Enforce max chars and max render time in markdown math

See merge request gitlab/gitlab-ee!1138

Require a captcha after unique failed logins from the same IP

See merge request gitlab/gitlab-ee!1148

Fix DNS rebind vulnerability for JIRA integration

See merge request gitlab/gitlab-ee!1163

Project visibility restriction bypass

See merge request gitlab/gitlab-ee!1174

Introduce JobActivity limit for alive jobs

Closes #376

See merge request gitlab/gitlab-ee!1182

DNS Rebind SSRF in Kubernetes Integration

See merge request gitlab/gitlab-ee!1188

Clear reset_password_tokens when login (email or username) change

See merge request gitlab/gitlab-ee!1193

Prevent disclosure of merge request id via email

See merge request gitlab/gitlab-ee!1198

Restrict MergeRequests#test_reports to authenticated users with read-access on Builds

See merge request gitlab/gitlab-ee!1203

Add direct upload support for personal snippets

See merge request gitlab/gitlab-ee!1208

admin_group authorization for Groups::RunnersController

See merge request gitlab/gitlab-ee!1213

Re-escape the whole HTML content when finding HTML references

See merge request gitlab/gitlab-ee!1217

Send TODOs for comments on commits correctly

See merge request gitlab/gitlab-ee!1219

Gitaly: ignore git redirects

See merge request gitlab/gitlab-ee!1226

Avoid exposing unaccessible repo data upon GFM post processing

See merge request gitlab/gitlab-ee!1235

[ci skip]

[ci skip]

[ci skip]

[ci skip]

[ci skip]

[ci skip]

When post-processing relative links to absolute links
RelativeLinkFilter didn't take into consideration that
internal repository data could be exposed for users
that do not have repository access to the project.

This commit solves that by checking whether the user
can `download_code` at this repository, avoiding any
processing of this filter if the user can't.

Additionally, if we're processing for a group (
no project was given), we check if the user can
read it in order to expand the href as an extra.
That doesn't seem necessarily a breach now,
but an extra check doesn't hurt as after all
the user needs to be able to `read_group`.

Bump ruby-prof to 1.0.0

See merge request gitlab-org/gitlab-ce!29588

Install Unleash Client Gem

See merge request gitlab-org/gitlab-ce!32065

Backport expired job artifact trait

See merge request gitlab-org/gitlab-ce!32179

Add helpers to exactly undo cleanup_concurrent_column_rename

See merge request gitlab-org/gitlab-ce!32183

- Also add helper to undo rename_column_concurrently.

Add helper to exactly undo cleanup_concurrent_column_rename

See merge request gitlab-org/gitlab-ee!15614

- Also add helper to undo rename_column_concurrently.

This is significant improvement over the previous releases:
https://github.com/ruby-prof/ruby-prof/blob/master/CHANGES

Resolve "Show the paths for groups in productivity analytics"

Closes #13637

See merge request gitlab-org/gitlab-ee!15513

- Add changelog entry
- Add specs for displaying the full group path
- Add selector to component

Preload tags when loading Ci::Pipeline

Closes #60925

See merge request gitlab-org/gitlab-ce!32149