Fix for three open redirect vulns using redirect_to url_for(params.merge)))

See merge request !2082

Introduced a new method but had failed to account for other delegated methods that were being used

Previously accidently added a test for a feature that does not exist in this release
: preserved styles in labels

Fix for open redirect vuln involving continue[to] params

See merge request !2083

Fix for path disclosure in project import/export

See merge request !2080

Don’t show source project name when user does not have access

See merge request !2081

Remove class from SanitizationFilter whitelist

See merge request !2079

[ci skip]

nil check for url_blocker?

See merge request !2076

fix for render json include leaks

See merge request !2074
Conflicts:
	app/controllers/projects/merge_requests_controller.rb
	spec/controllers/projects/issues_controller_spec.rb

Adds rel="noopener noreferrer" to all links with target="_blank"

See merge request !2071
Conflicts:
	app/assets/javascripts/environments/components/environment_external_url.js
	app/assets/javascripts/merge_request_widget.js
	app/helpers/commits_helper.rb
	app/views/projects/services/mattermost_slash_commands/_detailed_help.html.haml
	app/views/projects/services/mattermost_slash_commands/_help.html.haml
	app/views/projects/services/slack_slash_commands/_help.html.haml

Protect server against SSRF in project import URLs

See merge request !2068

Only show public emails in atom feeds

See merge request !2066

[ci skip]

[ci skip]

[ci skip]

Fix CompareService signature

See merge request !9515

In 8.17+, this takes two arguments to `new`, and two for `execute`. In
8.16, it takes four to `execute`.

This reverts commit f948c2f4.

Fix MR changes tab size count

Closes #27563

See merge request !9091

Allow searching issues for strings containing colons

Closes #28357

See merge request !9400

Fix hash of ruby in update documentation

See merge request !8735

[ci skip]

Show merge errors in merge request widget

Closes #28124 and gitlab-ee#1652

See merge request !9229
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix smart interval 8-16-stable failure

See merge request !9310

Change toBe to toBeLessThan to account for flakey timers, spec needs refactoring a little so this is not a complete fix

Signed-off-by: Rémy Coutable <remy@rymai.me>

Don't delete assigned MRs/issues when user is deleted

See merge request !8634

Reduce hits to LDAP on Git HTTP auth by reordering auth mechanisms

Closes #24462

See merge request !8752

Fix filtered search user autocomplete for gitlab instances that are hosted on a subdirectory

Closes #27343

See merge request !8891
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix wrong call to ProjectCacheWorker.perform, and call ProjectCacheWorker.perform_async instead

Closes #27516

See merge request !8910

Don't render snippet actions for logged-out users

Closes #27708

See merge request !8995

Snippet spam

Closes #26276

See merge request !8911

API: Fix file downloading

See merge request !8953

Remove unnecessary queries for .atom and .json in Dashboard::ProjectsController#index

Closes #27267

See merge request !8956