Merge branch 'tg/refs-allowed-flags' into maint