doc/user/group/settings/group_access_tokens.md

@@ -24,6 +24,8 @@ Group access tokens are similar to [project access tokens](../../project/setting
 and [personal access tokens](../../profile/personal_access_tokens.md), except they are
 associated with a group rather than a project or user.
 
+In self-managed instances, group access tokens are subject to the same [maximum lifetime limits](../../admin_area/settings/account_and_limit_settings.md#limit-the-lifetime-of-personal-access-tokens) as personal access tokens if the limit is set. 
+
 You can use group access tokens:
 
 - On GitLab SaaS if you have the Premium license tier or higher. Group access tokens are not available with a [trial license](https://about.gitlab.com/free-trial/).
@@ -45,7 +47,7 @@ To create a group access token:
 1. On the top bar, select **Menu > Groups** and find your group.
 1. On the left sidebar, select **Settings > Access Tokens**.
 1. Enter a name. The token name is visible to any user with permissions to view the group.
-1. Optional. Enter an expiry date for the token. The token will expire on that date at midnight UTC.
+1. Optional. Enter an expiry date for the token. The token will expire on that date at midnight UTC. An instance-wide [maximum lifetime](../../admin_area/settings/account_and_limit_settings.md#limit-the-lifetime-of-personal-access-tokens) setting can limit the maximum allowable lifetime in self-managed instances.
 1. Select a role for the token.
 1. Select the [desired scopes](#scopes-for-a-group-access-token).
 1. Select  **Create group access token**.

doc/user/packages/dependency_proxy/index.md

@@ -132,7 +132,8 @@ There are other additional predefined CI/CD variables you can also use:
 - `CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX`: the image prefix for pulling images through the
   dependency proxy from the direct group or subgroup that the project belongs to.
 
-`CI_DEPENDENCY_PROXY_SERVER` and `CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX`
+`CI_DEPENDENCY_PROXY_SERVER`, `CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX`, and
+`CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX`
 include the server port. If you explicitly include the Dependency Proxy
 path, the port must be included, unless you have logged into the Dependency
 Proxy manually without including the port:

doc/user/profile/notifications.md

@@ -11,7 +11,7 @@ Stay informed about what's happening in GitLab with email notifications.
 You can receive updates about activity in issues, merge requests, epics, and designs.
 
 For the tool that GitLab administrators can use to send messages to users, read
-[Email from GitLab](../../tools/email.md).
+[Email from GitLab](../admin_area/email_from_gitlab.md).
 
 ## Who receives notifications
 
@@ -21,11 +21,14 @@ that happen there.
 You might receive notifications for one of the following reasons:
 
 - You participate in an issue, merge request, epic, or design. You become a participant when you comment
-  or edit, or someone mentions you.
+  or edit, or someone mentions <sup>1</sup> you.
 - You've [enabled notifications in an issue, merge request, or epic](#notifications-on-issues-merge-requests-and-epics).
 - You've configured notifications for the [project](#change-level-of-project-notifications) or [group](#group-notifications).
 - You're subscribed to group or project pipeline notifications via the pipeline emails [integration](../project/integrations/overview.md).
 
+1. GitLab doesn't send a notification when
+   [a comment is edited to include a user mention](../discussions/index.md#editing-a-comment-to-add-a-mention).
+
 NOTE:
 Administrators can block notifications, preventing them from being sent.
 
@@ -305,7 +308,7 @@ If you no longer wish to receive any email notifications:
    **Disabled**.
 
 On self-managed installations, even after doing this, your instance administrator
-[can still email you](../../tools/email.md).
+[can still email you](../admin_area/email_from_gitlab.md).
 To unsubscribe, select the unsubscribe link in one of these emails.
 
 ## Email headers you can use to filter email

doc/user/project/deploy_tokens/index.md

@@ -16,7 +16,9 @@ container registry images of a project without having a user and a password.
 
 Deploy tokens can be managed only by users with the Maintainer role.
 
-Deploy tokens cannot be used with the GitLab API.
+Deploy tokens can't be used with the GitLab public API. However, you can use deploy tokens with some
+endpoints, such as those from the Package Registry. For details, see
+[Authenticate with the registry](../../packages/package_registry/index.md#authenticate-with-the-registry).
 
 Deploy tokens are tied to the project and stay enabled even when the user who created the token is removed from the project.
 

doc/user/project/integrations/overview.md

@@ -22,9 +22,9 @@ want to configure.
 
 ## Integrations listing
 
-Click on the service links to see further configuration instructions and details.
+Click on the integration links to see further configuration instructions and details.
 
-| Service                                                   | Description                                                                                  | Service hooks          |
+| Integration                                               | Description                                                                                  | Integration hooks      |
 | --------------------------------------------------------- | -------------------------------------------------------------------------------------------- | ---------------------- |
 | [Asana](asana.md)                                         | Add commit messages as comments to Asana tasks.                                              | **{dotted-circle}** No |
 | Assembla                                                  | Manage projects.                                                                             | **{dotted-circle}** No |
@@ -69,7 +69,7 @@ Click on the service links to see further configuration instructions and details
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/17874) in GitLab 12.4.
 
-If a single push includes changes to more than three branches or tags, services
+If a single push includes changes to more than three branches or tags, integrations
 supported by `push_hooks` and `tag_push_hooks` events aren't executed.
 
 The number of branches or tags supported can be changed via
@@ -94,7 +94,7 @@ and some integrations.
 
 ## Troubleshooting integrations
 
-Some integrations use service hooks for integration with external applications. To confirm which ones use service hooks, see the [integrations listing](#integrations-listing) above. Learn more about [troubleshooting service hooks](webhooks.md#troubleshoot-webhooks).
+Some integrations use hooks for integration with external applications. To confirm which ones use integration hooks, see the [integrations listing](#integrations-listing) above. Learn more about [troubleshooting integration hooks](webhooks.md#troubleshoot-webhooks).
 
 ### Uninitialized repositories
 

doc/user/project/issues/managing_issues.md

@@ -342,7 +342,7 @@ To do it:
 
    issues.each do |issue|
       if issue.state != "closed" && issue.moved_to.nil?
-         Issues::MoveService.new(project, admin_user).execute(issue, target_project)
+         Issues::MoveService.new(project: project, current_user: admin_user).execute(issue, target_project)
       else
          puts "issue with id: #{issue.id} and title: #{issue.title} was not moved"
       end

doc/user/project/settings/import_export.md

@@ -383,3 +383,17 @@ s = Gitlab::ImportExport::Saver.new(exportable: p, shared:p.import_export_shared
 s.send(:compress_and_save)
 s.send(:save_upload)
 ```
+
+### Import using the REST API fails when using a group access token
+
+[Group access tokens](../../group/settings/group_access_tokens.md)
+don't work for project or group import operations. When a group access token initiates an import,
+the import fails with this message:
+
+```plaintext
+Error adding importer user to Project members.
+Validation failed: User project bots cannot be added to other groups / projects
+```
+
+To use [Import REST APIs](../../../api/project_import_export.md),
+pass regular user account credentials such as [personal access tokens](../../profile/personal_access_tokens.md).

doc/user/project/settings/project_access_tokens.md

@@ -12,17 +12,16 @@ type: reference, howto
 > - [Feature flag removed](https://gitlab.com/gitlab-org/gitlab/-/issues/235765) in GitLab 13.5.
 > - [Changed](https://gitlab.com/gitlab-org/gitlab/-/issues/342327) in GitLab 14.5. Default prefix added.
 
-You can use a project access token to authenticate:
+Project access tokens are similar to passwords, except you can [limit access to resources](#scopes-for-a-project-access-token),
+select a limited role, and provide an expiry date.
 
-- With the [GitLab API](../../../api/index.md#personalprojectgroup-access-tokens).
-- With Git, when using HTTP Basic Authentication.
+Use a project access token to authenticate:
 
-After you configure a project access token, you don't need a password when you authenticate.
-Instead, you can enter any non-blank value.
+- With the [GitLab API](../../../api/index.md#personalprojectgroup-access-tokens).
+- With Git, when using HTTP Basic Authentication. You can use any non-blank value for a password.
 
 Project access tokens are similar to [group access tokens](../../group/settings/group_access_tokens.md)
-and [personal access tokens](../../profile/personal_access_tokens.md), except they are
-associated with a project rather than a group or user.
+and [personal access tokens](../../profile/personal_access_tokens.md).
 
 In self-managed instances, project access tokens are subject to the same [maximum lifetime limits](../../admin_area/settings/account_and_limit_settings.md#limit-the-lifetime-of-personal-access-tokens) as personal access tokens if the limit is set.
 

ee/app/assets/javascripts/analytics/group_ci_cd_analytics/components/shared_runner_usage.vue

@@ -7,6 +7,8 @@ import { convertToGraphQLId } from '~/graphql_shared/utils';
 import { s__, __ } from '~/locale';
 import getCiMinutesUsageByNamespace from '../graphql/ci_minutes.query.graphql';
 
+const timeFormatter = (val) => val;
+
 export default {
   components: {
     GlIcon,
@@ -55,6 +57,9 @@ export default {
         },
         yAxis: {
           name: this.$options.i18n.yAxisLabel,
+          axisLabel: {
+            formatter: timeFormatter,
+          },
         },
       };
     },
@@ -64,7 +69,10 @@ export default {
         .sort((a, b) => {
           return new Date(a.monthIso8601) - new Date(b.monthIso8601);
         })
-        .map((cur) => [formatDate(cur.monthIso8601, 'mmm yyyy'), cur.sharedRunnersDuration]);
+        .map((cur) => [
+          formatDate(cur.monthIso8601, 'mmm yyyy'),
+          parseFloat((cur.sharedRunnersDuration / 60).toFixed(2)),
+        ]);
     },
     isDataEmpty() {
       return this.minutesUsageDataByMonth.length === 0;

ee/app/assets/javascripts/pages/projects/path_locks/index.js

 import initDeprecatedRemoveRowBehavior from '~/behaviors/deprecated_remove_row_behavior';
 
-document.addEventListener('DOMContentLoaded', () => {
-  initDeprecatedRemoveRowBehavior();
+initDeprecatedRemoveRowBehavior();
 
-  const locks = document.querySelector('.locks');
+const locks = document.querySelector('.locks');
 
-  locks.addEventListener('ajax:success', () => {
-    const allRowsHidden = [...locks.querySelectorAll('li')].every((x) => x.offsetParent === null);
+locks.addEventListener('ajax:success', () => {
+  const allRowsHidden = [...locks.querySelectorAll('li')].every((x) => x.offsetParent === null);
 
-    if (allRowsHidden) {
-      locks.querySelector('.nothing-here-block.hidden')?.classList?.remove('hidden');
-    }
-  });
+  if (allRowsHidden) {
+    locks.querySelector('.nothing-here-block.hidden')?.classList?.remove('hidden');
+  }
 });

ee/app/assets/javascripts/pages/registrations/company/new/index.js

+import mountComponents from 'ee/registrations/company/new';
+
+mountComponents();

ee/app/assets/javascripts/pages/trials/apply/index.js

 import 'ee/trials/namespace_select';
 import 'ee/trials/track_trial_user_errors';
+import { initFlashAlert } from 'ee/trials/init_flash_alert';
+
+initFlashAlert();

ee/app/assets/javascripts/pages/trials/create_lead/index.js

 import 'ee/trials/track_trial_user_errors';
 import { initTrialCreateLeadForm } from 'ee/trials/init_create_lead_form';
+import { initFlashAlert } from 'ee/trials/init_flash_alert';
 
 initTrialCreateLeadForm();
+initFlashAlert();

ee/app/assets/javascripts/registrations/company/new/index.js

+import Vue from 'vue';
+import apolloProvider from 'ee/subscriptions/buy_addons_shared/graphql';
+import RegistrationForm from 'ee/registrations/components/company_form.vue';
+
+export default () => {
+  const el = document.querySelector('#js-company-registration-form');
+
+  const { trial, createLeadPath } = el.dataset;
+
+  return new Vue({
+    el,
+    apolloProvider,
+    provide: { createLeadPath },
+    render(createElement) {
+      return createElement(RegistrationForm, {
+        props: { trial },
+      });
+    },
+  });
+};

ee/app/assets/javascripts/registrations/components/company_form.vue

+<script>
+import { GlForm, GlButton, GlFormGroup, GlFormInput, GlFormSelect, GlFormText } from '@gitlab/ui';
+import {
+  LEADS_COMPANY_NAME_LABEL,
+  LEADS_COMPANY_SIZE_LABEL,
+  LEADS_PHONE_NUMBER_LABEL,
+  companySizes,
+} from 'ee/vue_shared/leads/constants';
+import csrf from '~/lib/utils/csrf';
+import { __ } from '~/locale';
+import CountryOrRegionSelector from 'ee/trials/components/country_or_region_selector.vue';
+import {
+  TRIAL_COMPANY_SIZE_PROMPT,
+  TRIAL_PHONE_DESCRIPTION,
+  TRIAL_FORM_SUBMIT_TEXT,
+} from 'ee/trials/constants';
+import RegistrationTrialToggle from 'ee/registrations/components/registration_trial_toggle.vue';
+
+export default {
+  csrf,
+  components: {
+    GlForm,
+    GlButton,
+    GlFormGroup,
+    GlFormInput,
+    GlFormSelect,
+    GlFormText,
+    CountryOrRegionSelector,
+    RegistrationTrialToggle,
+  },
+  inject: ['createLeadPath'],
+  props: {
+    trial: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
+  },
+  data() {
+    return {
+      companyName: '',
+      companySize: null,
+      phoneNumber: null,
+      country: '',
+      state: '',
+      websiteUrl: '',
+    };
+  },
+  computed: {
+    companySizeOptionsWithDefault() {
+      return [
+        {
+          name: this.$options.i18n.companySizeSelectPrompt,
+          id: null,
+        },
+        ...companySizes,
+      ];
+    },
+  },
+  i18n: {
+    companyNameLabel: LEADS_COMPANY_NAME_LABEL,
+    companySizeLabel: LEADS_COMPANY_SIZE_LABEL,
+    companySizeSelectPrompt: TRIAL_COMPANY_SIZE_PROMPT,
+    phoneNumberLabel: LEADS_PHONE_NUMBER_LABEL,
+    phoneNumberDescription: TRIAL_PHONE_DESCRIPTION,
+    formSubmitText: TRIAL_FORM_SUBMIT_TEXT,
+    optional: __('(optional)'),
+    websiteLabel: __('Website'),
+    trialLabel: __('GitLab Ultimate trial'),
+    trialDescription: __('Try all GitLab features for free for 30 days. No credit card required.'),
+  },
+};
+</script>
+
+<template>
+  <gl-form :action="createLeadPath" method="post" novalidate>
+    <input :value="$options.csrf.token" type="hidden" name="authenticity_token" />
+    <div class="gl-display-flex gl-flex-direction-column gl-sm-flex-direction-row gl-mt-5">
+      <gl-form-group
+        :label="$options.i18n.companyNameLabel"
+        label-size="sm"
+        label-for="company_name"
+        class="gl-mr-5 gl-w-half gl-xs-w-full"
+      >
+        <gl-form-input
+          id="company_name"
+          :value="companyName"
+          name="company_name"
+          data-testid="company_name"
+          required
+        />
+      </gl-form-group>
+      <gl-form-group
+        :label="$options.i18n.companySizeLabel"
+        label-size="sm"
+        label-for="company_size"
+        class="gl-w-half gl-xs-w-full company-size"
+      >
+        <gl-form-select
+          id="company_size"
+          :value="companySize"
+          name="company_size"
+          :options="companySizeOptionsWithDefault"
+          value-field="id"
+          text-field="name"
+          data-testid="company_size"
+          required
+        />
+      </gl-form-group>
+    </div>
+    <country-or-region-selector :country="country" :state="state" data-testid="country" required />
+    <gl-form-group
+      :label="$options.i18n.phoneNumberLabel"
+      :optional-text="$options.i18n.optional"
+      label-size="sm"
+      :description="$options.i18n.phoneNumberDescription"
+      label-for="phone_number"
+      optional
+    >
+      <gl-form-input
+        id="phone_number"
+        :value="phoneNumber"
+        name="phone_number"
+        type="tel"
+        data-testid="phone_number"
+        pattern="^(\+)*[0-9-\s]+$"
+      />
+    </gl-form-group>
+    <gl-form-group
+      :label="$options.i18n.websiteLabel"
+      :optional-text="$options.i18n.optional"
+      label-size="sm"
+      label-for="website_url"
+      optional
+    >
+      <gl-form-input
+        id="website_url"
+        :value="websiteUrl"
+        name="website_url"
+        data-testid="website_url"
+      />
+    </gl-form-group>
+    <gl-form-group
+      :label="$options.i18n.trialLabel"
+      label-size="sm"
+      :optional-text="$options.i18n.optional"
+      optional
+    >
+      <gl-form-text class="gl-pb-3">{{ $options.i18n.trialDescription }}</gl-form-text>
+      <registration-trial-toggle :active="trial" data-testid="trial" />
+    </gl-form-group>
+    <gl-button type="submit" variant="confirm" class="gl-w-20">
+      {{ $options.i18n.formSubmitText }}
+    </gl-button>
+  </gl-form>
+</template>
+
+<style>
+.company-size {
+  line-height: 1.2rem;
+}
+</style>

ee/app/assets/javascripts/repository/components/lock_button.vue

@@ -96,7 +96,10 @@ export default {
       modal-id="lock-file-modal"
       :visible="isModalVisible"
       :title="$options.i18n.modalTitle"
-      :action-primary="{ text: $options.i18n.actionPrimary }"
+      :action-primary="{
+        text: $options.i18n.actionPrimary,
+        attributes: { variant: 'confirm', 'data-qa-selector': 'confirm_ok_button' },
+      }"
       :action-cancel="{ text: $options.i18n.actionCancel }"
       @primary="handleModalPrimary"
       @hide="hideModal"

ee/app/assets/javascripts/security_dashboard/components/pipeline/pipeline_security_dashboard.vue

@@ -7,6 +7,7 @@ import { fetchPolicies } from '~/lib/graphql';
 import { s__ } from '~/locale';
 import glFeatureFlagMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import ScanAlerts, { TYPE_ERRORS, TYPE_WARNINGS } from './scan_alerts.vue';
+import ReportStatusAlert, { STATUS_PURGED } from './report_status_alert.vue';
 import SecurityDashboard from './security_dashboard_vuex.vue';
 import SecurityReportsSummary from './security_reports_summary.vue';
 import PipelineVulnerabilityReport from './pipeline_vulnerability_report.vue';
@@ -15,8 +16,10 @@ export default {
   name: 'PipelineSecurityDashboard',
   errorsAlertType: TYPE_ERRORS,
   warningsAlertType: TYPE_WARNINGS,
+  scanPurgedStatus: STATUS_PURGED,
   components: {
     GlEmptyState,
+    ReportStatusAlert,
     ScanAlerts,
     SecurityReportsSummary,
     SecurityDashboard,
@@ -87,21 +90,27 @@ export default {
             .flatMap(getScans)
         : [];
     },
+    purgedScans() {
+      return this.scans.filter((scan) => scan.status === this.$options.scanPurgedStatus);
+    },
+    hasPurgedScans() {
+      return this.purgedScans.length > 0;
+    },
     scansWithErrors() {
       const hasErrors = (scan) => Boolean(scan.errors?.length);
 
       return this.scans.filter(hasErrors);
     },
-    hasScansWithErrors() {
-      return this.scansWithErrors.length > 0;
+    showScanErrors() {
+      return this.scansWithErrors.length > 0 && !this.hasPurgedScans;
     },
     scansWithWarnings() {
       const hasWarnings = (scan) => Boolean(scan.warnings?.length);
 
       return this.scans.filter(hasWarnings);
     },
-    hasScansWithWarnings() {
-      return this.scansWithWarnings.length > 0;
+    showScanWarnings() {
+      return this.scansWithWarnings.length > 0 && !this.hasPurgedScans;
     },
   },
   created() {
@@ -130,7 +139,7 @@ export default {
   <div>
     <div v-if="reportSummary" class="gl-my-5">
       <scan-alerts
-        v-if="hasScansWithErrors"
+        v-if="showScanErrors"
         :type="$options.errorsAlertType"
         :scans="scansWithErrors"
         :title="$options.i18n.parsingErrorAlertTitle"
@@ -138,13 +147,14 @@ export default {
         class="gl-mb-5"
       />
       <scan-alerts
-        v-if="hasScansWithWarnings"
+        v-if="showScanWarnings"
         :type="$options.warningsAlertType"
         :scans="scansWithWarnings"
         :title="$options.i18n.parsingWarningAlertTitle"
         :description="$options.i18n.parsingWarningAlertDescription"
         class="gl-mb-5"
       />
+      <report-status-alert v-if="hasPurgedScans" class="gl-mb-5" />
       <security-reports-summary :summary="reportSummary" :jobs="jobs" />
     </div>
     <security-dashboard

ee/app/assets/javascripts/security_dashboard/components/pipeline/report_status_alert.vue

+<script>
+import { GlAlert, GlSprintf, GlButton } from '@gitlab/ui';
+import { s__ } from '~/locale';
+
+export const STATUS_PURGED = 'PURGED';
+
+export default {
+  components: {
+    GlAlert,
+    GlSprintf,
+    GlButton,
+  },
+  inject: ['vulnerabilityRetentionPeriodHelpPageLink'],
+  i18n: {
+    reportStatusTitle: s__('SecurityReports|Report has expired'),
+    reportExpiredMessage: s__(
+      `SecurityReports|The security report for this pipeline has %{helpPageLinkStart}expired%{helpPageLinkEnd}. Re-run the pipeline to generate a new security report.`,
+    ),
+  },
+};
+</script>
+
+<template>
+  <gl-alert variant="info" :dismissible="false">
+    <strong role="heading">{{ $options.i18n.reportStatusTitle }}</strong>
+    <p class="gl-mt-3">
+      <gl-sprintf :message="$options.i18n.reportExpiredMessage" data-testid="description">
+        <template #helpPageLink="{ content }">
+          <gl-button
+            variant="link"
+            icon="external-link"
+            :href="vulnerabilityRetentionPeriodHelpPageLink"
+            target="_blank"
+          >
+            {{ content }}
+          </gl-button>
+        </template>
+      </gl-sprintf>
+    </p>
+  </gl-alert>
+</template>

ee/app/assets/javascripts/security_dashboard/components/shared/vulnerability_report/vulnerability_list_graphql.vue

@@ -98,9 +98,8 @@ export default {
       update(data) {
         const vulnerabilities = this.getVulnerabilitiesFromData(data);
         this.pageInfo = vulnerabilities.pageInfo;
-        // The id property is used for the bulk select feature. Vulnerabilities use 'id' and
-        // pipeline findings use 'uuid', so we'll normalize it to 'id'.
-        return vulnerabilities.nodes.map((v) => ({ ...v, id: v.id || v.uuid }));
+
+        return vulnerabilities.nodes;
       },
       error() {
         createFlash({
@@ -180,11 +179,11 @@ export default {
       }
     },
     sort(newSort, oldSort) {
-      // Clear out the vulnerabilities so that the skeleton loader is shown.
-      this.vulnerabilities = [];
       // Anything that changes the querystring will also trigger this watcher (because sort is
       // recomputed), so we need to check that the sort has changed before we reset the paging.
       if (newSort.sortBy !== oldSort.sortBy || newSort.sortDesc !== oldSort.sortDesc) {
+        // Clear out the vulnerabilities so that the skeleton loader is shown.
+        this.vulnerabilities = [];
         this.resetPaging();
       }
     },

ee/app/assets/javascripts/security_dashboard/graphql/fragments/security_report_scans.fragment.graphql

@@ -2,6 +2,7 @@ fragment SecurityReportSummaryScans on SecurityReportSummarySection {
   scans {
     nodes {
       name
+      status
       errors
       warnings
     }