[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Patch Kramdown syntax highlighter gem

See merge request gitlab-org/security/gitlab!1293

This restricts Rouge formatters to the Rouge::Formatters namespace to
prevent arbitrary classes from being instantiated.

Relates to https://gitlab.com/gitlab-org/gitlab/-/issues/324452

[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Workhorse: prevent escaped router path traversal

See merge request gitlab-org/security/gitlab!1267

Clean up active session file

See merge request gitlab-org/security/gitlab!1271

mksionek authored 4 years ago and GitLab Release Tools Bot committed 4 years ago

From to-do items

Remove binding.pry

Fix warden to-do

Add warden guard clause

Add changelog entry

Change naming in changelog

Bump swagger-ui-dist version

See merge request gitlab-org/security/gitlab!1278

Bump thrift to 0.14.0

See merge request gitlab-org/security/gitlab!1274

Allow only group owners to manage group variables

See merge request gitlab-org/security/gitlab!1258

[ci skip]

Stop logging when path is excluded

See merge request gitlab-org/security/gitlab-workhorse!33

This causes logging a lot and reporting to sentry which can
cause performance issues.

Bumped the swagger-ui-dist version to the latest

This is a minor bump of the thrift gem. This is a dependency of labkit
through jaeger-client

[ci skip]

Use URL.EscapePath() in upstream router (8-58-stable)

See merge request gitlab-org/security/gitlab-workhorse!26

Before this change we were allowing maintainers to manage
group variables even though our permissions page list only owners.

[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Prevent Denial of Service Attack on gitlab-shell

See merge request gitlab-org/security/gitlab!1199

Merge branch 'security-respect-analytics-enabled-rule-for-project-level-analytics-features-13-7' into '13-7-stable-ee'

Respect analytics_enabled policy rule

See merge request gitlab-org/security/gitlab!1228

Always perform SSL verification for FortiTokenCloud Integration

See merge request gitlab-org/security/gitlab!1189