diff --git a/debian/patches/0050-relax-stable-libs.patch b/debian/patches/0050-relax-stable-libs.patch
index b83624f087..73b4616a71 100644
--- a/debian/patches/0050-relax-stable-libs.patch
+++ b/debian/patches/0050-relax-stable-libs.patch
@@ -3,7 +3,7 @@ gitlab Gemfile
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -2,53 +2,53 @@
+@@ -2,55 +2,55 @@
  
  source 'https://rubygems.org'
  
@@ -42,9 +42,13 @@ gitlab Gemfile
 -gem 'bcrypt', '3.1.12'
 -gem 'doorkeeper', '~> 5.5.0.rc2'
 -gem 'doorkeeper-openid_connect', '~> 1.7.5'
+-gem 'rexml', '~> 3.2.5'
+-gem 'ruby-saml', '~> 1.12.1'
 +gem 'bcrypt', '~> 3.1', '>= 3.1.12'
 +gem 'doorkeeper', '~> 5.5'
 +gem 'doorkeeper-openid_connect', '~> 1.7', '>= 1.7.5'
++gem 'rexml', '~> 3.2', '>= 3.2.5'
++gem 'ruby-saml', '~> 1.12', '>= 1.12.1'
  gem 'omniauth', '~> 1.8'
 -gem 'omniauth-auth0', '~> 2.0.0'
 +gem 'omniauth-auth0', '~> 2.0'
@@ -77,7 +81,7 @@ gitlab Gemfile
  
  # Kerberos authentication. EE-only
  gem 'gssapi', group: :kerberos
-@@ -56,17 +56,17 @@
+@@ -58,17 +58,17 @@
  # Spam and anti-bot protection
  gem 'recaptcha', '~> 4.11', require: 'recaptcha/rails'
  gem 'akismet', '~> 3.0'
@@ -100,7 +104,7 @@ gitlab Gemfile
  # GitLab Pages letsencrypt support
  gem 'acme-client', '~> 2.0', '>= 2.0.6'
  
-@@ -74,27 +74,27 @@
+@@ -76,27 +76,27 @@
  gem 'browser', '~> 4.2'
  
  # GPG
@@ -136,7 +140,7 @@ gitlab Gemfile
  gem 'graphlient', '~> 0.4.0' # Used by BulkImport feature (group::import)
  
  gem 'hashie'
-@@ -105,11 +105,11 @@
+@@ -107,11 +107,11 @@
  gem 'kaminari', '~> 1.0'
  
  # HAML
@@ -150,7 +154,7 @@ gitlab Gemfile
  
  # for backups
  gem 'fog-aws', '~> 3.8'
-@@ -130,37 +130,37 @@
+@@ -132,37 +132,37 @@
  gem 'unf', '~> 0.1.4'
  
  # Seed data
@@ -201,7 +205,7 @@ gitlab Gemfile
  gem 'escape_utils', '~> 1.1'
  
  # Calendar rendering
-@@ -171,7 +171,7 @@
+@@ -173,7 +173,7 @@
  gem 'diff_match_patch', '~> 0.1.0'
  
  # Application server
@@ -210,7 +214,7 @@ gitlab Gemfile
  # https://github.com/sharpstone/rack-timeout/blob/master/README.md#rails-apps-manually
  gem 'rack-timeout', '~> 0.5.1', require: 'rack/timeout/base'
  
-@@ -181,7 +181,7 @@
+@@ -183,7 +183,7 @@
  end
  
  group :puma do
@@ -219,7 +223,7 @@ gitlab Gemfile
    gem 'puma_worker_killer', '~> 0.3.1', require: false
  end
  
-@@ -192,13 +192,13 @@
+@@ -194,13 +194,13 @@
  gem 'acts-as-taggable-on', '~> 7.0'
  
  # Background jobs
@@ -236,7 +240,7 @@ gitlab Gemfile
  
  # HTTP requests
  gem 'httparty', '~> 0.16.4'
-@@ -210,14 +210,14 @@
+@@ -212,14 +212,14 @@
  gem 'ruby-progressbar', '~> 1.10'
  
  # GitLab settings
@@ -254,7 +258,7 @@ gitlab Gemfile
  
  # Export Ruby Regex to Javascript
  gem 'js_regex', '~> 3.4'
-@@ -230,20 +230,20 @@
+@@ -232,20 +232,20 @@
  gem 'connection_pool', '~> 2.0'
  
  # Redis session store
@@ -278,7 +282,7 @@ gitlab Gemfile
  
  # Hangouts Chat integration
  gem 'hangouts-chat', '~> 0.0.5'
-@@ -255,11 +255,11 @@
+@@ -257,11 +257,11 @@
  gem 'ruby-fogbugz', '~> 0.2.1'
  
  # Kubernetes integration
@@ -293,7 +297,7 @@ gitlab Gemfile
  
  # Sanitizes SVG input
  gem 'loofah', '~> 2.2'
-@@ -285,9 +285,9 @@
+@@ -287,9 +287,9 @@
  
  gem 'rack-proxy', '~> 0.6.0'
  
@@ -306,7 +310,7 @@ gitlab Gemfile
  
  gem 'addressable', '~> 2.7'
  gem 'gemojione', '~> 3.3'
-@@ -298,18 +298,18 @@
+@@ -300,18 +300,18 @@
  gem "gitlab-license", "~> 1.3"
  
  # Protect against bruteforcing
@@ -329,7 +333,7 @@ gitlab Gemfile
  # Thrift is a dependency of gitlab-labkit, we want a version higher than 0.14.0
  # because of https://gitlab.com/gitlab-org/gitlab/-/issues/321900
  gem 'thrift', '>= 0.14.0'
-@@ -317,11 +317,11 @@
+@@ -319,11 +319,11 @@
  # I18n
  gem 'ruby_parser', '~> 3.15', require: false
  gem 'rails-i18n', '~> 6.0'
@@ -343,7 +347,7 @@ gitlab Gemfile
  
  # Perf bar
  gem 'peek', '~> 1.1'
-@@ -354,39 +354,39 @@
+@@ -356,39 +356,39 @@
  end
  
  group :development, :test do
@@ -394,7 +398,7 @@ gitlab Gemfile
  
    gem 'timecop', '~> 0.9.1'
  
-@@ -408,18 +408,18 @@
+@@ -410,18 +410,18 @@
  end
  
  group :test do
@@ -419,7 +423,7 @@ gitlab Gemfile
    gem 'rails-controller-testing'
    gem 'concurrent-ruby', '~> 1.1'
    gem 'test-prof', '~> 0.12.0'
-@@ -438,7 +438,7 @@
+@@ -440,7 +440,7 @@
  gem 'email_reply_trimmer', '~> 0.1'
  gem 'html2text'
  
@@ -428,7 +432,7 @@ gitlab Gemfile
  gem 'stackprof', '~> 0.2.15', require: false
  gem 'rbtrace', '~> 0.4', require: false
  gem 'memory_profiler', '~> 0.9', require: false
-@@ -452,8 +452,8 @@
+@@ -454,8 +454,8 @@
  gem 'health_check', '~> 3.0'
  
  # System information
@@ -439,7 +443,7 @@ gitlab Gemfile
  
  # NTP client
  gem 'net-ntp'
-@@ -469,13 +469,13 @@
+@@ -471,13 +471,13 @@
  end
  
  # Gitaly GRPC protocol definitions
@@ -456,7 +460,7 @@ gitlab Gemfile
  
  # Feature toggles
  gem 'flipper', '~> 0.17.1'
-@@ -494,12 +494,12 @@
+@@ -496,12 +496,12 @@
  # Countries list
  gem 'countries', '~> 3.0'
  
@@ -471,7 +475,7 @@ gitlab Gemfile
  
  # Locked as long as quoted-printable encoding issues are not resolved
  # Monkey-patched in `config/initializers/mail_encoding_patch.rb`
-@@ -513,12 +513,12 @@
+@@ -515,12 +515,12 @@
  gem 'valid_email', '~> 0.1'
  
  # JSON
diff --git a/debian/patches/0100-remove-development-test.patch b/debian/patches/0100-remove-development-test.patch
index 8483594d51..d760415f7b 100644
--- a/debian/patches/0100-remove-development-test.patch
+++ b/debian/patches/0100-remove-development-test.patch
@@ -2,7 +2,7 @@ Bundler will fail when it can't find these locally
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -94,7 +94,6 @@
+@@ -96,7 +96,6 @@
  # https://gitlab.com/gitlab-org/gitlab/issues/31747
  gem 'graphiql-rails', '~> 1.4', '>= 1.4.10'
  gem 'apollo_upload_server', '~> 2.0', '>= 2.0.2'
@@ -10,7 +10,7 @@ Bundler will fail when it can't find these locally
  gem 'graphlient', '~> 0.4.0' # Used by BulkImport feature (group::import)
  
  gem 'hashie'
-@@ -319,7 +318,6 @@
+@@ -321,7 +320,6 @@
  gem 'rails-i18n', '~> 6.0'
  gem 'gettext_i18n_rails', '~> 1.8'
  gem 'gettext_i18n_rails_js', '~> 1.3'
@@ -18,7 +18,7 @@ Bundler will fail when it can't find these locally
  
  gem 'batch-loader', '~> 1.4'
  
-@@ -339,20 +337,6 @@
+@@ -341,20 +339,6 @@
    gem 'raindrops', '~> 0.18'
  end
  
@@ -39,7 +39,7 @@ Bundler will fail when it can't find these locally
  group :development, :test do
    gem 'deprecation_toolkit', '~> 1.5', '>= 1.5.1', require: false
    gem 'bullet', '~> 6.1', '>= 6.1.3'
-@@ -375,12 +359,6 @@
+@@ -377,12 +361,6 @@
    gem 'spring', '~> 2.1'
    gem 'spring-commands-rspec', '~> 1.0', '>= 1.0.4'
  
@@ -52,7 +52,7 @@ Bundler will fail when it can't find these locally
    gem 'benchmark-ips', '~> 2.3', require: false
  
    gem 'knapsack', '~> 1.17'
-@@ -397,16 +375,6 @@
+@@ -399,16 +377,6 @@
    gem 'rblineprof', '~> 0.3.6', platform: :mri, require: false
  end
  
diff --git a/debian/patches/0110-make-test-dependencies-conditional.patch b/debian/patches/0110-make-test-dependencies-conditional.patch
index 67da2f0901..4c8d99fdaf 100644
--- a/debian/patches/0110-make-test-dependencies-conditional.patch
+++ b/debian/patches/0110-make-test-dependencies-conditional.patch
@@ -2,7 +2,7 @@ Make test dependencies conditional so we can enable them when running autopkgtes
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -337,7 +337,7 @@
+@@ -339,7 +339,7 @@
    gem 'raindrops', '~> 0.18'
  end
  
@@ -11,7 +11,7 @@ Make test dependencies conditional so we can enable them when running autopkgtes
    gem 'deprecation_toolkit', '~> 1.5', '>= 1.5.1', require: false
    gem 'bullet', '~> 6.1', '>= 6.1.3'
    gem 'gitlab-pry-byebug', platform: :mri, require: ['pry-byebug', 'pry-byebug/pry_remote_ext']
-@@ -373,9 +373,7 @@
+@@ -375,9 +375,7 @@
    gem 'parallel', '~> 1.19', require: false
  
    gem 'rblineprof', '~> 0.3.6', platform: :mri, require: false
diff --git a/debian/patches/0340-relax-httparty.patch b/debian/patches/0340-relax-httparty.patch
index 49c6866613..20e139f36e 100644
--- a/debian/patches/0340-relax-httparty.patch
+++ b/debian/patches/0340-relax-httparty.patch
@@ -2,7 +2,7 @@ Allow newer versions of httparty to satisfy dependency
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -200,7 +200,7 @@
+@@ -202,7 +202,7 @@
  gem 'fugit', '~> 1.2', '>= 1.2.1'
  
  # HTTP requests
diff --git a/debian/patches/0350-relax-rdoc.patch b/debian/patches/0350-relax-rdoc.patch
index c03769a423..3bf3a90267 100644
--- a/debian/patches/0350-relax-rdoc.patch
+++ b/debian/patches/0350-relax-rdoc.patch
@@ -2,7 +2,7 @@ Allow rdoc from ruby 2.5 to match requirement
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -148,7 +148,7 @@
+@@ -150,7 +150,7 @@
  gem 'commonmarker', '~> 0.21'
  gem 'kramdown', '~> 2.3'
  gem 'RedCloth', '~> 4.3', '>= 4.3.2'
diff --git a/debian/patches/0430-remove-gitlab-markup.patch b/debian/patches/0430-remove-gitlab-markup.patch
index 1d609164f1..e8c5e7fb19 100644
--- a/debian/patches/0430-remove-gitlab-markup.patch
+++ b/debian/patches/0430-remove-gitlab-markup.patch
@@ -4,7 +4,7 @@ maintaining two almost same packages.
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -143,7 +143,6 @@
+@@ -145,7 +145,6 @@
  # Markdown and HTML processing
  gem 'html-pipeline', '~> 2.13', '>= 2.13.2'
  gem 'deckar01-task_list', '~> 2.3', '>= 2.3.1'
diff --git a/debian/patches/0440-remove-unicorn.patch b/debian/patches/0440-remove-unicorn.patch
index a1d84ae203..71a6e8468b 100644
--- a/debian/patches/0440-remove-unicorn.patch
+++ b/debian/patches/0440-remove-unicorn.patch
@@ -3,7 +3,7 @@ gitlab-puma changes is included in puma package.
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -173,11 +173,6 @@
+@@ -175,11 +175,6 @@
  # https://github.com/sharpstone/rack-timeout/blob/master/README.md#rails-apps-manually
  gem 'rack-timeout', '~> 0.5.1', require: 'rack/timeout/base'
  
diff --git a/debian/patches/0480-embed-elasticsearch-model.patch b/debian/patches/0480-embed-elasticsearch-model.patch
index df60823cd1..022f904245 100644
--- a/debian/patches/0480-embed-elasticsearch-model.patch
+++ b/debian/patches/0480-embed-elasticsearch-model.patch
@@ -2,7 +2,7 @@ Embed this gem until gitlab moved to 7.x version
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -132,7 +132,7 @@
+@@ -134,7 +134,7 @@
  gem 'seed-fu', '~> 2.3', '>= 2.3.7'
  
  # Search
diff --git a/debian/patches/0480-embed-elasticsearch-rails.patch b/debian/patches/0480-embed-elasticsearch-rails.patch
index dbc076d535..df7f034611 100644
--- a/debian/patches/0480-embed-elasticsearch-rails.patch
+++ b/debian/patches/0480-embed-elasticsearch-rails.patch
@@ -2,7 +2,7 @@ Embed this gem until gitlab moved to 7.x version
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -133,7 +133,7 @@
+@@ -135,7 +135,7 @@
  
  # Search
  gem 'elasticsearch-model', '~> 6.1', path: 'vendor/gems/elasticsearch-model'
diff --git a/debian/patches/0482-remove-ee-only-gems.patch b/debian/patches/0482-remove-ee-only-gems.patch
index 2bd5e763ba..455802c04d 100644
--- a/debian/patches/0482-remove-ee-only-gems.patch
+++ b/debian/patches/0482-remove-ee-only-gems.patch
@@ -2,7 +2,7 @@ This gem is used only in gitlab Enterprise Edition
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -50,9 +50,6 @@
+@@ -52,9 +52,6 @@
  gem 'rack-oauth2', '~> 1.16'
  gem 'jwt', '~> 2.1'
  
@@ -12,7 +12,7 @@ This gem is used only in gitlab Enterprise Edition
  # Spam and anti-bot protection
  gem 'recaptcha', '~> 4.11', require: 'recaptcha/rails'
  gem 'akismet', '~> 3.0'
-@@ -288,8 +285,6 @@
+@@ -290,8 +287,6 @@
  gem 'request_store', '~> 1.5'
  gem 'base32', '~> 0.3.0'
  
diff --git a/debian/patches/0484-relax-grape-entity.patch b/debian/patches/0484-relax-grape-entity.patch
index 431a140f2e..6656494b49 100644
--- a/debian/patches/0484-relax-grape-entity.patch
+++ b/debian/patches/0484-relax-grape-entity.patch
@@ -2,7 +2,7 @@ Debian already has 0.8
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -81,7 +81,7 @@
+@@ -83,7 +83,7 @@
  
  # API
  gem 'grape', '~> 1.5', '>= 1.5.2'
diff --git a/debian/patches/0485-relax-gitlab-sidekiq-fetcher.patch b/debian/patches/0485-relax-gitlab-sidekiq-fetcher.patch
index a784a1be34..12285fbe62 100644
--- a/debian/patches/0485-relax-gitlab-sidekiq-fetcher.patch
+++ b/debian/patches/0485-relax-gitlab-sidekiq-fetcher.patch
@@ -2,7 +2,7 @@ Allow newer version in the archive to satisfy the requirement
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -185,7 +185,7 @@
+@@ -187,7 +187,7 @@
  gem 'sidekiq', '~> 5.2', '>= 5.2.7'
  gem 'sidekiq-cron', '~> 1.0'
  gem 'redis-namespace', '~> 1.7'
diff --git a/debian/patches/0486-relax-sidekiq.patch b/debian/patches/0486-relax-sidekiq.patch
index fd570b8a52..273e11f542 100644
--- a/debian/patches/0486-relax-sidekiq.patch
+++ b/debian/patches/0486-relax-sidekiq.patch
@@ -2,7 +2,7 @@ ruby-sidekiq 6 is in unstable
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -182,7 +182,7 @@
+@@ -184,7 +184,7 @@
  gem 'acts-as-taggable-on', '~> 7.0'
  
  # Background jobs
diff --git a/debian/patches/0499-10-relax-capybara.patch b/debian/patches/0499-10-relax-capybara.patch
index 3f60fbdd01..2218e799e9 100644
--- a/debian/patches/0499-10-relax-capybara.patch
+++ b/debian/patches/0499-10-relax-capybara.patch
@@ -1,6 +1,6 @@
 --- a/Gemfile
 +++ b/Gemfile
-@@ -368,7 +368,7 @@
+@@ -370,7 +370,7 @@
    gem 'rspec_profiling', '~> 0.0.6'
    gem 'rspec-parameterized', require: false
  
diff --git a/debian/patches/0499-20-remove-capybara-screenshot.patch b/debian/patches/0499-20-remove-capybara-screenshot.patch
index 1fbe0e0e13..d16035b488 100644
--- a/debian/patches/0499-20-remove-capybara-screenshot.patch
+++ b/debian/patches/0499-20-remove-capybara-screenshot.patch
@@ -1,6 +1,6 @@
 --- a/Gemfile
 +++ b/Gemfile
-@@ -369,7 +369,6 @@
+@@ -371,7 +371,6 @@
    gem 'rspec-parameterized', require: false
  
    gem 'capybara', '~> 3.12'
diff --git a/debian/patches/0499-30-remove-guard-rspec.patch b/debian/patches/0499-30-remove-guard-rspec.patch
index c374836b65..16bbda0a29 100644
--- a/debian/patches/0499-30-remove-guard-rspec.patch
+++ b/debian/patches/0499-30-remove-guard-rspec.patch
@@ -1,6 +1,6 @@
 --- a/Gemfile
 +++ b/Gemfile
-@@ -378,7 +378,6 @@
+@@ -380,7 +380,6 @@
    gem 'concurrent-ruby', '~> 1.1'
    gem 'test-prof', '~> 0.12.0'
    gem 'rspec_junit_formatter'
diff --git a/debian/patches/0499-40-relax-rouge.patch b/debian/patches/0499-40-relax-rouge.patch
index e10b372555..cc60fe576e 100644
--- a/debian/patches/0499-40-relax-rouge.patch
+++ b/debian/patches/0499-40-relax-rouge.patch
@@ -3,7 +3,7 @@ rouge update is blocked by
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -152,7 +152,7 @@
+@@ -154,7 +154,7 @@
  gem 'asciidoctor-include-ext', '~> 0.3.1', require: false
  gem 'asciidoctor-plantuml', '~> 0.0.12'
  gem 'asciidoctor-kroki', '~> 0.4.0', require: false
diff --git a/debian/patches/0499-70-relax-graphlient.patch b/debian/patches/0499-70-relax-graphlient.patch
index f55c9d5837..ea843073ab 100644
--- a/debian/patches/0499-70-relax-graphlient.patch
+++ b/debian/patches/0499-70-relax-graphlient.patch
@@ -2,7 +2,7 @@ newer version is in the archive
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -91,7 +91,7 @@
+@@ -93,7 +93,7 @@
  # https://gitlab.com/gitlab-org/gitlab/issues/31747
  gem 'graphiql-rails', '~> 1.4', '>= 1.4.10'
  gem 'apollo_upload_server', '~> 2.0', '>= 2.0.2'
diff --git a/debian/patches/0499-90-relax-webrick.patch b/debian/patches/0499-90-relax-webrick.patch
index b23ce6b5b5..eb25c5da8b 100644
--- a/debian/patches/0499-90-relax-webrick.patch
+++ b/debian/patches/0499-90-relax-webrick.patch
@@ -1,6 +1,6 @@
 --- a/Gemfile
 +++ b/Gemfile
-@@ -319,7 +319,7 @@
+@@ -321,7 +321,7 @@
  # Metrics
  group :metrics do
    gem 'method_source', '~> 1.0', require: false
diff --git a/debian/patches/0499-91-relax-gitlab-labkit.patch b/debian/patches/0499-91-relax-gitlab-labkit.patch
index 0c8c3ec22b..70c32fdf8c 100644
--- a/debian/patches/0499-91-relax-gitlab-labkit.patch
+++ b/debian/patches/0499-91-relax-gitlab-labkit.patch
@@ -2,7 +2,7 @@ gitaly needs gitlab-labkit ~> 0.15.0
 
 --- a/Gemfile
 +++ b/Gemfile
-@@ -297,7 +297,7 @@
+@@ -299,7 +299,7 @@
  gem 'premailer-rails', '~> 1.10', '>= 1.10.3'
  
  # LabKit: Tracing and Correlation