[ci skip]

Prepare 10.3.9

See merge request gitlab/gitlabhq!2355

[10.3] Fix GitLab Auth0 integration signs in the wrong user

See merge request gitlab/gitlabhq!2351

[10.3] Server Side Request Forgery in Services and Web Hooks

See merge request gitlab/gitlabhq!2346

[ci skip]

Prepare 10.3.8

See merge request gitlab/gitlabhq!2340

Update gitlab-pages version (GitLab 10.3)

See merge request gitlab/gitlabhq!2319

Ensure that OTP backup codes are always invalidated (10.3 port)

See merge request gitlab/gitlabhq!2328

Resolve "Update Nokogiri to 1.8.2"

Closes #42591

See merge request gitlab-org/gitlab-ce!16807

[ci skip]

Fix using wildcards in protected tags to expose protected variables - 10.3

See merge request gitlab/gitlabhq!2307

There were three things here:

1. Display math was broken.
2. <script> tags could be injected into code blocks with the language as `math`,
   `mermaid`, or `plantuml`.
3. <script> tags could be injected if Rouge threw an exception, for whatever
   reason.

This fixes all of those by always using the same code path for 'standard'
highlighting and 'special' languages (mathematics, Mermaid, and PlantUML), and
skipping the filter entirely if Rouge fails on a retry with the plain text
filter. It also adds specs for KaTeX and Mermaid rendering.

[10.3] Fix stored XSS in code blocks

See merge request gitlab/gitlabhq!2317

[10-3] Fix GitHub import allowing a user to create a group under any existing namespace

See merge request gitlab/gitlabhq!2303

[10.3] Restrict Todo API mark_as_done endpoint to the user's todos only

See merge request gitlab/gitlabhq!2314

Merge branch 'security-10-3-25223-snippets-finder-doesnt-obey-feature-visibility' into 'security-10-3'

[Port for security-10-3]: Makes SnippetFinder ensure feature visibility

See merge request gitlab/gitlabhq!2311

[ci skip]

Prepare 10.3.6 release

See merge request gitlab-org/gitlab-ce!16581

Fix shortcut links on help page

Closes #41097

See merge request gitlab-org/gitlab-ce!16001

(cherry picked from commit 4e60b4f1)

befa1e5b Fix shortcut links on help page
4860f586 Add changelog
e4786a85 Add bundle and spec

Add CI YML example for Browser Performance Testing in CE

See merge request gitlab-org/gitlab-ce!16058

(cherry picked from commit 3ee5fd15)

496f2ba7 Add CI YML example for CE

Refactor user, project and group docs when changing namespace

See merge request gitlab-org/gitlab-ce!16019

Clarify Auto DevOps pipelines

See merge request gitlab-org/gitlab-ce!16106

(cherry picked from commit 2972352a)

16f45850 Clarify Auto DevOps pipelines
e263f7e5 Remove image to Auto DevOps settings and refactor the enable section

Gracefully handle garbled URIs in Markdown

Closes #41442

See merge request gitlab-org/gitlab-ce!16123

(cherry picked from commit 29749f92)

0faf772b Gracefully handle garbled URIs in Markdown

Fixed abuse reports link url

See merge request gitlab-org/gitlab-ce!16068

(cherry picked from commit 97bebab6)

7dfafd0f Fixed abuse reports link url
9574818e Add changelog entry

Update prometheus gem to version that publishes +Inf bucket in accordance with Prometheus docs.

See merge request gitlab-org/gitlab-ce!16175

(cherry picked from commit b6d3dfe5)

387c808f Update prometheus gem to version that adds inf+ bucket in accordance with Prometheus docs.

Avoid leaving a push event empty if payload cannot be created

See merge request gitlab-org/gitlab-ce!16214

(cherry picked from commit 51562aaf)

57dc5a52 Avoid leaving a push event empty if payload cannot be created

Do not run ee_compat_check on security branches

Closes #41396

See merge request gitlab-org/gitlab-ce!16188

(cherry picked from commit 54bbcc3d)

ebdcbd45 Do not run ee_compat_check on security branches

Merge branch '41677-branch-name-omitted-due-to-bad-utf-8-conversion-by-gitaly-ref-handler' into 'master'

Resolve "Branch name omitted due to bad UTF-8 conversion by Gitaly ref handler"

Closes #41677

See merge request gitlab-org/gitlab-ce!16243

(cherry picked from commit f7afb14c)

5152cc3b Fix a bug where charlock_holmes was used needlessly to encode strings

Merge branch '41468-error-500-trying-to-view-a-merge-request-json-undefined-method-binary-for-nil-nilclass' into 'master'

Resolve "Error 500 trying to view a merge request JSON: undefined method `binary?' for nil:NilClass"

Closes #41468

See merge request gitlab-org/gitlab-ce!16193

(cherry picked from commit 016a2b6e)

528b5eeb Fix error when viewing diffs without blobs

Fix changes dropdown ellipsis working across browsers

Closes #41561 and #41684

See merge request gitlab-org/gitlab-ce!16281

Resolve "gitlab-rake gitlab:import:repos schedules an import"

Closes #41424

See merge request gitlab-org/gitlab-ce!16115