Update CHANGELOG.md for 10.6.6

CHANGELOG.md

@@ -2,6 +2,16 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 10.6.6 (2018-05-28)
+
+### Security (4 changes)
+
+- Do not allow non-members to create MRs via forked projects when MRs are private.
+- Prevent user passwords from being changed without providing the previous password.
+- Fix API to remove deploy key from project instead of deleting it entirely.
+- Fixed bug that allowed importing arbitrary project attributes.
+
+
 ## 10.6.5 (2018-04-24)
 
 ### Security (1 change)

changelogs/unreleased/42682-merge-request-project-members-access.yml

----
-title: Do not allow non-members to create MRs via forked projects when MRs are private
-merge_request:
-author:
-type: security

changelogs/unreleased/security-10-6-users-can-update-their-password-without-entering-current-password.yml

----
-title: Prevent user passwords from being changed without providing the previous password
-merge_request:
-author:
-type: security

changelogs/unreleased/security-dm-delete-deploy-key.yml

----
-title: Fix API to remove deploy key from project instead of deleting it entirely
-merge_request:
-author:
-type: security

changelogs/unreleased/security-fj-import-export-assignment.yml

----
-title: Fixed bug that allowed importing arbitrary project attributes
-merge_request:
-author:
-type: security