Display only information visible to current user on Milestone detail

See merge request gitlab/gitlabhq!2803

Display only labels and assignees of issues
visible by the currently logged user
Display only issues visible to user in the burndown chart

[master] Check issue milestone availability

See merge request gitlab/gitlabhq!2788

Don't allow non-members to see private related MRs

Closes #2787

See merge request gitlab/gitlabhq!2866

Forbid creating discussions for users with restricted access

Closes #2788

See merge request gitlab/gitlabhq!2868

Fix leaking private repository information in API

See merge request gitlab/gitlabhq!2881

Prevent Releases links API to leak tag existence

Closes #2795

See merge request gitlab/gitlabhq!2893

Disable issue board policies when issues are disabled

Closes #2798

See merge request gitlab/gitlabhq!2894

Show only MRs visible to user on milestone detail

See merge request gitlab/gitlabhq!2895

Sharing a public project with a private group makes the group page publicly accessible

See merge request gitlab/gitlabhq!2896

Merge branch '2802-security-add-public-internal-groups-as-members-to-your-project-idor' into 'master'

Add public/internal groups as members to your Project(IDOR)

See merge request gitlab/gitlabhq!2898

Block local URLs for Kubernetes integration

See merge request gitlab/gitlabhq!2901

Validate session key when authorizing with GCP to create a cluster

Closes #2805

See merge request gitlab/gitlabhq!2902

Check snippet attached file to be moved is within designated directory

Closes #2806

See merge request gitlab/gitlabhq!2903

Fix blind SSRF in Prometheus Integration

See merge request gitlab/gitlabhq!2907

Check validity before querying so that if the dns entry for the api_url
has been changed to something invalid after the model was saved and
checked for validity, it will not query. This is to solve a toctou
(time of check to time of use) issue.

[master] Remove link after issue move when no permissions

See merge request gitlab/gitlabhq!2921

Stop linking to unrecognized package sources

See merge request gitlab/gitlabhq!2933

Fix git clone revealing private repo's presence

See merge request gitlab/gitlabhq!2937

Arbitrary file read via MergeRequestDiff

Closes #2814

See merge request gitlab/gitlabhq!2947

Limit number of characters allowed in mermaidjs

See merge request gitlab/gitlabhq!2964

[master] Prevent disclosing project milestone titles

Closes #2794

See merge request gitlab/gitlabhq!2965

Filter impersonated sessions from active sessions and remove ability to revoke session

See merge request gitlab/gitlabhq!2968

Ensure request to link GroupSAML acount was GitLab initiated

See merge request gitlab/gitlabhq!2976

[ci skip]

Session ID is used as a parameter for the revoke session endpoint but it
should never be included in the HTML as an attacker could obtain it via
XSS.

Persist source sha and target sha for merge pipelines

See merge request gitlab-org/gitlab-ce!25417

Quarantine failing push_mirroring_over_http_spec

See merge request gitlab-org/gitlab-ce!25590

source_sha and target_sha are used for merge request pipelines

Added permissions section to issue template [CE]

See merge request gitlab-org/gitlab-ce!25576

Update operations settings breadcrumb trail

Closes #56387

See merge request gitlab-org/gitlab-ce!25539

Elaborate on POSTGRES_VERSION Auto DevOps setting

See merge request gitlab-org/gitlab-ce!25579