Update CHANGELOG.md for 11.11.6

[ci skip]

CHANGELOG.md

@@ -2,6 +2,21 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 11.11.6
+
+### Security (9 changes)
+
+- Restrict slash commands to users who can log in.
+- Patch XSS issue in wiki links.
+- Filter merge request params on the new merge request page.
+- Fix Server Side Request Forgery mitigation bypass.
+- Show badges if pipelines are public otherwise default to project permissions.
+- Do not allow localhost url redirection in GitHub Integration.
+- Do not show moved issue id for users that cannot read issue.
+- Use source project as permissions reference for MergeRequestsController#pipelines.
+- Drop feature to take ownership of trigger token.
+
+
 ## 11.11.5 (2019-06-27)
 
 - No changes.

changelogs/unreleased/security-2873-blocked-user-slash-command-bypass-master.yml

----
-title: Restrict slash commands to users who can log in
-merge_request:
-author:
-type: security

changelogs/unreleased/security-60143-patch-additional-xss-vector-in-wikis.yml

----
-title: Patch XSS issue in wiki links
-merge_request:
-author:
-type: security

changelogs/unreleased/security-bvl-filter-mr-params.yml

----
-title: Filter merge request params on the new merge request page
-merge_request:
-author:
-type: security

changelogs/unreleased/security-dns-ssrf-bypass.yml

----
-title: Fix Server Side Request Forgery mitigation bypass
-merge_request:
-author:
-type: security

changelogs/unreleased/security-fix-badges-leaked-to-unauthorized-users.yml

----
-title: Show badges if pipelines are public otherwise default to project permissions.
-erge_request:
-author:
-type: security

changelogs/unreleased/security-github-ssrf-redirect.yml

----
-title: Do not allow localhost url redirection in GitHub Integration
-merge_request:
-author:
-type: security

changelogs/unreleased/security-hide_moved_issue_id.yml

----
-title: Do not show moved issue id for users that cannot read issue
-merge_request:
-author:
-type: security

changelogs/unreleased/security-mr-pipeline-permissions.yml

----
-title: Use source project as permissions reference for MergeRequestsController#pipelines
-merge_request:
-author:
-type: security

changelogs/unreleased/security-remove-take-trigger-ownership-feature.yml

----
-title: Drop feature to take ownership of trigger token.
-merge_request:
-author:
-type: security