[merge-train skip]

[ci skip]

[ci skip]

Add authorization checks to import status endpoint

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3515



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Dylan Griffith <dyl.griffith@gmail.com>
Approved-by: Luke Duncalfe <lduncalfe@gitlab.com>
Co-authored-by: bmarjanovic <bmarjanovic@gitlab.com>

Bojan Marjanović authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-415117-confidential-issue-16-1' into '16-1-stable-ee'

See merge request gitlab-org/security/gitlab!3515

Changelog: security

Update commonmarker to 0.23.10

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3509



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Mario Celi <mcelicalderon@gitlab.com>
Co-authored-by: Brett Walker <bwalker@gitlab.com>

Brett Walker authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-update-commonmarker-16-1' into '16-1-stable-ee'

See merge request gitlab-org/security/gitlab!3509

Changelog: security

Remove DAST secret variables when URL is updated

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3500



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Aboobacker MK <akarakath@gitlab.com>
Approved-by: Himanshu Kapoor <info@fleon.org>
Co-authored-by: Dheeraj Joshi <djoshi@gitlab.com>

Dheeraj Joshi authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-dast-reset-secrets-16-1' into '16-1-stable-ee'

See merge request gitlab-org/security/gitlab!3500

Changelog: security

Maintainer can leak sentry token by changing the configured URL

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3518



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Allen Cook <acook@gitlab.com>
Co-authored-by: bmarjanovic <bmarjanovic@gitlab.com>

Bojan Marjanović authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-422134-confidential-issue-16-1' into '16-1-stable-ee'

See merge request gitlab-org/security/gitlab!3518

Changelog: security

Merge branch 'security-smriti-417664/external_user_escalated_service_account-16-1' into '16-1-stable-ee'

Service account users are external by default

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3503



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Aboobacker MK <akarakath@gitlab.com>
Co-authored-by: smriti <sgarg@gitlab.com>

Smriti Garg authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-smriti-417664/external_user_escalated_service_account-16-1' into '16-1-stable-ee'

See merge request gitlab-org/security/gitlab!3503

Changelog: security

Additional permission check when editing label

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3506



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Mark Chao <mchao@gitlab.com>
Co-authored-by: Brett Walker <bwalker@gitlab.com>

Brett Walker authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-reporter-group-labels-16-1' into '16-1-stable-ee'

See merge request gitlab-org/security/gitlab!3506

Changelog: security

Fix ReDOS in bulk_imports endpoint params

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3512



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Bojan Marjanovic <bmarjanovic@gitlab.com>
Co-authored-by: Luke Duncalfe <lduncalfe@eml.cc>

Luke Duncalfe authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-415067-redos-in-bulk_imports-api-16-1' into '16-1-stable-ee'

See merge request gitlab-org/security/gitlab!3512

Changelog: security

Merge branch 'security-prevent-namespace-level-banned-users-from-accessing-api-16-1' into '16-1-stable-ee'

Prevent namespace level banned users from accessing API

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3485



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Kassio Borges <kborges@gitlab.com>
Co-authored-by: Alex Buijs <abuijs@gitlab.com>

Alex Buijs authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-prevent-namespace-level-banned-users-from-accessing-api-16-1' into '16-1-stable-ee'

See merge request gitlab-org/security/gitlab!3485

Changelog: security

Check prohibit_outer_forks in fork relationship api

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3478



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Alexandru Croitor <acroitor@gitlab.com>
Co-authored-by: ghinfeydesktop <ghinfey@gitlabdesktop.com>

Gavin Hinfey authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-415338-16-1' into '16-1-stable-ee'

See merge request gitlab-org/security/gitlab!3478

Changelog: security

Prevent traversal for `path` parameter in refs/switch endpoint

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3476



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Michael Kozono <mkozono@gitlab.com>
Co-authored-by: Thong Kuah <tkuah@gitlab.com>

Thong Kuah authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-refs-switch-redirect-16-1' into '16-1-stable-ee'

See merge request gitlab-org/security/gitlab!3476

Changelog: security

Gitaly keyset pager when pagination none only with tree view

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3482



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Dmitry Gruzd <dgruzd@gitlab.com>
Co-authored-by: Patrick Cyiza <jpcyiza@gitlab.com>

Patrick Cyiza authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-414502-confidential-gitaly-keyset-16-1' into '16-1-stable-ee'

See merge request gitlab-org/security/gitlab!3482

Changelog: security

Backport "Geo: Resync direct upload object stored artifacts" to 16.1

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/129884



Merged-by: Mayra Cabrera <mcabrera@gitlab.com>
Approved-by: Douglas Barbosa Alexandre <dbalexandre@gmail.com>
Approved-by: Mayra Cabrera <mcabrera@gitlab.com>
Co-authored-by: Douglas Barbosa Alexandre <dbalexandre@gmail.com>

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/128939



Merged-by: Douglas Barbosa Alexandre <dbalexandre@gmail.com>
Approved-by: Gregory Havenga <11164960-ghavenga@users.noreply.gitlab.com>
Approved-by: Douglas Barbosa Alexandre <dbalexandre@gmail.com>
Co-authored-by: Mike Kozono <mkozono@gitlab.com>

(cherry picked from commit eaa8da04)

33f2f25d Resync direct upload object stored artifacts
15737ede Perform update queries in Sidekiq job

Changelog: fixed
EE: true

Adjust Danger logic for stable branches

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/128764



Merged-by: Reuben Pereira <2967854-rpereira2@users.noreply.gitlab.com>
Approved-by: David Dieulivol <ddieulivol@gitlab.com>
Co-authored-by: Steve Abrams <sabrams@gitlab.com>

Revert "Log rails response length" - 16.1 Backport

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/128779



Merged-by: Reuben Pereira <2967854-rpereira2@users.noreply.gitlab.com>
Approved-by: Bob Van Landuyt <bob@gitlab.com>
Co-authored-by: Robert May <rmay@gitlab.com>

This reverts commit cd158c29.

Danger only considers the current stable version
when checking if it is within the maintenance policy.

[merge-train skip]

[ci skip]

[ci skip]

Backport "Fix artifacts object storage geo replication" to 16.1

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/128291



Merged-by: Steve Abrams <sabrams@gitlab.com>
Approved-by: Michael Kozono <mkozono@gitlab.com>
Approved-by: Steve Abrams <sabrams@gitlab.com>
Co-authored-by: Michael Kozono <mkozono@gitlab.com>

Michael Kozono authored 1 year ago and Frederick Bajao committed 1 year ago

Fix artifacts object storage geo replication

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/127733



Merged-by: Michael Kozono <mkozono@gitlab.com>
Approved-by: Michael Kozono <mkozono@gitlab.com>
Reviewed-by: Michael Kozono <mkozono@gitlab.com>
Reviewed-by: Erick Bajao <fbajao@gitlab.com>
Reviewed-by: Albert Salim <asalim@gitlab.com>
Co-authored-by: Erick Bajao <fbajao@gitlab.com>

(cherry picked from commit 8f9de66a)

eeef8e59 Fix artifacts object storage geo replication
69f402ed Explain why we need to override store method
ccdd72cd Improve specs and explanation

[merge-train skip]

[ci skip]

[ci skip]