[merge-train skip]

[ci skip]

[ci skip]

Add authorization checks to import status endpoint

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3514



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Dylan Griffith <dyl.griffith@gmail.com>
Approved-by: Luke Duncalfe <lduncalfe@gitlab.com>
Co-authored-by: bmarjanovic <bmarjanovic@gitlab.com>

Bojan Marjanović authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-415117-confidential-issue-16-2' into '16-2-stable-ee'

See merge request gitlab-org/security/gitlab!3514

Changelog: security

Update commonmarker to 0.23.10

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3508



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Mario Celi <mcelicalderon@gitlab.com>
Co-authored-by: Brett Walker <bwalker@gitlab.com>

Brett Walker authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-update-commonmarker-16-2' into '16-2-stable-ee'

See merge request gitlab-org/security/gitlab!3508

Changelog: security

Remove DAST secret variables when URL is updated

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3499



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Aboobacker MK <akarakath@gitlab.com>
Approved-by: Himanshu Kapoor <info@fleon.org>
Co-authored-by: Dheeraj Joshi <djoshi@gitlab.com>

Dheeraj Joshi authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-dast-reset-secrets-16-2' into '16-2-stable-ee'

See merge request gitlab-org/security/gitlab!3499

Changelog: security

Maintainer can leak sentry token by changing the configured URL

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3517



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Allen Cook <acook@gitlab.com>
Co-authored-by: bmarjanovic <bmarjanovic@gitlab.com>

Bojan Marjanović authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-422134-confidential-issue-16-2' into '16-2-stable-ee'

See merge request gitlab-org/security/gitlab!3517

Changelog: security

Merge branch 'security-smriti-417664/external_user_escalated_service_account-16-2' into '16-2-stable-ee'

Service account users are external by default

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3502



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Aboobacker MK <akarakath@gitlab.com>
Co-authored-by: smriti <sgarg@gitlab.com>

Smriti Garg authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-smriti-417664/external_user_escalated_service_account-16-2' into '16-2-stable-ee'

See merge request gitlab-org/security/gitlab!3502

Changelog: security

Additional permission check when editing label

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3505



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Mark Chao <mchao@gitlab.com>
Co-authored-by: Brett Walker <bwalker@gitlab.com>

Brett Walker authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-reporter-group-labels-16-2' into '16-2-stable-ee'

See merge request gitlab-org/security/gitlab!3505

Changelog: security

Fix ReDOS in bulk_imports endpoint params

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3511



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Bojan Marjanovic <bmarjanovic@gitlab.com>
Co-authored-by: Luke Duncalfe <lduncalfe@eml.cc>

Luke Duncalfe authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-415067-redos-in-bulk_imports-api-16-2' into '16-2-stable-ee'

See merge request gitlab-org/security/gitlab!3511

Changelog: security

Merge branch 'security-prevent-namespace-level-banned-users-from-accessing-api-16-2' into '16-2-stable-ee'

Prevent namespace level banned users from accessing API

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3484



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Kassio Borges <kborges@gitlab.com>
Co-authored-by: Alex Buijs <abuijs@gitlab.com>

Alex Buijs authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-prevent-namespace-level-banned-users-from-accessing-api-16-2' into '16-2-stable-ee'

See merge request gitlab-org/security/gitlab!3484

Changelog: security

Requires write_model_experiments on mlflow api

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3480



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Gary Holtz <gholtz@gitlab.com>
Approved-by: Ahmed Hemdan <ahemdan@gitlab.com>
Co-authored-by: Eduardo Bonet <ebonet@gitlab.com>

Eduardo Bonet authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-420301-requires-write-on-mlflow-endpoints-16-2' into '16-2-stable-ee'

See merge request gitlab-org/security/gitlab!3480

Changelog: security

Check prohibit_outer_forks in fork relationship api

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3477



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Alexandru Croitor <acroitor@gitlab.com>
Co-authored-by: ghinfeydesktop <ghinfey@gitlabdesktop.com>

Gavin Hinfey authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-415338-16-2' into '16-2-stable-ee'

See merge request gitlab-org/security/gitlab!3477

Changelog: security

Remove GCP private key from streaming audit events UI

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3487



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Sean Arnold <sarnold@gitlab.com>
Approved-by: Miguel Rincon <mrincon@gitlab.com>
Reviewed-by: Nick Malcolm <nmalcolm@gitlab.com>
Co-authored-by: nrosandich <nrosandich@gitlab.com>

Nathan Rosandich authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-gcp-streaming-key-16-2' into '16-2-stable-ee'

See merge request gitlab-org/security/gitlab!3487

Changelog: security

Prevent traversal for `path` parameter in refs/switch endpoint

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3475



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Michael Kozono <mkozono@gitlab.com>
Co-authored-by: Thong Kuah <tkuah@gitlab.com>

Thong Kuah authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-refs-switch-redirect-16-2' into '16-2-stable-ee'

See merge request gitlab-org/security/gitlab!3475

Changelog: security

Gitaly keyset pager when pagination none only with tree view

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3481



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Dmitry Gruzd <dgruzd@gitlab.com>
Co-authored-by: Patrick Cyiza <jpcyiza@gitlab.com>

Patrick Cyiza authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-414502-confidential-gitaly-keyset-16-2' into '16-2-stable-ee'

See merge request gitlab-org/security/gitlab!3481

Changelog: security

Backport "Geo: Resync direct upload object stored artifacts" to 16.2

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/129883



Merged-by: Mayra Cabrera <mcabrera@gitlab.com>
Approved-by: Douglas Barbosa Alexandre <dbalexandre@gmail.com>
Approved-by: Mayra Cabrera <mcabrera@gitlab.com>
Co-authored-by: Douglas Barbosa Alexandre <dbalexandre@gmail.com>

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/128939



Merged-by: Douglas Barbosa Alexandre <dbalexandre@gmail.com>
Approved-by: Gregory Havenga <11164960-ghavenga@users.noreply.gitlab.com>
Approved-by: Douglas Barbosa Alexandre <dbalexandre@gmail.com>
Co-authored-by: Mike Kozono <mkozono@gitlab.com>

(cherry picked from commit eaa8da04)

33f2f25d Resync direct upload object stored artifacts
15737ede Perform update queries in Sidekiq job

Changelog: fixed
EE: true

Adjust Danger logic for stable branches

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/128763



Merged-by: Reuben Pereira <2967854-rpereira2@users.noreply.gitlab.com>
Approved-by: David Dieulivol <ddieulivol@gitlab.com>
Co-authored-by: Steve Abrams <sabrams@gitlab.com>

[merge-train skip]

[ci skip]

[ci skip]

Replace vscode-cdn.net with web-ide.gitlab-static.net (Backport)

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/128950



Merged-by: Kerri Miller <kerrizor@kerrizor.com>
Approved-by: Kerri Miller <kerrizor@kerrizor.com>
Co-authored-by: Enrique Alcántara <ealcantara@gitlab.com>

Fix broken dependency list for invalid Container Scanning pkg mgr type

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/128942



Merged-by: Kerri Miller <kerrizor@kerrizor.com>
Approved-by: Adam Cohen <acohen@gitlab.com>
Approved-by: Kerri Miller <kerrizor@kerrizor.com>

Enrique Alcántara authored 1 year ago and Paul Slaughter committed 1 year ago

- (cherry picked from commit ae41ed4d)
- https://gitlab.com/gitlab-org/gitlab/-/issues/414488

Changelog: fixed

Kerri Miller authored 1 year ago and Thiago Figueiro committed 1 year ago

Fix broken dependency list for invalid Container Scanning pkg mgr type

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/128385



Merged-by: Kerri Miller <kerrizor@kerrizor.com>
Approved-by: Kerri Miller <kerrizor@kerrizor.com>
Co-authored-by: Adam Cohen <acohen@gitlab.com>

Revert "Remove log_response_length feature flag" - 16.2 Backport

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/128778



Merged-by: Bob Van Landuyt <bob@gitlab.com>
Approved-by: Bob Van Landuyt <bob@gitlab.com>
Co-authored-by: Robert May <rmay@gitlab.com>