diff --git a/debian/patches/0050-relax-stable-libs.patch b/debian/patches/0050-relax-stable-libs.patch
index 133cc54928..80d6ba1848 100644
--- a/debian/patches/0050-relax-stable-libs.patch
+++ b/debian/patches/0050-relax-stable-libs.patch
@@ -5,7 +5,7 @@ gitlab Gemfile
 +++ b/Gemfile
 @@ -2,7 +2,7 @@
  
- gem 'rails', '~> 6.0.3'
+ gem 'rails', '~> 6.0.3.1'
  
 -gem 'bootsnap', '~> 1.4.6'
 +gem 'bootsnap', '~> 1.4', '>= 1.4.6'
@@ -25,7 +25,7 @@ gitlab Gemfile
  
  # Supported DBs
  gem 'pg', '~> 1.1'
-@@ -22,32 +22,32 @@
+@@ -22,31 +22,31 @@
  gem 'grape-path-helpers', '~> 1.2'
  
  gem 'faraday', '~> 0.12'
@@ -59,8 +59,7 @@ gitlab Gemfile
 -gem 'omniauth_crowd', '~> 2.2.0'
 +gem 'omniauth_crowd', '~> 2.2'
  gem 'omniauth-authentiq', '~> 0.3.3'
- gem 'omniauth_openid_connect', '~> 0.3.3'
- gem "omniauth-ultraauth", '~> 0.0.2'
+ gem 'omniauth_openid_connect', '~> 0.3.5'
 -gem 'omniauth-salesforce', '~> 1.0.5'
 -gem 'rack-oauth2', '~> 1.9.3'
 -gem 'jwt', '~> 2.1.0'
@@ -70,7 +69,7 @@ gitlab Gemfile
  
  # Kerberos authentication. EE-only
  gem 'gssapi', group: :kerberos
-@@ -58,42 +58,42 @@
+@@ -57,42 +57,42 @@
  gem 'invisible_captcha', '~> 0.12.1'
  
  # Two-factor authentication
@@ -82,9 +81,9 @@ gitlab Gemfile
  gem 'u2f', '~> 0.2.1'
  
  # GitLab Pages
--gem 'validates_hostname', '~> 1.0.6'
+-gem 'validates_hostname', '~> 1.0.10'
 -gem 'rubyzip', '~> 2.0.0', require: 'zip'
-+gem 'validates_hostname', '~> 1.0', '>= 1.0.6'
++gem 'validates_hostname', '~> 1.0', '>= 1.0.10'
 +gem 'rubyzip', '~> 2.0', require: 'zip'
  # GitLab Pages letsencrypt support
 -gem 'acme-client', '~> 2.0.5'
@@ -125,7 +124,7 @@ gitlab Gemfile
  
  # Disable strong_params so that Mash does not respond to :permitted?
  gem 'hashie-forbidden_attributes'
-@@ -102,7 +102,7 @@
+@@ -101,7 +101,7 @@
  gem 'kaminari', '~> 1.0'
  
  # HAML
@@ -134,16 +133,16 @@ gitlab Gemfile
  
  # Files attachments
  gem 'carrierwave', '~> 1.3'
-@@ -112,7 +112,7 @@
+@@ -111,7 +111,7 @@
  gem 'fog-aws', '~> 3.5'
  # Locked until fog-google resolves https://github.com/fog/fog-google/issues/421.
  # Also see config/initializers/fog_core_patch.rb.
 -gem 'fog-core', '= 2.1.0'
 +gem 'fog-core', '= 2.1'
- gem 'fog-google', '~> 1.9'
+ gem 'fog-google', '~> 1.10'
  gem 'fog-local', '~> 0.6'
  gem 'fog-openstack', '~> 1.0'
-@@ -126,7 +126,7 @@
+@@ -125,7 +125,7 @@
  gem 'unf', '~> 0.1.4'
  
  # Seed data
@@ -152,7 +151,7 @@ gitlab Gemfile
  
  # Search
  gem 'elasticsearch-model', '~> 6.1'
-@@ -137,22 +137,22 @@
+@@ -136,22 +136,22 @@
  
  # Markdown and HTML processing
  gem 'html-pipeline', '~> 2.12'
@@ -184,7 +183,7 @@ gitlab Gemfile
  gem 'escape_utils', '~> 1.1'
  
  # Calendar rendering
-@@ -163,7 +163,7 @@
+@@ -162,7 +162,7 @@
  gem 'diff_match_patch', '~> 0.1.0'
  
  # Application server
@@ -193,7 +192,7 @@ gitlab Gemfile
  
  group :unicorn do
    gem 'unicorn', '~> 5.5'
-@@ -183,13 +183,13 @@
+@@ -182,13 +182,13 @@
  gem 'acts-as-taggable-on', '~> 6.0'
  
  # Background jobs
@@ -210,7 +209,7 @@ gitlab Gemfile
  
  # HTTP requests
  gem 'httparty', '~> 0.16.4'
-@@ -201,14 +201,14 @@
+@@ -200,14 +200,14 @@
  gem 'ruby-progressbar'
  
  # GitLab settings
@@ -228,7 +227,7 @@ gitlab Gemfile
  
  # Export Ruby Regex to Javascript
  gem 'js_regex', '~> 3.1'
-@@ -221,13 +221,13 @@
+@@ -220,13 +220,13 @@
  gem 'connection_pool', '~> 2.0'
  
  # Redis session store
@@ -244,7 +243,7 @@ gitlab Gemfile
  
  # Jira integration
  gem 'jira-ruby', '~> 2.0.0'
-@@ -237,7 +237,7 @@
+@@ -236,7 +236,7 @@
  gem 'flowdock', '~> 0.7'
  
  # Slack integration
@@ -253,7 +252,7 @@ gitlab Gemfile
  
  # Hangouts Chat integration
  gem 'hangouts-chat', '~> 0.0.5'
-@@ -249,11 +249,11 @@
+@@ -248,11 +248,11 @@
  gem 'ruby-fogbugz', '~> 0.2.1'
  
  # Kubernetes integration
@@ -267,7 +266,7 @@ gitlab Gemfile
  
  # Sanitizes SVG input
  gem 'loofah', '~> 2.2'
-@@ -262,7 +262,7 @@
+@@ -261,7 +261,7 @@
  gem 'licensee', '~> 8.9'
  
  # Ace editor
@@ -276,7 +275,7 @@ gitlab Gemfile
  
  # Detect and convert string character encoding
  gem 'charlock_holmes', '~> 0.7.5'
-@@ -280,8 +280,8 @@
+@@ -279,8 +279,8 @@
  gem 'webpack-rails', '~> 0.9.10'
  gem 'rack-proxy', '~> 0.6.0'
  
@@ -287,7 +286,7 @@ gitlab Gemfile
  
  gem 'addressable', '~> 2.7'
  gem 'font-awesome-rails', '~> 4.7'
-@@ -293,24 +293,24 @@
+@@ -292,24 +292,24 @@
  gem "gitlab-license", "~> 1.0"
  
  # Protect against bruteforcing
@@ -318,10 +317,10 @@ gitlab Gemfile
  
  # Perf bar
  gem 'peek', '~> 1.1'
-@@ -344,40 +344,40 @@
+@@ -343,40 +343,40 @@
  
  group :development, :test do
-   gem 'bullet', '~> 6.0.2', require: !!ENV['ENABLE_BULLET']
+   gem 'bullet', '~> 6.0.2'
 -  gem 'pry-byebug', '~> 3.5.1', platform: :mri
 +  gem 'pry-byebug', '~> 3.5','>= 3.5.1', platform: :mri
    gem 'pry-rails', '~> 0.3.9'
@@ -347,14 +346,14 @@ gitlab Gemfile
 +  gem 'spring', '~> 2.0'
 +  gem 'spring-commands-rspec', '~> 1.0', '>= 1.0.4'
  
--  gem 'gitlab-styles', '~> 3.2.0', require: false
-+  gem 'gitlab-styles', '~> 3.2', require: false
+-  gem 'gitlab-styles', '~> 4.2.0', require: false
++  gem 'gitlab-styles', '~> 4.2', require: false
    # Pin these dependencies, otherwise a new rule could break the CI pipelines
--  gem 'rubocop', '~> 0.74.0'
--  gem 'rubocop-performance', '~> 1.4.1'
+-  gem 'rubocop', '~> 0.82.0'
+-  gem 'rubocop-performance', '~> 1.5.2'
 -  gem 'rubocop-rspec', '~> 1.37.0'
-+  gem 'rubocop', '~> 0.74'
-+  gem 'rubocop-performance', '~> 1.4', '>= 1.4.1'
++  gem 'rubocop', '~> 0.82'
++  gem 'rubocop-performance', '~> 1.5', '>= 1.5.2'
 +  gem 'rubocop-rspec', '~> 1.37'
  
    gem 'scss_lint', '~> 0.56.0', require: false
@@ -372,7 +371,7 @@ gitlab Gemfile
  
    gem 'timecop', '~> 0.9.1'
  
-@@ -392,19 +392,19 @@
+@@ -391,18 +391,18 @@
  end
  
  group :test do
@@ -390,16 +389,14 @@ gitlab Gemfile
  
 -  gem 'shoulda-matchers', '~> 4.0.1', require: false
 -  gem 'email_spec', '~> 2.2.0'
--  gem 'json-schema', '~> 2.8.0'
 -  gem 'webmock', '~> 3.5.1'
 +  gem 'shoulda-matchers', '~> 4.0', '>= 4.0.1', require: false
 +  gem 'email_spec', '~> 2.2'
-+  gem 'json-schema', '~> 2.8'
 +  gem 'webmock', '~> 3.5', '>= 3.5.1'
    gem 'rails-controller-testing'
    gem 'concurrent-ruby', '~> 1.1'
    gem 'test-prof', '~> 0.10.0'
-@@ -423,7 +423,7 @@
+@@ -421,7 +421,7 @@
  gem 'email_reply_trimmer', '~> 0.1'
  gem 'html2text'
  
@@ -408,7 +405,7 @@ gitlab Gemfile
  gem 'stackprof', '~> 0.2.15', require: false
  gem 'rbtrace', '~> 0.4', require: false
  gem 'memory_profiler', '~> 0.9', require: false
-@@ -434,11 +434,11 @@
+@@ -432,11 +432,11 @@
  gem 'oauth2', '~> 1.4'
  
  # Health check
@@ -423,12 +420,12 @@ gitlab Gemfile
  
  # NTP client
  gem 'net-ntp'
-@@ -454,13 +454,13 @@
+@@ -452,13 +452,13 @@
  end
  
  # Gitaly GRPC protocol definitions
--gem 'gitaly', '~> 13.0.0.pre.rc1'
-+gem 'gitaly', '~> 13.0'
+-gem 'gitaly', '~> 13.1.0.pre.rc1'
++gem 'gitaly', '~> 13.1'
  
 -gem 'grpc', '~> 1.24.0'
 +gem 'grpc', '~> 1.24'
@@ -441,7 +438,7 @@ gitlab Gemfile
  
  # Feature toggles
  gem 'flipper', '~> 0.17.1'
-@@ -478,12 +478,12 @@
+@@ -476,12 +476,12 @@
  # Countries list
  gem 'countries', '~> 3.0'
  
@@ -456,9 +453,11 @@ gitlab Gemfile
  
  # Locked as long as quoted-printable encoding issues are not resolved
  # Monkey-patched in `config/initializers/mail_encoding_patch.rb`
-@@ -497,4 +497,4 @@
+@@ -495,5 +495,5 @@
  gem 'valid_email', '~> 0.1'
  
  # JSON
 -gem 'json', '~> 2.3.0'
+-gem 'json-schema', '~> 2.8.0'
 +gem 'json', '~> 2.3'
++gem 'json-schema', '~> 2.8'
diff --git a/debian/patches/0100-remove-development-test.patch b/debian/patches/0100-remove-development-test.patch
index 55f28dd63b..930879a827 100644
--- a/debian/patches/0100-remove-development-test.patch
+++ b/debian/patches/0100-remove-development-test.patch
@@ -2,7 +2,7 @@ Bundler will fail when it can't find these locally
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -93,7 +93,6 @@
+@@ -92,7 +92,6 @@
  # https://gitlab.com/gitlab-org/gitlab/issues/31747
  gem 'graphiql-rails', '~> 1.4', '>= 1.4.10'
  gem 'apollo_upload_server', '~> 2.0.0.beta3'
@@ -10,7 +10,7 @@ Bundler will fail when it can't find these locally
  
  # Disable strong_params so that Mash does not respond to :permitted?
  gem 'hashie-forbidden_attributes'
-@@ -308,7 +307,6 @@
+@@ -307,7 +306,6 @@
  gem 'rails-i18n', '~> 6.0'
  gem 'gettext_i18n_rails', '~> 1.8'
  gem 'gettext_i18n_rails_js', '~> 1.3'
@@ -18,7 +18,7 @@ Bundler will fail when it can't find these locally
  
  gem 'batch-loader', '~> 1.4'
  
-@@ -327,23 +325,7 @@
+@@ -326,21 +324,6 @@
    gem 'raindrops', '~> 0.18'
  end
  
@@ -38,28 +38,27 @@ Bundler will fail when it can't find these locally
 -end
 -
  group :development, :test do
--  gem 'bullet', '~> 6.0.2', require: !!ENV['ENABLE_BULLET']
+   gem 'bullet', '~> 6.0.2'
    gem 'pry-byebug', '~> 3.5','>= 3.5.1', platform: :mri
-   gem 'pry-rails', '~> 0.3.9'
- 
-@@ -362,16 +344,6 @@
+@@ -361,17 +344,6 @@
    gem 'spring', '~> 2.0'
    gem 'spring-commands-rspec', '~> 1.0', '>= 1.0.4'
  
--  gem 'gitlab-styles', '~> 3.2', require: false
+-  gem 'gitlab-styles', '~> 4.2', require: false
 -  # Pin these dependencies, otherwise a new rule could break the CI pipelines
--  gem 'rubocop', '~> 0.74'
--  gem 'rubocop-performance', '~> 1.4', '>= 1.4.1'
+-  gem 'rubocop', '~> 0.82'
+-  gem 'rubocop-performance', '~> 1.5', '>= 1.5.2'
 -  gem 'rubocop-rspec', '~> 1.37'
 -
 -  gem 'scss_lint', '~> 0.56.0', require: false
 -  gem 'haml_lint', '~> 0.34.0', require: false
 -  gem 'simplecov', '~> 0.18.5', require: false
 -  gem 'bundler-audit', '~> 0.6.1', require: false
- 
+-
    gem 'benchmark-ips', '~> 2.3', require: false
  
-@@ -386,11 +358,6 @@
+   gem 'knapsack', '~> 1.17'
+@@ -385,11 +357,6 @@
    gem 'parallel', '~> 1.19', require: false
  end
  
diff --git a/debian/patches/0110-make-test-dependencies-conditional.patch b/debian/patches/0110-make-test-dependencies-conditional.patch
index ffa41711af..06b2bd7d64 100644
--- a/debian/patches/0110-make-test-dependencies-conditional.patch
+++ b/debian/patches/0110-make-test-dependencies-conditional.patch
@@ -2,16 +2,16 @@ Make test dependencies conditional so we can enable them when running autopkgtes
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -325,7 +325,7 @@
+@@ -324,7 +324,7 @@
    gem 'raindrops', '~> 0.18'
  end
  
 -group :development, :test do
 +if ENV["INCLUDE_TEST_DEPENDS"] == "true"
+   gem 'bullet', '~> 6.0.2'
    gem 'pry-byebug', '~> 3.5','>= 3.5.1', platform: :mri
    gem 'pry-rails', '~> 0.3.9'
- 
-@@ -356,9 +356,6 @@
+@@ -355,9 +355,6 @@
    gem 'png_quantizator', '~> 0.2.1', require: false
  
    gem 'parallel', '~> 1.19', require: false
diff --git a/debian/patches/0340-relax-httparty.patch b/debian/patches/0340-relax-httparty.patch
index faa217675b..aeff7d6deb 100644
--- a/debian/patches/0340-relax-httparty.patch
+++ b/debian/patches/0340-relax-httparty.patch
@@ -2,7 +2,7 @@ Allow newer versions of httparty to satisfy dependency
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -191,7 +191,7 @@
+@@ -190,7 +190,7 @@
  gem 'fugit', '~> 1.2', '>= 1.2.1'
  
  # HTTP requests
diff --git a/debian/patches/0350-relax-method-source.patch b/debian/patches/0350-relax-method-source.patch
index c606d6eb6f..be5df4e0a6 100644
--- a/debian/patches/0350-relax-method-source.patch
+++ b/debian/patches/0350-relax-method-source.patch
@@ -2,7 +2,7 @@ Allow newer version to satisfy requirement
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -318,7 +318,7 @@
+@@ -317,7 +317,7 @@
  
  # Metrics
  group :metrics do
diff --git a/debian/patches/0350-relax-rdoc.patch b/debian/patches/0350-relax-rdoc.patch
index e572fd682a..bef2ae03ca 100644
--- a/debian/patches/0350-relax-rdoc.patch
+++ b/debian/patches/0350-relax-rdoc.patch
@@ -2,7 +2,7 @@ Allow rdoc from ruby 2.5 to match requirement
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -141,7 +141,7 @@
+@@ -140,7 +140,7 @@
  gem 'github-markup', '~> 1.7', require: 'github/markup'
  gem 'commonmarker', '~> 0.20'
  gem 'RedCloth', '~> 4.3', '>= 4.3.2'
diff --git a/debian/patches/0430-remove-gitlab-markup.patch b/debian/patches/0430-remove-gitlab-markup.patch
index f1afdb26c0..946b6a94b2 100644
--- a/debian/patches/0430-remove-gitlab-markup.patch
+++ b/debian/patches/0430-remove-gitlab-markup.patch
@@ -4,7 +4,7 @@ maintaining two almost same packages.
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -137,7 +137,6 @@
+@@ -136,7 +136,6 @@
  # Markdown and HTML processing
  gem 'html-pipeline', '~> 2.12'
  gem 'deckar01-task_list', '~> 2.3', '>= 2.3.1'
diff --git a/debian/patches/0440-remove-puma.patch b/debian/patches/0440-remove-puma.patch
index c3bac79596..45a5e9ad28 100644
--- a/debian/patches/0440-remove-puma.patch
+++ b/debian/patches/0440-remove-puma.patch
@@ -2,7 +2,7 @@ We are using unicorn so don't need puma
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -168,12 +168,6 @@
+@@ -167,12 +167,6 @@
    gem 'unicorn-worker-killer', '~> 0.4.4'
  end
  
diff --git a/debian/patches/0480-embed-elasticsearch-model.patch b/debian/patches/0480-embed-elasticsearch-model.patch
index e7787dfa30..914c2137bc 100644
--- a/debian/patches/0480-embed-elasticsearch-model.patch
+++ b/debian/patches/0480-embed-elasticsearch-model.patch
@@ -2,7 +2,7 @@ Embed this gem until gitlab moved to 7.x version
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -128,7 +128,7 @@
+@@ -127,7 +127,7 @@
  gem 'seed-fu', '~> 2.3', '>= 2.3.7'
  
  # Search
diff --git a/debian/patches/0480-embed-elasticsearch-rails.patch b/debian/patches/0480-embed-elasticsearch-rails.patch
index 1aa30d3f0d..15d0facd30 100644
--- a/debian/patches/0480-embed-elasticsearch-rails.patch
+++ b/debian/patches/0480-embed-elasticsearch-rails.patch
@@ -2,7 +2,7 @@ Embed this gem until gitlab moved to 7.x version
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -129,7 +129,7 @@
+@@ -128,7 +128,7 @@
  
  # Search
  gem 'elasticsearch-model', '~> 6.1', path: 'vendor/gems/elasticsearch-model'
diff --git a/debian/patches/0480-embed-faraday-middleware-aws-signers-v4.patch b/debian/patches/0480-embed-faraday-middleware-aws-signers-v4.patch
index fba0d198d4..97624bbff9 100644
--- a/debian/patches/0480-embed-faraday-middleware-aws-signers-v4.patch
+++ b/debian/patches/0480-embed-faraday-middleware-aws-signers-v4.patch
@@ -5,7 +5,7 @@ Bug: https://gitlab.com/gitlab-org/gitlab/-/issues/37931
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -132,7 +132,7 @@
+@@ -131,7 +131,7 @@
  gem 'elasticsearch-rails', '~> 6.1', require: 'elasticsearch/rails/instrumentation', path: 'vendor/gems/elasticsearch-rails'
  gem 'elasticsearch-api',   '~> 6.8'
  gem 'aws-sdk'
diff --git a/debian/patches/0482-remove-ee-only-gems.patch b/debian/patches/0482-remove-ee-only-gems.patch
index c56e52bca3..1328c1d222 100644
--- a/debian/patches/0482-remove-ee-only-gems.patch
+++ b/debian/patches/0482-remove-ee-only-gems.patch
@@ -2,7 +2,7 @@ This gem is used only in gitlab Enterprise Edition
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -49,9 +49,6 @@
+@@ -48,9 +48,6 @@
  gem 'rack-oauth2', '~> 1.9', '>= 1.9.3'
  gem 'jwt', '~> 2.1'
  
@@ -12,7 +12,7 @@ This gem is used only in gitlab Enterprise Edition
  # Spam and anti-bot protection
  gem 'recaptcha', '~> 4.11', require: 'recaptcha/rails'
  gem 'akismet', '~> 3.0'
-@@ -282,8 +279,6 @@
+@@ -281,8 +278,6 @@
  gem 'request_store', '~> 1.5'
  gem 'base32', '~> 0.3.0'
  
diff --git a/debian/patches/0510-remove-dev-dependencies.patch b/debian/patches/0510-remove-dev-dependencies.patch
index bc2ba5a51c..d9a180fb6b 100644
--- a/debian/patches/0510-remove-dev-dependencies.patch
+++ b/debian/patches/0510-remove-dev-dependencies.patch
@@ -2,11 +2,12 @@ These are not required in production
 
 --- a/package.json
 +++ b/package.json
-@@ -149,64 +149,7 @@
+@@ -155,66 +155,7 @@
      "xterm": "^3.5.0"
    },
    "devDependencies": {
--    "@babel/plugin-transform-modules-commonjs": "^7.8.3",
+-    "acorn": "^6.3.0",
+-    "@babel/plugin-transform-modules-commonjs": "^7.10.1",
 -    "@gitlab/eslint-plugin": "3.1.0",
 -    "@vue/test-utils": "^1.0.0-beta.30",
 -    "axios-mock-adapter": "^1.15.0",
@@ -34,7 +35,7 @@ These are not required in production
 -    "jasmine-jquery": "^2.1.1",
 -    "jest": "^24.1.0",
 -    "jest-canvas-mock": "^2.1.2",
--    "jest-environment-jsdom": "^24.0.0",
+-    "jest-environment-jsdom-sixteen": "^1.0.0",
 -    "jest-junit": "^6.3.0",
 -    "jest-util": "^24.0.0",
 -    "jsdoc": "^3.5.5",
@@ -50,7 +51,7 @@ These are not required in production
 -    "markdownlint-cli": "0.18.0",
 -    "md5": "^2.2.1",
 -    "node-sass": "^4.12.0",
--    "nodemon": "^1.18.9",
+-    "nodemon": "^2.0.4",
 -    "pixelmatch": "^4.0.2",
 -    "postcss": "^7.0.14",
 -    "prettier": "1.18.2",
@@ -61,10 +62,11 @@ These are not required in production
 -    "timezone-mock": "^1.0.8",
 -    "vue-jest": "^4.0.0-beta.2",
 -    "webpack-dev-server": "^3.10.3",
+-    "xhr-mock": "^2.5.1",
 -    "yarn-check-webpack-plugin": "^1.2.0",
 -    "yarn-deduplicate": "^1.1.1"
 -  },
-+     },
++   },
    "blockedDependencies": {
      "bootstrap-vue": "https://docs.gitlab.com/ee/development/fe_guide/dependencies.md#bootstrapvue"
    },
diff --git a/debian/patches/0520-add-system-lib-path-for-webpack.patch b/debian/patches/0520-add-system-lib-path-for-webpack.patch
index dd019523b1..dc7647f682 100644
--- a/debian/patches/0520-add-system-lib-path-for-webpack.patch
+++ b/debian/patches/0520-add-system-lib-path-for-webpack.patch
@@ -2,7 +2,7 @@ Debian specific patch to allow webpack to resolve packaged node modules
 
 --- a/config/webpack.config.js
 +++ b/config/webpack.config.js
-@@ -148,9 +148,14 @@
+@@ -149,9 +149,14 @@
  
    resolve: {
      extensions: ['.js', '.gql', '.graphql'],
diff --git a/debian/patches/0740-use-packaged-modules.patch b/debian/patches/0740-use-packaged-modules.patch
index 6460aa9b50..4c87fc8607 100644
--- a/debian/patches/0740-use-packaged-modules.patch
+++ b/debian/patches/0740-use-packaged-modules.patch
@@ -14,7 +14,7 @@ Use debian packaged node modules when available
  const CopyWebpackPlugin = require('copy-webpack-plugin');
  const vendorDllHash = require('./helpers/vendor_dll_hash');
  
-@@ -147,13 +146,13 @@
+@@ -148,13 +147,13 @@
    },
  
    resolve: {
@@ -31,7 +31,7 @@ Use debian packaged node modules when available
    },
  
    module: {
-@@ -166,9 +165,13 @@
+@@ -167,9 +166,13 @@
        },
        {
          test: /\.js$/,
@@ -46,7 +46,7 @@ Use debian packaged node modules when available
          loader: 'babel-loader',
          options: {
            cacheDirectory: path.join(CACHE_PATH, 'babel-loader'),
-@@ -502,19 +505,6 @@
+@@ -501,19 +504,6 @@
      // enable HMR only in webpack-dev-server
      DEV_SERVER_LIVERELOAD && new webpack.HotModuleReplacementPlugin(),
  
@@ -66,7 +66,7 @@ Use debian packaged node modules when available
      new webpack.DefinePlugin({
        // This one is used to define window.gon.ee and other things properly in tests:
        'process.env.IS_EE': JSON.stringify(IS_EE),
-@@ -540,6 +530,7 @@
+@@ -547,6 +537,7 @@
  
    node: {
      fs: 'empty', // sqljs requires fs
@@ -80,16 +80,16 @@ Use debian packaged node modules when available
      "webpack-prod": "NODE_OPTIONS=\"--max-old-space-size=3584\" NODE_ENV=production webpack --config config/webpack.config.js"
    },
    "dependencies": {
--    "@babel/core": "^7.8.4",
--    "@babel/plugin-proposal-class-properties": "^7.8.3",
--    "@babel/plugin-proposal-json-strings": "^7.8.3",
--    "@babel/plugin-proposal-private-methods": "^7.8.3",
--    "@babel/plugin-syntax-import-meta": "^7.8.3",
--    "@babel/preset-env": "^7.8.4",
+-    "@babel/core": "^7.10.1",
+-    "@babel/plugin-proposal-class-properties": "^7.10.1",
+-    "@babel/plugin-proposal-json-strings": "^7.10.1",
+-    "@babel/plugin-proposal-private-methods": "^7.10.1",
+-    "@babel/plugin-syntax-import-meta": "^7.10.1",
+-    "@babel/preset-env": "^7.10.1",
      "@gitlab/at.js": "1.5.5",
-     "@gitlab/svgs": "1.127.0",
-     "@gitlab/ui": "14.10.0",
-@@ -53,64 +47,40 @@
+     "@gitlab/svgs": "1.139.0",
+     "@gitlab/ui": "16.12.1",
+@@ -53,54 +47,35 @@
      "apollo-link": "^1.2.11",
      "apollo-link-batch-http": "^1.2.11",
      "apollo-upload-client": "^10.0.0",
@@ -98,10 +98,9 @@ Use debian packaged node modules when available
 -    "axios": "^0.19.0",
 -    "babel-loader": "^8.0.6",
      "babel-plugin-lodash": "^3.3.4",
-     "bootstrap": "4.3.1",
+     "bootstrap": "4.4.1",
      "brace-expansion": "^1.1.8",
      "cache-loader": "^4.1.0",
--    "chart.js": "2.7.2",
      "classlist-polyfill": "^1.2.0",
 -    "clipboard": "^1.7.1",
      "codemirror": "^5.48.4",
@@ -111,6 +110,8 @@ Use debian packaged node modules when available
 -    "core-js": "^3.6.4",
      "cropper": "^2.3.0",
 -    "css-loader": "^2.1.1",
+     "d3": "^5.16.0",
+     "d3-sankey": "^0.12.3",
 -    "d3-scale": "^2.2.2",
 -    "d3-selection": "^1.2.0",
 -    "dateformat": "^3.0.3",
@@ -118,6 +119,7 @@ Use debian packaged node modules when available
      "diff": "^3.4.0",
      "document-register-element": "1.14.3",
      "dropzone": "^4.2.0",
+     "editorconfig": "^0.15.3",
      "emoji-regex": "^7.0.3",
      "emoji-unicode-version": "^0.2.1",
 -    "exports-loader": "^0.7.0",
@@ -140,7 +142,9 @@ Use debian packaged node modules when available
      "katex": "^0.10.0",
 -    "lodash": "^4.17.15",
      "marked": "^0.3.12",
-     "mermaid": "^8.4.8",
+     "mermaid": "^8.5.2",
+     "mersenne-twister": "1.1.0",
+@@ -108,13 +83,9 @@
      "mitt": "^1.2.0",
      "monaco-editor": "^0.18.1",
      "monaco-editor-webpack-plugin": "^1.7.0",
@@ -154,7 +158,7 @@ Use debian packaged node modules when available
      "raphael": "^2.2.7",
      "raw-loader": "^4.0.0",
      "sanitize-html": "^1.22.0",
-@@ -123,30 +93,19 @@
+@@ -128,31 +99,20 @@
      "svg4everybody": "2.1.9",
      "swagger-ui-dist": "^3.24.3",
      "three": "^0.84.0",
@@ -167,6 +171,7 @@ Use debian packaged node modules when available
      "tributejs": "4.1.3",
      "unfetch": "^4.1.0",
 -    "url-loader": "^3.0.0",
+     "uuid": "8.1.0",
      "visibilityjs": "^1.2.4",
 -    "vue": "^2.6.10",
      "vue-apollo": "^3.0.3",
@@ -185,7 +190,7 @@ Use debian packaged node modules when available
 +    "webpack-stats-plugin": "^0.3.1"
    },
    "devDependencies": {
-      },
+    },
 --- a/babel.config.js
 +++ b/babel.config.js
 @@ -19,9 +19,12 @@
diff --git a/debian/patches/0741-add-graphql-tag.patch b/debian/patches/0741-add-graphql-tag.patch
index 8f9892d38b..8ae85eb779 100644
--- a/debian/patches/0741-add-graphql-tag.patch
+++ b/debian/patches/0741-add-graphql-tag.patch
@@ -2,7 +2,7 @@ yarn fails to install graphql-tag
 
 --- a/package.json
 +++ b/package.json
-@@ -68,6 +68,7 @@
+@@ -71,6 +71,7 @@
      "fuzzaldrin-plus": "^0.6.0",
      "glob": "^7.1.6",
      "graphql": "^14.0.2",
diff --git a/debian/patches/0760-update-grape.patch b/debian/patches/0760-update-grape.patch
index f864582b56..73c6f99fbf 100644
--- a/debian/patches/0760-update-grape.patch
+++ b/debian/patches/0760-update-grape.patch
@@ -1,7 +1,7 @@
-From 7c07471b98d105724cb6d6b4cd6853bd2ee9350f Mon Sep 17 00:00:00 2001
+From d5617969480da3d774c908bb00b3c37f7060a5a4 Mon Sep 17 00:00:00 2001
 From: Stan Hu <stanhu@gmail.com>
 Date: Fri, 29 May 2020 16:12:45 -0700
-Subject: [PATCH 1/4] Upgrade to Grape v1.3.3
+Subject: [PATCH 1/5] Upgrade to Grape v1.3.3
 
 This brings back many of the changes in
 https://gitlab.com/gitlab-org/gitlab/-/merge_requests/27276. This was
@@ -233,7 +233,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
 
 --- a/.rubocop.yml
 +++ b/.rubocop.yml
-@@ -292,6 +292,18 @@
+@@ -308,6 +308,18 @@
      - 'spec/**/*'
      - 'ee/spec/**/*'
  
@@ -263,16 +263,6 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
  
  gem 'faraday', '~> 0.12'
  gem 'marginalia', '~> 1.8'
-@@ -79,7 +79,8 @@
- gem 'net-ldap'
- 
- # API
--gem 'grape', '~> 1.1'
-+gem 'grape', '~> 1.3', '>= 1.3.3'
-+gem 'rack-timeout'
- gem 'grape-entity', '~> 0.7.1'
- gem 'rack-cors', '~> 1.0', '>= 1.0.6', require: 'rack/cors'
- 
 --- a/Gemfile.lock
 +++ b/Gemfile.lock
 @@ -103,10 +103,6 @@
@@ -333,8 +323,8 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      ed25519 (1.2.4)
      elasticsearch (6.8.0)
        elasticsearch-api (= 6.8.0)
-@@ -438,19 +452,19 @@
-       signet (~> 0.7)
+@@ -439,19 +453,19 @@
+       signet (~> 0.14)
      gpgme (2.0.20)
        mini_portile2 (~> 2.3)
 -    grape (1.1.0)
@@ -357,7 +347,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
        rake (~> 12)
      grape_logging (1.8.3)
        grape
-@@ -640,9 +654,10 @@
+@@ -641,9 +655,10 @@
      multi_xml (0.6.0)
      multipart-post (2.1.1)
      murmurhash3 (0.1.6)
@@ -371,7 +361,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      nakayoshi_fork (0.0.4)
      nap (1.1.0)
      nenv (0.3.0)
-@@ -956,6 +971,7 @@
+@@ -958,6 +973,7 @@
      ruby-saml (1.7.2)
        nokogiri (>= 1.5.10)
      ruby-statistics (2.1.2)
@@ -379,7 +369,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      ruby_dep (1.5.0)
      ruby_parser (3.13.1)
        sexp_processor (~> 4.9)
-@@ -1117,11 +1133,6 @@
+@@ -1119,11 +1135,6 @@
        activerecord (>= 3.0)
        activesupport (>= 3.0)
      version_sorter (2.2.4)
@@ -391,8 +381,8 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      vmstat (2.3.0)
      warden (1.2.8)
        rack (>= 2.0.6)
-@@ -1252,9 +1263,9 @@
-   google-api-client (~> 0.23)
+@@ -1254,9 +1265,9 @@
+   google-api-client (~> 0.33)
    google-protobuf (~> 3.8.0)
    gpgme (~> 2.0.19)
 -  grape (~> 1.1.0)
@@ -430,7 +420,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
  For non-200 HTTP responses, use the provided helpers in `lib/api/helpers.rb` to ensure correct behavior (`not_found!`, `no_content!` etc.). These will `throw` inside Grape and abort the execution of your endpoint.
 --- a/doc/development/ee_features.md
 +++ b/doc/development/ee_features.md
-@@ -514,12 +514,12 @@
+@@ -512,12 +512,12 @@
  interface first here.
  
  For example, suppose we have a few more optional parameters for EE. We can move the
@@ -445,7 +435,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      helpers Helpers::ProjectsHelpers
    end
  end
-@@ -580,7 +580,7 @@
+@@ -578,7 +578,7 @@
  
  ```ruby
  module API
@@ -454,7 +444,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      # EE::API::JobArtifacts would override the following helpers
      helpers do
        def authorize_download_artifacts!
-@@ -624,7 +624,7 @@
+@@ -622,7 +622,7 @@
  
  ```ruby
  module API
@@ -463,7 +453,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      helpers do
        # EE::API::MergeRequests would override the following helpers
        def update_merge_request_ee(merge_request)
-@@ -693,7 +693,7 @@
+@@ -691,7 +691,7 @@
  ```ruby
  # api/merge_requests/parameters.rb
  module API
@@ -472,7 +462,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      module Parameters
        def self.update_params_at_least_one_of
          %i[
-@@ -709,7 +709,7 @@
+@@ -707,7 +707,7 @@
  
  # api/merge_requests.rb
  module API
@@ -835,9 +825,9 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
  module API
 -  class GroupExport < Grape::API
 +  class GroupExport < Grape::API::Instance
-     before do
-       not_found! unless Feature.enabled?(:group_import_export, user_group, default_enabled: true)
+     helpers Helpers::RateLimiter
  
+     before do
 --- a/lib/api/group_import.rb
 +++ b/lib/api/group_import.rb
 @@ -1,7 +1,7 @@
@@ -846,9 +836,9 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
  module API
 -  class GroupImport < Grape::API
 +  class GroupImport < Grape::API::Instance
-     MAXIMUM_FILE_SIZE = 50.megabytes.freeze
- 
      helpers Helpers::FileUploadHelpers
+ 
+     helpers do
 --- a/lib/api/group_labels.rb
 +++ b/lib/api/group_labels.rb
 @@ -1,7 +1,7 @@
@@ -915,9 +905,9 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
          optional :with_merge_status_recheck, type: Boolean, desc: 'Request that stale merge statuses be rechecked asynchronously', default: false
 --- a/lib/api/helpers/projects_helpers.rb
 +++ b/lib/api/helpers/projects_helpers.rb
-@@ -45,7 +45,7 @@
-         optional :request_access_enabled, type: Boolean, desc: 'Allow users to request member access'
+@@ -46,7 +46,7 @@
          optional :only_allow_merge_if_pipeline_succeeds, type: Boolean, desc: 'Only allow to merge if builds succeed'
+         optional :allow_merge_on_skipped_pipeline, type: Boolean, desc: 'Allow to merge if pipeline is skipped'
          optional :only_allow_merge_if_all_discussions_are_resolved, type: Boolean, desc: 'Only allow to merge if all discussions are resolved'
 -        optional :tag_list, type: Array[String], desc: 'The list of tags for a project'
 +        optional :tag_list, type: Array[String], coerce_with: ::API::Validations::Types::CommaSeparatedToArray.coerce, desc: 'The list of tags for a project'
@@ -959,7 +949,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
        end
 --- a/lib/api/issues.rb
 +++ b/lib/api/issues.rb
-@@ -1,7 +1,7 @@
+@@ -1,18 +1,21 @@
  # frozen_string_literal: true
  
  module API
@@ -968,7 +958,12 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      include PaginationParams
      helpers Helpers::IssuesHelpers
      helpers Helpers::RateLimiter
-@@ -11,9 +11,9 @@
+ 
+-    before { authenticate_non_get! }
++    before do
++      authenticate_non_get!
++      coerce_nil_params_to_array!
++    end
  
      helpers do
        params :negatable_issue_filter_params do
@@ -980,7 +975,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
          optional :search, type: String, desc: 'Search issues for text present in the title, description, or any combination of these'
          optional :in, type: String, desc: '`title`, `description`, or a string joining them with comma'
  
-@@ -63,10 +63,10 @@
+@@ -62,12 +65,12 @@
  
        params :issue_params do
          optional :description, type: String, desc: 'The description of an issue'
@@ -989,7 +984,11 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
          optional :assignee_id,  type: Integer, desc: '[Deprecated] The ID of a user to assign issue'
          optional :milestone_id, type: Integer, desc: 'The ID of a milestone to assign issue'
 -        optional :labels, type: Array[String], coerce_with: Validations::Types::LabelsList.coerce, desc: 'Comma-separated list of label names'
-+        optional :labels, type: Array[String], coerce_with: ::API::Validations::Types::CommaSeparatedToIntegerArray.coerce, desc: 'Comma-separated list of label names'
+-        optional :add_labels, type: Array[String], coerce_with: Validations::Types::LabelsList.coerce, desc: 'Comma-separated list of label names'
+-        optional :remove_labels, type: Array[String], coerce_with: Validations::Types::LabelsList.coerce, desc: 'Comma-separated list of label names'
++        optional :labels, type: Array[String], coerce_with: ::API::Validations::Types::CommaSeparatedToArray.coerce, desc: 'Comma-separated list of label names'
++        optional :add_labels, type: Array[String], coerce_with: ::API::Validations::Types::CommaSeparatedToArray.coerce, desc: 'Comma-separated list of label names'
++        optional :remove_labels, type: Array[String], coerce_with: ::API::Validations::Types::CommaSeparatedToArray.coerce, desc: 'Comma-separated list of label names'
          optional :due_date, type: String, desc: 'Date string in the format YEAR-MONTH-DAY'
          optional :confidential, type: Boolean, desc: 'Boolean parameter if the issue should be confidential'
          optional :discussion_locked, type: Boolean, desc: " Boolean parameter indicating if the issue's discussion is locked"
@@ -1101,7 +1100,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      before { authenticate! }
 --- a/lib/api/merge_requests.rb
 +++ b/lib/api/merge_requests.rb
-@@ -1,7 +1,7 @@
+@@ -1,12 +1,15 @@
  # frozen_string_literal: true
  
  module API
@@ -1110,7 +1109,16 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      include PaginationParams
  
      CONTEXT_COMMITS_POST_LIMIT = 20
-@@ -182,11 +182,11 @@
+ 
+-    before { authenticate_non_get! }
++    before do
++      authenticate_non_get!
++      coerce_nil_params_to_array!
++    end
+ 
+     helpers Helpers::MergeRequestsHelpers
+ 
+@@ -179,11 +182,11 @@
          params :optional_params do
            optional :description, type: String, desc: 'The description of the merge request'
            optional :assignee_id, type: Integer, desc: 'The ID of a user to assign the merge request'
@@ -1126,7 +1134,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
            optional :remove_source_branch, type: Boolean, desc: 'Remove source branch when merging'
            optional :allow_collaboration, type: Boolean, desc: 'Allow commits from members who can merge to the target branch'
            optional :allow_maintainer_to_push, type: Boolean, as: :allow_collaboration, desc: '[deprecated] See allow_collaboration'
-@@ -201,7 +201,7 @@
+@@ -198,7 +201,7 @@
        end
        params do
          use :merge_requests_params
@@ -1135,6 +1143,24 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
        end
        get ":id/merge_requests" do
          authorize! :read_merge_request, user_project
+@@ -315,7 +318,7 @@
+       end
+ 
+       params do
+-        requires :commits, type: Array, allow_blank: false, desc: 'List of context commits sha'
++        requires :commits, type: Array[String], coerce_with: ::API::Validations::Types::CommaSeparatedToArray.coerce, allow_blank: false, desc: 'List of context commits sha'
+       end
+       desc 'create context commits of merge request' do
+         success Entities::Commit
+@@ -345,7 +348,7 @@
+       end
+ 
+       params do
+-        requires :commits, type: Array, allow_blank: false, desc: 'List of context commits sha'
++        requires :commits, type: Array[String], coerce_with: ::API::Validations::Types::CommaSeparatedToArray.coerce, allow_blank: false, desc: 'List of context commits sha'
+       end
+       desc 'remove context commits of merge request'
+       delete ':id/merge_requests/:merge_request_iid/context_commits' do
 --- a/lib/api/metrics/dashboard/annotations.rb
 +++ b/lib/api/metrics/dashboard/annotations.rb
 @@ -3,7 +3,7 @@
@@ -1390,7 +1416,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      TEMPLATE_TYPES = %w[dockerfiles gitignores gitlab_ci_ymls licenses].freeze
 --- a/lib/api/projects.rb
 +++ b/lib/api/projects.rb
-@@ -3,7 +3,7 @@
+@@ -3,13 +3,16 @@
  require_dependency 'declarative_policy'
  
  module API
@@ -1399,7 +1425,17 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      include PaginationParams
      include Helpers::CustomAttributes
  
-@@ -522,7 +522,7 @@
+     helpers Helpers::ProjectsHelpers
+ 
+-    before { authenticate_non_get! }
++    before do
++      authenticate_non_get!
++      coerce_nil_params_to_array!
++    end
+ 
+     helpers do
+       # EE::API::Projects would override this method
+@@ -524,7 +527,7 @@
        end
        params do
          optional :search, type: String, desc: 'Return list of users matching the search criteria'
@@ -1443,7 +1479,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
        RELEASE_ENDPOINT_REQUIREMENTS = API::NAMESPACE_OR_PROJECT_REQUIREMENTS
 --- a/lib/api/releases.rb
 +++ b/lib/api/releases.rb
-@@ -1,7 +1,7 @@
+@@ -1,13 +1,16 @@
  # frozen_string_literal: true
  
  module API
@@ -1452,6 +1488,25 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      include PaginationParams
  
      RELEASE_ENDPOINT_REQUIREMENTS = API::NAMESPACE_OR_PROJECT_REQUIREMENTS
+       .merge(tag_name: API::NO_SLASH_URL_PART_REGEX)
+ 
+-    before { authorize_read_releases! }
++    before do
++      authorize_read_releases!
++      coerce_nil_params_to_array!
++    end
+ 
+     params do
+       requires :id, type: String, desc: 'The ID of a project'
+@@ -54,7 +57,7 @@
+             requires :url, type: String
+           end
+         end
+-        optional :milestones, type: Array, desc: 'The titles of the related milestones', default: []
++        optional :milestones, type: Array[String], coerce_with: ::API::Validations::Types::CommaSeparatedToArray.coerce, desc: 'The titles of the related milestones', default: []
+         optional :released_at, type: DateTime, desc: 'The date when the release will be/was ready. Defaults to the current time.'
+       end
+       route_setting :authentication, job_token_allowed: true
 --- a/lib/api/remote_mirrors.rb
 +++ b/lib/api/remote_mirrors.rb
 @@ -1,7 +1,7 @@
@@ -1465,7 +1520,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      before do
 --- a/lib/api/repositories.rb
 +++ b/lib/api/repositories.rb
-@@ -3,7 +3,7 @@
+@@ -3,12 +3,15 @@
  require 'mime/types'
  
  module API
@@ -1473,8 +1528,17 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
 +  class Repositories < Grape::API::Instance
      include PaginationParams
  
-     before { authorize! :download_code, user_project }
-@@ -139,7 +139,7 @@
+     helpers ::API::Helpers::HeadersHelpers
+ 
+-    before { authorize! :download_code, user_project }
++    before do
++      authorize! :download_code, user_project
++      coerce_nil_params_to_array!
++    end
+ 
+     params do
+       requires :id, type: String, desc: 'The ID of a project'
+@@ -143,7 +146,7 @@
          success Entities::Commit
        end
        params do
@@ -1494,9 +1558,20 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      include PaginationParams
      helpers ::API::Helpers::NotesHelpers
  
+--- a/lib/api/resource_milestone_events.rb
++++ b/lib/api/resource_milestone_events.rb
+@@ -1,7 +1,7 @@
+ # frozen_string_literal: true
+ 
+ module API
+-  class ResourceMilestoneEvents < Grape::API
++  class ResourceMilestoneEvents < Grape::API::Instance
+     include PaginationParams
+     helpers ::API::Helpers::NotesHelpers
+ 
 --- a/lib/api/runner.rb
 +++ b/lib/api/runner.rb
-@@ -1,7 +1,7 @@
+@@ -1,9 +1,13 @@
  # frozen_string_literal: true
  
  module API
@@ -1504,8 +1579,14 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
 +  class Runner < Grape::API::Instance
      helpers ::API::Helpers::Runner
  
++    before do
++      coerce_nil_params_to_array!
++    end
++
      resource :runners do
-@@ -18,7 +18,7 @@
+       desc 'Registers a new Runner' do
+         success Entities::RunnerRegistrationDetails
+@@ -18,7 +22,7 @@
          optional :access_level, type: String, values: Ci::Runner.access_levels.keys,
                                  desc: 'The access_level of the runner'
          optional :run_untagged, type: Boolean, desc: 'Should Runner handle untagged jobs'
@@ -1516,7 +1597,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
        post '/' do
 --- a/lib/api/runners.rb
 +++ b/lib/api/runners.rb
-@@ -1,7 +1,7 @@
+@@ -1,10 +1,13 @@
  # frozen_string_literal: true
  
  module API
@@ -1524,8 +1605,15 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
 +  class Runners < Grape::API::Instance
      include PaginationParams
  
-     before { authenticate! }
-@@ -17,7 +17,7 @@
+-    before { authenticate! }
++    before do
++      authenticate!
++      coerce_nil_params_to_array!
++    end
+ 
+     resource :runners do
+       desc 'Get runners available for user' do
+@@ -17,7 +20,7 @@
                          desc: 'The type of the runners to show'
          optional :status, type: String, values: Ci::Runner::AVAILABLE_STATUSES,
                            desc: 'The status of the runners to show'
@@ -1534,7 +1622,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
          use :pagination
        end
        get do
-@@ -40,7 +40,7 @@
+@@ -40,7 +43,7 @@
                          desc: 'The type of the runners to show'
          optional :status, type: String, values: Ci::Runner::AVAILABLE_STATUSES,
                            desc: 'The status of the runners to show'
@@ -1543,7 +1631,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
          use :pagination
        end
        get 'all' do
-@@ -75,7 +75,7 @@
+@@ -75,7 +78,7 @@
          requires :id, type: Integer, desc: 'The ID of the runner'
          optional :description, type: String, desc: 'The description of the runner'
          optional :active, type: Boolean, desc: 'The state of a runner'
@@ -1552,7 +1640,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
          optional :run_untagged, type: Boolean, desc: 'Flag indicating the runner can execute untagged jobs'
          optional :locked, type: Boolean, desc: 'Flag indicating the runner is locked'
          optional :access_level, type: String, values: Ci::Runner.access_levels.keys,
-@@ -145,7 +145,7 @@
+@@ -145,7 +148,7 @@
                          desc: 'The type of the runners to show'
          optional :status, type: String, values: Ci::Runner::AVAILABLE_STATUSES,
                            desc: 'The status of the runners to show'
@@ -1561,7 +1649,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
          use :pagination
        end
        get ':id/runners' do
-@@ -208,7 +208,7 @@
+@@ -208,7 +211,7 @@
                   desc: 'The type of the runners to show'
          optional :status, type: String, values: Ci::Runner::AVAILABLE_STATUSES,
                   desc: 'The status of the runners to show'
@@ -1593,16 +1681,21 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
  
 --- a/lib/api/settings.rb
 +++ b/lib/api/settings.rb
-@@ -1,7 +1,7 @@
+@@ -1,8 +1,11 @@
  # frozen_string_literal: true
  
  module API
 -  class Settings < Grape::API
+-    before { authenticated_as_admin! }
 +  class Settings < Grape::API::Instance
-     before { authenticated_as_admin! }
++    before do
++      authenticated_as_admin!
++      coerce_nil_params_to_array!
++    end
  
      helpers Helpers::SettingsHelpers
-@@ -49,7 +49,7 @@
+ 
+@@ -49,7 +52,7 @@
        optional :default_project_visibility, type: String, values: Gitlab::VisibilityLevel.string_values, desc: 'The default project visibility'
        optional :default_projects_limit, type: Integer, desc: 'The maximum number of personal projects'
        optional :default_snippet_visibility, type: String, values: Gitlab::VisibilityLevel.string_values, desc: 'The default snippet visibility'
@@ -1611,7 +1704,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
        optional :domain_blacklist_enabled, type: Boolean, desc: 'Enable domain blacklist for sign ups'
        optional :domain_blacklist, type: Array[String], coerce_with: Validations::Types::CommaSeparatedToArray.coerce, desc: 'Users with e-mail addresses that match these domain(s) will NOT be able to sign-up. Wildcards allowed. Use separate lines for multiple entries. Ex: domain.com, *.domain.com'
        optional :domain_whitelist, type: Array[String], coerce_with: Validations::Types::CommaSeparatedToArray.coerce, desc: 'ONLY users with e-mail addresses that match these domain(s) will be able to sign-up. Wildcards allowed. Use separate lines for multiple entries. Ex: domain.com, *.domain.com'
-@@ -79,7 +79,8 @@
+@@ -79,7 +82,8 @@
          requires :housekeeping_incremental_repack_period, type: Integer, desc: "Number of Git pushes after which an incremental 'git repack' is run."
        end
        optional :html_emails_enabled, type: Boolean, desc: 'By default GitLab sends emails in HTML and plain text formats so mail clients can choose what format to use. Disable this option if you only want to send emails in plain text format.'
@@ -1621,15 +1714,22 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
                                  desc: 'Enabled sources for code import during project creation. OmniAuth must be configured for GitHub, Bitbucket, and GitLab.com'
        optional :max_artifacts_size, type: Integer, desc: "Set the maximum file size for each job's artifacts"
        optional :max_attachment_size, type: Integer, desc: 'Maximum attachment size in MB'
-@@ -112,7 +113,7 @@
+@@ -113,13 +117,13 @@
          requires :recaptcha_private_key, type: String, desc: 'Generate private key at http://www.google.com/recaptcha'
        end
        optional :repository_checks_enabled, type: Boolean, desc: "GitLab will periodically run 'git fsck' in all project and wiki repositories to look for silent disk corruption issues."
 -      optional :repository_storages, type: Array[String], desc: 'Storage paths for new projects'
 +      optional :repository_storages, type: Array[String], coerce_with: Validations::Types::CommaSeparatedToArray.coerce, desc: 'Storage paths for new projects'
+       optional :repository_storages_weighted, type: Hash, desc: 'Storage paths for new projects with a weighted value between 0 and 100'
        optional :require_two_factor_authentication, type: Boolean, desc: 'Require all users to set up Two-factor authentication'
        given require_two_factor_authentication: ->(val) { val } do
          requires :two_factor_grace_period, type: Integer, desc: 'Amount of time (in hours) that users are allowed to skip forced configuration of two-factor authentication'
+       end
+-      optional :restricted_visibility_levels, type: Array[String], desc: 'Selected levels cannot be used by non-admin users for groups, projects or snippets. If the public level is restricted, user profiles are only visible to logged in users.'
++      optional :restricted_visibility_levels, type: Array[String], coerce_with: Validations::Types::CommaSeparatedToArray.coerce, desc: 'Selected levels cannot be used by non-admin users for groups, projects or snippets. If the public level is restricted, user profiles are only visible to logged in users.'
+       optional :send_user_confirmation_email, type: Boolean, desc: 'Send confirmation email on sign-up'
+       optional :session_expire_delay, type: Integer, desc: 'Session duration in minutes. GitLab restart is required to apply changes.'
+       optional :shared_runners_enabled, type: Boolean, desc: 'Enable shared runners for new projects'
 --- a/lib/api/sidekiq_metrics.rb
 +++ b/lib/api/sidekiq_metrics.rb
 @@ -3,7 +3,7 @@
@@ -1696,6 +1796,15 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
      before { authenticate! }
  
      resource :suggestions do
+@@ -25,7 +25,7 @@
+         success Entities::Suggestion
+       end
+       params do
+-        requires :ids, type: Array[String], desc: "An array of suggestion ID's"
++        requires :ids, type: Array[Integer], coerce_with: ::API::Validations::Types::CommaSeparatedToIntegerArray.coerce, desc: "An array of suggestion ID's"
+       end
+       put 'batch_apply' do
+         ids = params[:ids]
 --- a/lib/api/system_hooks.rb
 +++ b/lib/api/system_hooks.rb
 @@ -1,7 +1,7 @@
@@ -2057,7 +2166,7 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
 +end
 --- a/spec/requests/api/settings_spec.rb
 +++ b/spec/requests/api/settings_spec.rb
-@@ -60,14 +60,14 @@
+@@ -62,14 +62,14 @@
              default_projects_limit: 3,
              default_project_creation: 2,
              password_authentication_enabled_for_web: false,
@@ -2074,6 +2183,26 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
              default_artifacts_expire_in: '2 days',
              help_page_text: 'custom help text',
              help_page_hide_commercial_content: true,
+@@ -94,7 +94,9 @@
+             issues_create_limit: 300,
+             raw_blob_request_limit: 300,
+             spam_check_endpoint_enabled: true,
+-            spam_check_endpoint_url: 'https://example.com/spam_check'
++            spam_check_endpoint_url: 'https://example.com/spam_check',
++            disabled_oauth_sign_in_sources: 'unknown',
++            import_sources: 'github,bitbucket'
+           }
+ 
+         expect(response).to have_gitlab_http_status(:ok)
+@@ -135,6 +137,8 @@
+         expect(json_response['raw_blob_request_limit']).to eq(300)
+         expect(json_response['spam_check_endpoint_enabled']).to be_truthy
+         expect(json_response['spam_check_endpoint_url']).to eq('https://example.com/spam_check')
++        expect(json_response['disabled_oauth_sign_in_sources']).to eq([])
++        expect(json_response['import_sources']).to match_array(%w(github bitbucket))
+       end
+     end
+ 
 --- /dev/null
 +++ b/spec/rubocop/cop/api/grape_api_instance_spec.rb
 @@ -0,0 +1,31 @@
@@ -2186,44 +2315,54 @@ Closes https://gitlab.com/gitlab-org/gitlab/-/issues/195960
          resource :projects do
            get '/' do
              FooWorker.perform_async
---- /dev/null
-+++ b/spec/support/shared_examples/requests/api/issuable_update_shared_examples.rb
-@@ -0,0 +1,38 @@
-+# frozen_string_literal: true
+--- a/lib/api/helpers/common_helpers.rb
++++ b/lib/api/helpers/common_helpers.rb
+@@ -12,6 +12,26 @@
+           end
+         end
+       end
 +
-+RSpec.shared_examples 'issuable update endpoint' do
-+  let(:area) { entity.class.name.underscore.pluralize }
++      # Grape v1.3.3 no longer automatically coerces an Array
++      # type to an empty array if the value is nil.
++      def coerce_nil_params_to_array!
++        keys_to_coerce = params_with_array_types
 +
-+  describe 'PUT /projects/:id/issues/:issue_id' do
-+    let(:url) { "/projects/#{project.id}/#{area}/#{entity.iid}" }
++        params.each do |key, val|
++          params[key] = Array(val) if val.nil? && keys_to_coerce.include?(key)
++        end
++      end
 +
-+    it 'clears labels when labels param is nil' do
-+      put api(url, user), params: { labels: 'label1' }
-+
-+      expect(response).to have_gitlab_http_status(:ok)
-+      expect(json_response['labels']).to contain_exactly('label1')
-+
-+      put api(url, user), params: { labels: nil }
-+
-+      expect(response).to have_gitlab_http_status(:ok)
-+      json_response = Gitlab::Json.parse(response.body)
-+      expect(json_response['labels']).to be_empty
-+    end
-+
-+    it 'updates the issuable with labels param as array' do
-+      stub_const("Gitlab::QueryLimiting::Transaction::THRESHOLD", 110)
-+
-+      params = { labels: ['label1', 'label2', 'foo, bar', '&,?'] }
-+
-+      put api(url, user), params: params
-+
-+      expect(response).to have_gitlab_http_status(:ok)
-+      expect(json_response['labels']).to include 'label1'
-+      expect(json_response['labels']).to include 'label2'
-+      expect(json_response['labels']).to include 'foo'
-+      expect(json_response['labels']).to include 'bar'
-+      expect(json_response['labels']).to include '&'
-+      expect(json_response['labels']).to include '?'
-+    end
-+  end
-+end
++      def params_with_array_types
++        options[:route_options][:params].map do |key, val|
++          param_type = val[:type]
++          # Search for parameters with Array types (e.g. "[String]", "[Integer]", etc.)
++          if param_type =~ %r(\[\w*\])
++            key
++          end
++        end.compact.to_set
++      end
+     end
+   end
+ end
+--- a/spec/requests/api/applications_spec.rb
++++ b/spec/requests/api/applications_spec.rb
+@@ -74,14 +74,15 @@
+         expect(json_response['error']).to eq('scopes is missing')
+       end
+ 
+-      it 'does not allow creating an application with confidential set to nil' do
++      it 'defaults to creating an application with confidential' do
+         expect do
+           post api('/applications', admin_user), params: { name: 'application_name', redirect_uri: 'http://application.url', scopes: '', confidential: nil }
+-        end.not_to change { Doorkeeper::Application.count }
++        end.to change { Doorkeeper::Application.count }.by(1)
+ 
+-        expect(response).to have_gitlab_http_status(:bad_request)
++        expect(response).to have_gitlab_http_status(:created)
+         expect(json_response).to be_a Hash
+-        expect(json_response['message']['confidential'].first).to eq('is not included in the list')
++        expect(json_response['callback_url']).to eq('http://application.url')
++        expect(json_response['confidential']).to be true
+       end
+     end
+