diff --git a/app/assets/javascripts/repository/pages/tree.vue b/app/assets/javascripts/repository/pages/tree.vue
index cbdc62624d4..6bf674eb3f1 100644
--- a/app/assets/javascripts/repository/pages/tree.vue
+++ b/app/assets/javascripts/repository/pages/tree.vue
@@ -1,5 +1,5 @@
 <script>
-import TreeContent from '../components/tree_content.vue';
+import TreeContent from 'jh_else_ce/repository/components/tree_content.vue';
 import preloadMixin from '../mixins/preload';
 import { updateElementsVisibility } from '../utils/dom';
 
diff --git a/app/controllers/concerns/authenticates_with_two_factor.rb b/app/controllers/concerns/authenticates_with_two_factor.rb
index da5b7ccfbf0..4228a93d310 100644
--- a/app/controllers/concerns/authenticates_with_two_factor.rb
+++ b/app/controllers/concerns/authenticates_with_two_factor.rb
@@ -25,7 +25,7 @@ module AuthenticatesWithTwoFactor
     session[:user_password_hash] = Digest::SHA256.hexdigest(user.encrypted_password)
     push_frontend_feature_flag(:webauthn)
 
-    if user.two_factor_webauthn_enabled?
+    if Feature.enabled?(:webauthn)
       setup_webauthn_authentication(user)
     else
       setup_u2f_authentication(user)
diff --git a/app/controllers/search_controller.rb b/app/controllers/search_controller.rb
index 0e285dae089..38af6dd0cde 100644
--- a/app/controllers/search_controller.rb
+++ b/app/controllers/search_controller.rb
@@ -150,7 +150,7 @@ class SearchController < ApplicationController
   end
 
   def block_anonymous_global_searches
-    return if params[:project_id].present? || params[:group_id].present?
+    return unless search_service.global_search?
     return if current_user
     return unless ::Feature.enabled?(:block_anonymous_global_searches, type: :ops)
 
@@ -160,7 +160,7 @@ class SearchController < ApplicationController
   end
 
   def check_scope_global_search_enabled
-    return if params[:project_id].present? || params[:group_id].present?
+    return unless search_service.global_search?
 
     search_allowed = case params[:scope]
                      when 'blobs'
diff --git a/app/models/user.rb b/app/models/user.rb
index a0209a51131..0435e872c22 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -917,6 +917,8 @@ class User < ApplicationRecord
   end
 
   def two_factor_u2f_enabled?
+    return false if Feature.enabled?(:webauthn)
+
     if u2f_registrations.loaded?
       u2f_registrations.any?
     else
diff --git a/app/services/search_service.rb b/app/services/search_service.rb
index 4ba1b3ade86..7c45f6ed120 100644
--- a/app/services/search_service.rb
+++ b/app/services/search_service.rb
@@ -45,6 +45,10 @@ class SearchService
     # overridden in EE
   end
 
+  def global_search?
+    project.blank? && group.blank?
+  end
+
   def show_snippets?
     return @show_snippets if defined?(@show_snippets)
 
diff --git a/doc/administration/monitoring/prometheus/index.md b/doc/administration/monitoring/prometheus/index.md
index e86ca596955..3268c0fc14c 100644
--- a/doc/administration/monitoring/prometheus/index.md
+++ b/doc/administration/monitoring/prometheus/index.md
@@ -259,9 +259,10 @@ To use an external Prometheus server:
            - 1.1.1.1:9229
      - job_name: gitlab-rails
        metrics_path: "/-/metrics"
+       scheme: https
        static_configs:
          - targets:
-           - 1.1.1.1:8080
+           - 1.1.1.1
      - job_name: gitlab-sidekiq
        static_configs:
          - targets:
@@ -287,6 +288,11 @@ To use an external Prometheus server:
            - 1.1.1.1:9236
    ```
 
+   WARNING:
+   The `gitlab-rails` job in the snippet assumes that GitLab is reachable through HTTPS. If your
+   deployment doesn't use HTTPS, the job configuration is adapted to use the `http` scheme and port
+   80.
+
 1. Reload the Prometheus server.
 
 ## Viewing performance metrics
diff --git a/doc/administration/troubleshooting/tracing_correlation_id.md b/doc/administration/troubleshooting/tracing_correlation_id.md
index 864bebbc848..3a0c6a30cde 100644
--- a/doc/administration/troubleshooting/tracing_correlation_id.md
+++ b/doc/administration/troubleshooting/tracing_correlation_id.md
@@ -2,13 +2,12 @@
 stage: Enablement
 group: Distribution
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
-type: reference
 ---
 
 # Finding relevant log entries with a correlation ID **(FREE SELF)**
 
-In GitLab 11.6 and later, a unique request tracking ID, known as the "correlation ID" has been
-logged by the GitLab instance for most requests. Each individual request to GitLab gets
+GitLab instances log a unique request tracking ID (known as the
+"correlation ID") for most requests. Each individual request to GitLab gets
 its own correlation ID, which then gets logged in each GitLab component's logs for that
 request. This makes it easier to trace behavior in a
 distributed system. Without this ID it can be difficult or
diff --git a/qa/qa/page/project/pipeline/show.rb b/qa/qa/page/project/pipeline/show.rb
index d45eeac46f6..83a49ae6361 100644
--- a/qa/qa/page/project/pipeline/show.rb
+++ b/qa/qa/page/project/pipeline/show.rb
@@ -77,7 +77,10 @@ module QA
           end
 
           def click_job(job_name)
-            click_element(:job_link, Project::Job::Show, text: job_name)
+            # Retry due to transient bug https://gitlab.com/gitlab-org/gitlab/-/issues/347126
+            QA::Support::Retrier.retry_on_exception do
+              click_element(:job_link, Project::Job::Show, text: job_name)
+            end
           end
 
           def child_pipelines
diff --git a/spec/controllers/search_controller_spec.rb b/spec/controllers/search_controller_spec.rb
index 73e8e0c7dd4..42960a8c3f7 100644
--- a/spec/controllers/search_controller_spec.rb
+++ b/spec/controllers/search_controller_spec.rb
@@ -172,6 +172,12 @@ RSpec.describe SearchController do
 
               expect(response).to redirect_to new_user_session_path
             end
+
+            it 'redirects to login page when trying to circumvent the restriction' do
+              get :show, params: { scope: 'projects', project_id: non_existing_record_id, search: '*' }
+
+              expect(response).to redirect_to new_user_session_path
+            end
           end
 
           context 'for authenticated user' do
diff --git a/spec/features/webauthn_spec.rb b/spec/features/webauthn_spec.rb
index 4eebc9d2c1e..215d1ff1cb6 100644
--- a/spec/features/webauthn_spec.rb
+++ b/spec/features/webauthn_spec.rb
@@ -113,124 +113,94 @@ RSpec.describe 'Using WebAuthn Devices for Authentication', :js do
   describe 'authentication' do
     let(:otp_required_for_login) { true }
     let(:user) { create(:user, webauthn_xid: WebAuthn.generate_user_id, otp_required_for_login: otp_required_for_login) }
+    let!(:webauthn_device) do
+      add_webauthn_device(app_id, user)
+    end
 
-    describe 'when there is only an U2F device' do
-      let!(:u2f_device) do
-        fake_device = U2F::FakeU2F.new(app_id) # "Client"
-        u2f = U2F::U2F.new(app_id) # "Server"
-
-        challenges = u2f.registration_requests.map(&:challenge)
-        device_response = fake_device.register_response(challenges[0])
-        device_registration_params = { device_response: device_response,
-                                       name: 'My device' }
-
-        U2fRegistration.register(user, app_id, device_registration_params, challenges)
-        FakeU2fDevice.new(page, 'My device', fake_device)
-      end
-
-      it 'falls back to U2F' do
-        # WebAuthn registration is automatically created with the U2fRegistration because of the after_create callback
-        # so we need to delete it
-        WebauthnRegistration.delete_all
+    describe 'when 2FA via OTP is disabled' do
+      let(:otp_required_for_login) { false }
 
+      it 'allows logging in with the WebAuthn device' do
         gitlab_sign_in(user)
 
-        u2f_device.respond_to_u2f_authentication
+        webauthn_device.respond_to_webauthn_authentication
 
         expect(page).to have_css('.sign-out-link', visible: false)
       end
     end
 
-    describe 'when there is a WebAuthn device' do
-      let!(:webauthn_device) do
-        add_webauthn_device(app_id, user)
+    describe 'when 2FA via OTP is enabled' do
+      it 'allows logging in with the WebAuthn device' do
+        gitlab_sign_in(user)
+
+        webauthn_device.respond_to_webauthn_authentication
+
+        expect(page).to have_css('.sign-out-link', visible: false)
       end
+    end
 
-      describe 'when 2FA via OTP is disabled' do
-        let(:otp_required_for_login) { false }
+    describe 'when a given WebAuthn device has already been registered by another user' do
+      describe 'but not the current user' do
+        let(:other_user) { create(:user, webauthn_xid: WebAuthn.generate_user_id, otp_required_for_login: otp_required_for_login) }
 
-        it 'allows logging in with the WebAuthn device' do
-          gitlab_sign_in(user)
-
-          webauthn_device.respond_to_webauthn_authentication
-
-          expect(page).to have_css('.sign-out-link', visible: false)
-        end
-      end
-
-      describe 'when 2FA via OTP is enabled' do
-        it 'allows logging in with the WebAuthn device' do
-          gitlab_sign_in(user)
-
-          webauthn_device.respond_to_webauthn_authentication
-
-          expect(page).to have_css('.sign-out-link', visible: false)
-        end
-      end
-
-      describe 'when a given WebAuthn device has already been registered by another user' do
-        describe 'but not the current user' do
-          let(:other_user) { create(:user, webauthn_xid: WebAuthn.generate_user_id, otp_required_for_login: otp_required_for_login) }
-
-          it 'does not allow logging in with that particular device' do
-            # Register other user with a different WebAuthn device
-            other_device = add_webauthn_device(app_id, other_user)
-
-            # Try authenticating user with the old WebAuthn device
-            gitlab_sign_in(user)
-            other_device.respond_to_webauthn_authentication
-            expect(page).to have_content('Authentication via WebAuthn device failed')
-          end
-        end
-
-        describe "and also the current user" do
-          # TODO Uncomment once WebAuthn::FakeClient supports passing credential options
-          # (especially allow_credentials, as this is needed to specify which credential the
-          # fake client should use. Currently, the first credential is always used).
-          # There is an issue open for this: https://github.com/cedarcode/webauthn-ruby/issues/259
-          it "allows logging in with that particular device" do
-            pending("support for passing credential options in FakeClient")
-            # Register current user with the same WebAuthn device
-            current_user = gitlab_sign_in(:user)
-            visit profile_account_path
-            manage_two_factor_authentication
-            register_webauthn_device(webauthn_device)
-            gitlab_sign_out
-
-            # Try authenticating user with the same WebAuthn device
-            gitlab_sign_in(current_user)
-            webauthn_device.respond_to_webauthn_authentication
-
-            expect(page).to have_css('.sign-out-link', visible: false)
-          end
-        end
-      end
-
-      describe 'when a given WebAuthn device has not been registered' do
         it 'does not allow logging in with that particular device' do
-          unregistered_device = FakeWebauthnDevice.new(page, 'My device')
-          gitlab_sign_in(user)
-          unregistered_device.respond_to_webauthn_authentication
+          # Register other user with a different WebAuthn device
+          other_device = add_webauthn_device(app_id, other_user)
 
+          # Try authenticating user with the old WebAuthn device
+          gitlab_sign_in(user)
+          other_device.respond_to_webauthn_authentication
           expect(page).to have_content('Authentication via WebAuthn device failed')
         end
       end
 
-      describe 'when more than one device has been registered by the same user' do
-        it 'allows logging in with either device' do
-          first_device = add_webauthn_device(app_id, user)
-          second_device = add_webauthn_device(app_id, user)
+      describe "and also the current user" do
+        # TODO Uncomment once WebAuthn::FakeClient supports passing credential options
+        # (especially allow_credentials, as this is needed to specify which credential the
+        # fake client should use. Currently, the first credential is always used).
+        # There is an issue open for this: https://github.com/cedarcode/webauthn-ruby/issues/259
+        it "allows logging in with that particular device" do
+          pending("support for passing credential options in FakeClient")
+          # Register current user with the same WebAuthn device
+          current_user = gitlab_sign_in(:user)
+          visit profile_account_path
+          manage_two_factor_authentication
+          register_webauthn_device(webauthn_device)
+          gitlab_sign_out
 
-          # Authenticate as both devices
-          [first_device, second_device].each do |device|
-            gitlab_sign_in(user)
-            # register_webauthn_device(device)
-            device.respond_to_webauthn_authentication
+          # Try authenticating user with the same WebAuthn device
+          gitlab_sign_in(current_user)
+          webauthn_device.respond_to_webauthn_authentication
 
-            expect(page).to have_css('.sign-out-link', visible: false)
+          expect(page).to have_css('.sign-out-link', visible: false)
+        end
+      end
+    end
 
-            gitlab_sign_out
-          end
+    describe 'when a given WebAuthn device has not been registered' do
+      it 'does not allow logging in with that particular device' do
+        unregistered_device = FakeWebauthnDevice.new(page, 'My device')
+        gitlab_sign_in(user)
+        unregistered_device.respond_to_webauthn_authentication
+
+        expect(page).to have_content('Authentication via WebAuthn device failed')
+      end
+    end
+
+    describe 'when more than one device has been registered by the same user' do
+      it 'allows logging in with either device' do
+        first_device = add_webauthn_device(app_id, user)
+        second_device = add_webauthn_device(app_id, user)
+
+        # Authenticate as both devices
+        [first_device, second_device].each do |device|
+          gitlab_sign_in(user)
+          # register_webauthn_device(device)
+          device.respond_to_webauthn_authentication
+
+          expect(page).to have_css('.sign-out-link', visible: false)
+
+          gitlab_sign_out
         end
       end
     end
diff --git a/spec/frontend/repository/components/tree_content_spec.js b/spec/frontend/repository/components/tree_content_spec.js
index 49397c77215..bc12577fa8e 100644
--- a/spec/frontend/repository/components/tree_content_spec.js
+++ b/spec/frontend/repository/components/tree_content_spec.js
@@ -2,7 +2,7 @@ import { shallowMount } from '@vue/test-utils';
 import paginatedTreeQuery from 'shared_queries/repository/paginated_tree.query.graphql';
 import FilePreview from '~/repository/components/preview/index.vue';
 import FileTable from '~/repository/components/table/index.vue';
-import TreeContent from '~/repository/components/tree_content.vue';
+import TreeContent from 'jh_else_ce/repository/components/tree_content.vue';
 import { loadCommits, isRequested, resetRequestedCommits } from '~/repository/commits_service';
 
 jest.mock('~/repository/commits_service', () => ({
diff --git a/spec/helpers/numbers_helper_spec.rb b/spec/helpers/numbers_helper_spec.rb
new file mode 100644
index 00000000000..a546f625ce8
--- /dev/null
+++ b/spec/helpers/numbers_helper_spec.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe NumbersHelper do
+  describe '#limited_counter_with_delimiter' do
+    using RSpec::Parameterized::TableSyntax
+
+    subject { limited_counter_with_delimiter(resource, **options) }
+
+    where(:count, :options, :expected_result) do
+      # Using explicit limit
+      9    | { limit: 10 } | '9'
+      10   | { limit: 10 } | '10'
+      11   | { limit: 10 } | '10+'
+      12   | { limit: 10 } | '10+'
+      # Using default limit
+      999  | {}            | '999'
+      1000 | {}            | '1,000'
+      1001 | {}            | '1,000+'
+      1002 | {}            | '1,000+'
+    end
+
+    with_them do
+      let(:page) { double('page', total_count_with_limit: [count, options.fetch(:limit, 1000) + 1].min) }
+      let(:resource) { class_double(Ci::Runner, page: page) }
+
+      it { is_expected.to eq(expected_result) }
+    end
+  end
+end
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index e8052341299..9aa67057fca 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -1726,6 +1726,52 @@ RSpec.describe User do
     end
   end
 
+  context 'two_factor_u2f_enabled?' do
+    let_it_be(:user) { create(:user, :two_factor) }
+
+    context 'when webauthn feature flag is enabled' do
+      context 'user has no U2F registration' do
+        it { expect(user.two_factor_u2f_enabled?).to eq(false) }
+      end
+
+      context 'user has existing U2F registration' do
+        it 'returns false' do
+          device = U2F::FakeU2F.new(FFaker::BaconIpsum.characters(5))
+          create(:u2f_registration, name: 'my u2f device',
+                 user: user,
+                 certificate: Base64.strict_encode64(device.cert_raw),
+                 key_handle: U2F.urlsafe_encode64(device.key_handle_raw),
+                 public_key: Base64.strict_encode64(device.origin_public_key_raw))
+
+          expect(user.two_factor_u2f_enabled?).to eq(false)
+        end
+      end
+    end
+
+    context 'when webauthn feature flag is disabled' do
+      before do
+        stub_feature_flags(webauthn: false)
+      end
+
+      context 'user has no U2F registration' do
+        it { expect(user.two_factor_u2f_enabled?).to eq(false) }
+      end
+
+      context 'user has existing U2F registration' do
+        it 'returns true' do
+          device = U2F::FakeU2F.new(FFaker::BaconIpsum.characters(5))
+          create(:u2f_registration, name: 'my u2f device',
+                 user: user,
+                 certificate: Base64.strict_encode64(device.cert_raw),
+                 key_handle: U2F.urlsafe_encode64(device.key_handle_raw),
+                 public_key: Base64.strict_encode64(device.origin_public_key_raw))
+
+          expect(user.two_factor_u2f_enabled?).to eq(true)
+        end
+      end
+    end
+  end
+
   describe 'projects' do
     before do
       @user = create(:user)