Add latest changes from gitlab-org/gitlab@12-8-stable-ee

43 files changed, 608 insertions, 332 deletions

diff --git a/config/application.rb b/config/application.rb
index 304cd72e806..be7d366c927 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -1,7 +1,9 @@
 require_relative 'boot'
 
-# Based on https://github.com/rails/rails/blob/v5.2.3/railties/lib/rails/all.rb
+# Based on https://github.com/rails/rails/blob/v6.0.1/railties/lib/rails/all.rb
 # Only load the railties we need instead of loading everything
+require 'rails'
+
 require 'active_record/railtie'
 require 'action_controller/railtie'
 require 'action_view/railtie'
@@ -53,6 +55,8 @@ module Gitlab
         memo << ee_path.to_s
       end
 
+      ee_paths << "#{config.root}/ee/app/replicators"
+
       # Eager load should load CE first
       config.eager_load_paths.push(*ee_paths)
       config.helpers_paths.push "#{config.root}/ee/app/helpers"
diff --git a/config/environment.rb b/config/environment.rb
index 7e55c7803d3..426333bb469 100644
--- a/config/environment.rb
+++ b/config/environment.rb
@@ -1,6 +1,5 @@
-# Load the rails application
-
+# Load the Rails application.
 require_relative 'application'
 
-# Initialize the rails application
+# Initialize the Rails application.
 Rails.application.initialize!
diff --git a/config/environments/test.rb b/config/environments/test.rb
index 153d16e4e55..d8235c6220c 100644
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -10,11 +10,8 @@ Rails.application.configure do
   # your test database is "scratch space" for the test suite and is wiped
   # and recreated between test runs. Don't rely on the data there!
 
-  # Enabling caching of classes slows start-up time because all controllers
-  # are loaded at initialization, but it reduces memory and load because files
-  # are not reloaded with every request. For example, caching is not necessary
-  # for loading database migrations but useful for handling Knapsack specs.
-  config.cache_classes = ENV['CACHE_CLASSES'] == 'true'
+  # Code doesn't change in CI so we don't need code-reloading
+  config.cache_classes = !!ENV['CI']
 
   # Configure static asset server for tests with Cache-Control for performance
   config.assets.compile = false if ENV['CI']
diff --git a/config/feature_categories.yml b/config/feature_categories.yml
index 1cae9875eac..924bdb58682 100644
--- a/config/feature_categories.yml
+++ b/config/feature_categories.yml
@@ -21,6 +21,7 @@
 - cloud_native_installation
 - cluster_cost_optimization
 - cluster_monitoring
+- code_analytics
 - code_quality
 - code_review
 - collection
@@ -31,19 +32,23 @@
 - container_scanning
 - continuous_delivery
 - continuous_integration
-- data_loss_prevention
 - ddos_protection
+- dependency_firewall
 - dependency_proxy
 - dependency_scanning
 - design_management
 - devops_score
+- digital_experience_management
 - disaster_recovery
 - dynamic_application_security_testing
 - epics
 - error_tracking
 - feature_flags
+- frontend_foundation
 - fuzzing
+- gdk
 - geo_replication
+- git_lfs
 - gitaly
 - gitlab_handbook
 - gitter
@@ -52,11 +57,11 @@
 - incident_management
 - incremental_rollout
 - infrastructure_as_code
-- integration_testing
 - integrations
 - interactive_application_security_testing
 - internationalization
 - issue_tracking
+- jupyter_notebooks
 - kanban_boards
 - kubernetes_management
 - language_specific
@@ -65,6 +70,7 @@
 - load_testing
 - logging
 - malware_scanning
+- merge_trains
 - metrics
 - omnibus_package
 - package_registry
@@ -91,8 +97,8 @@
 - static_site_editor
 - status_page
 - subgroups
-- synthetic_monitoring
 - system_testing
+- teams
 - templates
 - threat_detection
 - time_tracking
@@ -107,3 +113,4 @@
 - web_ide
 - web_performance
 - wiki
+- workspaces
diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example
index 5f078459bc2..20c75a6e255 100644
--- a/config/gitlab.yml.example
+++ b/config/gitlab.yml.example
@@ -111,7 +111,7 @@ production: &base
     # Email server smtp settings are in config/initializers/smtp_settings.rb.sample
 
     # default_can_create_group: false  # default: true
-    # username_changing_enabled: false # default: true - User can change her username/namespace
+    # username_changing_enabled: false # default: true - User can change their username/namespace
     ## Default theme ID
     ##   1 - Indigo
     ##   2 - Dark
@@ -145,6 +145,12 @@ production: &base
     # Number of seconds to wait for HTTP response after sending webhook HTTP POST request (default: 10)
     # webhook_timeout: 10
 
+    ### GraphQL Settings
+    # Tells the rails application how long it has to complete a GraphQL request.
+    # We suggest this value to be higher than the database timeout value
+    # and lower than the worker timeout set in unicorn/puma. (default: 30)
+    # graphql_timeout: 30
+
     ## Repository downloads directory
     # When a user clicks e.g. 'Download zip' on a project, a temporary zip file is created in the following directory.
     # The default is 'shared/cache/archive/' relative to the root of the Rails app.
@@ -367,6 +373,9 @@ production: &base
     # Remove expired build artifacts
     expire_build_artifacts_worker:
       cron: "50 * * * *"
+    # Stop expired environments
+    environments_auto_stop_cron_worker:
+      cron: "24 * * * *"
     # Periodically run 'git fsck' on all repositories. If started more than
     # once per hour you will have concurrent 'git fsck' jobs.
     repository_check_worker:
@@ -426,6 +435,11 @@ production: &base
     geo_repository_sync_worker:
       cron: "*/1 * * * *"
 
+    # GitLab Geo registry backfill worker
+    # NOTE: This will only take effect if Geo is enabled (secondary nodes only)
+    geo_secondary_registry_consistency_worker:
+      cron: "* * * * *"
+
     # GitLab Geo file download dispatch worker
     # NOTE: This will only take effect if Geo is enabled (secondary nodes only)
     geo_file_download_dispatch_worker:
@@ -916,7 +930,7 @@ production: &base
   # Gitaly settings
   gitaly:
     # Path to the directory containing Gitaly client executables.
-    client_path: /home/git/gitaly/bin
+    client_path: /home/git/gitaly
     # Default Gitaly authentication token. Can be overridden per storage. Can
     # be left blank when Gitaly is running locally on a Unix socket, which
     # is the normal way to deploy Gitaly.
@@ -959,9 +973,9 @@ production: &base
     #   # Turns on AWS Server-Side Encryption with Amazon S3-Managed Keys for backups, this is optional
     #   # encryption: 'AES256'
     #   # Turns on AWS Server-Side Encryption with Amazon Customer-Provided Encryption Keys for backups, this is optional
-    #   #   This should be set to the 256-bit, base64-encoded encryption key for Amazon S3 to use to encrypt or decrypt your data.
+    #   #   This should be set to the 256-bit encryption key for Amazon S3 to use to encrypt or decrypt your data.
     #   #   'encryption' must also be set in order for this to have any effect.
-    #   # encryption_key: '<base64 key>'
+    #   # encryption_key: '<key>'
     #   # Specifies Amazon S3 storage class to use for backups, this is optional
     #   # storage_class: 'STANDARD'
 
diff --git a/config/initializers/0_inflections.rb b/config/initializers/0_inflections.rb
index 7690eafdc6b..5c38859a667 100644
--- a/config/initializers/0_inflections.rb
+++ b/config/initializers/0_inflections.rb
@@ -19,6 +19,7 @@ ActiveSupport::Inflector.inflections do |inflect|
     group_view
     job_artifact_registry
     lfs_object_registry
+    package_file_registry
     project_auto_devops
     project_registry
     project_statistics
diff --git a/config/initializers/0_license.rb b/config/initializers/0_license.rb
index 19c71c34904..5c4546f499f 100644
--- a/config/initializers/0_license.rb
+++ b/config/initializers/0_license.rb
@@ -10,7 +10,7 @@ Gitlab.ee do
   end
 
   # Needed to run migration
-  if ActiveRecord::Base.connected? && ActiveRecord::Base.connection.table_exists?('licenses')
+  if Gitlab::Database.cached_table_exists?('licenses')
     message = LicenseHelper.license_message(signed_in: true, is_admin: true, in_html: false)
     if ::License.block_changes? && message.present?
       warn "WARNING: #{message}"
diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb
index d7d4bd9d3a1..aa743416e99 100644
--- a/config/initializers/1_settings.rb
+++ b/config/initializers/1_settings.rb
@@ -192,6 +192,7 @@ Settings.gitlab['username_changing_enabled'] = true if Settings.gitlab['username
 Settings.gitlab['issue_closing_pattern'] = '\b((?:[Cc]los(?:e[sd]?|ing)|\b[Ff]ix(?:e[sd]|ing)?|\b[Rr]esolv(?:e[sd]?|ing)|\b[Ii]mplement(?:s|ed|ing)?)(:?) +(?:(?:issues? +)?%{issue_ref}(?:(?: *,? +and +| *,? *)?)|([A-Z][A-Z0-9_]+-\d+))+)' if Settings.gitlab['issue_closing_pattern'].nil?
 Settings.gitlab['default_projects_features'] ||= {}
 Settings.gitlab['webhook_timeout'] ||= 10
+Settings.gitlab['graphql_timeout'] ||= 30
 Settings.gitlab['max_attachment_size'] ||= 10
 Settings.gitlab['session_expire_delay'] ||= 10080
 Settings.gitlab['unauthenticated_session_expire_delay'] ||= 2.hours.to_i
@@ -402,6 +403,9 @@ Settings.cron_jobs['pipeline_schedule_worker']['job_class'] = 'PipelineScheduleW
 Settings.cron_jobs['expire_build_artifacts_worker'] ||= Settingslogic.new({})
 Settings.cron_jobs['expire_build_artifacts_worker']['cron'] ||= '50 * * * *'
 Settings.cron_jobs['expire_build_artifacts_worker']['job_class'] = 'ExpireBuildArtifactsWorker'
+Settings.cron_jobs['environments_auto_stop_cron_worker'] ||= Settingslogic.new({})
+Settings.cron_jobs['environments_auto_stop_cron_worker']['cron'] ||= '24 * * * *'
+Settings.cron_jobs['environments_auto_stop_cron_worker']['job_class'] = 'Environments::AutoStopCronWorker'
 Settings.cron_jobs['repository_check_worker'] ||= Settingslogic.new({})
 Settings.cron_jobs['repository_check_worker']['cron'] ||= '20 * * * *'
 Settings.cron_jobs['repository_check_worker']['job_class'] = 'RepositoryCheck::DispatchWorker'
@@ -497,6 +501,9 @@ Gitlab.ee do
   Settings.cron_jobs['geo_repository_sync_worker'] ||= Settingslogic.new({})
   Settings.cron_jobs['geo_repository_sync_worker']['cron'] ||= '*/1 * * * *'
   Settings.cron_jobs['geo_repository_sync_worker']['job_class'] ||= 'Geo::RepositorySyncWorker'
+  Settings.cron_jobs['geo_secondary_registry_consistency_worker'] ||= Settingslogic.new({})
+  Settings.cron_jobs['geo_secondary_registry_consistency_worker']['cron'] ||= '* * * * *'
+  Settings.cron_jobs['geo_secondary_registry_consistency_worker']['job_class'] ||= 'Geo::Secondary::RegistryConsistencyWorker'
   Settings.cron_jobs['geo_repository_verification_primary_batch_worker'] ||= Settingslogic.new({})
   Settings.cron_jobs['geo_repository_verification_primary_batch_worker']['cron'] ||= '*/1 * * * *'
   Settings.cron_jobs['geo_repository_verification_primary_batch_worker']['job_class'] ||= 'Geo::RepositoryVerification::Primary::BatchWorker'
diff --git a/config/initializers/action_mailer_hooks.rb b/config/initializers/action_mailer_hooks.rb
index 02ca6ef13bf..41e34b6eb20 100644
--- a/config/initializers/action_mailer_hooks.rb
+++ b/config/initializers/action_mailer_hooks.rb
@@ -11,6 +11,9 @@ ActionMailer::Base.register_interceptors(
 
 ActionMailer::Base.register_observer(::Gitlab::Email::Hook::DeliveryMetricsObserver)
 
+# Force premailer loading so that it's not configured to run after the S/MIME interceptor
+::Premailer::Rails.register_interceptors
+
 if Gitlab.config.gitlab.email_enabled && Gitlab.config.gitlab.email_smime.enabled
   ActionMailer::Base.register_interceptor(::Gitlab::Email::Hook::SmimeSignatureInterceptor)
   Gitlab::AppLogger.debug "S/MIME signing of outgoing emails enabled"
diff --git a/config/initializers/active_record_data_types.rb b/config/initializers/active_record_data_types.rb
index 2b3f58330e3..3fa999e9908 100644
--- a/config/initializers/active_record_data_types.rb
+++ b/config/initializers/active_record_data_types.rb
@@ -24,10 +24,11 @@ module RegisterDateTimeWithTimeZone
   def initialize_type_map(mapping = type_map)
     super mapping
 
-    mapping.register_type 'timestamptz' do |_, _, sql_type|
-      precision = extract_precision(sql_type)
-      ActiveRecord::ConnectionAdapters::PostgreSQLAdapter::OID::DateTimeWithTimeZone.new(precision: precision)
-    end
+    register_class_with_precision(
+      mapping,
+      'timestamptz',
+      ActiveRecord::ConnectionAdapters::PostgreSQLAdapter::OID::DateTimeWithTimeZone
+    )
   end
 end
 
@@ -46,3 +47,5 @@ end
 if (ActiveRecord::Base.connection.active? rescue false)
   ActiveRecord::Base.connection.send :reload_type_map
 end
+
+ActiveRecord::Base.time_zone_aware_types += [:datetime_with_timezone]
diff --git a/config/initializers/active_record_preloader.rb b/config/initializers/active_record_preloader.rb
index a293909149e..d585ecda307 100644
--- a/config/initializers/active_record_preloader.rb
+++ b/config/initializers/active_record_preloader.rb
@@ -6,7 +6,7 @@ module ActiveRecord
           self
         end
 
-        def self.run(preloader)
+        def self.run
         end
 
         def self.preloaded_records
diff --git a/config/initializers/active_record_query_cache.rb b/config/initializers/active_record_query_cache.rb
deleted file mode 100644
index 61505a1edd3..00000000000
--- a/config/initializers/active_record_query_cache.rb
+++ /dev/null
@@ -1,3 +0,0 @@
-# frozen_string_literal: true
-
-ActiveRecord::ConnectionAdapters::ConnectionPool.prepend Gitlab::Patch::ActiveRecordQueryCache
diff --git a/config/initializers/backtrace_silencers.rb b/config/initializers/backtrace_silencers.rb
index 58941aae1b0..f25bb7d25fa 100644
--- a/config/initializers/backtrace_silencers.rb
+++ b/config/initializers/backtrace_silencers.rb
@@ -1,2 +1,8 @@
 Rails.backtrace_cleaner.remove_silencers!
+
+# This allows us to see the proper caller of SQL calls in {development,test}.log
+if (Rails.env.development? || Rails.env.test?) && Gitlab.ee?
+  Rails.backtrace_cleaner.add_silencer { |line| line =~ %r(^ee/lib/gitlab/database/load_balancing) }
+end
+
 Rails.backtrace_cleaner.add_silencer { |line| line !~ Gitlab::APP_DIRS_PATTERN }
diff --git a/config/initializers/config_initializers_active_record_locking.rb b/config/initializers/config_initializers_active_record_locking.rb
index 915247826e9..9f9908283c6 100644
--- a/config/initializers/config_initializers_active_record_locking.rb
+++ b/config/initializers/config_initializers_active_record_locking.rb
@@ -26,7 +26,7 @@ module ActiveRecord
             locking_column => possible_previous_lock_value,
             self.class.primary_key => id_in_database
           ).update_all(
-            attributes_with_values_for_update(attribute_names)
+            attributes_with_values(attribute_names)
           )
 
           if affected_rows != 1
diff --git a/config/initializers/console_message.rb b/config/initializers/console_message.rb
index 04c109aa844..7272583f262 100644
--- a/config/initializers/console_message.rb
+++ b/config/initializers/console_message.rb
@@ -1,17 +1,20 @@
 # rubocop:disable Rails/Output
-if defined?(Rails::Console)
+if Gitlab::Runtime.console?
   # note that this will not print out when using `spring`
   justify = 15
 
   puts '-' * 80
-  puts " GitLab:".ljust(justify) + "#{Gitlab::VERSION} (#{Gitlab.revision})"
+  puts " GitLab:".ljust(justify) + "#{Gitlab::VERSION} (#{Gitlab.revision}) #{Gitlab.ee? ? 'EE' : 'FOSS'}"
   puts " GitLab Shell:".ljust(justify) + "#{Gitlab::VersionInfo.parse(Gitlab::Shell.new.version)}"
-  puts " #{Gitlab::Database.human_adapter_name}:".ljust(justify) + Gitlab::Database.version
 
-  Gitlab.ee do
-    if Gitlab::Geo.enabled?
-      puts " Geo enabled:".ljust(justify) + 'yes'
-      puts " Geo server:".ljust(justify) + EE::GeoHelper.current_node_human_status
+  if Gitlab::Database.exists?
+    puts " #{Gitlab::Database.human_adapter_name}:".ljust(justify) + Gitlab::Database.version
+
+    Gitlab.ee do
+      if Gitlab::Geo.connected? && Gitlab::Geo.enabled?
+        puts " Geo enabled:".ljust(justify) + 'yes'
+        puts " Geo server:".ljust(justify) + EE::GeoHelper.current_node_human_status
+      end
     end
   end
 
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index 608d0401a96..c19fb65017f 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -12,4 +12,5 @@ if csp_settings['enabled']
 
   Rails.application.config.content_security_policy_report_only = csp_settings['report_only']
   Rails.application.config.content_security_policy_nonce_generator = ->(request) { SecureRandom.base64(16) }
+  Rails.application.config.content_security_policy_nonce_directives = %w(script-src)
 end
diff --git a/config/initializers/cookies_serializer.rb b/config/initializers/cookies_serializer.rb
index 54516e3f23d..a04d5044f4e 100644
--- a/config/initializers/cookies_serializer.rb
+++ b/config/initializers/cookies_serializer.rb
@@ -1,3 +1,4 @@
 # Be sure to restart your server when you modify this file.
 
+Rails.application.config.action_dispatch.use_cookies_with_metadata = false
 Rails.application.config.action_dispatch.cookies_serializer = :hybrid
diff --git a/config/initializers/doorkeeper.rb b/config/initializers/doorkeeper.rb
index 6be5c00daaa..4158bfec216 100644
--- a/config/initializers/doorkeeper.rb
+++ b/config/initializers/doorkeeper.rb
@@ -113,53 +113,3 @@ Doorkeeper.configure do
 
   base_controller '::Gitlab::BaseDoorkeeperController'
 end
-
-# Monkey patch to avoid creating new applications if the scope of the
-# app created does not match the complete list of scopes of the configured app.
-# It also prevents the OAuth authorize application window to appear every time.
-
-# Remove after we upgrade the doorkeeper gem from version 4.3.2
-if Doorkeeper.gem_version > Gem::Version.new('4.3.2')
-  raise "Doorkeeper was upgraded, please remove the monkey patch in #{__FILE__}"
-end
-
-module Doorkeeper
-  module AccessTokenMixin
-    module ClassMethods
-      def matching_token_for(application, resource_owner_or_id, scopes)
-        resource_owner_id =
-          if resource_owner_or_id.respond_to?(:to_key)
-            resource_owner_or_id.id
-          else
-            resource_owner_or_id
-          end
-
-        tokens = authorized_tokens_for(application.try(:id), resource_owner_id)
-        tokens.detect do |token|
-          scopes_match?(token.scopes, scopes, application.try(:scopes))
-        end
-      end
-
-      def scopes_match?(token_scopes, param_scopes, app_scopes)
-        return true if token_scopes.empty? && param_scopes.empty?
-
-        (token_scopes.sort == param_scopes.sort) &&
-          Doorkeeper::OAuth::Helpers::ScopeChecker.valid?(
-            param_scopes.to_s,
-            Doorkeeper.configuration.scopes,
-            app_scopes)
-      end
-
-      def authorized_tokens_for(application_id, resource_owner_id)
-        ordered_by(:created_at, :desc)
-          .where(application_id: application_id,
-                 resource_owner_id: resource_owner_id,
-                 revoked_at: nil)
-      end
-
-      def last_authorized_token_for(application_id, resource_owner_id)
-        authorized_tokens_for(application_id, resource_owner_id).first
-      end
-    end
-  end
-end
diff --git a/config/initializers/graphql.rb b/config/initializers/graphql.rb
index 2b21c9d9729..44a9644f481 100644
--- a/config/initializers/graphql.rb
+++ b/config/initializers/graphql.rb
@@ -6,6 +6,8 @@ GraphQL::Field.accepts_definitions(authorize: GraphQL::Define.assign_metadata_ke
 GraphQL::Schema::Object.accepts_definition(:authorize)
 GraphQL::Schema::Field.accepts_definition(:authorize)
 
-GitlabSchema.middleware << GraphQL::Schema::TimeoutMiddleware.new(max_seconds: ENV.fetch('GITLAB_RAILS_GRAPHQL_TIMEOUT', 30).to_i) do |timeout_error, query|
-  Gitlab::GraphqlLogger.error(message: timeout_error.to_s, query: query.query_string, query_variables: query.provided_variables)
+Gitlab::Application.config.after_initialize do
+  GitlabSchema.middleware << GraphQL::Schema::TimeoutMiddleware.new(max_seconds: Gitlab.config.gitlab.graphql_timeout) do |timeout_error, query|
+    Gitlab::GraphqlLogger.error(message: timeout_error.to_s, query: query.query_string, query_variables: query.provided_variables)
+  end
 end
diff --git a/config/initializers/load_balancing.rb b/config/initializers/load_balancing.rb
index a49bcbe1f96..7502a6299ae 100644
--- a/config/initializers/load_balancing.rb
+++ b/config/initializers/load_balancing.rb
@@ -3,7 +3,7 @@
 # We need to run this initializer after migrations are done so it doesn't fail on CI
 
 Gitlab.ee do
-  if ActiveRecord::Base.connected? && ActiveRecord::Base.connection.table_exists?('licenses')
+  if Gitlab::Database.cached_table_exists?('licenses')
     if Gitlab::Database::LoadBalancing.enable?
       Gitlab::Database.disable_prepared_statements
 
diff --git a/config/initializers/lograge.rb b/config/initializers/lograge.rb
index dc064a76033..fb93c3a6e12 100644
--- a/config/initializers/lograge.rb
+++ b/config/initializers/lograge.rb
@@ -15,6 +15,10 @@ unless Gitlab::Runtime.sidekiq?
       data
     end
 
+    # This isn't a user-reachable controller; we use it to check for a
+    # valid CSRF token in the API
+    config.lograge.ignore_actions = ['Gitlab::RequestForgeryProtection::Controller#index']
+
     # Add request parameters to log output
     config.lograge.custom_options = lambda do |event|
       params = event.payload[:params]
@@ -24,7 +28,7 @@ unless Gitlab::Runtime.sidekiq?
 
       payload = {
         time: Time.now.utc.iso8601(3),
-        params: params,
+        params: Gitlab::Utils::LogLimitedArray.log_limited_array(params),
         remote_ip: event.payload[:remote_ip],
         user_id: event.payload[:user_id],
         username: event.payload[:username],
@@ -35,6 +39,7 @@ unless Gitlab::Runtime.sidekiq?
       ::Gitlab::InstrumentationHelper.add_instrumentation_data(payload)
 
       payload[:response] = event.payload[:response] if event.payload[:response]
+      payload[:etag_route] = event.payload[:etag_route] if event.payload[:etag_route]
       payload[Labkit::Correlation::CorrelationId::LOG_KEY] = Labkit::Correlation::CorrelationId.current_id
 
       if cpu_s = Gitlab::Metrics::System.thread_cpu_duration(::Gitlab::RequestContext.instance.start_thread_cpu_time)
diff --git a/config/initializers/mail_encoding_patch.rb b/config/initializers/mail_encoding_patch.rb
new file mode 100644
index 00000000000..d53b058ba75
--- /dev/null
+++ b/config/initializers/mail_encoding_patch.rb
@@ -0,0 +1,82 @@
+# Monkey patch mail 2.7.1 to fix quoted-printable issues with newlines
+# The issues upstream invalidate SMIME signatures under some conditions
+# This was working properly in 2.6.6
+#
+# See https://gitlab.com/gitlab-org/gitlab/issues/197386
+# See https://github.com/mikel/mail/issues/1190
+
+module Mail
+  module Encodings
+    # PATCH
+    # This reverts https://github.com/mikel/mail/pull/1113, which solves some
+    # encoding issues with binary attachments encoded in quoted-printable, but
+    # unfortunately breaks re-encoding of messages
+    class QuotedPrintable < SevenBit
+      def self.decode(str)
+        ::Mail::Utilities.to_lf str.gsub(/(?:=0D=0A|=0D|=0A)\r\n/, "\r\n").unpack1("M*")
+      end
+
+      def self.encode(str)
+        ::Mail::Utilities.to_crlf([::Mail::Utilities.to_lf(str)].pack("M"))
+      end
+    end
+  end
+
+  class Body
+    def encoded(transfer_encoding = nil, charset = nil)
+      # PATCH
+      # Use provided parameter charset (from parent Message) if not nil,
+      # otherwise use own self.charset
+      # Required because the Message potentially has on its headers the charset
+      # that needs to be used (e.g. 'Content-Type: text/plain; charset=UTF-8')
+      charset = self.charset if charset.nil?
+
+      if multipart?
+        self.sort_parts!
+        encoded_parts = parts.map { |p| p.encoded }
+        ([preamble] + encoded_parts).join(crlf_boundary) + end_boundary + epilogue.to_s
+      else
+        dec = Mail::Encodings.get_encoding(encoding)
+        enc = if Utilities.blank?(transfer_encoding)
+                dec
+              else
+                negotiate_best_encoding(transfer_encoding)
+              end
+
+        if dec.nil?
+          # Cannot decode, so skip normalization
+          raw_source
+        else
+          # Decode then encode to normalize and allow transforming
+          # from base64 to Q-P and vice versa
+          decoded = dec.decode(raw_source)
+
+          if defined?(Encoding) && charset && charset != "US-ASCII"
+            # PATCH
+            # We need to force the encoding: in the case of quoted-printable
+            # this will throw an exception otherwise, because `decoded` will have
+            # an encoding of BINARY (or its equivalent ASCII-8BIT),
+            # coming from QuotedPrintable#decode, and inside it from String#unpack1
+            decoded = decoded.force_encoding(charset)
+            decoded.force_encoding('BINARY') unless Encoding.find(charset).ascii_compatible?
+          end
+
+          enc.encode(decoded)
+        end
+      end
+    end
+  end
+
+  class Message
+    def encoded
+      ready_to_send!
+      buffer = header.encoded
+      buffer << "\r\n"
+      # PATCH
+      # Pass the Message charset down to the contained Body, the headers
+      # potentially contain the charset needed to be applied
+      buffer << body.encoded(content_transfer_encoding, charset)
+      buffer
+    end
+  end
+end
diff --git a/config/initializers/rack_timeout.rb b/config/initializers/rack_timeout.rb
index 1f1264de208..5d5a5fcf980 100644
--- a/config/initializers/rack_timeout.rb
+++ b/config/initializers/rack_timeout.rb
@@ -12,6 +12,8 @@
 if Gitlab::Runtime.puma? && !Rails.env.test?
   require 'rack/timeout/base'
 
+  Rack::Timeout::Logger.level = Logger::ERROR
+
   Gitlab::Application.configure do |config|
     config.middleware.insert_before(Rack::Runtime, Rack::Timeout,
                                     service_timeout: ENV.fetch('GITLAB_RAILS_RACK_TIMEOUT', 60).to_i,
diff --git a/config/initializers/rails_host_authorization.rb b/config/initializers/rails_host_authorization.rb
new file mode 100644
index 00000000000..3be2de47812
--- /dev/null
+++ b/config/initializers/rails_host_authorization.rb
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+# This file requires config/initializers/1_settings.rb
+
+if Rails.env.development?
+  Rails.application.config.hosts += [Gitlab.config.gitlab.host, 'unix']
+end
diff --git a/config/initializers/rspec_profiling.rb b/config/initializers/rspec_profiling.rb
index 9f29e48a63e..2473dc1ff6c 100644
--- a/config/initializers/rspec_profiling.rb
+++ b/config/initializers/rspec_profiling.rb
@@ -46,7 +46,7 @@ module RspecProfilingExt
     rescue => err
       return if @already_logged_example_finished_error # rubocop:disable Gitlab/ModuleWithInstanceVariables
 
-      $stderr.puts "rspec_profiling couldn't collect an example: #{err}. Further warnings suppressed."
+      warn "rspec_profiling couldn't collect an example: #{err}. Further warnings suppressed."
       @already_logged_example_finished_error = true # rubocop:disable Gitlab/ModuleWithInstanceVariables
     end
 
@@ -61,7 +61,7 @@ RspecProfiling.configure do |config|
     RspecProfiling::Run.prepend(RspecProfilingExt::Run)
     config.collector = RspecProfilingExt::Collectors::CSVWithTimestamps
     config.csv_path = -> do
-      prefix = "#{ENV['CI_JOB_NAME']}-".tr(' ', '-') if ENV['CI_JOB_NAME']
+      prefix = "#{ENV['CI_JOB_NAME']}-".gsub(/[ \/]/, '-') if ENV['CI_JOB_NAME']
       "rspec_profiling/#{prefix}#{Time.now.to_i}-#{SecureRandom.hex(8)}-rspec-data.csv"
     end
   end
diff --git a/config/initializers/snowplow_tracker.rb b/config/initializers/snowplow_tracker.rb
index 3c730e03738..fadedc97d83 100644
--- a/config/initializers/snowplow_tracker.rb
+++ b/config/initializers/snowplow_tracker.rb
@@ -3,21 +3,12 @@
 # Gitlab.com uses Snowplow for identifying users and events.
 # https://gitlab.com/gitlab-org/gitlab/issues/6329
 #
-# SnowplowTracker write log into STDERR
+# SnowplowTracker writes logs to STDERR:
 # https://github.com/snowplow/snowplow-ruby-tracker/blob/39fcfa2be793f2e25e73087a9700abc93f43b5e8/lib/snowplow-tracker/emitters.rb#L23
-#     `LOGGER = Logger.new(STDERR)`
-#
-# In puma.rb, if `stdout_redirect` specify stderr, Puma will overwrite STDERR in:
-# https://github.com/puma/puma/blob/b41205f5cacbc2ad0060472bdce68ba636f42175/lib/puma/runner.rb#L134
-#    `STDERR.reopen stderr, (append ? "a" : "w")`
-# As a result, SnowplowTracker will log into Puma stderr, when Puma enabled.
-#
-# By default, SnowplowTracker uses default log formatter.
-# When enable Puma, SnowplowTracker log is expected to be JSON format, as part of puma_stderr.log.
-# Hence overwrite ::SnowplowTracker::LOGGER.formatter to JSON formatter
-
-if defined?(::Puma) && defined?(::SnowplowTracker::LOGGER)
-  ::SnowplowTracker::LOGGER.formatter = proc do |severity, datetime, progname, msg|
-    { severity: severity, timestamp: datetime.utc.iso8601(3), pid: $$, progname: progname, message: msg }.to_json << "\n"
-  end
+if defined?(::SnowplowTracker::LOGGER)
+  # This squelches the output of the logger since it doesn't really
+  # provide useful information.
+  # https://github.com/snowplow/snowplow-ruby-tracker/pull/109
+  # would make it possible to configure this logger directly.
+  ::SnowplowTracker::LOGGER.level = Logger::FATAL
 end
diff --git a/config/mail_room.yml b/config/mail_room.yml
index 75024c2b2e1..da37ef60587 100644
--- a/config/mail_room.yml
+++ b/config/mail_room.yml
@@ -1,9 +1,7 @@
 :mailboxes:
   <%
     require_relative "../lib/gitlab/mail_room" unless defined?(Gitlab::MailRoom)
-    config = Gitlab::MailRoom.config
-
-    if Gitlab::MailRoom.enabled?
+    Gitlab::MailRoom.enabled_configs.each do |config|
   %>
     -
       :host: <%= config[:host].to_json %>
@@ -24,8 +22,8 @@
       :delivery_options:
         :redis_url: <%= config[:redis_url].to_json %>
         :namespace: <%= Gitlab::Redis::Queues::SIDEKIQ_NAMESPACE %>
-        :queue: email_receiver
-        :worker: EmailReceiverWorker
+        :queue: <%= config[:queue] %>
+        :worker: <%= config[:worker] %>
         <% if config[:sentinels] %>
         :sentinels:
           <% config[:sentinels].each do |sentinel| %>
diff --git a/config/prometheus/self_monitoring_default.yml b/config/prometheus/self_monitoring_default.yml
new file mode 100644
index 00000000000..dc2361fb3bc
--- /dev/null
+++ b/config/prometheus/self_monitoring_default.yml
@@ -0,0 +1,39 @@
+dashboard: 'Default dashboard'
+priority: 1
+panel_groups:
+- group: Web Service
+  panels:
+    - title: Web Service - Error Ratio
+      type: line-chart
+      y_label: "Unhandled Exceptions (%)"
+      metrics:
+        - id: wser_web_service
+          query_range: 'max(max_over_time(gitlab_service_errors:ratio{environment="{{ci_environment_slug}}", type="web", stage="main"}[1m])) by (type) * 100'
+          unit: "%"
+          label: "Error Ratio"
+        - id: wser_degradation_slo
+          query_range: 'avg(slo:max:gitlab_service_errors:ratio{environment="{{ci_environment_slug}}", type="web", stage="main"}) or avg(slo:max:gitlab_service_errors:ratio{type="web"}) * 100'
+          unit: "%"
+          label: "Degradation SLO"
+        - id: wser_outage_slo
+          query_range: '2 * (avg(slo:max:gitlab_service_errors:ratio{environment="{{ci_environment_slug}}", type="web", stage="main"}) or avg(slo:max:gitlab_service_errors:ratio{type="web"})) * 100'
+          unit: "%"
+          label: "Outage SLO"
+- group: API Service
+  panels:
+    - title: API Service - Error Ratio
+      type: line-chart
+      y_label: "Unhandled Exceptions (%)"
+      metrics:
+        - id: aser_web_service
+          query_range: 'max(max_over_time(gitlab_service_errors:ratio{environment="{{ci_environment_slug}}", type="api", stage="main"}[1m])) by (type) * 100'
+          unit: "%"
+          label: "Error Ratio"
+        - id: aser_degradation_slo
+          query_range: 'avg(slo:max:gitlab_service_errors:ratio{environment="{{ci_environment_slug}}", type="api", stage="main"}) or avg(slo:max:gitlab_service_errors:ratio{type="web"}) * 100'
+          unit: "%"
+          label: "Degradation SLO"
+        - id: aser_outage_slo
+          query_range: '2 * (avg(slo:max:gitlab_service_errors:ratio{environment="{{ci_environment_slug}}", type="api", stage="main"}) or avg(slo:max:gitlab_service_errors:ratio{type="web"})) * 100'
+          unit: "%"
+          label: "Outage SLO"
diff --git a/config/routes.rb b/config/routes.rb
index 518cf985718..16b15e5300a 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -24,7 +24,8 @@ Rails.application.routes.draw do
   use_doorkeeper do
     controllers applications: 'oauth/applications',
                 authorized_applications: 'oauth/authorized_applications',
-                authorizations: 'oauth/authorizations'
+                authorizations: 'oauth/authorizations',
+                token_info: 'oauth/token_info'
   end
 
   # This prefixless path is required because Jira gets confused if we set it up with a path
@@ -120,9 +121,7 @@ Rails.application.routes.draw do
       draw :country
       draw :country_state
       draw :subscription
-    end
 
-    Gitlab.ee do
       constraints(-> (*) { Gitlab::Analytics.any_features_enabled? }) do
         draw :analytics
       end
@@ -168,11 +167,6 @@ Rails.application.routes.draw do
     end
   end
 
-  draw :api
-  draw :sidekiq
-  draw :help
-  draw :snippets
-
   # Invites
   resources :invites, only: [:show], constraints: { id: /[A-Za-z0-9_-]+/ } do
     member do
@@ -193,6 +187,25 @@ Rails.application.routes.draw do
   # Notification settings
   resources :notification_settings, only: [:create, :update]
 
+  resources :groups, only: [:index, :new, :create] do
+    post :preview_markdown
+  end
+
+  resources :projects, only: [:index, :new, :create]
+
+  get '/projects/:id' => 'projects#resolve'
+
+  Gitlab.ee do
+    scope '/-/push_from_secondary/:geo_node_id' do
+      draw :git_http
+    end
+  end
+
+  draw :git_http
+  draw :api
+  draw :sidekiq
+  draw :help
+  draw :snippets
   draw :google_api
   draw :import
   draw :uploads
diff --git a/config/routes/admin.rb b/config/routes/admin.rb
index f363823f80c..5210b84c8ba 100644
--- a/config/routes/admin.rb
+++ b/config/routes/admin.rb
@@ -32,6 +32,14 @@ namespace :admin do
   resources :abuse_reports, only: [:index, :destroy]
   resources :gitaly_servers, only: [:index]
 
+  namespace :serverless do
+    resources :domains, only: [:index, :create, :update] do
+      member do
+        post '/verify', to: 'domains#verify'
+      end
+    end
+  end
+
   resources :spam_logs, only: [:index, :destroy] do
     member do
       post :mark_as_ham
@@ -107,7 +115,11 @@ namespace :admin do
     end
   end
 
-  resource :application_settings, only: [:show, :update] do
+  resource :application_settings, only: :update do
+    # This redirect should be removed with 13.0 release.
+    # https://gitlab.com/gitlab-org/gitlab/issues/199427
+    get '/', to: redirect('admin/application_settings/general'), as: nil
+
     resources :services, only: [:index, :edit, :update]
 
     get :usage_data
diff --git a/config/routes/api.rb b/config/routes/api.rb
index d55bbdf6776..5dbfcc98f0f 100644
--- a/config/routes/api.rb
+++ b/config/routes/api.rb
@@ -1,5 +1,5 @@
 post '/api/graphql', to: 'graphql#execute'
-mount GraphiQL::Rails::Engine, at: '/-/graphql-explorer', graphql_path: '/api/graphql'
+mount GraphiQL::Rails::Engine, at: '/-/graphql-explorer', graphql_path: Gitlab::Utils.append_path(Gitlab.config.gitlab.relative_url_root, '/api/graphql')
 
 ::API::API.logger Rails.logger # rubocop:disable Gitlab/RailsLogger
 mount ::API::API => '/'
diff --git a/config/routes/explore.rb b/config/routes/explore.rb
index 42ec5e8abec..59b53bdcf42 100644
--- a/config/routes/explore.rb
+++ b/config/routes/explore.rb
@@ -8,7 +8,7 @@ namespace :explore do
 
   resources :groups, only: [:index]
   resources :snippets, only: [:index]
-  root to: 'projects#trending'
+  root to: 'projects#index'
 end
 
 # Compatibility with old routing
diff --git a/config/routes/git_http.rb b/config/routes/git_http.rb
index aac6d418a92..593f818e434 100644
--- a/config/routes/git_http.rb
+++ b/config/routes/git_http.rb
@@ -1,43 +1,51 @@
-scope(path: '*namespace_id/:project_id',
-      format: nil,
-      constraints: { namespace_id: Gitlab::PathRegex.full_namespace_route_regex }) do
-  scope(constraints: { project_id: Gitlab::PathRegex.project_git_route_regex }, module: :projects) do
-    # Git HTTP clients ('git clone' etc.)
-    scope(controller: :git_http) do
-      get '/info/refs', action: :info_refs
-      post '/git-upload-pack', action: :git_upload_pack
-      post '/git-receive-pack', action: :git_receive_pack
-    end
+concern :gitactionable do
+  scope(controller: :git_http) do
+    get '/info/refs', action: :info_refs
+    post '/git-upload-pack', action: :git_upload_pack
+    post '/git-receive-pack', action: :git_receive_pack
+  end
+end
 
-    # Git LFS API (metadata)
-    scope(path: 'info/lfs/objects', controller: :lfs_api) do
-      post :batch
-      post '/', action: :deprecated
-      get '/*oid', action: :deprecated
-    end
+concern :lfsable do
+  # Git LFS API (metadata)
+  scope(path: 'info/lfs/objects', controller: :lfs_api) do
+    post :batch
+    post '/', action: :deprecated
+    get '/*oid', action: :deprecated
+  end
 
-    scope(path: 'info/lfs') do
-      resources :lfs_locks, controller: :lfs_locks_api, path: 'locks' do
-        post :unlock, on: :member
-        post :verify, on: :collection
-      end
+  scope(path: 'info/lfs') do
+    resources :lfs_locks, controller: :lfs_locks_api, path: 'locks' do
+      post :unlock, on: :member
+      post :verify, on: :collection
     end
+  end
 
-    # GitLab LFS object storage
-    scope(path: 'gitlab-lfs/objects/*oid', controller: :lfs_storage, constraints: { oid: /[a-f0-9]{64}/ }) do
-      get '/', action: :download
+  # GitLab LFS object storage
+  scope(path: 'gitlab-lfs/objects/*oid', controller: :lfs_storage, constraints: { oid: /[a-f0-9]{64}/ }) do
+    get '/', action: :download
 
-      scope constraints: { size: /[0-9]+/ } do
-        put '/*size/authorize', action: :upload_authorize
-        put '/*size', action: :upload_finalize
-      end
+    scope constraints: { size: /[0-9]+/ } do
+      put '/*size/authorize', action: :upload_authorize
+      put '/*size', action: :upload_finalize
+    end
+  end
+end
+
+scope(path: '*namespace_id/:repository_id',
+      format: nil,
+      constraints: { namespace_id: Gitlab::PathRegex.full_namespace_route_regex }) do
+  scope(constraints: { repository_id: Gitlab::PathRegex.project_git_route_regex }) do
+    scope(module: :repositories) do
+      concerns :gitactionable
+      concerns :lfsable
     end
   end
 
   # Redirect /group/project.wiki.git to the project wiki
-  scope(format: true, constraints: { project_id: Gitlab::PathRegex.project_wiki_git_route_regex, format: :git }) do
+  scope(format: true, constraints: { repository_id: Gitlab::PathRegex.project_wiki_git_route_regex, format: :git }) do
     wiki_redirect = redirect do |params, request|
-      project_id = params[:project_id].delete_suffix('.wiki')
+      project_id = params[:repository_id].delete_suffix('.wiki')
       path = [params[:namespace_id], project_id, 'wikis'].join('/')
       path << "?#{request.query_string}" unless request.query_string.blank?
       path
@@ -47,7 +55,7 @@ scope(path: '*namespace_id/:project_id',
   end
 
   # Redirect /group/project/info/refs to /group/project.git/info/refs
-  scope(constraints: { project_id: Gitlab::PathRegex.project_route_regex }) do
+  scope(constraints: { repository_id: Gitlab::PathRegex.project_route_regex }) do
     # Allow /info/refs, /info/refs?service=git-upload-pack, and
     # /info/refs?service=git-receive-pack, but nothing else.
     #
@@ -58,7 +66,7 @@ scope(path: '*namespace_id/:project_id',
     end
 
     ref_redirect = redirect do |params, request|
-      path = "#{params[:namespace_id]}/#{params[:project_id]}.git/info/refs"
+      path = "#{params[:namespace_id]}/#{params[:repository_id]}.git/info/refs"
       path << "?#{request.query_string}" unless request.query_string.blank?
       path
     end
diff --git a/config/routes/group.rb b/config/routes/group.rb
index 24957d5ecef..68e239faf6d 100644
--- a/config/routes/group.rb
+++ b/config/routes/group.rb
@@ -1,11 +1,5 @@
 # frozen_string_literal: true
 
-# rubocop: disable Cop/PutGroupRoutesUnderScope
-resources :groups, only: [:index, :new, :create] do
-  post :preview_markdown
-end
-# rubocop: enable Cop/PutGroupRoutesUnderScope
-
 constraints(::Constraints::GroupUrlConstrainer.new) do
   scope(path: 'groups/*id',
         controller: :groups,
@@ -82,7 +76,7 @@ constraints(::Constraints::GroupUrlConstrainer.new) do
       end
     end
 
-    resources :container_registries, only: [:index], controller: 'registry/repositories'
+    resources :container_registries, only: [:index, :show], controller: 'registry/repositories'
   end
 
   scope(path: '*id',
diff --git a/config/routes/issues.rb b/config/routes/issues.rb
new file mode 100644
index 00000000000..9ac69975690
--- /dev/null
+++ b/config/routes/issues.rb
@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+get :issues, to: 'issues#calendar', constraints: lambda { |req| req.format == :ics }
+
+resources :issues, concerns: :awardable, constraints: { id: /\d+/ } do
+  member do
+    post :toggle_subscription
+    post :mark_as_spam
+    post :move
+    put :reorder
+    get :related_branches
+    get :can_create_branch
+    get :realtime_changes
+    post :create_merge_request
+    get :discussions, format: :json
+  end
+
+  collection do
+    post :bulk_update
+    post :import_csv
+  end
+end
diff --git a/config/routes/merge_requests.rb b/config/routes/merge_requests.rb
index fd80c21deb1..f9670a5bf6e 100644
--- a/config/routes/merge_requests.rb
+++ b/config/routes/merge_requests.rb
@@ -18,6 +18,7 @@ resources :merge_requests, concerns: :awardable, except: [:new, :create, :show],
     scope constraints: ->(req) { req.format == :json }, as: :json do
       get :commits
       get :pipelines
+      get :context_commits
       get :diffs, to: 'merge_requests/diffs#show'
       get :diffs_batch, to: 'merge_requests/diffs#diffs_batch'
       get :diffs_metadata, to: 'merge_requests/diffs#diffs_metadata'
diff --git a/config/routes/project.rb b/config/routes/project.rb
index 09e6b733bff..f153082f118 100644
--- a/config/routes/project.rb
+++ b/config/routes/project.rb
@@ -1,13 +1,5 @@
 # frozen_string_literal: true
 
-# rubocop: disable Cop/PutProjectRoutesUnderScope
-resources :projects, only: [:index, :new, :create]
-
-draw :git_http
-
-get '/projects/:id' => 'projects#resolve'
-# rubocop: enable Cop/PutProjectRoutesUnderScope
-
 constraints(::Constraints::ProjectUrlConstrainer.new) do
   # If the route has a wildcard segment, the segment has a regex constraint,
   # the segment is potentially followed by _another_ wildcard segment, and
@@ -174,7 +166,7 @@ constraints(::Constraints::ProjectUrlConstrainer.new) do
           end
         end
 
-        resources :releases, only: [:index, :edit], param: :tag, constraints: { tag: %r{[^/]+} } do
+        resources :releases, only: [:index, :show, :edit], param: :tag, constraints: { tag: %r{[^/]+} } do
           member do
             get :evidence
           end
@@ -203,9 +195,8 @@ constraints(::Constraints::ProjectUrlConstrainer.new) do
           end
         end
 
-        resource :cycle_analytics, only: [:show]
-
-        namespace :cycle_analytics do
+        resource :cycle_analytics, only: :show, path: 'value_stream_analytics'
+        scope module: :cycle_analytics, as: 'cycle_analytics', path: 'value_stream_analytics' do
           scope :events, controller: 'events' do
             get :issue
             get :plan
@@ -216,6 +207,7 @@ constraints(::Constraints::ProjectUrlConstrainer.new) do
             get :production
           end
         end
+        get '/cycle_analytics', to: redirect('%{namespace_id}/%{project_id}/-/value_stream_analytics')
 
         concerns :clusterable
 
@@ -281,9 +273,12 @@ constraints(::Constraints::ProjectUrlConstrainer.new) do
           end
         end
 
+        draw :merge_requests
+
         # The wiki and repository routing contains wildcard characters so
         # its preferable to keep it below all other project routes
         draw :repository_scoped
+        draw :repository
         draw :wiki
       end
       # End of the /-/ scope.
@@ -306,17 +301,6 @@ constraints(::Constraints::ProjectUrlConstrainer.new) do
           defaults: { format: 'json' },
           constraints: { template_type: %r{issue|merge_request}, format: 'json' }
 
-      resources :commit, only: [:show], constraints: { id: /\h{7,40}/ } do
-        member do
-          get :branches
-          get :pipelines
-          post :revert
-          post :cherry_pick
-          get :diff_for_path
-          get :merge_requests
-        end
-      end
-
       resource :pages, only: [:show, :update, :destroy] do
         resources :domains, except: :index, controller: 'pages_domains', constraints: { id: %r{[^/]+} } do
           member do
@@ -339,16 +323,7 @@ constraints(::Constraints::ProjectUrlConstrainer.new) do
         end
       end
 
-      # Unscoped route. It will be replaced with redirect to /-/merge_requests/
-      # Issue https://gitlab.com/gitlab-org/gitlab/issues/118849
-      draw :merge_requests
-
-      # To ensure an old unscoped routing is used for the UI we need to
-      # add prefix 'as' to the scope routing and place it below original MR routing.
-      # Issue https://gitlab.com/gitlab-org/gitlab/issues/118849
-      scope '-', as: 'scoped' do
-        draw :merge_requests
-      end
+      post 'alerts/notify', to: 'alerting/notifications#create'
 
       resources :pipelines, only: [:index, :new, :create, :show, :destroy] do
         collection do
@@ -368,6 +343,7 @@ constraints(::Constraints::ProjectUrlConstrainer.new) do
           get :failures
           get :status
           get :test_report
+          get :test_reports_count
         end
 
         member do
@@ -398,7 +374,7 @@ constraints(::Constraints::ProjectUrlConstrainer.new) do
         end
       end
 
-      resources :container_registry, only: [:index, :destroy],
+      resources :container_registry, only: [:index, :destroy, :show],
                                      controller: 'registry/repositories'
 
       namespace :registry do
@@ -417,25 +393,15 @@ constraints(::Constraints::ProjectUrlConstrainer.new) do
         end
       end
 
-      get :issues, to: 'issues#calendar', constraints: lambda { |req| req.format == :ics }
-
-      resources :issues, concerns: :awardable, constraints: { id: /\d+/ } do
-        member do
-          post :toggle_subscription
-          post :mark_as_spam
-          post :move
-          put :reorder
-          get :related_branches
-          get :can_create_branch
-          get :realtime_changes
-          post :create_merge_request
-          get :discussions, format: :json
-        end
+      # Unscoped route. It will be replaced with redirect to /-/issues/
+      # Issue https://gitlab.com/gitlab-org/gitlab/issues/118849
+      draw :issues
 
-        collection do
-          post :bulk_update
-          post :import_csv
-        end
+      # To ensure an old unscoped routing is used for the UI we need to
+      # add prefix 'as' to the scope routing and place it below original routing.
+      # Issue https://gitlab.com/gitlab-org/gitlab/issues/118849
+      scope '-', as: 'scoped' do
+        draw :issues
       end
 
       resources :notes, only: [:create, :destroy, :update], concerns: :awardable, constraints: { id: /\d+/ } do
@@ -485,14 +451,9 @@ constraints(::Constraints::ProjectUrlConstrainer.new) do
         post :web_ide_clientside_preview
       end
 
-      # The repository routing contains wildcard characters so
-      # its preferable to keep it below all other project routes
-      draw :repository
-
-      # To ensure an old unscoped routing is used for the UI we need to
-      # add prefix 'as' to the scope routing and place it below original routing.
+      # Deprecated unscoped routing.
       # Issue https://gitlab.com/gitlab-org/gitlab/issues/118849
-      scope '-', as: 'scoped' do
+      scope as: 'deprecated' do
         draw :repository
       end
 
@@ -510,7 +471,8 @@ constraints(::Constraints::ProjectUrlConstrainer.new) do
                                             :forks, :group_links, :import, :avatar, :mirror,
                                             :cycle_analytics, :mattermost, :variables, :triggers,
                                             :environments, :protected_environments, :error_tracking,
-                                            :serverless, :clusters, :audit_events, :wikis)
+                                            :serverless, :clusters, :audit_events, :wikis, :merge_requests,
+                                            :vulnerability_feedback, :security, :dependencies)
     end
 
     # rubocop: disable Cop/PutProjectRoutesUnderScope
diff --git a/config/routes/repository.rb b/config/routes/repository.rb
index d4805b67a5c..38d6cdbbaf8 100644
--- a/config/routes/repository.rb
+++ b/config/routes/repository.rb
@@ -10,6 +10,17 @@ resource :repository, only: [:create] do
   end
 end
 
+resources :commit, only: [:show], constraints: { id: /\h{7,40}/ } do
+  member do
+    get :branches
+    get :pipelines
+    post :revert
+    post :cherry_pick
+    get :diff_for_path
+    get :merge_requests
+  end
+end
+
 # Don't use format parameter as file extension (old 3.0.x behavior)
 # See http://guides.rubyonrails.org/routing.html#route-globbing-and-wildcard-segments
 scope format: false do
diff --git a/config/sidekiq_queues.yml b/config/sidekiq_queues.yml
index 2986431f21b..1cb19d18a0d 100644
--- a/config/sidekiq_queues.yml
+++ b/config/sidekiq_queues.yml
@@ -1,7 +1,12 @@
+# This file is generated automatically by
+#   bin/rake gitlab:sidekiq:sidekiq_queues_yml:generate
+#
+# Do not edit it manually!
+#
 # This configuration file should be exclusively used to set queue settings for
 # Sidekiq. Any other setting should be specified using the Sidekiq CLI or the
 # Sidekiq Ruby API (see config/initializers/sidekiq.rb).
----
+#
 # All the queues to process and their weights. Every queue _must_ have a weight
 # defined.
 #
@@ -17,114 +22,225 @@
 # to perform) is:
 #
 #     chance = (queue weight / total weight of all queues) * 100
+---
 :queues:
-  - [post_receive, 5]
-  - [merge, 5]
-  - [update_merge_requests, 3]
-  - [process_commit, 3]
-  - [new_note, 2]
-  - [new_issue, 2]
-  - [notifications, 2]
-  - [new_merge_request, 2]
-  - [pipeline_processing, 5]
-  - [pipeline_creation, 4]
-  - [pipeline_default, 3]
-  - [pipeline_cache, 3]
-  - [deployment, 3]
-  - [auto_merge, 3]
-  - [pipeline_hooks, 2]
-  - [gitlab_shell, 2]
-  - [email_receiver, 2]
-  - [emails_on_push, 2]
-  - [mailers, 2]
-  - [mail_scheduler, 2]
-  - [invalid_gpg_signature_update, 2]
-  - [create_gpg_signature, 2]
-  - [rebase, 2]
-  - [upload_checksum, 1]
-  - [repository_fork, 1]
-  - [repository_import, 1]
-  - [github_importer, 1]
-  - [github_import_advance_stage, 1]
-  - [project_service, 1]
-  - [delete_user, 1]
-  - [todos_destroyer, 1]
-  - [delete_merged_branches, 1]
-  - [authorized_projects, 2]
-  - [expire_build_instance_artifacts, 1]
-  - [group_destroy, 1]
-  - [irker, 1]
-  - [namespaceless_project_destroy, 1]
-  - [project_cache, 1]
-  - [project_destroy, 1]
-  - [project_export, 1]
-  - [web_hook, 1]
-  - [repository_check, 1]
-  - [git_garbage_collect, 1]
-  - [reactive_caching, 1]
-  - [cronjob, 1]
-  - [default, 1]
-  - [pages, 1]
-  - [system_hook_push, 1]
-  - [propagate_service_template, 1]
-  - [background_migration, 1]
-  - [gcp_cluster, 1]
-  - [project_migrate_hashed_storage, 1]
-  - [project_rollback_hashed_storage, 1]
-  - [hashed_storage, 1]
-  - [pages_domain_verification, 1]
-  - [pages_domain_ssl_renewal, 1]
-  - [object_storage_upload, 1]
-  - [object_storage, 1]
-  - [file_hook, 1]
-  - [pipeline_background, 1]
-  - [repository_update_remote_mirror, 1]
-  - [repository_remove_remote, 1]
-  - [create_note_diff_file, 1]
-  - [delete_diff_files, 1]
-  - [detect_repository_languages, 1]
-  - [auto_devops, 2]
-  - [container_repository, 1]
-  - [object_pool, 1]
-  - [repository_cleanup, 1]
-  - [delete_stored_files, 1]
-  - [remote_mirror_notification, 2]
-  - [project_daily_statistics, 1]
-  - [import_issues_csv, 2]
-  - [chat_notification, 2]
-  - [migrate_external_diffs, 1]
-  - [update_project_statistics, 1]
-  - [phabricator_import_import_tasks, 1]
-  - [update_namespace_statistics, 1]
-  - [chaos, 2]
-  - [create_evidence, 2]
-  - [group_export, 1]
-  - [self_monitoring_project_create, 2]
-  - [self_monitoring_project_delete, 2]
-
-  # EE-specific queues
-  - [analytics, 1]
-  - [ldap_group_sync, 2]
-  - [create_github_webhook, 2]
-  - [geo, 1]
-  - [repository_update_mirror, 1]
-  - [repository_push_audit_event, 1]
-  - [new_epic, 2]
-  - [project_import_schedule, 1]
-  - [project_update_repository_storage, 1]
-  - [admin_emails, 1]
-  - [elastic_batch_project_indexer, 1]
-  - [elastic_indexer, 1]
-  - [elastic_full_index, 1]
-  - [elastic_commit_indexer, 1]
-  - [elastic_namespace_indexer, 1]
-  - [elastic_namespace_rollout, 1]
-  - [export_csv, 1]
-  - [incident_management, 2]
-  - [jira_connect, 1]
-  - [update_external_pull_requests, 3]
-  - [refresh_license_compliance_checks, 2]
-  - [design_management_new_version, 1]
-  - [epics, 2]
-  - [personal_access_tokens, 1]
-  - [adjourned_project_deletion, 1]
+- - adjourned_project_deletion
+  - 1
+- - admin_emails
+  - 1
+- - authorized_projects
+  - 2
+- - auto_devops
+  - 2
+- - auto_merge
+  - 3
+- - background_migration
+  - 1
+- - chaos
+  - 2
+- - chat_notification
+  - 2
+- - container_repository
+  - 1
+- - create_commit_signature
+  - 2
+- - create_evidence
+  - 2
+- - create_github_webhook
+  - 2
+- - create_note_diff_file
+  - 1
+- - cronjob
+  - 1
+- - default
+  - 1
+- - delete_diff_files
+  - 1
+- - delete_merged_branches
+  - 1
+- - delete_stored_files
+  - 1
+- - delete_user
+  - 1
+- - deployment
+  - 3
+- - design_management_new_version
+  - 1
+- - detect_repository_languages
+  - 1
+- - elastic_batch_project_indexer
+  - 1
+- - elastic_commit_indexer
+  - 1
+- - elastic_full_index
+  - 1
+- - elastic_indexer
+  - 1
+- - elastic_namespace_indexer
+  - 1
+- - elastic_namespace_rollout
+  - 1
+- - email_receiver
+  - 2
+- - emails_on_push
+  - 2
+- - epics
+  - 2
+- - error_tracking_issue_link
+  - 1
+- - expire_build_instance_artifacts
+  - 1
+- - export_csv
+  - 1
+- - file_hook
+  - 1
+- - gcp_cluster
+  - 1
+- - geo
+  - 1
+- - git_garbage_collect
+  - 1
+- - github_import_advance_stage
+  - 1
+- - github_importer
+  - 1
+- - gitlab_shell
+  - 2
+- - group_destroy
+  - 1
+- - group_export
+  - 1
+- - group_import
+  - 1
+- - hashed_storage
+  - 1
+- - import_issues_csv
+  - 2
+- - incident_management
+  - 2
+- - invalid_gpg_signature_update
+  - 2
+- - irker
+  - 1
+- - jira_connect
+  - 1
+- - ldap_group_sync
+  - 2
+- - mail_scheduler
+  - 2
+- - mailers
+  - 2
+- - merge
+  - 5
+- - merge_request_mergeability_check
+  - 1
+- - migrate_external_diffs
+  - 1
+- - namespaceless_project_destroy
+  - 1
+- - new_epic
+  - 2
+- - new_issue
+  - 2
+- - new_merge_request
+  - 2
+- - new_note
+  - 2
+- - notifications
+  - 2
+- - object_pool
+  - 1
+- - object_storage
+  - 1
+- - package_repositories
+  - 1
+- - pages
+  - 1
+- - pages_domain_ssl_renewal
+  - 1
+- - pages_domain_verification
+  - 1
+- - personal_access_tokens
+  - 1
+- - phabricator_import_import_tasks
+  - 1
+- - pipeline_background
+  - 1
+- - pipeline_cache
+  - 3
+- - pipeline_creation
+  - 4
+- - pipeline_default
+  - 3
+- - pipeline_hooks
+  - 2
+- - pipeline_processing
+  - 5
+- - post_receive
+  - 5
+- - process_commit
+  - 3
+- - project_cache
+  - 1
+- - project_daily_statistics
+  - 1
+- - project_destroy
+  - 1
+- - project_export
+  - 1
+- - project_import_schedule
+  - 1
+- - project_service
+  - 1
+- - project_update_repository_storage
+  - 1
+- - propagate_service_template
+  - 1
+- - reactive_caching
+  - 1
+- - rebase
+  - 2
+- - refresh_license_compliance_checks
+  - 2
+- - remote_mirror_notification
+  - 2
+- - repository_check
+  - 1
+- - repository_cleanup
+  - 1
+- - repository_fork
+  - 1
+- - repository_import
+  - 1
+- - repository_push_audit_event
+  - 1
+- - repository_remove_remote
+  - 1
+- - repository_update_mirror
+  - 1
+- - repository_update_remote_mirror
+  - 1
+- - security_scans
+  - 2
+- - self_monitoring_project_create
+  - 2
+- - self_monitoring_project_delete
+  - 2
+- - service_desk_email_receiver
+  - 1
+- - system_hook_push
+  - 1
+- - todos_destroyer
+  - 1
+- - update_external_pull_requests
+  - 3
+- - update_merge_requests
+  - 3
+- - update_namespace_statistics
+  - 1
+- - update_project_statistics
+  - 1
+- - upload_checksum
+  - 1
+- - web_hook
+  - 1
diff --git a/config/unicorn.rb.example b/config/unicorn.rb.example
index 9f13fac5cca..77e440eddde 100644
--- a/config/unicorn.rb.example
+++ b/config/unicorn.rb.example
@@ -82,6 +82,7 @@ preload_app true
 check_client_connection false
 
 require_relative "/home/git/gitlab/lib/gitlab/cluster/lifecycle_events"
+require_relative "/home/git/gitlab/lib/gitlab/log_timestamp_formatter.rb"
 
 before_exec do |server|
   # Signal application hooks that we're about to restart
@@ -137,3 +138,7 @@ after_fork do |server, worker|
   # addr = "127.0.0.1:#{9293 + worker.nr}"
   # server.listen(addr, :tries => -1, :delay => 5, :tcp_nopush => true)
 end
+
+# Configure the default logger to use a custom formatter that formats the
+# timestamps to be in UTC and in ISO8601.3 format
+Configurator::DEFAULTS[:logger].formatter = Gitlab::LogTimestampFormatter.new
diff --git a/config/unicorn.rb.example.development b/config/unicorn.rb.example.development
index 92bb1c7344a..2c6e809f753 100644
--- a/config/unicorn.rb.example.development
+++ b/config/unicorn.rb.example.development
@@ -15,6 +15,7 @@ preload_app true
 check_client_connection false
 
 require_relative "/home/git/gitlab/lib/gitlab/cluster/lifecycle_events"
+require_relative "/home/git/gitlab/lib/gitlab/log_timestamp_formatter.rb"
 
 before_exec do |server|
   # Signal application hooks that we're about to restart
@@ -70,3 +71,7 @@ after_fork do |server, worker|
   # addr = "127.0.0.1:#{9293 + worker.nr}"
   # server.listen(addr, :tries => -1, :delay => 5, :tcp_nopush => true)
 end
+
+# Configure the default logger to use a custom formatter that formats the
+# timestamps to be in UTC and in ISO8601.3 format
+Configurator::DEFAULTS[:logger].formatter = Gitlab::LogTimestampFormatter.new
diff --git a/config/webpack.config.js b/config/webpack.config.js
index 7da7e571d67..639de770fd8 100644
--- a/config/webpack.config.js
+++ b/config/webpack.config.js
@@ -92,6 +92,7 @@ const alias = {
   vendor: path.join(ROOT_PATH, 'vendor/assets/javascripts'),
   vue$: 'vue/dist/vue.esm.js',
   spec: path.join(ROOT_PATH, 'spec/javascripts'),
+  jest: path.join(ROOT_PATH, 'spec/frontend'),
 
   // the following resolves files which are different between CE and EE
   ee_else_ce: path.join(ROOT_PATH, 'app/assets/javascripts'),
@@ -111,6 +112,7 @@ if (IS_EE) {
     ee_icons: path.join(ROOT_PATH, 'ee/app/views/shared/icons'),
     ee_images: path.join(ROOT_PATH, 'ee/app/assets/images'),
     ee_spec: path.join(ROOT_PATH, 'ee/spec/javascripts'),
+    ee_jest: path.join(ROOT_PATH, 'ee/spec/frontend'),
     ee_else_ce: path.join(ROOT_PATH, 'ee/app/assets/javascripts'),
   });
 }
diff --git a/config/webpack.vendor.config.js b/config/webpack.vendor.config.js
index bddbf067d7c..90736349d91 100644
--- a/config/webpack.vendor.config.js
+++ b/config/webpack.vendor.config.js
@@ -1,6 +1,7 @@
 const path = require('path');
 const webpack = require('webpack');
 const vendorDllHash = require('./helpers/vendor_dll_hash');
+const { YarnCheck } = require('yarn-check-webpack-plugin');
 
 const ROOT_PATH = path.resolve(__dirname, '..');
 
@@ -29,7 +30,7 @@ module.exports = {
       'vuex',
       'pikaday',
       'vue/dist/vue.esm.js',
-      'at.js',
+      '@gitlab/at.js',
       'jed',
       'mermaid',
       'katex',
@@ -60,6 +61,11 @@ module.exports = {
       path: path.join(dllCachePath, '[name].dll.manifest.json'),
       name: '[name]_[hash]',
     }),
+    new YarnCheck({
+      rootDirectory: ROOT_PATH,
+      exclude: /ts-jest/,
+      forceKill: true,
+    }),
   ],
 
   node: {