[merge-train skip]

[ci skip]

[ci skip]

Prepare 14.0.8-ee release

See merge request gitlab-org/gitlab!68761

Backport fix for flaky spec to 14.0

See merge request gitlab-org/gitlab!68959

Taken from https://gitlab.com/gitlab-org/gitlab/-/merge_requests/65153.

Geo 2.0 Regression - Add ability to remove primary

See merge request gitlab-org/gitlab!68867

Backport: Fix Sidekiq workers delete each other's metrics

See merge request gitlab-org/gitlab!68771

When we moved the logic that wipes the Prometheus metrics
dir out of the Rackup file and into the initializer, all
Sidekiq workers would call this and potentially enter a
race condition where they deleted each other's database
files.

Changelog: fixed

Mark Chao authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Resolve "operator does not exist: integer[] || bigint in app/models/namespace/traversal_hierarchy.rb"

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/67288

Changelog: changed

Andreas Brandl authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/66627

Changelog: other

[merge-train skip]

[ci skip]

[ci skip]

Don't allow to add users to project with email different than group sett

See merge request gitlab-org/security/gitlab!1563

Hide project-level CI/CD Analytics page for Guest users

See merge request gitlab-org/security/gitlab!1574

Merge branch 'security-not-allow-to-impersonate-tokens-while-impersonation-is-off-14-0' into '14-0-stable-ee'

Block pushing with impersonation token if impersonation is disabled

See merge request gitlab-org/security/gitlab!1584

Changelog: security

This commit updates the project-level CI/CD Analytics page to not be
accessible by Guest users of private projects.

Changelog: security

Add permissions check to pipelines#show action

See merge request gitlab-org/security/gitlab!1613

Disallow non-members to set issue metadata on issue create

See merge request gitlab-org/security/gitlab!1581

Do not show email address in error message

See merge request gitlab-org/security/gitlab!1597

Misleading username could lead to impersonation in using SSH Certificates

See merge request gitlab-org/security/gitlab!1610

Remove impersonation token from api response for non-admin user

See merge request gitlab-org/security/gitlab!1566

Only allow invite to be accepted by user with matching email

See merge request gitlab-org/security/gitlab!1633

Add html escaping for default branch name

See merge request gitlab-org/security/gitlab!1631

Configure OmniAuth to use GitLab AppLogger

See merge request gitlab-org/security/gitlab!1616

Merge branch 'security-prevent-guests-from-creating-issues-with-sentry-error-14-0' into '14-0-stable-ee'

Prevent Guest users from creating issues linked to Sentry errors

See merge request gitlab-org/security/gitlab!1588

Updates oauth to 0.5.6

See merge request gitlab-org/security/gitlab!1568

Unauthorized User Can Trigger Deployment to the Protected Environment

See merge request gitlab-org/security/gitlab!1607

Fix tag ref detection for pipelines

See merge request gitlab-org/security/gitlab!1548

Restrict access to instance-level security features for reporters

See merge request gitlab-org/security/gitlab!1539

[14.0] Fix XSS in Mermaid Markdown rendering

See merge request gitlab-org/security/gitlab!1489

Filter todos whose target users no longer have access to [RUN AS-IF-FOSS]

See merge request gitlab-org/security/gitlab!1554

Previously, any user was able to accept an invite even if the
user's email addresses didn't match the invite. A note was
displayed but the invite could still be accepted. With this
change, a user without a matching, confirmed email address
is unable to accept the invite.

Changelog: security

This escapes html chars for default branch
name value in initializing repository instructions

This is to prevent XSS vulnerability

Changelog: security

OmniAuth logger was not being configured properly and some logs
were being dropped. This change ensures OmniAuth log messages
are output to `application.log` and/or `application_json.log`
as appropriate depending on configuration.

Fix Group SAML Spec order dependency

Change `allow/expect_any_instance_of` to
`allow/expect_next_instance_of` to avoid leaking state from other
tests.

Changelog: security

This check renders a 404 in case the user trying
to access the pipeline details page doesn't have enough
permissions

Changelog: security