Update CHANGELOG.md for 9.4.6

CHANGELOG.md

@@ -2,6 +2,18 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 9.4.6 (2017-09-06)
+
+- [SECURITY] Upgrade mail and nokogiri gems due to security issues. !13662 (Markus Koller)
+- [SECURITY] Prevent a persistent XSS in the commit author block.
+- Fix XSS issue in go-get handling.
+- Remove hidden symlinks from project import files.
+- Fixes race condition in project uploads.
+- Disallow Git URLs that include a username or hostname beginning with a non-alphanumeric character.
+- Disallow arbitrary properties in `th` and `td` `style` attributes.
+- Resolve CSRF token leakage via pathname manipulation on environments page.
+- Disallow the `name` attribute on all user-provided markup.
+
 ## 9.4.5 (2017-08-14)
 
 - Fix deletion of deploy keys linked to other projects. !13162

changelogs/unreleased/29943-environment-folder.yml

----
-title: Resolve CSRF token leakage via pathname manipulation on environments page
-merge_request:
-author:

changelogs/unreleased/dm-go-get-xss.yml

----
-title: Fix XSS issue in go-get handling
-merge_request:
-author:

changelogs/unreleased/fix-escape-commit-block.yml

----
-title: Prevent a persistent XSS in the commit author block
-merge_request:
-author:
-type: security

changelogs/unreleased/fix-gem-security-updates.yml

----
-title: Upgrade mail and nokogiri gems due to security issues
-merge_request: 13662
-author: Markus Koller
-type: security

changelogs/unreleased/fix-import-symbolink-links.yml

----
-title: Remove hidden symlinks from project import files
-merge_request:
-author:

changelogs/unreleased/race-condition-in-project-uploads-fix-9-4.yml

----
-title: Fixes race condition in project uploads
-merge_request:
-author:

changelogs/unreleased/rs-alphanumeric-ssh-params.yml

----
-title: Disallow Git URLs that include a username or hostname beginning with a non-alphanumeric
-  character
-merge_request:
-author:

changelogs/unreleased/rs-issue-36098.yml

----
-title: Disallow arbitrary properties in `th` and `td` `style` attributes
-merge_request:
-author:

changelogs/unreleased/rs-issue-36104.yml

----
-title: Disallow the `name` attribute on all user-provided markup
-merge_request:
-author: