Add latest changes from gitlab-org/gitlab@master

45 files changed, 365 insertions, 403 deletions

diff --git a/.gitlab/ci/qa-common/main.gitlab-ci.yml b/.gitlab/ci/qa-common/main.gitlab-ci.yml
index 3f33b3e8451..7a812ed5dad 100644
--- a/.gitlab/ci/qa-common/main.gitlab-ci.yml
+++ b/.gitlab/ci/qa-common/main.gitlab-ci.yml
@@ -223,17 +223,14 @@ stages:
     - .qa-install
     - .ruby-image
   stage: report
-  variables:
-    QA_TESTCASE_SESSIONS_PROJECT: gitlab-org/quality/testcase-sessions
-    QA_RSPEC_JSON_FILE_PATTERN: $CI_PROJECT_DIR/gitlab-qa-run-*/**/rspec-*.json
-    GITLAB_QA_ACCESS_TOKEN: $QA_TEST_SESSION_TOKEN
-    GITLAB_CI_API_TOKEN: $QA_GITLAB_CI_TOKEN
   when: always
   script:
     - |
-      bundle exec gitlab-qa-report \
-        --generate-test-session "$QA_RSPEC_JSON_FILE_PATTERN" \
-        --project "$QA_TESTCASE_SESSIONS_PROJECT"
+      bundle exec generate-test-session \
+        --input-files "${CI_PROJECT_DIR}/gitlab-qa-run-*/**/rspec-*.json" \
+        --project "gitlab-org/quality/testcase-sessions" \
+        --token "${QA_TEST_SESSION_TOKEN}" \
+        --ci-project-token "${GENERATE_TEST_SESSION_READ_API_REPORTER_TOKEN}" > REPORT_ISSUE_URL
   artifacts:
     when: always
     expire_in: 1d
diff --git a/.rubocop_todo/sidekiq_load_balancing/worker_data_consistency.yml b/.rubocop_todo/sidekiq_load_balancing/worker_data_consistency.yml
index d8d16220d5f..a7311c1c6df 100644
--- a/.rubocop_todo/sidekiq_load_balancing/worker_data_consistency.yml
+++ b/.rubocop_todo/sidekiq_load_balancing/worker_data_consistency.yml
@@ -92,7 +92,6 @@ SidekiqLoadBalancing/WorkerDataConsistency:
     - 'app/workers/dependency_proxy/cleanup_dependency_proxy_worker.rb'
     - 'app/workers/dependency_proxy/cleanup_manifest_worker.rb'
     - 'app/workers/dependency_proxy/image_ttl_group_policy_worker.rb'
-    - 'app/workers/deployments/drop_older_deployments_worker.rb'
     - 'app/workers/deployments/link_merge_request_worker.rb'
     - 'app/workers/deployments/update_environment_worker.rb'
     - 'app/workers/design_management/copy_design_collection_worker.rb'
diff --git a/app/assets/stylesheets/framework/common.scss b/app/assets/stylesheets/framework/common.scss
index febb597e26e..56ef6d13252 100644
--- a/app/assets/stylesheets/framework/common.scss
+++ b/app/assets/stylesheets/framework/common.scss
@@ -5,6 +5,9 @@
   --top-bar-height: 0px;
   --system-footer-height: 0px;
   --mr-review-bar-height: 0px;
+
+  --application-bar-left: 0px;
+  --application-bar-right: 0px;
 }
 
 .with-performance-bar {
@@ -27,6 +30,42 @@
   --mr-review-bar-height: #{$mr-review-bar-height};
 }
 
+@include media-breakpoint-up(md) {
+  .page-with-contextual-sidebar {
+    --application-bar-left: #{$contextual-sidebar-collapsed-width};
+  }
+
+  .right-sidebar-collapsed {
+    --application-bar-right: #{$gutter-collapsed-width};
+
+    &.is-merge-request {
+      --application-bar-right: 0px;
+    }
+  }
+
+  .right-sidebar-expanded {
+    --application-bar-right: #{$gutter-width};
+  }
+}
+
+@include media-breakpoint-up(xl) {
+  .page-with-contextual-sidebar {
+    --application-bar-left: #{$contextual-sidebar-width};
+  }
+
+  .page-with-icon-sidebar {
+    --application-bar-left: #{$contextual-sidebar-collapsed-width};
+  }
+
+  .page-with-super-sidebar {
+    --application-bar-left: #{$super-sidebar-width};
+  }
+
+  .page-with-super-sidebar-collapsed {
+    --application-bar-left: 0px;
+  }
+}
+
 /** COLORS **/
 .cgray { color: $gl-text-color; }
 .clgray { color: $gray-200; }
diff --git a/app/assets/stylesheets/framework/header.scss b/app/assets/stylesheets/framework/header.scss
index a5ff3c9c980..0c53b3fd866 100644
--- a/app/assets/stylesheets/framework/header.scss
+++ b/app/assets/stylesheets/framework/header.scss
@@ -317,42 +317,22 @@ $search-input-field-x-min-width: 200px;
 }
 
 .top-bar-fixed {
+  @include gl-inset-border-b-1-gray-100;
   background-color: $body-bg;
-  left: 0;
+  left: var(--application-bar-left);
   position: fixed;
-  right: 0;
+  right: var(--application-bar-right);
   top: $calc-application-bars-height;
   width: auto;
   z-index: $top-bar-z-index;
-  @include gl-inset-border-b-1-gray-100;
-
-  .breadcrumbs-list {
-    @include media-breakpoint-down(xs) {
-      flex-wrap: nowrap;
-    }
-  }
 
   @media (prefers-reduced-motion: no-preference) {
     transition: left $gl-transition-duration-medium, right $gl-transition-duration-medium;
   }
 
-  @include media-breakpoint-up(md) {
-    .right-sidebar-collapsed & {
-      right: $gutter-collapsed-width;
-    }
-
-    .right-sidebar-expanded & {
-      right: $gutter-width;
-    }
-  }
-
-  @include media-breakpoint-up(xl) {
-    .page-with-super-sidebar & {
-      left: $super-sidebar-width;
-    }
-
-    .page-with-super-sidebar-collapsed & {
-      left: 0;
+  .breadcrumbs-list {
+    @include media-breakpoint-down(xs) {
+      flex-wrap: nowrap;
     }
   }
 }
diff --git a/app/assets/stylesheets/framework/sidebar.scss b/app/assets/stylesheets/framework/sidebar.scss
index 74d5c64f57d..f2486640650 100644
--- a/app/assets/stylesheets/framework/sidebar.scss
+++ b/app/assets/stylesheets/framework/sidebar.scss
@@ -56,7 +56,7 @@
   z-index: $zindex-dropdown-menu;
 
   &.right-sidebar-merge-requests {
-    width: 300px;
+    width: $gutter-width;
 
     @include media-breakpoint-up(md) {
       z-index: auto;
@@ -319,7 +319,7 @@
     @include right-sidebar;
     top: calc(#{$header-height} + #{$calc-application-bars-height});
 
-    @include media-breakpoint-down(sm) {
+    @include media-breakpoint-down(md) {
       z-index: 251;
     }
   }
@@ -327,9 +327,13 @@
   &.right-sidebar-merge-requests {
     @include media-breakpoint-down(md) {
       @include right-sidebar;
-      top: $calc-application-header-height;
+      top: calc(#{$header-height} + #{$calc-application-bars-height});
       z-index: 251;
     }
+
+    @include media-breakpoint-down(sm) {
+      top: $calc-application-header-height;
+    }
   }
 
   a:not(.btn) {
diff --git a/app/assets/stylesheets/page_bundles/merge_requests.scss b/app/assets/stylesheets/page_bundles/merge_requests.scss
index d3ebc06a1dd..17ca7828a20 100644
--- a/app/assets/stylesheets/page_bundles/merge_requests.scss
+++ b/app/assets/stylesheets/page_bundles/merge_requests.scss
@@ -964,7 +964,7 @@ $tabs-holder-z-index: 250;
 .merge-request-overview {
   @include media-breakpoint-up(lg) {
     display: grid;
-    grid-template-columns: calc(97% - 285px) auto;
+    grid-template-columns: calc(97% - #{$gutter-width}) auto;
     grid-gap: 3%;
   }
 }
@@ -1081,30 +1081,6 @@ $tabs-holder-z-index: 250;
   box-shadow: 0 1px 4px rgba($gray-300, 0.4);
 }
 
-.page-with-contextual-sidebar .merge-request-sticky-header {
-  --width: calc(100% - #{$contextual-sidebar-width});
-
-  @include media-breakpoint-down(lg) {
-    --width: calc(100% - #{$contextual-sidebar-collapsed-width});
-  }
-}
-
-.page-with-icon-sidebar .issue-sticky-header {
-  --width: calc(100% - #{$contextual-sidebar-collapsed-width});
-}
-
-.page-with-super-sidebar .merge-request-sticky-header {
-  @include media-breakpoint-up(xl) {
-    --width: calc(100% - #{$super-sidebar-width});
-  }
-}
-
-.page-with-super-sidebar-collapsed .merge-request-sticky-header {
-  @include media-breakpoint-up(xl) {
-    --width: 100%;
-  }
-}
-
 .merge-request-notification-toggle {
   .gl-toggle {
     @include gl-ml-auto;
diff --git a/app/assets/stylesheets/pages/issues.scss b/app/assets/stylesheets/pages/issues.scss
index 9b6a3362e71..36efe42aed1 100644
--- a/app/assets/stylesheets/pages/issues.scss
+++ b/app/assets/stylesheets/pages/issues.scss
@@ -250,16 +250,10 @@ ul.related-merge-requests > li gl-emoji {
 }
 
 .issue-sticky-header {
-  --width: 100%;
-
-  @include gl-left-0;
-  width: var(--width);
+  left: var(--application-bar-left);
+  right: var(--application-bar-right);
+  width: auto;
   top: $calc-application-header-height;
-
-  // collapsed right sidebar
-  @include media-breakpoint-up(sm) {
-    --width: calc(100% - #{$gutter-collapsed-width});
-  }
 }
 
 .limit-container-width {
@@ -268,77 +262,6 @@ ul.related-merge-requests > li gl-emoji {
   }
 }
 
-@include media-breakpoint-up(md) {
-  // collapsed left sidebar + collapsed right sidebar
-  .page-with-contextual-sidebar .issue-sticky-header {
-    left: $contextual-sidebar-collapsed-width;
-    --width: calc(100% - #{$contextual-sidebar-collapsed-width} - #{$gutter-collapsed-width});
-  }
-
-  // collapsed left sidebar + expanded right sidebar
-  .page-with-contextual-sidebar.right-sidebar-expanded .issue-sticky-header {
-    --width: calc(100% - #{$contextual-sidebar-collapsed-width} - #{$gutter-width});
-  }
-
-  // collapsed super sidebar + collapsed right sidebar
-  .page-with-super-sidebar .issue-sticky-header {
-    --width: calc(100% - #{$gutter-collapsed-width});
-  }
-
-  // collapsed super sidebar + expanded right sidebar
-  .page-with-super-sidebar.right-sidebar-expanded .issue-sticky-header {
-    --width: calc(100% - #{$gutter-width});
-  }
-}
-
-@include media-breakpoint-up(xl) {
-  // expanded left sidebar + collapsed right sidebar
-  .page-with-contextual-sidebar .issue-sticky-header {
-    left: $contextual-sidebar-width;
-    --width: calc(100% - #{$contextual-sidebar-width} - #{$gutter-collapsed-width});
-  }
-
-  // collapsed left sidebar + collapsed right sidebar
-  .page-with-icon-sidebar .issue-sticky-header {
-    left: $contextual-sidebar-collapsed-width;
-    --width: calc(100% - #{$contextual-sidebar-collapsed-width} - #{$gutter-collapsed-width});
-  }
-
-  // expanded left sidebar + expanded right sidebar
-  .page-with-contextual-sidebar.right-sidebar-expanded .issue-sticky-header {
-    --width: calc(100% - #{$contextual-sidebar-width} - #{$gutter-width});
-  }
-
-  // collapsed left sidebar + expanded right sidebar
-  .page-with-contextual-sidebar.right-sidebar-expanded.page-with-icon-sidebar .issue-sticky-header {
-    --width: calc(100% - #{$contextual-sidebar-collapsed-width} - #{$gutter-width});
-  }
-
-  // expanded super sidebar + collapsed right sidebar
-  .page-with-super-sidebar .issue-sticky-header {
-    left: $super-sidebar-width;
-    --width: calc(100% - #{$super-sidebar-width} - #{$gutter-collapsed-width});
-  }
-
-  // collapsed super sidebar + collapsed right sidebar
-  .page-with-super-sidebar-collapsed .issue-sticky-header {
-    left: 0;
-    --width: calc(100% - #{$gutter-collapsed-width});
-  }
-
-  // expanded super sidebar + expanded right sidebar
-  .page-with-super-sidebar.right-sidebar-expanded .issue-sticky-header {
-    left: $super-sidebar-width;
-    --width: calc(100% - #{$super-sidebar-width} - #{$gutter-width});
-  }
-
-  // collapsed super sidebar + expanded right sidebar
-  .page-with-super-sidebar-collapsed.right-sidebar-expanded .issue-sticky-header {
-    left: 0;
-    --width: calc(100% - #{$gutter-width});
-  }
-}
-
 .issuable-header-slide-enter-active,
 .issuable-header-slide-leave-active {
   @include gl-transition-medium;
diff --git a/app/assets/stylesheets/startup/startup-dark.scss b/app/assets/stylesheets/startup/startup-dark.scss
index bb838437939..74ffebd44ec 100644
--- a/app/assets/stylesheets/startup/startup-dark.scss
+++ b/app/assets/stylesheets/startup/startup-dark.scss
@@ -635,6 +635,25 @@ html {
 .with-top-bar {
   --top-bar-height: 48px;
 }
+@media (min-width: 768px) {
+  .page-with-contextual-sidebar {
+    --application-bar-left: 56px;
+  }
+}
+@media (min-width: 1200px) {
+  .page-with-contextual-sidebar {
+    --application-bar-left: 256px;
+  }
+  .page-with-icon-sidebar {
+    --application-bar-left: 56px;
+  }
+  .page-with-super-sidebar {
+    --application-bar-left: 256px;
+  }
+  .page-with-super-sidebar-collapsed {
+    --application-bar-left: 0px;
+  }
+}
 .gl-font-sm {
   font-size: 12px;
 }
diff --git a/app/assets/stylesheets/startup/startup-general.scss b/app/assets/stylesheets/startup/startup-general.scss
index 079e59f5521..c5a5d1aa289 100644
--- a/app/assets/stylesheets/startup/startup-general.scss
+++ b/app/assets/stylesheets/startup/startup-general.scss
@@ -635,6 +635,25 @@ html {
 .with-top-bar {
   --top-bar-height: 48px;
 }
+@media (min-width: 768px) {
+  .page-with-contextual-sidebar {
+    --application-bar-left: 56px;
+  }
+}
+@media (min-width: 1200px) {
+  .page-with-contextual-sidebar {
+    --application-bar-left: 256px;
+  }
+  .page-with-icon-sidebar {
+    --application-bar-left: 56px;
+  }
+  .page-with-super-sidebar {
+    --application-bar-left: 256px;
+  }
+  .page-with-super-sidebar-collapsed {
+    --application-bar-left: 0px;
+  }
+}
 .gl-font-sm {
   font-size: 12px;
 }
diff --git a/app/workers/all_queues.yml b/app/workers/all_queues.yml
index d6f410f4b1d..3eb80292a2f 100644
--- a/app/workers/all_queues.yml
+++ b/app/workers/all_queues.yml
@@ -930,15 +930,6 @@
   :weight: 3
   :idempotent: true
   :tags: []
-- :name: deployment:deployments_drop_older_deployments
-  :worker_name: Deployments::DropOlderDeploymentsWorker
-  :feature_category: :continuous_delivery
-  :has_external_dependencies: false
-  :urgency: :low
-  :resource_boundary: :unknown
-  :weight: 3
-  :idempotent: false
-  :tags: []
 - :name: deployment:deployments_hooks
   :worker_name: Deployments::HooksWorker
   :feature_category: :continuous_delivery
diff --git a/app/workers/deployments/drop_older_deployments_worker.rb b/app/workers/deployments/drop_older_deployments_worker.rb
deleted file mode 100644
index 5f252122232..00000000000
--- a/app/workers/deployments/drop_older_deployments_worker.rb
+++ /dev/null
@@ -1,16 +0,0 @@
-# frozen_string_literal: true
-
-module Deployments
-  class DropOlderDeploymentsWorker # rubocop:disable Scalability/IdempotentWorker
-    include ApplicationWorker
-
-    data_consistency :always
-
-    sidekiq_options retry: 3
-
-    queue_namespace :deployment
-    feature_category :continuous_delivery
-
-    def perform(deployment_id); end
-  end
-end
diff --git a/config/feature_flags/development/ci_enforce_rate_limits_jobs_api.yml b/config/feature_flags/development/ci_enforce_rate_limits_jobs_api.yml
deleted file mode 100644
index 14c435f294a..00000000000
--- a/config/feature_flags/development/ci_enforce_rate_limits_jobs_api.yml
+++ /dev/null
@@ -1,8 +0,0 @@
----
-name: ci_enforce_rate_limits_jobs_api
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/104912
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/384186
-milestone: '15.7'
-type: development
-group: group::pipeline execution
-default_enabled: false
diff --git a/config/feature_flags/development/instance_streaming_audit_events.yml b/config/feature_flags/development/instance_streaming_audit_events.yml
new file mode 100644
index 00000000000..964d7ac7cbd
--- /dev/null
+++ b/config/feature_flags/development/instance_streaming_audit_events.yml
@@ -0,0 +1,8 @@
+---
+name: instance_streaming_audit_events
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/119008
+rollout_issue_url:
+milestone: '16.0'
+type: development
+group: group::compliance
+default_enabled: false
diff --git a/data/deprecations/16-0-deprecate-omnibus-grafana.yml b/data/deprecations/16-0-deprecate-omnibus-grafana.yml
new file mode 100644
index 00000000000..815c60099e9
--- /dev/null
+++ b/data/deprecations/16-0-deprecate-omnibus-grafana.yml
@@ -0,0 +1,23 @@
+- title: "Bundled Grafana deprecated and disabled"
+  removal_milestone: "16.3"
+  announcement_milestone: "16.0"
+  breaking_change: true
+  reporter: twk3
+  stage: Enablement
+  issue_url: https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/7772
+  body: |  # (required) Do not modify this line, instead modify the lines below.
+    The version of [Grafana bundled with Omnibus GitLab](https://docs.gitlab.com/omnibus/settings/grafana.html) is
+    disabled in 16.0 and will be removed in 16.3.
+    If you are using the bundled Grafana, you must migrate to either:
+
+    - Another implementation of Grafana. For more information, see
+      [Switch to new Grafana instance](https://docs.gitlab.com/ee/administration/monitoring/performance/grafana_configuration.html#switch-to-new-grafana-instance).
+    - Another observability platform of your choice.
+
+    The version of Grafana that is currently provided is no longer a supported version.
+
+    In GitLab versions 16.0 to 16.2, you can still [re-enable the bundled Grafana](https://docs.gitlab.com/ee/administration/monitoring/performance/grafana_configuration.html#temporary-workaround).
+    However, enabling the bundled Grafana will no longer work from GitLab 16.3.
+  end_of_support_milestone: 16.3
+  tiers: # (optional - may be required in the future) An array of tiers that the feature is available in currently.  e.g., [Free, Silver, Gold, Core, Premium, Ultimate]
+  documentation_url: https://docs.gitlab.com/omnibus/settings/grafana.html
diff --git a/data/removals/16_0/16-0-gitlab-com-importer.yml b/data/removals/16_0/16-0-gitlab-com-importer.yml
new file mode 100644
index 00000000000..7a64bb4a185
--- /dev/null
+++ b/data/removals/16_0/16-0-gitlab-com-importer.yml
@@ -0,0 +1,16 @@
+- title: "GitLab.com importer"
+  announcement_milestone: "15.8"
+  removal_milestone: "16.0"
+  breaking_change: false
+  reporter: m_frankiewicz
+  stage: Manage
+  issue_url: https://gitlab.com/gitlab-com/Product/-/issues/4895
+  body: |
+    The [GitLab.com importer](https://docs.gitlab.com/ee/user/project/import/gitlab_com.html) was deprecated in GitLab 15.8 and is removed in GitLab 16.0.
+
+    The GitLab.com importer was introduced in 2015 for importing a project from GitLab.com to a self-managed GitLab instance through the UI.
+
+    This feature was available on self-managed instances only. [Migrating GitLab groups and projects by direct transfer](https://docs.gitlab.com/ee/user/group/import/#migrate-groups-by-direct-transfer-recommended)
+    supersedes the GitLab.com importer and provides a more cohesive importing functionality.
+
+    See [migrated group items](https://docs.gitlab.com/ee/user/group/import/#migrated-group-items) and [migrated project items](https://docs.gitlab.com/ee/user/group/import/#migrated-project-items) for an overview.
diff --git a/data/removals/16_0/16-0-import-bare-repositories-rake-task.yml b/data/removals/16_0/16-0-import-bare-repositories-rake-task.yml
new file mode 100644
index 00000000000..c3095ef6ff9
--- /dev/null
+++ b/data/removals/16_0/16-0-import-bare-repositories-rake-task.yml
@@ -0,0 +1,25 @@
+- title: "Rake task for importing bare repositories"
+  announcement_milestone: "15.8"
+  removal_milestone: "16.0"
+  breaking_change: false
+  reporter: m_frankiewicz
+  stage: Manage
+  issue_url: https://gitlab.com/gitlab-com/Product/-/issues/5255
+  body: |
+    The [Rake task for importing bare repositories](https://docs.gitlab.com/ee/raketasks/import.html) `gitlab:import:repos` was deprecated in GitLab 15.8 and is removed in GitLab 16.0.
+
+    This Rake task imported a directory tree of repositories into a GitLab instance. These repositories must have been
+    managed by GitLab previously, because the Rake task relied on the specific directory structure or a specific custom Git setting in order to work (`gitlab.fullpath`).
+
+    Importing repositories using this Rake task had limitations. The Rake task:
+
+    - Only knew about project and project wiki repositories and didn't support repositories for designs, group wikis, or snippets.
+    - Permitted you to import non-hashed storage projects even though these aren't supported.
+    - Relied on having Git config `gitlab.fullpath` set. [Epic 8953](https://gitlab.com/groups/gitlab-org/-/epics/8953) proposes removing support for this setting.
+
+    Alternatives to using the `gitlab:import:repos` Rake task include:
+
+    - Migrating projects using either [an export file](https://docs.gitlab.com/ee/user/project/settings/import_export.html) or
+      [direct transfer](https://docs.gitlab.com/ee/user/group/import/#migrate-groups-by-direct-transfer-recommended) migrate repositories as well.
+    - Importing a [repository by URL](https://docs.gitlab.com/ee/user/project/import/repo_by_url.html).
+    - Importing a [repositories from a non-GitLab source](https://docs.gitlab.com/ee/user/project/import/).
diff --git a/data/removals/16_0/16-0-restrict-imports-to-maintainers-and-above.yml b/data/removals/16_0/16-0-restrict-imports-to-maintainers-and-above.yml
new file mode 100644
index 00000000000..2572ec9d6a4
--- /dev/null
+++ b/data/removals/16_0/16-0-restrict-imports-to-maintainers-and-above.yml
@@ -0,0 +1,12 @@
+- title: "Developer role providing the ability to import projects to a group"
+  announcement_milestone: "15.8"
+  removal_milestone: "16.0"
+  breaking_change: true
+  reporter: m_frankiewicz
+  stage: Manage
+  issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/387891
+  body: |
+    The ability for users with the Developer role for a group to import projects to that group was deprecated in GitLab
+    15.8 and is removed in GitLab 16.0.
+
+    From GitLab 16.0, only users with at least the Maintainer role for a group can import projects to that group.
diff --git a/db/migrate/20230509144234_delete_drop_older_deployments_worker_queues.rb b/db/migrate/20230509144234_delete_drop_older_deployments_worker_queues.rb
new file mode 100644
index 00000000000..b6e3046e446
--- /dev/null
+++ b/db/migrate/20230509144234_delete_drop_older_deployments_worker_queues.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class DeleteDropOlderDeploymentsWorkerQueues < Gitlab::Database::Migration[2.1]
+  DEPRECATED_JOB_CLASSES = %w[
+    Deployments::DropOlderDeploymentsWorker
+  ]
+
+  disable_ddl_transaction!
+  def up
+    sidekiq_remove_jobs(job_klasses: DEPRECATED_JOB_CLASSES)
+  end
+
+  def down
+    # This migration removes any instances of deprecated workers and cannot be undone.
+  end
+end
diff --git a/db/schema_migrations/20230509144234 b/db/schema_migrations/20230509144234
new file mode 100644
index 00000000000..0116d971e38
--- /dev/null
+++ b/db/schema_migrations/20230509144234
@@ -0,0 +1 @@
+8c6d6a8d77dac3291f8af00e61c5ce0124c0742d0009f84b0d5bab7b43024bbe
\ No newline at end of file
diff --git a/doc/administration/raketasks/github_import.md b/doc/administration/raketasks/github_import.md
index 3c64e1fef8e..1babafc902e 100644
--- a/doc/administration/raketasks/github_import.md
+++ b/doc/administration/raketasks/github_import.md
@@ -20,8 +20,7 @@ before/after the brackets. Also, some shells (for example, Zsh) can interpret th
 
 Prerequisite:
 
-- At least the Maintainer role on the destination group to import to. Using the Developer role for this purpose was
-  [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in GitLab 16.0.
+- At least the Maintainer role on the destination group to import to.
 
 ## Rate limit
 
diff --git a/doc/api/import.md b/doc/api/import.md
index e762de4a0fa..7f25e9236c3 100644
--- a/doc/api/import.md
+++ b/doc/api/import.md
@@ -19,9 +19,7 @@ Prerequisites:
 
 - [Prerequisites for GitHub importer](../user/project/import/github.md#prerequisites).
 - The namespace set in `target_namespace` must exist.
-- The namespace can be your user namespace or an existing group that you have at least the Maintainer role for. Using
-  the Developer role for this purpose was [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab
-  15.8 and will be removed in GitLab 16.0.
+- The namespace can be your user namespace or an existing group that you have at least the Maintainer role for.
 
 ```plaintext
 POST /import/github
diff --git a/doc/api/managed_licenses.md b/doc/api/managed_licenses.md
index b98be629e90..e7ac247ae4a 100644
--- a/doc/api/managed_licenses.md
+++ b/doc/api/managed_licenses.md
@@ -2,148 +2,16 @@
 stage: Fulfillment
 group: Utilization
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/product/ux/technical-writing/#assignments
+remove_date: '2023-08-22'
+redirect_to: 'index.md'
 ---
 
-# Managed Licenses API (deprecated) **(ULTIMATE)**
+# Managed Licenses API (removed) **(ULTIMATE)**
 
-WARNING:
-This feature was [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/390417) in GitLab 15.9.
+This feature was [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/390417) in GitLab 15.9
+and [removed](https://gitlab.com/gitlab-org/gitlab/-/issues/397067) in 16.0.
 
-WARNING:
-"approval" and "blacklisted" approval statuses are changed to "allowed" and "denied" in GitLab 15.0.
-
-## List managed licenses
-
-Get all managed licenses for a given project.
-
-```plaintext
-GET /projects/:id/managed_licenses
-```
-
-| Attribute | Type    | Required | Description           |
-| --------- | ------- | -------- | --------------------- |
-| `id`      | integer/string    | yes      | The ID or [URL-encoded path of the project](rest/index.md#namespaced-path-encoding) |
-
-```shell
-curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/1/managed_licenses"
-```
-
-Example response:
-
-```json
-[
-  {
-    "id": 1,
-    "name": "MIT",
-    "approval_status": "allowed"
-  },
-  {
-    "id": 3,
-    "name": "ISC",
-    "approval_status": "denied"
-  }
-]
-```
-
-## Show an existing managed license
-
-Shows an existing managed license.
-
-```plaintext
-GET /projects/:id/managed_licenses/:managed_license_id
-```
-
-| Attribute       | Type    | Required                          | Description                      |
-| --------------- | ------- | --------------------------------- | -------------------------------  |
-| `id`      | integer/string    | yes      | The ID or [URL-encoded path of the project](rest/index.md#namespaced-path-encoding) owned by the authenticated user |
-| `managed_license_id`      | integer/string    | yes      | The ID or URL-encoded name of the license belonging to the project |
-
-```shell
-curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/1/managed_licenses/6"
-```
-
-Example response:
-
-```json
-{
-  "id": 1,
-  "name": "MIT",
-  "approval_status": "denied"
-}
-```
-
-## Create a new managed license
-
-Creates a new managed license for the given project with the given name and approval status.
-
-```plaintext
-POST /projects/:id/managed_licenses
-```
-
-| Attribute     | Type    | Required | Description                  |
-| ------------- | ------- | -------- | ---------------------------- |
-| `id`      | integer/string    | yes      | The ID or [URL-encoded path of the project](rest/index.md#namespaced-path-encoding) owned by the authenticated user |
-| `name`        | string  | yes      | The name of the managed license        |
-| `approval_status`       | string  | yes      | The approval status of the license. "allowed" or "denied". |
-
-```shell
-curl --data "name=MIT&approval_status=denied" --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/1/managed_licenses"
-```
-
-Example response:
-
-```json
-{
-  "id": 1,
-  "name": "MIT",
-  "approval_status": "allowed"
-}
-```
-
-## Delete a managed license
-
-Deletes a managed license with a given ID.
-
-```plaintext
-DELETE /projects/:id/managed_licenses/:managed_license_id
-```
-
-| Attribute | Type    | Required | Description           |
-| --------- | ------- | -------- | --------------------- |
-| `id`      | integer/string    | yes      | The ID or [URL-encoded path of the project](rest/index.md#namespaced-path-encoding) owned by the authenticated user |
-| `managed_license_id`      | integer/string    | yes      | The ID or URL-encoded name of the license belonging to the project |
-
-```shell
-curl --request DELETE --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/1/managed_licenses/4"
-```
-
-When successful, it replies with an HTTP 204 response.
-
-## Edit an existing managed license
-
-Updates an existing managed license with a new approval status.
-
-```plaintext
-PATCH /projects/:id/managed_licenses/:managed_license_id
-```
-
-| Attribute       | Type    | Required                          | Description                      |
-| --------------- | ------- | --------------------------------- | -------------------------------  |
-| `id`      | integer/string    | yes      | The ID or [URL-encoded path of the project](rest/index.md#namespaced-path-encoding) owned by the authenticated user |
-| `managed_license_id`      | integer/string    | yes      | The ID or URL-encoded name of the license belonging to the project |
-| `approval_status`       | string  | yes      | The approval status of the license. "allowed" or "denied". |
-
-```shell
-curl --request PATCH --data "approval_status=denied" \
-     --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/1/managed_licenses/6"
-```
-
-Example response:
-
-```json
-{
-  "id": 1,
-  "name": "MIT",
-  "approval_status": "denied"
-}
-```
+<!-- This redirect file can be deleted after <2023-08-22>. -->
+<!-- Redirects that point to other docs in the same project expire in three months. -->
+<!-- Redirects that point to docs in a different project or site (link is not relative and starts with `https:`) expire in one year. -->
+<!-- Before deletion, see: https://docs.gitlab.com/ee/development/documentation/redirects.html -->
diff --git a/doc/api/project_import_export.md b/doc/api/project_import_export.md
index 15f2e878570..a162bc3e5af 100644
--- a/doc/api/project_import_export.md
+++ b/doc/api/project_import_export.md
@@ -146,12 +146,12 @@ POST /projects/import
 
 | Attribute   | Type           | Required | Description                              |
 | ----------- | -------------- | -------- | ---------------------------------------- |
-| `file`      | string | yes | The file to be uploaded.
-| `path`      | string | yes | Name and path for new project.
-| `name`      | string | no | The name of the project to be imported. Defaults to the path of the project if not provided.
-| `namespace` | integer or string | no | The ID or path of the namespace to import the project to. Defaults to the current user's namespace.<br/><br/> Requires at least the Maintainer role on the destination group to import to. Using the Developer role for this purpose was [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and is scheduled for removal in GitLab 16.0.
-| `override_params` | Hash | no | Supports all fields defined in the [Project API](projects.md).
-| `overwrite` | boolean | no | If there is a project with the same path the import overwrites it. Defaults to `false`.
+| `file`      | string | yes | The file to be uploaded. |
+| `path`      | string | yes | Name and path for new project. |
+| `name`      | string | no | The name of the project to be imported. Defaults to the path of the project if not provided. |
+| `namespace` | integer or string | no | The ID or path of the namespace to import the project to. Defaults to the current user's namespace.<br/><br/> Requires at least the Maintainer role on the destination group to import to. |
+| `override_params` | Hash | no | Supports all fields defined in the [Project API](projects.md). |
+| `overwrite` | boolean | no | If there is a project with the same path the import overwrites it. Defaults to `false`. |
 
 The override parameters passed take precedence over all values defined inside the export file.
 
diff --git a/doc/security/rate_limits.md b/doc/security/rate_limits.md
index da267388b7e..d835d8eb08c 100644
--- a/doc/security/rate_limits.md
+++ b/doc/security/rate_limits.md
@@ -138,13 +138,6 @@ The **rate limit** is 20 calls per minute per IP address.
 
 ### Project Jobs API endpoint
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/104912) in GitLab 15.7 [with a flag](../administration/feature_flags.md) named `ci_enforce_rate_limits_jobs_api`. Disabled by default.
-
-FLAG:
-On self-managed GitLab, by default this feature is not available. To make it available,
-ask an administrator to [enable the feature flag](../administration/feature_flags.md) named `ci_enforce_rate_limits_jobs_api`.
-The feature is not ready for production use.
-
 There is a rate limit for the endpoint `project/:id/jobs`, which is enforced to reduce timeouts when retrieving jobs.
 
 The **rate limit** is 600 calls per minute per authenticated user.
@@ -202,7 +195,7 @@ To remove a blocked IP:
    keys *rack::attack*
    ```
 
-  By default, the [`keys` command is disabled](https://docs.gitlab.com/omnibus/settings/redis.html#renamed-commands).
+By default, the [`keys` command is disabled](https://docs.gitlab.com/omnibus/settings/redis.html#renamed-commands).
 
 1. Optionally, add [the IP to the allowlist](https://docs.gitlab.com/omnibus/settings/configuration.html#configuring-rack-attack)
    to prevent it being denylisted again.
diff --git a/doc/update/deprecations.md b/doc/update/deprecations.md
index fdb0d340151..5d0985ca4a1 100644
--- a/doc/update/deprecations.md
+++ b/doc/update/deprecations.md
@@ -728,6 +728,37 @@ be available in CI/CD jobs.
 </div>
 </div>
 
+<div class="milestone-wrapper" data-milestone="16.3">
+
+## GitLab 16.3
+
+<div class="deprecation breaking-change" data-milestone="16.3">
+
+### Bundled Grafana deprecated and disabled
+
+<div class="deprecation-notes">
+- Announced in: GitLab <span class="milestone">16.0</span>
+- End of Support: GitLab <span class="milestone">16.3</span>
+- This is a [breaking change](https://docs.gitlab.com/ee/development/deprecation_guidelines/).
+- To discuss this change or learn more, see the [deprecation issue](https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/7772).
+</div>
+
+The version of [Grafana bundled with Omnibus GitLab](https://docs.gitlab.com/omnibus/settings/grafana.html) is
+disabled in 16.0 and will be removed in 16.3.
+If you are using the bundled Grafana, you must migrate to either:
+
+- Another implementation of Grafana. For more information, see
+  [Switch to new Grafana instance](https://docs.gitlab.com/ee/administration/monitoring/performance/grafana_configuration.html#switch-to-new-grafana-instance).
+- Another observability platform of your choice.
+
+The version of Grafana that is currently provided is no longer a supported version.
+
+In GitLab versions 16.0 to 16.2, you can still [re-enable the bundled Grafana](https://docs.gitlab.com/ee/administration/monitoring/performance/grafana_configuration.html#temporary-workaround).
+However, enabling the bundled Grafana will no longer work from GitLab 16.3.
+
+</div>
+</div>
+
 <div class="milestone-wrapper" data-milestone="16.1">
 
 ## GitLab 16.1
diff --git a/doc/update/removals.md b/doc/update/removals.md
index ee7c0159d5a..77da46b5fc4 100644
--- a/doc/update/removals.md
+++ b/doc/update/removals.md
@@ -122,6 +122,17 @@ Review the details carefully before upgrading.
 
 The Container Registry [pull-through cache](https://docs.docker.com/registry/recipes/mirror/) was deprecated in GitLab 15.8 and removed in GitLab 16.0. This feature is part of the upstream [Docker Distribution project](https://github.com/distribution/distribution) but we are removing that code in favor of the GitLab Dependency Proxy. Use the GitLab Dependency Proxy to proxy and cache container images from Docker Hub.
 
+### Developer role providing the ability to import projects to a group
+
+WARNING:
+This is a [breaking change](https://docs.gitlab.com/ee/development/deprecation_guidelines/).
+Review the details carefully before upgrading.
+
+The ability for users with the Developer role for a group to import projects to that group was deprecated in GitLab
+15.8 and is removed in GitLab 16.0.
+
+From GitLab 16.0, only users with at least the Maintainer role for a group can import projects to that group.
+
 ### Embedding Grafana panels in Markdown is removed
 
 WARNING:
@@ -156,6 +167,17 @@ Review the details carefully before upgrading.
 
 GitLab administrators can no longer perform actions on protected branches or tags unless they have been explicitly granted that permission. These actions include pushing and merging into a [protected branch](https://docs.gitlab.com/ee/user/project/protected_branches.html), unprotecting a branch, and creating [protected tags](https://docs.gitlab.com/ee/user/project/protected_tags.html).
 
+### GitLab.com importer
+
+The [GitLab.com importer](https://docs.gitlab.com/ee/user/project/import/gitlab_com.html) was deprecated in GitLab 15.8 and is removed in GitLab 16.0.
+
+The GitLab.com importer was introduced in 2015 for importing a project from GitLab.com to a self-managed GitLab instance through the UI.
+
+This feature was available on self-managed instances only. [Migrating GitLab groups and projects by direct transfer](https://docs.gitlab.com/ee/user/group/import/#migrate-groups-by-direct-transfer-recommended)
+supersedes the GitLab.com importer and provides a more cohesive importing functionality.
+
+See [migrated group items](https://docs.gitlab.com/ee/user/group/import/#migrated-group-items) and [migrated project items](https://docs.gitlab.com/ee/user/group/import/#migrated-project-items) for an overview.
+
 ### GraphQL API: Runner status no longer returns `PAUSED` and `ACTIVE` values
 
 WARNING:
@@ -253,6 +275,26 @@ is removed in favor of more specialized fields like:
 - `infrastructure_access_level`
 - `monitor_access_level`
 
+### Rake task for importing bare repositories
+
+The [Rake task for importing bare repositories](https://docs.gitlab.com/ee/raketasks/import.html) `gitlab:import:repos` was deprecated in GitLab 15.8 and is removed in GitLab 16.0.
+
+This Rake task imported a directory tree of repositories into a GitLab instance. These repositories must have been
+managed by GitLab previously, because the Rake task relied on the specific directory structure or a specific custom Git setting in order to work (`gitlab.fullpath`).
+
+Importing repositories using this Rake task had limitations. The Rake task:
+
+- Only knew about project and project wiki repositories and didn't support repositories for designs, group wikis, or snippets.
+- Permitted you to import non-hashed storage projects even though these aren't supported.
+- Relied on having Git config `gitlab.fullpath` set. [Epic 8953](https://gitlab.com/groups/gitlab-org/-/epics/8953) proposes removing support for this setting.
+
+Alternatives to using the `gitlab:import:repos` Rake task include:
+
+- Migrating projects using either [an export file](https://docs.gitlab.com/ee/user/project/settings/import_export.html) or
+  [direct transfer](https://docs.gitlab.com/ee/user/group/import/#migrate-groups-by-direct-transfer-recommended) migrate repositories as well.
+- Importing a [repository by URL](https://docs.gitlab.com/ee/user/project/import/repo_by_url.html).
+- Importing a [repositories from a non-GitLab source](https://docs.gitlab.com/ee/user/project/import/).
+
 ### Redis 5 compatibility
 
 WARNING:
diff --git a/doc/user/group/import/index.md b/doc/user/group/import/index.md
index 1ff71d50e2d..7f55bf56102 100644
--- a/doc/user/group/import/index.md
+++ b/doc/user/group/import/index.md
@@ -107,9 +107,7 @@ To migrate groups by direct transfer:
   - For GitLab 15.0 and earlier source instances, the personal access token must have both the `api` and
     `read_repository` scopes.
 - You must have the Owner role on the source group to migrate from.
-- You must have at least the Maintainer role on the destination group to migrate to. Using the Developer role for this
-  purpose was [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in
-  GitLab 16.0.
+- You must have at least the Maintainer role on the destination group to migrate to.
 
 ### Prepare user accounts
 
diff --git a/doc/user/project/import/bitbucket.md b/doc/user/project/import/bitbucket.md
index 42eb690af64..b523e007f0e 100644
--- a/doc/user/project/import/bitbucket.md
+++ b/doc/user/project/import/bitbucket.md
@@ -38,8 +38,7 @@ When importing:
   to enable it. The Bitbucket Cloud integration is enabled by default on GitLab.com.
 - [Bitbucket Cloud import source](../../admin_area/settings/visibility_and_access_controls.md#configure-allowed-import-sources) must be enabled. If not enabled, ask your
   GitLab administrator to enable it. The Bitbucket Cloud import source is enabled by default on GitLab.com.
-- At least the Maintainer role on the destination group to import to. Using the Developer role for this purpose was
-  [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in GitLab 16.0.
+- At least the Maintainer role on the destination group to import to.
 
 ## How it works
 
diff --git a/doc/user/project/import/bitbucket_server.md b/doc/user/project/import/bitbucket_server.md
index 451a15de92a..4d3a6eb87e0 100644
--- a/doc/user/project/import/bitbucket_server.md
+++ b/doc/user/project/import/bitbucket_server.md
@@ -34,8 +34,7 @@ You can import Bitbucket repositories to GitLab.
 - [Bitbucket Server import source](../../admin_area/settings/visibility_and_access_controls.md#configure-allowed-import-sources)
   must be enabled. If not enabled, ask your GitLab administrator to enable it. The Bitbucket Server import source is enabled
   by default on GitLab.com.
-- At least the Maintainer role on the destination group to import to. Using the Developer role for this purpose was
-  [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in GitLab 16.0.
+- At least the Maintainer role on the destination group to import to.
 
 ### Import repositories
 
diff --git a/doc/user/project/import/fogbugz.md b/doc/user/project/import/fogbugz.md
index 6f5e8e446d6..692ec1390d2 100644
--- a/doc/user/project/import/fogbugz.md
+++ b/doc/user/project/import/fogbugz.md
@@ -22,8 +22,7 @@ users.
 - [FogBugz import source](../../admin_area/settings/visibility_and_access_controls.md#configure-allowed-import-sources)
   must be enabled. If not enabled, ask your GitLab administrator to enable it. The FogBugz import source is enabled
   by default on GitLab.com.
-- At least the Maintainer role on the destination group to import to. Using the Developer role for this purpose was
-  [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in GitLab 16.0.
+- At least the Maintainer role on the destination group to import to.
 
 ## Import project from FogBugz
 
diff --git a/doc/user/project/import/gitea.md b/doc/user/project/import/gitea.md
index d600c26276a..62cda62c2fe 100644
--- a/doc/user/project/import/gitea.md
+++ b/doc/user/project/import/gitea.md
@@ -35,8 +35,7 @@ on the issue about the original Gitea author.
 - [Gitea import source](../../admin_area/settings/visibility_and_access_controls.md#configure-allowed-import-sources)
   must be enabled. If not enabled, ask your GitLab administrator to enable it. The Gitea import source is enabled
   by default on GitLab.com.
-- At least the Maintainer role on the destination group to import to. Using the Developer role for this purpose was
-  [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in GitLab 16.0.
+- At least the Maintainer role on the destination group to import to.
 
 ## Import your Gitea repositories
 
diff --git a/doc/user/project/import/github.md b/doc/user/project/import/github.md
index ad951994f69..b956993f8c4 100644
--- a/doc/user/project/import/github.md
+++ b/doc/user/project/import/github.md
@@ -43,9 +43,7 @@ To import projects from GitHub:
 - [GitHub import source](../../admin_area/settings/visibility_and_access_controls.md#configure-allowed-import-sources)
   must be enabled. If not enabled, ask your GitLab administrator to enable it. The GitHub import source is enabled
   by default on GitLab.com.
-- You must have at least the Maintainer role on the destination group to import to. Using the Developer role for this
-  purpose was [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in
-  GitLab 16.0.
+- You must have at least the Maintainer role on the destination group to import to.
 - Each GitHub author and assignee in the repository must have a
   [public-facing email address](https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/setting-your-commit-email-address)
   on GitHub that matches their GitLab email address (regardless of how the account was created). If their email address
diff --git a/doc/user/project/import/manifest.md b/doc/user/project/import/manifest.md
index 6a8c40ec601..7b3550d2dc9 100644
--- a/doc/user/project/import/manifest.md
+++ b/doc/user/project/import/manifest.md
@@ -24,8 +24,7 @@ repositories like the Android Open Source Project (AOSP).
   by default on GitLab.com.
 - GitLab must use PostgreSQL for its database, because [subgroups](../../group/subgroups/index.md) are needed for the manifest import
   to work. Read more about the [database requirements](../../../install/requirements.md#database).
-- At least the Maintainer role on the destination group to import to. Using the Developer role for this purpose was
-  [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in GitLab 16.0.
+- At least the Maintainer role on the destination group to import to.
 
 ## Manifest format
 
diff --git a/doc/user/project/import/repo_by_url.md b/doc/user/project/import/repo_by_url.md
index a4868fed94f..4ad51ccb97f 100644
--- a/doc/user/project/import/repo_by_url.md
+++ b/doc/user/project/import/repo_by_url.md
@@ -15,8 +15,7 @@ You can import your existing repositories by providing the Git URL.
 - [Repository by URL import source](../../admin_area/settings/visibility_and_access_controls.md#configure-allowed-import-sources)
   must be enabled. If not enabled, ask your GitLab administrator to enable it. The Repository by URL import source is enabled
   by default on GitLab.com.
-- At least the Maintainer role on the destination group to import to. Using the Developer role for this purpose was
-  [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in GitLab 16.0.
+- At least the Maintainer role on the destination group to import to.
 
 ## Import project by URL
 
diff --git a/doc/user/project/settings/import_export.md b/doc/user/project/settings/import_export.md
index baa7470b309..3ac864c1351 100644
--- a/doc/user/project/settings/import_export.md
+++ b/doc/user/project/settings/import_export.md
@@ -203,8 +203,7 @@ may be possible for an attacker to steal your sensitive data.
 - Compare GitLab versions and ensure you are importing to a GitLab version that is the same or later
   than the GitLab version you exported to.
 - Review [compatibility](#compatibility) for any issues.
-- At least the Maintainer role on the destination group to migrate to. Using the Developer role for this purpose was
-  [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in GitLab 16.0.
+- At least the Maintainer role on the destination group to migrate to.
 
 ### Import a project
 
diff --git a/lib/api/ci/jobs.rb b/lib/api/ci/jobs.rb
index b4b03664916..5d60c004a03 100644
--- a/lib/api/ci/jobs.rb
+++ b/lib/api/ci/jobs.rb
@@ -49,7 +49,7 @@ module API
         end
         # rubocop: disable CodeReuse/ActiveRecord
         get ':id/jobs', urgency: :low, feature_category: :continuous_integration do
-          check_rate_limit!(:jobs_index, scope: current_user) if enforce_jobs_api_rate_limits(@project)
+          check_rate_limit!(:jobs_index, scope: current_user)
 
           authorize_read_builds!
 
diff --git a/lib/api/helpers.rb b/lib/api/helpers.rb
index e55452fd07b..9fa0923d914 100644
--- a/lib/api/helpers.rb
+++ b/lib/api/helpers.rb
@@ -167,10 +167,6 @@ module API
         current_authenticated_job.project == project
     end
 
-    def enforce_jobs_api_rate_limits(project)
-      ::Feature.enabled?(:ci_enforce_rate_limits_jobs_api, project)
-    end
-
     # rubocop: disable CodeReuse/ActiveRecord
     def find_group(id)
       if id.to_s =~ INTEGER_ID_REGEX
diff --git a/lib/gitlab/ci/templates/Pages/Zola.gitlab-ci.yml b/lib/gitlab/ci/templates/Pages/Zola.gitlab-ci.yml
new file mode 100644
index 00000000000..0ce7bface66
--- /dev/null
+++ b/lib/gitlab/ci/templates/Pages/Zola.gitlab-ci.yml
@@ -0,0 +1,28 @@
+# To contribute improvements to CI/CD templates, please follow the Development guide at:
+# https://docs.gitlab.com/ee/development/cicd/templates.html
+# This specific template is located at:
+# https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Pages/Zola.gitlab-ci.yml
+
+---
+# From: https://www.getzola.org/documentation/deployment/gitlab-pages/
+# Source template is slightly modified to be self-contained
+
+pages:
+  image: alpine:latest
+  variables:
+    # This variable will ensure that the CI runner pulls in your theme from the submodule
+    GIT_SUBMODULE_STRATEGY: recursive
+  before_script:
+    # Install the zola package from the alpine community repositories
+    - apk add --update-cache --repository http://dl-cdn.alpinelinux.org/alpine/edge/community/ zola
+  script:
+    # Execute zola build
+    - zola build --base-url "$CI_PAGES_URL"
+  artifacts:
+    paths:
+      # Path of our artifacts
+      - public
+  # This config will only publish changes that are pushed on the default branch
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+  environment: production
diff --git a/qa/Gemfile b/qa/Gemfile
index d7dec5f17d5..9189ca8a002 100644
--- a/qa/Gemfile
+++ b/qa/Gemfile
@@ -3,7 +3,7 @@
 source 'https://rubygems.org'
 
 gem 'gitlab-qa', '~> 10', '>= 10.3.0', require: 'gitlab/qa'
-gem 'gitlab_quality-test_tooling', '~> 0.2.2', require: false
+gem 'gitlab_quality-test_tooling', '~> 0.3.0', require: false
 gem 'activesupport', '~> 6.1.7.2' # This should stay in sync with the root's Gemfile
 gem 'allure-rspec', '~> 2.20.0'
 gem 'capybara', '~> 3.39.0'
diff --git a/qa/Gemfile.lock b/qa/Gemfile.lock
index c8d408831d7..f6344da8393 100644
--- a/qa/Gemfile.lock
+++ b/qa/Gemfile.lock
@@ -111,7 +111,7 @@ GEM
       rainbow (>= 3, < 4)
       table_print (= 1.5.7)
       zeitwerk (>= 2, < 3)
-    gitlab_quality-test_tooling (0.2.2)
+    gitlab_quality-test_tooling (0.3.0)
       activesupport (~> 6.1)
       gitlab (~> 4.18.0)
       http (~> 5.0)
@@ -328,7 +328,7 @@ DEPENDENCIES
   fog-core (= 2.1.0)
   fog-google (~> 1.19)
   gitlab-qa (~> 10, >= 10.3.0)
-  gitlab_quality-test_tooling (~> 0.2.2)
+  gitlab_quality-test_tooling (~> 0.3.0)
   influxdb-client (~> 2.9)
   knapsack (~> 4.0)
   nokogiri (~> 1.14, >= 1.14.3)
diff --git a/spec/lib/gitlab/ci/templates/Pages/zola_gitlab_ci_yaml_spec.rb b/spec/lib/gitlab/ci/templates/Pages/zola_gitlab_ci_yaml_spec.rb
new file mode 100644
index 00000000000..4f80ae0054b
--- /dev/null
+++ b/spec/lib/gitlab/ci/templates/Pages/zola_gitlab_ci_yaml_spec.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Pages/Zola.gitlab-ci.yml', feature_category: :pages do
+  subject(:template) { Gitlab::Template::GitlabCiYmlTemplate.find('Pages/Zola') }
+
+  describe 'the created pipeline' do
+    let_it_be(:project) { create(:project, :repository) }
+
+    let(:user) { project.first_owner }
+    let(:service) { Ci::CreatePipelineService.new(project, user, ref: project.default_branch) }
+    let(:pipeline) { service.execute(:push).payload }
+    let(:build_names) { pipeline.builds.pluck(:name) }
+
+    before do
+      stub_ci_pipeline_yaml_file(template.content)
+      allow(Ci::BuildScheduleWorker).to receive(:perform).and_return(true)
+    end
+
+    it 'creates "pages" job' do
+      expect(build_names).to include('pages')
+    end
+  end
+end
diff --git a/spec/models/deployment_spec.rb b/spec/models/deployment_spec.rb
index 49084e1d551..2a7a8d50895 100644
--- a/spec/models/deployment_spec.rb
+++ b/spec/models/deployment_spec.rb
@@ -170,13 +170,6 @@ RSpec.describe Deployment, feature_category: :continuous_delivery do
           deployment.run!
         end
       end
-
-      it 'does not execute Deployments::DropOlderDeploymentsWorker' do
-        expect(Deployments::DropOlderDeploymentsWorker)
-          .not_to receive(:perform_async).with(deployment.id)
-
-        deployment.run!
-      end
     end
 
     context 'when deployment succeeded' do
diff --git a/spec/requests/api/ci/jobs_spec.rb b/spec/requests/api/ci/jobs_spec.rb
index 25871beeb4f..ed0cec46a42 100644
--- a/spec/requests/api/ci/jobs_spec.rb
+++ b/spec/requests/api/ci/jobs_spec.rb
@@ -546,40 +546,18 @@ RSpec.describe API::Ci::Jobs, feature_category: :continuous_integration do
   describe 'GET /projects/:id/jobs rate limited' do
     let(:query) { {} }
 
-    context 'with the ci_enforce_rate_limits_jobs_api feature flag on' do
-      before do
-        stub_feature_flags(ci_enforce_rate_limits_jobs_api: true)
-
-        allow_next_instance_of(Gitlab::ApplicationRateLimiter::BaseStrategy) do |strategy|
-          threshold = Gitlab::ApplicationRateLimiter.rate_limits[:jobs_index][:threshold]
-          allow(strategy).to receive(:increment).and_return(threshold + 1)
-        end
-
-        get api("/projects/#{project.id}/jobs", api_user), params: query
+    before do
+      allow_next_instance_of(Gitlab::ApplicationRateLimiter::BaseStrategy) do |strategy|
+        threshold = Gitlab::ApplicationRateLimiter.rate_limits[:jobs_index][:threshold]
+        allow(strategy).to receive(:increment).and_return(threshold + 1)
       end
 
-      it 'enforces rate limits for the endpoint' do
-        expect(response).to have_gitlab_http_status :too_many_requests
-        expect(json_response['message']['error']).to eq('This endpoint has been requested too many times. Try again later.')
-      end
+      get api("/projects/#{project.id}/jobs", api_user), params: query
     end
 
-    context 'with the ci_enforce_rate_limits_jobs_api feature flag off' do
-      before do
-        stub_feature_flags(ci_enforce_rate_limits_jobs_api: false)
-
-        allow_next_instance_of(Gitlab::ApplicationRateLimiter::BaseStrategy) do |strategy|
-          threshold = Gitlab::ApplicationRateLimiter.rate_limits[:jobs_index][:threshold]
-          allow(strategy).to receive(:increment).and_return(threshold + 1)
-        end
-
-        get api("/projects/#{project.id}/jobs", api_user), params: query
-      end
-
-      it 'makes a successful request' do
-        expect(response).to have_gitlab_http_status(:ok)
-        expect(response).to include_limited_pagination_headers
-      end
+    it 'enforces rate limits for the endpoint' do
+      expect(response).to have_gitlab_http_status :too_many_requests
+      expect(json_response['message']['error']).to eq('This endpoint has been requested too many times. Try again later.')
     end
   end
 
diff --git a/spec/support/rspec_order_todo.yml b/spec/support/rspec_order_todo.yml
index 1d6620f0bc8..724f45524d1 100644
--- a/spec/support/rspec_order_todo.yml
+++ b/spec/support/rspec_order_todo.yml
@@ -10072,7 +10072,6 @@
 - './spec/workers/dependency_proxy/cleanup_manifest_worker_spec.rb'
 - './spec/workers/dependency_proxy/image_ttl_group_policy_worker_spec.rb'
 - './spec/workers/deployments/archive_in_project_worker_spec.rb'
-- './spec/workers/deployments/drop_older_deployments_worker_spec.rb'
 - './spec/workers/deployments/hooks_worker_spec.rb'
 - './spec/workers/deployments/link_merge_request_worker_spec.rb'
 - './spec/workers/deployments/update_environment_worker_spec.rb'
diff --git a/spec/workers/every_sidekiq_worker_spec.rb b/spec/workers/every_sidekiq_worker_spec.rb
index 0c1e9da0fb1..4309ec24a9e 100644
--- a/spec/workers/every_sidekiq_worker_spec.rb
+++ b/spec/workers/every_sidekiq_worker_spec.rb
@@ -205,7 +205,6 @@ RSpec.describe 'Every Sidekiq worker', feature_category: :shared do
         'DependencyProxy::CleanupBlobWorker' => 3,
         'DependencyProxy::CleanupManifestWorker' => 3,
         'Deployments::AutoRollbackWorker' => 3,
-        'Deployments::DropOlderDeploymentsWorker' => 3,
         'Deployments::FinishedWorker' => 3,
         'Deployments::ForwardDeploymentWorker' => 3,
         'Deployments::LinkMergeRequestWorker' => 3,