Add cr remarks

app/controllers/projects_controller.rb

@@ -327,9 +327,9 @@ class ProjectsController < Projects::ApplicationController
   end
   # rubocop: enable CodeReuse/ActiveRecord
-  def project_params(attributes: project_params_attributes)
+  def project_params(attributes: [])
     params.require(:project)
-      .permit(attributes)
+      .permit(project_params_attributes + attributes)
   end
   def project_params_attributes
@@ -374,7 +374,7 @@ class ProjectsController < Projects::ApplicationController
   end
   def project_params_create_attributes
-    project_params_attributes << :namespace_id
+    [:namespace_id]
   end
   def custom_import_params

changelogs/unreleased/security-mass-assignment-on-project-update.yml

 ---
-title: Disallow updating namespace during updating project
+title: Disallow updating namespace when updating a project
 merge_request:
 author:
 type: security

spec/controllers/projects_controller_spec.rb

@@ -383,7 +383,7 @@ describe ProjectsController do
               id: project.id,
               project: params
             }
-        end.not_to change {project.namespace}
+        end.not_to change {project.reload.namespace}
       end
       def update_project(**parameters)