- This makes nesting experiments more flexible, but can still surface in
reporting.

Merge branch '344860-npm-package-registry-documentation-recommends-a-practice-that-is-insecure-and-can-lead-to' into 'master'

Add security warning and env variable to npm package docs

See merge request gitlab-org/gitlab!73957

Remove ci_runner_limits_override feature flag

See merge request gitlab-org/gitlab!75503

Add support for SAST in security policies

See merge request gitlab-org/gitlab!73938

Add new instance vulnerability report

See merge request gitlab-org/gitlab!74463

Remove feature flag handling in storage purchase tests

See merge request gitlab-org/gitlab!75524

Add default_branch_image to container scanning location

See merge request gitlab-org/gitlab!73486

Fix administrator Vale rule

See merge request gitlab-org/gitlab!75510

Remove instrumentation class ff

See merge request gitlab-org/gitlab!75345

Merge branch '343145-follow-up-from-fix-handling-service-ping-response-with-only-usage_data_id' into 'master'

Add validations to DevOpsReport::Metric

See merge request gitlab-org/gitlab!75060

Merge maintain feature flags for new queuing mechanism

See merge request gitlab-org/gitlab!75425

Remove bulk_queue_bg_migration_jobs_by_range

See merge request gitlab-org/gitlab!75274

Enable job trace store outside database transaction by default

See merge request gitlab-org/gitlab!75414

Default jira_use_first_ref_by_oid feature flag to true

See merge request gitlab-org/gitlab!73510

Fix import from remote object storage documentation

See merge request gitlab-org/gitlab!75158

This change improves feature flag checks for the `default_branch_image`
feature. We now check that the feature flag is enabled in the report
parser so that we can use `@report.pipeline.project` in order to enable
or disable the feature on a per-project basis. The feature flag status
is passed to the location parser as an attribute.

Adds a a new field named default_branch_image, which indicates the name
of the scanned image as it appears on the default branch. On non-default
branches, we will use this in lieu of the image field when creating the
location fingerprint. This will allow vulnerabilities to generate
identical fingerprints when the image name differs between the default
branch and the non-default branch.

Use linear version UserGroupNotificationSettingsFinder#execute

See merge request gitlab-org/gitlab!74606

Fix Style/OpenStructUse offenses

See merge request gitlab-org/gitlab!74957

Extend database with encrypted field for static objects tokens

See merge request gitlab-org/gitlab!75334

Merge branch '339438-fj-user-application_settings_elasticsearch_limited_namespaces-linear-version' into 'master'

Use linear version ApplicationSettings#elasticsearch_limited_namespaces

See merge request gitlab-org/gitlab!74593

Standardize snippet class methods location

See merge request gitlab-org/gitlab!75383

Update doc/administration/instance_review.md to fix Vale warning

See merge request gitlab-org/gitlab!75493

Replace Banzai based label rendering in VSA

See merge request gitlab-org/gitlab!75415