GitLab

The following formerly separate commits have been merged in:

* Adjust 'Sign in' button for GitLab's CSRF protection

  GitLab introduced CSRF protection for authentication requests in
  571ba5a7. The 'Sign in' button has been
  adjusted to send a POST request.

* Opt out of turbolinks for 'Sign in' button

This restriction does not apply to admins.

This restriction does not apply to admins.

The project variable can hold an object which is not an instance of
Project (e.g. ProjectWiki). In this case, visibility_level is not
defined.

Additionally, the prompt to set a password is no longer shown for CAS
users.

[ci skip]

[11.5] Validate bundle files before unpacking them

See merge request gitlab/gitlabhq!2775

(cherry picked from commit 28bec61b5d3c43ef896780cb0eebf09353b51995)

68433868 Validate bundle files before unpacking them

Stop using deprecated argument to `gem`

See merge request gitlab-org/gitlab-ce!24079

[ci skip]

[11.5] Resolve "Removing a user from a private group doesn't remove them from group's project, if their project's role was changed"

See merge request gitlab/gitlabhq!2715

# Conflicts:
#   app/services/members/destroy_service.rb

Merge branch '55402-broken-master-karma-test-failing-in-spec-javascripts-boards-components-issue_due_date_spec-js' into 'master'

Resolve "Broken master: karma test failing in spec/javascripts/boards/components/issue_due_date_spec.js"

Closes #55402

See merge request gitlab-org/gitlab-ce!23845

Disable docs lint internal_links check

Closes #55038

See merge request gitlab-org/gitlab-ce!23665

[11.5] Secret CI variables can exposed by creating a tag with the same name as an existing protected branch

See merge request gitlab/gitlabhq!2682

Merge branch 'security-11-5-53543-user-keeps-access-to-mr-issue-when-removed-from-team' into 'security-11-5'

[11.5] Adds validation to check if user can read project

See merge request gitlab/gitlabhq!2679

[11.5] Group Ex-Maintainer Could maintain Access to Project's Source Code/Jobs/Pipelines/Artifacts if it had Shared Group Runner Configured

See merge request gitlab/gitlabhq!2751

[11.5] Guest users have access to all Job information via the API

See merge request gitlab/gitlabhq!2745

[11.5] Project guests no longer are able to see refs page

See merge request gitlab/gitlabhq!2687

[11.5] SSRF in project imports with LFS

See merge request gitlab/gitlabhq!2726

[11.5] Escape html entities when no label found

See merge request gitlab/gitlabhq!2748

[11.5] Ensure that build token is only used when running

See merge request gitlab/gitlabhq!2664

[11.5] SSRF - Scan Internal Ports and GCP/AWS endpoints

See merge request gitlab/gitlabhq!2709

[11.5] Escape label and milestone titles to prevent XSS in GFM autocomplete

See merge request gitlab/gitlabhq!2741

[11.5] Set URL rel attribute for broken URLs

See merge request gitlab/gitlabhq!2712

[11.5] Delete confidential issue todos for guests

See merge request gitlab/gitlabhq!2723

[11.5] Validate projects in MR build service

See merge request gitlab/gitlabhq!2704