CHANGELOG.md

**Note:** This file is automatically generated. Please see the [developer
documentation](doc/development/changelog.md) for instructions on adding your own
entry.

## 11.8.0 (2019-02-22)

### Security (7 changes, 1 of them is from the community)

- Sanitize user full name to clean up any URL to prevent mail clients from auto-linking URLs. !2793
- Update Helm to 2.12.2 to address Helm client vulnerability. !24418 (Takuya Noguchi)
- Use sanitized user status message for user popover.
- Validate bundle files before unpacking them.
- Alias GitHub and BitBucket OAuth2 callback URLs.
- Fixed XSS content in KaTex links.
- Disallows unauthorized users from accessing the pipelines section.

### Removed (2 changes, 1 of them is from the community)

- Removed deprecated Redcarpet markdown engine.
- Remove Cancel all jobs button in general jobs list view. (Jordi Llull)

### Fixed (84 changes, 20 of them are from the community)

- Fix ambiguous brackets in task lists. !18514 (Jared Deckard <jared.deckard@gmail.com>)
- Fix lost line number when navigating to a specific line in a protected file before authenticating. !19165 (Scott Escue)
- Fix suboptimal handling of checkbox and radio input events causing group general settings submit button to stay disabled after changing its visibility. !23022
- Fix upcoming milestones filter not including group milestones. !23098 (Heinrich Lee Yu)
- Update runner admin page to make description field larger. !23593 (Sascha Reynolds)
- Fix Bitbucket Server import not allowing personal projects. !23601
- Fix bug causing repository mirror settings UI to break. !23712
- Fix foreground color for labels to ensure consistency of label appearance. !23873 (Nathan Friend)
- Resolve In Merge Request diff screen, master is not a hyperlink. !23874
- Show the correct error page when access is denied. !23932
- Increase reliability and performance of toggling task items. !23938
- Modify file restore to rectify tar issue. !24000
- Fix default visibility_level for new projects. !24120 (Fabian Schneider @fabsrc)
- Footnotes now render properly in markdown. !24168
- Emoji and cancel button are taller than input in set user status modal. !24173 (Dhiraj Bodicherla)
- Adjusts duplicated line when commenting on unfolded diff lines (in the bottom). !24201
- Adjust height of "Add list" dropdown in issue boards. !24227
- Improves restriction of multiple Kubernetes clusters through API. !24251
- Fix files/blob api endpoints content disposition. !24267
- Cleanup stale +deleted repo paths on project removal (adjusts project removal bug). !24269
- Handle regular job dependencies next to parallelized job dependencies. !24273
- Proper align Projects dropdown on issue boards page. !24277 (Johann Hubert Sonntagbauer)
- Resolve When merging an MR, the squash checkbox isnt always supported. !24296
- Fix Bitbucket Server importer error handling. !24343
- Fix syntax highlighting for suggested changes preview. !24358
- API: Support dots in wiki slugs. !24383 (Robert Schilling)
- Show CI artifact file size with 3 significant digits on 'browse job artifacts' page. !24387
- API: Support username with dots. !24395 (Robert Schilling)
- API: Fix default_branch_protection admin setting. !24398 (Robert Schilling)
- Remove unwanted margin above suggested changes. !24419
- Prevent checking protected_ref? for ambiguous refs. !24437
- Update metrics environment dropdown to show complete option set. !24441
- Fix empty labels of CI builds for gitlab-pages on pipeline page. !24451
- Do not run spam checks on confidential issues. !24453
- Upgrade KaTeX to version 0.10.0. !24478 (Andrew Harmon)
- Avoid overwriting default jaeger values with nil. !24482
- Display SAML failure messages instead of expecting CSRF token. !24509
- Adjust vertical alignment for project visibility icons. !24511 (Martin Hobert)
- Load initUserInternalRegexPlaceholder only when required. !24522
- Hashed Storage: `AfterRenameService` was receiving the wrong `old_path` under some circunstances. !24526
- Resolve Runners IPv6 address overlaps other values. !24531
- Fix 404s with snippet uploads in object storage. !24550
- Fixed oversized custom project notification selector dropdown. !24557
- Allow users with full private access to read private personal snippets. !24560
- Resolve Pipeline stages job action button icon is not aligned. !24577
- Fix cluster page non-interactive on form validation error. !24583
- Fix 404s for snippet uploads when relative URL root used. !24588
- Fix markdown table border. !24601
- Fix CSS grid on a new Project/Group Milestone. !24614 (Takuya Noguchi)
- Prevent unload when Recaptcha is open. !24625
- Clean up unicorn sampler metric labels. !24626 (bjk-gitlab)
- Support bamboo api polymorphism. !24680 (Alex Lossent)
- Ensure Cert Manager works with Auto DevOps URLs greater than 64 bytes. !24683
- Fix failed LDAP logins when nil user_id present. !24749
- fix display comment avatars issue in IE 11. !24777 (Gokhan Apaydin)
- Fix template labels not being created on new projects. !24803
- Fix cluster installation processing spinner. !24814
- Append prioritized label before pagination. !24815
- Resolve UI bug adding group members with lower permissions. !24820
- Make `ActionController::Parameters` serializable for sidekiq jobs. !24864
- Fix Jira Service password validation on project integration services. !24896 (Daniel Juarez)
- Fix potential Addressable::URI::InvalidURIError. !24908
- Update Workhorse to v8.2.0. !24909
- Encode Content-Disposition filenames. !24919
- Avoid race conditions when creating GpgSignature. !24939
- Create the source branch for a GitHub import. !25064
- Fix suggested changes syntax highlighting. !25116
- Fix counts in milestones dashboard. !25230
- Fixes incorrect TLD validation errors for Kubernetes cluster domain. !25262
- Fix 403 errors when adding an assignee list in project boards. !25263
- Prevent Auto DevOps from trying to deploy without a domain name. !25308
- Fix uninitialized constant with GitLab Pages.
- Increase line height of project summaries. (gfyoung)
- Remove extra space between MR tab bar and sticky file headers.
- Correct spacing for comparison page.
- Update CI YAML param table with include.
- Return bottom border on MR Tabs.
- Fixes z-index and margins of archived alert in job page.
- Fixes archived sticky top bar without perfomance bar.
- Fixed rebase button not showing in merge request widget.
- Fixed double tooltips on note awards buttons.
- Allow suggestions to be copied and pasted as GFM.
- Fix bug that caused Suggestion Markdown toolbar button to insert snippet with leading +/-/<space>.
- Moved primary button for labels to follow the design patterns used on rest of the site. (Martin Hobert)

### Changed (37 changes, 11 of them are from the community)

- Change spawning of tooltips to be top by default. !21223
- Standardize filter value capitlization in filter bar in both issues and boards pages. !23846 (obahareth)
- Refresh group overview to match project overview. !23866
- Build number does not need to be tweaked anymore for the TeamCity integration to work properly. !23898
- Added empty project illustration and updated text to user profile overview. !23973 (Fernando Arias)
- Modified Knative list view to provide more details. !24072 (Chris Baumbauer)
- Move cancel & new issue button on job page. !24074
- Make issuable empty states actionable. !24077
- Fix code search when text is larger than max gRPC message size. !24111
- Update string structure for available group runners. !24187 (George Tsiolis)
- Remove multilingual translation from the word "in" in the job details sidebar. !24192 (Nathan Friend)
- Fix duplicate project disk path in BackfillLegacyProjectRepositories. !24213
- Ensured links to a comment or system note anchor resolves to the right note if a user has a discussion filter. !24228
- Remove expansion hover animation from pipeline status icon buttons. !24268 (Nathan Friend)
- Redesigned related merge requests in issue page. !24270
- Return the maximum group access level in the projects API. !24403
- Update project topics styling to use badges design. !24415
- Display "commented" only for commit discussions on merge requests. !24427
- Upgrade js-regex gem to version 3.1. !24433 (rroger)
- Prevent Sidekiq arguments over 10 KB in size from being logged to JSON. !24493
- Added Avatar in the settings sidebar. !24515 (Yoginth)
- Refresh empty states for profile page tabs. !24549
- remove red/green colors from diff view of no-color syntax theme. !24582 (khm)
- Get remote IP address of runner. !24624
- Update last_activity_on for Users on some main GET endpoints. !24642
- Update metrics dashboard graph design. !24653
- Update to GitLab SVG icon from Font Awesome in profile for location and work. !24671 (Yoginth)
- Add template for Android with Fastlane. !24722
- Display timestamps to messages printed by gitlab:backup:restore rake tasks. (Will Chandler)
- Show MR statistics in diff comparisons.
- Make possible to toggle file tree while scrolling through diffs.
- Use delete instead of remove when referring to `git branch -D`.
- Add folder header to files in merge request tree list.
- Added fuzzy file finder to merge requests.
- Collapse directory structure in merge request file tree.
- Adds skeleton loading to releases page.
- Support multiple outputs in jupyter notebooks.

### Performance (8 changes, 1 of them is from the community)

- Remove unused button classes `btn-create` and `comment-btn`. !23232 (George Tsiolis)
- [API] Omit `X-Total` and `X-Total-Pages` headers when items count is more than 10,000. !23931
- Improve efficiency of GitHub importer by reducing amount of locks needed. !24102
- Improve milestone queries using subqueries instead of separate queries for ids. !24325
- Efficiently remove expired artifacts in `ExpireBuildArtifactsWorker`. !24450
- Eliminate N+1 queries in /api/groups/:id. !24513
- Use deployment relation to get an environment name. !24890
- Do not reload daemon if configuration file of pages does not change.

### Added (35 changes, 18 of them are from the community)

- Add badge count to projects. !18425 (George Tsiolis)
- API: Add support for group labels. !21368 (Robert Schilling)
- Add setting for first day of the week. !22755 (Fabian Schneider @fabsrc)
- Pages for subgroups. !23505
- Add support for customer provided encryption keys for Amazon S3 remote backups. !23797 (Pepijn Van Eeckhoudt)
- Add Knative detailed view. !23863 (Chris Baumbauer)
- Add group full path to project's shared_with_groups. !24052 (Mathieu Parent)
- Added feature to specify a custom Auto DevOps chart repository. !24162 (walkafwalka)
- Add flat-square badge style. !24172 (Fabian Schneider @fabsrc)
- Display last activity and created at datetimes for users. !24181
- Allow setting of feature gates per project. !24184
- Save issues/merge request sorting options to backend. !24198
- Added support for custom hosts/domains to Auto DevOps. !24248 (walkafwalka)
- Adds milestone search. !24265 (Jacopo Beschi @jacopo-beschi)
- Allow merge request diffs to be placed into an object store. !24276
- Add Container Registry API with cleanup function. !24303
- GitLab now supports the profile and email scopes from OpenID Connect. !24335 (Goten Xiao)
- Add 'in' filter that modifies scope of 'search' filter to issues and merge requests API. !24350 (Hiroyuki Sato)
- Add `with_programming_language` filter for projects to API. !24377 (Dylan MacKenzie)
- API: Support searching for tags. !24385 (Robert Schilling)
- Document graphicsmagick installation for source installation. !24404 (Alexis Reigel)
- Redirect GET projects/:id to project page. !24467
- Indicate on Issue Status if an Issue was Moved. !24470
- Redeploy Auto DevOps deployment on variable updates. !24498 (walkafwalka)
- Don't create new merge request pipeline without commits. !24503 (Hiroyuki Sato)
- Add GitLab Pages predefined CI variables 'CI_PAGES_DOMAIN' and 'CI_PAGES_URL'. !24504 (Adrian Moisey)
- Moves domain setting from Auto DevOps to Cluster's page. !24580
- API allows setting the squash commit message when squashing a merge request. !24784
- Added ability to upgrade cluster applications. !24789
- Add argument iids for issues in GraphQL. !24802
- Add repositories count to usage ping data. !24823
- Add support for extensionless pages URLs. !24876
- Add templates for most popular Pages templates. !24906
- Introduce Internal API for searching environment names. !24923
- Allow admins to invalidate markdown texts by setting local markdown version.

### Other (50 changes, 18 of them are from the community)

- Externalize strings from `/app/views/projects/project_members`. !23227 (Tao Wang)
- Add CSS & JS global flags to represent browser and platform. !24017
- Fix deprecation: Passing an argument to force an association to reload is now deprecated. !24136 (Jasper Maes)
- Cleanup legacy artifact background migration. !24144
- Bump kubectl in Auto DevOps to 1.11.6. !24176
- Conditionally initialize the global opentracing tracer. !24186
- Remove horizontal whitespace on user profile overview on small breakpoints. !24189
- Bump nginx-ingress chart to 1.1.2. !24203
- Use monospace font for registry table tag id and tag name. !24205
- Rename project tags to project topics. !24219
- Add uniqueness validation to url column in Releases::Link model. !24223
- Update sidekiq-cron to 1.0.4 and use fugit to replace rufus-scheduler to parse cron syntax. !24235
- Adds inter-service OpenTracing propagation. !24239
- Fixes Auto DevOps title on CI/CD admin settings. !24249
- Upgrade kubeclient to 4.2.2 and swap out monkey-patch to disallow redirects. !24284
- i18n: externalize strings from 'app/views/search'. !24297 (Tao Wang)
- Fix several ActionController::Parameters deprecations. !24332 (Jasper Maes)
- Remove all `$theme-gray-{weight}` variables in favor of `$gray-{weight}`. !24333 (George Tsiolis)
- Update gitlab-styles to 2.5.1. !24336 (Jasper Maes)
- Modifies environment scope UI on cluster page. !24376
- Extract process_name from GitLab::Sentry. !24422
- Upgrade Gitaly to 1.13.0. !24429
- Actually set raise_on_unfiltered_parameters to true. !24443 (Jasper Maes)
- Refactored NoteableDiscussion by extracting ResolveDiscussionButton. !24505 (Martin Hobert)
- Extracted JumpToNextDiscussionButton to its own component. !24506 (Martin Hobert)
- Extracted ReplyPlaceholder to its own component. !24507 (Martin Hobert)
- Block emojis and symbol characters from users full names. !24523
- Update GitLab Runner Helm Chart to 0.1.45. !24564
- Updated docs for fields in pushing mirror from GitLab to GitHub. !24566 (Joseph Yu)
- Upgrade gitlab-workhorse to 8.1.0. !24571
- Externalize strings from `/app/views/sent_notifications`. !24576 (George Tsiolis)
- Adds tracing support for ActiveRecord notifications. !24604
- Externalize strings from `/app/views/projects/ci`. !24617 (George Tsiolis)
- Move permission check of manual actions of deployments. !24660
- Externalize strings from `/app/views/clusters`. !24666 (George Tsiolis)
- Update UI for admin appearance settings. !24685
- Externalize strings from `/app/views/projects/pages_domains`. !24723 (George Tsiolis)
- Externalize strings from `/app/views/projects/milestones`. !24726 (George Tsiolis)
- Add OpenTracing instrumentation for Action View Render events. !24728
- Expose version for each application in cluster_status JSON endpoint. !24791
- Externalize strings from `/app/views/instance_statistics`. !24809 (George Tsiolis)
- Update cluster application version on updated and installed status. !24810
- Project list UI improvements. !24855
- Externalize strings from `/app/views/email_rejection_mailer`. !24869 (George Tsiolis)
- Update Gitaly to v1.17.0. !24873
- Update Workhorse to v8.3.0. !24959
- Upgrade gitaly to 1.18.0. !24981
- Update Workhorse to v8.3.1.
- Upgraded Codesandbox smooshpack package.
- Creates mixin to reduce code duplication between CE and EE in graph component.


## 11.7.5 (2019-02-06)

### Fixed (8 changes)

- Fix import handling errors in Bitbucket Server importer. !24499
- Adjusts suggestions unable to be applied. !24603
- Fix 500 errors with legacy appearance logos. !24615
- Fix form functionality for edit tag page. !24645
- Update Workhorse to v8.0.2. !24870
- Downcase aliased OAuth2 callback providers. !24877
- Fix Detect Host Keys not working. !24884
- Changed external wiki query method to prevent attribute caching. !24907


## 11.7.2 (2019-01-29)

### Fixed (1 change)

- Fix uninitialized constant with GitLab Pages.


## 11.7.1 (2019-01-28)

### Security (24 changes)

- Make potentially malicious links more visible in the UI and scrub RTLO chars from links. !2770
- Don't process MR refs for guests in the notes. !2771
- Sanitize user full name to clean up any URL to prevent mail clients from auto-linking URLs. !2828
- Fixed XSS content in KaTex links.
- Disallows unauthorized users from accessing the pipelines section.
- Verify that LFS upload requests are genuine.
- Extract GitLab Pages using RubyZip.
- Prevent awarding emojis to notes whose parent is not visible to user.
- Prevent unauthorized replies when discussion is locked or confidential.
- Disable git v2 protocol temporarily.
- Fix showing ci status for guest users when public pipline are not set.
- Fix contributed projects info still visible when user enable private profile.
- Add subresources removal to member destroy service.
- Add more LFS validations to prevent forgery.
- Use common error for unauthenticated users when creating issues.
- Fix slow regex in project reference pattern.
- Fix private user email being visible in push (and tag push) webhooks.
- Fix wiki access rights when external wiki is enabled.
- Group guests are no longer able to see merge requests they don't have access to at group level.
- Fix path disclosure on project import error.
- Restrict project import visibility based on its group.
- Expose CI/CD trigger token only to the trigger owner.
- Notify only users who can access the project on project move.
- Alias GitHub and BitBucket OAuth2 callback URLs.


## 11.7.0 (2019-01-22)

### Security (14 changes, 1 of them is from the community)

- Escape label and milestone titles to prevent XSS in GFM autocomplete. !2693
- Bump Ruby on Rails to 5.0.7.1. !23396 (@blackst0ne)
- Delete confidential todos for user when downgraded to Guest.
- Project guests no longer are able to see refs page.
- Set URL rel attribute for broken URLs.
- Prevent leaking protected variables for ambiguous refs.
- Authorize before reading job information via API.
- Allow changing group CI/CD settings only for owners.
- Fix SSRF with import_url and remote mirror url.
- Don't expose cross project repositories through diffs when creating merge reqeusts.
- Validate bundle files before unpacking them.
- Issuable no longer is visible to users when project can't be viewed.
- Escape html entities in LabelReferenceFilter when no label found.
- Prevent private snippets from being embeddable.

### Removed (3 changes, 1 of them is from the community)

- Removes all instances of deprecated Gitlab Upgrader calls. !23603 (@jwolen)
- Removed discard draft comment button form notes. !24185
- Remove migration to backfill project_repositories for legacy storage projects. !24299

### Fixed (42 changes, 7 of them are from the community)

- Prevent awards emoji being updated when updating status. !23470
- Allow merge after rebase without page refresh on FF repositories. !23572
- Prevent admins from attempting hashed storage migration on read only DB. !23597
- Correct the ordering of metrics on the performance dashboard. !23630
- Display empty files properly on MR diffs. !23671 (Sean Nichols)
- Allow GitHub imports via token even if OAuth2 provider not configured. !23703
- Update header navigation theme colors. !23734 (George Tsiolis)
- Fix login box bottom margins on signin page. !23739 (@gear54)
- Return an ApplicationSetting in CurrentSettings. !23766
- Fix bug commenting on LFS images. !23812
- Only prompt user once when navigating away from file editor. !23820 (Sam Bigelow)
- Display commit ID for discussions made on merge request commits. !23837
- Stop autofocusing on diff comment after initial mount. !23849
- Fix object storage not working properly with Google S3 compatibility. !23858
- Fix project calendar feed when sorted by priority. !23870
- Fix edit button disappearing in issue title. !23948 (Ruben Moya)
- Aligns build loader animation with the job log. !23959
- Allow 'rake gitlab:cleanup:remote_upload_files' to read bucket files without having permissions to see all buckets. !23981
- Correctly externalize pipeline tags. !24028
- Fix error when creating labels in a new issue in the boards page. !24039 (Ruben Moya)
- Use 'parsePikadayDate' to parse due date string. !24045
- Fix commit SHA not showing in merge request compare dropdown. !24084
- Remove top margin in modal header titles. !24108
- Drop Webhooks from project import/export config. !24121
- Only validate project visibility when it has changed. !24142
- Resolve About this feature link should open in new window. !24149
- Add syntax highlighting to suggestion diff. !24156
- Fix Bitbucket Server import only including first 25 pull requests. !24178
- Enable caching for records which primary key is not `id`. !24245
- Adjust applied suggestion reverting previous changes. !24250
- Fix unexpected exception by failure of finding an actual head pipeline. !24257
- Fix broken templated "Too many changes to show" text. !24282
- Fix requests profiler in admin page not rendering HTML properly. !24291
- Fix no avatar not showing in user selection box. !24346
- Upgrade to gitaly 1.12.1. !24361
- Fix runner eternal loop when update job result. !24481
- Fix notification email for image diff notes.
- Fixed merge request diffs empty states.
- Fixed diff suggestions removing dashes.
- Don't hide CI dropdown behind diff summary. (gfyoung)
- Fix spacing on discussions.
- Fixes missing margin in releases block.

### Changed (22 changes, 8 of them are from the community)

- Show clusters of ancestors in cluster list page. !22996
- Remove unnecessary line before reply holder. !23092 (George Tsiolis)
- Make the Pages permission setting more clear. !23146
- Disable merging of labels with same names. !23265
- Allow basic authentication on go get middleware. !23497 (Morty Choi @mortyccp)
- No longer require email subaddressing for issue creation by email. !23523
- Adjust padding of .dropdown-title to comply with design specs. !23546
- Make commit IDs in merge request discussion header monospace. !23562
- Update environments breadcrumb. !23751 (George Tsiolis)
- Add date range in milestone change email notifications. !23762
- Require Knative to be installed only on an RBAC kubernetes cluster. !23807 (Chris Baumbauer)
- Fix label and header styles in the job details sidebar. !23816 (Nathan Friend)
- Add % prefix to milestone reference links. !23928
- Reorder sidebar menu item for group clusters. !24001 (George Tsiolis)
- Support CURD operation for Links as one of the Release assets. !24056
- Upgrade Omniauth and JWT gems to switch away from Google+ API. !24068
- Renames Milestone sort into Milestone due date. !24080 (Jacopo Beschi @jacopo-beschi)
- Discussion filter only displayed in discussions tab for merge requests. !24082
- Make RBAC enabled default for new clusters. !24119
- Hashed Storage: Only set as `read_only` when starting the per-project migration. !24128
- Knative version bump 0.1.3 -> 0.2.2. (Chris Baumbauer)
- Show message on non-diff discussions.

### Performance (7 changes)

- Fix some N+1 queries related to Admin Dashboard, User Dashboards and Activity Stream. !23034
- Add indexes to speed up CI query. !23188
- Improve the loading time on merge request's discussion page by caching diff highlight. !23857
- Cache avatar URLs and paths within a request. !23950
- Improve snippet search performance by removing duplicate counts. !23952
- Skip per-commit validations already evaluated. !23984
- Fix timeout issues retrieving branches via API. !24034

### Added (29 changes, 6 of them are from the community)

- Handle ci.skip push option. !15643 (Jonathon Reinhart)
- Add NGINX 0.16.0 and above metrics. !22133
- Add project milestone link. !22552
- Support tls communication in gitaly. !22602
- Add option to make ci variables protected by default. !22744 (Alexis Reigel)
- Add project identifier as List-Id email Header to ease filtering. !22817 (Olivier Crête)
- Add markdown helper buttons to file editor. !23480
- Allow to include templates in gitlab-ci.yml. !23495
- Extend override check to also check arity. !23498 (Jacopo Beschi @jacopo-beschi)
- Add importing of issues from CSV file. !23532
- Add submit feedback link to help dropdown. !23547
- Send a notification email to project maintainers when a mirror update fails. !23595
- Restore Object Pools when restoring an object pool. !23682
- Creates component for release block. !23697
- Configure Auto DevOps deployed applications with secrets from prefixed CI variables. !23719
- Add name, author_id, and sha to releases table. !23763
- Display a list of Sentry Issues in GitLab. !23770
- Releases API. !23795
- Creates frontend app for releases. !23796
- Add new pipeline variable CI_COMMIT_SHORT_SHA. !23822
- Create system notes on issue / MR creation when labels, milestone, or due date is set. !23859
- Adds API documentation for releases. !23901
- Add API Support for Kubernetes integration. !23922
- Expose CI/CD predefined variable `CI_API_V4_URL`. !23936
- Add Knative metrics to Prometheus. !23972 (Chris Baumbauer)
- Use reports syntax for Dependency scanning in Auto DevOps. !24081
- Allow to include files from another projects in gitlab-ci.yml. !24101
- User Popovers for Commit Infos, Member Lists and Snippets. !24132
- Add no-color theme for syntax highlighting. (khm)

### Other (45 changes, 30 of them are from the community)

- Redesign project lists UI. !22682
- [Rails5.1] Update functional specs to use new keyword format. !23095 (@blackst0ne)
- Update a condition to visibility a merge request collaboration message. !23104 (Harry Kiselev)
- Remove framework/mobile.scss. !23301 (Takuya Noguchi)
- Passing the separator argument as a positional parameter is deprecated. !23334 (Jasper Maes)
- Clarifies docs about CI `allow_failure`. !23367 (C.J. Jameson)
- Refactor issuable sidebar to use serializer. !23379
- Refactor the logic of updating head pipelines for merge requests. !23502
- Allow user to add Kubernetes cluster for clusterable when there are ancestor clusters. !23569
- Adds explanatory text to input fields on user profile settings page. !23673
- Externalize strings from `/app/views/shared/notes`. !23696 (Tao Wang)
- Remove rails 4 support in CI, Gemfiles, bin/ and config/. !23717 (Jasper Maes)
- Fix calendar events fetching error on private profile page. !23718 (Harry Kiselev)
- Update GitLab Workhorse to v8.0.0. !23740
- Hide confidential events in the API. !23746
- Changed Userpopover Fixtures and shadow color. !23768
- Fix deprecation: Passing conditions to delete_all is deprecated. !23817 (Jasper Maes)
- Fix deprecation: Passing ActiveRecord::Base objects to sanitize_sql_hash_for_assignment. !23818 (Jasper Maes)
- Remove rails4 specific code. !23847 (Jasper Maes)
- Remove deprecated ActionDispatch::ParamsParser. !23848 (Jasper Maes)
- Fix deprecation: Comparing equality between ActionController::Parameters and a Hash is deprecated. !23855 (Jasper Maes)
- Fix deprecation: Directly inheriting from ActiveRecord::Migration is deprecated. !23884 (Jasper Maes)
- Fix deprecation: alias_method_chain is deprecated. Please, use Module#prepend instead. !23887 (Jasper Maes)
- Update specs to exclude possible false positive pass. !23893 (@blackst0ne)
- Passing an argument to force an association to reload is now deprecated. !23894 (Jasper Maes)
- ActiveRecord::Migration -> ActiveRecord::Migration[5.0]. !23910 (Jasper Maes)
- Split bio into individual line in extended user tooltips. !23940
- Fix deprecation: redirect_to :back is deprecated. !23943 (Jasper Maes)
- Fix deprecation: insert_sql is deprecated and will be removed. !23944 (Jasper Maes)
- Upgrade @gitlab/ui to 1.16.2. !23946
- convert specs in javascripts/ and support/ to new syntax. !23947 (Jasper Maes)
- Remove deprecated xhr from specs. !23949 (Jasper Maes)
- Remove app/views/shared/issuable/_filter.html.haml. !24008 (Takuya Noguchi)
- Fix deprecation: Using positional arguments in integration tests. !24009 (Jasper Maes)
- UI improvements for redesigned project lists. !24011
- Update cert-manager chart from v0.5.0 to v0.5.2. !24025 (Takuya Noguchi)
- Hide spinner on empty activites list on user profile overview. !24063
- Don't show Auto DevOps enabled banner for projects with CI file or CI disabled. !24067
- Update GitLab Runner Helm Chart to 0.1.43. !24083
- Fix navigation style in docs. !24090 (Takuya Noguchi)
- Remove gem install bundler from Docker-based Ruby environments. !24093 (Takuya Noguchi)
- Fix deprecation: Using positional arguments in integration tests. !24110 (Jasper Maes)
- Fix deprecation: returning false in Active Record and Active Model callbacks will not implicitly halt a callback chain. !24134 (Jasper Maes)
- ActiveRecord::Migration -> ActiveRecord::Migration[5.0] for AddIndexesToCiBuildsAndPipelines. !24167 (Jasper Maes)
- Update url placeholder for the sentry configuration page. !24338


## 11.6.8 (2019-01-30)

- No changes.

## 11.6.5 (2019-01-17)

### Fixed (5 changes)

- Add syntax highlighting to suggestion diff. !24156
- Fix broken templated "Too many changes to show" text. !24282
- Fix requests profiler in admin page not rendering HTML properly. !24291
- Fix no avatar not showing in user selection box. !24346
- Fixed diff suggestions removing dashes.


## 11.6.4 (2019-01-15)

### Security (1 change)

- Validate bundle files before unpacking them.


## 11.6.3 (2019-01-04)

### Fixed (1 change)

- Fix clone URL not showing if protocol is HTTPS. !24131


## 11.6.2 (2019-01-02)

### Fixed (7 changes)

- Hide cluster features that don't work yet with Group Clusters. !23935
- Fix a 500 error that could occur until all migrations are done. !23939
- Fix missing Git clone button when protocol restriction setting enabled. !24015
- Fix clone dropdown parent inheritance issues in HAML. !24029
- Fix content-disposition in blobs and files API endpoint. !24078
- Fixed markdown toolbar buttons.
- Adjust line-height of blame view line numbers.


## 11.6.1 (2018-12-28)

### Security (15 changes)

- Escape label and milestone titles to prevent XSS in GFM autocomplete. !2740
- Prevent private snippets from being embeddable.
- Add subresources removal to member destroy service.
- Escape html entities in LabelReferenceFilter when no label found.
- Allow changing group CI/CD settings only for owners.
- Authorize before reading job information via API.
- Prevent leaking protected variables for ambiguous refs.
- Ensure that build token is only used when running.
- Issuable no longer is visible to users when project can't be viewed.
- Don't expose cross project repositories through diffs when creating merge reqeusts.
- Fix SSRF with import_url and remote mirror url.
- Fix persistent symlink in project import.
- Set URL rel attribute for broken URLs.
- Project guests no longer are able to see refs page.
- Delete confidential todos for user when downgraded to Guest.

### Other (1 change)

- Fix due date test. !23845


## 11.6.0 (2018-12-22)

### Security (24 changes, 1 of them is from the community)

- Fix possible XSS attack in Markdown urls with spaces. !2599
- Update rack to 2.0.6 (for QA environments). !23171 (Takuya Noguchi)
- Bump nokogiri, loofah, and rack gems for security updates. !23204
- Encrypt runners tokens. !23412
- Encrypt CI/CD builds authentication tokens. !23436
- Configure mermaid to not render HTML content in diagrams.
- Fix a possible symlink time of check to time of use race condition in GitLab Pages.
- Removed ability to see private group names when the group id is entered in the url.
- Fix stored XSS for Environments.
- Fix persistent symlink in project import.
- Fixed ability of guest users to edit/delete comments on locked or confidential issues.
- Fixed ability to comment on locked/confidential issues.
- Fix CRLF vulnerability in Project hooks.
- Fix SSRF in project integrations.
- Resolve reflected XSS in Ouath authorize window.
- Restrict Personal Access Tokens to API scope on web requests.
- Provide email notification when a user changes their email address.
- Don't expose confidential information in commit message list.
- Validate LFS hrefs before downloading them.
- Do not follow redirects in Prometheus service when making http requests to the configured api url.
- Escape user fullname while rendering autocomplete template to prevent XSS.
- Redact sensitive information on gitlab-workhorse log.
- Fix milestone promotion authorization check.
- Prevent a path traversal attack on global file templates.

### Removed (1 change)

- Remove obsolete gitlab_shell rake tasks. !22417

### Fixed (86 changes, 13 of them are from the community)

- Remove limit of 100 when searching repository code. !8671
- Show error message when attempting to reopen an MR and there is an open MR for the same branch. !16447 (Akos Gyimesi)
- Fix a bug where internal email pattern wasn't respected. !22516
- Fix project selector consistency in groups issues / MRs / boards pages. !22612 (Heinrich Lee Yu)
- Add empty state for graphs with no values. !22630
- Fix navigating by unresolved discussions on Merge Request page. !22789
- Fix "merged with [commit]" info for merge requests being merged automatically by other actions. !22794
- Fixing regression issues on pages settings and details. !22821
- Remove duplicate primary button in dashboard snippets on small viewports. !22902 (George Tsiolis)
- Fix API::Namespaces routing to accept namepaces with dots. !22912
- Switch kubernetes:active with checking in Auto-DevOps.gitlab-ci.yml. !22929
- Avoid Gitaly RPC errors when fetching diff stats. !22995
- Removes promote to group label for anonymous user. !23042 (Jacopo Beschi @jacopo-beschi)
- Fix enabling project deploy key for admins. !23043
- Align issue status label and confidential icon. !23046 (George Tsiolis)
- Fix default sorting for subgroups and projects list. !23058 (Jacopo Beschi @jacopo-beschi)
- Hashed Storage: allow migration to be retried in partially migrated projects. !23087
- Fix line height of numbers in file blame view. !23090 (Johann Hubert Sonntagbauer)
- Fixes an issue where default values from models would override values set in the interface (e.g. users would be set to external even though their emails matches the internal email address pattern). !23114
- Remove display of local Sidekiq process in /admin/sidekiq. !23118
- Fix unrelated deployment status in MR widget. !23175
- Respect confirmed flag on secondary emails. !23181
- Restrict member access level to be higher than that of any parent group. !23226
- Return real deployment status to frontend. !23270
- Handle force_remove_source_branch when creating merge request. !23281
- Avoid creating invalid refs using rugged, shelling out for writing refs. !23286
- Remove needless auto-capitalization on Wiki page titles. !23288
- Modify the wording for the knative cluster application to match upstream. !23289 (Chris Baumbauer)
- Change container width for project import. !23318 (George Tsiolis)
- Validate chunk size when persist. !23341
- Resolve Main navbar is broken in certain viewport widths. !23348
- Gracefully handle references with null bytes. !23365
- Display commit ID for commit diff discussion on merge request. !23370
- Pass commit when posting diff discussions. !23371
- Fix flash notice styling for fluid layout. !23382
- Add monkey patch to unicorn to fix eof? problem. !23385
- Commits API: Preserve file content in move operations if unspecified. !23387
- Disable password autocomplete in mirror form fill. !23402
- Fix "protected branches only" checkbox not set properly at init. !23409
- Support RSA and ECDSA algorithms in Omniauth JWT provider. !23411 (Michael Tsyganov)
- Make KUBECONFIG nil if KUBE_TOKEN is nil. !23414
- Allow search and sort users at same time on admin users page. !23439
- Fix: Unstar icon button is misaligned. !23444
- Fix error when searching for group issues with priority or popularity sort. !23445
- Fix Order By dropdown menu styling in tablet and mobile screens. !23446
- Fix collapsing discussion replies. !23462
- Gracefully handle unknown/invalid GPG keys. !23492
- Fix multiple commits shade overlapping vertical discussion line. !23515
- Use read_repository scope on read-only files API. !23534
- Avoid 500's when serializing legacy diff notes. !23544
- Fix web hook functionality when the database encryption key is too short. !23573
- Hide Knative from group cluster applications until supported. !23577
- Add top padding for nested environment items loading icon. !23580 (George Tsiolis)
- Improve help and validation sections of maximum build timeout inputs. !23586
- Fix milestone select in issue sidebar of issue boards. !23625
- Fix gitlab:web_hook tasks. !23635
- Avoid caching BroadcastMessage as an ActiveRecord object. !23662
- Only allow strings in URL::Sanitizer.valid?. !23675
- Fix a frozen string error in app/mailers/notify.rb. !23683
- Fix a frozen string error in lib/gitlab/utils.rb. !23690
- Fix MR resolved discussion counts being too low. !23710
- Fix a potential frozen string error in app/mailers/notify.rb. !23728
- Remove unnecessary div from MarkdownField to apply list styles correctly. !23733
- Display reply field if resolved discussion has no replies. !23801
- Restore kubernetes:active in Auto-DevOps.gitlab-ci.yml (reverts 22929). !23826
- Fix mergeUrlParams with fragment URL. !54218 (Thomas Holder)
- Fixed multiple diff line discussions not expanding.
- Fixed diff files expanding not loading commit content.
- Fixed styling of image comment badges on commits.
- Resolve possible cherry pick API race condition.
- When user clicks linenumber in MR changes, highlight that line.
- Remove old webhook logs after 90 days, as documented, instead of after 2.
- Add an external IP address to the knative cluster application page. (Chris Baumbauer)
- Fixed duplicate discussions getting added to diff lines.
- Fix deadlock on ChunkedIO.
- Show tree collapse button for merge request commit diffs.
- Use approximate count for big tables for usage statistics.
- Lock writes to trace stream.
- Ensure that SVG sprite icons are properly rendered in IE11.
- Make new branch form fields' fonts consistent.
- Open first 10 merge request files in IDE.
- Prevent user from navigating away from file edit without commit.
- Prevent empty button being rendered in empty state.
- Adds margins between tags when a job is stuck.
- Fix Image Lazy Loader for some older browsers.
- Correctly styles tags in sidebar for job page.

### Changed (34 changes, 9 of them are from the community)

- Include new link in breadcrumb for issues, merge requests, milestones, and labels. !18515 (George Tsiolis)
- Allow sorting issues and MRs in reverse order. !21438
- Design improvements to project overview page. !22196
- Remove auto deactivation when failed to create a pipeline via pipeline schedules. !22243
- Use group clusters when deploying (DeploymentPlatform). !22308
- Improve initial discussion rendering performance. !22607
- removes partially matching of No Label filter and makes it case-insensitive. !22622 (Jacopo Beschi @jacopo-beschi)
- Use search bar for filtering in dashboard issues / MRs. !22641 (Heinrich Lee Yu)
- Show different empty state for filtered issues and MRs. !22775 (Heinrich Lee Yu)
- Relocate JSONWebToken::HMACToken from EE. !22906
- Resolve Add border around the repository file tree. !23018
- Change breadcrumb title for contribution charts. !23071 (George Tsiolis)
- Update environments metrics empty state. !23074 (George Tsiolis)
- Refine cursor positioning in Markdown Editor for wrap tags. !23085 (Johann Hubert Sonntagbauer)
- Use reports syntax for SAST in Auto DevOps. !23163
- SystemCheck: Use a more reliable way to detect current Ruby version. !23291
- Changed frontmatter filtering to support YAML, JSON, TOML, and arbitrary languages. !23331 (Travis Miller)
- Don't remove failed install pods after installing GitLab managed applications. !23350
- Expose merge request pipeline variables. !23398
- Scope default MR search in WebIDE dropdown to current project. !23400
- Show user contributions in correct timezone within user profile. !23419
- Redesign of MR header sections (CE). !23465
- Auto DevOps: Add echo for each branch of the deploy() function where we run helm upgrade. !23499
- Updates service to update Kubernetes project namespaces and restricted service account if present. !23525
- Adjust divider margin to comply with design specs. !23548
- Adjust dropdown item and header padding to comply with design specs. !23552
- Truncate merge request titles with periods instead of ellipsis. !23558
- Remove close icon from projects dropdown in issue boards. !23567
- Change dropdown divider color to gray-200 (#dfdfdf). !23592
- Define the default value for only/except policies. !23765
- Don't show Memory Usage for unmerged MRs.
- reorder notification settings by noisy-ness. (C.J. Jameson)
- Changed merge request filtering to be by path instead of name.
- Make diff file headers sticky.

### Performance (22 changes, 6 of them are from the community)

- Upgrade to Ruby 2.5.3. !2806
- Removes all the irrelevant code and columns that were migrated from the Project table over to the ProjectImportState table. !21497
- Approximate counting strategy with TABLESAMPLE. !22650
- Replace tooltip directive with gl-tooltip diretive in badges, cycle analytics, and diffs. !22770 (George Tsiolis)
- Validate foreign keys being created and indexed for column with _id. !22808
- Remove monospace extend. !23089 (George Tsiolis)
- Use Nokogiri as the ActiveSupport XML backend. !23136
- Improve memory performance by reducing dirty pages after fork(). !23169
- Add partial index for ci_builds on project_id and status. !23268
- Reduce Gitaly calls in projects dashboard. !23307
- Batch load only data from same repository when lazy object is accessed. !23309
- Add index for events on project_id and created_at. !23354
- Remove index for notes on updated_at. !23356
- Improves performance of Project#readme_url by caching the README path. !23357
- Populate MR metrics with events table information (migration). !23564
- Remove unused data from discussions endpoint. !23570
- Speed up issue board lists in groups with many projects.
- Use cached size when passing artifacts to Runner.
- Enable even more frozen string for lib/gitlab. (gfyoung)
- Enable even more frozen string in lib/gitlab/**/*.rb. (gfyoung)
- Enable even more frozen string in lib/gitlab/**/*.rb. (gfyoung)
- Enable even more frozen string for lib/gitlab. (gfyoung)

### Added (32 changes, 13 of them are from the community)

- Add ability to create group level clusters and install gitlab managed applications. !22450
- Creates /create_merge_request quickaction. !22485 (Jacopo Beschi @jacopo-beschi)
- Filter by None/Any for labels in issues/mrs API. !22622 (Jacopo Beschi @jacopo-beschi)
- Chat message push notifications now include links back to GitLab branches. !22651 (Tony Castrogiovanni)
- Added feature flag to signal content headers detection by Workhorse. !22667
- Add Discord integration. !22684 (@blackst0ne)
- Upgrade helm to 2.11.0 and upgrade on every install. !22693
- Add knative client to kubeclient library. !22968 (cab105)
- Allow SSH public-key authentication for push mirroring. !22982
- Allow deleting a Pipeline via the API. !22988
- #40635: Adds support for cert-manager. !23036 (Amit Rathi)
- WebIDE: Pressing Ctrl-Enter while typing on the commit message now performs the commit action. !23049 (Thomas Pathier)
- Adds Any option to label filters. !23111 (Jacopo Beschi @jacopo-beschi)
- Added glob for CI changes detection. !23128 (Kirill Zaitsev)
- Add model and relation to store repo full path in database. !23143
- Add ability to render suggestions. !23147
- Introduce Knative and Serverless Components. !23174 (Chris Baumbauer)
- Use BFG object maps to clean projects. !23189
- Merge request pipelines. !23217
- Extended user centric tooltips on issue and MR page. !23231
- Add a rebase API endpoint for merge requests. !23296
- Add config to prohibit impersonation. !23338
- Merge request pipeline tag, and adds tags to pipeline view. !23364
- #52753: HTTPS for JupyterHub installation. !23479 (Amit Rathi)
- Fill project_repositories for hashed storage projects. !23482
- Ability to override email for cert-manager. !23503 (Amit Rathi)
- Allow public forks to be deduplicated. !23508
- Pipeline trigger variable values are hidden in the UI by default. Maintainers have the option to reveal them. !23518 (jhampton)
- Add new endpoint to download single artifact file for a ref. !23538
- Log and pass correlation-id between Unicorn, Sidekiq and Gitaly.
- Allow user to scroll to top of tab on MR page.
- Adds states to the deployment widget.

### Other (54 changes, 30 of them are from the community)

- Switch to Rails 5. !21492
- Migration to write fullpath in all repository configs. !22322
- Rails5: env is deprecated and will be removed from Rails 5.1. !22626 (Jasper Maes)
- Update haml_lint to 0.28.0. !22660 (Takuya Noguchi)
- Update ffaker to 2.10.0. !22661 (Takuya Noguchi)
- Drop gcp_clusters table. !22713
- Upgrade minimum required Git version to 2.18.0. !22803
- Adds new icon size to Vue icon component. !22899
- Make sure there's only one slash as path separator. !22954
- Show HTTP response code for Kubernetes errors. !22964
- Update config map for gitlab managed application if already present on install. !22969
- Drop default value on status column in deployments table. !22971
- UI improvements to user's profile. !22977
- Update asana to 0.8.1. !23039 (Takuya Noguchi)
- Update asciidoctor to 1.5.8. !23047 (Takuya Noguchi)
- Make auto-generated icons for subgroups in the breadcrumb dropdown display as a circle. !23062 (Thomas Pathier)
- Make reply shortcut only quote selected discussion text. !23096 (Thomas Pathier)
- Fix typo in notebook props. !23103 (George Tsiolis)
- Fix typos in lib. !23106 (George Tsiolis)
- Rename diffs store variable. !23123 (George Tsiolis)
- Fix overlapping navbar separator and overflowing navbar dropdown on small displays. !23126 (Thomas Pathier)
- Show what RPC is called in the performance bar. !23140
- Updated Gitaly to v0.133.0. !23148
- Rails5: Passing a class as a value in an Active Record query is deprecated. !23164 (Jasper Maes)
- Fix project identicon aligning Harry Kiselev. !23166 (Harry Kiselev)
- Fix horizontal scrollbar overlapping on horizontal scrolling-tabs. !23167 (Harry Kiselev)
- Fix bottom paddings of profile header and some markup updates of profile. !23168 (Harry Kiselev)
- Fixes to AWS documentation spelling and grammar. !23198 (Brendan O'Leary)
- Adds a PHILOSOPHY.md which references GitLab Product Handbook. !23200
- Externalize strings from `/app/views/invites`. !23205 (Tao Wang)
- Externalize strings from `/app/views/project/runners`. !23208 (Tao Wang)
- Fix typo for scheduled pipeline. !23218 (Davy Defaud)
- Force content disposition attachment to several endpoints. !23223
- Upgrade kubeclient to 4.0.0. !23261 (Praveen Arimbrathodiyil @pravi)
- Update used version of Runner Helm Chart to 0.1.38. !23304
- render :nothing option is deprecated, Use head method to respond with empty response body. !23311 (Jasper Maes)
- Passing an argument to force an association to reload is now deprecated. !23334 (Jasper Maes)
- Externalize strings from `/app/views/snippets`. !23351 (Tao Wang)
- Fix deprecation: You are passing an instance of ActiveRecord::Base to. !23369 (Jasper Maes)
- Resolve status emoji being replaced by avatar on mobile. !23408
- Fix deprecation: render :text is deprecated because it does not actually render a text/plain response. !23425 (Jasper Maes)
- Fix lack of documentation on how to fetch a snippet's content using API. !23448 (Colin Leroy)
- Upgrade GitLab Workhorse to v7.3.0. !23489
- Fallback to admin KUBE_TOKEN for project clusters only. !23527
- Update used version of Runner Helm Chart to 0.1.39. !23633
- Show primary button when all labels are prioritized. !23648 (George Tsiolis)
- Upgrade workhorse to 7.6.0. !23694
- Upgrade Gitaly to v1.7.1 for correlation-id logging. !23732
- Fix due date test. !23845
- Remove unused project method. !54103 (George Tsiolis)
- Uses new gitlab-ui components in Jobs and Pipelines components.
- Replaces tooltip directive with the new gl-tooltip directive for consistency in some ci/cd code.
- Bump gpgme gem version from 2.0.13 to 2.0.18. (asaparov)
- Enable Rubocop on lib/gitlab. (gfyoung)


## 11.5.8 (2019-01-28)

### Security (21 changes)

- Make potentially malicious links more visible in the UI and scrub RTLO chars from links. !2770
- Don't process MR refs for guests in the notes. !2771
- Fixed XSS content in KaTex links.
- Verify that LFS upload requests are genuine.
- Extract GitLab Pages using RubyZip.
- Prevent awarding emojis to notes whose parent is not visible to user.
- Prevent unauthorized replies when discussion is locked or confidential.
- Disable git v2 protocol temporarily.
- Fix showing ci status for guest users when public pipline are not set.
- Fix contributed projects info still visible when user enable private profile.
- Disallows unauthorized users from accessing the pipelines section.
- Add more LFS validations to prevent forgery.
- Use common error for unauthenticated users when creating issues.
- Fix slow regex in project reference pattern.
- Fix private user email being visible in push (and tag push) webhooks.
- Fix wiki access rights when external wiki is enabled.
- Fix path disclosure on project import error.
- Restrict project import visibility based on its group.
- Expose CI/CD trigger token only to the trigger owner.
- Notify only users who can access the project on project move.
- Alias GitHub and BitBucket OAuth2 callback URLs.


## 11.5.5 (2018-12-20)

### Security (1 change)

- Fix persistent symlink in project import.


## 11.5.3 (2018-12-06)

### Security (1 change)

- Prevent a path traversal attack on global file templates.


## 11.5.2 (2018-12-03)

### Removed (1 change)

- Removed Site Statistics optimization as it was causing problems. !23314

### Fixed (6 changes, 1 of them is from the community)

- Display impersonation token value only after creation. !22916
- Fix not render emoji in filter dropdown. !23112 (Hiroyuki Sato)
- Fixes stuck tooltip on stop env button. !23244
- Correctly handle data-loss scenarios when encrypting columns. !23306
- Clear BatchLoader context between Sidekiq jobs. !23308
- Fix handling of filenames with hash characters in tree view. !23368


## 11.5.1 (2018-11-26)

### Security (17 changes)

- Escape user fullname while rendering autocomplete template to prevent XSS.
- Fix CRLF vulnerability in Project hooks.
- Fix possible XSS attack in Markdown urls with spaces.
- Redact sensitive information on gitlab-workhorse log.
- Do not follow redirects in Prometheus service when making http requests to the configured api url.
- Don't expose confidential information in commit message list.
- Provide email notification when a user changes their email address.
- Restrict Personal Access Tokens to API scope on web requests.
- Resolve reflected XSS in Ouath authorize window.
- Fix SSRF in project integrations.
- Fixed ability to comment on locked/confidential issues.
- Fixed ability of guest users to edit/delete comments on locked or confidential issues.
- Fix milestone promotion authorization check.
- Configure mermaid to not render HTML content in diagrams.
- Fix a possible symlink time of check to time of use race condition in GitLab Pages.
- Removed ability to see private group names when the group id is entered in the url.
- Fix stored XSS for Environments.


## 11.5.0 (2018-11-22)

### Security (10 changes, 1 of them is from the community)

- Escape entity title while autocomplete template rendering to prevent XSS. !2556
- Update moment to 2.22.2. !22648 (Takuya Noguchi)
- Redact personal tokens in unsubscribe links.
- Escape user fullname while rendering autocomplete template to prevent XSS.
- Persist only SHA digest of PersonalAccessToken#token.
- Monkey kubeclient to not follow any redirects.
- Prevent SSRF attacks in HipChat integration.
- Prevent templated services from being imported.
- Validate Wiki attachments are valid temporary files.
- Fix XSS in merge request source branch name.

### Removed (2 changes)

- Remove Git circuit breaker. !22212
- Remove Koding integration and documentation. !22334

### Fixed (74 changes, 15 of them are from the community)

- Hide all tables on Pipeline when no Jobs for the Pipeline. !18540 (Takuya Noguchi)
- Fixing count on Milestones. !21446
- Use case insensitve username lookups. !21728 (William George)
- Correctly process Bamboo API result array. !21970 (Alex Lossent)
- Fix 'merged with' UI being displayed when merge request has no merge commit. !22022
- Fix broken file name navigation on MRs. !22109
- Fix incorrect spacing between buttons when commenting on a MR. !22135
- Vertical align Pipeline Graph in Commit Page. !22173 (Johann Hubert Sonntagbauer)
- Reject invalid branch names in repository compare controller. !22186
- Fix size of emojis of user status in user menu. !22194
- Use the standard PIP_CACHE_DIR for Python dependency caching template. !22211 (Takuya Noguchi)
- Fix bug with wiki attachments content disposition. !22220
- Does not allow a SSH URI when importing new projects. !22309
- fix duplicated key in license management job auto devops gitlab ci template. !22311 (Adam Lemanski)
- Fix commit signature error when project is disabled. !22344
- Show available clusters when installed or updated. !22356
- Fix auto-corrected upload URLs in webhooks. !22361
- Fix a bug displaying certain wiki pages. !22377
- Fix prometheus graphs in firefox. !22400
- Resolve assign-me quick action doesn't work if there is extra white space. !22402
- Remove base64 encoding from files that contain plain text. !22425
- Strip whitespace around GitHub personal access tokens. !22432
- Fix 500 error when testing webhooks with redirect loops. !22447 (Heinrich Lee Yu)
- Fix rendering of 'Protected' value on Runner details page. !22459
- Fix bug stopping non-admin users from changing visibility level on group creation. !22468
- Make Issue Board sidebar show project-specific labels based on selected Issue. !22475
- Fix EOF detection with CI artifacts metadata. !22479
- Fix transient spec error in the bar_chart component. !22495
- Resolve LFS not correctly showing enabled. !22501
- If user was not found, service hooks won't run on post receive background job. !22519
- Fix broken "Show whitespace changes" button on MRs. !22539
- Always show new issue button in boards' Open list. !22557 (Heinrich Lee Yu)
- Add transparent background to markdown header tabs. !22565 (George Tsiolis)
- Use gitlab_environment for ldap rake task. !22582
- Add commit message to commit tree anchor title. !22585
- Cache pipeline status per SHA. !22589
- Change HELM_HOST in Auto-DevOps template to work behind proxy. !22596 (Sergej Nikolaev <kinolaev@gmail.com>)
- Show user status for label events in system notes. !22609
- Fix extra merge request versions created from forked merge requests. !22611
- Remove PersonalAccessTokensFinder#find_by method. !22617
- Fix search "all in GitLab" not working with relative URLs. !22644
- Fix quick links button styles. !22657 (George Tsiolis)
- Fix #53298: JupyterHub restarts should work without errors. !22671 (Amit Rathi)
- Fix incompatibility with IE11 due to non-transpiled gitlab-ui components. !22695
- Fix bug when links in tabs of the labels index pages ends with .html. !22716
- Fixed label removal from issue. !22762
- Align toggle sidebar button across all browsers and OSs. !22771
- Disable replication lag check for Aurora PostgreSQL databases. !22786
- Render unescaped link for failed pipeline status. !22807
- Fix misaligned approvers dropdown. !22832
- Fix bug with wiki page create message. !22849
- Fix rendering of filter bar tokens for special values. !22865 (Heinrich Lee Yu)
- Align sign in button. !22888 (George Tsiolis)
- Fix error handling bugs in kubernetes integration. !22922
- Fix deployment jobs using nil KUBE_TOKEN due to migration issue. !23009
- Avoid returning deployment metrics url to MR widget when the deployment is not successful. !23010
- Fix a race condition intermittently breaking GitLab startup. !23028
- Adds margin after a deleted branch name in the activity feed. !23038
- Ignore environment validation failure. !23100
- Fixes broken borders for reports section in MR widget.
- Adds CI favicon back to jobs page.
- Redirect to the pipeline builds page when a build is canceled. (Eva Kadlecova)
- Fixed diff stats not showing when performance bar is enabled.
- Show expand all diffs button when a single diff file is collapsed.
- Clear fetched file templates when changing template type in Web IDE.
- Fix bug causing not all emails to show up in commit email selectbox.