Update CHANGELOG.md for 12.1.12

[ci skip]

CHANGELOG.md

@@ -2,6 +2,23 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
+## 12.1.12
+
+### Security (11 changes)
+
+- Add a policy check for system notes that may not be visible due to cross references to private items.
+- Display only participants that user has permission to see on milestone page.
+- Do not disclose project milestones on group milestones page when project milestones access is disabled in project settings.
+- Fix new project path being disclosed through unsubscribe link of issue/merge requests.
+- Prevent bypassing email verification using Salesforce.
+- Do not show resource label events referencing not accessible labels.
+- Cancel all running CI jobs triggered by the user who is just blocked.
+- Fix Gitaly SearchBlobs flag RPC injection.
+- Only render fixed number of mermaid blocks.
+- Prevent GitLab accounts takeover if SAML is configured.
+- Upgrade mermaid to prevent XSS.
+
+
 ## 12.1.11
 - No changes.

changelogs/unreleased/security-12630-private-system-note-disclosed-in-graphql.yml

----
-title: Add a policy check for system notes that may not be visible due to cross references
-  to private items
-merge_request:
-author:
-type: security

changelogs/unreleased/security-12717-fix-confidential-issue-assignee-visible-to-guests.yml

----
-title: Display only participants that user has permission to see on milestone page
-merge_request:
-author:
-type: security

changelogs/unreleased/security-12718-project-milestones-disclosed-via-groups.yml

----
-title: Do not disclose project milestones on group milestones page when project milestones
-  access is disabled in project settings
-merge_request:
-author:
-type: security

changelogs/unreleased/security-64938-dont-disclose-path.yml

----
-title: Fix new project path being disclosed through unsubscribe link of issue/merge
-  requests
-merge_request:
-author:
-type: security

changelogs/unreleased/security-bypass-email-verification-using-salesforce.yml

----
-title: Prevent bypassing email verification using Salesforce
-merge_request:
-author:
-type: security

changelogs/unreleased/security-cross-reference-fix.yml

----
-title: Do not show resource label events referencing not accessible labels.
-merge_request:
-author:
-type: security

changelogs/unreleased/security-fp-stop-jobs-when-blocking-user.yml

----
-title: Cancel all running CI jobs triggered by the user who is just blocked
-merge_request:
-author:
-type: security

changelogs/unreleased/security-gitaly-1-53-4.yml

----
-title: Fix Gitaly SearchBlobs flag RPC injection
-merge_request:
-author:
-type: security

changelogs/unreleased/security-mermaid-block.yml

----
-title: Only render fixed number of mermaid blocks
-merge_request:
-author:
-type: security

changelogs/unreleased/security-sarcila-verify-saml-request-origin.yml

----
-title: Prevent GitLab accounts takeover if SAML is configured
-merge_request:
-author:
-type: security

changelogs/unreleased/security-xss-mermaid-12-1.yml

----
-title: Upgrade mermaid to prevent XSS
-merge_request:
-author:
-type: security