[ci skip]

Prepare 10.3.8

See merge request gitlab/gitlabhq!2340

Update gitlab-pages version (GitLab 10.3)

See merge request gitlab/gitlabhq!2319

Ensure that OTP backup codes are always invalidated (10.3 port)

See merge request gitlab/gitlabhq!2328

[ci skip]

Fix using wildcards in protected tags to expose protected variables - 10.3

See merge request gitlab/gitlabhq!2307

There were three things here:

1. Display math was broken.
2. <script> tags could be injected into code blocks with the language as `math`,
   `mermaid`, or `plantuml`.
3. <script> tags could be injected if Rouge threw an exception, for whatever
   reason.

This fixes all of those by always using the same code path for 'standard'
highlighting and 'special' languages (mathematics, Mermaid, and PlantUML), and
skipping the filter entirely if Rouge fails on a retry with the plain text
filter. It also adds specs for KaTeX and Mermaid rendering.

[10.3] Fix stored XSS in code blocks

See merge request gitlab/gitlabhq!2317

[10-3] Fix GitHub import allowing a user to create a group under any existing namespace

See merge request gitlab/gitlabhq!2303

[10.3] Restrict Todo API mark_as_done endpoint to the user's todos only

See merge request gitlab/gitlabhq!2314

Merge branch 'security-10-3-25223-snippets-finder-doesnt-obey-feature-visibility' into 'security-10-3'

[Port for security-10-3]: Makes SnippetFinder ensure feature visibility

See merge request gitlab/gitlabhq!2311

[ci skip]

Prepare 10.3.6 release

See merge request gitlab-org/gitlab-ce!16581

Fix shortcut links on help page

Closes #41097

See merge request gitlab-org/gitlab-ce!16001

(cherry picked from commit 4e60b4f1)

befa1e5b Fix shortcut links on help page
4860f586 Add changelog
e4786a85 Add bundle and spec

Add CI YML example for Browser Performance Testing in CE

See merge request gitlab-org/gitlab-ce!16058

(cherry picked from commit 3ee5fd15)

496f2ba7 Add CI YML example for CE

Refactor user, project and group docs when changing namespace

See merge request gitlab-org/gitlab-ce!16019

Clarify Auto DevOps pipelines

See merge request gitlab-org/gitlab-ce!16106

(cherry picked from commit 2972352a)

16f45850 Clarify Auto DevOps pipelines
e263f7e5 Remove image to Auto DevOps settings and refactor the enable section

Gracefully handle garbled URIs in Markdown

Closes #41442

See merge request gitlab-org/gitlab-ce!16123

(cherry picked from commit 29749f92)

0faf772b Gracefully handle garbled URIs in Markdown

Fixed abuse reports link url

See merge request gitlab-org/gitlab-ce!16068

(cherry picked from commit 97bebab6)

7dfafd0f Fixed abuse reports link url
9574818e Add changelog entry

Update prometheus gem to version that publishes +Inf bucket in accordance with Prometheus docs.

See merge request gitlab-org/gitlab-ce!16175

(cherry picked from commit b6d3dfe5)

387c808f Update prometheus gem to version that adds inf+ bucket in accordance with Prometheus docs.

Avoid leaving a push event empty if payload cannot be created

See merge request gitlab-org/gitlab-ce!16214

(cherry picked from commit 51562aaf)

57dc5a52 Avoid leaving a push event empty if payload cannot be created

Do not run ee_compat_check on security branches

Closes #41396

See merge request gitlab-org/gitlab-ce!16188

(cherry picked from commit 54bbcc3d)

ebdcbd45 Do not run ee_compat_check on security branches

Merge branch '41677-branch-name-omitted-due-to-bad-utf-8-conversion-by-gitaly-ref-handler' into 'master'

Resolve "Branch name omitted due to bad UTF-8 conversion by Gitaly ref handler"

Closes #41677

See merge request gitlab-org/gitlab-ce!16243

(cherry picked from commit f7afb14c)

5152cc3b Fix a bug where charlock_holmes was used needlessly to encode strings

Merge branch '41468-error-500-trying-to-view-a-merge-request-json-undefined-method-binary-for-nil-nilclass' into 'master'

Resolve "Error 500 trying to view a merge request JSON: undefined method `binary?' for nil:NilClass"

Closes #41468

See merge request gitlab-org/gitlab-ce!16193

(cherry picked from commit 016a2b6e)

528b5eeb Fix error when viewing diffs without blobs

Fix changes dropdown ellipsis working across browsers

Closes #41561 and #41684

See merge request gitlab-org/gitlab-ce!16281

Resolve "gitlab-rake gitlab:import:repos schedules an import"

Closes #41424

See merge request gitlab-org/gitlab-ce!16115

Fixing bug related to wiki last version

Closes #41477 and #41506

See merge request gitlab-org/gitlab-ce!16197

(cherry picked from commit 65b04860)

e44ca26f Fixing bug related to wiki last version
abe399b1 Added changelog
e471ec00 Restoring last version and created monkey patch
52c9dcb4 Fixed spec descriptions
5814d83c Updated monkey patch to work with paths with more than one dir
b9ff53c0 Updated specs
bc261232 Fixing offense

Prevent excessive DB load due to faulty DeleteConflictingRedirectRoutes background migration

See merge request gitlab-org/gitlab-ce!16205

(cherry picked from commit d2891822)

f6352772 Make DeleteConflictingRedirectRoutes no-op

Fix custom name in branch creation for issue in Firefox

Closes #41563

See merge request gitlab-org/gitlab-ce!16244

(cherry picked from commit ae46ceaa)

f4c2eeb2 Fix custom name in branch creation for issue in Firefox
578c930f Merge branch 'master' of gitlab.com:gitlab-org/gitlab-ce into…

Fix hooks not being set up properly for bare import Rake task

Closes #41739

See merge request gitlab-org/gitlab-ce!16280

Fix 500 error when visiting a commit where the blobs do not exist (nil blobs)

Closes #41491

See merge request gitlab-org/gitlab-ce!16237

Fixing request json mime type

Closes #41598

See merge request gitlab-org/gitlab-ce!16427

(cherry picked from commit f402762d)

defd12cc Trying to fix the json mime type in the request
2c352404 Added changelog
b7c19497 Added regression test

Fix Route validation when conflicting permanent redirects exist

Closes gitlab-com/support-forum#2883 and #41786

See merge request gitlab-org/gitlab-ce!16397

(cherry picked from commit d607f16f)

1dc30595 Revert "Revert "Fix Route validation for unchanged path""
c517788e Fix Rubocop offense
601c24d5 Add RedirectRoute factory
d4c8d1b7 Add changelog entry