From 6e7be08ca5d6fac981284e7b1383b320a03d3a5d Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Tue, 11 Oct 2022 18:09:43 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .../components/filter_sort/sort_dropdown.vue  |   6 +-
 .../javascripts/sidebar/mount_sidebar.js      |   2 +-
 .../vue_shared/components/markdown/header.vue |   1 +
 .../components/registry/registry_search.vue   |   5 ++
 app/helpers/form_helper.rb                    |  17 ++--
 app/helpers/wiki_helper.rb                    |   3 +-
 app/models/concerns/issuable.rb               |  15 ++++
 app/models/merge_request.rb                   |  14 +--
 app/models/project.rb                         |   5 ++
 .../update_assignees_service.rb               |  12 ++-
 app/services/notes/create_service.rb          |  38 ++++++--
 .../cleanup_tags_service.rb                   |   3 +-
 .../issuable/_sidebar_assignees.html.haml     |   2 +-
 .../issuable/_sidebar_reviewers.html.haml     |   2 +-
 ...e.yml => limit_assignees_per_issuable.yml} |   8 +-
 config/metrics/aggregates/common.yml          |  62 -------------
 ...nagement_incidents_total_unique_counts.yml |  17 ++++
 .../counts_28d/20220222215951_xmau_plan.yml   |   9 ++
 ...20220222215952_xmau_project_management.yml |   9 ++
 .../20220222215955_users_work_items.yml       |   9 ++
 ...nagement_incidents_total_unique_counts.yml |  17 ++++
 .../counts_7d/20220222215851_xmau_plan.yml    |  11 ++-
 ...20220222215852_xmau_project_management.yml |   9 ++
 .../20220222215855_users_work_items.yml       |   9 ++
 config/sidekiq_queues.yml                     |   2 +
 doc/api/graphql/reference/index.md            |   1 +
 doc/api/group_protected_environments.md       |   4 +-
 .../blueprints/rate_limiting/index.md         |   2 +-
 doc/ci/environments/protected_environments.md |   6 +-
 doc/development/pipelines.md                  |   5 ++
 doc/development/sec/index.md                  |   2 +-
 .../end_to_end/beginners_guide.md             |  28 ++++--
 ...lue_stream_analytics_aggregated_backend.md |   4 +-
 doc/development/work_items.md                 |   4 +-
 doc/subscriptions/gitlab_dedicated/index.md   |   4 +-
 .../get-started-security.md                   |   2 +-
 .../img/secure_tools_and_cicd_stages.png      | Bin 0 -> 42240 bytes
 doc/user/application_security/index.md        |  24 ++++-
 .../policies/scan-execution-policies.md       |   8 +-
 doc/user/group/import/index.md                |   2 +-
 doc/user/group/saml_sso/scim_setup.md         |   2 +-
 .../group/settings/group_access_tokens.md     |   2 +-
 doc/user/group/subgroups/index.md             |   2 +-
 doc/user/workspace/index.md                   |   2 +-
 .../work_items_activity_aggregated_metric.rb  |  13 +++
 lib/tasks/gitlab/tw/codeowners.rake           |   3 +-
 qa/qa/page/base.rb                            |   5 ++
 qa/qa/page/component/namespace_select.rb      |   2 +-
 qa/qa/page/merge_request/new.rb               |   1 -
 qa/qa/page/merge_request/show.rb              |   5 +-
 ...er_interacts_with_batched_mr_diffs_spec.rb |   4 +-
 .../filter_sort/sort_dropdown_spec.js         |   2 +-
 spec/helpers/form_helper_spec.rb              |  72 ++++++++++++---
 spec/helpers/wiki_helper_spec.rb              |  18 ++--
 ...k_items_activity_aggregated_metric_spec.rb |  54 +++++++++++
 spec/models/concerns/issuable_spec.rb         |  18 ++++
 spec/models/project_spec.rb                   |  16 ++++
 .../update_assignees_service_spec.rb          |  26 +++---
 .../cleanup_tags_service_spec.rb              |   8 --
 .../issuable/max_issuable_examples.rb         |  85 ++++++++++++++++++
 workhorse/go.mod                              |   2 +-
 workhorse/go.sum                              |   4 +-
 62 files changed, 552 insertions(+), 177 deletions(-)
 rename config/feature_flags/development/{container_registry_new_cleanup_service.yml => limit_assignees_per_issuable.yml} (67%)
 delete mode 100644 config/metrics/aggregates/common.yml
 create mode 100644 doc/user/application_security/img/secure_tools_and_cicd_stages.png
 create mode 100644 lib/gitlab/usage/metrics/instrumentations/work_items_activity_aggregated_metric.rb
 create mode 100644 spec/lib/gitlab/usage/metrics/instrumentations/work_items_activity_aggregated_metric_spec.rb
 create mode 100644 spec/support/shared_examples/quick_actions/issuable/max_issuable_examples.rb

diff --git a/app/assets/javascripts/members/components/filter_sort/sort_dropdown.vue b/app/assets/javascripts/members/components/filter_sort/sort_dropdown.vue
index ce28283ccdf..01f145e0862 100644
--- a/app/assets/javascripts/members/components/filter_sort/sort_dropdown.vue
+++ b/app/assets/javascripts/members/components/filter_sort/sort_dropdown.vue
@@ -4,6 +4,7 @@ import { mapState } from 'vuex';
 import { visitUrl } from '~/lib/utils/url_utility';
 import { FIELDS } from '~/members/constants';
 import { parseSortParam, buildSortHref } from '~/members/utils';
+import { SORT_DIRECTION_UI } from '~/search/sort/constants';
 
 export default {
   name: 'SortDropdown',
@@ -30,6 +31,9 @@ export default {
     isAscending() {
       return !this.sort.sortDesc;
     },
+    sortDirectionData() {
+      return this.isAscending ? SORT_DIRECTION_UI.asc : SORT_DIRECTION_UI.desc;
+    },
     filteredOptions() {
       return FIELDS.filter(
         (field) => this.tableSortableFields.includes(field.key) && field.sort,
@@ -70,7 +74,7 @@ export default {
     data-testid="members-sort-dropdown"
     :text="activeOptionLabel"
     :is-ascending="isAscending"
-    :sort-direction-tool-tip="__('Sort direction')"
+    :sort-direction-tool-tip="sortDirectionData.tooltip"
     @sortDirectionChange="handleSortDirectionChange"
   >
     <gl-sorting-item
diff --git a/app/assets/javascripts/sidebar/mount_sidebar.js b/app/assets/javascripts/sidebar/mount_sidebar.js
index 1cb3c30b9e0..9b5bad710dd 100644
--- a/app/assets/javascripts/sidebar/mount_sidebar.js
+++ b/app/assets/javascripts/sidebar/mount_sidebar.js
@@ -161,7 +161,7 @@ function mountAssigneesComponent() {
           fullPath,
           issuableType,
           issuableId: id,
-          allowMultipleAssignees: !el.dataset.maxAssignees,
+          allowMultipleAssignees: !el.dataset.maxAssignees || el.dataset.maxAssignees > 1,
           editable,
         },
         scopedSlots: {
diff --git a/app/assets/javascripts/vue_shared/components/markdown/header.vue b/app/assets/javascripts/vue_shared/components/markdown/header.vue
index 6019412b688..89fffdedbfd 100644
--- a/app/assets/javascripts/vue_shared/components/markdown/header.vue
+++ b/app/assets/javascripts/vue_shared/components/markdown/header.vue
@@ -243,6 +243,7 @@ export default {
                 variant="confirm"
                 category="primary"
                 size="small"
+                data-qa-selector="dismiss_suggestion_popover_button"
                 @click="handleSuggestDismissed"
               >
                 {{ __('Got it') }}
diff --git a/app/assets/javascripts/vue_shared/components/registry/registry_search.vue b/app/assets/javascripts/vue_shared/components/registry/registry_search.vue
index 1948a6778f4..8c9c7c63db1 100644
--- a/app/assets/javascripts/vue_shared/components/registry/registry_search.vue
+++ b/app/assets/javascripts/vue_shared/components/registry/registry_search.vue
@@ -1,6 +1,7 @@
 <script>
 import { GlSorting, GlSortingItem, GlFilteredSearch } from '@gitlab/ui';
 import { FILTERED_SEARCH_TERM } from '~/packages_and_registries/shared/constants';
+import { SORT_DIRECTION_UI } from '~/search/sort/constants';
 
 const ASCENDING_ORDER = 'asc';
 const DESCENDING_ORDER = 'desc';
@@ -52,6 +53,9 @@ export default {
         return acc;
       }, {});
     },
+    sortDirectionData() {
+      return this.isSortAscending ? SORT_DIRECTION_UI.asc : SORT_DIRECTION_UI.desc;
+    },
   },
   methods: {
     generateQueryData({ sorting = {}, filter = [] } = {}) {
@@ -119,6 +123,7 @@ export default {
       data-testid="registry-sort-dropdown"
       :text="sortText"
       :is-ascending="isSortAscending"
+      :sort-direction-tool-tip="sortDirectionData.tooltip"
       @sortDirectionChange="onDirectionChange"
     >
       <gl-sorting-item
diff --git a/app/helpers/form_helper.rb b/app/helpers/form_helper.rb
index e8539f5997e..9e42aeea9ce 100644
--- a/app/helpers/form_helper.rb
+++ b/app/helpers/form_helper.rb
@@ -39,13 +39,13 @@ module FormHelper
     end
   end
 
-  def dropdown_max_select(data)
-    return data[:'max-select'] unless Feature.enabled?(:limit_reviewer_and_assignee_size)
+  def dropdown_max_select(data, feature_flag)
+    return data[:'max-select'] unless Feature.enabled?(feature_flag)
 
-    if data[:'max-select'] && data[:'max-select'] < MergeRequest::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS
+    if data[:'max-select'] && data[:'max-select'] < ::Issuable::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS
       data[:'max-select']
     else
-      MergeRequest::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS
+      ::Issuable::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS
     end
   end
 
@@ -162,7 +162,12 @@ module FormHelper
 
     new_options[:title] = _('Select assignee(s)')
     new_options[:data][:'dropdown-header'] = 'Assignee(s)'
-    new_options[:data].delete(:'max-select')
+
+    if Feature.enabled?(:limit_assignees_per_issuable)
+      new_options[:data][:'max-select'] = ::Issuable::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS
+    else
+      new_options[:data].delete(:'max-select')
+    end
 
     new_options
   end
@@ -174,7 +179,7 @@ module FormHelper
     new_options[:data][:'dropdown-header'] = _('Reviewer(s)')
 
     if Feature.enabled?(:limit_reviewer_and_assignee_size)
-      new_options[:data][:'max-select'] = MergeRequest::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS
+      new_options[:data][:'max-select'] = ::Issuable::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS
     else
       new_options[:data].delete(:'max-select')
     end
diff --git a/app/helpers/wiki_helper.rb b/app/helpers/wiki_helper.rb
index c42e3a5ff99..bded1b3a566 100644
--- a/app/helpers/wiki_helper.rb
+++ b/app/helpers/wiki_helper.rb
@@ -64,12 +64,13 @@ module WikiHelper
     link_class = 'gl-button btn btn-default btn-icon has-tooltip reverse-sort-btn qa-reverse-sort rspec-reverse-sort'
     reversed_direction = direction == 'desc' ? 'asc' : 'desc'
     icon_class = direction == 'desc' ? 'highest' : 'lowest'
+    title = direction == 'desc' ? _('Sort direction: Descending') : _('Sort direction: Ascending')
 
     link_options = { action: :pages, direction: reversed_direction }
     link_options[:sort] = sort unless wiki.disable_sorting?
 
     link_to(wiki_path(wiki, **link_options),
-      type: 'button', class: link_class, title: _('Sort direction')) do
+      type: 'button', class: link_class, title: title) do
       sprite_icon("sort-#{icon_class}")
     end
   end
diff --git a/app/models/concerns/issuable.rb b/app/models/concerns/issuable.rb
index 3a362f75c9c..f8389865f91 100644
--- a/app/models/concerns/issuable.rb
+++ b/app/models/concerns/issuable.rb
@@ -33,6 +33,7 @@ module Issuable
   DESCRIPTION_LENGTH_MAX = 1.megabyte
   DESCRIPTION_HTML_LENGTH_MAX = 5.megabytes
   SEARCHABLE_FIELDS = %w(title description).freeze
+  MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS = 200
 
   STATE_ID_MAP = {
     opened: 1,
@@ -95,6 +96,7 @@ module Issuable
     # to avoid breaking the existing Issuables which may have their descriptions longer
     validates :description, length: { maximum: DESCRIPTION_LENGTH_MAX }, allow_blank: true, on: :create
     validate :description_max_length_for_new_records_is_valid, on: :update
+    validate :validate_assignee_size_length, unless: :importing?
 
     before_validation :truncate_description_on_import!
 
@@ -166,6 +168,11 @@ module Issuable
       def locking_enabled?
         false
       end
+
+      def max_number_of_assignees_or_reviewers_message
+        # Assignees will be included in https://gitlab.com/gitlab-org/gitlab/-/issues/368936
+        format(_("total must be less than or equal to %{size}"), size: MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS)
+      end
     end
 
     # We want to use optimistic lock for cases when only title or description are involved
@@ -227,6 +234,14 @@ module Issuable
     def truncate_description_on_import!
       self.description = description&.slice(0, Issuable::DESCRIPTION_LENGTH_MAX) if importing?
     end
+
+    def validate_assignee_size_length
+      return true unless Feature.enabled?(:limit_assignees_per_issuable)
+      return true unless assignees.size > MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS
+
+      errors.add :assignees,
+        -> (_object, _data) { self.class.max_number_of_assignees_or_reviewers_message }
+    end
   end
 
   class_methods do
diff --git a/app/models/merge_request.rb b/app/models/merge_request.rb
index ec791f91a3e..a3c1ef8bd79 100644
--- a/app/models/merge_request.rb
+++ b/app/models/merge_request.rb
@@ -41,8 +41,6 @@ class MergeRequest < ApplicationRecord
     'Ci::CompareCodequalityReportsService' => ->(project) { true }
   }.freeze
 
-  MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS = 200
-
   belongs_to :target_project, class_name: "Project"
   belongs_to :source_project, class_name: "Project"
   belongs_to :merge_user, class_name: "User"
@@ -294,7 +292,7 @@ class MergeRequest < ApplicationRecord
   validate :validate_branches, unless: [:allow_broken, :importing?, :closed_or_merged_without_fork?]
   validate :validate_fork, unless: :closed_or_merged_without_fork?
   validate :validate_target_project, on: :create
-  validate :validate_reviewer_and_assignee_size_length, unless: :importing?
+  validate :validate_reviewer_size_length, unless: :importing?
 
   scope :by_source_or_target_branch, ->(branch_name) do
     where("source_branch = :branch OR target_branch = :branch", branch: branch_name)
@@ -1014,18 +1012,12 @@ class MergeRequest < ApplicationRecord
                'Source project is not a fork of the target project'
   end
 
-  def self.max_number_of_assignees_or_reviewers_message
-    # Assignees will be included in https://gitlab.com/gitlab-org/gitlab/-/issues/368936
-    _("total must be less than or equal to %{size}") % { size: MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS }
-  end
-
-  def validate_reviewer_and_assignee_size_length
-    # Assigness will be added in a subsequent MR https://gitlab.com/gitlab-org/gitlab/-/issues/368936
+  def validate_reviewer_size_length
     return true unless Feature.enabled?(:limit_reviewer_and_assignee_size)
     return true unless reviewers.size > MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS
 
     errors.add :reviewers,
-      -> (_object, _data) { MergeRequest.max_number_of_assignees_or_reviewers_message }
+      -> (_object, _data) { self.class.max_number_of_assignees_or_reviewers_message }
   end
 
   def merge_ongoing?
diff --git a/app/models/project.rb b/app/models/project.rb
index 3d026351b4f..e6cc4d228f7 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -3039,6 +3039,11 @@ class Project < ApplicationRecord
     pages_domains.count < Gitlab::CurrentSettings.max_pages_custom_domains_per_project
   end
 
+  # overridden in EE
+  def can_suggest_reviewers?
+    false
+  end
+
   # overridden in EE
   def suggested_reviewers_available?
     false
diff --git a/app/services/merge_requests/update_assignees_service.rb b/app/services/merge_requests/update_assignees_service.rb
index a13db52e34b..79a3e9f3c22 100644
--- a/app/services/merge_requests/update_assignees_service.rb
+++ b/app/services/merge_requests/update_assignees_service.rb
@@ -18,7 +18,17 @@ module MergeRequests
       return merge_request if old_ids.to_set == new_ids.to_set # no-change
 
       attrs = update_attrs.merge(assignee_ids: new_ids)
-      merge_request.update!(**attrs)
+
+      # We now have assignees validation on merge request
+      # If we use an update with bang, it will explode,
+      # instead we need to check if its valid then return if its not valid.
+      if Feature.enabled?(:limit_assignees_per_issuable)
+        merge_request.update(**attrs)
+
+        return merge_request unless merge_request.valid?
+      else
+        merge_request.update!(**attrs)
+      end
 
       # Defer the more expensive operations (handle_assignee_changes) to the background
       MergeRequests::HandleAssigneesChangeService
diff --git a/app/services/notes/create_service.rb b/app/services/notes/create_service.rb
index b7e6a50fa5c..1aaf7fb769a 100644
--- a/app/services/notes/create_service.rb
+++ b/app/services/notes/create_service.rb
@@ -88,12 +88,14 @@ module Notes
       return if quick_actions_service.commands_executed_count.to_i == 0
 
       if update_params.present?
-        if check_for_reviewer_validity(message, update_params)
+        invalid_message = validate_commands(note, update_params)
+
+        if invalid_message
+          note.errors.add(:validation, invalid_message)
+          message = invalid_message
+        else
           quick_actions_service.apply_updates(update_params, note)
           note.commands_changes = update_params
-        else
-          message = "Reviewers #{MergeRequest.max_number_of_assignees_or_reviewers_message}"
-          note.errors.add(:validation, message)
         end
       end
 
@@ -114,16 +116,36 @@ module Notes
       }
     end
 
-    def check_for_reviewer_validity(message, update_params)
-      return true unless Feature.enabled?(:limit_reviewer_and_assignee_size)
+    def validate_commands(note, update_params)
+      if invalid_reviewers?(update_params)
+        "Reviewers #{note.noteable.class.max_number_of_assignees_or_reviewers_message}"
+      elsif invalid_assignees?(update_params)
+        "Assignees #{note.noteable.class.max_number_of_assignees_or_reviewers_message}"
+      end
+    end
+
+    def invalid_reviewers?(update_params)
+      return false unless Feature.enabled?(:limit_reviewer_and_assignee_size)
 
       if update_params.key?(:reviewer_ids)
         possible_reviewers = update_params[:reviewer_ids]&.uniq&.size
 
-        return false if possible_reviewers > MergeRequest::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS
+        possible_reviewers > ::Issuable::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS
+      else
+        false
       end
+    end
 
-      true
+    def invalid_assignees?(update_params)
+      return false unless Feature.enabled?(:limit_assignees_per_issuable)
+
+      if update_params.key?(:assignee_ids)
+        possible_assignees = update_params[:assignee_ids]&.uniq&.size
+
+        possible_assignees > ::Issuable::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS
+      else
+        false
+      end
     end
 
     def track_event(note, user)
diff --git a/app/services/projects/container_repository/cleanup_tags_service.rb b/app/services/projects/container_repository/cleanup_tags_service.rb
index 0b31ac0c877..cf2eb81e5f3 100644
--- a/app/services/projects/container_repository/cleanup_tags_service.rb
+++ b/app/services/projects/container_repository/cleanup_tags_service.rb
@@ -30,8 +30,7 @@ module Projects
       end
 
       def use_gitlab_service?
-        Feature.enabled?(:container_registry_new_cleanup_service, project) &&
-          container_repository.migrated? &&
+        container_repository.migrated? &&
           container_repository.gitlab_api_client.supports_gitlab_api?
       end
 
diff --git a/app/views/shared/issuable/_sidebar_assignees.html.haml b/app/views/shared/issuable/_sidebar_assignees.html.haml
index e9b04579808..62221fb8218 100644
--- a/app/views/shared/issuable/_sidebar_assignees.html.haml
+++ b/app/views/shared/issuable/_sidebar_assignees.html.haml
@@ -39,7 +39,7 @@
   - data[:multi_select] = true
   - data['dropdown-title'] = title
   - data['dropdown-header'] = dropdown_options[:data][:'dropdown-header']
-  - data['max-select'] = dropdown_options[:data][:'max-select'] if dropdown_options[:data][:'max-select']
+  - data['max-select'] = dropdown_max_select(dropdown_options[:data], :limit_assignees_per_issuable)
   - options[:data].merge!(data)
 
   = render 'shared/issuable/sidebar_user_dropdown',
diff --git a/app/views/shared/issuable/_sidebar_reviewers.html.haml b/app/views/shared/issuable/_sidebar_reviewers.html.haml
index 89efd5c11d1..771db8af6a8 100644
--- a/app/views/shared/issuable/_sidebar_reviewers.html.haml
+++ b/app/views/shared/issuable/_sidebar_reviewers.html.haml
@@ -39,7 +39,7 @@
   - data[:suggested_reviewers_header] = dropdown_options[:data][:suggested_reviewers_header]
   - data[:all_members_header] = dropdown_options[:data][:all_members_header]
   - data[:show_suggested] = dropdown_options[:data][:show_suggested]
-  - data['max-select'] = dropdown_max_select(dropdown_options[:data])
+  - data['max-select'] = dropdown_max_select(dropdown_options[:data], :limit_reviewer_and_assignee_size)
   - options[:data].merge!(data)
 
   = render 'shared/issuable/sidebar_user_dropdown',
diff --git a/config/feature_flags/development/container_registry_new_cleanup_service.yml b/config/feature_flags/development/limit_assignees_per_issuable.yml
similarity index 67%
rename from config/feature_flags/development/container_registry_new_cleanup_service.yml
rename to config/feature_flags/development/limit_assignees_per_issuable.yml
index 0826abbf994..d950b8c2f09 100644
--- a/config/feature_flags/development/container_registry_new_cleanup_service.yml
+++ b/config/feature_flags/development/limit_assignees_per_issuable.yml
@@ -1,8 +1,8 @@
 ---
-name: container_registry_new_cleanup_service
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/98651
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/375037
+name: limit_assignees_per_issuable
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/95673
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/373237
 milestone: '15.5'
 type: development
-group: group::package
+group: group::code review
 default_enabled: false
diff --git a/config/metrics/aggregates/common.yml b/config/metrics/aggregates/common.yml
deleted file mode 100644
index ca6c664a6e9..00000000000
--- a/config/metrics/aggregates/common.yml
+++ /dev/null
@@ -1,62 +0,0 @@
-# Aggregated metrics that include EE only event names within `events:` attribute have to be defined at ee/config/metrics/aggregates/common.yml
-# instead of this file.
-# - name: unique name of aggregated metric
-#  operator: aggregation operator. Valid values are:
-#             - "OR": counts unique elements that were observed triggering any of following events
-#             - "AND": counts unique elements that were observed triggering all of following events
-#  events: list of events names to aggregate into metric. All events in this list must have the same 'redis_slot' and 'aggregation' attributes
-#           see from lib/gitlab/usage_data_counters/known_events/ for the list of valid events.
-#  source: defines which datasource will be used to locate events that should be included in aggregated metric. Valid values are:
-#          - database
-#          - redis
-#  time_frame: defines time frames for aggregated metrics:
-#          - 7d - last 7 days
-#          - 28d - last 28 days
-#          - all - all historical available data, this time frame is not available for redis source
-#  feature_flag: name of development feature flag that will be checked before metrics aggregation is performed.
-#                Corresponding feature flag should have `default_enabled` attribute set to `false`.
-#                This attribute is OPTIONAL and can be omitted, when `feature_flag` is missing no feature flag will be checked.
----
-- name: incident_management_incidents_total_unique_counts
-  operator: OR
-  source: redis
-  time_frame: [7d, 28d]
-  events:
-    - 'incident_management_incident_created'
-    - 'incident_management_incident_reopened'
-    - 'incident_management_incident_closed'
-    - 'incident_management_incident_assigned'
-    - 'incident_management_incident_todo'
-    - 'incident_management_incident_comment'
-    - 'incident_management_incident_zoom_meeting'
-    - 'incident_management_incident_published'
-    - 'incident_management_incident_relate'
-    - 'incident_management_incident_unrelate'
-    - 'incident_management_incident_change_confidential'
-- name: xmau_plan
-  operator: OR
-  source: redis
-  time_frame: [7d, 28d]
-  events:
-    - users_creating_work_items
-    - users_updating_work_item_title
-    - users_updating_work_item_dates
-  feature_flag: track_work_items_activity
-- name: xmau_project_management
-  operator: OR
-  source: redis
-  time_frame: [7d, 28d]
-  events:
-    - users_creating_work_items
-    - users_updating_work_item_title
-    - users_updating_work_item_dates
-  feature_flag: track_work_items_activity
-- name: users_work_items
-  operator: OR
-  source: redis
-  time_frame: [7d, 28d]
-  events:
-    - users_creating_work_items
-    - users_updating_work_item_title
-    - users_updating_work_item_dates
-  feature_flag: track_work_items_activity
diff --git a/config/metrics/counts_28d/20210216180511_incident_management_incidents_total_unique_counts.yml b/config/metrics/counts_28d/20210216180511_incident_management_incidents_total_unique_counts.yml
index 3174894384a..b5afcfa7ae6 100644
--- a/config/metrics/counts_28d/20210216180511_incident_management_incidents_total_unique_counts.yml
+++ b/config/metrics/counts_28d/20210216180511_incident_management_incidents_total_unique_counts.yml
@@ -9,7 +9,24 @@ product_category: incident_management
 value_type: number
 status: active
 time_frame: 28d
+instrumentation_class: AggregatedMetric
 data_source: redis_hll
+options:
+  aggregate:
+    operator: OR
+    attribute: user_id
+  events:
+    - 'incident_management_incident_created'
+    - 'incident_management_incident_reopened'
+    - 'incident_management_incident_closed'
+    - 'incident_management_incident_assigned'
+    - 'incident_management_incident_todo'
+    - 'incident_management_incident_comment'
+    - 'incident_management_incident_zoom_meeting'
+    - 'incident_management_incident_published'
+    - 'incident_management_incident_relate'
+    - 'incident_management_incident_unrelate'
+    - 'incident_management_incident_change_confidential'
 distribution:
 - ce
 - ee
diff --git a/config/metrics/counts_28d/20220222215951_xmau_plan.yml b/config/metrics/counts_28d/20220222215951_xmau_plan.yml
index aaa9558d5a6..9498c56e06f 100644
--- a/config/metrics/counts_28d/20220222215951_xmau_plan.yml
+++ b/config/metrics/counts_28d/20220222215951_xmau_plan.yml
@@ -10,7 +10,16 @@ status: active
 milestone: '14.9'
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/81336
 time_frame: 28d
+instrumentation_class: WorkItemsActivityAggregatedMetric
 data_source: redis_hll
+options:
+  aggregate:
+    operator: OR
+    attribute: user_id
+  events:
+    - users_creating_work_items
+    - users_updating_work_item_title
+    - users_updating_work_item_dates
 data_category: optional
 distribution:
 - ce
diff --git a/config/metrics/counts_28d/20220222215952_xmau_project_management.yml b/config/metrics/counts_28d/20220222215952_xmau_project_management.yml
index ede46c85292..a02616e06ce 100644
--- a/config/metrics/counts_28d/20220222215952_xmau_project_management.yml
+++ b/config/metrics/counts_28d/20220222215952_xmau_project_management.yml
@@ -10,7 +10,16 @@ status: active
 milestone: '14.9'
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/81336
 time_frame: 28d
+instrumentation_class: WorkItemsActivityAggregatedMetric
 data_source: redis_hll
+options:
+  aggregate:
+    operator: OR
+    attribute: user_id
+  events:
+    - users_creating_work_items
+    - users_updating_work_item_title
+    - users_updating_work_item_dates
 data_category: optional
 distribution:
 - ce
diff --git a/config/metrics/counts_28d/20220222215955_users_work_items.yml b/config/metrics/counts_28d/20220222215955_users_work_items.yml
index a0f892fcef2..3e6103a6dfd 100644
--- a/config/metrics/counts_28d/20220222215955_users_work_items.yml
+++ b/config/metrics/counts_28d/20220222215955_users_work_items.yml
@@ -10,7 +10,16 @@ status: active
 milestone: '14.9'
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/81336
 time_frame: 28d
+instrumentation_class: WorkItemsActivityAggregatedMetric
 data_source: redis_hll
+options:
+  aggregate:
+    operator: OR
+    attribute: user_id
+  events:
+    - users_creating_work_items
+    - users_updating_work_item_title
+    - users_updating_work_item_dates
 data_category: optional
 distribution:
 - ce
diff --git a/config/metrics/counts_7d/20210216180515_incident_management_incidents_total_unique_counts.yml b/config/metrics/counts_7d/20210216180515_incident_management_incidents_total_unique_counts.yml
index 6089b36401e..93228309855 100644
--- a/config/metrics/counts_7d/20210216180515_incident_management_incidents_total_unique_counts.yml
+++ b/config/metrics/counts_7d/20210216180515_incident_management_incidents_total_unique_counts.yml
@@ -9,7 +9,24 @@ product_category: incident_management
 value_type: number
 status: active
 time_frame: 7d
+instrumentation_class: AggregatedMetric
 data_source: redis_hll
+options:
+  aggregate:
+    operator: OR
+    attribute: user_id
+  events:
+    - 'incident_management_incident_created'
+    - 'incident_management_incident_reopened'
+    - 'incident_management_incident_closed'
+    - 'incident_management_incident_assigned'
+    - 'incident_management_incident_todo'
+    - 'incident_management_incident_comment'
+    - 'incident_management_incident_zoom_meeting'
+    - 'incident_management_incident_published'
+    - 'incident_management_incident_relate'
+    - 'incident_management_incident_unrelate'
+    - 'incident_management_incident_change_confidential'
 distribution:
 - ce
 - ee
diff --git a/config/metrics/counts_7d/20220222215851_xmau_plan.yml b/config/metrics/counts_7d/20220222215851_xmau_plan.yml
index 170b1c595de..ebeaa6e5060 100644
--- a/config/metrics/counts_7d/20220222215851_xmau_plan.yml
+++ b/config/metrics/counts_7d/20220222215851_xmau_plan.yml
@@ -9,8 +9,17 @@ value_type: number
 status: active
 milestone: '14.9'
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/81336
-time_frame: 7d
+instrumentation_class: WorkItemsActivityAggregatedMetric
 data_source: redis_hll
+time_frame: 7d
+options:
+  aggregate:
+    operator: OR
+    attribute: user_id
+  events:
+    - users_creating_work_items
+    - users_updating_work_item_title
+    - users_updating_work_item_dates
 data_category: optional
 distribution:
 - ce
diff --git a/config/metrics/counts_7d/20220222215852_xmau_project_management.yml b/config/metrics/counts_7d/20220222215852_xmau_project_management.yml
index 061ee13722b..13f35df6530 100644
--- a/config/metrics/counts_7d/20220222215852_xmau_project_management.yml
+++ b/config/metrics/counts_7d/20220222215852_xmau_project_management.yml
@@ -10,7 +10,16 @@ status: active
 milestone: '14.9'
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/81336
 time_frame: 7d
+instrumentation_class: WorkItemsActivityAggregatedMetric
 data_source: redis_hll
+options:
+  aggregate:
+    operator: OR
+    attribute: user_id
+  events:
+    - users_creating_work_items
+    - users_updating_work_item_title
+    - users_updating_work_item_dates
 data_category: optional
 distribution:
 - ce
diff --git a/config/metrics/counts_7d/20220222215855_users_work_items.yml b/config/metrics/counts_7d/20220222215855_users_work_items.yml
index b749a7c9430..fec786715b7 100644
--- a/config/metrics/counts_7d/20220222215855_users_work_items.yml
+++ b/config/metrics/counts_7d/20220222215855_users_work_items.yml
@@ -10,7 +10,16 @@ status: active
 milestone: '14.9'
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/81336
 time_frame: 7d
+instrumentation_class: WorkItemsActivityAggregatedMetric
 data_source: redis_hll
+options:
+  aggregate:
+    operator: OR
+    attribute: user_id
+  events:
+    - users_creating_work_items
+    - users_updating_work_item_title
+    - users_updating_work_item_dates
 data_category: optional
 distribution:
 - ce
diff --git a/config/sidekiq_queues.yml b/config/sidekiq_queues.yml
index b1da557014a..04d0b35cc71 100644
--- a/config/sidekiq_queues.yml
+++ b/config/sidekiq_queues.yml
@@ -409,6 +409,8 @@
   - 1
 - - projects_refresh_build_artifacts_size_statistics
   - 1
+- - projects_register_suggested_reviewers_project
+  - 1
 - - projects_schedule_bulk_repository_shard_moves
   - 1
 - - projects_update_repository_storage
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index bd9905ca652..1dda66a2e43 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -2891,6 +2891,7 @@ Input type: `GitlabSubscriptionActivateInput`
 | ---- | ---- | ----------- |
 | <a id="mutationgitlabsubscriptionactivateclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
 | <a id="mutationgitlabsubscriptionactivateerrors"></a>`errors` | [`[String!]!`](#string) | Errors encountered during execution of the mutation. |
+| <a id="mutationgitlabsubscriptionactivatefuturesubscriptions"></a>`futureSubscriptions` | [`[SubscriptionFutureEntry!]`](#subscriptionfutureentry) | Array of future subscriptions. |
 | <a id="mutationgitlabsubscriptionactivatelicense"></a>`license` | [`CurrentLicense`](#currentlicense) | Current license. |
 
 ### `Mutation.groupUpdate`
diff --git a/doc/api/group_protected_environments.md b/doc/api/group_protected_environments.md
index d160ce2c6d5..4cf87cb4305 100644
--- a/doc/api/group_protected_environments.md
+++ b/doc/api/group_protected_environments.md
@@ -112,7 +112,7 @@ POST /groups/:id/protected_environments
 | `approval_rules`                | array          | no  | Array of access levels allowed to approve, with each described by a hash. One of `user_id`, `group_id` or `access_level`. They take the form of `{user_id: integer}`, `{group_id: integer}` or `{access_level: integer}` respectively. You can also specify the number of required approvals from the specified entity with `required_approvals` field. See [Multiple approval rules](../ci/environments/deployment_approvals.md#multiple-approval-rules) for more information. |
 
 The assignable `user_id` are the users who belong to the given group with the Maintainer role (or above).
-The assignable `group_id` are the sub-groups under the given group.
+The assignable `group_id` are the subgroups under the given group.
 
 ```shell
 curl --header 'Content-Type: application/json' --request POST --data '{"name": "production", "deploy_access_levels": [{"group_id": 9899826}]}' --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/groups/22034114/protected_environments"
@@ -157,7 +157,7 @@ PUT /groups/:id/protected_environments/:name
 To update:
 
 - **`user_id`**: Ensure the updated user belongs to the given group with the Maintainer role (or above). You must also pass the `id` of either a `deploy_access_level` or `approval_rule` in the respective hash.
-- **`group_id`**: Ensure the updated group is a sub-group of the group this protected environment belongs to. You must also pass the `id` of either a `deploy_access_level` or `approval_rule` in the respective hash.
+- **`group_id`**: Ensure the updated group is a subgroup of the group this protected environment belongs to. You must also pass the `id` of either a `deploy_access_level` or `approval_rule` in the respective hash.
 
 To delete:
 
diff --git a/doc/architecture/blueprints/rate_limiting/index.md b/doc/architecture/blueprints/rate_limiting/index.md
index 9f7ec278133..2ed66f22b53 100644
--- a/doc/architecture/blueprints/rate_limiting/index.md
+++ b/doc/architecture/blueprints/rate_limiting/index.md
@@ -65,7 +65,7 @@ Inc._
 - There is no way to automatically notify a user when they are approaching thresholds.
 - There is no single way to change limits for a namespace / project / user / customer.
 - There is no single way to monitor limits through real-time metrics.
-- There is no framework for hierarchical limit configuration (instance / namespace / sub-group / project).
+- There is no framework for hierarchical limit configuration (instance / namespace / subgroup / project).
 - We allow disabling rate-limiting for some marquee SaaS customers, but this
   increases a risk for those same customers. We should instead be able to set
   higher limits.
diff --git a/doc/ci/environments/protected_environments.md b/doc/ci/environments/protected_environments.md
index f7e64ab426b..c19e4e5a140 100644
--- a/doc/ci/environments/protected_environments.md
+++ b/doc/ci/environments/protected_environments.md
@@ -26,7 +26,7 @@ Maintainer role.
 
 Prerequisites:
 
-- When granting the **Allowed to deploy** permission to a group or sub-group, the user configuring the protected environment must be a **direct member** of the group or sub-group to be added. Otherwise, the group or sub-group will not show up in the dropdown. For more information see [issue #345140](https://gitlab.com/gitlab-org/gitlab/-/issues/345140).
+- When granting the **Allowed to deploy** permission to a group or subgroup, the user configuring the protected environment must be a **direct member** of the group or subgroup to be added. Otherwise, the group or subgroup will not show up in the dropdown. For more information see [issue #345140](https://gitlab.com/gitlab-org/gitlab/-/issues/345140).
 
 To protect an environment:
 
@@ -214,8 +214,8 @@ configured:
   They do *not* have access to the CI/CD configurations in the
   top-level group, so operators can ensure that the critical configuration won't
   be accidentally changed by the developers.
-- For sub-groups and child projects:
-  - Regarding [sub-groups](../../user/group/subgroups/index.md), if a higher
+- For subgroups and child projects:
+  - Regarding [subgroups](../../user/group/subgroups/index.md), if a higher
     group has configured the group-level protected environment, the lower groups
     cannot override it.
   - [Project-level protected environments](#protecting-environments) can be
diff --git a/doc/development/pipelines.md b/doc/development/pipelines.md
index 047a2064f6f..360ebcc3e52 100644
--- a/doc/development/pipelines.md
+++ b/doc/development/pipelines.md
@@ -358,6 +358,11 @@ with latest `master`, and then it triggers a regular branch pipeline for
 never be merged back to `master`. Any other Ruby 3 changes should go into
 `master` directly, which should be compatible with Ruby 2.7.
 
+Previously, `ruby3-sync` was using a project token stored in `RUBY3_SYNC_TOKEN`
+(now backed up in `RUBY3_SYNC_TOKEN_NOT_USED`), however due to various
+permissions issues, we ended up using an access token from `gitlab-bot` so now
+`RUBY3_SYNC_TOKEN` is actually an access token from `gitlab-bot`.
+
 ### Long-term plan
 
 We follow the [PostgreSQL versions shipped with Omnibus GitLab](../administration/package_information/postgresql_versions.md):
diff --git a/doc/development/sec/index.md b/doc/development/sec/index.md
index baea583e1ce..294dad4048a 100644
--- a/doc/development/sec/index.md
+++ b/doc/development/sec/index.md
@@ -45,7 +45,7 @@ flowchart LR
 ### Scanning
 
 The scanning part is responsible for finding vulnerabilities in given resources, and exporting results.
-The scans are executed in CI/CD jobs via several small projects called [Analyzers](../../user/application_security/terminology/index.md#analyzer), which can be found in our [Analyzers sub-group](https://gitlab.com/gitlab-org/security-products/analyzers).
+The scans are executed in CI/CD jobs via several small projects called [Analyzers](../../user/application_security/terminology/index.md#analyzer), which can be found in our [Analyzers subgroup](https://gitlab.com/gitlab-org/security-products/analyzers).
 The Analyzers are wrappers around security tools called [Scanners](../../user/application_security/terminology/index.md#scanner), developed internally or externally, to integrate them into GitLab.
 The Analyzers are mainly written in Go.
 
diff --git a/doc/development/testing_guide/end_to_end/beginners_guide.md b/doc/development/testing_guide/end_to_end/beginners_guide.md
index bceb0d12fde..b81379d89b2 100644
--- a/doc/development/testing_guide/end_to_end/beginners_guide.md
+++ b/doc/development/testing_guide/end_to_end/beginners_guide.md
@@ -120,6 +120,22 @@ module QA
 end
 ```
 
+### The `product_group` metadata
+
+Assign `product_group` metadata and specify what product group this test belongs to. In this case, `authentication_and_authorization`.
+
+```ruby
+# frozen_string_literal: true
+
+module QA
+  RSpec.describe 'Manage' do
+    describe 'Login', product_group: :authentication_and_authorization do
+
+    end
+  end
+end
+```
+
 ### The `it` blocks (examples)
 
 Every test suite contains at least one `it` block (example). A good way to start
@@ -128,7 +144,7 @@ writing end-to-end tests is to write test case descriptions as `it` blocks:
 ```ruby
 module QA
   RSpec.describe 'Manage' do
-    describe 'Login' do
+    describe 'Login', product_group: :authentication_and_authorization do
       it 'can login' do
 
       end
@@ -152,7 +168,7 @@ Begin by logging in.
 
 module QA
   RSpec.describe 'Manage' do
-    describe 'Login' do
+    describe 'Login', product_group: :authentication_and_authorization do
       it 'can login' do
         Flow::Login.sign_in
 
@@ -175,7 +191,7 @@ should answer the question "What do we test?"
 
 module QA
   RSpec.describe 'Manage' do
-    describe 'Login' do
+    describe 'Login', product_group: :authentication_and_authorization do
       it 'can login' do
         Flow::Login.sign_in
 
@@ -222,7 +238,7 @@ a call to `sign_in`.
 
 module QA
   RSpec.describe 'Manage' do
-    describe 'Login' do
+    describe 'Login', product_group: :authentication_and_authorization do
       before do
         Flow::Login.sign_in
       end
@@ -251,7 +267,7 @@ ensuring we now sign in at the beginning of each test.
 ## Test setup using resources and page objects
 
 Next, let's test something other than Login. Let's test Issues, which are owned by the Plan
-stage, so [create a file](#identify-the-devops-stage) in
+stage and the Project Management Group, so [create a file](#identify-the-devops-stage) in
 `qa/specs/features/browser_ui/3_create/issues` called `issues_spec.rb`.
 
 ```ruby
@@ -259,7 +275,7 @@ stage, so [create a file](#identify-the-devops-stage) in
 
 module QA
   RSpec.describe 'Plan' do
-    describe 'Issues' do
+    describe 'Issues', product_group: :project_management do
       let(:issue) do
         Resource::Issue.fabricate_via_api! do |issue|
           issue.title = 'My issue'
diff --git a/doc/development/value_stream_analytics/value_stream_analytics_aggregated_backend.md b/doc/development/value_stream_analytics/value_stream_analytics_aggregated_backend.md
index 3391c80aca0..0b7e1bd46da 100644
--- a/doc/development/value_stream_analytics/value_stream_analytics_aggregated_backend.md
+++ b/doc/development/value_stream_analytics/value_stream_analytics_aggregated_backend.md
@@ -43,7 +43,7 @@ Benefits of the aggregated VSA backend:
 - Simpler database queries (fewer JOINs).
 - Faster aggregations, only a single table is accessed.
 - Possibility to introduce further aggregations for improving the first page load time.
-- Better performance for large groups (with many sub-groups, projects, issues and, merge requests).
+- Better performance for large groups (with many subgroups, projects, issues and, merge requests).
 - Ready for database decomposition. The VSA related database tables could live in a separate
 database with a minimal development effort.
 - Ready for keyset pagination which can be useful for exporting the data.
@@ -165,7 +165,7 @@ Creation time always happens first, so this stage always reports negative durati
 
 The data collection scans and processes all issues and merge requests records in the group
 hierarchy, starting from the top-level group. This means that if a group only has one value stream
-in a sub-group, we nevertheless collect data of all issues and merge requests in the hierarchy of
+in a subgroup, we nevertheless collect data of all issues and merge requests in the hierarchy of
 this group. This aims to simplify the data collection mechanism. Moreover, data research shows
 that most group hierarchies have their stages configured on the top level.
 
diff --git a/doc/development/work_items.md b/doc/development/work_items.md
index 5f0ef88f200..eabad175bf7 100644
--- a/doc/development/work_items.md
+++ b/doc/development/work_items.md
@@ -88,8 +88,8 @@ so that in future we can allow users to define custom WITs, we will move the
 to `work_item_types` will involve creating the set of WITs for all root-level groups.
 
 NOTE:
-At first, defining a WIT will only be possible at the root-level group, which would then be inherited by sub-groups.
-We will investigate the possibility of defining new WITs at sub-group levels at a later iteration.
+At first, defining a WIT will only be possible at the root-level group, which would then be inherited by subgroups.
+We will investigate the possibility of defining new WITs at subgroup levels at a later iteration.
 
 ### Introducing work_item_types table
 
diff --git a/doc/subscriptions/gitlab_dedicated/index.md b/doc/subscriptions/gitlab_dedicated/index.md
index 2369d8a187d..ae70a673349 100644
--- a/doc/subscriptions/gitlab_dedicated/index.md
+++ b/doc/subscriptions/gitlab_dedicated/index.md
@@ -18,7 +18,8 @@ GitLab Dedicated enables you to offload the operational overhead of managing the
 
 ## Available features
 
-- Authentication: Support for instance-level [SAML OmniAuth](../../integration/saml.md) functionality. GitLab Dedicated acts as the service provider, and you must provide the necessary [configuration](../../integration/saml.md#general-setup) in order for GitLab to communicate with your IdP. This is provided during onboarding. SAML [request signing](../../integration/saml.md#request-signing-optional) is supported.
+- Authentication: Support for instance-level [SAML OmniAuth](../../integration/saml.md) functionality. GitLab Dedicated acts as the service provider, and you must provide the necessary [configuration](../../integration/saml.md#general-setup) in order for GitLab to communicate with your IdP. This is provided during onboarding.
+  - SAML [request signing](../../integration/saml.md#request-signing-optional), [group sync](../../user/group/saml_sso/group_sync.md#configure-saml-group-sync), and [SAML groups](../../integration/saml.md#saml-groups) are supported.
 - Networking:
   - Public connectivity with support for IP Allowlists. During onboarding, you can optionally specify a list of IP addresses that can access your Dedicated instance. Subsequently, when an IP not on the allowlist tries to access your instance the connection will be refused.
   - Optional. Private connectivity via [AWS PrivateLink](https://aws.amazon.com/privatelink/).
@@ -43,6 +44,7 @@ Features that are not available but we plan to support in the future:
 - FortiAuthenticator/FortiToken 2FA
 - Reply-by email
 - Service Desk
+- Any feature not listed [above](#available-features) which needs to be configured outside of the web interface.
 
 Features that we do not plan to offer at all:
 
diff --git a/doc/user/application_security/get-started-security.md b/doc/user/application_security/get-started-security.md
index 41dc35dd8ce..b6213a98f91 100644
--- a/doc/user/application_security/get-started-security.md
+++ b/doc/user/application_security/get-started-security.md
@@ -14,7 +14,7 @@ The following steps will help you get the most from GitLab application security
 1. Enable [Secret Detection](secret_detection/index.md) and [Dependency Scanning](dependency_scanning/index.md)
    to identify any leaked secrets and vulnerable packages in your codebase.
 
-   - For all security scanners, enable them by updating your `[.gitlab-ci.yml](../../ci/yaml/gitlab_ci_yaml.md)` directly on your `default` branch. This creates a baseline scan of your `default` branch, which is necessary for
+   - For all security scanners, enable them by updating your [`.gitlab-ci.yml`](../../ci/yaml/gitlab_ci_yaml.md) directly on your `default` branch. This creates a baseline scan of your `default` branch, which is necessary for
    feature branch scans to be compared against. This allows [merge requests](../project/merge_requests/index.md)
    to display only newly-introduced vulnerabilities. Otherwise, merge requests will display every
    vulnerability in the branch, regardless of whether it was introduced by a change in the branch.
diff --git a/doc/user/application_security/img/secure_tools_and_cicd_stages.png b/doc/user/application_security/img/secure_tools_and_cicd_stages.png
new file mode 100644
index 0000000000000000000000000000000000000000..3dbfd835bafde5c27a2b5c2d4fc0a1ccd39340f3
GIT binary patch
literal 42240
zcmeFZ2UJu`n>GrF0w$6f2@*}jCL=k=Cg&ib8=8hDXK12I5D-z2j3OXN4owCFNdd_@
zDTp8$fhNPPjpxiAzxn^UbJx1}Ti-uxPO!1ryLRoWx8CqPPgR(@n*6!b*G>}<5S&v~
zkkKR{I3Z3zKzKxY3Vh?mXgL8s2wgPgr3ebXT>nWxaEjSgR^Qd$6N$1z5U{|cfB(e7
z!)4>(;>rS(Vd3F1cXZ^iLYZ4To7=l^U=Xh0EAV@J2P+g3g|Pa44G$L&4?C9-I~TV$
z7cUD;lA9a+!NbQP$j@!~`+9S01m>>>`8c>h12<L8Em0U(2NxR_m=yTCBE}VA2R^~q
z;7_;~_(LE3&&_4V&1WWX3;ZbQ=xB$~Ls%%IKp*7zU;-R4e(?28Wd&_j6&4<8@UtBX
zjQ}6=2urjBbc?i&vx7bOMvj|{mxBxX7ksH@jx={h{ktZh_d&RtTmOC+eQS4nA&iWy
zC&HXdSI*O0QqBR~1zqEgaCSjCVE%q(4jvAH-@kD6azy<8)(YW{vIGz0VS&kl;rwgd
zz`dxyM#@}LMgXY?SJ0Jnwskj9GEkPc@%Y^c#vJtYc*NDgV6k)mZbU%W&dP$%#Y0Y=
ziyL9?C2Ogp;%LAHw{X=}#%MdKXbIUG@L5W#>DgMsB-LcW0Lp>?5T4d(TWM`aJGg}m
zzlObzwF-vE+8k*q=q03WZNTd#Wr37-RK~!#bW|<ilKg^t%90iy=5Am#<=j|!z-&ml
zYD>CU8)#TM2{|cA+c{XMfX3C7^i`FmY`GMj<#kjH%(YPR296473tLHTjI1hJPt(Cs
z+FQ+C&Co%a+nLWvTT0r)+Ex<f&1ERaW#?pX$Sr7V$g5x_i5Ae}Q^hE$DoLxU8F;{T
zlnpR)NJ)2TR}WQ7Iaw7&@N|@og_No!7ea%}-O2)VO3BvEmfzFb*;>$+%Zkgz-bxmH
z>FMRBsEV|3$9N#!c?Hmlg8BmXIzrx(t~Pdt_MUFKZhRKf)()Dgy0%=(s=SikUI<5S
zO=){2HAPME2rFePMLj!JdvzxnWjh&7CkshWlqSEnorRU8i=3>3j*_LNnl89bT}sVT
z8*L+RZ($*$U?HiGmeD{d*~`dka;XVv+t@jSORV`U)ur4WU3u(bHddDIHiif<Syk}8
zha6H)PsLNmQ;=6p+QVKEW66VZweeQ;LP>g}U34|ov?Y=5UT74rnzJk)hDXrSTHi~?
zQP<T?UdF;4yrGo3w4n@)M-yekZJ?sfuOP%Ds3HX8;kPyP@<xMS!?+Bs+z>E*8Gdz7
zE_s-MqpO`Ij8BQ*%EHOo*&T*PbMZKPm>b%=E4c|6pjDAN&IUXfew4JP9<Q{$tCk+W
z5Wl6CHbNSuFKOrPtm$NJV8QR;#%IT?$}Q<&Wx;KuX{YM#WNqc5&!sJ;=ZQp^Yb$fX
zcr*kobTkaKEo`ObRlU(jTR4xprh&Ggyp^USpCw9x-`v|9%#MPVi#(SdH_Tki*4xdJ
z57?BPs+N+ux}>9=ovs3(rGuIb7g87Q;mwV*a+8HQy2z_}BJ6ln1bJlCbrs#UEOm5s
z5mvkwn$B_ph7O)6l#nb&S-};}r76p=%BAA!tRN@@*Hj1VUd~R6pWo2K&{5w&3JDp8
zj+UZ;xg|^ujzB7Vy0|$R$Z*T(pba(n-7K{fcwJQxQi>M(yt;68d38;=x4D#+f`fsE
zoVm1$yOf)TtSs6Ip#WOpwNm2N76ij=XMvOv(2!QJR&v+%wh@5wnJYMWt1I)mt7|A*
zJ366Zz*9Ks>*(sZ!VT4(gmiU<_;t0BDlkJKdu|?GXI=qC3p+J8S9MhZWfezWSGbp*
z0ZdLo+t$I$k(*0ENsCvBPgjP^+EocW)CuM&D2URM6HtK+3;gGT5K^*%qnw;%yqxt_
zxIE>x&E=3VB`<`R13&PSQvBvBiVgy@Hp=FLf(RQfWdR!uXhv06S4GQHQ$^Dq>Bh~g
z%;l<swgOH`%E?0rZR>0Wu7JZ~D0`TY1+Sw!_?w3!<al7fgUbEwv5wsr`1@Z00VZ3r
zM_NTdz(AlVBdP6ax|l-p>|zt{p+I;L)dfl7_oSzT?!OBSFwnlxTgTe|Gtotj^wfom
z7f-@oxZrQGo(&CRWWCTtd|F9e<Go~M`uc!bJ<Q>X^$Y6Unzx-hw(J9&UtE{!_D1)T
z3mWdIr2P8z%h^cEXJy?0|MS@}e*CczzHRIz&apd9xjK1Ll7NUJfPk2RfRI!I{22P+
z9gkZ)jx}<Ac%J>5Q4615iRy@e*{exmzOc0T7C&pI7I^t3Rhr>zZwsv06Zvo#uMG$Y
zrT;@K3W))%NbH_peaAK`%5U$ZUDDdR@o0UUEp9sNtsc#Ycw=XoLBr?)C%oiT+h7F;
zt!^pu4!^=~>MHr~Zv5S&bX_9x14HCAn_78^*Lr?u)KZ??`ooA#1C@Q>!zE7lQCOP(
zR^(vG<|r<&U+^;Y27liQek6^2$7ZHlAuyR{*Ro+cIa1jDnz8ouTE^8hNpk=DB5wB9
z_J#uI*s)WA|Mvhuw?E+vEX+Qz<E#_?q&Df05q>rO^qNcm!L<E2pPqR$8#>vT^p9?a
zs7Syh%v2Ikvl~CBKDbWFKcZ1d<RA2Qx2JbrY&`YHwGs?$M4a^pRpsdMR@$Jijh$5$
zwFn=((Xfx_oIkWS{rm0*NX!wtl78qdR4uv_J^p$A@tz%WXO0Y(rxzXdvPISRk825t
zomp4M-oW#XvM=e*7Eq==7r^vAsS^`odVS*GX7~8zP7#gl!K{~8bhD3EJwAI3m53@&
z^gQ9S2>D|WoLSQ|9SR@sjLj$Wdus1!_&8wN`b>nanOy(f07E}g2nRlhI4l!M^=z3>
z7Mv^p6-&NI=Uv-K@(-`=Kom^xNxc>;ASx{N$28^K2-sFs%_Y6?$K2fvA(+ah@ZNav
zN3S%c3D#m0wJC4@@k;8XgpKeU8*^v=c;xGc1XFB$IgIMZhW&T1(<z8T)1>CQFaPm0
zg>#?<sT}Wv=d(+n9<7vkwA7-+k2Wl&G``~W$$0H?CH6Rk$0)i1m@=*VxgY#Fd-pXp
zo&~CJ$tLJxaxW3}iLz*h6Q9oUX@nD9?A=<NUi!E-Q3C4}9Csf^Tt*L<Ac!=+mb@TS
zNfR5Fdwj)w&{(9Ef6VI6f`FsVRE6?5TWZiN@_=g2-3u<k{S@iTw<0u|)fL8>uoeYZ
z&JkShNVAN-w|~Dq)k!ax7(c#3@Yblo=@n6EHD~|4@^XF7-uIztAt9nZKj+1@<m-XP
z3v_GLmIY<sXRGggDGf`*Qf25FOTNpKZrNNaTPI;IA&#ofCW>X07-y5EYfz+0Uygkp
zz4Ds$yXIDC+Lcn*&)s_?4fsWb{B<Xp$EHpv2}{jCJ{-1$i&_he9V#pezS$d!nO;32
zRo{9hbqn0B%)Kz?!r>OZ9ae0LGj7OK-QH%xZ#TAH*Yl_D8W~bc5h&tLQ;DV}bE6k=
zzJ5qgIG?I{Qx<gh7Ba=>OXf1AIQKwXHT%4wmzURLI;WF?M{MfZYP5S6&98=H)VGS6
zTFhC%5YMQG6TjKhY!}{2wugo$@8YRI?hnoV;-pr4nO|vW-Byxr;+=0ujL%9%pd%g-
zxS8Ee_%7yr;|X-N^Gn08<!6b`5G!m2LD#E4iM18h+Nuw;;Jgfa!ckU<(+4lq^i*+~
z=`zvqfanz4<=m5|Z45;c0j`{(5;(KdCxs;Ux0@f;5s|5Hog{kga~pi-sL)7WR$v&d
zmfycXDjdHYnr3X{l<z<^jJ>suS03ME4X-l>%~o|yjaY!5T~=nTiZ&*-G6Dl_{N|D;
zd+<9V!k#(?==uxaLlWpGw~O=`2<Pj;L*Xoh^J33YOmjqJ$JY}{&i2r*#hzg=*i>a0
z<vclw&GDI(DULq_F1u`KY;+e4j>RYDt(Y@`cEA8)&-4=&A}I73B&sjVfa@OwC3CG$
z)6nBjGlPDRK3UEIpV>V2#3l^j`g(>n*ukS5{PJjqUGoNNpv=H!)HPxm*KBBi=4_p3
zP5i6v1ObQC=g*%Hf4)<gY-4e>yTF+w?qAPdvsj{Aff<*vRQ&7(2C07fPE++($CKTT
zw3}{e;v(Kz@dR#Z6JwNKhr}iMd$moSmgMIv*5M+%^pvTtKbo@qZQ-KcX?}v(yv-38
zakj@wb<cYkR@*om$}FQr2Tc7ob>i_qI+8|zW~X7S)BJEbg3}m>`kk!Jx$ci&M7NA-
zxb6ptZgffGd*R~4VQi^aJZ^^VwBeQCdjw=^Z}AoH9qz5<yDbbv98_y$$l*So7a39&
z7`J*`P(4potXD93r=apfoT2TlQHuz6yY?5{M{^#7CLY7z9?@ewCjBaCom+3z_a+GY
z^!Z)6h3?IY^jq%`=s&eSVB}yhSYYCE+V$Iq2mG#c>PD84e0H6pTkSaxw~STBTViJl
z8xBWCa3=ei4fPA1g41V3W}a!CzP4iQ)~|zU|Mjblv&Q;lzB{lrKhr7efyeZDqYvNK
z+&nKlMLc?cx??eTt9j^z$M_W1eUORMaFA|P#EChkZzcDJ`@5G%IimB74X?CM1tu<`
z1`ASDllVKlH|G&=^Kpse{znJ=9?QmT_cqL<YWz0)_4ut?DMsB#?ejfWCUC>Zq~S`Z
z>Ac$7d&}xn>+wtRK`R8xnalBws%a<v&TmlNpY+=*myNhIT(eS-UTHY0r}f+D26tDm
zQ~J#8j{9wm$KS+0JV%3+r}KJ!j$Ul+yvQQg<WH3p(Rs1Q&r<vkclgl*clW>m+BJq!
zE+Zs5Q$<Z2y;-$sB?c~Sf(9|(f$7%mNBf;eeePbL4pOV5*=DY;#qMDAOvH}%*9!(Z
zg%|G92s+-M2sHMZdG0>pH9H)^S#Kk<RHilIu9Rbmb4!cgzPdSo#=S4F#vu4%q}`Zx
zY2GqVTczZ8uWUMm7OOw%NcgMcojt#TaUs_yMpT0Z(rhBDU6v^XyWca`__yb=_?>L}
z(a&$oiaKgAmVW2O2MqIZS#6yn4h`ngr%aG$*u$KqJ~XFMwh0N%&QvMx=zWWR=QtiG
z{^R-ZIlZk?J+oc<ByopS`)+$0k?H+5`{!}_L7fgcXNfjh_g=@UIg{fqn|i*Vk#*SL
z_yH%c&C$xPCP_z{n0n1zG{RKPj0LDW2*sIUy=pcGjK<p^pYqzB%#1f33Cprh^=hW`
z+t66($&47s?kz2kjJuC^@K1PJ?k!bJE|w3PmYR5s_n#O1N+9r&*KgN#VYH&qXYZg}
zo_?5&E%`nPt?QG6-G#!eidiblUu)lE;llJy6D0?ls~s=3=f!B&w7k;!Q9aD)$@)6`
z@_t=@?+qKaFZ8~vl3V;WF0)_Ufe{O8xOVUjR(2|6VUO0+j_$Hz%b3;D$iq^zRFkUf
zJtn-^re=?*q{jCSWiBIEHV4f-IA3m<_^#A#30o#U5MOVH-I3|$Zn<um>r!59*;3sZ
zaw;GRQ=Ma^k-l=^f3RSN-=2;ZA$)BeR^N*{f(KMbXJ6x)%KqiC_xLI-578FKK@cgx
ztK02ShMexl4_T7O7VS(&izj=o4CE(uB*0oy{qP0?C%g|f2Wt*>nxe(d>?Ye}xsJOH
zx=r5|y^N{+cFJe5xFuQrX<et-UVEMPD5hp9&;RIfEr7I9`PhCE_BWXqs&wQ%-qJV>
z^t(@@{YS0Vmj`erkHRIbj@IGDdk@b!4Jt6xI=1>RhV*h4MUL?2Y$p&uHEdC%8II+Q
zF6CrXEi*OpD7f@(=b*6sW0X+S`AG+BpM^-hOEp=tZ3FoBx6}4btg0v8oB3VI<RQH`
z|0ZMX>q7NHL8%s8w4A6p&HvC~ZSq>WYO-Lru<P7cI$v+)R~3EUM)?&1R8qE7%HHUL
ztVhX-G7*iD6U+sbQ{l_j-V2O03A$C2(c*`5^=En7CN@O;6kET%d_*^IA-gZL)qU%E
zwHej>_V#F7_>?hB+@W^uVbV@_8<FU{G8K!ibjd6hjQ15=E|2#oFIQHCo}=N<do!5}
zni()+G__wUA1u%}Y;5nGy!r`mKDS3LF|G$M6JE=x7%?2lxJ+oslfU9zM>>Qqth3wf
zKQcv>93Ae}#G7B^nx9EXW#3&M@Mt(Rn*3RI#3nJ`qIIr6jNWTtKAy9F`-5MLa^+jG
z&4av^U!d<pVcTsSHSLLfXnZtxdz8qs4QJg(kHwUA-R8jC?Yna>jD)YVR(3A28xC>Q
zELxDz`xg12Sh-(!%G~1c`+{3urxGVJH5ju}Qem7OitQ}^7%kcnXM&p$kE^Q_wS8^k
zI^Z;b3g&R{c;d4-P2N0wSm#r@oaU>Cj5l+w7WLf9A3%LnUBvCB7Q@A{lO0?+iu<k;
zHn36ut%j}hbv*7*`3!OrmMV-q_U0qP2K>LOj~+d-oXWx9t9$nOBiA|ujga$epLO-}
zpX?r6%j4rKyz3dkq`C%(i)?b(otev9f$`hjA05*C@J>Vu<R3r9vei^D(byFQ`nbFz
z$2CSz1o-a$%yw^~^%!z$p`DG}pKE|QoN9@tUpa5`rgrub!olm36WzE{=5i^ec)y7Y
zaLEQ~Vt&6aiL<5omW+E&M`HX_Cf-=v(yRq<f0~}Y<`thiH9P9iP|i1K+}ojVE0k;+
zj#|z3&qa4c*>(*Tnu%}u6$<>!UB9TSABb>JZq>yFOH7h+mapt3Hb(2de3M#U>jjpt
zJEzkom2RoTLSaKa&B~nhwMm6{Xt&29b+#rAy)Wda#7Y;J>b53aI6v~nx^&B49u`@t
zoyPmw@@re>J`U}<qQv>}``&DtKkm7%;U|yqU|hWY_$)itb&J04sG#of^E!TjhI91M
z^kfdfue8|Ca@d!Kyb)1x!)3fUT+AxXZ}(-LIOeet-K?EzswK%%d5Y@xswj=)0WGfc
z(7#Ye+_BSsv935HWjm&_`s;?}*pV$fW+a4s!bN!jzrQ8PzuH_Aq^6YPd&{P@oZmz*
zWv82mp1r%<l%}I{&fI;i$)7$dX6IGcuQC!k&v#*I?KF;Iv~{<-dp@_*xT-GM(#Oy}
zq|%@=G`z&7;R+T*^~a0MA;4Q-+L~bse6XEkY1XcPVbA*Yu^-JKOo^MHb4h;`ANSB!
z&IP|X?EXb)_AdXr%g#*v=!46q`U~xFBvTcCzyh;$K6gBOBl#2?p4{is`M2R|?QKQ5
zCVZrQ?|9bjTK7#IDmLp1Iw^dxwx?2;7`P&y&A2M&_)QKnV|gaqsCW`|?&wHjx4%8Y
zeS1h#ef0}ls^^CTL!YPR`>K|yv#CA>Qu}j=qGlb#iG~jT(aQc4ZFfr_FJu(Q#D&==
zY`oFP7}L+z-ui$r+VToZTgmdZpY-MXq-$GU;x=KUMRL@V(7RM}23|_pDTYMj3<gcT
z(Np4$(ZoIVbvWlibk3+;l6$`XHMX@<cqjYV-7o1$E2ZQ3kx3JecFDSwcTcywRZ;E=
zQ}U(K&qt9)_#*1g%A48bsIklOpW}mMq8lH{gk|~gG4%Eo;^%FOvZ>WKBt%x<ok$7L
z=tVk`(WHd)d9HpnY>J++v#ImspOUvwcF?8}4^68SU%%@AT-FEaf{U}9k4yumipSe1
z8X;ZKa<zlFMf=$l4|l(^cr^#g&EZ~a3a}Uyb0^}zSLAMYtH4{LXvZg1JA!N(vWIDx
zT+scw&wZE*W`mGh<%3#jEGF5PO+x7#;XQn&Dcjwq*6h-4i?eoPmBmRN-HVY(?8YP&
zCpy18PUNRnCt-hOv(nY>*GGjcb_ogeVRZT7-PRIDXUeGLI7!QX$#TY(hs$ve@+eRB
z>2aP`%9p*3P4(ZU6xkFf5vKe#H3!f4ifD*N_0!R_KZ@n@+J8`daccJI9fy(=<RUnW
zoaFN|l~dKD_8SYFqm+9qQ@cw0$v(d*)$T17xj4}9>^li$lx{Yot0tBA=Nw26X1|Ii
zPj=H|XAkvC<$D{Bz6{v*ei3#Z;hMV_AHLoF?F1EUH(=po4htqB5^I>9OJee4%Ue2s
za}*d-h7ZgK8^^mI8?oJeIZ7@4?OiNx%vrf2Mi*QD{bty7#Wcr&UBd<67M<H}4a}J5
zaG&0oOmB4lWg<iB)SSI`%6`McjLfr!ztVM+w!25g>NaCj@+&5)EgG&*k*rPcl`eiX
z)mbaO|DLEKUb4-1V@f%VY$>?cS#2qzt6u%w+(uqk#EJfz`ik;rZzO|HEnm&}D5kv!
z;>EiyzkB`aJ7ofX6$_bh_`)1SeQ<fF)?WXHl(J7?8NIw)ey7xrlP|E@Ea+;rh9oZY
zproeGQ2M2dJ+l&nY3?H^{6;UlhWjyI4E;O+dFb{vve_izvaM?3eqBrbGeZ#c2irS4
z#XCx9aW;CzR`wB?(du*43Bjbxo?rd*THHlOS!Pq`q8bM7b{1zRTZ{W1rJS4d$r3rR
zU-2U^CRwQ)&+<KZ(AGv`c3?qYD}a+a`!hQ0GdxRi-{#hsn#rJx_@q??2Df|7elhIP
zk(lW8OKZ8RkC&w|nY^TZzxX;9=kiUnbWDF_Rb24)M2Nld_IZgw?^?8m0-NZ1R9B5~
zc-{m@x};}?^C67ghLakjkyz#rJpQxt4#RF|GYyed>aFF|OgLzEwsY+=p3T>@y7L{R
z(6gI$-Hn{U|NI&a^1}&s5B1)a4aaBO-89Q82fCuG5~Xs6Q|Tlx6DI_1>jb7|SM1cc
z>czVs48L7|cY<BD{`*s9<8h?z5lGnGPl(cDTtLO3C)od<gi737IrXaceCaEJ>3<98
z;CXemJz)<LUuyJzDmDCYH>M!#syDk!tmB|5?LlEw>%bX;{@P}#B!~JcpO{Q;Wh9@(
zj8nv-O;xgKA_}RfN-{fVB@-EKm2tu7I1i)jg0uPFKlmc*R9q*vyYtC<GhZLe@4kU{
zA2at6iFrMo3gf68J3m^Ht(qwKe&+im37vVT`1+f@y7PiV$VVpQlP9m;D@se+>^|F7
z*zm>O2fKUziXF)4CupDh;T0d%%s3^)?U>AkaWqM$i*0yQKNXsJ?Ht9sB!c*S;jLa_
z>K;$14_@{W!~RyoQMsm<$Wy2y>eRS3;CJKfrdRhzm9z-Eq`1?l=}NlS-qH$|6fc^u
zby2?0ooVNOpWxG_%+p_C8il|MSz)sc{5oE1Zbeupuk5Xg5ngj?PZsJuFgI1bGABXg
zXT5Mg8<b3q>_7W>1j+Ui6HUL{eo8tY)}sQS$(k<Xqh>ZbI^1gbc!EM&2GoQTQ*18e
z;s=7gNR^|Bd`r7wTQ{g~xLi~B;LH))1=}k$d(N(EhNf~-bq`aLUo@pO@Mi6Fgvr~F
z=aKtd9S0qB>?uj&N73Pa5?i7>xhS*f#QHhx3w*xO=Q2>$=b6^+ax<`xoeX~W;i|<A
ze+Ys2zVdQ6wXe?M)leHiPtpL=zz(1-zwLy)yVwm6@6#wl#f%1nHwjF2H{Y0v(@sxG
zEmu|7gTB6>YO((M(V=dFJwmHDFFNi$BCZ}~kc{7cUBykR;)3s?_ko~+m1osksuz5!
z0Knz)vZ=gDDxjKNJT|eZyTrP~#ulIbBx?p^_@OZKNLb;eHn0x*XWKh2-HbKUKhR5&
zF-&8c0%0lVYV0tx__~oLY9${q75KARB8Sk5m}L1+;2#ne?Cr_)kggtO{jC>g9;+81
zD6S~6D#4<lJ9}R)`%yQUasc=QU^n)~pmz~0v19Ta5MFV=3C<yq6o<Y_oW-Kmbk+L!
zHB$e>YjDP?IMY{AwBi7kRi)0pYIrITLWm@ZLD_Y)Rgo{{|1DI*fc2gJXc`Fm1n?oz
z=ipO2D>D5I^D&lnnm9$-qY(};s{w&P=oR)d|M#x|AW07GGqrJ&_X7!jno>a5pLYJx
z9_`>ebms}c$N)Z+{S?gh=Q2vyK=8`o`oMITpHbVN9$XsSWqkrxgG0lAG>T%Yr+cjr
zBya%r`}Dvza1c|4RZd!6lOHHSv=Om)(-Kutz7X@PcAKvajNGyE#?XoytB(5wgof1u
zILymDL+dj@&u+mPzRk)q!~^u~`vbuSwe0J4g$L+PQ};$n`R~>NrWCEQ?~2SnE*58}
zmeOGSnc-)4JTjKot>rsEfL0!?Wq1gKR(`hAXk3;%ZskI=aP~xD!>?Ksk0vkvwO+XM
zd`lC>&1Vviq83I`v*bng?nCA3T0&dd%Pw+qByi$4K5z!^*xSI$b9-cqQjZ}}dU#hU
z9|Ypsckc_~TR)N`M;|OOs8a;`ZHc^_A8@ccICY-ARqaMf&K^LL1?a)eVtsS5?%;C-
zrm(+5(OM47U`L&!DEd?oef?HkidXYb94L2+NZv@Kx*o9+=KIldTZEXnEHR8a#^zI9
z6ib+U<8zzO7PQb8QcTYX5WU7c3a!51h;rX>&inc}BGH{y6a4ZEfu-3rtjf*PW0&p(
zW_9S|I&g~^pCu1{M&)taDW&nt=%xowW&o`6VhHyHgR}Ol+33pecCH99pZ)_3XRrWZ
zcqpMI-5+2$X)plJAK#-m`3J~O!3`kt#sKa=8JZADf;DP6x=^A&S_pjsTCjNc;?W=A
z{Rf7CZ89cu8NxqcdKnea0{8uP=|4yTa|*|)*|PT;pQA^7T#T}od(35IFZ=`HagR#B
zat>ZI9p;gzcJyuK*-8<@2aU5h5&eVv<R6caU^shBBOTKjV|-JkznUYjjqKVRJ*2#<
z@eiEQs>0XU!mQEcss^JJr?if{^rGeuH|M*%GrUy(f#f0$e&>=QR*p$A)Q32>UoH+_
zZTKM^wesYL)^q>RY$~bEr_sNNoOy?}^<R}Mc0FZP1EpvmI0x5>f9S2(zcEDaW3HPG
zP0>=-^M`A=<;1r|TWmY~6oh|F%-6sG{H`xIA}gggJEBzg1~#i>cl?y-e&AAHc}h8I
zyf65U%0IlM!ozoiy;xlQM5<NxN<~aLX2Q{FE#qiwr=nrVzSGxYT);HqYPywkh~6LO
zk}g4%xaPHf@X1|eWi$Wan(FO5o%Vez?5nHkduFLt=i&+-Ooa2AZ;+l0$`<*fj}+vD
zv=}bzl=ht@fyv#)p#qC$w&?@<DYo@9v_V|X``YO4vY7nhd8L6@29`!I&HbP$Uz3Tt
z{KxYNh?E(M0B?yOU0JtphPy0|(j!M7r_GMwO>|uz(P$6aUJy@+nB4P?^Akqk`~)nc
z4tP8QKM|h$!#D#ZdWd<sdtYma8r8{KE>!+d!YS_kP(GWZyB51~?i>A|7YC3Nh0@bs
zDE`xEiQ&L#eZxs9{<wG*EQaY|M*hFa)ML&m@GBVuHV95h_$TWnMhZN<dgG}-hv^<z
zW2?6qCH{ErcO-<3(d6Mne^Xe$7fKKtSWRNG#D7we+hC2|dNSpIxSmGD-bG7fPFV@y
zMfADQ>cWeZmtQ{ye!e7xvH&n1b(bGsQM?MC7f9C2unI7#J6)&8Z%~{H>{S!#DDk_Z
zxn=(S@y*i!#<~23;>=Gbz!h*>%NPq1_KQwsOGJgHL2>CO(Y>?5N+j<aWdMRl#)}C8
zloHAF^Fd)@1XC?1Y#O6ULSK+RBq0BIUsIBS8!$zdA(3zI1K0ijb&!MwbHMf*0nOSp
zAtP(hjdvfpUT9M&JO+{Oiuv^IE5H?U<uE+C0!HuNJGp&N5IOFXu5z7ay+};O1pK4i
zQ03`|1a9;yw@I1hz#NemQHs+sSTJ6Jx}<nAuu%bYiITq{2(T_Bv8Rc`VxTVB{d2oi
zdQtq`HQv>)=cp-K(<BTG4DwUFt_*~So(YE{Z;0YdoGpuEPp#zNS^$ah!Qa1}YLV7-
zp%kB)nW4L9K}1wV{YEQ0>IT+%RxY}S;T=N}@2_?f4z+;lY(^#My`%?zzq~W>=dF~}
z3{AvWh_eK}LQ)05NIAH=ssQI5{pkA*>^+G_neW6D;xSCklHp`rq$*CoNJSmMSWnE&
zy#UdGp8S*a@mRNlac7i&9DITLKE;cv@08vXU}9>!ySbad-E>bMftjPEj-i&=mx;PU
za*OpH16R{0rj1$<aJ(`yEW@E$V<tbIT1H@~Vb{6OYpMiD-VcwJpYx(lUtX7!Z@B>O
z_Eew)vm&D+qXrg~kj3@aF9?F)U0{puT4x0`USw3%EmmM8PwpL0TWB%}E6$CA3fzRJ
z0&l6&y_{7IsP3eprPTs4Wcr3zXxh;uL5GQZd-zcY`<dr@IAlj+ztR?jMrFnseoo{?
zX)cr-t6u>|Z@xcgG6n|ek_Wb`W*+ofTkaMW=uWFQcSKshu2IMC=7Ke#KO3nO4**f)
z4zT1Ars#W`P9}iNupcTi$Ia)yJ<M3SQ&?+pg5-Qzycu@*00Y>U5|>WVK|q!WkYD}u
zCB$N`H#@o`SqN5h{#L{3wb)<8RM^+xv2x*;rvt%qIH7vhTviEmp3tE<B2Ag2sxj)`
zuhwgd&*S4q0l{SNf3O)p4qC+FN6@3M6=RLl#E<rSn;%~-)i>)n&u7yGAS?ijPar!}
z?WG@{Ee534=K~MpQVA-%aF+;n+^YJ?Z%GpSA!$sEDp6o$|DcJ1Ns!<(8L<=oM}9R^
z;dd501SZP>HP#0}tm_LCbv1Qs%``XwCk=rS#4L@JzhwZJW!ea+_H9p`I_qe`)?2?j
zf5*r=#ci=)&#c_OVtn9W8(_OdU{rb<HDR*RqWBjkj_*(60h%}hn2gyF&4b;|CC~^C
z0LTMjaVhR2pEgkdmswvw*qR*u{wa0|a3CcdCe=gZ9+UQw*Z4~4M7;%Tf=`_**;$_*
z^_oqwmZx=l1`tS}Wo)YFRM@pW^iJyXG$1)}S7FE@NfKHsz+?nQNS0clY(vv{5fS>+
zkac3Fw$B6tcOi8t^acj9^G0RaeT5-~@7Dpjh3}Fk9}cBtT8xE@IemEPFj;TFNpDnU
z6GN>iez=`M3xGEq;9!ITpC+uubf~2W4}X0hoT4BM_`Jne5ga9e5*s9o0u<E{|D>;r
z2;i{tEnA}80UIH7bg;MOp}Yam{rhamjzN1KKN75kzm+dnFN{PAOw7g2jDvSlvx}q?
zt+p68QazYK2cP3F0>2va-dbLg85%0KTq^ApE5$F3`n*ZqR$;(SSw?1WP=ZxipG@iW
z4XjG2eDi}=rL*qsDfu94z+Up5d&PIcW%WIY2<446C-6np@C&;n{IE^f80f1tz5jmk
zLY77Ck3{s?<4z-oIz)zCq_g<oMDj}g-WU9s3)}|~EA|i^{6Wz|zLblKn~Jlr4sR$+
zPsT)B>j-!#k+s+aM52gC0Uu^;C@db;o5jwG&0Q$W^rX@fKiG(cXkq+v&5H212ix2N
zNm*mP4C-g01t)!}>X9*6a8*>(yA~i?tvzY7BMH0~g7#NQOhg*;_+THNr=3UYg0(w?
z-}D7!tJ?m(%|0#ncZ4J_)G$V<%;&c;4quXmAV#w4Bh~FAW93fXz1|{oX^;H4*l_@-
zW8CFm%>&lA0?@`a35lQW-v^xpGK~1)a{^=cskrlvDsX%Q`WaID3Jef^=@w%H=D;Jl
zl4^^yVZUbtXTN}DTf+l5M40fo(5l2#PW7SBQhB@ySdIMHea}HXC(hD#o=|$}{ntNT
zRPxG!i_{lkD!3^I{OH=uGm+dBpj~m7D>v0RJtf~Z&P-PpE!Wmrzdd!P;=0O|JWPxR
zQ~7dKgsJ!mDsebQ|LJO%(?CKN!a6Y_$NO_)$iP+WWOFLj5i@3uOn%Impn!5lmI3`z
ze~dVLh0oVOlG^|T-B*y&VZ$=_4H%;HS;EuichL<oaXUX9Lm&z<3!b)&XXaiH-p<*K
z2t1=H3mot7>PCGlRl<T*2Qro(9nd)+$FebHqL*Oy+<O$+s#p-<AKd=0HWA6!!!dw!
z=@Rx>UL;m7G_70gQRZ~>alc&=M$J}TC!DAuv|KrzhZ(QNPepK6v$!$IN4d83l#wg=
zgqIb{k<hfJsRhM4?#^XIkNK~Zv~gf=C91{twyRzM5A`iuQIJxWQh3BN2Ie=E9*Mo@
z>vErwndmH$^ygE>jj|weNAO~$7$NJ3)T9tMtj6sv*Ng&3I2)ScJ)eUaKs=&#cWmq9
zjmWtA6cPmly-`!>McK8nSB#0@RBoJWELZ8J;-~dtcY4WG>ZXFjQ|5dsJb(Mi*Y2Or
zh6Pz!C(c=kyYv|8tT7R04YRTPycJ$&BFvoec^+S<Gia9m1yvZUme)JM9Coki74^bM
z8EX2a_Y~}XAjw*Bv(_#t2%KhLLMt7?gnv6*{6q|LC_;CTYg!jO`*O6#4{6CxFO7FM
zT+}lzp5j^B>!zb)=k9&n^)&HtB3dRaDq~<GC07+!)|Xe}x0J98xLSL_wz|UP8V>MD
zNe4M<_q`PIjh3@MQn?NV9U^07Cg$H3V$NLVa6RnpqYy`ZzEs?-3MO@|aqTh@i0~nI
zDWu1sNezvEy1f=~M~Bt*U0~dtJ>dFrAeaq<5_*h#EU`+-2$(FpWg`t62%t_q&3ZS1
z`%veRyzT_WzVt{C)Vc3dYh|f8we6Jk*=I!ZJNwV^+Lwxbh}b5pY$auP0#if{CnRK+
z2&je=2y;+_*uM6J=)V@7>B%X$DTP4r{T}M{!~(RWm3&XCGYO=m0>Z*spk!>3{srCv
z<Z%C8)0kRgFj5{b0wgAgKY#vgyVUlvNLR*KJp{}Gqsr|H?K?pD^ZN@h4o?&Fx7WU&
zrltUC5BWzZtCIlc7NB_Jbt`b6Py!cloQee<r(*9ZzM5b8oeTH*JuY&(cox{j?}Qq(
zb)V@t^W!4+ymIPyF6>6nWM_O*8US#=6Kc@0Az;K{hRzbwJ^Y=X0|u9rM(;hq!+s~!
zP@cknoURc|2Rt(Wot~?20ST547kGu=IX*C?0LYLissE+Al#;)V>PinJaR8%#_<Qu*
z|MSt0*uKTdx%HJ2r0yvaDZ*}N*J4Ekyq}!{OD8kNdfC|tDAF!!ghO*s67?^c4*#<k
z-1qZqQ1&-mYHjpZH{W^14*3Az*@pToas#WGD)Axu8OT5t)-3L+13OL+yOE~=RS92Z
z_pQjC=KFHom#bz+PLSXGDx6=lTn!<BLqfC3r7vP&o%ebRK=MH&fJwG5`NVp$!ASE6
z%6c*NJ3nlLuL?S*r??Fm43ij!=rLl$xpKyy3IOj?_p(tv9F&^3lrFvWW&(aHfNCvP
zw9zt3s2QZ90yOtLi~0-ACLtk-$oAJ@d!SXqt$z^_kp_OY43fDVi2>n>>IatIxITZ7
zOBZ>q|EN+X2U;g1psC6ST9V}>0g(J$<F|X^moDqcGL=ml`<dN~=^aBCjndi7P~g~J
zSyAQ+K*8ZArTDP4G2*$-VhFWb5y%uPU-fpql(zqPPN1y7q^3GekyNqP7$^tafh=Qa
zYtr8VDAwE>+Oir77RGBT%I!x7PMy2<%+FC43!c+T-M(~D1_S`f?YU%4Fq%r#@<S&n
zCH60btgL(qO<TNS`{M^Ff-1mpc6s9$QRCHar9e02!+pYUccVCt-Dm{Lq&pJ%N@JMh
zM?fYuTkt7Md@6g_mjPQ+s8w)R6bzs;=j>SVRX6y>XN*wwn8$=Ic_iq6=vxCuX(@~?
zwMfs*uitG9BwS1HN$6db$FT>Sdgz|licO|zkU+_>0s~3{_oNye?l3{&#m<hk8in}q
z;4Qs4I%o~WyDVQ>lRo#16>7W|G#<PS>Wq<OA(!Mzjo!oL>@@61M>3>6TMh{R_VH28
z2@0N4$w}Y!NIu)XR^*pt6hKt%@((D*`DTgMVog$<bx<ITJwr|?9~9*5X%+_b)cXJ3
zwBTQQCqIzaMzFhy040vyK%N1<9oDHIO(!}==4f~+8)wtaSaEOp6I)st08I)94k32f
zy}wn5LO+=xSmO4p3&8PazHnQ<x;Fjt6nGcOzFUB=fFy;LOgU~uqm5zI_FLl~71HO0
z8V`COcgoZIS*3s+nX4L5^wkDwdn*n8VF!EoC8KVj@HlEGgNYCK-_m=|3XMm?mSzKb
zzP|5HI`0ZSC}&rod5oeJ8E{RPL<%K&FM~3`9V9qIKyBsl@!>gG2Zas>)Io*Ra>9&8
z7CBjmoAdqB`*&|#1UD``yQ3TpmRnDokVktey=^)#wAQ`@`6!JHJ0gh(5zek(^o|{2
zWSf)e%%g5|l$?CAyD2n{QHix;3Z$<sBAREj0)PbvF;l+sfGk+ye-H+MF#K~}YMbo7
zr{g0s((kJ2d3kvQ_4m%AWgAb*0%VKx!)s^da)2QG{sMwOa)!g{$qTp$16#>fxgG<+
zg$U?-NnTu#3Qq=gFThra6`;#*{dbP?|KBAZ!{KSb;d-t<1fvf>9{n%>`RG@Lrh$z%
z<aFGGfn#K#2xy@YuX4$dM^S*{@S4{Tj>`Z^)uPNio`Z#dvK{>^LVC3p6yjRhYUQ9t
zH>&gAyhrg~CKTjSH;@lrNZkN{%`+7W`DBn)3Zka(T!0)<f<o!`RUWI*bF{*JtZK<~
z3ILO%a|bY=A#kXoPjZGEgHE1Vgvx#ZB~1cl?M@Si@2^j65R6f<Z2%CCJoI1z|NVCa
zqc$0laaRVPE+So|pYJW~f{7ji03OPI6xWgE(=`b2dNuO*ED&D#f$W_hBj|-p(KN3)
z)C)3&x7$}mz02HICdTEWuA@Y~H;TxpS%+jVn^=`1J4%3LeDFj<qH24p=x8Fpz3rs`
zQC)uZd~Srvb|W=>NNjJ>5@!9yRh(YLJrBYv@QbCLBOuh-(h9r2>0bS-PZc)Z9~y09
zRrz-wNwhWV+JG)ewUMrcKrvrom?5qb<TXw)&2WX|>@!Ap&E;>&`n6R7R8M2f_WpY3
zQj9!ZF$78-_?x%@ENU2%UPIzwYI!KRkos9U9aRcRF(Ki2ys39ie))hQZYIvCI?c?b
zgAd=Q1y4ZQs|n3qI7WjYTnfS$J0|REmT=3~Ah6-|Oud?PfucEF#i|kR<+Wom9J2&M
zmhcT;%jU;<i-$Y2Y5k^bK%4m|4rmQQrY7#gnT!P><WE3KW(e5G1Kolm@(`4q7&2A@
z$ZZ(lk>9b{h5QO(N&&B5Rz5#7<MWi`Iov^*<#dPBea^d29hw$IX^|cZ(CoWY-<{EX
zz$@O0(uBx`C!1yA^z5^S9^-D~4Pt(~mBaL8kK60hD4FDj3Tl>ZgGtD7Akue|WoAT+
zjeHT?vpW{?gQTSt#Ps%p`d!-!v$;4UOfe$PpqVTc%0$(~cC1EG*(r8S7xi5Ict5^o
zackKB6_I2xKU|uvIHzzALcYqw)367-!vL_bUa4J=vImK3`H0S9;&ASlqcT))9x(jn
zi2(y^TDB+5i>~wumCRktryBr3WK`++lG-#o)jQWHm#vtsd*erv!w5^fu?2t;1)8!A
za;Vh=-ygJ*Dv-1MXd<3!IV1P@!Yz<J$R_Gz&|!ehKK=Rv6zQ!*^QYu13J_KxQE(|0
zr6Q){NbDB;{zN(tYynU^Ym+6bI*9u510W9`uioV4wX>7-K5hZo+7IHu#?IAmA5(5#
z6UWvX@nlUFR{coKO1RF>(o4rg7BLc6r<1ayVJtA|TM7Zw2E!?0e%_IT5Fm>Oi1jce
zHLOG7e}cUOrJ`G7rHmY5tV=sF+ufpd0K?`-wqNn6L$)%L0;IzTN+icucyM3Dk9@aW
zmQbg2ZeXPV02Cqz%-rVcjZ{I%%+;IaZ6Gt}d8)gXk!ff6LAL?xCod_b0J}mZHR6zA
zKz(lijzAbw$Hv)fysfONiDg48KsNlnG5S3G376+ax4b=2&mNGNlU+Hur?=(;Fzivd
z_<<GZp^vUR3&!>rXECF>$8@9s$0f5FQSs+Zoj|&2lW$n=yp@k{q4yX3#zvVr<4C1O
zrC>`HnwZj)r>k&ojarjGl!X_h$<kn9HcA4>Dws!13aT@n#FT}n1(S;nu?zIJ%Vw!2
z@H7E1DE$zu|FUDH+)iBFTT~&S1zg5bFSDPF_1pzm<KkKiy@!t<GZwfAn1^99zQKkp
zVON1SNAU{k(-=VCQewAbhPoDGkUGqHCB=InOYQSaAszxb<qDo9Cz3|sONZ}IEbLWY
z$+i~|iY|R57kAwY=_{L6+<X3`GtEKI*y+LOdThcC5Dm7~&54M(0d9E(<~Vi|be^2?
z95E#fVg$aTE{ao$LLmESL@5CO1-UZ<eJ1PuQr>kF5+t7NY4#6`hiWLWDugN$8VpL2
z%Old{qJ3Y$1{VS9SMU81YZ(UDXsyx{7?+N`fDm?E>_!+>$15B0$U`F^)a{D)KoUd4
zELM@(WS1z^)ugx{)WcgeHE;7ulp+UjnUV=Ep`WVvPJkU0!k^fE+8S9XUl`z_?JO+{
zcdOkNew-KUQb|DiHJ(|U{uUfUM#`)Jj3sE*Ddh?PJh(Rm)t-Rt^~63{_$eW*8m~kJ
z6L5gWsEOR8x;4^O$dqjcHWY0wKr}~(Zyw+;+#xWV``J#F+JoNrWK`l*?11TTY3O|%
zcAm7Ax8tdT;2T958<b)Hbivy_5pgOO;RJTQ8sR7D!bcE0L+kZDW|>!nk3BQCtC#AX
ziZN*a`QDzG@Re6!PmVkAYS8F>4@s9vkD8dUEA7a=D4wYJxt+@ECO0RmKK{o^Cb@8^
zFlJP}TTw0pFoly~BO!z-qyj#=%8lK+*I9u5PTO^_l%16Gv|T^^4%XmdH0RP`_7k;U
zpvG%3Xp3WySI{6~n(GQ~w}a0_%+%y|+G#z_A7?SyTJIFEVevGaic>W<oXR#}2)n_)
zqpSr`z*|O**93s$aH4K8BLxADqD11X6GX@{q`Cu`hmciM0&KMe*}sJaK<!x{(zTEQ
zze*hvz0e4l>wD?)|L3xV|J)q@zm$8$M*yhrJV2U~j!9y_|3DJ|K@0;{na&t2;23Iv
z`5h<rU;%U83b`NzmH^;KNuebm4RG^+IX?XVP>TMK(f|LGmiIv4;`&<)@ZXc72aB(i
z3xqoVp~d0Se4V$t2F4vMIv{0vLq^&MGH!-`0IB}o<okGgP5lIlN*uyCj&~Kh&G$7e
z`vSK&kS=**576@YAY-R{vkiNx54NlsLn&l(x7(n}V3gn#DHLD!g>srSTYXC&1Z;nb
zyD<2i5yDvjev?q0ed;gWL@zTI;Er@63wfn>KiU%_#&^v84-gsh(KuE9;YMhG9=Y~@
zg5ZxAmWvgW*wXjGBt{U0J#3v;4uyDVFE`i$Qz|a6Ty%ja&5jV@XDm%_nNU!IHaBN2
z=LG(hih_FQ%%!_Uv>s#K9R+2W@ew+oMedrfL1z{R&HT#`@S~ll&R?GkX@PcKf-Qhq
zs)@XxAnXog_9=Y!BYl{<O<ia&tNpL<pYR|bFo@?cSp*C#?zx`naH{VwMK<H+XnF^q
z<*Mv)*Iw0uN+-)CZp()$&Yy4LL7q2yipK7~o{8IY`?7Aiqt@2jZ}Ti5M%u)8t?6O|
z4X8fsE5AJ)C`ao-%6iaCCp?%Yqra)YQaxxVsEJe4MLd*}W+h?fk>S-IE6dB@M$m=j
zAn6|g;&V(#l0d}`>4!s?jO;X~{ccX2O{2$dzid7Pn?keKy+9r|?7fgbyUzjkdSQOt
z{`qiQQTW6*c>;)kPfDfjG$_-TGZ-VrpB$&K*;g9jNQ1%4X1?ZBQUHK=4nhE&*NJEb
zQ0~sbN6^+VMYa^Hqus%VWQIhTbrg^beBQ+`p+T-(0n%@SN9Spi^}8D&sF*ArQeFcE
zh=p~s(?eSCxtCcVMgjR~53=|&0IZEdwH&BsG9k6cvi0*MAidW-e{WTStr8?1NT620
z)mR<w@8FuRp@+a$LL}fHUzh+KSgjobKnDs;L`IQG_KSe;#66<(Ztb|>2TIQ`@yiH6
zn>(+WIDcZn^=T@zuZb~lm)%wOtq1cBqzk&a@H8=ZKt7LvI%t_VX{sJ<rxVpSG-ss{
zht#c35VbtEGqaovp$Aw0LJyi)kGJ1C)NRI5pRg^g{S^*KeGj!cn`W7#{J=7#|44;{
zLvJ>`0%-7uO#yWsE;gda9K!`lUp6&N?V22$n(O_*^BmitP#&ie>9~*&a(rD=)8&xo
zNLM^C?WPjOKql@rs9=3tSU(Tg@Lykp$*T>LAy^kMS7Xki!=MHnO*SK=J5VbYJJ{&O
z<Rtr|z0!6&Q$z*<B5uQ3yBf3vOnLc`c`CPtJghKxD!ckHG4SdAd*Eu5WGcj+ydt8h
zmXEV%0mJna7{JY+79!dJ%YKt^qu?fF0A1|-YcAg&T&^CbCX4&53KKId(Je;}4})55
zUZxuqDdUCZAxkM96HY<0L5eUoTf?}lOlQd6sITiJ$@Bquz-Y~qohkNacV0{)@(r_9
zqcKcac>g}w1gRFPV^5`-7zXwq#wFd_1ttwxb)+@VUg`vP&wkYQZGJLA>~_wwSlQ$J
zlI@(FhPXM!d-G!b91Z)<NrFy{|BoHdxO#CZ-fKQ5`+ADgbn`GM`o=m<eb;0w<mK(b
zhH=c*1bn&8lR~ib4WnzY4`xnzSl7s&FShkbWtTttXHr}dY7!1G3uF2);tncQf^ilC
z8DD?6yAYm<*&WxAr=5|BJnac4!KJt_-)OLmeio`9U}7U%8GiCq27u%ClTAoS14TgX
zRAUV^_<L_|V{PXrvs7s+%HVB3`<SorjW(4Ckkj+3NH9o&LWU_M;^%#UaKF!b_>S>d
zn<rpDH4BWuRk`7I1t1Nohv~wIQ}S3PUyAY=4&Z=Luu5`2_ie#EaT|?8?Kk3R{NP+V
zLD)%J9`zKPuDeh1<2G6HrJPja!rNa#x$Vp-&kt44K2T9W#T|BwR^|zcicdJe93u0T
z7hG2ZWO{%@!#uj~915n@3jp*mfnH`wmTxx#nbuy4%7!bF@Z7|bakEFq4uvW0Ux#vU
zf`^aju|r|0kou@8e0yzG@*^=ZBQrpdq$*#Wj|0%Boh|8IDG0l9>}AC=Q|0p05*2~v
zSJSZ06!S{5mN-1|)QWJCM0TB`u}wlkV&hX}81pk`+uU&ajw?U=1UqVN43Y~5%}*I#
z%hnoUroaP8CtTfCDX~$dpWl5^-y<|2E+2smE8{#y3ILcQq>&*_*~k3(LWP>4)))v)
z$$L9F*{SntC9$DTS3k+_&xyIpc>Y*n0HtAO^Wn(R>tOl|Ny~bB{u`X7*Sn;vX6%Db
zkpGgCZ=r&;e#B4P*$;yW+~6925i!|{``?{wfD)`!B&%xvCmPZyjdErn5L7b5ytLTW
z$)m$TvOut6xP@P*gAjXh&pWpiKuV0Ub6twARQ$pz`Odwj3?2HYQ*WJn=@m?XrY703
z`#ssN-X^vrOnemWsvfc!5gC$j-b)`8Id|~)5NNjW1qyKu^(JI7glPUgSmWPL+5qV$
zYlP0er-YU>tLum4!_Yir;)cLeXd5;S4B2j>yz?|DXj?J-9=2BkM8<0+GLP$lr9p>p
zoI5UdLI8nUte~<FxD7mju4<%jxJsF<Ow^4}s+@iaP=Qt=?hqw#=WpkrzNOLA<o@Ou
z6$t(x>h-@S+5Ddx<6l7r93YWHdGpSlJLN`E2iU8`%~97M5dwk52?e4XjX(oCP3Xlj
zm0epq7Ay~m_A{l@f!grlc9_`cS)vT<$B$M4BKB=2B=i*|ym@y8T+hhLKoDpP;^ow>
zv!?>r9GjK(LH=CyOOkhu0+jP#K^6_P7+~wf6x;i2KsCtVYs@AG)H`QIqo|LaJm4CS
z8v(+cAU@zWCATZpAf5OX@9S(3TR|vxEcpPv2~8tL|F6In-(&p`kf&3KlMR4KPW)|J
zm>WcLi#exc1_)EyKIS`sgq{IQl?QTgvJWk87ND1nUDJY+kY`>!E)2mY5{Z3g{S!cA
zbc{2oZ-u>VaSDQ#`Bx_F;lno#=DhYJyhcU$1M>lLgIg?V^G-MNWd%`@v$p{Phg@AE
zF0p^Ef~%dc6jUI(?nVnYyh7ak@hYb|$Sgm8Ch2Yj2S`l^!lqglArUH+!T<P@vJlD-
z7-bNlghhU}GKo^CrG-Jj_U^_{2&><hU#%E(jsO{}G9Cm&D?iIL-(O*%7WqWh{&@)!
zJj}$K)f<XH+ASc46hzYxn|kiAwTuEet?|+f1a+5w5x!%jrFIiUjsqNYV1gJ>g%|xL
zHcTpyv}mAMqlP~O=I|f7>XH+Y2J!5;NvsbIP#Vy>c1dC+_CTIFLMeaU92~6hYN@PO
zjqYZ4TO(-DB9>LPgdI1;sJR9MN@%t#bY9;nN3CL2FRhmYwP)g~FZH9~SQ^`3Z{3H?
zA5|IDA0F)09B~%+1BqCk$(MgeT9g9{LN1zaX*q*cGQRv9V>Q%8p8s7Jq38?cFExPZ
zzLenw)NDgQnTXh1ERFU98D-Yh;I-)%BS6%Q=XHVW5Fl|$@>$^Qe(es`1VDN_X7}#z
z!iSnt)CUisb#<|CA=Jr{01W?pUUWl!q5o|>R0b{|6@u}^NMQRk<b{0Fu)8@afac-1
zY(6_X4JNb*QWiHE#UA9ctU-DLpuziQ0VJ-QcD<?s<&Zp5P538sZ(Z98$Xsk2jt*-e
zkpj@Xb`FCAZ(-NQU0!(%)F+xyIcXQkH&CRTZ<v5YY=|_ueZG}F1f<Lu=pY9ZaEcGE
zTaKoR0;=PnLx|Q{YIaTf6Ve`U$JkJGe$EG!ZSyv>5(zn7?a=1u=(s7JEf?<mg3aae
z(T*Mnt3L2n+{)Nyd2+E-40hSrF|dYn+-LSn$`W8rDo&gieCGt=!p5n>?u#~{Yc+fh
z6Jrn0UY%;RQr!{U8gmi#P5cN8+zw-7J4-bE?Qwh&@D1iO!8TLiK()1ZRefMPJs$ne
zxR<~HCV7nkJsc+!eriHs%rO``5(wkS8Tblu-<FDcmn|!i?8&?B!G=SGp&Fm{m+Lfq
zw$G9fJ$Aj|0GH{;ZXiasIWGRdSv>q;&uqoM8jOsJnd$;a`ifCcIB0;@*-a`>F_x8Y
zq|lHGoVSu^^x^NK1_R2sVp`9yfyYNAf%0()6eUiKa2R9Bok?mowLE=1q`t1w-vfgC
zqk|QH)!+@l6tvO#?>j*ST1w<!)!ENw$x=Bg`NXOiN9bT2BPDRiP~NqsPC&eU4>8F4
zS<g~p8xH@VFxLN!oV}^{XkILL&r7w`<9Snbh=J-B6X9EQ`8`b`DsuL77hq&YWRf!`
z`;a7;jSiH$@-2$57N06}6hr$2W*V}56}T>2O7Azu>in-<s`2M3`J~l&1LReKCzC!a
zb#F6wKAho%&MBE{jKCA+C~}R1Di^~l1G{8+$ZXE=o+<F<Fn!(55lC*wdf3mU@{Pj4
zu{~_J%ld4$SHFFU3wd(bfOKINW_D+09x(ARS?GEh45}pf^6JTs4I4*}wTu_GC53*%
ziA@@@_aR_o>~Rn9U(496;aqT@#|`wFOY4nCL*QVp#r+(FAnJ#-axE)7bulEWF?iYR
zl~P_o!=X3iGmO)~Av~YR-X|ilyfDU>u_!A2Us`}y;L`3TylCMH$`#$aCPqD-Z&@o#
zw!8C8Rkt#R3n6v;Os0G^9S7V(6W{^i2#0VT<?Y)M^h-B-d4y+_51M8GmH3vQ9(Zyy
zB#T{;<b5)>h7gC8YR+%p<5%;6_>j5bSyS|CIjXmr-M+V7X(o&CZDR~liWl}QL8FTg
z$dg=P!imFA2&#AI->N2U@wE;z7@qJu@aX3^|3F-!qM|$#CAMp`g=SCc=@dKMwnUFt
zm(z5ipRhMjQIurIQQA_88%pWK`mtyBsyt1Miv^H<Rb1R)jtP)dVOCAue#kQ_pV-ZX
ziBoyc7w+lwI==%eYLtDgC!pT8*PQ6Ml;%k6*Yp9k_}J4z<2b-!y#a;a^|Z$5#vg##
zS|ZMgOGc=rz5O}c@23sD`+DwA?6W(xSSL_>i}-^gq%vs}9EgUE1jiT!QckhN<n5UO
z!B=hv2`Coh4akx}+Wg@Y=QpG5Wo5w~7GFpN@QKrHjmarJA>s3soWm}QEpuquzEUZR
z;g`&VJJ;UX{*ak^12}8Ut>ic%R8c*k%SOZ4Qf&;IGZFe!{I)=-#+%}qb-<q}`+v3f
z9#Bzb+qy7GD3nkn6$B}gWI;elN)<tJk|d%cARx&A0)j|MkwGO>2%-eZK|zur3JNF)
zN>)TfEQyj4iG}=gV|z~j=icu7!X598``+tuhTUh3?XJDoUTdy7=NDGorH*HNr#Cx_
zTJHJHOgQeB>q|O6-LMKZ;a%M8mENLQ+6`7Lm&kiyJ+oJk-vRIKjZCWhOU?_ci7CO!
zjs-FxHdjhsVsn0%U$7F}u?|xBX_}N2;x(OcZZJ~1(2}&&V(-`}SkP!t>0q>+k>gWw
zPLy}v^z=1Sx=*>FQJ{&eR<cERyDJ-zwJp0hoYJBleHV>dKP7wxmR4KDD4;&(=kS6t
zIfi$?4Or~NvVQCxp#})2wJ6vCfZMHkV!AApN@jiLg-Df>YF0YCih!`+0Ue!5+6u08
z*XWmkGEOe#YtK0a6n@}&x^W!}$@8%7UZzqjW8~~iH?v>*W>4FNI3BSb{#N*bYr~p)
z>gGyk8-aGFKl(nQoauB&`Uw@mNWoL(wT3_6D$gFiqEXfuP3&$l^ja$Xxxv#UL71Cs
zV19DDLf!#B>lHeTwv$e+4q8V}B&vX<MR#!A>c{(^!si#>OT0wTQpZToiz$?*ZLATj
zzA4+fz4`_2XJ6?*oAr5&A1}jSR<lxmMU&y+Ndd}&9JY6Y+J)=BBSKz@See9gco|u}
z-cQjq(L@;)U>`<(IP}r&D^14IIp?(KnG@@`#H9QRb;vyl%rF>IWvqvuV@iVK&%CHI
z{FHQQL2m`od&QmkM$$qZeEhymdvumu1X0tFY)|`+bw8_S%9oCVtn^CTmAm^ZT*qkZ
zxUQW`8Jsz1$P!=QS$`rBN4Hm-!Tx7x4AICrK<eW{?yY%f7;NyReCU|15H!?#<SAIr
zWYyfZ*X&%Ki;mMv?J`{@cAUGm@kH7Z_rw^hzYACM<h{a3-XEW#b{{ZNJSdsgeKXGR
zay;fW`PQBdL*Yi9EQh6LC#giF%lReP*x>qDZcX=K&%>M*_QEAy^9%iY_c?37;U6UD
zeY5KA9(1YUoxb0N$4Kg!-Se#Z2tfN;@#6BhlT`T*_}4d>UUujwG9As+Axntz?p1mF
zJb9=-$j9UbMtbjCANm_m<6EeN@7s%HlBq1%>*_uCxXurrK}^<6stT^3)fDz~o)foC
znEveE*>#XH^`HpRCNJMvQ&aD2Ij;tls;r^XFpk<+GNOAy;X~(hRLy?bC-Jv7+J5e7
zN_RM^)O!I)gI9##<U3d2OL3HQak2XjW$F`$E6L!m;_9`K@;D;dQB_Png5pyZlUj3?
z1KXKrm4%bXVHLd76aMO8*k3qsT#v1A(9hsNFOfNInKe+d(dh6AKwp{9)dqvwfmxha
zgN+%<l;6TDparD)o@dmtm4Q=VwS%LQCr+<fZZbiydnz_6<z0jm>m{WeKQJnMdq@&b
zl}%)ZdmViF?+?XZjHbPstnk_sX)BX#?A`)(>Vlbx{5KWE^a(jRo@ePF=p}!|g=Y$>
zr}r#CCXxI0FS2D&=t2J93-roH)7}4GwgHUD{}M$6=pSilKy{>3LJO!SiuZj46b5YS
z(O+qhj${26s!0#(+xd7KMi6<RRUWW`@>O^X{zRDVX@3B90l0{*GOkoPYSSB%;&$%n
z7LYZ@w^On-f;RXo!MBq13K3poJV1{s076O%=yy==3yI-}POcVcCMglgh4%LUqICNI
zJfa;k;r}Difp;Y-7rcV@)&l5>7CA@-Dy3}i*3!>XLG@rnD@_5lCWQ_rxDWY;nD(RO
zgrp?Dxp4T7>1L>3RJ_h}cT{Z_Z_cCl0z_Jyiaxf8RF%88WDzhSj3uG^Jsk4<uT~LA
zaR06}{hysx(f^BTbWzz-=mHj=th$hSY!h;WLw-wc;EH9Q={|JW3MrQ*Ki~BF_cC6j
ziBK9z&oK&t@63ER!r22I>~xCjg995^;-*11SqgoM6DHS7y#LJPmoEAflb>x55g7C*
zK*~9Vn7dY<|M+sWik*iKPij#Ls`pX&DkK5l(Q*}&;)5^@E+Lw4%ce%r+*A_nJ791n
zNuGM#aqs$1-zO6}ccy?Mk4Vw1fI3K4e$!>wMH;((HmdY9e*FzC^Io?flkclQ7xs=x
zWyNL>SZz$#et&yn@ThGPgz__p;U!WNyFvaS)wcU-60|wkj0n=Gn_;rnFF?W`mdKnL
z5r*(c&LORh-f-SGmkt9Q!co`B`Vgc6{g8;bB22nBw+}Q3##vwA@cL*I#5e^N<)d4N
z`kN6jiCJYO{Z6vact%)}dKeQz+_rq;Jv~*ox$zKz+?J3EK2rRF6R2m2(@=&U0%rYW
z=lw9zBp4x&%}sdVving=uUD@F&(W<ufU*)A5QvHE*fj?Lr#g^!g>W1DdxUsswe$F$
zr#tpPu16U7KndA!8>%OG!%r*CdjJ(kIqgxQU+0F!1t8f(-o5mKenv&+{CGzO;w5JV
z9=7LS1k-y1jP(IvSvMHaM|x6Ed)~aQg-(Sx;A4GIu{k5=op(gPA*x`I;(3ELo)y@u
zO#=btimWRlJ%*;ki@$^@U*6jD5j-Bp9n%mGJFfLjC~@D8AyQOe_TBp~9-2~}>7WHs
zmnT>4p&i;%M0G7U7J5)Gi&!paz)B5amAg#s$cT4!<+>?cVOCJtr?&o7!@zw0{_ZEx
z_Mx5PG6qZFQN#LF=r$M%BCfGZFv<FMNY&cVabF79a<GLGNx`-hP`D4^zBxksiB*MF
z%Bn`_`8)uau+^R)ZHyzvAl8aY%>vPV06;kRAD6v6s(%v5kkcSA_71vEp96fS>QgS2
z4uHyfl}U3A=sj+pO+I(;#QmoapRK)?yknXMQj}Np3iLTp4_8~t-Ot=NUk+%)NuW^e
z(nB1*wqV67c4Pf_)_&)&+|u~S<yvHm^h0={CF2dHx$=R_;0vj+bKaHiHy2>O3Yb`r
zR|L0nJaH^-G*oj0RPhmlYwoWeW_{(_lXvXxmCc_U#b@g9h8nt_6K6($BDF0dgm;~K
zcp@LTj|xO^8?9z@i$pMF=HlVNTXZn#UH)prZxq`HH5C-MReJ_pLyzh`kQ3mu<>%|l
zJi4QsA)MHvL)Jz)`KD_0Aj(8AjjhnU#bw^c-ICoHOOp^B-`Ebop$nL<7C*5l+XFV3
z$+tLVUru8YLFlOjEBqCZn<}O~^;>>`-nI4#nop@EYXC92l;<YLR}Efmjo49vwBVkt
z&nU~gRv-i}PDw_egAD>{Ks&X*88xG4r&eYcdE9_>wCr?BQ|xYNsa|gFY#ginc;RxH
z1?%CpyKW#uMqtUtyN$%P$$QW|8*lsyH*~!`+U5>AX$iJTn1!>AQH@DH<~y;yKi)GW
z&<rAFH7P;lq-_WX8moBC9{#8o8!`bqr~3P@F0hB^8}Ja|pn-W)idy~SNOU*>6w^0d
zMM1O^T<OQpBg9BHS+1#bjgd>aPWg$Bd`O4u`eN)|kg#l?rLLpBiy)NB_Ns>t3S=!o
z4f0sXmKB>~5KECaAXp-3Q?M5mQ<{51{LM@IDf5|+0N2Uy$VyIv**x%u*8GB%=DuSf
zv0+<2`^H+QIgj?>{rkz{k{=8Ejo$0-cA?cOvq<?ToGI6ky#!O>BXrzGW{gN$FZ8eV
z0N-@e>Lp-~Jw0cr3<Hf@XL~%2`pcTyjF!?k8;zEVwpYig+JKw>9SaD@R<c?HA+Yta
ztIck%@q>u4O^xitd}C?pCNFjnzcwLUHLS<4Zl`V#<nm^_GiMSp$N8m}L2Gfjpn;!l
z`M?w`4focT9?x6Bod{4!`<;~ru~b|?tyu(yaE=~}buL_wT}O3DHV`0xu_HHc5kHCU
zTP<w42SfPTehOhWLd+c{-qlHMP6Cvcu)lWhMN_kOPx-~qgMUDxH8{U`L6=3syL*Cf
z@Dm~zreFC&3-;5^=p{(Pb?l4+4J2e`u~rX~zL=Yno!X;`ZzQ3*>N#UKb5r*1B|t;v
z&gMKl3BnnyEc|hT!$T;j9`SZ6hAwrvW7Ojv&{Go)M!YJXelu|TaA)bhQ>B`$ywa+H
z?4JIz%#o7_8dqGq@cM$$jU`eoNT@I9B(7->!=;Ad@zR|tX$VSre&9WxPm<8BiKnNg
z7kN{z-PR*$At)#)B4{Oeul(H6pMv<F<Lf~%r26abTLepq;zNG@mj(FB0Blt}mVQJj
z@<>^mft?|LfrqICB4mf4@m#JoJKML$P}a)oMXov*K-!~@PUUGjFVv~DNa}uBjkqw)
z<}~61XW!IDLo?DCL^sc6!Jn*0tW5GOL6>&j6QoRKV#B($gpiK=7p-8DJHO#}-=zkV
z9CZYy_|@J!d23hj<@$Q-uF&L?5f<x_OMj<xJ~?N^o{Ox<?Vu6vs4lou?kgW<ydtH6
ztfWiI`B<Ka$Zw62#J9zDKi4i)YRHPXKp!EDO%2fC;`0y?^85Vmcei=Uq|!9UP3f?Y
z%gG;%prjY!Ia!>O?b*NU{)TezmUFZ^jhtR$@(&XRrA|Y?R6!TdO_xY5ykO?=SoPSw
z%UCQ}1ANjs51y?m)v!&QA*5uE*0mh{WRtU-6WzH_sM*->5Z9bHqklROJC9o6j@s}3
zt46kL>mW?<?qJ9L<@t46xT%dGzI^s59fy<60|z%NO`@|>sFm;o=g%?0$0`jf1&uvR
z)JFEPWT{i^l&~CH8gME}G3cI3Bn~)ZkB#K8jTl1G5GnAmuq@lp`0#?Lt?BAd&!<aN
z6Bj8f+&*}e&RF$VcIk>Me#s1CTYOls>1Nly#Kkj(S-0{Kw$1q<8KE=%@juuWhx1&S
zX*N=t!_!h64arx(pEFnwD6i6#)o1l=ntP?5xMRAmOF!PR1wmqkb-gZalT-#6XG($N
zDhEt(`Y!A(nBa1bw{Gtcf(f30feEf!x38Q|^MzI!gR_fOT<+PNid>N-&it6!W9t>=
zyt>!JErffVCo-1|Iv)WD)pF0A@3;&~B6zQVw=Td+uA|{kejTx~apny1sc*nm8g2zY
z>a#sa)#h;OJnK$K!Hce;4GtqIxWexg{C~VA`(Kqk-~OLMxPUgecVMf2Ie^qJLf)_D
zKkpB!UrGLYz!w7Tf+8kx1*u=8+bux!6+(~FFa(V?NafLR9E3`J7TRPOKGiQ7IMhr!
zs#^ry|9X~4|9dE)EBM`qoH{VK{RCpV1dS~$EGBQQKUlZo@t~xk!hlRJhDI$Mkv&p-
zAX_?kRt3z4WgwCkU+HBnO!m=VFsx{C>gB2rY;zm_X;05R2*!CJGq~@!w*DHHfd%_K
zt5T3!m7HMTUp*l~zw+~0dzWOAD&`o{n_Bt(?$3Bb!_#a`PR0>1cwL$40Z$^$wd<eH
zO%Pi#F(ODCi2S=M{>-f2Xe6C4*@8o3g_6B5DCto>tD7zJY;{0uCm_#@|L61ak%Vve
z5bZJHX>t0>@^^(OKYw06Q8OZg65Mha!ot-W`ZVhG%MAeK>AUF3pc{>Ja_-)F8y7G;
zyDss`gOi38qQHE>FGM(yZ)n{%e1(2rg%Br-lq=Z%*5I5@{qnLu@j^8NRRq$$sQ<O}
zo}=eBq&3Ji@%?cOH1no$&SN=cf<r)p*Q+{3OVB`O_0TWAxD5(E#6BTBaQE!vg^dug
z(OZktUgn4lHPCiSAO=oJu=+mwrr7%FRh2f5V#Y?J&K%;N?>P9~r(rQ$;zp##|Lq3`
zcY7&`7raW#u-gWJCiiXKpmP2=^K{vI5*nX_sesh#Ob%3+0q~Hcxd(16`)T&K((B{<
zI3*@dnMSaiaRDI8GimxydNP6e<99m|KPK2n?4bBO?xynHD|n?PiF-qrfDD(3&C4S>
zY48Qqnf~-u-ESbeA4T`MzO&IM;7}BVQtAy==10WM2vG*yk!;C5U-F#R8+dK~Pz%m-
zJ=y%1inRUJ8`kw^Z*Y}AKinMq?!Fc?LdZPr*?AN>R>Ke4(ofe5ThbkSV9!Ap4!vF;
zMPpav?w=8bui$@Xd)wnziwKXuneU(9TiS5m)WX7%akJ{FEa6?X)#i$TI#>9EjFU2Q
z#$4?5?}g;Jx(u=}goYP|WLD&f3uPq4$Q<1LL}x@dt1I}z@mPB?Q-0l`xK(4FvASpN
zPiI%_#ykfvTaO*C+nD*hzCKg&R(EV;W9j=;`}fo<o6jac_-#gEtpS0OfNcG(U1TIf
zuwJg=-SVs7p;~wivLFFVC4}6?2_iVN0yCX^_%-KM;NW>y4?y)Q3E29vPB|#jeZj%#
zM~bLvPP0SO>73qd_=@ym29hT$6CjzMtOLB;BN;qKuYrU^#$#9;>;f*^LoF*-V_cDc
zrtaBVNI?tek?f%|>U!qy$8o^N_#${fc+L)<2Hq}T*|~NiG@4~yxgXPg?XSL^n;?18
z;(8r^<7zVSW-V%Lc=0N$!|^5$PAN{0K^pyj(&PIwi1x)Y=Xk&wAiAX;yIFLq#(TQJ
zPAqm4fcH2+Nv(l35I=|SO9f)#b|Z-+Zg67EHP9d}0ApA2jaMXZ?qg>OdzzxUS@lEL
zYW5tXV#m@Fa#s!nH1DtFvpK?9!;VF&rBtB5`R-S4@Hl{q1AejTg_?<di1=}8@aakL
z_S-}eFEj2vY-xO?;6z!@;?xJz>j<yYxid3lz@t^N3ntAffQ@DpN8lt5F*RdGFwMyw
z27Iu`;UZE7x_zoK59xrlQn;LcaZ35>=EkxE@T&WHHF|;mSsXYDWmG&+1N7!eP1$Do
zCS6q*&rE<1K`Jy4PE->{JbMd|gXQ*gfBsy6W#sfa!RN{3gD1nFn~FL8#9If5xAw5u
z#7Y(xc5Oi6r+Jh;_zh5}D*_XnHwn~q1-QoB2L=ab!rm;5w6+4Dvp}r~O4oiMeEHoS
zRceYh9gy28L-p?SGT$DRPq#!UBYA`BP071)_PYkrCHELkN2Wo01(#HlA$F|PuIW^=
znvKM%$HqIQtW(Vu2^0j&=RsJNAe?GL#mWXKV5H_-2j9WLXrxRCE04~9Jj8*``-$@z
zX2${{q1&Yg`WvFaB<~H|gsWVIoJfrkE_8_naOPDDB-3W(^qOEX^9zjchpwVH`a+G>
zMhXD&_Ly(lr3W?_kCv2GQ*n)|!NVi7AVAH6IZAZ~6pE6&dDlW$THb7?l7y?)k3Tq-
zpI8bG3<hBYF;)$srfB)=-#mk98rRnEY3pDZXhiS~nHuwFDPm9isMlYW@f5|+)#Kr#
zy&kB(Y);cCFL5Nu^0`crsiET0B;Sk-F2aT)=zh9KE+J7Rl35PLD$)C5q1b0WXv6~{
z%<s*lm?wk^*(f$K7s&Qq4o2*(bU_R#Br9v`(vz3bo3Rp#FG*!2(e;X=9;Gt&CfGGa
z>a@fO{SZL$nH6AyZRo-zaP=btNeO9n^K^3QCRAS*pyS};B`UvpIWlcvM$3E$2d}h-
zx&tFsEa}x9te27+Oy)L%Hf#FI0hDr6G^K|37e<2g4PI^q;~ag?2|(><aw9507L_ku
zPw#-1@Ok`-fO1lhqgW3p`Ro7<shTlii&z~&e7zGq$O0Hk=_ZPqmuCiLd%|lF%T$q1
zW?A6fB9vrr?qr;(TCtsK2Z=5*X~6JegG?o>kZxXm#KD{SRuwK{gG28@36R@5(t+t0
zJN}?3v9Olh)TOXU*eQi)T}?A34|`*YL(_ew>LHw5KA!=vXU7hbv%6VX(UH9SR0Zjc
z$-9H^l3r2pKbZ@~-ELyW*p*?I`i3(0th<z8=`tx>hb{%w!}QIDKF`9-Jr~DW72W2v
zwrw-#J=`PAid7(|L!0%g0!4u?dPkoy+a$AJc*#Q{{D+hL^8pQvL%i2;O>`S1V+vGR
zZ6mV=Gm}8Q^TplNOcDXOpwD@ExN_V44^Z<<D3HGZHKlhun_Ws$ooaX*EWAm)sKj!^
zv9Eb+>1vIy|CmT3_}kR6g1Gs!Xzxf~>hP%-d#G%8VHM^X^twtqRo<0c*|u(f$!ZVr
z?k6BsSXB__0><lQ6sM9}49M4@Qnsq7|H+$ro3=Ah9fgnuruVKpV;+^v()Mzsj)sO^
zGqY!n;N>m}*v`20I=#2}<ni-E4n=6J!gEHwuO5{RVa$j}*rLd+W#Q>3l{47{OhfE@
z&;lG+4K2-}3Z~|{<Z;^i=O{ZC7EIT(g#xmT6gxSfuXP$f1*e%Z3J+vRanr&|jx2KU
ze875-Ztr7$17%x5n+<<nP1;4ptH|=OGyK!?s2&sE%O6$sGQu9sUV1j;EB4i~p1!u|
zB%&R!fefRc2j*JjPRWAVYE@pS<9f60`UEbMB80!4Ymp0=Mxhpiy1P2G9x=8KV;<Nj
zSC!h%vN4&}vsPP*7uB__?R;_p7K)XZx)<YFb#rlxX{D}b+b<t!GO`_?AM_N4hf15N
zRd}|DK}K8a_h`S1w=HOlmd6QvLj?;HpM2TSRal`g$J9PS>7h>_isVfycNTX;;(o&+
z{MsG^B<{QaDejw)eb}tVqHJ0)gU-QX+}8X2p!2G*Od!2d^x$G(p`4suM>F1ipn033
zDOz<-6wiQpwBsVm(kK+BZSbMEC}XmQ%oMk09P$hCa;>e}m~3Rw=Kd5lMe()t=LLB(
zRwC^C6vqYWEw6tTb|xmp;&hS8KJ+gS)32?hHqX{la=Al?wdChBqb><40YU<@w(E`l
z`604a=J%DydIpn(<7~&$<B>0xmUY5flS)(wMkgTcj|CL)!(My-tAUfi1ggnMu;Hz$
zuulEjx{6L&?M)gJ-2k`>`$xQ>oNS4KXwsqC#S)pO9eOv&FfQQ7vVWYTFDHFg0=zsW
z{+}bx2VpehR+a!eHkLt|?yev*N`h||WLULDVauQ<!x*DKgviqr39Co)UR2woqa}jp
z=k#V$(n0nXos<y=!59<dORW59K+#w?!5CdCPEO9%l&ZJu*BBS5Smy#Lz7GarI<}1=
zgBtUDP>1Zt4MfJn)v4P2!b+T9?}2|`R8!UBMn);X;Ez!Xh|iGENEcwDm!9Q$kt2E$
zB|ZC;ejAUwHuBnse!sS1=wNVQl!9P=?G@CWoLav6+U0%ho{fCSd-VN&4+YMvY}=Jc
zG4L>aZYc|)@b5du9V}tUL)rWv^iY;#8z8C~>+nnACtz8d;h$YMyavZyV|K*^&>=4y
z2$O4TtNh2{T8<q7wUA>@14{=xJsC^jKN^W@VwMf0@eqb<V>o{gVG%FYQ_kHye1yX&
z_$y7!-I9rLLld2}N`K@+G~YjF7c*gy;bv3}MHBO73_o1M&+5cfhJ*ju9xS<T@cVuu
zu&9uaS+6vEV%2^3;gmIM_+<OG(F^WFewXL>b-#a?(gFfC3m<NtEf#nA_BMXpyeY=5
zh`ih8?5=w-ZRX{qJ;jZw-ubq_HcJ0uH@1pSU$F(VU~w#A6#0YXFcw8`iKS8UP8-!u
z$I%phzXxv2wnGM*@L)G_kM5KU*1wKcwfx6?#?oAsm4=<!7hUq!FOoOsq!=vrtT>hP
z>xMA@Flzti`678AdJF-{k+_{htQn4!n@&74F~rbhq@)ph78QvsKxlaX+F+2-gUnf*
zyUP<MtNG@I#A{INAX$QAL;`p#yoQ46j-(Q}IwS%TU~s*|@W>A{PC2KT0oZP@hm+tG
zLVNPc{3GvatBonZ62Y&+SL3bHWD!o_CuFa>05jP`hW5y7(&9voXa2yY21Y`^zWEqC
zHlN?<iS1VW75e=!@Ba8+xV<naDm;zt-+BwTk?79P3{-a&n2T>LL*7aA)erEMY{&vV
z#yj|uK{AG<&PZy=PfHpj(Cv)@=UMyv&j2KK?#YX7OT(VwlD{B<a7-C?OXC2$qT>)y
zt%MY}1<pUrf>KZE9+I6OI^WNp)spbTU_M@EQI4Am2`Q?Xzmxh6^!S_laTJU@_c5l$
z$@fO$f|f)Co@xeoD#n0}YnF5CGrqnIN`Ad$8HZuW)GSyMw8{E+mCV6^Q$qR5OadIL
z@a^g3`-e$ja@!2Dt%sY@u7J1*tuN0efi-NQf|y0o?d{n!pPuZ{Km_3q%`tonW7y3T
z;6WmW6gmLWo|tuhSCm`}Y-uD1_62y*EFF?D1F%dG1c)*btiWDFowe_d{6!*U^M<g4
ziXno*HI6c7cZ49z!y=WoKWAlLlxwj`9(hNWj6dEH2f=+S5We%}U3%RP2;{!pRF6pg
zRE1+vO5a3^*Ffy4rJJ<>uK6lrwK^<yef7rAO|S{(2kKvUwi`gT-fHt@?q4<Yt)JHX
zw4vuJK#a4StxV*B#f+3SH}@W~S|?zho74bJ_+)`uekR`YTaQjCGw*}-5R5&h24i1f
zUbyecm062pKY)4dWKOry09?vXLXZHM-?4nT4BYKzn40@b=sxe-e@X;>+3E2Z6lIAp
zFO=GFCr#P0m4`o^yvhQxJ6!m8Se^{SU8L32(#9~un&kDK5860zzQ4TlsY>2An`q_&
zVKj58!^L?8K8<>GFMqj4BJVXYo#skD?EA>V&-kvWc|pQW9%Tz)@QOgQ-r^W_XGrKI
zOr0FHZJ8nh0_y&R0ADZ!?y<&`=mIAJiilY`f`w|uqR5i3!u357DJU^q@NGpPaf*Xd
z23vkzmK~eH$is65hwL9R|N5W-B;g6}0QB=m4*@YSm{oPi2GAYJPwgXkC4w4M>6{Y9
zj}u8vH_rV?(<a-T;3AeJN}Mox7=q>kL%i*L+!_HJI4BW)4`KPDj3;~neD-WNyrzCo
z%$hs}+4AcosWkJ|=L?SkyZa^?(a5Z#3^1FQFHgZKOR=PG!>*yj)v$rb<2o3nwsPo@
zKT-gQ9KW_f%Q64k;#-y1$a!#yiG>o&g}o$o8t~zcZ>UDp%UyM2!sqf>Bhr|7l(ZvQ
zg*-P6iq3y{bTp|5Du4Y8bsOH*aAeV=rOlxjs=nZW=hl0<A5hFMg8cL~EUKbj{_r$Q
zFJX(O2uVLZ3-XY?(!h@SAh8ZWo5!Trrwopf`(z!WC)APfNBr0Dx3w+!L%L6_`Z3<A
z4hUCnk;_|P%!`e@PV5$P0wsVRp@~_;2w?Lc<yEkB@@}i9^_`(6d<SIHg#*R0FI-|u
zKne81!%#`TajXM@XP`h;u6{B<qPAU}{d}hB1k}0amLtOWOBkxCFE71H8`$ky2kh2~
zFUWN2^K7Hzoy+OS*r9X&Z3q!eq*hp+0+XDc*GAVGN_#DtLW7t}W^*u!X}`1ZBiPbV
z-5p|53T+g0JBMg0x9!+D{>suq9-!>g7V^NS<xnsE{MAgsET_b6zqbOVn4aYWx?@4v
zSNnt$K0cB+ivoO2t(dEc__#Okn0km=ht>sQj$k!wjd@e;fZ8L)Tc0)Q-~X)pOU^3p
zf$W#2vM=`ifhWny$yXZ>MZJHibKWN=`XF~@fWL|YN$J^_D^6&smP4sdVc%H9^qrvL
z)9G-fRN!I!^s85sBKT`JxBD-IAepWpZ1%r0-T(hamNu955sI%Lo{Cd^FGM}^Ttc26
zBL^P|T*PW4feFgzfB9=jWqJxVl%0<p9gNrxo8+5hm)mH}$M3Wq#!$gNe3pXvZ{O*N
zIF>0$%k(<zH4Rx9LL=<543C2TxGvy_db&LIeF4~V|NC+TyOA(O9F-QV;4zeqP))*L
z+|P0~LOWftjfy4RU2T0Q1;t(~9Sv2p6;bpd3p_(f=?)|K5<XnJYdAzGCu`4*2zOj6
z{eBH)OqM>XjX3~WNYIqc$gcwSZ=dv5A}_Vu)C*G>xO=pr7q;nc<udegr>0U9c}FSe
z*`ekzB6MzS-hw>kR|^J@T6DC5_J!rDEt5ttBql8Ma$zShaEEO#UcQc|Jmmca$-s@M
z)vKt4AU((<m&D@4=<V(8hg}DiX1^b7-l1JjjeIH9-;YQkto|!^wi#3oHZUDT+YI{s
zN_HW{x&7YdQyKoqoqcD~hYWnx1AJ$HZ9H(RlHVWwlFZ_-+<Ek=dY{|~BjxDRU!e!q
zRQ>NYRo~L_D|f!V%w*f0AWw69`ByfB%!E6?XTpE|hk}n8tvsU;HrUNhA45UEaug#V
z&>$5?s)fB9#rUt=$JRc_4Bqa^I-`O(DnYa&)zL_HD8=NMm79!G=oIW4%J8V0yH%Lv
zv$m2?;j9Q;l}-T7c7p&?ZU<^(7Q*W0?#_l`Bum|QG5L5L?%P(TZS>7frxk9Q4~1d8
z)lb7BQ?kNyeSs(xlFfSDanw#X{*}!de;IlM*YQFA%tjg#npA2sdX(jJdN*=msBPO~
z?AB#ribvt;%wY<#gdc7)q6y^A;IqQgXrg$+xa?rBHiExwpFRmU3PEygk!xQbCzFJ^
z-7}L~SW56H{kLKd`3XI&NK%~E^D_P&yn=}qY@S|IcTeQ3xQC{Ma--oo&mkFu7+eND
zQY#o`sJ~#+4xmwkf>k(+pv+n&ijNB3`S8bGWO>bg&Au*3vGvOhwF?pTVCo>rA!ZhX
zIEx8ajq9aAcCXW2|C0FzNtjACssmlj3ySL~b;bj*cym|i-DP}+)|jzm42QTy+o%rY
zMdn$E9;SV1y{`fkU=_6>jrgE~nBW5U!WtY03hU}X(lrcObF4|Wu1>aYB5PEF)c6k!
zz1kF2lTmn3Qqd$kwk3|_Ws9-dK<^Gc(5<!g!n~tqwkWsH&rTyssAM?9JrztN9{GNE
z^aZKb2q=}~pyjR&4f{tmVUH)?KTMnYSY?C>hOPf$nxs{^HrGLyEPuHR1C}8CH{}H7
zlXaQTyd8nD98xVE5a2D=A)DoAM3xoep0=!+3h{%66$b6E-utRPx#(22i3=PAF~ZW=
z3Y5)lt$lXIKq>43KMG$EV%bAJ+f{s0egpO1Yi8ht_soDO91`9885mF2j%~O3fDU;5
z-3B7eI|V?=hv0ZR)VNwW#K&L-pOzZK`FIIY>s_=|P$byymi3250SvjVAx9{Vf9t5q
zYT(v60He{Q#?u*ao4Y+lCrm?HL6$ZQin5MK=6)csWrMPNts9IUihs&Ebqq1D<DnE}
z6CJ#>hcYq^HN5SwCgEKD4-L|}rbrHxC*J2zKMJL0Fn+G;h4S+!N}R|fjY7(j0GaDI
z5dcI4026!X(hk%}&xh@B@<TTCnTyCi=rK<(0!jF^z#jSi@KZF3YU<^%2+>MR2OEDa
z!p4>%!em5aJ6MW&p4g*;y|z*^^G4BU4h~vb1$fDPh=Et-6bLEAk$T~eMsHbg2b^MI
zj%sRTQ-L5H6p)*|gB|O<vtu9>k`Mw$%PAa&i$(2KM(FJTuR&87O3uTVj>N7wf2=Hy
zOa+(cR-lIoLj{otj4i#RO#O=!-9MzM&91>=7Z@Skgc#_II^1%CYQ&`2>fnh=w`7}#
z=%#48=Z5OLMDShGd5U2gfAd58@Nfh~w%=9brep>8%zI0rx{SnUUt)qjJ-O1_mMmL#
z*!tPE>c|vmh_-fR>;2$LU3v$+C`Hfl7=}HE^l6#6Mf{d$dW9~rWB1Z1GoFUk*N|>P
z*1+Vk?9Ke4ZWDaWW1Np4_9k{L-}Yx=4@Q^nrGdwRF3bWXW%d}Vr&NuCgUUDKpcqzh
zrSZWU!K}`P&i>URFQnNCX%=lK%mfUaUt<1l_VLu41{zeg9^8)EMrNjLA)Z0Vnr-LS
zl;f1&xOr%6&P8~utjeuH0Z9)@5;_=?B$ZXIGhNZJLe`oVnFTUeB5*MRavGCi^{9-m
z#_IYIzD4nBsSKWXX^;pBQ!Ye`TOK}!fZ?KyB69bZ6C>t=F;-iVC%)gOONl-PLM{~f
zQBP%C*|BepyJM)4>zGdE(6frjZ9Rslr*<DDT&In!5V=cQq(e>Zu^ps}XKWDj7X51%
zqiJwkzkK^RM9^apve^jDrZ9NTEL>ZI*WsSWx9`{B8Pe7mQVAN1KqwA*u`BA1DE<YD
z@YQ5)N_dCiq6INlZON_Q)H#3H8D0Y81utRpYB1R$lJ{Jmb2BAehojryO+(L~vNg@v
zl?0~(;JPfhPL1oafcqWNn6}fr)n{Z!SyQoI)1ty`{c@W)D~6B<VKo9bEQ;qx52F}6
z*Z8E>#ua+dY+HdHElhn{n37e59agB?mmRO(uw%c3vpv<1f`Dz~Vd2X`pGDmI&8$QB
z%Hbtql;9=u&(5|%StZ*eHynTjcIqVOK-k`3IQZ~=5dO6>1vD};GPOKP&t`AfJ32aE
zowP-9-(R6ujTyJ=qJc(F{GqlTI+zg1C`5yex<v)*YmGRsav5&*@>YIV9RIiU^8WL?
zp76zZL9;n{^H!8bJWf+n^BHySO3SWeKX)0Ehug!C2ZuqsdH228?rsq_n?WtbwN9QV
zUW4jn_*R;`M6~Xi{7PwfwfNFk+-XuAQxQn<u7ZJpps_Yp+qxRn@N@>!(}Fr%Kd9V2
zh4ji+L=?~cA}7C|9vbchWqoQv8(e_zMd&~VNBs(o`?qzywvFTs`;xWd4*gpyVSsXJ
zXQUZp0w^K-1SE__=~q%x!>%nJ26qdMC%u9m?)FsVSsypZ;iza~zCgSB==iU6Y1{-;
z%ng~yZbP_jiL=-xDnJ;9n7S$GcSCBt2lDU?fnN`)M=1BW4G*dCw+~4tiN|klT>0?G
z;YI=!{9wc~+%aG2;RAx>NB-;Hiol~AS@{}W_3hB&hA~-z0eb6@JaZ^OLtgq)m~#LP
z12nD~F^_I^u#~)APj6(7YR5zFfpn{g{_9JkV~~TifGN+mcANeE&{A^%yw3yd?VF)r
zBMz2|rj&M{fNCK&`K~w~MB+2dryrhvVu5TGtw~btYemN&TFclqqC~B0eF&!_c#m82
z9EKCZ#STLnVuexOe<5?lU3K;PA(6lP5OB;ZFhMXzhv$R!(^O7Bs9n%i-R1-w3<Un?
z1Xc3@be{-iX<*6T50*UfQ~ecshur!wpcas?S_c_2y~bN;vZNKy@+f;ZgUM?SiH?fC
zi0|ctnr~u1T<3<KZ(9(;pYrvZ1Ihnupdau9d*6aE_4siF>D4v}XkiJ?uQ_1EIubvZ
zt5bzQ7hj6u$lx9e`1ZWPD})XO5D_>4Ljls7_ilO6-N7R?RV4FR078MYxf5(Lk06(F
z9;~fKI$qE+lSCYZ7iT`59Q2z#g7jFC-3_VGPn6n);M{r&j~f9yb|2CoQoKCc+#D-l
zK5z<j)>iIou=9_=(L3<~#I*t#Dh$SDrj#;3B2k3=z#<D_T|8yt;9HEKn}__y)nWUy
z4e(y^0K*#lTYU1$NC$85&YdmO<-@=u_@;g>k#1w?>f)`)W8j$&jChq}u~fEj7@9hV
z&Tcr4IQ2faxLF?N>&sj5ksRWVdv?({@Yg|$B#V0;ND*U?Z3^LJt=G(I94h1qqw7eL
ziK6KN!n6P+N2b>AZjoN4IPKjiUHA&6-8Mr&!5Ic@xiFN}0INX5ncov~9Tn7knSBc@
za+Jq4Xyw+t5_<MKBW*?e(?pDp{Mc%_AsBZiwcd+4YIiu#hO-((3l8AlCFX=FK(bc<
z7}&yV24GaWO3!LlP#z2MTU(xe7)TjNlPHWTh6I3qX`qq#R8=2`#!(<<L~HAij^^*C
zWL`W1CbkGe1c&23>|+f5&Ae07I1xcsto)$QeMBuQ#_!>p_ZpGcexoKM-o-s*;M1UH
z@z7cl$Vb(uz>!NVsw9|Er4~ppA6|Na0o}gE9oP7*>lHd5W7LcwE3f_<r92F-ZAoy1
zfZ5W_Cvil8A2kW|byL;F=<8&4=<B-tTvnSu8ztu+#*T#&)@%rHu7-M^97<McOnt39
zFiO<4VAl#lW1)XlQ|{8M%bQu+F8s_NBp6m7a0h9a`+XE%Q6K3CkLbMKZBt>@<C!-W
z%ODxuzQp{6(jQv$R+NO550BmNZ>J0AG7E!akOUB~q5VSYUMPNXysstsUK;#mOWyHg
z$*N$Bl?ko}+Ty%JrEvPYe}|U&c5@N4b2jp^cQr_K=6N9GKiQ;vf$^(mh4?+TDT3<i
z!iYJ!o{l>v!1ZJ0`NH=vqs1T2LwCRW){c$L7c?2$`KV~~aL~8AB1SfjXsF|>4Rm71
zsu~+~K!5gcf)l2Zxls#3&Io+BP9dv##y~oA8nYuMMU06ohp*jl64OMh%7aH9uibZ;
z#4hH!P)dkVb#$~tvY$sqt(F0y4E~pRxQUsDmPz<AR9WTBX2hX$nwp`JX}3#WoP%+D
zbQl$=;SF6%r03qampIxaFX0;$BW6{e7kT5L>pOdYGB_%ji%aK?H}ZC%*>0f&=Sjl9
z-|q!;VpS?5M`hnaZK_|g#HN!7Ucz~_d)I&PUhTlisUQV8IHQ&48GB=(Yv1xBWXCoV
z#pX+D1+Jfvk1rQUt2)rGo7*J{plHKWAhMlf!y*=O7XFak?n7)QEDSC+t63-Vnt5TQ
z!C)}oo3CIlJ$eH-L?|$;aOqtvyS?&!mh}VhFiNzxcu(#&4-JcuvP(BXB!fiDAtNys
zgbplG1bdG1*Owtte(nXPi4}uHZSwHJp9tT@-L@S~{HS^}gKsawW&($@<3^*c=cVFD
zc%kJWWB`#;&RMJ%nXqQjVM{s~PS|+uMdnjHkv&Z{oLBmljLeiNAqGw^sUQRQs%Dvn
zM9bWtbjl+llGlvG*rA?4VfikkyYo^X1=0V@mp$v(ja37+>(v#BzD>vRmn4bjGHL?b
zOKvi}prRA8S^WgY%LRLuY-KHUR1;C&$86QIQRcj;J8*!R5IZ)HN$63$HaR^mIFg0Q
zt$r`R#N8kRZYlybQ^|Wex*ayDr)xYr-R;th-9&-D!G_&$7R9=ncys0Xpg8Ky_09Fq
zCj#j*8QU&3(=-`z`3IFO#A`kuHg3EsBWS{kqNW`6-<_$!TMSJEe`6Az9bF~`mB_of
zIpzbw-<Y`?nU^xIfl>O}rlnYz&}kpeZ=k+PI6tw+(4~PulQ&)tV3g~Jk6>3&2rp8{
z%vGSMz)i`4LG4RLhXt|C;dt4wd5uE^-mvZI8Lts7)5KuPfEX5S0egv_6P=co@YQx^
zF_V%#djzJM(gJrCGG)97aqvUSpxyfJ1I%R8R_dM+NOU5jrG13aOS(c_??D&yFbs>+
z$mG*ReEj5G-{~8@(v#a?SnD|QD$<@65(GiYh@{|9BzZ|8ba!eaiIx&MmZ#Qh5H?{u
z$`{AFeCA%M+<BcSe(uJeM&@98Lzf_*mQ_VDVTDDCS2{_OClA@Sm7ZdlU3mTlr4Yv{
zd^=<9a@&DdPEGW=6(fgzC|{kvfALgUH)#%i?@Vi}q4hFJ1;w%g)U&w*&!&L|2Ssv@
zxzrRvH>WAOFdg6Yk@C73;ZnE;Fo)vZpAU0I^0M7*@lu<Q=N7i+U_z271x*8~`-TC&
zygwMiM^}o!t2oWaA5X9&(P<f$9gT->bHiikNkQ+Czy=8+^_APS+Vu$T4-_C250o%Q
z*(=Z2uNXU^NE-(-cDQNqAlaGE-)3j|kV6I;g}s3?>$ZTwz~AOn(1_~D##t%q&wrIp
z{o9CspC6A%ZxrDWn}x#)e4Z^av`p~i4E%o^Jv@O9B*P_T)uim%0S=8KkPUR7EjfK~
z1+DD(G4V}FUk1F6=-<B1gan?6TOob6im);PQpIP7*=Kv7w<^!i)<(5g>fihmE=v5A
zbMy?nL<7)1{$@A7+td!UT|UI_^qKZS?@aE&ilC%)k|J8l^seINoB;@EfmfynK$9ny
zaEa;@v^VU56DwvlXJRoBw9NQrB;V&8^B~J2L<l`_2t^>5-enZHFj=lQ?NA4^pmYAB
zV4!h&o0Jm#e>m_caqcHVIRwlp3lh%2q>{>upRECH%TO6QqA}4A*`+3+0DqmB`zzhx
ztwogs^twjX`}VG~9-R4Lmfk3)@|(0N1GH5R9RSCOl+?7^u&tS28X75tlX(z2Wh>-J
z0$}PG2bkk)Xuddfq^p{gIT}pB(E&dfr#~Jq)Q5IP(t)!tn{RT;+Jnw(&93|CjhzmF
zWO-uUpwFP^^8SG&0wuCkLK=j$s!~C3n9<s853^B+nDE@|cYO(*m*2=`n_rF=I}&~1
z;fG%VTs)GtNzT;==oeCwVo~Z)0nM8ok?nBaBL+z`e(v?Vj2!H``tkG6eXyh41M^DF
z5Vl690%`OCv=q3GwAIkPaDqf$1_6_>rDEOB{MWNQC%VL}VO0_hwzzd9RegkA2U`Xo
z^i0gZ9G(CExz3}pNE<3<NA}I};+OjKXOG5htl%KgTeQ_*B+x8CrQ9Bk#u{lszMS@!
zM5otoyrKAW<?BI?l2kWfWm<iD{-_d6ovg*o^3oGiR<=NN*tA8Ej33vCP>BH<juXOT
zVt}`uS%oV{sJCJd>OCMQ^?1p7Zv0%H3({%aW;Rt%9iBTdQwN6<jDQk4$w*~YV>aY-
z(~VuZE30R00Ooo2<{#LTQRo&G1gHhKm-VAXpozNfxf5&Y9r~J~06Wj9*AJv$0q8a*
zj<hDV0@VEjaOR(ug>p`LYc>zxZrgP#eccld<-8|^FBzlb7n7eagJx?!_)6VFxS^$=
z$ANCk#vNr`?sN>H?Rpxqieoo#aW_Rjuj2VfhaT_>LMIEfJ8YR^aEA~A6D&uh4eaM-
zd~5=Qx$NQ=`h!;|B@wtBp)Mq4+wykQ`hNF3!^m_940@Co1r<=a(4(EG1Bm~DUMKKn
zi&_T*(b&GPLH=53E3}$|#1}YMAPYud3Ft)ESWJEcKKB^5STlg>03c*cX6L8F*j*x7
z71`47iFz9P7;%zCT4OR^-^?~vfaLuyXgkIS=@Ym1c3euQH1xZ1cadmHPPYs8KZ=f1
z6vv{CvE(`RN{5TppQ2625NA~6&;qZEtW2i^q!dbL!2L*yhO+MB2!W32tNI^71X{?K
z8s&!gprj5{&Cr854IknGxiOHiyn#y?QgE62)bardji+5KU;-3HmsH@pa|}!>T+EAi
zPXh&^5c`VzvOea(OAmQ&VnD-ACSH{yy&u32l>o}J$@+gw0AO!4+8uZkG6RiSAgB@n
z%zq8X7XR3N!R$d-^)a%-&HaBDg@J-|-NXi3qB3xz!Rc>^4B*=h!|v*D)C&+TzeoRF
z>;VMgKf5UaeZ>E5or^#7?6d}VwKRTA>f5dlC{q2n&;2ljv&S5!ouoa)j4ZlH5mv}B
z4t(R51yGm?aJ(%X^8fMgfZX`EjYM?>cvWKY0UpD59;WXqXEbUt_AsD)J9d9M2<-{^
g=go#{nnRluPd9n!E2dcDDc~QSqlOv})NBI(KP^mqn*aa+

literal 0
HcmV?d00001

diff --git a/doc/user/application_security/index.md b/doc/user/application_security/index.md
index ffd9bb1a783..e0eec53a782 100644
--- a/doc/user/application_security/index.md
+++ b/doc/user/application_security/index.md
@@ -32,6 +32,25 @@ schedule. Coverage includes:
 - Vulnerabilities in a running web application.
 - Infrastructure as code configuration.
 
+Each of the GitLab application security tools is relevant to specific stages of the feature development workflow.
+
+- Commit
+  - SAST
+  - Secret Detection
+  - IaC Scanning
+  - Dependency Scanning
+  - License Scanning
+  - Coverage-guided Fuzz Testing
+- Build
+  - Container Scanning
+- Test
+  - API Security
+  - DAST
+- Deploy
+  - Operational Container Scanning
+
+![CI/CD stages and matching GitLab application security tools](img/secure_tools_and_cicd_stages.png)
+
 ### Source code analysis
 
 Source code analysis occurs on every code commit. Details of vulnerabilities detected are provided
@@ -48,7 +67,7 @@ Analysis of the web application occurs on every code commit. As part of the CI/C
 application is built, deployed to a test environment, and subjected to the following tests:
 
 - Test for known application vectors - [Dynamic Application Security Testing (DAST)](dast/index.md).
-- Analysis of APIs for known attack vectors - [DAST API](dast_api/index.md).
+- Analysis of APIs for known attack vectors - [API Security](dast_api/index.md).
 - Analysis of web APIs for unknown bugs and vulnerabilities - [API fuzzing](api_fuzzing/index.md).
 
 ### Dependency analysis
@@ -66,7 +85,7 @@ For more details, see
 [Dependency Scanning compared to Container Scanning](dependency_scanning/index.md#dependency-scanning-compared-to-container-scanning).
 
 Additionally, dependencies in operational container images can be analyzed for vulnerabilities
-on a regular schedule or cadence. For more details, see [Cluster Image Scanning](../clusters/agent/vulnerabilities.md).
+on a regular schedule or cadence. For more details, see [Operational Container Scanning](../../user/clusters/agent/vulnerabilities.md).
 
 ### Infrastructure analysis
 
@@ -486,6 +505,7 @@ Feedback is welcome on our vision for [unifying the user experience for these tw
 
 <!-- NOTE: The below subsection(`### Secure job failing with exit code 1`) documentation URL is referred in the [/gitlab-org/security-products/analyzers/command](https://gitlab.com/gitlab-org/security-products/analyzers/command/-/blob/main/command.go#L19) repository. If this section/subsection changes, please ensure to update the corresponding URL in the mentioned repository.
 -->
+
 ### Secure job failing with exit code 1
 
 WARNING:
diff --git a/doc/user/application_security/policies/scan-execution-policies.md b/doc/user/application_security/policies/scan-execution-policies.md
index ce0900aaf4e..da928c405a7 100644
--- a/doc/user/application_security/policies/scan-execution-policies.md
+++ b/doc/user/application_security/policies/scan-execution-policies.md
@@ -9,11 +9,11 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 > - Group-level security policies were [introduced](https://gitlab.com/groups/gitlab-org/-/epics/4425) in GitLab 15.2.
 > - Group-level security policies were [enabled on GitLab.com](https://gitlab.com/gitlab-org/gitlab/-/issues/356258) in GitLab 15.4.
 
-Group, sub-group, or project owners can use scan execution policies to require that security scans run on a specified
-schedule or with the project (or multiple projects if the policy is defined at a group or sub-group level) pipeline. Required scans are injected into the CI pipeline as new jobs
+Group, subgroup, or project owners can use scan execution policies to require that security scans run on a specified
+schedule or with the project (or multiple projects if the policy is defined at a group or subgroup level) pipeline. Required scans are injected into the CI pipeline as new jobs
 with a long, random job name. In the unlikely event of a job name collision, the security policy job overwrites
 any pre-existing job in the pipeline. If a policy is created at the group-level, it will apply to every child
-project or sub-group. A group-level policy cannot be edited from a child project or sub-group.
+project or subgroup. A group-level policy cannot be edited from a child project or subgroup.
 
 This feature has some overlap with [compliance framework pipelines](../../group/manage.md#configure-a-compliance-pipeline),
 as we have not [unified the user experience for these two features](https://gitlab.com/groups/gitlab-org/-/epics/7312).
@@ -29,7 +29,7 @@ an error appears that states `chosen stage does not exist`.
 ## Scan execution policy editor
 
 NOTE:
-Only group, sub-group, or project Owners have the [permissions](../../permissions.md#project-members-permissions)
+Only group, subgroup, or project Owners have the [permissions](../../permissions.md#project-members-permissions)
 to select Security Policy Project.
 
 Once your policy is complete, save it by selecting **Create via merge request**
diff --git a/doc/user/group/import/index.md b/doc/user/group/import/index.md
index b382b08dec9..ee50cfcf182 100644
--- a/doc/user/group/import/index.md
+++ b/doc/user/group/import/index.md
@@ -109,7 +109,7 @@ Items that are migrated to the target instance include:
 - Namespace Settings
 - Releases
   - Milestones ([Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/339422) in GitLab 15.0).
-- Sub-Groups
+- Subgroups
 - Uploads
 
 Any other items are **not** migrated.
diff --git a/doc/user/group/saml_sso/scim_setup.md b/doc/user/group/saml_sso/scim_setup.md
index 6b64288f5af..75160a53de3 100644
--- a/doc/user/group/saml_sso/scim_setup.md
+++ b/doc/user/group/saml_sso/scim_setup.md
@@ -207,7 +207,7 @@ For role information, please see the [Group SAML page](index.md#user-access-and-
 
 ### Blocking access
 
-To rescind access to the top-level group, all sub-groups, and projects, remove or deactivate the user
+To rescind access to the top-level group, all subgroups, and projects, remove or deactivate the user
 on the identity provider. After the identity provider performs a sync, based on its configured schedule, the user's membership is revoked and they lose access.
 
 NOTE:
diff --git a/doc/user/group/settings/group_access_tokens.md b/doc/user/group/settings/group_access_tokens.md
index 64cbe68a9d4..7ed36f8ab1e 100644
--- a/doc/user/group/settings/group_access_tokens.md
+++ b/doc/user/group/settings/group_access_tokens.md
@@ -147,7 +147,7 @@ The scope determines the actions you can perform when you authenticate with a gr
 
 ## Enable or disable group access token creation
 
-To enable or disable group access token creation for all sub-groups in a top-level group:
+To enable or disable group access token creation for all subgroups in a top-level group:
 
 1. On the top bar, select **Main menu > Groups** and find your group.
 1. On the left sidebar, select **Settings > General**.
diff --git a/doc/user/group/subgroups/index.md b/doc/user/group/subgroups/index.md
index 812888de5c2..58f5e476f26 100644
--- a/doc/user/group/subgroups/index.md
+++ b/doc/user/group/subgroups/index.md
@@ -201,7 +201,7 @@ role on an ancestor group, add the user to the subgroup again with a higher role
 ## Mention subgroups
 
 Mentioning subgroups ([`@<subgroup_name>`](../../discussions/index.md#mentions)) in issues, commits, and merge requests
-notifies all direct members of that group. Inherited members of a sub-group are not notified by mentions. Mentioning works the same as for projects and groups, and you can choose the group
+notifies all direct members of that group. Inherited members of a subgroup are not notified by mentions. Mentioning works the same as for projects and groups, and you can choose the group
 of people to be notified.
 
 <!-- ## Troubleshooting
diff --git a/doc/user/workspace/index.md b/doc/user/workspace/index.md
index 7818a89abe4..d7e014672aa 100644
--- a/doc/user/workspace/index.md
+++ b/doc/user/workspace/index.md
@@ -26,7 +26,7 @@ everything you do as a GitLab administrator, including:
 Our goal is to reach feature parity between SaaS and self-managed installations, with all
 [Admin Area settings](/ee/user/admin_area/settings/index.md) moving to either:
 
-- Groups. Available in the Workspace, top-level group namespaces, and sub-groups.
+- Groups. Available in the Workspace, top-level group namespaces, and subgroups.
 - Hardware Controls. For functionality that does not apply to groups, Hardware Controls are only
   applicable to self-managed installations. There is one Hardware Controls section per installation.
 
diff --git a/lib/gitlab/usage/metrics/instrumentations/work_items_activity_aggregated_metric.rb b/lib/gitlab/usage/metrics/instrumentations/work_items_activity_aggregated_metric.rb
new file mode 100644
index 00000000000..d045265495a
--- /dev/null
+++ b/lib/gitlab/usage/metrics/instrumentations/work_items_activity_aggregated_metric.rb
@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Usage
+    module Metrics
+      module Instrumentations
+        class WorkItemsActivityAggregatedMetric < AggregatedMetric
+          available? { Feature.enabled?(:track_work_items_activity) }
+        end
+      end
+    end
+  end
+end
diff --git a/lib/tasks/gitlab/tw/codeowners.rake b/lib/tasks/gitlab/tw/codeowners.rake
index c7353b9415d..3f11aefc74f 100644
--- a/lib/tasks/gitlab/tw/codeowners.rake
+++ b/lib/tasks/gitlab/tw/codeowners.rake
@@ -28,7 +28,6 @@ namespace :tw do
       CodeOwnerRule.new('Compliance', '@eread'),
       CodeOwnerRule.new('Composition Analysis', '@rdickenson'),
       CodeOwnerRule.new('Configure', '@phillipwells'),
-      CodeOwnerRule.new('Container Security', '@claytoncornell'),
       CodeOwnerRule.new('Contributor Experience', '@eread'),
       CodeOwnerRule.new('Conversion', '@kpaizee'),
       CodeOwnerRule.new('Database', '@aqualls'),
@@ -58,6 +57,7 @@ namespace :tw do
       CodeOwnerRule.new('Pipeline Execution', '@marcel.amirault'),
       CodeOwnerRule.new('Pipeline Insights', '@marcel.amirault'),
       CodeOwnerRule.new('Portfolio Management', '@msedlakjakubowski'),
+      CodeOwnerRule.new('Product Analytics', '@lciutacu'),
       CodeOwnerRule.new('Product Intelligence', '@claytoncornell'),
       CodeOwnerRule.new('Product Planning', '@msedlakjakubowski'),
       CodeOwnerRule.new('Project Management', '@msedlakjakubowski'),
@@ -68,6 +68,7 @@ namespace :tw do
       CodeOwnerRule.new('Respond', '@msedlakjakubowski'),
       CodeOwnerRule.new('Runner', '@sselhorn'),
       CodeOwnerRule.new('Pods', '@sselhorn'),
+      CodeOwnerRule.new('Security Policies', '@claytoncornell'),
       CodeOwnerRule.new('Source Code', '@aqualls'),
       CodeOwnerRule.new('Static Analysis', '@rdickenson'),
       CodeOwnerRule.new('Style Guide', '@sselhorn'),
diff --git a/qa/qa/page/base.rb b/qa/qa/page/base.rb
index 03f753b1d61..81c518bb4c6 100644
--- a/qa/qa/page/base.rb
+++ b/qa/qa/page/base.rb
@@ -242,6 +242,11 @@ module QA
       end
 
       def fill_element(name, content)
+        # `click_element_coordinates` is used to ensure the element is focused.
+        # Without it, flakiness can occur on pages with GitLab keyboard shortcuts enabled,
+        # where certain keys trigger actions when typed elsewhere on the page.
+        click_element_coordinates(name)
+
         find_element(name).set(content)
       end
 
diff --git a/qa/qa/page/component/namespace_select.rb b/qa/qa/page/component/namespace_select.rb
index 399c265c424..41a9975003f 100644
--- a/qa/qa/page/component/namespace_select.rb
+++ b/qa/qa/page/component/namespace_select.rb
@@ -21,7 +21,7 @@ module QA
           click_element :namespaces_list
 
           within_element(:namespaces_list) do
-            find_element(:namespaces_list_search).fill_in(with: item)
+            fill_element(:namespaces_list_search, item)
 
             wait_for_requests
 
diff --git a/qa/qa/page/merge_request/new.rb b/qa/qa/page/merge_request/new.rb
index 79eb4f2d51b..909b37943ff 100644
--- a/qa/qa/page/merge_request/new.rb
+++ b/qa/qa/page/merge_request/new.rb
@@ -38,7 +38,6 @@ module QA
 
         def click_diffs_tab
           click_element(:diffs_tab)
-          click_element(:dismiss_popover_button) if has_element?(:dismiss_popover_button, wait: 1)
         end
 
         def has_file?(file_name)
diff --git a/qa/qa/page/merge_request/show.rb b/qa/qa/page/merge_request/show.rb
index 2587241ed18..e1add9ad434 100644
--- a/qa/qa/page/merge_request/show.rb
+++ b/qa/qa/page/merge_request/show.rb
@@ -108,6 +108,7 @@ module QA
 
         view 'app/assets/javascripts/vue_shared/components/markdown/header.vue' do
           element :suggestion_button
+          element :dismiss_suggestion_popover_button
         end
 
         view 'app/assets/javascripts/vue_shared/components/markdown/suggestion_diff_header.vue' do
@@ -191,8 +192,11 @@ module QA
           wait_until(sleep_interval: 5) do
             has_css?('a[data-linenumber="1"]')
           end
+
           all_elements(:new_diff_line_link, minimum: 1).first.hover
           click_element(:diff_comment_button)
+          click_element(:dismiss_suggestion_popover_button) if has_element?(:dismiss_suggestion_popover_button, wait: 1)
+
           fill_element(:reply_field, text)
         end
 
@@ -208,7 +212,6 @@ module QA
 
         def click_diffs_tab
           click_element(:diffs_tab)
-          click_element(:dismiss_popover_button) if has_element?(:dismiss_popover_button, wait: 1)
         end
 
         def click_pipeline_link
diff --git a/spec/features/merge_request/user_interacts_with_batched_mr_diffs_spec.rb b/spec/features/merge_request/user_interacts_with_batched_mr_diffs_spec.rb
index f5b5460769e..07d99a786ba 100644
--- a/spec/features/merge_request/user_interacts_with_batched_mr_diffs_spec.rb
+++ b/spec/features/merge_request/user_interacts_with_batched_mr_diffs_spec.rb
@@ -6,8 +6,8 @@ RSpec.describe 'Batch diffs', :js do
   include MergeRequestDiffHelpers
   include RepoHelpers
 
-  let(:project) { create(:project, :repository) }
-  let(:merge_request) { create(:merge_request, source_project: project, source_branch: 'master', target_branch: 'empty-branch') }
+  let_it_be(:project) { create(:project, :repository) }
+  let_it_be(:merge_request) { create(:merge_request, source_project: project, source_branch: 'master', target_branch: 'empty-branch') }
 
   before do
     sign_in(project.first_owner)
diff --git a/spec/frontend/members/components/filter_sort/sort_dropdown_spec.js b/spec/frontend/members/components/filter_sort/sort_dropdown_spec.js
index 5581fd52458..ef3c8bde3cf 100644
--- a/spec/frontend/members/components/filter_sort/sort_dropdown_spec.js
+++ b/spec/frontend/members/components/filter_sort/sort_dropdown_spec.js
@@ -45,7 +45,7 @@ describe('SortDropdown', () => {
 
   const findSortingComponent = () => wrapper.findComponent(GlSorting);
   const findSortDirectionToggle = () =>
-    findSortingComponent().find('button[title="Sort direction"]');
+    findSortingComponent().find('button[title^="Sort direction"]');
   const findDropdownToggle = () => wrapper.find('button[aria-haspopup="true"]');
   const findDropdownItemByText = (text) =>
     wrapper
diff --git a/spec/helpers/form_helper_spec.rb b/spec/helpers/form_helper_spec.rb
index 4b76c370810..14ff5d97057 100644
--- a/spec/helpers/form_helper_spec.rb
+++ b/spec/helpers/form_helper_spec.rb
@@ -6,35 +6,85 @@ RSpec.describe FormHelper do
   include Devise::Test::ControllerHelpers
 
   describe '#dropdown_max_select' do
-    context "with the :limit_reviewer_and_assignee_size feature flag on" do
-      it 'correctly returns the max amount of reviewers or assignees to allow' do
-        max = MergeRequest::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS
+    let(:feature_flag) { :limit_reviewer_and_assignee_size }
 
-        expect(helper.dropdown_max_select({}))
+    context "with the :limit_reviewer_and_assignee_size feature flag on" do
+      before do
+        stub_feature_flags(feature_flag => true)
+      end
+
+      it 'correctly returns the max amount of reviewers or assignees to allow' do
+        max = Issuable::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS
+
+        expect(helper.dropdown_max_select({}, feature_flag))
           .to eq(max)
-        expect(helper.dropdown_max_select({ 'max-select'.to_sym => 5 }))
+        expect(helper.dropdown_max_select({ 'max-select'.to_sym => 5 }, feature_flag))
           .to eq(5)
-        expect(helper.dropdown_max_select({ 'max-select'.to_sym => max + 5 }))
+        expect(helper.dropdown_max_select({ 'max-select'.to_sym => max + 5 }, feature_flag))
           .to eq(max)
       end
     end
 
     context "with the :limit_reviewer_and_assignee_size feature flag off" do
       before do
-        stub_feature_flags(limit_reviewer_and_assignee_size: false)
+        stub_feature_flags(feature_flag => false)
       end
 
       it 'correctly returns the max amount of reviewers or assignees to allow' do
-        expect(helper.dropdown_max_select({}))
+        expect(helper.dropdown_max_select({}, feature_flag))
           .to eq(nil)
-        expect(helper.dropdown_max_select({ 'max-select'.to_sym => 5 }))
+        expect(helper.dropdown_max_select({ 'max-select'.to_sym => 5 }, feature_flag))
           .to eq(5)
-        expect(helper.dropdown_max_select({ 'max-select'.to_sym => 120 }))
+        expect(helper.dropdown_max_select({ 'max-select'.to_sym => 120 }, feature_flag))
           .to eq(120)
       end
     end
   end
 
+  describe '#assignees_dropdown_options' do
+    let(:merge_request) { build(:merge_request) }
+
+    context "with the :limit_assignees_per_issuable feature flag on" do
+      context "with multiple assignees" do
+        it 'correctly returns the max amount of assignees to allow' do
+          allow(helper).to receive(:merge_request_supports_multiple_assignees?).and_return(true)
+
+          expect(helper.assignees_dropdown_options(:merge_request)[:data][:'max-select'])
+            .to eq(Issuable::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS)
+        end
+      end
+
+      context "with only 1 assignee" do
+        it 'correctly returns the max amount of assignees to allow' do
+          expect(helper.assignees_dropdown_options(:merge_request)[:data][:'max-select'])
+            .to eq(1)
+        end
+      end
+    end
+
+    context "with the :limit_assignees_per_issuable feature flag off" do
+      before do
+        stub_feature_flags(limit_assignees_per_issuable: false)
+      end
+
+      context "with multiple assignees" do
+        it 'correctly returns the max amount of assignees to allow' do
+          allow(helper).to receive(:merge_request_supports_multiple_assignees?).and_return(true)
+
+          expect(helper.assignees_dropdown_options(:merge_request)[:data][:'max-select'])
+            .to eq(nil)
+        end
+      end
+
+      context "with only 1 assignee" do
+        it 'correctly returns the max amount of assignees to allow' do
+          expect(helper.assignees_dropdown_options(:merge_request)[:data][:'max-select'])
+            .to eq(1)
+        end
+      end
+    end
+  end
+
   describe '#reviewers_dropdown_options' do
     let(:merge_request) { build(:merge_request) }
 
@@ -44,7 +94,7 @@ RSpec.describe FormHelper do
           allow(helper).to receive(:merge_request_supports_multiple_reviewers?).and_return(true)
 
           expect(helper.reviewers_dropdown_options(merge_request)[:data][:'max-select'])
-            .to eq(MergeRequest::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS)
+            .to eq(Issuable::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS)
         end
       end
 
diff --git a/spec/helpers/wiki_helper_spec.rb b/spec/helpers/wiki_helper_spec.rb
index e798281ccff..06bc89b4950 100644
--- a/spec/helpers/wiki_helper_spec.rb
+++ b/spec/helpers/wiki_helper_spec.rb
@@ -79,14 +79,16 @@ RSpec.describe WikiHelper do
     let(:classes) { "gl-button btn btn-default btn-icon has-tooltip reverse-sort-btn qa-reverse-sort rspec-reverse-sort" }
 
     def expected_link(sort, direction, icon_class)
+      reversed_direction = direction == 'desc' ? 'asc' : 'desc'
       path =
         if sort
-          "/#{wiki.project.full_path}/-/wikis/pages?direction=#{direction}&sort=#{sort}"
+          "/#{wiki.project.full_path}/-/wikis/pages?direction=#{reversed_direction}&sort=#{sort}"
         else
-          "/#{wiki.project.full_path}/-/wikis/pages?direction=#{direction}"
+          "/#{wiki.project.full_path}/-/wikis/pages?direction=#{reversed_direction}"
         end
 
-      helper.link_to(path, type: 'button', class: classes, title: 'Sort direction') do
+      title = direction == 'desc' ? _('Sort direction: Descending') : _('Sort direction: Ascending')
+      helper.link_to(path, type: 'button', class: classes, title: title) do
         helper.sprite_icon("sort-#{icon_class}")
       end
     end
@@ -101,7 +103,7 @@ RSpec.describe WikiHelper do
         let(:direction) { nil }
 
         it 'renders with default values' do
-          expect(wiki_link).to eq(expected_link('title', 'desc', 'lowest'))
+          expect(wiki_link).to eq(expected_link('title', 'asc', 'lowest'))
         end
       end
 
@@ -110,7 +112,7 @@ RSpec.describe WikiHelper do
         let(:direction) { 'asc' }
 
         it 'renders a link with opposite direction' do
-          expect(wiki_link).to eq(expected_link('title', 'desc', 'lowest'))
+          expect(wiki_link).to eq(expected_link('title', 'aesc', 'lowest'))
         end
       end
 
@@ -119,7 +121,7 @@ RSpec.describe WikiHelper do
         let(:direction) { 'desc' }
 
         it 'renders a link with opposite direction' do
-          expect(wiki_link).to eq(expected_link('created_at', 'asc', 'highest'))
+          expect(wiki_link).to eq(expected_link('created_at', 'desc', 'highest'))
         end
       end
     end
@@ -134,7 +136,7 @@ RSpec.describe WikiHelper do
         let(:direction) { 'asc' }
 
         it 'ignores created_at and renders a link with opposite direction' do
-          expect(wiki_link).to eq(expected_link(nil, 'desc', 'lowest'))
+          expect(wiki_link).to eq(expected_link(nil, 'asc', 'lowest'))
         end
       end
 
@@ -143,7 +145,7 @@ RSpec.describe WikiHelper do
         let(:direction) { nil }
 
         it 'renders with default values' do
-          expect(wiki_link).to eq(expected_link(nil, 'desc', 'lowest'))
+          expect(wiki_link).to eq(expected_link(nil, 'asc', 'lowest'))
         end
       end
     end
diff --git a/spec/lib/gitlab/usage/metrics/instrumentations/work_items_activity_aggregated_metric_spec.rb b/spec/lib/gitlab/usage/metrics/instrumentations/work_items_activity_aggregated_metric_spec.rb
new file mode 100644
index 00000000000..c13a5ba4d72
--- /dev/null
+++ b/spec/lib/gitlab/usage/metrics/instrumentations/work_items_activity_aggregated_metric_spec.rb
@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::Usage::Metrics::Instrumentations::WorkItemsActivityAggregatedMetric do
+  let(:metric_definition) do
+    {
+      data_source: 'redis_hll',
+      time_frame: '7d',
+      options: {
+        aggregate: {
+          operator: 'OR'
+        },
+        events: %w[
+          users_creating_work_items
+          users_updating_work_item_title
+          users_updating_work_item_dates
+        ]
+      }
+    }
+  end
+
+  around do |example|
+    freeze_time { example.run }
+  end
+
+  describe '#available?' do
+    it 'returns false without track_work_items_activity feature' do
+      stub_feature_flags(track_work_items_activity: false)
+
+      expect(described_class.new(metric_definition).available?).to eq(false)
+    end
+
+    it 'returns true with track_work_items_activity feature' do
+      stub_feature_flags(track_work_items_activity: true)
+
+      expect(described_class.new(metric_definition).available?).to eq(true)
+    end
+  end
+
+  describe '#value', :clean_gitlab_redis_shared_state do
+    let(:counter) { Gitlab::UsageDataCounters::HLLRedisCounter }
+
+    before do
+      counter.track_event(:users_creating_work_items, values: 1, time: 1.week.ago)
+      counter.track_event(:users_updating_work_item_title, values: 1, time: 1.week.ago)
+      counter.track_event(:users_updating_work_item_dates, values: 2, time: 1.week.ago)
+    end
+
+    it 'has correct value' do
+      expect(described_class.new(metric_definition).value).to eq 2
+    end
+  end
+end
diff --git a/spec/models/concerns/issuable_spec.rb b/spec/models/concerns/issuable_spec.rb
index 6763cc904b4..8842a36f40a 100644
--- a/spec/models/concerns/issuable_spec.rb
+++ b/spec/models/concerns/issuable_spec.rb
@@ -75,6 +75,24 @@ RSpec.describe Issuable do
 
       it_behaves_like 'truncates the description to its allowed maximum length on import'
     end
+
+    describe '#validate_assignee_length' do
+      let(:assignee_1) { create(:user) }
+      let(:assignee_2) { create(:user) }
+      let(:assignee_3) { create(:user) }
+
+      subject { create(:merge_request) }
+
+      before do
+        stub_const("Issuable::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS", 2)
+      end
+
+      it 'will not exceed the assignee limit' do
+        expect do
+          subject.update!(assignees: [assignee_1, assignee_2, assignee_3])
+        end.to raise_error(ActiveRecord::RecordInvalid)
+      end
+    end
   end
 
   describe "Scope" do
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index cf1fd115882..97e9c51e21e 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -8336,6 +8336,22 @@ RSpec.describe Project, factory_default: :keep do
     end
   end
 
+  describe '#can_suggest_reviewers?' do
+    let_it_be(:project) { create(:project) }
+
+    subject(:can_suggest_reviewers) { project.can_suggest_reviewers? }
+
+    it { is_expected.to be(false) }
+  end
+
+  describe '#suggested_reviewers_available?' do
+    let_it_be(:project) { create(:project) }
+
+    subject(:suggested_reviewers_available) { project.suggested_reviewers_available? }
+
+    it { is_expected.to be(false) }
+  end
+
   private
 
   def finish_job(export_job)
diff --git a/spec/services/merge_requests/update_assignees_service_spec.rb b/spec/services/merge_requests/update_assignees_service_spec.rb
index 3a0b17c2768..2d80d75a262 100644
--- a/spec/services/merge_requests/update_assignees_service_spec.rb
+++ b/spec/services/merge_requests/update_assignees_service_spec.rb
@@ -36,6 +36,20 @@ RSpec.describe MergeRequests::UpdateAssigneesService do
       service.execute(merge_request)
     end
 
+    shared_examples 'it updates and enqueues the job' do
+      it 'correctly updates the MR and enqueues the job' do
+        expect_next(MergeRequests::HandleAssigneesChangeService, project: project, current_user: user) do |service|
+          expect(service)
+            .to receive(:async_execute).with(merge_request, [user3], execute_hooks: true)
+        end
+
+        expect { update_merge_request }
+          .to change { merge_request.reload.assignees }.from([user3]).to(new_users)
+          .and change(merge_request, :updated_at)
+          .and change(merge_request, :updated_by).to(user)
+      end
+    end
+
     shared_examples 'removing all assignees' do
       it 'removes all assignees' do
         expect(update_merge_request).to have_attributes(assignees: be_empty, errors: be_none)
@@ -73,16 +87,8 @@ RSpec.describe MergeRequests::UpdateAssigneesService do
         it_behaves_like 'removing all assignees'
       end
 
-      it 'updates the MR, and queues the more expensive work for later' do
-        expect_next(MergeRequests::HandleAssigneesChangeService, project: project, current_user: user) do |service|
-          expect(service)
-            .to receive(:async_execute).with(merge_request, [user3], execute_hooks: true)
-        end
-
-        expect { update_merge_request }
-          .to change { merge_request.reload.assignees }.from([user3]).to([user2])
-          .and change(merge_request, :updated_at)
-          .and change(merge_request, :updated_by).to(user)
+      it_behaves_like 'it updates and enqueues the job' do
+        let(:new_users) { [user2] }
       end
 
       it 'does not update the assignees if they do not have access' do
diff --git a/spec/services/projects/container_repository/cleanup_tags_service_spec.rb b/spec/services/projects/container_repository/cleanup_tags_service_spec.rb
index c430bb6e913..8311c4e4d9b 100644
--- a/spec/services/projects/container_repository/cleanup_tags_service_spec.rb
+++ b/spec/services/projects/container_repository/cleanup_tags_service_spec.rb
@@ -86,14 +86,6 @@ RSpec.describe Projects::ContainerRepository::CleanupTagsService do
           end
 
           it_behaves_like 'calling service', ::Projects::ContainerRepository::Gitlab::CleanupTagsService, extra_log_data: { gitlab_cleanup_tags_service: true }
-
-          context 'with container_registry_new_cleanup_service disabled' do
-            before do
-              stub_feature_flags(container_registry_new_cleanup_service: false)
-            end
-
-            it_behaves_like 'calling service', ::Projects::ContainerRepository::ThirdParty::CleanupTagsService, extra_log_data: { third_party_cleanup_tags_service: true }
-          end
         end
 
         context 'not supporting the gitlab api' do
diff --git a/spec/support/shared_examples/quick_actions/issuable/max_issuable_examples.rb b/spec/support/shared_examples/quick_actions/issuable/max_issuable_examples.rb
new file mode 100644
index 00000000000..e725de8ad31
--- /dev/null
+++ b/spec/support/shared_examples/quick_actions/issuable/max_issuable_examples.rb
@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+RSpec.shared_examples 'does not exceed the issuable size limit' do
+  let(:user1) { create(:user) }
+  let(:user2) { create(:user) }
+  let(:user3) { create(:user) }
+
+  before do
+    project.add_maintainer(user)
+    project.add_maintainer(user1)
+    project.add_maintainer(user2)
+    project.add_maintainer(user3)
+  end
+
+  context 'when feature flag is turned on' do
+    context "when the number of users of issuable does exceed the limit" do
+      before do
+        stub_const("Issuable::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS", 2)
+      end
+
+      it 'will not add more than the allowed number of users' do
+        allow_next_instance_of(update_service) do |service|
+          expect(service).not_to receive(:execute)
+        end
+
+        note = described_class.new(project, user, opts.merge(
+                                                    note: note_text,
+                                                    noteable_type: noteable_type,
+                                                    noteable_id: issuable.id,
+                                                    confidential: false
+                                                  )).execute
+
+        expect(note.errors[:validation]).to match_array([validation_message])
+      end
+    end
+
+    context "when the number of users does not exceed the limit" do
+      before do
+        stub_const("Issuable::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS", 6)
+      end
+
+      it 'calls execute and does not return an error' do
+        allow_next_instance_of(update_service) do |service|
+          expect(service).to receive(:execute).and_call_original
+        end
+
+        note = described_class.new(project, user, opts.merge(
+                                                    note: note_text,
+                                                    noteable_type: noteable_type,
+                                                    noteable_id: issuable.id,
+                                                    confidential: false
+                                                  )).execute
+
+        expect(note.errors[:validation]).to be_empty
+      end
+    end
+  end
+
+  context 'when feature flag is off' do
+    before do
+      stub_feature_flags(feature_flag_hash)
+    end
+
+    context "when the number of users of issuable does exceed the limit" do
+      before do
+        stub_const("Issuable::MAX_NUMBER_OF_ASSIGNEES_OR_REVIEWERS", 2)
+      end
+
+      it 'will not add more than the allowed number of users' do
+        allow_next_instance_of(MergeRequests::UpdateService) do |service|
+          expect(service).to receive(:execute).and_call_original
+        end
+
+        note = described_class.new(project, user, opts.merge(
+                                                    note: note_text,
+                                                    noteable_type: 'MergeRequest',
+                                                    noteable_id: issuable.id,
+                                                    confidential: false
+                                                  )).execute
+
+        expect(note.errors[:validation]).to be_empty
+      end
+    end
+  end
+end
diff --git a/workhorse/go.mod b/workhorse/go.mod
index b933692f997..664b63c3da4 100644
--- a/workhorse/go.mod
+++ b/workhorse/go.mod
@@ -26,7 +26,7 @@ require (
 	github.com/sirupsen/logrus v1.9.0
 	github.com/smartystreets/goconvey v1.7.2
 	github.com/stretchr/testify v1.8.0
-	gitlab.com/gitlab-org/gitaly/v15 v15.4.0
+	gitlab.com/gitlab-org/gitaly/v15 v15.4.2
 	gitlab.com/gitlab-org/golang-archive-zip v0.1.1
 	gitlab.com/gitlab-org/labkit v1.16.0
 	gocloud.dev v0.26.0
diff --git a/workhorse/go.sum b/workhorse/go.sum
index 7e2996a7148..e07588706b9 100644
--- a/workhorse/go.sum
+++ b/workhorse/go.sum
@@ -949,8 +949,8 @@ github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
 github.com/ziutek/mymysql v1.5.4/go.mod h1:LMSpPZ6DbqWFxNCHW77HeMg9I646SAhApZ/wKdgO/C0=
-gitlab.com/gitlab-org/gitaly/v15 v15.4.0 h1:fLGICSlAXbxxoat2dJt+DKrhRzdVkPXhMQUYKyFBDks=
-gitlab.com/gitlab-org/gitaly/v15 v15.4.0/go.mod h1:anANn2UwrECvFOEvLx8DkXYYDQ6g3+jmv0kP2VDYm70=
+gitlab.com/gitlab-org/gitaly/v15 v15.4.2 h1:evAILjEjT7M+pegcbP4QsViK4Hkt1I1IwJAr5AQjbdY=
+gitlab.com/gitlab-org/gitaly/v15 v15.4.2/go.mod h1:anANn2UwrECvFOEvLx8DkXYYDQ6g3+jmv0kP2VDYm70=
 gitlab.com/gitlab-org/golang-archive-zip v0.1.1 h1:35k9giivbxwF03+8A05Cm8YoxoakU8FBCj5gysjCTCE=
 gitlab.com/gitlab-org/golang-archive-zip v0.1.1/go.mod h1:ZDtqpWPGPB9qBuZnZDrKQjIdJtkN7ZAoVwhT6H2o2kE=
 gitlab.com/gitlab-org/labkit v1.16.0 h1:Vm3NAMZ8RqAunXlvPWby3GJ2R35vsYGP6Uu0YjyMIlY=