Private/internal repository enumeration via bruteforce on a vulnerable URL

See merge request gitlab/gitlab-ee!1345

Pass all wiki markup formats through our Banzai pipeline filters

See merge request gitlab/gitlab-ee!1351

Mask sentry auth token

See merge request gitlab/gitlab-ee!1360

Do not index system notes for issue update

See merge request gitlab/gitlab-ee!1370

Sanitize search text to prevent XSS

See merge request gitlab/gitlab-ee!1371

Require Maintainer permission on group where project is transferred to

See merge request gitlab/gitlab-ee!1375

Use the '\A' and '\z' regex anchors in `InternalRedirect` to mitigate an Open Redirect issue.

Closes gitlabhq#2934

See merge request gitlab/gitlab-ee!1381

Filter out search results based on permissions to avoid bugs leaking data

See merge request gitlab/gitlab-ee!1388

[ci skip]

[ci skip]

Fix `RSpec/ScatteredSetup` rubocop failure

See merge request gitlab-org/gitlab!19207

Return merge-request state in API

See merge request gitlab-org/gitlab!18888

- expose `has_conflicts` and `mergeable_discussions_state` in API
- add unit tests for the change

Merge branch '34408-reducing-the-data-being-loaded-per-design-on-first-load-of-design-management' into 'master'

[BE] Reduce the data being loaded per Design on first load

See merge request gitlab-org/gitlab!18997

- added selection by id and ids

Support query for multiple states

See merge request gitlab-org/gitlab!18518

Populate CI variables from params

Closes #24146

See merge request gitlab-org/gitlab!19023

When running a new pipeline on a
project, this commit gives the
feature of populating ci vars
from a url query string.

Workaround for QA tests when job_log_json flag is enabled

Closes #34901, #34900, and #34899

See merge request gitlab-org/gitlab!19145

Make 404 page button same height as text input

See merge request gitlab-org/gitlab!19080

Fix instance audit log spec flakiness

Closes #34865 and #34428

See merge request gitlab-org/gitlab!19089

Ensure that user is logged in as admin by logging out if already
logged in and login in not logged in already

Fix group_audit_logs_1_spec e2e test failures on staging

Closes #34237

See merge request gitlab-org/gitlab!19077

removes `export_designs` feature flags from ee files

Closes #32535

See merge request gitlab-org/gitlab!18507

closes #32535

* removes ee/project_tree_restorer and documentation line calling out incomplete support since they are no longer needed
* removes remove_feature_dependent_sub_relations method from project_tree_restorer

Move last 5 docs out of the workflow dir

See merge request gitlab-org/gitlab!18628

docs - Sort in ascending order the list of deprecated variables

See merge request gitlab-org/gitlab!19157

Update retrieval instruction of CA cert when adding k8s cluster

See merge request gitlab-org/gitlab!18031

Update Troubleshooting section in using_docker_build.md

See merge request gitlab-org/gitlab!18953

Clarify variable type example

See merge request gitlab-org/gitlab!18588

Updated link name to match the page name (Uploads administration)

See merge request gitlab-org/gitlab!19149

Supporting multiple states query on todo. Also updating specs.

Simplify method as suggested by @reprazent

Remove method for_states

Revert "Simplify method as suggested by @reprazent"

This reverts commit 011f44d1c1e51120dbc5fefbb70f68116439e6aa.

Fix time-dependent test failure in release_block_spec.js

Closes #35019

See merge request gitlab-org/gitlab!19194

This test was using timeago.js to show amount of time elapsed since the
release date. Since timeago.js uses Date() to determine the current
timestamp, we can just mock that value to ensure consistent results.

Closes https://gitlab.com/gitlab-org/gitlab/issues/35019