Add latest changes from gitlab-org/gitlab@master

app/assets/javascripts/boards/constants.js

@@ -13,7 +13,7 @@ export const ListType = {
   blank: 'blank',
 };
 
-export const inactiveListId = 0;
+export const inactiveId = 0;
 
 export default {
   BoardType,

app/assets/javascripts/boards/stores/state.js

@@ -1,7 +1,7 @@
-import { inactiveListId } from '~/boards/constants';
+import { inactiveId } from '~/boards/constants';
 
 export default () => ({
   endpoints: {},
   isShowingLabels: true,
-  activeListId: inactiveListId,
+  activeId: inactiveId,
 });

app/assets/javascripts/issuables_list/components/issuable.vue

@@ -237,6 +237,8 @@ export default {
     :data-id="issuable.id"
     :data-labels="labelIdsString"
     :data-url="issuable.web_url"
+    data-qa-selector="issue_container"
+    :data-qa-issue-title="issuable.title"
   >
     <div class="gl-display-flex">
       <!-- Bulk edit checkbox -->
@@ -265,7 +267,12 @@ export default {
               :title="$options.confidentialTooltipText"
               :aria-label="$options.confidentialTooltipText"
             />
-            <gl-link :href="issuable.web_url" :target="linkTarget" data-testid="issuable-title">
+            <gl-link
+              :href="issuable.web_url"
+              :target="linkTarget"
+              data-testid="issuable-title"
+              data-qa-selector="issue_link"
+            >
               {{ issuable.title }}
               <gl-icon
                 v-if="isJiraIssue"
@@ -355,6 +362,7 @@ export default {
             :title="__('Weight')"
             class="gl-display-none d-sm-inline-block"
             data-testid="weight"
+            data-qa-selector="issuable_weight_content"
           >
             <gl-icon name="weight" class="align-text-bottom" />
             {{ issuable.weight }}

app/assets/javascripts/vue_shared/components/issue/issue_assignees.vue

@@ -88,6 +88,7 @@ export default {
       :img-size="iconSize"
       class="js-no-trigger"
       tooltip-placement="bottom"
+      data-qa-selector="assignee_link"
     >
       <span class="js-assignee-tooltip">
         <span class="bold d-block">{{ __('Assignee') }}</span> {{ assignee.name }}
@@ -100,6 +101,7 @@ export default {
       :title="assigneesCounterTooltip"
       class="avatar-counter"
       data-placement="bottom"
+      data-qa-selector="avatar_counter_content"
       >{{ assigneeCounterLabel }}</span
     >
   </div>

app/helpers/form_helper.rb

@@ -11,7 +11,7 @@ module FormHelper
       content_tag(:h4, headline) <<
         content_tag(:ul) do
           messages = model.errors.map do |attribute, message|
-            message = model.errors.full_message(attribute, message)
+            message = html_escape_once(model.errors.full_message(attribute, message)).html_safe
             message = content_tag(:span, message, class: 'str-truncated-100') if truncate.include?(attribute)
 
             content_tag(:li, message)

app/models/user.rb

@@ -355,6 +355,12 @@ class User < ApplicationRecord
   scope :order_recent_last_activity, -> { reorder(Gitlab::Database.nulls_last_order('last_activity_on', 'DESC')) }
   scope :order_oldest_last_activity, -> { reorder(Gitlab::Database.nulls_first_order('last_activity_on', 'ASC')) }
 
+  def preferred_language
+    read_attribute('preferred_language') ||
+      I18n.default_locale.to_s.presence_in(Gitlab::I18n::AVAILABLE_LANGUAGES.keys) ||
+      'en'
+  end
+
   def active_for_authentication?
     super && can?(:log_in)
   end

app/validators/html_safety_validator.rb

@@ -21,7 +21,7 @@ class HtmlSafetyValidator < ActiveModel::EachValidator
   end
 
   def self.error_message
-    _("cannot contain HTML/XML tags, including any word between angle brackets (<,>).")
+    _("cannot contain HTML/XML tags, including any word between angle brackets (&lt;,&gt;).")
   end
 
   private

app/views/admin/application_settings/integrations.html.haml

@@ -10,7 +10,7 @@
         = sprite_icon('close', size: 16, css_class: 'gl-icon')
       .gl-alert-body
         %h4.gl-alert-title= s_('AdminSettings|Some settings have moved')
-        = s_('AdminSettings|Elasticsearch, PlantUML, Slack application, Third party offers, Snowplow, Amazon EKS have moved to Settings > General.')
+        = html_escape_once(s_('AdminSettings|Elasticsearch, PlantUML, Slack application, Third party offers, Snowplow, Amazon EKS have moved to Settings > General.')).html_safe
       .gl-alert-actions
         = link_to s_('AdminSettings|Go to General Settings'), general_admin_application_settings_path, class: 'btn gl-alert-action btn-info new-gl-button'
 

app/views/profiles/two_factor_auths/show.html.haml

@@ -88,7 +88,7 @@
             %tbody
               - @u2f_registrations.each do |registration|
                 %tr
-                  %td= registration.name.presence || _("<no name set>")
+                  %td= registration.name.presence || html_escape_once(_("&lt;no name set&gt;")).html_safe
                   %td= registration.created_at.to_date.to_s(:medium)
                   %td= link_to _('Delete'), profile_u2f_registration_path(registration), method: :delete, class: "btn btn-danger float-right", data: { confirm: _('Are you sure you want to delete this device? This action cannot be undone.') }
 

app/views/projects/issues/_issue.html.haml

@@ -1,5 +1,5 @@
 -# DANGER: Any changes to this file need to be reflected in issuables_list/components/issuable.vue!
-%li{ id: dom_id(issue), class: issue_css_classes(issue), url: issue_path(issue), data: { labels: issue.label_ids, id: issue.id, qa_selector: 'issue', qa_issue_title: issue.title } }
+%li{ id: dom_id(issue), class: issue_css_classes(issue), url: issue_path(issue), data: { labels: issue.label_ids, id: issue.id, qa_selector: 'issue_container', qa_issue_title: issue.title } }
   .issue-box
     - if @can_bulk_update
       .issue-check.hidden

app/views/projects/pages/_access.html.haml

@@ -18,6 +18,6 @@
         - help_page = help_page_path('/user/project/pages/pages_access_control')
         - link_start = '<a href="%{url}" target="_blank" class="alert-link" rel="noopener noreferrer">'.html_safe % { url: help_page }
         - link_end = '</a>'.html_safe
-        = s_('GitLabPages|Access Control is enabled for this Pages website; only authorized users will be able to access it. To make your website publicly available, navigate to your project\'s %{strong_start}Settings > General > Visibility%{strong_end} and select %{strong_start}Everyone%{strong_end} in pages section. Read the %{link_start}documentation%{link_end} for more information.').html_safe % { link_start: link_start, link_end: link_end, strong_start: '<strong>'.html_safe, strong_end: '</strong>'.html_safe }
+        = html_escape_once(s_('GitLabPages|Access Control is enabled for this Pages website; only authorized users will be able to access it. To make your website publicly available, navigate to your project\'s %{strong_start}Settings &gt; General &gt; Visibility%{strong_end} and select %{strong_start}Everyone%{strong_end} in pages section. Read the %{link_start}documentation%{link_end} for more information.')).html_safe % { link_start: link_start, link_end: link_end, strong_start: '<strong>'.html_safe, strong_end: '</strong>'.html_safe }
     .card-footer.alert-primary
       = s_('GitLabPages|It may take up to 30 minutes before the site is available after the first deployment.')

app/views/projects/services/slack_slash_commands/_help.html.haml

@@ -1,5 +1,5 @@
-- pretty_name = @project&.full_name || _('<project name>')
+- pretty_name = @project&.full_name || _('&lt;project name&gt;')
-- run_actions_text = s_("ProjectService|Perform common operations on GitLab project: %{project_name}") % { project_name: pretty_name }
+- run_actions_text = html_escape_once(s_("ProjectService|Perform common operations on GitLab project: %{project_name}") % { project_name: pretty_name })
 
 .info-well
   .well-segment
@@ -67,7 +67,7 @@
         .form-group
           = label_tag :autocomplete_description, _('Autocomplete description'), class: 'col-12 col-form-label label-bold'
           .col-12.input-group
-            = text_field_tag :autocomplete_description, run_actions_text, class: 'form-control form-control-sm', readonly: 'readonly'
+            = text_field_tag :autocomplete_description, run_actions_text.html_safe, class: 'form-control form-control-sm', readonly: 'readonly'
             .input-group-append
               = clipboard_button(target: '#autocomplete_description', class: 'input-group-text')
 

app/views/shared/access_tokens/_table.html.haml

@@ -42,7 +42,7 @@
                     = _('In %{time_to_now}') % { time_to_now: distance_of_time_in_words_to_now(token.expires_at) }
               - else
                 %span.token-never-expires-label= _('Never')
-            %td= token.scopes.present? ? token.scopes.join(', ') : _('<no scopes selected>')
+            %td= token.scopes.present? ? token.scopes.join(', ') : html_escape_once(_('&lt;no scopes selected&gt;')).html_safe
             %td= link_to _('Revoke'), revoke_route_helper.call(token), method: :put, class: 'btn btn-danger float-right qa-revoke-button', data: { confirm: _('Are you sure you want to revoke this %{type}? This action cannot be undone.') % { type: type } }
 - else
   .settings-message.text-center

app/views/shared/deploy_tokens/_table.html.haml

@@ -23,7 +23,7 @@
                   In #{distance_of_time_in_words_to_now(token.expires_at)}
               - else
                 %span.token-never-expires-label= _('Never')
-            %td= token.scopes.present? ? token.scopes.join(", ") : _('<no scopes selected>')
+            %td= token.scopes.present? ? token.scopes.join(", ") : html_escape_once(_('&lt;no scopes selected&gt;')).html_safe
             %td= link_to s_('DeployTokens|Revoke'), "#", class: "btn btn-danger float-right", data: { toggle: "modal", target: "#revoke-modal-#{token.id}"}
             = render 'shared/deploy_tokens/revoke_modal', token: token, group_or_project: group_or_project
 - else

app/views/shared/issuable/_assignees.html.haml

@@ -7,4 +7,4 @@
   = link_to_member(@project, assignee, name: false, title: "Assigned to :name")
 
 - if more_assignees_count.positive?
-  %span{ class: 'avatar-counter has-tooltip', data: { container: 'body', placement: 'bottom', 'line-type' => 'old', 'original-title' => "+#{more_assignees_count} more assignees", qa_selector: 'avatar_counter' } } +#{more_assignees_count}
+  %span{ class: 'avatar-counter has-tooltip', data: { container: 'body', placement: 'bottom', 'line-type' => 'old', 'original-title' => "+#{more_assignees_count} more assignees", qa_selector: 'avatar_counter_content' } } +#{more_assignees_count}

changelogs/unreleased/231329-use-cloudflare-comments.yml

@@ -0,0 +1,5 @@
+---
+title: Use Cloudflare in comments
+merge_request: 37764
+author: Takuya Noguchi
+type: other

changelogs/unreleased/ab-keyset-blank-parameters.yml

@@ -0,0 +1,5 @@
+---
+title: Fix issue with blank keyset pagination parameters
+merge_request: 37351
+author:
+type: fixed

changelogs/unreleased/kassio-ensure-user-preferred-language.yml

@@ -0,0 +1,5 @@
+---
+title: Ensure User's preferred_language always has a value.
+merge_request: 37464
+author:
+type: fixed

doc/operations/feature_flags.md

@@ -196,9 +196,11 @@ To get the access credentials that your application needs to communicate with Gi
 1. Click the **Configure** button to view the following:
    - **API URL**: URL where the client (application) connects to get a list of feature flags.
    - **Instance ID**: Unique token that authorizes the retrieval of the feature flags.
-   - **Application name**: The name of the running environment. For instance,
+   - **Application name**: The name of the *environment* the application runs in
-     if the application runs for a production server, the application name would be
+     (not the name of the application itself).
-     `production` or similar. This value is used for the environment spec evaluation.
+
+     For example, if the application runs for a production server, the **Application name**
+     could be `production` or similar. This value is used for the environment spec evaluation.
 
 NOTE: **Note:**
 The meaning of these fields might change over time. For example, we are not sure
@@ -247,7 +249,7 @@ func init() {
     unleash.Initialize(
         unleash.WithUrl("https://gitlab.com/api/v4/feature_flags/unleash/42"),
         unleash.WithInstanceId("29QmjsW6KngPR5JNPMWx"),
-        unleash.WithAppName("production"),
+        unleash.WithAppName("production"), // Set to the running environment of your application
         unleash.WithListener(&metricsInterface{}),
     )
 }
@@ -280,7 +282,7 @@ require 'unleash/context'
 
 unleash = Unleash::Client.new({
   url: 'http://gitlab.com/api/v4/feature_flags/unleash/42',
-  app_name: 'production',
+  app_name: 'production', # Set to the running environment of your application
   instance_id: '29QmjsW6KngPR5JNPMWx'
 })
 

lib/api/helpers.rb

@@ -559,8 +559,8 @@ module API
       finder_params[:search_namespaces] = true if params[:search_namespaces].present?
       finder_params[:user] = params.delete(:user) if params[:user]
       finder_params[:custom_attributes] = params[:custom_attributes] if params[:custom_attributes]
-      finder_params[:id_after] = params[:id_after] if params[:id_after]
+      finder_params[:id_after] = sanitize_id_param(params[:id_after]) if params[:id_after]
-      finder_params[:id_before] = params[:id_before] if params[:id_before]
+      finder_params[:id_before] = sanitize_id_param(params[:id_before]) if params[:id_before]
       finder_params[:last_activity_after] = params[:last_activity_after] if params[:last_activity_after]
       finder_params[:last_activity_before] = params[:last_activity_before] if params[:last_activity_before]
       finder_params[:repository_storage] = params[:repository_storage] if params[:repository_storage]
@@ -659,6 +659,10 @@ module API
     def ip_address
       env["action_dispatch.remote_ip"].to_s || request.ip
     end
+
+    def sanitize_id_param(id)
+      id.present? ? id.to_i : nil
+    end
   end
 end
 

lib/gitlab/i18n/html_todo.yml

@@ -74,50 +74,6 @@
     - "< 1 hora"
     - "< 1 saat"
     - "< 1 Stunde"
-"<namespace / project>":
-  plural_id:
-  translations:
-    - "<namespace / project>"
-    - "<простір імен / проєкт>"
-"<no name set>":
-  translations:
-    - "<nenhum nome definido>"
-    - "<no name set>"
-    - "<未設定名稱>"
-    - "<nenhum nome definido>"
-    - "<no name set>"
-    - "<未设置名称>"
-    - "<ім’я не задане>"
-    - "<no name set>"
-    - "<sense nom establert>"
-    - "<no tiene el nombre establecido>"
-    - "<isim belirlenmemiş>"
-"<no scopes selected>":
-  translations:
-    - "<nenhum escopo selecionado>"
-    - "<スコープが選択されていません>"
-    - "<未選擇範圍>"
-    - "<nenhum escopo selecionado>"
-    - "<no scopes selected>"
-    - "<未选择范围>"
-    - "<область дії не вибрано>"
-    - "<keine Bereiche ausgewählt>"
-    - "<ningún alcance seleccionado>"
-    - "<hiçbir kapsam seçilmedi>"
-"<project name>":
-  translations:
-    - "<название проекта>"
-    - "<project name>"
-    - "<proje adı>"
-    - "<naziv projekta>"
-    - "<ім’я проєкту>"
-"AdminSettings|Elasticsearch, PlantUML, Slack application, Third party offers, Snowplow, Amazon EKS have moved to Settings > General.":
-  translations:
-    - "Elasticsearch、PlantUML、Slackアプリケーション、サードパーティのオファー、Snowplow、Amazon EKS は 設定 > 全般 に移動しました。"
-    - "Elasticsearch, PlantUML, приложение Slack, предложения от третьих лиц, Snowplow, Amazon EKS были перемещены в Настройки > Общие"
-    - "Elasticsearch, PlantUML, застосунок Slack, пропозиції від третіх осіб, Snowplow, Amazon EKS були переміщені до Налаштувань > Загальне."
-"cannot contain HTML/XML tags, including any word between angle brackets (<,>).":
-  translations:
 "<code>\\\"johnsmith@example.com\\\": \\\"@johnsmith\\\"</code> will add \\\"By <a href=\\\"#\\\">@johnsmith</a>\\\" to all issues and comments originally created by johnsmith@example.com, and will set <a href=\\\"#\\\">@johnsmith</a> as the assignee on all issues originally assigned to johnsmith@example.com.":
   plural_id:
   translations:
@@ -1053,3 +1009,47 @@
     - "아래 프로젝트 목록에서 <strong>프로젝트 이름</strong>을 눌러 프로젝트 마일스톤을 봅니다."
     - "Cliquez sur n’importe quel <strong>nom de projet</strong> dans la liste des projets ci‐dessous pour naviguer jusqu’au jalon du projet."
     - "Haga clic en cualquier <strong>nombre de proyecto</strong> en la lista de proyectos que se muestra a continuación para navegar hasta el hito de proyecto correspondiente."
+"<namespace / project>":
+  plural_id:
+  translations:
+    - "<namespace / project>"
+    - "<простір імен / проєкт>"
+"<no name set>":
+  translations:
+    - "<nenhum nome definido>"
+    - "<no name set>"
+    - "<未設定名稱>"
+    - "<nenhum nome definido>"
+    - "<no name set>"
+    - "<未设置名称>"
+    - "<ім’я не задане>"
+    - "<no name set>"
+    - "<sense nom establert>"
+    - "<no tiene el nombre establecido>"
+    - "<isim belirlenmemiş>"
+"<no scopes selected>":
+  translations:
+    - "<nenhum escopo selecionado>"
+    - "<スコープが選択されていません>"
+    - "<未選擇範圍>"
+    - "<nenhum escopo selecionado>"
+    - "<no scopes selected>"
+    - "<未选择范围>"
+    - "<область дії не вибрано>"
+    - "<keine Bereiche ausgewählt>"
+    - "<ningún alcance seleccionado>"
+    - "<hiçbir kapsam seçilmedi>"
+"<project name>":
+  translations:
+    - "<название проекта>"
+    - "<project name>"
+    - "<proje adı>"
+    - "<naziv projekta>"
+    - "<ім’я проєкту>"
+"AdminSettings|Elasticsearch, PlantUML, Slack application, Third party offers, Snowplow, Amazon EKS have moved to Settings > General.":
+  translations:
+    - "Elasticsearch、PlantUML、Slackアプリケーション、サードパーティのオファー、Snowplow、Amazon EKS は 設定 > 全般 に移動しました。"
+    - "Elasticsearch, PlantUML, приложение Slack, предложения от третьих лиц, Snowplow, Amazon EKS были перемещены в Настройки > Общие"
+    - "Elasticsearch, PlantUML, застосунок Slack, пропозиції від третіх осіб, Snowplow, Amazon EKS були переміщені до Налаштувань > Загальне."
+"cannot contain HTML/XML tags, including any word between angle brackets (<,>).":
+  translations:

locale/gitlab.pot

@@ -762,6 +762,15 @@ msgstr ""
 msgid "%{webhooks_link_start}%{webhook_type}%{link_end} enable you to send notifications to web applications in response to events in a group or project. We recommend using an %{integrations_link_start}integration%{link_end} in preference to a webhook."
 msgstr ""
 
+msgid "<no name set>"
+msgstr ""
+
+msgid "<no scopes selected>"
+msgstr ""
+
+msgid "<project name>"
+msgstr ""
+
 msgid "'%{level}' is not a valid visibility level"
 msgstr ""
 
@@ -1019,12 +1028,6 @@ msgstr ""
 msgid "<code>Protected</code> to expose them to protected branches or tags only."
 msgstr ""
 
-msgid "<no name set>"
-msgstr ""
-
-msgid "<no scopes selected>"
-msgstr ""
-
 msgid "<project name>"
 msgstr ""
 
@@ -1729,7 +1732,7 @@ msgstr ""
 msgid "AdminSettings|Auto DevOps domain"
 msgstr ""
 
-msgid "AdminSettings|Elasticsearch, PlantUML, Slack application, Third party offers, Snowplow, Amazon EKS have moved to Settings > General."
+msgid "AdminSettings|Elasticsearch, PlantUML, Slack application, Third party offers, Snowplow, Amazon EKS have moved to Settings &gt; General."
 msgstr ""
 
 msgid "AdminSettings|Enable shared runners for new projects"
@@ -10309,6 +10312,9 @@ msgstr ""
 msgid "FeatureFlags|Rollout Strategy"
 msgstr ""
 
+msgid "FeatureFlags|Set the Unleash client application name to the name of the environment your application runs in. This value is used to match environment scopes. See the %{linkStart}example client configuration%{linkEnd}."
+msgstr ""
+
 msgid "FeatureFlags|Status"
 msgstr ""
 
@@ -11281,7 +11287,7 @@ msgstr ""
 msgid "GitLabPages|%{domain} is not verified. To learn how to verify ownership, visit your %{link_start}domain details%{link_end}."
 msgstr ""
 
-msgid "GitLabPages|Access Control is enabled for this Pages website; only authorized users will be able to access it. To make your website publicly available, navigate to your project's %{strong_start}Settings > General > Visibility%{strong_end} and select %{strong_start}Everyone%{strong_end} in pages section. Read the %{link_start}documentation%{link_end} for more information."
+msgid "GitLabPages|Access Control is enabled for this Pages website; only authorized users will be able to access it. To make your website publicly available, navigate to your project's %{strong_start}Settings &gt; General &gt; Visibility%{strong_end} and select %{strong_start}Everyone%{strong_end} in pages section. Read the %{link_start}documentation%{link_end} for more information."
 msgstr ""
 
 msgid "GitLabPages|Access pages"
@@ -27869,7 +27875,7 @@ msgstr ""
 msgid "cannot block others"
 msgstr ""
 
-msgid "cannot contain HTML/XML tags, including any word between angle brackets (<,>)."
+msgid "cannot contain HTML/XML tags, including any word between angle brackets (&lt;,&gt;)."
 msgstr ""
 
 msgid "cannot include leading slash or directory traversal."

package.json

@@ -43,7 +43,7 @@
     "@babel/preset-env": "^7.10.1",
     "@gitlab/at.js": "1.5.5",
     "@gitlab/svgs": "1.153.0",
-    "@gitlab/ui": "17.35.2",
+    "@gitlab/ui": "17.36.2",
     "@gitlab/visual-review-tools": "1.6.1",
     "@rails/actioncable": "^6.0.3-1",
     "@sentry/browser": "^5.10.2",

qa/qa/page/project/issue/index.rb

@@ -5,8 +5,14 @@ module QA
     module Project
       module Issue
         class Index < Page::Base
-          view 'app/helpers/projects_helper.rb' do
+          view 'app/assets/javascripts/issuables_list/components/issuable.vue' do
+            element :issue_container
+            element :issue_link
+          end
+
+          view 'app/assets/javascripts/vue_shared/components/issue/issue_assignees.vue' do
             element :assignee_link
+            element :avatar_counter_content
           end
 
           view 'app/views/projects/issues/export_csv/_button.html.haml' do
@@ -23,21 +29,12 @@ module QA
             element :import_from_jira_link
           end
 
-          view 'app/views/projects/issues/_issue.html.haml' do
-            element :issue
-            element :issue_link, 'link_to issue.title' # rubocop:disable QA/ElementWithPattern
-          end
-
-          view 'app/views/shared/issuable/_assignees.html.haml' do
-            element :avatar_counter
-          end
-
           view 'app/views/shared/issuable/_nav.html.haml' do
             element :closed_issues_link
           end
 
           def avatar_counter
-            find_element(:avatar_counter)
+            find_element(:avatar_counter_content)
           end
 
           def click_issue_link(title)
@@ -80,7 +77,7 @@ module QA
           end
 
           def has_issue?(issue)
-            has_element? :issue, issue_title: issue.title
+            has_element? :issue_container, issue_title: issue.title
           end
         end
       end

qa/qa/service/docker_run/gitlab_runner.rb

@@ -92,7 +92,7 @@ module QA
           CMD
         end
 
-        # Ping CloudFlare DNS, should fail
+        # Ping Cloudflare DNS, should fail
         # Ping Registry, should fail to resolve
         def prove_airgap
           gitlab_ip = Resolv.getaddress 'registry.gitlab.com'

spec/models/user_spec.rb

@@ -241,6 +241,22 @@ RSpec.describe User do
       it { is_expected.to validate_length_of(:last_name).is_at_most(127) }
     end
 
+    describe 'preferred_language' do
+      context 'when its value is nil in the database' do
+        let(:user) { build(:user, preferred_language: nil) }
+
+        it 'falls back to I18n.default_locale when empty in the database' do
+          expect(user.preferred_language).to eq I18n.default_locale.to_s
+        end
+
+        it 'falls back to english when I18n.default_locale is not an available language' do
+          I18n.default_locale = :kl
+
+          expect(user.preferred_language).to eq 'en'
+        end
+      end
+    end
+
     describe 'username' do
       it 'validates presence' do
         expect(subject).to validate_presence_of(:username)

spec/requests/api/projects_spec.rb

@@ -386,6 +386,14 @@ RSpec.describe API::Projects do
           let(:current_user) { user }
           let(:projects) { [public_project, project, project2, project3].select { |p| p.id > project2.id } }
         end
+
+        context 'regression: empty string is ignored' do
+          it_behaves_like 'projects response' do
+            let(:filter) { { id_after: '' } }
+            let(:current_user) { user }
+            let(:projects) { [public_project, project, project2, project3] }
+          end
+        end
       end
 
       context 'and using id_before' do
@@ -394,6 +402,14 @@ RSpec.describe API::Projects do
           let(:current_user) { user }
           let(:projects) { [public_project, project, project2, project3].select { |p| p.id < project2.id } }
         end
+
+        context 'regression: empty string is ignored' do
+          it_behaves_like 'projects response' do
+            let(:filter) { { id_before: '' } }
+            let(:current_user) { user }
+            let(:projects) { [public_project, project, project2, project3] }
+          end
+        end
       end
 
       context 'and using both id_after and id_before' do

yarn.lock

@@ -848,10 +848,10 @@
   resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-1.153.0.tgz#79db0598382e6990d242f2e8dc0911903b1f558c"
   integrity sha512-9letemutba300jT8BgxmYjUjMGDJifFFulPBNT4bxT+U2Ki+X+xs57Il3o/FNv5feJOPAlYS8Z/aEII8145g1g==
 
-"@gitlab/ui@17.35.2":
+"@gitlab/ui@17.36.2":
-  version "17.35.2"
+  version "17.36.2"
-  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-17.35.2.tgz#5bbabf8723bbb96cd08bca14a0d0f5356bcddd64"
+  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-17.36.2.tgz#745a04357c631f28677bd37bc81433602b8cf71f"
-  integrity sha512-VsL8v9y8VzhM6AJ9fs+14/juBffKTLB0FRf9LKPXAUJOB3kpGnXfDNDVab6oqEA04OxoQTjxX33MIjn3ZNT1Iw==
+  integrity sha512-aO85RZYYMfWmTzhuGlSIZFSVaGYeOTMT6gmgr1UQrMnrgM7noxSh9An3byuZLbQSa7EuxjCQ2w7u2Au5WiIRKw==
   dependencies:
     "@babel/standalone" "^7.0.0"
     "@gitlab/vue-toasted" "^1.3.0"