The `api` scope for access tokens grants read and write access to the
Container Registry and Dependency Proxy. However, the documentation
and UI do not reflect that, they only mention the Package Registry.
This change updates the UI and documentation to reflect the current
behavior.

Changelog: changed

Enforce users to accept the latest terms by a feature flag

Changelog: other

Changelog: removed

This is the third and last part of the merging the overarching
subscription MR at
https://gitlab.com/gitlab-org/gitlab/-/merge_requests/132460 .

This provides the controller, route and service used to create
subscriptions.

We add the `inbox` endpoint as specified by ActivityPub on our
`releases` actor to receive various post requests. The only requests we
accept are Follow and unfollow (Undo > Follow) ones. If we receive an
other kind of activity (that could be, for example, that someone
commented on our release post in the Fediverse), we silently discard it.

The service's role is to create the blank subscription and to queue the
background job that will resolve the various URLs and prepare the
subscription.

Changelog: fixed

It adds a condition on partition_id to be have
the same value between the relations.

This allows for more accurate and safe parsing rather
than relying on complex regexs to parse markdown.

https://gitlab.com/gitlab-org/gitlab/-/issues/378613

Changelog: fixed

This change increases the maximum page size to 500 for the
contribution analytics queries.

Changelog: changed
EE: true

Changelog: performance

MR: gitlab.com/gitlab-org/gitlab/-/merge_requests/136993
Changelog: other

This has already been enabled by default for several releases

Changelog: other

This introduces a new filter and pipeline for Duo Chat where we change
the links from relative to absolute ones. This is necessary because if
the LLM includes a link from the documentation, the user needs to be
able to click on it and gets to the correct URL.

This is to prevent GitlabSettings::MissingSetting, as you apparently
can't stub a non-existing example setting with `stub_config`.

Contributes to https://gitlab.com/gitlab-org/gitlab/-/issues/429049

**Problem**

1. It's possible to run multiple migration workers for the same
project/snippet/group simultaneously
2. The worker can be killed and rescheduled by Sidekiq interrupt signal.
It will leave the migration in inconsistent state.

**Solution**

Use an exclusive lock in storage migration workers. The exclusive lease
key includes a project/snippet/group id to prevent simultaneous updates.
The key value is a Sidekiq worker jid to track the owner of the update.

This setup should handle following situations:
1. Worker tries to migrate a repository under existing
migration (result: job is marked as failed)
2. Worker started a migration but was interrupted and
rescheduled. (result: job is marked as failed, lock is released)

Changelog: fixed

This makes the sentry settings in the admin panel to appear by default

Changelog: other

- The SyncServiceToken worker is a Sidekiq CronWorker
- It’s triggered once per day.
- It is responsible for refreshing the JWT Service token
- It makes a request to the Subscription Portal with the license key

Feature has been active for many milestones, no need to keep this live.

Changelog: other

The feature is already available on gitlab.com.
Updating it to enabled by default.

Changelog: other

It's possible to send additional context about selected text in Duo Chat
now.

Changelog: added
EE: true

A new boolean group setting is introduced in order to control
whether SSH certificates are enforced or not.

The previous approach can be safely removed later because
it hasn't been released yet.

A customer has noticed that with the current approach deploy
key won't be accepted as well. It shows the limitation of
treating SSH certificates as a separate Git protocol.

Changelog: added

This reverts commit 3c426a56, reversing
changes made to 33761759.

Changelog: removed

Signed-off-by: Rémy Coutable <remy@rymai.me>

Changelog: other

Changelog: added

The tool filter on the project vulnerability report page can now filter
vulnerabilities by scanners.

This MR removes all the code related to the feature flag development.

Changelog: changed
EE: true

This patch has been removed along with Rails 7 upgrade.
However, it includes the ability to specify Proc as a
value to disable_joins: it's somethings that Rails
doesn't provide.

Changelog: changed

Add default attribute_statements to support Microsoft SAML
attribute format. Microsoft uses a URL format by default. Prior
to this change self-managed instances had to manually configure
attribute statements and SaaS users had to add custom attributes
to their SAML responses. This makes both self-managed and SaaS
work out of the box with Microsoft.

Changelog: changed

- This will be used as a stopping point for
  user leaving the site.
- The user can make sure the URL is a place they want
  to go to.
- Especially helpful when URL's are coming from
  user land like Mastodon social.