Add merge active status messages and use one of
them randomly.

Auditor can see and add projects in security center

See merge request gitlab-org/gitlab!58841

Update button variants to btn-confirm on MR page

See merge request gitlab-org/gitlab!60254

Show translation levels in UI

See merge request gitlab-org/gitlab!59420

Add gl-form-input class for fields in bitbucket import page

See merge request gitlab-org/gitlab!58309

Add gl-form-input class for fields in fogbugz import page

See merge request gitlab-org/gitlab!58312

Add gl-form-input class for fields in gitea import page

See merge request gitlab-org/gitlab!58313

Prevent DOS from Chaining in Mermaid

See merge request gitlab-org/gitlab!60382

Add gl-form-input class for fields in import page

See merge request gitlab-org/gitlab!58316

Added tracking to the different diff view settings [RUN ALL RSPEC] [RUN AS-IF-FOSS]

See merge request gitlab-org/gitlab!59979

Add descriptions for GroupMemberRelationEnum

See merge request gitlab-org/gitlab!60158

Update Gitaly version

See merge request gitlab-org/gitlab!60507

Geo Node Status 2.0 - Vuex Spec Cleanup

See merge request gitlab-org/gitlab!60151

[VSA] Enable pagination (frontend)

See merge request gitlab-org/gitlab!59650

Don't allow chaining of links to be rendered directly
in the Mermaid diagram.

Changelog: security

Add Merge Requests and Requirements Menu

See merge request gitlab-org/gitlab!59374

We need to use gl-w-auto! since there is width: 100%
coming in from styles in .note-form-actions. Ideally we
should refactor that and remove the utils used here.

Fix spacing and alignment on xs / md breakpoints

Also update badge variant and add some spacing

Rename routeQuery to queryString in standard_filter.vue

See merge request gitlab-org/gitlab!60371

[ci skip]

[ci skip]

[ci skip]

[ci skip]

[ci skip]

[ci skip]

Any objects other than `User` (such as `DeployToken`) are not allowed

Changelog: security

Verify that read_api tokens cannot run mutations.

Also: adds tests use of OAuth tokens for GraphQL

We make some changes to the sessionless_authentication module
in order to capture the request_authenticator, so that we can access
the token scopes, without making any extra queries.

We ensure we always authorize the mutation, which, like all resolvers,
needs to opt in to the check.

Unlike resolvers, mutations should always raise. So
`BaseMutation.authorized?` raises on failure.

Logic for handling scopes is pushed down to the `ObjectAuthorization`
class, and encapsulated in the `ScopeValidator`, which limits the
methods that can be called by resolvers.