Add latest changes from gitlab-org/gitlab@master

40 files changed, 290 insertions, 181 deletions

diff --git a/app/assets/javascripts/access_tokens/components/new_access_token_app.vue b/app/assets/javascripts/access_tokens/components/new_access_token_app.vue
index 12d695626d2..ce5342ad1ea 100644
--- a/app/assets/javascripts/access_tokens/components/new_access_token_app.vue
+++ b/app/assets/javascripts/access_tokens/components/new_access_token_app.vue
@@ -57,8 +57,8 @@ export default {
     /** @type {HTMLFormElement} */
     this.form = document.querySelector(FORM_SELECTOR);
 
-    /** @type {HTMLInputElement} */
-    this.submitButton = this.form.querySelector('input[type=submit]');
+    /** @type {HTMLButtonElement} */
+    this.submitButton = this.form.querySelector('[type=submit]');
   },
   methods: {
     beforeDisplayResults() {
@@ -75,6 +75,7 @@ export default {
       this.errors = errors;
 
       this.submitButton.classList.remove('disabled');
+      this.submitButton.removeAttribute('disabled');
     },
     onSuccess(event) {
       this.beforeDisplayResults();
@@ -84,7 +85,7 @@ export default {
 
       this.infoAlert = createAlert({ message: this.alertInfoMessage, variant: VARIANT_INFO });
 
-      // Selectively reset all input fields except for the date picker and submit.
+      // Selectively reset all input fields except for the date picker.
       // The form token creation is not controlled by Vue.
       this.form.querySelectorAll('input[type=text]:not([id$=expires_at])').forEach((el) => {
         el.value = '';
diff --git a/app/assets/javascripts/runner/group_runners/group_runners_app.vue b/app/assets/javascripts/runner/group_runners/group_runners_app.vue
index 7113e14a965..bc943c03a62 100644
--- a/app/assets/javascripts/runner/group_runners/group_runners_app.vue
+++ b/app/assets/javascripts/runner/group_runners/group_runners_app.vue
@@ -149,11 +149,6 @@ export default {
     isSearchFiltered() {
       return isSearchFiltered(this.search);
     },
-    shouldRenderAllAvailableToggle() {
-      // Feature flag for `runners_finder_all_available`
-      // See: https://gitlab.com/gitlab-org/gitlab/-/issues/374525
-      return this.glFeatures?.runnersFinderAllAvailable;
-    },
   },
   watch: {
     search: {
@@ -235,7 +230,6 @@ export default {
         class="gl-flex-grow-1 gl-align-self-stretch"
       />
       <runner-membership-toggle
-        v-if="shouldRenderAllAvailableToggle"
         v-model="search.membership"
         class="gl-align-self-end gl-md-align-self-center"
       />
diff --git a/app/assets/javascripts/task_list.js b/app/assets/javascripts/task_list.js
index 6e72d95c8e6..a7760ad5d0b 100644
--- a/app/assets/javascripts/task_list.js
+++ b/app/assets/javascripts/task_list.js
@@ -1,7 +1,7 @@
 import $ from 'jquery';
 import 'deckar01-task_list';
 import { __ } from '~/locale';
-import createFlash from './flash';
+import { createAlert } from '~/flash';
 import axios from './lib/utils/axios_utils';
 
 export default class TaskList {
@@ -23,7 +23,7 @@ export default class TaskList {
           errorMessages = e.response.data.errors.join(' ');
         }
 
-        return createFlash({
+        return createAlert({
           message: errorMessages || __('Update failed'),
         });
       };
diff --git a/app/assets/javascripts/token_access/components/token_access.vue b/app/assets/javascripts/token_access/components/token_access.vue
index edfb708b425..4b91872d80d 100644
--- a/app/assets/javascripts/token_access/components/token_access.vue
+++ b/app/assets/javascripts/token_access/components/token_access.vue
@@ -9,7 +9,7 @@ import {
   GlSprintf,
   GlToggle,
 } from '@gitlab/ui';
-import createFlash from '~/flash';
+import { createAlert } from '~/flash';
 import { __, s__ } from '~/locale';
 import { helpPagePath } from '~/helpers/help_page_helper';
 import addProjectCIJobTokenScopeMutation from '../graphql/mutations/add_project_ci_job_token_scope.mutation.graphql';
@@ -63,7 +63,7 @@ export default {
         return data.project.ciCdSettings.jobTokenScopeEnabled;
       },
       error() {
-        createFlash({ message: this.$options.i18n.scopeFetchError });
+        createAlert({ message: this.$options.i18n.scopeFetchError });
       },
     },
     projects: {
@@ -77,7 +77,7 @@ export default {
         return data.project?.ciJobTokenScope?.projects?.nodes ?? [];
       },
       error() {
-        createFlash({ message: this.$options.i18n.projectsFetchError });
+        createAlert({ message: this.$options.i18n.projectsFetchError });
       },
     },
   },
@@ -117,7 +117,7 @@ export default {
           throw new Error(errors[0]);
         }
       } catch (error) {
-        createFlash({ message: error });
+        createAlert({ message: error });
       }
     },
     async addProject() {
@@ -140,7 +140,7 @@ export default {
           throw new Error(errors[0]);
         }
       } catch (error) {
-        createFlash({ message: error });
+        createAlert({ message: error });
       } finally {
         this.clearTargetProjectPath();
         this.getProjects();
@@ -166,7 +166,7 @@ export default {
           throw new Error(errors[0]);
         }
       } catch (error) {
-        createFlash({ message: error });
+        createAlert({ message: error });
       } finally {
         this.getProjects();
       }
diff --git a/app/assets/javascripts/vue_merge_request_widget/components/approvals/approvals.vue b/app/assets/javascripts/vue_merge_request_widget/components/approvals/approvals.vue
index f782c28ea19..2cfeb7a4bcb 100644
--- a/app/assets/javascripts/vue_merge_request_widget/components/approvals/approvals.vue
+++ b/app/assets/javascripts/vue_merge_request_widget/components/approvals/approvals.vue
@@ -1,6 +1,6 @@
 <script>
 import { GlButton, GlSprintf, GlLink } from '@gitlab/ui';
-import createFlash from '~/flash';
+import { createAlert } from '~/flash';
 import { BV_SHOW_MODAL } from '~/lib/utils/constants';
 import glFeatureFlagsMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import { s__, __ } from '~/locale';
@@ -139,7 +139,7 @@ export default {
         this.fetchingApprovals = false;
       })
       .catch(() =>
-        createFlash({
+        createAlert({
           message: FETCH_ERROR,
         }),
       );
@@ -154,7 +154,7 @@ export default {
       this.updateApproval(
         () => this.service.approveMergeRequest(),
         () =>
-          createFlash({
+          createAlert({
             message: APPROVE_ERROR,
           }),
       );
@@ -167,7 +167,7 @@ export default {
             this.hasApprovalAuthError = true;
             return;
           }
-          createFlash({
+          createAlert({
             message: APPROVE_ERROR,
           });
         },
@@ -177,7 +177,7 @@ export default {
       this.updateApproval(
         () => this.service.unapproveMergeRequest(),
         () =>
-          createFlash({
+          createAlert({
             message: UNAPPROVE_ERROR,
           }),
       );
diff --git a/app/assets/javascripts/vue_merge_request_widget/components/deployment/deployment_actions.vue b/app/assets/javascripts/vue_merge_request_widget/components/deployment/deployment_actions.vue
index fbd0f6235ba..d6d1cae4029 100644
--- a/app/assets/javascripts/vue_merge_request_widget/components/deployment/deployment_actions.vue
+++ b/app/assets/javascripts/vue_merge_request_widget/components/deployment/deployment_actions.vue
@@ -1,5 +1,5 @@
 <script>
-import createFlash from '~/flash';
+import { createAlert } from '~/flash';
 import { confirmAction } from '~/lib/utils/confirm_via_gl_modal/confirm_via_gl_modal';
 import { visitUrl } from '~/lib/utils/url_utility';
 import { __, s__ } from '~/locale';
@@ -130,7 +130,7 @@ export default {
             }
           })
           .catch(() => {
-            createFlash({
+            createAlert({
               message: errorMessage,
             });
           })
diff --git a/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_auto_merge_enabled.vue b/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_auto_merge_enabled.vue
index 3c6c2a44e70..92a7fa39cdc 100644
--- a/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_auto_merge_enabled.vue
+++ b/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_auto_merge_enabled.vue
@@ -2,7 +2,7 @@
 import { GlSkeletonLoader, GlSprintf } from '@gitlab/ui';
 import autoMergeMixin from 'ee_else_ce/vue_merge_request_widget/mixins/auto_merge';
 import autoMergeEnabledQuery from 'ee_else_ce/vue_merge_request_widget/queries/states/auto_merge_enabled.query.graphql';
-import createFlash from '~/flash';
+import { createAlert } from '~/flash';
 import { __ } from '~/locale';
 import glFeatureFlagMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import { AUTO_MERGE_STRATEGIES } from '../../constants';
@@ -113,7 +113,7 @@ export default {
         })
         .catch(() => {
           this.isCancellingAutoMerge = false;
-          createFlash({
+          createAlert({
             message: __('Something went wrong. Please try again.'),
           });
         });
@@ -141,7 +141,7 @@ export default {
         })
         .catch(() => {
           this.isRemovingSourceBranch = false;
-          createFlash({
+          createAlert({
             message: __('Something went wrong. Please try again.'),
           });
         });
diff --git a/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_merged.vue b/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_merged.vue
index e9298b0c856..46392565088 100644
--- a/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_merged.vue
+++ b/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_merged.vue
@@ -1,7 +1,7 @@
 <script>
 import { GlTooltipDirective } from '@gitlab/ui';
 import api from '~/api';
-import createFlash from '~/flash';
+import { createAlert } from '~/flash';
 import { s__, __ } from '~/locale';
 import { OPEN_REVERT_MODAL, OPEN_CHERRY_PICK_MODAL } from '~/projects/commit/constants';
 import modalEventHub from '~/projects/commit/event_hub';
@@ -131,7 +131,7 @@ export default {
         })
         .catch(() => {
           this.isMakingRequest = false;
-          createFlash({
+          createAlert({
             message: __('Something went wrong. Please try again.'),
           });
         });
diff --git a/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_rebase.vue b/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_rebase.vue
index 37c8d5d15f3..f6843c1f3d3 100644
--- a/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_rebase.vue
+++ b/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_rebase.vue
@@ -1,6 +1,6 @@
 <script>
 import { GlButton, GlSkeletonLoader } from '@gitlab/ui';
-import createFlash from '~/flash';
+import { createAlert } from '~/flash';
 import { __ } from '~/locale';
 import glFeatureFlagMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import toast from '~/vue_shared/plugins/global_toast';
@@ -111,7 +111,7 @@ export default {
           if (error.response && error.response.data && error.response.data.merge_error) {
             this.rebasingError = error.response.data.merge_error;
           } else {
-            createFlash({
+            createAlert({
               message: __('Something went wrong. Please try again.'),
             });
           }
@@ -142,7 +142,7 @@ export default {
         })
         .catch(() => {
           this.isMakingRequest = false;
-          createFlash({
+          createAlert({
             message: __('Something went wrong. Please try again.'),
           });
           stopPolling();
diff --git a/app/assets/javascripts/vue_merge_request_widget/components/states/ready_to_merge.vue b/app/assets/javascripts/vue_merge_request_widget/components/states/ready_to_merge.vue
index c5ea336bd96..1298c1316e2 100644
--- a/app/assets/javascripts/vue_merge_request_widget/components/states/ready_to_merge.vue
+++ b/app/assets/javascripts/vue_merge_request_widget/components/states/ready_to_merge.vue
@@ -14,7 +14,7 @@ import {
 import { isEmpty } from 'lodash';
 import readyToMergeMixin from 'ee_else_ce/vue_merge_request_widget/mixins/ready_to_merge';
 import readyToMergeQuery from 'ee_else_ce/vue_merge_request_widget/queries/states/ready_to_merge.query.graphql';
-import createFlash from '~/flash';
+import { createAlert } from '~/flash';
 import { secondsToMilliseconds } from '~/lib/utils/datetime_utility';
 import simplePoll from '~/lib/utils/simple_poll';
 import { __, s__, n__ } from '~/locale';
@@ -444,7 +444,7 @@ export default {
         .catch(() => {
           this.isMakingRequest = false;
           this.mr.transitionStateMachine({ transition: MERGE_FAILURE });
-          createFlash({
+          createAlert({
             message: __('Something went wrong. Please try again.'),
           });
         });
@@ -488,7 +488,7 @@ export default {
           }
         })
         .catch(() => {
-          createFlash({
+          createAlert({
             message: __('Something went wrong while deleting the source branch. Please try again.'),
           });
         });
diff --git a/app/assets/javascripts/vue_merge_request_widget/components/states/work_in_progress.vue b/app/assets/javascripts/vue_merge_request_widget/components/states/work_in_progress.vue
index 0458e9dfaf5..dee27a5d5b5 100644
--- a/app/assets/javascripts/vue_merge_request_widget/components/states/work_in_progress.vue
+++ b/app/assets/javascripts/vue_merge_request_widget/components/states/work_in_progress.vue
@@ -2,7 +2,7 @@
 import { GlButton } from '@gitlab/ui';
 import { produce } from 'immer';
 import $ from 'jquery';
-import createFlash from '~/flash';
+import { createAlert } from '~/flash';
 import toast from '~/vue_shared/plugins/global_toast';
 import { __ } from '~/locale';
 import MergeRequest from '~/merge_request';
@@ -77,7 +77,7 @@ export default {
             },
           ) {
             if (errors?.length) {
-              createFlash({
+              createAlert({
                 message: __('Something went wrong. Please try again.'),
               });
 
@@ -130,7 +130,7 @@ export default {
           },
         )
         .catch(() =>
-          createFlash({
+          createAlert({
             message: __('Something went wrong. Please try again.'),
           }),
         )
@@ -152,7 +152,7 @@ export default {
           })
           .catch(() => {
             this.isMakingRequest = false;
-            createFlash({
+            createAlert({
               message: __('Something went wrong. Please try again.'),
             });
           });
diff --git a/app/assets/javascripts/vue_merge_request_widget/mr_widget_options.vue b/app/assets/javascripts/vue_merge_request_widget/mr_widget_options.vue
index 2d9549fdada..a3f70b551bf 100644
--- a/app/assets/javascripts/vue_merge_request_widget/mr_widget_options.vue
+++ b/app/assets/javascripts/vue_merge_request_widget/mr_widget_options.vue
@@ -6,7 +6,7 @@ import MrWidgetApprovals from 'ee_else_ce/vue_merge_request_widget/components/ap
 import MRWidgetService from 'ee_else_ce/vue_merge_request_widget/services/mr_widget_service';
 import MRWidgetStore from 'ee_else_ce/vue_merge_request_widget/stores/mr_widget_store';
 import { stateToComponentMap as classState } from 'ee_else_ce/vue_merge_request_widget/stores/state_maps';
-import createFlash from '~/flash';
+import { createAlert } from '~/flash';
 import { secondsToMilliseconds } from '~/lib/utils/datetime_utility';
 import notify from '~/lib/utils/notify';
 import { sprintf, s__, __ } from '~/locale';
@@ -267,7 +267,7 @@ export default {
         this.initWidget(data);
       })
       .catch(() =>
-        createFlash({
+        createAlert({
           message: __('Unable to load the merge request widget. Try reloading the page.'),
         }),
       );
@@ -359,7 +359,7 @@ export default {
           }
         })
         .catch(() =>
-          createFlash({
+          createAlert({
             message: __('Something went wrong. Please try again.'),
           }),
         );
@@ -418,7 +418,7 @@ export default {
         .catch(() => this.throwDeploymentsError());
     },
     throwDeploymentsError() {
-      createFlash({
+      createAlert({
         message: __(
           'Something went wrong while fetching the environments for this merge request. Please try again.',
         ),
@@ -438,7 +438,7 @@ export default {
           }
         })
         .catch(() =>
-          createFlash({
+          createAlert({
             message: __('Something went wrong. Please try again.'),
           }),
         );
diff --git a/app/controllers/concerns/access_tokens_actions.rb b/app/controllers/concerns/access_tokens_actions.rb
index 451841c43bb..6e43be5594d 100644
--- a/app/controllers/concerns/access_tokens_actions.rb
+++ b/app/controllers/concerns/access_tokens_actions.rb
@@ -22,11 +22,10 @@ module AccessTokensActions
 
     if token_response.success?
       @resource_access_token = token_response.payload[:access_token]
-      PersonalAccessToken.redis_store!(key_identity, @resource_access_token.token)
-
-      redirect_to resource_access_tokens_path, notice: _("Your new access token has been created.")
+      render json: { new_token: @resource_access_token.token,
+                     active_access_tokens: active_resource_access_tokens }, status: :ok
     else
-      redirect_to resource_access_tokens_path, alert: _("Failed to create new access token: %{token_response_message}") % { token_response_message: token_response.message }
+      render json: { errors: token_response.errors }, status: :unprocessable_entity
     end
   end
   # rubocop:enable Gitlab/ModuleWithInstanceVariables
@@ -63,12 +62,15 @@ module AccessTokensActions
     resource.members.load
 
     @scopes = Gitlab::Auth.resource_bot_scopes
-    @active_resource_access_tokens = finder(state: 'active').execute.preload_users
-    @inactive_resource_access_tokens = finder(state: 'inactive', sort: 'expires_at_asc').execute.preload_users
-    @new_resource_access_token = PersonalAccessToken.redis_getdel(key_identity)
+    @active_resource_access_tokens = active_resource_access_tokens
   end
   # rubocop:enable Gitlab/ModuleWithInstanceVariables
 
+  def active_resource_access_tokens
+    tokens = finder(state: 'active', sort: 'expires_at_asc_id_desc').execute.preload_users
+    represent(tokens)
+  end
+
   def finder(options = {})
     PersonalAccessTokensFinder.new({ user: bot_users, impersonation: false }.merge(options))
   end
diff --git a/app/controllers/groups/runners_controller.rb b/app/controllers/groups/runners_controller.rb
index 4aa4256b044..01c1529e831 100644
--- a/app/controllers/groups/runners_controller.rb
+++ b/app/controllers/groups/runners_controller.rb
@@ -5,10 +5,6 @@ class Groups::RunnersController < Groups::ApplicationController
   before_action :authorize_update_runner!, only: [:edit, :update, :destroy, :pause, :resume]
   before_action :runner, only: [:edit, :update, :destroy, :pause, :resume, :show]
 
-  before_action do
-    push_frontend_feature_flag(:runners_finder_all_available, @group)
-  end
-
   before_action only: [:show] do
     push_frontend_feature_flag(:enforce_runner_token_expires_at)
   end
@@ -41,8 +37,7 @@ class Groups::RunnersController < Groups::ApplicationController
   private
 
   def runner
-    group_params = { group: @group }
-    group_params[:membership] = :all_available if Feature.enabled?(:runners_finder_all_available, @group)
+    group_params = { group: @group, membership: :all_available }
 
     @runner ||= Ci::RunnersFinder.new(current_user: current_user, params: group_params).execute
       .except(:limit, :offset)
diff --git a/app/controllers/groups/settings/access_tokens_controller.rb b/app/controllers/groups/settings/access_tokens_controller.rb
index b9ab2e008cc..f01b2b779e3 100644
--- a/app/controllers/groups/settings/access_tokens_controller.rb
+++ b/app/controllers/groups/settings/access_tokens_controller.rb
@@ -13,6 +13,12 @@ module Groups
       def resource_access_tokens_path
         group_settings_access_tokens_path
       end
+
+      private
+
+      def represent(tokens)
+        ::GroupAccessTokenSerializer.new.represent(tokens, group: resource)
+      end
     end
   end
 end
diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb
index 8963b84e6d8..269342a6c22 100644
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -81,9 +81,9 @@ class GroupsController < Groups::ApplicationController
       successful_creation_hooks
 
       notice = if @group.chat_team.present?
-                 "Group '#{@group.name}' and its Mattermost team were successfully created."
+                 format(_("Group %{group_name} and its Mattermost team were successfully created."), group_name: @group.name)
                else
-                 "Group '#{@group.name}' was successfully created."
+                 format(_("Group %{group_name} was successfully created."), group_name: @group.name)
                end
 
       redirect_to @group, notice: notice
diff --git a/app/controllers/projects/settings/access_tokens_controller.rb b/app/controllers/projects/settings/access_tokens_controller.rb
index 32916831ecd..bac35583a97 100644
--- a/app/controllers/projects/settings/access_tokens_controller.rb
+++ b/app/controllers/projects/settings/access_tokens_controller.rb
@@ -13,6 +13,12 @@ module Projects
       def resource_access_tokens_path
         namespace_project_settings_access_tokens_path
       end
+
+      private
+
+      def represent(tokens)
+        ::ProjectAccessTokenSerializer.new.represent(tokens, project: resource)
+      end
     end
   end
 end
diff --git a/app/controllers/users/namespace_callouts_controller.rb b/app/controllers/users/namespace_callouts_controller.rb
deleted file mode 100644
index d4876382dfe..00000000000
--- a/app/controllers/users/namespace_callouts_controller.rb
+++ /dev/null
@@ -1,17 +0,0 @@
-# frozen_string_literal: true
-
-module Users
-  class NamespaceCalloutsController < Users::CalloutsController
-    private
-
-    def callout
-      Users::DismissNamespaceCalloutService.new(
-        container: nil, current_user: current_user, params: callout_params
-      ).execute
-    end
-
-    def callout_params
-      params.permit(:namespace_id).merge(feature_name: feature_name)
-    end
-  end
-end
diff --git a/app/events/projects/project_features_changed_event.rb b/app/events/projects/project_features_changed_event.rb
index fe44130ab13..a0c6fa1a3f9 100644
--- a/app/events/projects/project_features_changed_event.rb
+++ b/app/events/projects/project_features_changed_event.rb
@@ -14,5 +14,9 @@ module Projects
         'required' => %w[project_id namespace_id root_namespace_id features]
       }
     end
+
+    def pages_related?
+      data[:features].include?("pages_access_level")
+    end
   end
 end
diff --git a/app/graphql/mutations/namespace/package_settings/update.rb b/app/graphql/mutations/namespace/package_settings/update.rb
index e499e646781..ea72b71715c 100644
--- a/app/graphql/mutations/namespace/package_settings/update.rb
+++ b/app/graphql/mutations/namespace/package_settings/update.rb
@@ -35,6 +35,36 @@ module Mutations
                 required: false,
                 description: copy_field_description(Types::Namespace::PackageSettingsType, :generic_duplicate_exception_regex)
 
+        argument :maven_package_requests_forwarding,
+                GraphQL::Types::Boolean,
+                required: false,
+                description: copy_field_description(Types::Namespace::PackageSettingsType, :maven_package_requests_forwarding)
+
+        argument :npm_package_requests_forwarding,
+                GraphQL::Types::Boolean,
+                required: false,
+                description: copy_field_description(Types::Namespace::PackageSettingsType, :npm_package_requests_forwarding)
+
+        argument :pypi_package_requests_forwarding,
+                GraphQL::Types::Boolean,
+                required: false,
+                description: copy_field_description(Types::Namespace::PackageSettingsType, :pypi_package_requests_forwarding)
+
+        argument :lock_maven_package_requests_forwarding,
+                GraphQL::Types::Boolean,
+                required: false,
+                description: copy_field_description(Types::Namespace::PackageSettingsType, :lock_maven_package_requests_forwarding)
+
+        argument :lock_npm_package_requests_forwarding,
+                GraphQL::Types::Boolean,
+                required: false,
+                description: copy_field_description(Types::Namespace::PackageSettingsType, :lock_npm_package_requests_forwarding)
+
+        argument :lock_pypi_package_requests_forwarding,
+                GraphQL::Types::Boolean,
+                required: false,
+                description: copy_field_description(Types::Namespace::PackageSettingsType, :lock_pypi_package_requests_forwarding)
+
         field :package_settings,
               Types::Namespace::PackageSettingsType,
               null: true,
diff --git a/app/graphql/types/ci/runner_membership_filter_enum.rb b/app/graphql/types/ci/runner_membership_filter_enum.rb
index 5c895ebcb48..d59a68b427b 100644
--- a/app/graphql/types/ci/runner_membership_filter_enum.rb
+++ b/app/graphql/types/ci/runner_membership_filter_enum.rb
@@ -19,8 +19,7 @@ module Types
       value 'ALL_AVAILABLE',
             description:
                            "Include all runners. This list includes runners for all projects in the group " \
-                           "and subgroups, as well as for the parent groups and instance. " \
-                           "Will not return runners if `runners_finder_all_available` feature flag is disabled.",
+                           "and subgroups, as well as for the parent groups and instance.",
             value: :all_available,
             deprecated: { milestone: '15.5', reason: :alpha }
     end
diff --git a/app/graphql/types/namespace/package_settings_type.rb b/app/graphql/types/namespace/package_settings_type.rb
index 7a0abe619a5..84becba8001 100644
--- a/app/graphql/types/namespace/package_settings_type.rb
+++ b/app/graphql/types/namespace/package_settings_type.rb
@@ -8,9 +8,50 @@ module Types
 
     authorize :admin_package
 
-    field :generic_duplicate_exception_regex, Types::UntrustedRegexp, null: true, description: 'When generic_duplicates_allowed is false, you can publish duplicate packages with names that match this regex. Otherwise, this setting has no effect.'
-    field :generic_duplicates_allowed, GraphQL::Types::Boolean, null: false, description: 'Indicates whether duplicate generic packages are allowed for this namespace.'
-    field :maven_duplicate_exception_regex, Types::UntrustedRegexp, null: true, description: 'When maven_duplicates_allowed is false, you can publish duplicate packages with names that match this regex. Otherwise, this setting has no effect.'
-    field :maven_duplicates_allowed, GraphQL::Types::Boolean, null: false, description: 'Indicates whether duplicate Maven packages are allowed for this namespace.'
+    field :generic_duplicate_exception_regex, Types::UntrustedRegexp,
+      null: true,
+      description: 'When generic_duplicates_allowed is false, you can publish duplicate packages with names that match this regex. Otherwise, this setting has no effect.'
+    field :generic_duplicates_allowed, GraphQL::Types::Boolean,
+      null: false,
+      description: 'Indicates whether duplicate generic packages are allowed for this namespace.'
+    field :maven_duplicate_exception_regex, Types::UntrustedRegexp,
+      null: true,
+      description: 'When maven_duplicates_allowed is false, you can publish duplicate packages with names that match this regex. Otherwise, this setting has no effect.'
+    field :maven_duplicates_allowed, GraphQL::Types::Boolean,
+      null: false,
+      description: 'Indicates whether duplicate Maven packages are allowed for this namespace.'
+
+    field :maven_package_requests_forwarding, GraphQL::Types::Boolean,
+      null: true,
+      description: 'Indicates whether Maven package forwarding is allowed for this namespace.'
+    field :npm_package_requests_forwarding, GraphQL::Types::Boolean,
+      null: true,
+      description: 'Indicates whether npm package forwarding is allowed for this namespace.'
+    field :pypi_package_requests_forwarding, GraphQL::Types::Boolean,
+      null: true,
+      description: 'Indicates whether PyPI package forwarding is allowed for this namespace.'
+
+    field :lock_maven_package_requests_forwarding, GraphQL::Types::Boolean,
+      null: false,
+      description: 'Indicates whether Maven package forwarding is locked for all descendent namespaces.'
+    field :lock_npm_package_requests_forwarding, GraphQL::Types::Boolean,
+      null: false,
+      description: 'Indicates whether npm package forwarding is locked for all descendent namespaces.'
+    field :lock_pypi_package_requests_forwarding, GraphQL::Types::Boolean,
+      null: false,
+      description: 'Indicates whether PyPI package forwarding is locked for all descendent namespaces.'
+
+    field :maven_package_requests_forwarding_locked, GraphQL::Types::Boolean,
+      null: false,
+      method: :maven_package_requests_forwarding_locked?,
+      description: 'Indicates whether Maven package forwarding settings are locked by a parent namespace.'
+    field :npm_package_requests_forwarding_locked, GraphQL::Types::Boolean,
+      null: false,
+      method: :npm_package_requests_forwarding_locked?,
+      description: 'Indicates whether npm package forwarding settings are locked by a parent namespace.'
+    field :pypi_package_requests_forwarding_locked, GraphQL::Types::Boolean,
+      null: false,
+      method: :pypi_package_requests_forwarding_locked?,
+      description: 'Indicates whether PyPI package forwarding settings are locked by a parent namespace.'
   end
 end
diff --git a/app/helpers/events_helper.rb b/app/helpers/events_helper.rb
index bcddb889cf4..b717cbcc312 100644
--- a/app/helpers/events_helper.rb
+++ b/app/helpers/events_helper.rb
@@ -16,6 +16,54 @@ module EventsHelper
     'joined' => 'users'
   }.freeze
 
+  def localized_action_name_map
+    {
+      accepted: s_('Event|accepted'),
+      approved: s_('Event|approved'),
+      closed: s_('Event|closed'),
+      'commented on': s_('Event|commented on'),
+      created: s_('Event|created'),
+      destroyed: s_('Event|destroyed'),
+      joined: s_('Event|joined'),
+      left: s_('Event|left'),
+      opened: s_('Event|opened'),
+      updated: s_('Event|updated'),
+      'removed due to membership expiration from': s_('Event|removed due to membership expiration from')
+    }.merge(localized_push_action_name_map,
+            localized_created_project_action_name_map,
+            localized_design_action_names
+           ).freeze
+  end
+
+  def localized_push_action_name_map
+    {
+      'pushed new': s_('Event|pushed new'),
+      deleted: s_('Event|deleted'),
+      'pushed to': s_('Event|pushed to')
+    }.freeze
+  end
+
+  def localized_created_project_action_name_map
+    {
+      created: s_('Event|created'),
+      imported: s_('Event|imported')
+    }.freeze
+  end
+
+  def localized_design_action_names
+    {
+      added: s_('Event|added'),
+      updated: s_('Event|updated'),
+      removed: s_('Event|removed')
+    }.freeze
+  end
+
+  def localized_action_name(event)
+    action_name = event.action_name
+    # The action fallback is used to cover the types were not included in the maps.
+    localized_action_name_map[action_name.to_sym] || action_name
+  end
+
   def link_to_author(event, self_added: false)
     author = event.author
 
diff --git a/app/models/event.rb b/app/models/event.rb
index 215d330ed27..74c3367f4b2 100644
--- a/app/models/event.rb
+++ b/app/models/event.rb
@@ -280,6 +280,7 @@ class Event < ApplicationRecord
       "opened"
     end
   end
+
   # rubocop: enable Metrics/CyclomaticComplexity
   # rubocop: enable Metrics/PerceivedComplexity
 
@@ -447,9 +448,9 @@ class Event < ApplicationRecord
 
   def design_action_names
     {
-      created: _('added'),
-      updated: _('updated'),
-      destroyed: _('removed')
+      created: 'added',
+      updated: 'updated',
+      destroyed: 'removed'
     }
   end
 
diff --git a/app/models/namespace/detail.rb b/app/models/namespace/detail.rb
index dbbf9f4944a..a5643ab9f79 100644
--- a/app/models/namespace/detail.rb
+++ b/app/models/namespace/detail.rb
@@ -1,6 +1,10 @@
 # frozen_string_literal: true
 
 class Namespace::Detail < ApplicationRecord
+  include IgnorableColumns
+
+  ignore_column :free_user_cap_over_limt_notified_at, remove_with: '15.7', remove_after: '2022-11-22'
+
   belongs_to :namespace, inverse_of: :namespace_details
   validates :namespace, presence: true
   validates :description, length: { maximum: 255 }
diff --git a/app/models/user.rb b/app/models/user.rb
index b2f75959f15..dc2f7ff5b5e 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -232,7 +232,6 @@ class User < ApplicationRecord
   has_many :callouts, class_name: 'Users::Callout'
   has_many :group_callouts, class_name: 'Users::GroupCallout'
   has_many :project_callouts, class_name: 'Users::ProjectCallout'
-  has_many :namespace_callouts, class_name: 'Users::NamespaceCallout'
   has_many :term_agreements
   belongs_to :accepted_term, class_name: 'ApplicationSetting::Term'
 
@@ -2098,14 +2097,6 @@ class User < ApplicationRecord
     callout_dismissed?(callout, ignore_dismissal_earlier_than)
   end
 
-  # Deprecated: do not use. See: https://gitlab.com/gitlab-org/gitlab/-/issues/371017
-  def dismissed_callout_for_namespace?(feature_name:, namespace:, ignore_dismissal_earlier_than: nil)
-    source_feature_name = "#{feature_name}_#{namespace.id}"
-    callout = namespace_callouts_by_feature_name[source_feature_name]
-
-    callout_dismissed?(callout, ignore_dismissal_earlier_than)
-  end
-
   def dismissed_callout_for_project?(feature_name:, project:, ignore_dismissal_earlier_than: nil)
     callout = project_callouts.find_by(feature_name: feature_name, project: project)
 
@@ -2138,11 +2129,6 @@ class User < ApplicationRecord
       .find_or_initialize_by(feature_name: ::Users::GroupCallout.feature_names[feature_name], group_id: group_id)
   end
 
-  def find_or_initialize_namespace_callout(feature_name, namespace_id)
-    namespace_callouts
-      .find_or_initialize_by(feature_name: ::Users::NamespaceCallout.feature_names[feature_name], namespace_id: namespace_id)
-  end
-
   def find_or_initialize_project_callout(feature_name, project_id)
     project_callouts
       .find_or_initialize_by(feature_name: ::Users::ProjectCallout.feature_names[feature_name], project_id: project_id)
@@ -2275,10 +2261,6 @@ class User < ApplicationRecord
     @group_callouts_by_feature_name ||= group_callouts.index_by(&:source_feature_name)
   end
 
-  def namespace_callouts_by_feature_name
-    @namespace_callouts_by_feature_name ||= namespace_callouts.index_by(&:source_feature_name)
-  end
-
   def authorized_groups_without_shared_membership
     Group.from_union(
       [
diff --git a/app/models/users/namespace_callout.rb b/app/models/users/namespace_callout.rb
deleted file mode 100644
index 4e655a96b57..00000000000
--- a/app/models/users/namespace_callout.rb
+++ /dev/null
@@ -1,33 +0,0 @@
-# frozen_string_literal: true
-
-module Users
-  class NamespaceCallout < ApplicationRecord
-    include Users::Calloutable
-
-    self.table_name = 'user_namespace_callouts'
-
-    belongs_to :namespace
-
-    enum feature_name: {
-      invite_members_banner: 1,
-      approaching_seat_count_threshold: 2, # EE-only
-      storage_enforcement_banner_first_enforcement_threshold: 3, # EE-only
-      storage_enforcement_banner_second_enforcement_threshold: 4, # EE-only
-      storage_enforcement_banner_third_enforcement_threshold: 5, # EE-only
-      storage_enforcement_banner_fourth_enforcement_threshold: 6, # EE-only
-      preview_user_over_limit_free_plan_alert: 7, # EE-only
-      user_reached_limit_free_plan_alert: 8, # EE-only
-      web_hook_disabled: 9
-    }
-
-    validates :namespace, presence: true
-    validates :feature_name,
-              presence: true,
-              uniqueness: { scope: [:user_id, :namespace_id] },
-              inclusion: { in: NamespaceCallout.feature_names.keys }
-
-    def source_feature_name
-      "#{feature_name}_#{namespace_id}"
-    end
-  end
-end
diff --git a/app/models/users/project_callout.rb b/app/models/users/project_callout.rb
index 98dacbe394a..c73b3a4ee71 100644
--- a/app/models/users/project_callout.rb
+++ b/app/models/users/project_callout.rb
@@ -11,7 +11,11 @@ module Users
     enum feature_name: {
       awaiting_members_banner: 1, # EE-only
       web_hook_disabled: 2,
-      ultimate_feature_removal_banner: 3
+      ultimate_feature_removal_banner: 3,
+      storage_enforcement_banner_first_enforcement_threshold: 4, # EE-only
+      storage_enforcement_banner_second_enforcement_threshold: 5, # EE-only
+      storage_enforcement_banner_third_enforcement_threshold: 6, # EE-only
+      storage_enforcement_banner_fourth_enforcement_threshold: 7 # EE-only
     }
 
     validates :project, presence: true
diff --git a/app/policies/group_policy.rb b/app/policies/group_policy.rb
index d9aa204399e..7a0fb10928a 100644
--- a/app/policies/group_policy.rb
+++ b/app/policies/group_policy.rb
@@ -87,10 +87,6 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy
     Gitlab::CurrentSettings.valid_runner_registrars.include?('group')
   end
 
-  condition(:runners_finder_all_available, scope: :subject) do
-    Feature.enabled?(:runners_finder_all_available, group)
-  end
-
   rule { can?(:read_group) & design_management_enabled }.policy do
     enable :read_design_activity
   end
@@ -158,8 +154,6 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy
     enable :read_group_all_available_runners
   end
 
-  rule { ~runners_finder_all_available }.prevent :read_group_all_available_runners
-
   rule { reporter }.policy do
     enable :reporter_access
     enable :read_container_image
diff --git a/app/serializers/group_access_token_entity.rb b/app/serializers/group_access_token_entity.rb
index ab1fbb8ab46..83e8284e4e2 100644
--- a/app/serializers/group_access_token_entity.rb
+++ b/app/serializers/group_access_token_entity.rb
@@ -11,7 +11,7 @@ class GroupAccessTokenEntity < AccessTokenEntityBase
 
     revoke_group_settings_access_token_path(
       id: token,
-      group_id: group.path)
+      group_id: group.full_path)
   end
 
   expose :role do |token, options|
diff --git a/app/serializers/project_access_token_entity.rb b/app/serializers/project_access_token_entity.rb
index 52bb7b05d4e..548fb24173a 100644
--- a/app/serializers/project_access_token_entity.rb
+++ b/app/serializers/project_access_token_entity.rb
@@ -11,7 +11,7 @@ class ProjectAccessTokenEntity < AccessTokenEntityBase
 
     revoke_namespace_project_settings_access_token_path(
       id: token,
-      namespace_id: project.namespace.path,
+      namespace_id: project.namespace.full_path,
       project_id: project.path)
   end
 
diff --git a/app/services/namespaces/package_settings/update_service.rb b/app/services/namespaces/package_settings/update_service.rb
index c0af0900450..0c6fcee9113 100644
--- a/app/services/namespaces/package_settings/update_service.rb
+++ b/app/services/namespaces/package_settings/update_service.rb
@@ -8,7 +8,13 @@ module Namespaces
       ALLOWED_ATTRIBUTES = %i[maven_duplicates_allowed
                               maven_duplicate_exception_regex
                               generic_duplicates_allowed
-                              generic_duplicate_exception_regex].freeze
+                              generic_duplicate_exception_regex
+                              maven_package_requests_forwarding
+                              npm_package_requests_forwarding
+                              pypi_package_requests_forwarding
+                              lock_maven_package_requests_forwarding
+                              lock_npm_package_requests_forwarding
+                              lock_pypi_package_requests_forwarding].freeze
 
       def execute
         return ServiceResponse.error(message: 'Access Denied', http_status: 403) unless allowed?
diff --git a/app/services/users/dismiss_namespace_callout_service.rb b/app/services/users/dismiss_namespace_callout_service.rb
deleted file mode 100644
index 51261a93e20..00000000000
--- a/app/services/users/dismiss_namespace_callout_service.rb
+++ /dev/null
@@ -1,11 +0,0 @@
-# frozen_string_literal: true
-
-module Users
-  class DismissNamespaceCalloutService < DismissCalloutService
-    private
-
-    def callout
-      current_user.find_or_initialize_namespace_callout(params[:feature_name], params[:namespace_id])
-    end
-  end
-end
diff --git a/app/views/events/event/_common.html.haml b/app/views/events/event/_common.html.haml
index 1f6ac29bffc..7ef3461a7fb 100644
--- a/app/views/events/event/_common.html.haml
+++ b/app/views/events/event/_common.html.haml
@@ -6,7 +6,7 @@
   = inline_event_icon(event)
   - if event.target
     %span.event-type.d-inline-block.gl-mr-2{ class: event.action_name }
-      = event.action_name
+      = localized_action_name(event)
     %span.event-target-type.gl-mr-2= event.target_type_name
     = link_to event_target_path(event), class: 'has-tooltip event-target-link gl-mr-2', title: event.target_title do
       = event.target.reference_link_text
diff --git a/app/views/groups/settings/access_tokens/index.html.haml b/app/views/groups/settings/access_tokens/index.html.haml
index 43bdc7de22b..5e3d814687e 100644
--- a/app/views/groups/settings/access_tokens/index.html.haml
+++ b/app/views/groups/settings/access_tokens/index.html.haml
@@ -24,13 +24,11 @@
         = _('You can enable group access token creation in %{link_start}group settings%{link_end}.').html_safe % { link_start: link_start, link_end: '</a>'.html_safe }
 
   .col-lg-8
-    - if @new_resource_access_token
-      = render 'shared/access_tokens/created_container',
-          type: type,
-          new_token_value: @new_resource_access_token
+    #js-new-access-token-app{ data: { access_token_type: type } }
 
     - if current_user.can?(:create_resource_access_tokens, @group)
       = render 'shared/access_tokens/form',
+          ajax: true,
           type: type,
           path: group_settings_access_tokens_path(@group),
           resource: @group,
@@ -41,10 +39,6 @@
           prefix: :resource_access_token,
           help_path: help_page_path('user/group/settings/group_access_tokens', anchor: 'scopes-for-a-group-access-token')
 
-    = render 'shared/access_tokens/table',
-        active_tokens: @active_resource_access_tokens,
-        resource: @group,
-        type: type,
-        type_plural: type_plural,
-        revoke_route_helper: ->(token) { revoke_group_settings_access_token_path(id: token) },
-        no_active_tokens_message: _('This group has no active access tokens.')
+    #js-access-token-table-app{ data: { access_token_type: type, access_token_type_plural: type_plural, initial_active_access_tokens: @active_resource_access_tokens.to_json, no_active_tokens_message: _('This group has no active access tokens.'), show_role: true
+ } }
+
diff --git a/app/views/projects/settings/access_tokens/index.html.haml b/app/views/projects/settings/access_tokens/index.html.haml
index fe3ab3f1448..9f598ffb2d1 100644
--- a/app/views/projects/settings/access_tokens/index.html.haml
+++ b/app/views/projects/settings/access_tokens/index.html.haml
@@ -24,13 +24,11 @@
         = _('You can enable project access token creation in %{link_start}group settings%{link_end}.').html_safe % { link_start: link_start, link_end: '</a>'.html_safe }
 
   .col-lg-8
-    - if @new_resource_access_token
-      = render 'shared/access_tokens/created_container',
-          type: type,
-          new_token_value: @new_resource_access_token
+    #js-new-access-token-app{ data: { access_token_type: type } }
 
     - if current_user.can?(:create_resource_access_tokens, @project)
       = render 'shared/access_tokens/form',
+          ajax: true,
           type: type,
           path: project_settings_access_tokens_path(@project),
           resource: @project,
@@ -42,10 +40,5 @@
           description_prefix: :project_access_token,
           help_path: help_page_path('user/project/settings/project_access_tokens', anchor: 'scopes-for-a-project-access-token')
 
-    = render 'shared/access_tokens/table',
-        active_tokens: @active_resource_access_tokens,
-        resource: @project,
-        type: type,
-        type_plural: type_plural,
-        revoke_route_helper: ->(token) { revoke_namespace_project_settings_access_token_path(id: token) },
-        no_active_tokens_message: _('This project has no active access tokens.')
+    #js-access-token-table-app{ data: { access_token_type: type, access_token_type_plural: type_plural, initial_active_access_tokens: @active_resource_access_tokens.to_json, no_active_tokens_message: _('This project has no active access tokens.'), show_role: true
+ } }
diff --git a/app/workers/all_queues.yml b/app/workers/all_queues.yml
index fcd37c43cb3..0624197183c 100644
--- a/app/workers/all_queues.yml
+++ b/app/workers/all_queues.yml
@@ -1020,6 +1020,24 @@
   :weight: 1
   :idempotent: false
   :tags: []
+- :name: github_importer:github_import_attachments_import_issue
+  :worker_name: Gitlab::GithubImport::Attachments::ImportIssueWorker
+  :feature_category: :importers
+  :has_external_dependencies: true
+  :urgency: :low
+  :resource_boundary: :unknown
+  :weight: 1
+  :idempotent: false
+  :tags: []
+- :name: github_importer:github_import_attachments_import_merge_request
+  :worker_name: Gitlab::GithubImport::Attachments::ImportMergeRequestWorker
+  :feature_category: :importers
+  :has_external_dependencies: true
+  :urgency: :low
+  :resource_boundary: :unknown
+  :weight: 1
+  :idempotent: false
+  :tags: []
 - :name: github_importer:github_import_attachments_import_note
   :worker_name: Gitlab::GithubImport::Attachments::ImportNoteWorker
   :feature_category: :importers
diff --git a/app/workers/gitlab/github_import/attachments/import_issue_worker.rb b/app/workers/gitlab/github_import/attachments/import_issue_worker.rb
new file mode 100644
index 00000000000..1a9fa15b850
--- /dev/null
+++ b/app/workers/gitlab/github_import/attachments/import_issue_worker.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module GithubImport
+    module Attachments
+      class ImportIssueWorker # rubocop:disable Scalability/IdempotentWorker
+        include ObjectImporter
+
+        def representation_class
+          Representation::NoteText
+        end
+
+        def importer_class
+          Importer::NoteAttachmentsImporter
+        end
+
+        def object_type
+          :issue_attachment
+        end
+      end
+    end
+  end
+end
diff --git a/app/workers/gitlab/github_import/attachments/import_merge_request_worker.rb b/app/workers/gitlab/github_import/attachments/import_merge_request_worker.rb
new file mode 100644
index 00000000000..a86852b094f
--- /dev/null
+++ b/app/workers/gitlab/github_import/attachments/import_merge_request_worker.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module GithubImport
+    module Attachments
+      class ImportMergeRequestWorker # rubocop:disable Scalability/IdempotentWorker
+        include ObjectImporter
+
+        def representation_class
+          Representation::NoteText
+        end
+
+        def importer_class
+          Importer::NoteAttachmentsImporter
+        end
+
+        def object_type
+          :merge_request_attachment
+        end
+      end
+    end
+  end
+end
diff --git a/app/workers/gitlab/github_import/stage/import_attachments_worker.rb b/app/workers/gitlab/github_import/stage/import_attachments_worker.rb
index 00901548514..e4a413b4081 100644
--- a/app/workers/gitlab/github_import/stage/import_attachments_worker.rb
+++ b/app/workers/gitlab/github_import/stage/import_attachments_worker.rb
@@ -30,7 +30,9 @@ module Gitlab
         def importers
           [
             ::Gitlab::GithubImport::Importer::Attachments::ReleasesImporter,
-            ::Gitlab::GithubImport::Importer::Attachments::NotesImporter
+            ::Gitlab::GithubImport::Importer::Attachments::NotesImporter,
+            ::Gitlab::GithubImport::Importer::Attachments::IssuesImporter,
+            ::Gitlab::GithubImport::Importer::Attachments::MergeRequestsImporter
           ]
         end