[merge-train skip]

[ci skip]

[ci skip]

Prepare 14.1.3-ee release

See merge request gitlab-org/gitlab!68383

Andrew Fontaine authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/68005

Changelog: fixed
EE: true

Mark Chao authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Resolve "operator does not exist: integer[] || bigint in app/models/namespace/traversal_hierarchy.rb"

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/67288

Changelog: changed

Thong Kuah authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Bump kas to v14.1.1

See merge request gitlab-org/gitlab!66806

(cherry picked from commit 5651fc98)

b7a2bbf8 Bump kas to v14.1.1

Imre (Admin) authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/66791

Changelog: fixed
EE: true

Updating docs to fix UI link

See merge request gitlab-org/gitlab!67732

The docs were not updated in time for 14.1
and so the UI help link does not work properly.
This MR fixes that issue.
https://gitlab.com/gitlab-org/gitlab/-/issues/337876

[merge-train skip]

[ci skip]

[ci skip]

Don't allow to add users to project with email different than group sett

See merge request gitlab-org/security/gitlab!1564

Hide project-level CI/CD Analytics page for Guest users

See merge request gitlab-org/security/gitlab!1600

Merge branch 'security-not-allow-to-impersonate-tokens-while-impersonation-is-off-14-1' into '14-1-stable-ee'

Block pushing with impersonation token if impersonation is disabled

See merge request gitlab-org/security/gitlab!1583

Changelog: security

This commit updates the project-level CI/CD Analytics page to not be
accessible by Guest users of private projects.

Changelog: security

Add permissions check to pipelines#show action

See merge request gitlab-org/security/gitlab!1612

Disallow non-members to set issue metadata on issue create

See merge request gitlab-org/security/gitlab!1586

Do not show email address in error message

See merge request gitlab-org/security/gitlab!1596

Misleading username could lead to impersonation in using SSH Certificates

See merge request gitlab-org/security/gitlab!1609

Remove impersonation token from api response for non-admin user

See merge request gitlab-org/security/gitlab!1565

Only allow invite to be accepted by user with matching email

See merge request gitlab-org/security/gitlab!1632

Add html escaping for default branch name

See merge request gitlab-org/security/gitlab!1630

Configure OmniAuth to use GitLab AppLogger

See merge request gitlab-org/security/gitlab!1615

Merge branch 'security-prevent-guests-from-creating-issues-with-sentry-error-14-1' into '14-1-stable-ee'

Prevent Guest users from creating issues linked to Sentry errors

See merge request gitlab-org/security/gitlab!1587

Use oauth_app id instead of uid

See merge request gitlab-org/security/gitlab!1603

Updates oauth to 0.5.6

See merge request gitlab-org/security/gitlab!1592

Unauthorized User Can Trigger Deployment to the Protected Environment

See merge request gitlab-org/security/gitlab!1606

Fix tag ref detection for pipelines

See merge request gitlab-org/security/gitlab!1591

Restrict access to instance-level security features for reporters

See merge request gitlab-org/security/gitlab!1561

[14.1] Fix XSS in Mermaid Markdown rendering

See merge request gitlab-org/security/gitlab!1488

Filter todos whose target users no longer have access to [RUN AS-IF-FOSS]

See merge request gitlab-org/security/gitlab!1556

Previously, any user was able to accept an invite even if the
user's email addresses didn't match the invite. A note was
displayed but the invite could still be accepted. With this
change, a user without a matching, confirmed email address
is unable to accept the invite.

Changelog: security

This escapes html chars for default branch
name value in initializing repository instructions

This is to prevent XSS vulnerability

Changelog: security

[merge-train skip]

[ci skip]

[ci skip]