CHANGELOG.md 541 KB
Newer Older
1
2
3
**Note:** This file is automatically generated. Please see the [developer
documentation](doc/development/changelog.md) for instructions on adding your own
entry.
Felipe Artur's avatar
Felipe Artur committed
4

5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
## 12.3.2

### Security (10 changes)

- Fix Gitaly SearchBlobs flag RPC injection.
- Add a policy check for system notes that may not be visible due to cross references to private items.
- Display only participants that user has permission to see on milestone page.
- Do not disclose project milestones on group milestones page when project milestones access is disabled in project settings.
- Fix new project path being disclosed through unsubscribe link of issue/merge requests.
- Prevent bypassing email verification using Salesforce.
- Do not show resource label events referencing not accessible labels.
- Cancel all running CI jobs triggered by the user who is just blocked.
- Only render fixed number of mermaid blocks.
- Prevent GitLab accounts takeover if SAML is configured.


21
22
23
24
25
26
27
28
29
30
## 12.3.1

### Fixed (4 changes)

- Fix ordering of issue board lists not being persisted. !17356
- Fix error when duplicate users are merged in approvers list. !17406
- Fix bug that caused a merge to show an error message. !17466
- Fix CSS leak in job log.


31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
## 12.3.0

### Security (23 changes)

- Filter out old system notes for epics in notes api endpoint response.
- Fix SSRF via DNS rebinding in Kubernetes Integration.
- Fix project import restricted visibility bypass via API.
- Prevent disclosure of merge request ID via email.
- Use admin_group authorization in Groups::RunnersController.
- Gitaly: ignore git redirects.
- Prevent DNS rebind on JIRA service integration.
- Make sure HTML text is always escaped when replacing label/milestone references.
- Fix HTML injection for label description.
- Avoid exposing unaccessible repo data upon GFM post processing.
- Remove EXIF from users/personal snippet uploads.
- Fix weak session management by clearing password reset tokens after login (username/email) are updated.
- Added image proxy to mitigate potential stealing of IP addresses.
- Restrict MergeRequests#test_reports to authenticated users with read-access on Builds.
- Ensure only authorised users can create notes on Merge Requests and Issues.
- Send TODOs for comments on commits correctly.
- Check permissions before responding in MergeController#pipeline_status.
- Limit the size of issuable description and comments.
- Enforce max chars and max render time in markdown math.
- Speed up regexp in namespace format by failing fast after reaching maximum namespace depth.
- Add :login_recaptcha_protection_enabled setting to prevent bots from brute-force attacks.
- Upgrade pages to 1.8.1.
- Show cross-referenced MR-id in issues' activities only to authorized users.

### Removed (1 change)

- Removed redundant index on releases table. !31487

### Fixed (78 changes, 25 of them are from the community)

- Avoid Devise "401 Unauthorized" responses. !16519
- Allow close status to be shown on locked issues. !16685
- Changed todo/done quick actions to work not only for first usage. !16837 (Marc Schwede)
- Adds missing error handling. !16896 (toptalo)
- Prevent the user from seeing an invalid "Purchase more minutes" prompt. !16979
- Fix missing board lists when other users collapse / expand the list. !17318
- Uses projects_authorizations.access_level in MembersFinder. !28887 (Jacopo Beschi @jacopo-beschi)
- Let project reporters create issue from group boards. !29866
- Remove margin from user header. !30878 (lucyfox)
- Improve application settings API. !31149 (Mathieu Parent)
- Fix encoding of special characters in "Find File". !31311 (Jan Beckmann)
- Avoid conflicts between ArchiveTracesCronWorker and ArchiveTraceWorker. !31376
- Disable "Transfer group" button when no group is selected. !31387 (Jan Beckmann)
- Prevent archived projects from showing up in global search. !31498 (David Palubin)
- Fixed embeded metrics tooltip inconsistent styling. !31517
- Fix 500 errors caused by pattern matching with variables in CI Lint. !31719
- Fixed removing directories in Web IDE. !31727
- All of discussion expand/collapse button is clickable. !31730
- Only show /copy_metadata quick action when usable. !31735 (Lee Tickett)
- Read pipelines from public projects through API without an access token. !31816
- fix charts scroll handle icon to use gitlab svg. !31825
- Remove "Commit" from pipeline status tooltips. !31861
- Fix top-nav search bar dropdown on xl displays. !31864 (Kemais Ehlers)
- Fix loading icon causing text to jump in file row of Web IDE. !31884
- Fix MR reports section loading icon alignment. !31897
- Fix broken git clone box on wiki git access page. !31898
- Exempt user gitlab-ci-token from rate limiting. !31909
- Fix search preserving space when change branch. !31973 (minghuan lei)
- Fix file header style and position during scroll in a merge conflict resolution. !31991
- Allow latency measurements of sidekiq jobs taking > 2.5s. !32001
- Return correct user for manual deployments. !32004
- Fix style of secondary profile tab buttons. !32010 (Wolfgang Faust)
- Fix serverless entry page layout. !32029
- Fix HTML rendering for fast-forward rebases in merge request widget. !32032
- Update the timestamp in Operations > Environments to show correct deployment date for manual deploy jobs. !32072
- Fix dropdowns closing when click is released outside the dropdown. !32084
- Hide duplicate board list while dragging. !32099
- Don't check external authorization when disabling the service. !32102 (Robert Schilling)
- Makes custom Pages domain open as external link in new tab. !32130 (jakeburden)
- Change default visibility level for FogBugz imported projects to Private. !32142
- Move visual review toolbar code to NPM. !32159
- Fix parsing of months in time tracking commands. !32165
- Wrong format on MS teams integration push events with multi line commit messages. !32180 (Massimeddu Cireddu)
- Guard against deleted project feature entry in project permissions. !32187
- Fix ref switcher separators from conflicting with branch names. !32198
- Fix performance bar on Puma. !32213
- Remove token field from runners edit form. !32231
- Fix 500 error in CI lint when included templates are an array. !32232
- Fix users cannot access job detail page when deployable does not exist. !32247
- Do not translate system notes into author's language. !32264
- Fix moving issues API failing when text includes commit URLs. !32317
- Fix issue due notification emails not being threaded correctly. !32325
- Allow project feature permissions to be overridden during import with override_params. !32348
- Handle invalid mirror url. !32353 (Lee Tickett)
- New project milestone primary button. !32355 (Lee Tickett)
- Display `more information` docs link on error tracking page when users do not have permissions to enable that feature. !32365 (Romain Maneschi)
- Quick action label must be first in issue comment. !32367 (Romain Maneschi)
- Fix for missing avatar images dislpayed in commit trailers. !32374 (Jesse Hall @jessehall3)
- Make it harder to delete issuables accidentally. !32376
- Replaced vue resource to axios in the  Markdown field preview component. !32386 (Prakash Chokalingam @prakash_Chokalingam)
- Fix create MR from issue using a tag as ref. !32392 (Jacopo Beschi @jacopo-beschi)
- Add X-GitLab-NotificationReason header to note emails. !32422
- Expand textarea for CA cert in cluster form. !32508
- Prevent empty external authorization classification labels from overriding the default label. !32517 (Will Chandler)
- Allow not resolvable urls when dns rebind protection is disabled. !32523
- Avoid checking dns rebind protection when validating. !32577
- Passing job rules downstream and E2E specs for job:rules configuration. !32609
- Quote branch names in how to merge instructions. !32639 (Lee Tickett)
- Fix removal of install pods. !32667
- Fix sharing localStorage with all MRs. !32699
- Default the asset proxy whitelist to the installation domain. !32703
- Add some padding to details markdown element. !32716
- Use `ChronicDuration` in a thread-safe way. !32817
- Fix watch button styling and notifications buttons consistency. !32827
- Fix encoding error in MR diffs when using external diffs. !32862 (Hiroyuki Sato)
- Add bottom margin to snippet title. !32877
- Bump markdown cache version to fix any incorrect links from asset proxy defaults.
- Persist `needs:` validation as config error.

### Changed (39 changes, 6 of them are from the community)

- Extend pipeline graph scroll area to full width. !14870
- Frontend support for saving issue board preferences on the current user. !16421
- Switch Milestone and Release to a many-to-many relationship. !16517
- Align project selector search box better with design system. !16795
- Adds the runners_token of the group if the user that requests the group info is admin of it. !16831 (Ignacio Lorenzo Subirá Otal nachootal@gmail.com)
- Upgrade to Gitaly v1.65.0. !17135
- Make flash notifications sticky. !30141
- Add Issue and Merge Request titles to Todo items. !30435 (Arun Kumar Mohan)
- Remove wiki page slug dialog step when creating wiki page. !31362
- Improve system notes for Zoom links. !31410 (Jacopo Beschi @jacopo-beschi)
- Updated WebIDE default commit options. !31449
- Remove oauth form from GitHub CI/CD only import authentication. !31488
- Update assignee (cannot merge) style. !31545
- Updated latest pipeline tag tooltip to be more descriptive. !31624
- Add optional label_id parameter to label API for PUT and DELETE. !31804
- Updates issues REST API to allow extended sort options. !31849
- Fix to show renamed file in mr. !31888
- Replaced expand diff icons. !31907
- Upgrade to Gitaly 1.60.0. !31981
- Make MR pipeline widget text more descriptive. !32025
- Fix wording on milestone due date when milestone is due today. !32096
- Improve search result labels. !32101
- Limit access request emails to ten most recently active owners or maintainers. !32141
- Improve chatops help output. !32208
- Update merge train documentation. !32218
- Add caret icons to the monitoring dashboard. !32239
- Install cert-manager v0.9.1. !32243
- Bring text mail for new issue & MR more in line. !32254
- Add cluster domain warning. !32260
- Rename epic column state to state_id. !32270
- Use moved instead of closed in issue references. !32277 (juliette-derancourt)
- Standardize use of `content` parameter in snippets API. !32296
- Show meaningful message on /due quick action with invalid date. !32349 (Jacopo Beschi @jacopo-beschi)
- Remove dynamically constructed feature flags starting with prometheus_transaction_. !32395 (Jacopo Beschi @jacopo-beschi)
- Indicate on Issue Status if an Issue was Duplicated. !32472
- Avoid dns rebinding checks when the domain is whitelisted. !32603
- Upgrade to Gitaly v1.62.0. !32608
- Unified presentation of the filter input field for projects listings. !32706
- Hide resolve thread button from guest. !32859

### Performance (20 changes)

- Lower search counters. !11777
- Considerably improve the query performance for MR discussions load. !16635
- Eliminate Gitaly N+1 queries with notes API. !32089
- Optimise UpdateBuildQueueService. !32095
- Remove N+1 SQL query loading project feature in dashboard. !32169
- Reduce the number of SQL requests on MR-show. !32192
- Makes LFS object linker process OIDs in batches. !32268
- Preload routes information to fix N+1 issue. !32352
- Reduce N+1 when doing project export. !32423
- Skip requesting diverging commit counts if no branches are listed. !32496
- Support selective highlighting of lines. !32514
- Replace indexes for counting active users. !32538
- Create partial index for gitlab-monitor CI metrics. !32546
- Optimize queries for snippet listings. !32576
- Preprocess wiki attachments with GitLab-Workhorse. !32663
- Create index for users.unconfirmed_email. !32664
- Optimize /admin/applications so that it does not timeout. !32852
- Replace events index with partial one. !32874
- Partial index for namespaces.type. !32876
- Fix member expiration not always working. !32951

### Added (42 changes, 10 of them are from the community)

- Enable modsecurity in nginx-ingress apps. !15774
- Database table for tracking programming language trends over time. !16491
- Add DAST full scan domain validation. !16680
- Add not param to Issues API endpoint. !16748
- Allow specifying timeout per-job in .gitlab-ci.yml. !16777 (Michał Siwek)
- Document forwarding CI variables to docker build in Auto DevOps. !16783
- Add links for latest pipelines. !20865 (Alex Ives)
- New interruptible attribute for CI/CD jobs. !23464 (Cédric Tabin)
- API: Promote project labels to group labels. !25218 (Robert Schilling)
- Introduced Build::Rules configuration for Ci::Build. !29011
- Notification emails can be signed with SMIME. !30644 (Diego Louzán)
- Allow milestones to be associated with a release (backend). !30816
- Enable serving static objects from an external storage. !31025
- Save collapsed option for board lists in database. !31069
- Apply quickactions when modifying comments. !31136
- Add SwaggerUI Pages template for .gitlab-ci.yml. !31183 (mdhtr)
- Add ability to see project deployments at cluster level (FE). !31575
- Create component to display area and line charts in monitor dashboards. !31639
- Add persistance to last choice of projects sorting on projects dashboard page. !31669
- Run Pipeline button & API for MR Pipelines. !31722
- Add service to transfer Group Milestones when transferring a Project. !31778
- Allow $CI_REGISTRY_USER to delete tags. !31796
- Support adding and removing labels w/ push opts. !31831
- Enable line charts in dashbaord panels and embedded charts. !31920
- Add First and Last name columns to User model. !31985
- Add option to allow OAuth providers to bypass two factor. !31996 (Dodocat)
- Expose namespace storage statistics with GraphQL. !32012
- Add usage pings for merge request creating. !32059
- Add warning about initial deployment delay for GitLab Pages sites. !32122
- Allow Knative to be installed on group and instance level clusters. !32128
- Add a close issue slack slash command. !32150
- Support chat notifications to be fired for protected branches. !32176
- Add system hooks for project/group membership updates. !32371 (Brandon Williams)
- Add source and merge_request fields to pipeline event webhook. !32373 (Bian Jiaping)
- Allow ECDSA certificates for pages domains. !32393
- Show link to cluster used on job page. !32446
- Group level JupyterHub. !32512
- Creates utility parser for the job log. !32555
- Expose update project service endpoint JSON. !32759
- Expose 'protected' field for Tag API endpoint. !32790 (Andrea Leone)
- Create table `alerts_service_data`. !32860
- Creates base components for the new job log.

### Other (42 changes, 13 of them are from the community)

- Setting NOT NULL constraint to users.private_profile column. !14838
- Schedule productivity analytics recalculation for EE. !15137
- Document Lambda deploys via GitLab CI/CD. !16858
- Add Redis interceptor tracing. !30238
- Encrypt existing and new deploy tokens. !30679
- Clean up keyboard shortcuts help modal, removing and adding as needed. !31642
- Add warning to pages domains that obtaining/deploying SSL certificates through Let's Encrypt can take some time. !31765
- Add new API method in Api.js: projectUsers. !31801
- Upgrade babel to 7.5.5. !31819 (Takuya Noguchi)
- Update docs to reflect the rename of gitlab-monitor to gitlab-exporter. !31901
- Count comments on commits and merge requests. !31912
- Resolve Badge counter: Very low contrast between foreground and background colors. !31922
- Add index to improve group cluster deployments query performance. !31988
- Replace finished_at with deployed_at for the internal API Deployment entity. !32000
- Update to GitLab Shell v9.4.0. !32009
- Default clusters namespace_per_environment column to true. !32139
- Remove deprecation message for milestone tabs. !32252
- Refactored Karma spec to Jest for mr_widget_auto_merge_failed. !32282 (Illya Klymov)
- Update GitLab Runner Helm Chart to 0.8.0. !32289
- Refactor showStagedIcon property to reflect the behavior its name represents. !32333 (Arun Kumar Mohan)
- Upgrade pages to 1.8.0. !32334
- Change prioritized labels empty state message. !32338 (Lee Tickett)
- make test of note app with comments disabled dry. !32383 (Romain Maneschi)
- Use new location for gitlab-runner helm charts. !32384
- Mention in docs how to disable project snippets. !32391 (Jacopo Beschi @jacopo-beschi)
- delete animation width on global search input. !32399 (Romain Maneschi)
- Remove vue resource from sidebar service. !32400 (Lee Tickett)
- Remove vue resource from issue. !32421 (Lee Tickett)
- Remove vue resource from remove issue. !32425 (Lee Tickett)
- Remove vue-resource from PerformanceBarService. !32428 (Lee Tickett)
- Added warning note on the project container registry setting informing users that the registry is public for public projects. !32447
- Admin dashboard: Fetch and render statistics async. !32449
- Update GitLab Workhorse to v8.10.0. !32501
- Remove Users.support_bot column. !32554
- Add padding to left of "Sort by" in members dropdown. !32602
- Log errors for failed pipeline creation in PostReceive. !32633
- Avoid prefilling target branch when source branch is the default one. !32701
- Bump Kubeclient to 4.4.0. !32811
- Remove vue-resource from notes service. !32934 (Lee Tickett)
- Added board name to page title in boards view.
- Remove vue resource from group service. (Lee Tickett)
- Updates tooltip of 'detached' label/state.


300
301
302
303
304
305
306
## 12.2.5

### Security (1 change)

- Upgrade pages to 1.7.2.


307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
## 12.2.4

### Fixed (7 changes)

- Add syntax highlighting for line expansion. !31821
- Fix issuable sidebar icon on notification disabled. !32134
- Upgrade Mermaid to v8.2.4. !32186
- Fix Piwik not working. !32234
- Fix snippets API not working with visibility level. !32286
- Fix upload URLs in Markdown for users without access to project repository. !32448
- Update Mermaid to v8.2.6. !32502

### Performance (1 change)

- Fix N+1 Gitaly calls in /api/v4/projects/:id/issues. !32171


324
325
## 12.2.3

326
327
328
329
- No changes.

## 12.2.2

330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
### Security (22 changes)

- Ensure only authorised users can create notes on Merge Requests and Issues.
- Gitaly: ignore git redirects.
- Add :login_recaptcha_protection_enabled setting to prevent bots from brute-force attacks.
- Speed up regexp in namespace format by failing fast after reaching maximum namespace depth.
- Limit the size of issuable description and comments.
- Send TODOs for comments on commits correctly.
- Restrict MergeRequests#test_reports to authenticated users with read-access on Builds.
- Added image proxy to mitigate potential stealing of IP addresses.
- Filter out old system notes for epics in notes api endpoint response.
- Avoid exposing unaccessible repo data upon GFM post processing.
- Fix HTML injection for label description.
- Make sure HTML text is always escaped when replacing label/milestone references.
- Prevent DNS rebind on JIRA service integration.
- Use admin_group authorization in Groups::RunnersController.
- Prevent disclosure of merge request ID via email.
- Show cross-referenced MR-id in issues' activities only to authorized users.
- Enforce max chars and max render time in markdown math.
- Check permissions before responding in MergeController#pipeline_status.
- Remove EXIF from users/personal snippet uploads.
- Fix project import restricted visibility bypass via API.
- Fix weak session management by clearing password reset tokens after login (username/email) are updated.
- Fix SSRF via DNS rebinding in Kubernetes Integration.


356
## 12.2.1
357

358
### Fixed (2 changes)
359

360
361
362
363
364
365
- Fix for embedded metrics undefined params. !31975
- Fix "ERR value is not an integer or out of range" errors. !32126

### Performance (1 change)

- Fix Gitaly N+1 calls with listing issues/MRs via API. !31938
366
367
368
369
370
371
372
373
374
375
376
377

### Fixed (3 changes)

- Fix for embedded metrics undefined params. !31975
- Fix "ERR value is not an integer or out of range" errors. !32126
- Prevent duplicated trigger action button.

### Performance (1 change)

- Fix Gitaly N+1 calls with listing issues/MRs via API. !31938


378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
## 12.2.0

### Security (4 changes, 1 of them is from the community)

- Update mini_magick to 4.9.5. !31505 (Takuya Noguchi)
- Upgrade Rugged to 0.28.3. !31794
- Queries for Upload should be scoped by model.
- Restrict slash commands to users who can log in.

### Removed (3 changes)

- Remove Kubernetes service integration page. !31365
- Remove line profiler from performance bar.
- Remove GC metrics from performance bar.

### Fixed (74 changes, 4 of them are from the community)

- Resolve Incorrect empty state message on Explore projects. !25578
- Search issuables by iids. !28302 (Riccardo Padovani)
- Make it easier to find invited group members. !28436
- fix: updates to include units for the y axis label. !30330
- Align access permissions for wiki history to those of wiki pages. !30470
- Add index for issues on relative position, project, and state for manual sorting. !30542
- Fix suggestion on lines that are not part of an MR. !30606
- Add empty chart component. !30682
- Remove blank block from job sidebar. !30754
- Remove duplicate buttons in diff discussion. !30757
- Order projects in 'Move issue' dropdown by name. !30778
- Fix bug in dashboard display of closed milestones. !30820
- Fixes alignment issues with reports. !30839
- Ensure visibility icons in group/project listings are grey. !30858
- Fix admin labels page when there are invalid records. !30885
- Extra logging for new live trace architecture. !30892
- Fix pipeline emails not respecting group notification email setting. !30907
- Handle trailing slashes when generating Jira issue URLs. !30911
- Optimize relative re-positioning when moving issues. !30938
- Better support clickable tasklists inside blockquotes. !30952
- Add space to "merged by" widget. !30972
- Remove duplicated mapping key in config/locales/en.yml. !30980 (Peter Dave Hello)
- Update Mermaid to v8.2.3. !30985
- Use persistent Redis cluster for Workhorse pub/sub notifications. !30990
- Remove :livesum from RubySampler metrics. !31047
- Fix pid discovery for Unicorn processes in `PidProvider`. !31056
- Respect group notification email when sending group access notifications. !31089
- Default dependency job stage index to Infinity, and correctly report it as undefined in prior stages. !31116
- Fix incorrect use of message interpolation. !31121
- Moved labels out of fields on Search page. !31137
- Ensure Warden triggers after_authentication callback. !31138
- Fix admin area user access level radio button labels. !31154
- Ignore Gitaly errors if cache flushing fails on project destruction. !31164
- Prevent double slash in review apps path. !31212
- Make pdf.js render CJK characters. !31220
- Prevent discussion filter from persisting to `Show all activity` when opening links to notes. !31229
- Improve layout of dropdowns in the metrics dashboard page. !31239
- Remove pdf.js deprecation warnings. !31253
- Fix GC::Profiler metrics fetching. !31331
- Jupyter fixes. !31332 (Amit Rathi)
- Fix first-time contributor notes not rendering. !31340
- Fix inline rendering of relative paths to SVGs from the current repository. !31352
- Make `bin/web_puma` consider RAILS_ENV. !31378
- Removed extrenal dashboard legend border. !31407
- Fix visual review app storage keys. !31427
- Fix flashing conflict warning when editing issues. !31469
- Fix broken issue links and possible 500 error on cycle analytics page when project name and path are different. !31471
- Prevent turning plain links into embedded when moving issues. !31489
- Add a field for released_at to GH importer. !31496
- Adjust size and align MR-widget loading icon. !31503
- Fix an issue where clicking outside the MR/branch search box in WebIDE closed the dropdown. !31523
- Don't attempt to contact registry if it is disabled. !31553
- Fix IDE new files icon in tree. !31560
- Fix missing author line (`Created by: <user>`) in MRs/issues/comments of imported Bitbucket Cloud project. !31579
- Add missing report-uri to CSP config. !31593
- Fixed display of some sections and externalized all text in the shortcuts modal overlay. !31594
- Remove extra padding from disabled comment box. !31603
- Allow CI to clone public projects when HTTP protocol is disabled. !31632
- error message for general settings. !31636 (Mesut Güneş)
- Invalidate branches cache on PostReceive. !31653
- Fix active metric files being wiped after the app starts. !31668
- Fix :wiki_can_not_be_created_total counter. !31673
- Fix job logs where style changes were broken down into separate lines. !31674
- Properly save suggestions in project exports. !31690
- Fix project avatar image in Slack pipeline notifications. !31788
- Fix empty error flash message on profile:account page when updating username with username that has already been taken. !31809
- Fix starrers counts after searching. !31823
- Fix pipelines not always being created after a push. !31927
- Fix 500 errors in commits api caused by empty ref_name parameter.
- Center loading icon in CI action component.
- Prevents showing 2 tooltips in pipelines table.
- Fix tag page layout.
- Prevent duplicated trigger action button.
- Hides loading spinner in pipelines actions after request has been fullfiled.

### Changed (31 changes, 5 of them are from the community)

- Update cluster page automatically when cluster is created. !27189
- Add branch/tags/commits dropdown filter on the search page for searching codes. !28282 (minghuan lei)
- Add support for start_sha to commits API. !29598
- Maintainers can create subgroups. !29718 (Fabio Papa)
- Extract Auto DevOps deploy functions into a base image. !30404
- Add MR form to Visual Review (EE) runtime configuration. !30481
- Adjust redis cache metrics. !30572
- Add DS_PIP_DEPENDENCY_PATH option to configure Dependency Scanning for projects using pip. !30762
- Bring scoped environment variables to core. !30779
- Add Web IDE Usage Ping for Create SMAU. !30800
- Update the container scanning CI template to use v12 of the clair scanner. !30809
- Multiple pipeline support for Commit status. !30828 (Gaetan Semet)
- Add support for exporting repository type data for LFS objects. !30830
- Avoid increasing redis counters when usage_ping is disabled. !30949
- Added navbar searches usage ping counter. !30953
- Convert githost.log to JSON format. !30967
- Adjusted the clickable area of collapsed sidebar elements. !30974 (Michel Engelen)
- Mark push mirrors as failed after 1 hour. !30999
- Allows masking @ and : characters. !31065
- Remove incorrect fallback when determining which cluster to use when retrieving MR performance metrics. !31126
- Retry push mirrors faster when running concurrently, improve error handling when push mirrors fail. !31247
- Make issue boards importable. !31434 (Jason Colyer)
- Allow users to resend a confirmation link when the grace period has expired. !31476
- Remove counts from default labels API responses. !31543
- Upgrade to Gitaly v1.57.0. !31568
- Rename githost.log -> git_json.log. !31634
- Load search result counts asynchronously. !31663
- feat: adds a download to csv functionality to the dropdown in prometheus metrics. !31679
- Adjust copy for adding additional members. !31726
- Upgrade to Gitaly v1.59.0. !31743
- Filter title, description, and body parameters from logs.

### Performance (17 changes, 1 of them is from the community)

- Add partial index on identities table to speed up LDAP lookups. !26710
- Improve MembersFinder query performance using UNION. !30451 (Jacopo Beschi @jacopo-beschi)
- Rake task to cleanup expired ActiveSession lookup keys. !30668
- Update usage ping cron behavior. !30842
- Make Bootsnap available via ENABLE_BOOTSNAP=1. !30963
- Batch processing of commit refs in markdown processing. !31037
- Use tablesample approximate counting by default. !31048
- Create index on environments by state. !31231
- Split MR widget into etag-cached and non-cached serializers. !31354
- Speed up loading and filtering deploy keys and their projects. !31384
- Only track Redis calls if Peek is enabled. !31438
- Only expire tag cache once per push. !31641
- Reduce Gitaly calls in PostReceive. !31741
- Eliminate many Gitaly calls in discussions API. !31834
- Optimize DB indexes for ES indexing of notes. !31846
- Expire project caches once per push instead of once per ref. !31876
- Look up upstream commits once before queuing ProcessCommitWorkers.

### Added (51 changes, 11 of them are from the community)

- Make starred projects and starrers of a project publicly visible. !24690
- Make quick action commands applied banner more useful. !26672 (Jacopo Beschi @jacopo-beschi)
- Allow Helm to be uninstalled from the UI. !27359
- Improve pipeline status Slack notifications. !27683
- Add links to relevant configuration areas in admin area overview. !29306
- Display project id on project admin page. !29734 (Zsolt Kovari)
- Display group id on group admin page. !29735 (Zsolt Kovari)
- Resolve Keyboard shortcut for jump to NEXT unresolved discussion. !30144
- Personal access tokens are accepted using OAuth2 header format. !30277
- Add Outbound requests whitelist for local networks. !30350 (Istvan Szalai)
- Allow multiple Auto DevOps projects to deploy to a single namespace within a k8s cluster. !30360 (James Keogh)
- Allow Knative to be uninstalled from the UI. !30458
- Add admin-configurable "Support page URL" link to top Help dropdown menu. !30459 (Diego Louzán)
- Allow specifying variables when running manual jobs. !30485
- Use predictable environment slugs. !30551
- Return an ETag header for the archive endpoint. !30581
- Add Rate Request Limiter to RawController#show endpoint. !30635
- Add git blame to GitLab API. !30675 (Oleg Zubchenko)
- Use separate Kubernetes namespaces per environment. !30711
- Support remove source branch on merge w/ push options. !30728
- Deploy serverless apps with gitlabktl. !30740
- Adjust group level analytics to accept multiple ids. !30744
- Adds event enum column to DesignsVersions join table. !30745
- Allow email notifications to be disabled for all members of a group or project. !30755 (Dustin Spicuzza)
- Export and download CSV from metrics charts. !30760
- Add API endpoints to return container repositories and tags from the group level. !30817
- Add support for deferred links in persistent user callouts. !30818
- Add system notes for when a Zoom call was added/removed from an issue. !30857 (Jacopo Beschi @jacopo-beschi)
- Count wiki creation, update and delete events. !30864
- Add new expansion options for merge request diffs. !30927
- Count snippet creation, update and comment events. !30930
- Update namespace label for GitLab-managed clusters. !30935
- UI for disabling group/project email notifications. !30961 (Dustin Spicuzza)
- Support setting of merge request title and description using git push options. !31068
- Add new table to store email domain per group. !31071
- Redirect from a project wiki git route to the project wiki home. !31085
- Link and embed metrics in GitLab Flavored Markdown. !31106
- Moves snowplow tracking from ee to ce. !31160 (jejacks0n)
- Allow Cert-Manager to be uninstalled. !31166
- Add new outbound network requests application setting for system hooks. !31177
- Allow links to metrics dashboard at a specific time. !31283
- Enable embedding of specific metrics charts in GFM. !31304
- Support creating DAGs in CI config through the `needs` key. !31328
- Generate shareable link for specific metric charts. !31339
- Add support for Content-Security-Policy. !31402
- Add BitBucketServer project import filtering. !31420
- Embed specific metrics chart in issue. !31644
- Track page views for cycle analytics show page. !31717
- Add usage pings for source code pushes. !31734
- Makes collapsible title clickable in job log.
- Adds highlight to the collapsible section.

### Other (36 changes, 9 of them are from the community)

- Rewrite `if:` argument in before_action and alike when `only:` is also used. !24412 (George Thomas @thegeorgeous)
- Create rake tasks for migrating legacy uploads out of deprecated paths. !29409
- Remove the warning style from the U2F device message in user settings > account. !30119 (matejlatin)
- Set visibility level 'Private' for restricted 'Internal' imported projects when 'Internal' visibility setting is restricted in admin settings. !30522
- Change BoardService in favor of boardsStore on board blank state of the component board. !30546 (eduarmreyes)
- Adds Sidekiq scheduling latency structured logging field. !30784
- Adds chaos endpoints to Sidekiq. !30814
- Added multi-select deletion of container registry images. !30837
- When GitLab import fails during importer user mapping step, add an explicit error message mentioning importer. !30838
- Add Rugged calls and duration to API and Rails logs. !30871
- Fixed distorted avatars when resource not reachable. !30904 (Marc Schwede)
- Update GitLab Runner Helm Chart to 0.7.0. !30950
- Use Rails 5.2 Redis caching store. !30966
- Add Rugged calls to performance bar. !30983
- add color selector to broadcast messages form. !30988
- Harmonize selections in user settings. !31110 (Marc Schwede)
- Update rouge to v3.7.0. !31254
- Update 'Ruby on Rails' project template. !31310
- Fix mirroring help text. !31348 (jramsay)
- Enhance style of the shared runners limit. !31386
- Enables storage statistics for root namespaces on database. !31392
- Improve quick action error messages. !31451
- Enable authenticated cookie encryption. !31463
- Update karma to 4.2.0. !31495 (Takuya Noguchi)
- Add max_replication_slots to PG HA documentation. !31534
- Create database tables for the new cycle analytics backend. !31621
- Updated the detached pipeline badge tooltip text to offer a better explanation. !31626
- Add Gitaly and Rugged call timing in Sidekiq logs. !31651
- Fix the style-lint errors and warnings for `app/assets/stylesheets/pages/wiki.scss`. !31656
- Update GraphicsMagick from 1.3.29 to 1.3.33 for CI tests. !31692 (Takuya Noguchi)
- Migrate remaining users with null private_profile. !31708
- Bump Helm to 2.14.3 and kubectl to 1.11.10 for Kubernetes integration. !31716
- Updated the personal access token api scope description to reflect the permissions it grants. !31759
- Add finished_at to the internal API Deployment entity. !31808
- Remove Security Dashboard feature flag. !31820
- Update Packer.gitlab-ci.yml to use latest image. (Kelly Hair)


618
619
620
621
## 12.1.10

- No changes.

622
623
624
625
626
627
628
629
## 12.1.5

### Security (2 changes)

- Upgrade Gitaly to 1.53.2 to prevent revision flag injection exploits.
- Upgrade pages to 1.7.1 to prevent gitlab api token recovery from cookie.


630
631
632
633
634
635
636
637
638
639
640
641
642
## 12.1.4

### Fixed (3 changes, 1 of them is from the community)

- Properly translate term in projects list. !30958
- Add exclusive lease to mergeability check process. !31082
- Fix Docker in Docker (DIND) listen port behavior change by adding DOCKER_TLS_CERTDIR in CI job templates. !31201 (Cameron Boulton)

### Performance (1 change)

- Improve job log rendering performance. !31262


643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
## 12.1.3

### Fixed (11 changes)

- Prevent multiple confirmation modals from opening when deleting a repository. !30532
- Fix the project auto devops API. !30946
- Fix "Certificate misses intermediates" UI error when enabling Let's Encrypt integration for pages domain. !30995
- Fix xterm css not loading for environment terminal. !31023
- Set DOCKER_TLS_CERTDIR in Auto Dev-Ops CI template to fix jobs using Docker-in-Docker. !31078
- Set DOCKER_TLS_CERTDIR in CI job templates to fix Docker-in-Docker service. !31080
- Support Docker OCI images. !31127
- Fix error rendering submodules in MR diffs when there is no .gitmodules. !31162
- Fix pdf.js rendering pages in the wrong order. !31222
- Fix exception handling in Gitaly autodetection. !31285
- Fix bug that caused diffs not to show on MRs with changes to submodules.

### Performance (1 change)

- Optimise import performance. !31045


664
665
## 12.1.2

666
667
668
669
### Security (1 change)

- Use source project as permissions reference for MergeRequestsController#pipelines.

670
671
672
673
674
675
676
677
678
679
680
681
682
### Security (9 changes)

- Restrict slash commands to users who can log in.
- Patch XSS issue in wiki links.
- Queries for Upload should be scoped by model.
- Filter merge request params on the new merge request page.
- Fix Server Side Request Forgery mitigation bypass.
- Show badges if pipelines are public otherwise default to project permissions.
- Do not allow localhost url redirection in GitHub Integration.
- Do not show moved issue id for users that cannot read issue.
- Drop feature to take ownership of trigger token.


683
684
685
686
## 12.1.1

- No changes.

687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
## 12.1.0

### Security (11 changes, 2 of them are from the community)

- Update tar to 2.2.2. !29949 (Takuya Noguchi)
- Update lodash to 4.7.14 and lodash.mergewith to 4.6.2. !30602 (Takuya Noguchi)
- Correctly check permissions when creating snippet notes.
- Gate MR head_pipeline behind read_pipeline ability.
- Prevent Billion Laughs attack.
- Add missing authorizations in GraphQL.
- Fix Denial of Service for comments when rendering issues/MR comments.
- Expose merge requests count based on user access.
- Fix DoS vulnerability in color validation regex.
- Prevent the detection of merge request templates by unauthorized users.
- Persist tmp snippet uploads at users.

### Removed (7 changes)

- Disable Kubernetes credential passthrough for managed project-level clusters. !29262
- Remove deprecated group routes. !29351
- Remove support for creating non-RBAC kubernetes clusters. !29614
- Remove Kubernetes service integration and Kubernetes service template from available deployment platforms. !29786
- Remove MySQL support. !29790
- Remove depreated /u/:username routing. !30044
- Remove support for legacy pipeline triggers. !30133

### Fixed (84 changes, 14 of them are from the community)

- Update a user's routes after updating their name. !23272
- Show poper panel when validation error occurs in admin settings panels. !25434
- Expect bytes from Gitaly RPC GetRawChanges. !28164
- Sanitize LDAP output in Rake tasks. !28427
- Left align mr widget icons and text. !28561
- Keep the empty folders in the tree. !29196
- Fix incorrect emoji placement in commit diff discussion. !29445
- Fix favicon path with uploads of object store. !29482 (Roger Meier)
- Remove duplicate trailing +/- char in merge request discussions. !29518
- Fix the signup form's username validation messages not displaying. !29678 (Jiaan Louw)
- Fix broken environment selector and always display it on monitoring dashboard. !29705
- Fix Container Scanning job timeout when using the kubernetes executor. !29706
- Look for new branches more carefully. !29761
- Fix nested lists unnecessary margin. !29775 (Kuba Kopeć)
- Fix reports jobs timing out because of cache. !29780
- Fix Double Border in Profile Page. !29784 (Yoginth <@yo>)
- Remove minimum character limits for fuzzy searches when using a CTE. !29810
- Set default sort method for dashboard projects list. !29830 (David Palubin)
- Protect TeamCity builds from triggering when a branch has been deleted. And a MR-option. !29836 (Nikolay Novikov, Raphael Tweitmann)
- Fix pipeline schedule does not run correctly when it's scheduled at the same time with the cron worker. !29848
- Always shows author of created issue/started discussion/comment in HTML body and text of email. !29886 (Frank van Rest)
- Build correct basenames for title search results. !29898
- Resolve "500 error when forking via the web IDE button". !29909
- Turn commit sha in monitor charts popover to link. !29914
- Fix broken URLs for uploads with a plus in the filename. !29915
- Retry fetching Kubernetes Secret#token (#63507). !29922
- Enforce presence of pipeline when "Pipeline must succeed" project setting is enabled. !29926
- Fix unresponsive reply button in discussions. !29936
- Allow asynchronous rebase operations to be monitored. !29940
- Resolve Avatar in Please sign in pattern too large. !29944
- Persist the cluster a deployment was deployed to. !29960
- Fix runner tags search dropdown being empty when there are tags. !29985
- Display the correct amount of projects being migrated/rolled-back to Hashed Storage when specifying ranges. !29996
- Resolve Environment details header border misaligned. !30011
- Correct link to docs for External Dashboard. !30019
- Fix Jupyter-Git integration. !30020 (Amit Rathi)
- Update Mermaid to 8.1.0. !30036
- Fix background migrations failing with unused replication slot. !30042
- Disable Rails SQL query cache when applying service templates. !30060
- Set higher TTL for write lock of trace to prevent concurrent archiving. !30064
- Fix charts on Cluster health page. !30073
- Display boards filter bar on mobile. !30120
- Fix IDE editor not showing when switching back from preview. !30135
- Support note position tracing on an image. !30158
- Replace slugifyWithHyphens with improved slugify function. !30172 (Luke Ward)
- 'Open' and 'Closed' issue board lists no longer display a redundant tooltip. !30187
- Fix pipelines table to update without refreshing after action. !30190
- Change ruby_process_start_time_seconds metric to unix timestamp instead of seconds from boot. !30195
- Fix attachments using the wrong URLs in e-mails. !30197
- Make sure UnicornSampler is started only in master process. !30215
- Don't show image diff note on text file. !30221
- Fix median counting for cycle analytics. !30229
- In WebIDE allow adding new entries of the same name as deleted entry. !30239
- Don't let logged out user do manual order. !30264
- Skip spam check for task list updates. !30279
- Make Housekeeping button do a full garbage collection. !30289
- Removing an image should not output binary data. !30314
- Fix spacing issues for toasts. !30345
- Fix race in forbid_sidekiq_in_transactions.rb. !30359
- Fixed back navigation for projects filter. !30373
- Fix environments broken terminal. !30401
- Fix invalid SSL certificate errors on Drone CI service. !30422
- Fix subgroup url in search drop down. !30457
- Make unicorn_workers to return meaningful results. !30506
- Fix wrong URL when creating milestones from instance milestones dashboard. !30512
- Fixed incorrect line wrap for assignee label in issues. !30523 (Marc Schwede)
- Improves section header whitespace on the CI/CD Charts page. !30531
- Prevent multiple confirmation modals from opening when deleting a repository. !30532
- Aligns CI icon in Merge Request dashboard. !30558
- Add text-secondary to controls in project list. !30567
- Review Tools: Add large z-index to toolbar. !30583
- Hide restricted and disallowed visibility radios. !30590
- Resolve Label picker: Line break on long label titles. !30610
- Fix a bug that prevented projects containing merge request diff comments from being imported. !30630
- I fixed z index bug in diff page. !30657 (Faruk Can)
- Allow client authentication method to be configured for OpenID Connect. !30683 (Vincent Fazio)
- Fix commenting before discussions are loaded. !30724
- Fix linebreak rendering in Mermaid flowcharts. !30730
- Make httpclient respect system SSL configuration. !30749
- Bump fog-aws to v3.5.2. !30803
- API: Allow changing only ci_default_git_depth. !30888 (Mathieu Parent)
- Search issuables by iids. (Riccardo Padovani)
- Fix broken warnings while Editing Issues and Edit File on MR.
- Make sure we are receiving the proper information on the MR Popover by updating the IID in the graphql query.

### Changed (39 changes, 8 of them are from the community)

- Improve group list UI. !26542
- Backport and Docs for Paginate license management and add license search. !27602
- Update merge requests section description text on project settings page. !27838
- Knative version bump 0.5 -> 0.6. !28798 (Chris Baumbauer)
- Add salesforce logo for salesforce SSO. !28857
- Enforced requirements for UltraAuth users. !28941 (Kartikey Tanna)
- Return 400 when deleting tags more often than once per hour. !29448
- Add identity information to external authorization requests. !29461
- Enable just-in-time Kubernetes resource creation for project-level clusters. !29515
- renamed discussion to thread in merge-request and issue timeline. !29553 (Michel Engelen)
- Changed HTTP Status Code for disabled repository on /branches and /commits to 404. !29585 (Sam Battalio)
- Enable Git object pools. !29595 (jramsay)
- Updated container registry to display error message when special characters in path. Documentation has also been updated. !29616
- Allow developers to delete tags. !29668
- Will not update issue timestamps when changing positions in a list. !29677
- Include a link back to the MR for Visual Review feedback form. !29719
- Improve discussion reply buttons layout and how jump to next discussion button appears. !29779
- Renders a pre-release tag for releases. !29797
- Migrate NULL values for users.private_profile column and update users API to reject null value for private_profile. !29888
- Re-name files in Web IDE in a more natural way. !29948
- Include events from subgroups in group's activity. !29953 (Fabian Schneider @fabsrc)
- Upgrade to Gitaly v1.49.0. !29990
- Remove group and instance clusters feature flag. !30124
- Add support for creating random passwords in user creation API. !30138
- Support CIDR notation in IP rate limiter. !30146
- Add Redis call details in Peek performance bar. !30191
- Create Knative role and binding with service account. !30235
- Add cleanup migration for MR's multiple assignees. !30261
- Updates PHP template to php:latest to ensure always targeting latest stable. !30319 (Paul Giberson)
- Format `from` and `to` fields in JSON audit log. !30333
- Upgrade to Gitaly v1.51.0. !30353
- Modify cycle analytics on project level. !30356
- Extract clair version as CLAIR_EXECUTABLE_VERSION variable and update clair executable from v8 to v11. !30396
- Upgrade Rouge to 3.5.1. !30431
- Move multiple issue boards to core. !30503
- Upgrade to Gitaly v1.52.0. !30568
- Upgrade to Gitaly v1.53.0. !30614
- Open WebIDE in fork when user doesn't have access. !30642
- Propagate python version variable. (Can Eldem)

### Performance (25 changes, 1 of them is from the community)

- Remove tooltip directive on project avatar image component. !29631 (George Tsiolis)
- Use Rugged if we detect storage is NFS and we can access the disk. !29725
- Add endpoint for fetching diverging commit counts. !29802
- Cache feature flag names in Redis for a minute. !29816
- Avoid storing backtraces from Bitbucket Cloud imports in the database. !29862
- Remove import columns from projects table. !29863
- Enable Gitaly ref name caching for discussions.json. !29951
- Allow caching of negative FindCommit matches. !29952
- Eliminate N+1 queries in Dashboard::TodosController. !29954
- Memoize non-existent custom appearances. !29957
- Add a separate endpoint for fetching MRs serialized as widgets. !29979
- Use CTE to fetch clusters hierarchy in single query. !30063
- Enable Gitaly ref caching for SearchController. !30105
- Avoid loading pipeline status in search results. !30111
- Improve performance of MergeRequestsController#ci_environment_status endpoint. !30224
- Add a memory cache local to the thread to reduce Redis load. !30233
- Cache Flipper persisted names directly to local memory storage. !30265
- Limit amount of JUnit tests returned. !30274
- Cache Flipper feature flags in L1 and L2 caches. !30276
- Prevent amplification of ReactiveCachingWorker jobs upon failures. !30432
- Allow ReactiveCaching to support nil value. !30456
- Improve performance of fetching environments statuses. !30560
- Do Redis lookup in batches in ActiveSession.sessions_from_ids. !30561
- Remove catfile cache feature flag. !30750
- Fix Gitaly auto-detection caching. !30954

### Added (46 changes, 12 of them are from the community)

- Document the negative commit message push rule for the API. !14004 (Maikel Vlasman)
- Expose saml_provider_id in the users API. !14045
- Improve Project API. !28327 (Mathieu Parent)
- Remove Sentry from application settings. !28447 (Roger Meier)
- Implement borderless discussion design with new reply field. !28580
- Enable terminals for instance and group clusters. !28613
- Resolve Multiple discussions per line in merge request diffs. !28748
- Adds link to Grafana in Admin > Monitoring settings when grafana is enabled in config. !28937 (Romain Maneschi)
- Bring Manual Ordering on Issue List. !29410
- Added commit type to tree GraphQL response. !29412
- New API for User Counts, updates on success of an MR the count on top and in other tabs. !29441
- Add option to limit time tracking units to hours. !29469 (Jon Kolb)
- Add confirmation for registry image deletion. !29505
- Sync merge ref upon mergeability check. !29569
- Show an Upcoming Status for Releases. !29577
- Add order_by and sort params to list runner jobs api. !29629 (Sujay Patel)
- Allow custom username for deploy tokens. !29639
- Add a verified pill next to email addresses under the admin users section. !29669
- Add rake task to clean orphan artifact files. !29681
- Render GFM in GraphQL. !29700
- Upgrade asciidoctor version to 2.0.10. !29741 (Rajendra Kadam)
- Allow auto-completing scoped labels. !29749
- Enable syntax highlighting for AsciiDoc. !29835 (Guillaume Grossetie)
- Expose placeholder element for metrics charts in GFM. !29861
- Added a min schema version check to db:migrate. !29882
- Extract zoom link from issue and pass to frontend. !29910 (raju249)
- GraphQL mutations for add, remove and toggle emoji. !29919
- Labeled issue boards can now collapse. !29955
- Allow Ingress to be uninstalled from the UI. !29977
- Add permission check to metrics dashboards endpoint. !30017
- Allow JupyterHub to be uninstalled from the UI. !30097
- Allow GitLab Runner to be uninstalled from the UI. !30176
- GraphQL mutations for managing Notes. !30210
- Add API for CRUD group clusters. !30213
- Add endpoint to move multiple issues in boards. !30216
- Enable terminals button for group clusters. !30255
- Prevent excessive sanitization of AsciiDoc ouptut. !30290 (Guillaume Grossetie)
- Extend `MergeToRefService` to create merge ref from an arbitrary ref. !30361
- Add CI variable to provide GitLab HOST. !30417
- Add migration for adding rule_type to approval_project_rules. !30575
- Enable section anchors in Asciidoctor. !30666 (Guillaume Grossetie)
- Preserve footnote link ids in Asciidoctor. !30790 (Guillaume Grossetie)
- Add support for generating SSL certificates for custon pages domains through Let's Encrypt.
- Introduce default: for gitlab-ci.yml.
- Move Multiple Issue Boards for Projects to Core.
- Add Gitaly data to the usage ping.

### Other (35 changes, 15 of them are from the community)

- Remove unresolved class and fixed height in discussion header. !28440 (David Palubin)
- Moved EE/CE code differences for file `app/views/search/_category.html.haml` into CE. !28755 (Michel Engelen)
- Changes "Todo" to "To Do" in the UI for clarity. !28844
- Migrate GitLab managed project-level clusters to unmanaged if a Kubernetes namespace was unable to be created. !29251
- Migrate GitLab managed project-level clusters to unmanaged if they are missing a Kubernetes service account token. !29648
- Add strategies column to operations_feature_flag_scopes table. !29808
- Disallow `NULL` values for `geo_nodes.primary` column. !29818 (Arun Kumar Mohan)
- Replace 'JIRA' with 'Jira'. !29849 (Takuya Noguchi)
- Support jsonb default in add_column_with_default migration helper. !29871
- Update pagination prev and next texts. !29911
- Adds metrics to measure cost of expensive operations. !29928
- Always allow access to health endpoints from localhost in dev. !29930
- Update GitLab Runner Helm Chart to 0.6.0. !29982
- Use darker gray color for system note metadata and edited text. !30054
- Fix typo in docs about Elasticsearch. !30162 (Takuya Noguchi)
- Fix typo in code comments about Elasticsearch. !30163 (Takuya Noguchi)
- Update mixin-deep to 1.3.2. !30223 (Takuya Noguchi)
- Migrate markdown header_spec.js to Jest. !30228 (Martin Hobert)
- Remove istanbul JavaScript package. !30232 (Takuya Noguchi)
- Centralize markdownlint configuration. !30263
- Use PostgreSQL 9.6.11 in CI tests. !30270 (Takuya Noguchi)
- Fix typo in updateResolvableDiscussionsCounts action. !30278 (Frank van Rest)
- Change color for namespace in commit search. !30312
- Remove applySuggestion from notes service. !30399 (Frank van Rest)
- Improved readability of storage statistics in group / project admin area. !30406
- Alignign empty container registry message with design guidelines. !30502
- Remove toggleAward from notes service. !30536 (Frank van Rest)
- Remove deleteNote from notes service. !30537 (Frank van Rest)
- change the use of boardService in favor of boardsStore on footer for the board component. !30616 (eduarmreyes)
- Update example Prometheus scrape config. !30739
- Update GitLab Pages to v1.7.0.
- Add token_encrypted column to operations_feature_flags_clients table.
- Removes EE diff for app/views/profiles/preferences/show.html.haml.
- Removes EE differences for app/views/layouts/fullscreen.html.haml.
- Removes EE differences for app/views/admin/users/show.html.haml.


958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
## 12.0.7

### Security (22 changes)

- Ensure only authorised users can create notes on Merge Requests and Issues.
- Add :login_recaptcha_protection_enabled setting to prevent bots from brute-force attacks.
- Queries for Upload should be scoped by model.
- Speed up regexp in namespace format by failing fast after reaching maximum namespace depth.
- Limit the size of issuable description and comments.
- Send TODOs for comments on commits correctly.
- Restrict MergeRequests#test_reports to authenticated users with read-access on Builds.
- Added image proxy to mitigate potential stealing of IP addresses.
- Filter out old system notes for epics in notes api endpoint response.
- Avoid exposing unaccessible repo data upon GFM post processing.
- Fix HTML injection for label description.
- Make sure HTML text is always escaped when replacing label/milestone references.
- Prevent DNS rebind on JIRA service integration.
- Use admin_group authorization in Groups::RunnersController.
- Prevent disclosure of merge request ID via email.
- Show cross-referenced MR-id in issues' activities only to authorized users.
- Enforce max chars and max render time in markdown math.
- Check permissions before responding in MergeController#pipeline_status.
- Remove EXIF from users/personal snippet uploads.
- Fix project import restricted visibility bypass via API.
- Fix weak session management by clearing password reset tokens after login (username/email) are updated.
- Fix SSRF via DNS rebinding in Kubernetes Integration.


986
987
988
989
## 12.0.6

- No changes.

990
991
## 12.0.3 (2019-06-27)

992
- No changes.
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
### Security (10 changes)

- Persist tmp snippet uploads at users.
- Gate MR head_pipeline behind read_pipeline ability.
- Fix DoS vulnerability in color validation regex.
- Expose merge requests count based on user access.
- Fix Denial of Service for comments when rendering issues/MR comments.
- Add missing authorizations in GraphQL.
- Disable Rails SQL query cache when applying service templates.
- Prevent Billion Laughs attack.
- Correctly check permissions when creating snippet notes.
- Prevent the detection of merge request templates by unauthorized users.


1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
## 12.0.2 (2019-06-25)

### Fixed (7 changes, 1 of them is from the community)

- Fix missing API notification flags for Microsoft Teams. !29824 (Seiji Suenaga)
- Fixed 'diff version changes' link not working. !29825
- Fix label serialization in issue and note hooks. !29850
- Include the GitLab version in the cache key for Gitlab::JsonCache. !29938
- Prevent EE backport migrations from running if CE is not migrated. !30002
- Silence backup warnings when CRON=1 in use. !30033
- Fix comment emails not respecting group-level notification email.

### Performance (1 change)

- Omit issues links in merge request entity API response. !29917


1024
1025
1026
1027
## 12.0.1 (2019-06-24)

- No changes.

1028
1029
1030
1031
## 12.0.0 (2019-06-22)

### Security (10 changes)

1032
- Prevent bypass of restriction disabling web password sign in.
1033
- Hide confidential issue title on unsubscribe for anonymous users.
1034
- Resolve: Milestones leaked via search API.
1035
- Fix url redaction for issue links.
1036
- Add extra fields for handling basic auth on import by url page.
1037
1038
- Fix confidential issue label disclosure on milestone view.
- Filter relative links in wiki for XSS.
1039
- Prevent invalid branch for merge request.
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
- Prevent XSS injection in note imports.
- Protect Gitlab::HTTP against DNS rebinding attack.

### Removed (5 changes, 1 of them is from the community)

- Remove ability for group clusters to be automatically configured on creation. !27245
- Removes support for AUTO_DEVOPS_DOMAIN. !28460
- Remove the circuit breaker API. !28669
- Make Kubernetes service templates readonly. !29044
- Remove Content-Type override for Mattermost OAuth login. (Harrison Healey)

1051
### Fixed (115 changes, 28 of them are from the community)
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159

- Fix col-sm-* in forms to keep layout. !24885 (Takuya Noguchi)
- Avoid 500 when rendering users ATOM data. !25408
- Fix flyout nav on small viewports. !25998
- Fix proxy support in Container Scanning. !27246
- preventing blocked users and their PipelineSchdules from creating new Pipelines. !27318
- Fix yaml linting for GitLab CI inside project (.gitlab/ci) *.yml files and CI template files. !27576 (Will Hall)
- Fix yaml linting for project root *.yml files. !27579 (Will Hall)
- Added a content field to atom feed. !27652
- Bring secondary button styles up to design standard. !27920
- Use FindOrCreateService to create labels and check for existing ones. !27987 (Matt Duren)
- Fix "too many loops" error by handling gracefully cron schedules for non existent days. !28002
- Fix 500 error when accessing charts with an anonymous user. !28091 (Diego Silva)
- Allow user to set primary email first when 2FA is required. !28097 (Kartikey Tanna)
- Auto-DevOps: allow to disable rollout status check. !28130 (Sergej Nikolaev <kinolaev@gmail.com>)
- Resolved JIRA service: NoMethodError: undefined method 'find' for nil:NilClass. !28206
- Supports Matomo/Piwik string website ID ("Protect Track ID" plugin). !28214 (DUVERGIER Claude)
- Fix loading.. dropdown at search field. !28275 (Pavel Chausov)
- Remove unintended error message shown when moving issues. !28317
- Properly clear the merge error upon rebase failure. !28319
- Upgrade dependencies for node 12 compatibility. !28323
- Fix. `db:migrate` is failed on MySQL 8. !28351 (sue445)
- Fix an error in projects admin when statistics are missing. !28355
- Fix emojis URLs. !28371
- Prevent common name collisions when requesting multiple Let's Encrypt certificates concurrently. !28373
- Fix issue that causes "Save changes" button in project settings pages to be enabled/disabled incorrectly when changes are made to the form. !28377
- Fix diff notes and discussion notes being exported as regular notes. !28401
- Fix padding in MR widget. !28472
- Updates loading icon in commits page. !28475
- Fix border radius of discussions. !28490
- Update broadcast message action icons. !28496 (Jarek Ostrowski @jareko)
- Update icon color to match design system, pass accessibility. !28498 (Jarek Ostrowski @jareko)
- Show data on Cycle Analytics page when value is less than a second. !28507
- Fix dropdown position when loading remote data. !28526
- Delete unauthorized Todos when project is made private. !28560
- Change links in system notes to use relative paths. !28588 (Luke Picciau)
- Update favicon from next. !28601 (Jarek Ostrowski @jareko)
- Open visibility help link in a new tab. !28603 (George Tsiolis)
- Fix issue importing members with owner access. !28636
- Fix the height of the page headers on issues/merge request/snippets pages. !28650 (Erik van der Gaag)
- Always show "Pipelines must succeed" checkbox. !28651
- Resolve moving an issue results in broken image links in comments. !28654
- Fix milestone references containing &, <, or >. !28667
- Add hover and focus to Attach a file. !28682
- Correctly word-wrapping project descriptions with very long words. !28695 (Erik van der Gaag)
- Prevent icons from shrinking in User popover when contents exceed container. !28696
- Allow removal of empty lines via suggestions. !28703
- Throw an error when formatDate's input is invalid. !28713
- Fix order dependency with user params during imports. !28719
- Fix search dropdown not closing on blur if empty. !28730
- Fixed ignored postgres version that occurs after the first autodevops deploy when specifying custom $POSTGRES_VERSION. !28735 (Brandon Dimcheff)
- Limit milestone dates to before year 9999. !28742 (Luke Picciau)
- Set project default visibility to max allowed. !28754
- Cancel auto merge when merge request is closed. !28782
- Fixes Ref link being displayed as raw HTML in the Pipelines page. !28823
- Fix job name in graph dropdown overflowing. !28824
- Add style to disable webkit icons for search inputs. !28833 (Jarek Ostrowski @jareko)
- Fix email notifications for user excluded actions. !28835
- Resolve Tooltip Consistency. !28839
- Fix Merge Request merge checkbox alignment on mobile view. !28845
- Add referenced-commands in no overflow list. !28858
- Fix participants list wrapping. !28873
- Excludes MR author from Review roulette. !28886 (Jacopo Beschi @jacopo-beschi)
- Give labels consistent weight. !28895
- Added padding to time window dropdown in monitor dashboard. !28897
- Move text under p tag. !28901
- Resolve Position is off when visiting files with anchors. !28913
- Fix whitespace changes visibility when the related file was initially collapsed. !28950 (Ondřej Budai)
- Fix emoji picker visibility issue. !28984
- Resolve Merge request discussion text jumps when resolved. !28995
- Allow lowercase prefix for Youtrack issue ids. !29057 (Matthias Baur)
- Add support to view entirety of long branch name in dropdown instead of it being cut off. !29069
- Fix inconsistent option dropdown button height to match adjacent button. !29096
- Improve new user email markup unconsistency between text and html parts. !29111 (Haunui Saint-sevin)
- Eliminate color inconsistencies in metric graphs. !29127
- Avoid setting Gitlab::Session on sessionless requests and Git HTTP. !29146
- Use the selected time window for metrics dashboard. !29152
- Remove build policies from serverless app template. !29253
- Fix serverless apps deployments by bumping 'tm' version. !29254
- Include the port in the URLs of the API Link headers. !29267
- Fix Fogbugz Importer not working. !29383
- Fix GPG signature verification with recent GnuPG versions. !29388 (David Palubin)
- Cancel Auto Merge when target branch is changed. !29416
- Fix nil coercion updating storage size on project statistics. !29425
- Ignore legacy artifact columns in Project Import/Export. !29427
- Avoid DB timeouts when scheduling migrations. !29437
- Handle encoding errors for MergeToRefService. !29440
- Fix UTF-8 conversion issues when resolving conflicts. !29453
- Enlarge metrics time-window dropdown links. !29458
- Remove unnecessary decimals on Metrics chart axis. !29468
- Fix scrolling to top on assignee change. !29500
- Allow command/control click to open link in new tab on Merge Request tabs. !29506
- Omit blocked admins from repository check e-mails. !29507
- Fix diverged branch locals. !29508
- Process up to 100 commit messages for references when pushing to a new default branch. !29511 (Fabio Papa)
- Allow developer role to delete docker tags via container registry API. !29512
- Fix "Resolve conflicts" button not appearing for some users. !29535
- Fix: propagate all documented ENV vars to CI when using SAST. !29564
- AutoDevops function ensure_namespace() now explicitly tests the namespace. !29567 (Jack Lei)
- Fix sidebar flyout navigation. !29571
- Fix missing deployment rockets in monitor dashboard. !29574
- Fix inability to set visibility_level on project via API. !29578
- Ensure a Kubernetes namespace is not used for deployments if there is no service account token associated with it. !29643
- Refresh service_account_token for kubernetes_namespaces. !29657
- Expose all current events properly on services API. !29736 (Zsolt Kovari)
- Move Dropdown to Stick to MR View App Button. !29767
- Fix IDE commit using latest ref in branch and overriding contents. !29769
- Revert concurrent pipeline creation for pipeline schedules. !29794
1160
- Fix border radii on diff files and repo files.
1161
- Fix padding of unclickable pipeline dropdown items to match links.
1162
1163
1164
1165
- Fix pipeline schedules when owner is nil.
- Fix remote mirrors not updating after tag push.
- Fix layout of group milestone header.
- Fixed show whitespace button not refetching diff content.
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
- Change resolve button text to mark comment as resolved.
- Align system note within discussion with other notes.

### Changed (35 changes, 13 of them are from the community)

- Include information if issue was clossed via merge request or commit. !15610 (Michał Zając)
- Removes duplicated members from api/projects/:id/members/all. !24005 (Jacopo Beschi @jacopo-beschi)
- Apply the group setting "require 2FA" across all subgroup members as well when changing the group setting. !24965 (rroger)
- Enable function features for external Knative installations. !27173
- Remove dind from DAST template. !28083
- Update registration form to indicate invalid name or username length on input. !28095 (Jiaan Louw)
- Default masked to false for new variables. !28186
- Better isolated `Docker.gitlab-ci.yml` to avoid interference with other job configurations. !28213 (lrkwz)
- Remove the mr_push_options feature flag. !28278
- Replace Oxygen-Sans font with Noto Sans. !28322
- Update new smiley icons, find n replace old names with new ones. !28338 (Jarek Ostrowski)
- Adds a text label to color pickers to improve accessibility. !28343 (Chris Toynbee)
- Prioritize login form on mobile breakpoint. !28360
- Move some project routes under /-/ scope. !28435
- I18n for issue closure reason in emails. !28489 (Michał Zając)
- Geo: Remove Gitlab::LfsToken::LegacyRedisDeviseToken implementation and usage. !28546
- Add check circle filled icon for resolved comments. !28663
- Update project security dashboard documentation. !28681
- Remove `docker pull` prefix when copying a tag from the registry. !28757 (Benedikt Franke)
- Adjust milestone completion rate to be based on issues count. !28777
- Enhance line-height of Activity feed UI. !28856 (Jacopo Beschi @jacopo-beschi)
- Upgrade to Gitaly v1.43.0. !28867
- Do not display Update app button when saving Knative domain name. !28904
- Rebrush of flash-warning according to the new design (brighter background and darker font). !28916 (Michel Engelen)
- Added reference, web_path, and relative_position fields to GraphQL Issue. !28998
- Change logic behind cycle analytics. !29018
- Add documentation links for confidental and locked discussions. !29073
- Update GITALY_SERVER_VERSION to 1.45.0. !29109
- Allow masking if 8 or more characters in base64. !29143 (thomas-nilsson-irfu)
- Replaces sidekiq mtail metrics with ruby instrumentation metrics. !29215
- Allow references to labels and milestones to contain emoji. !29284
- changed the styles on `Add List` dropdown to look more like the EE vesion. !29338 (Michel Engelen)
- Hashed Storage is enabled by default on new installations. !29586
- Upgrade to Gitaly v1.47.0. !29789
- Default MR checkbox to true in most cases.

### Performance (11 changes)

- Improve performance of jobs controller. !28093
- Upgrade Ruby version to 2.6.3. !28117
- Make pipeline schedule worker resilient. !28407
- Fix performance issue with large Markdown content in issue or merge request description. !28597
- Improve clone performance by using delta islands. !28871
- Reduce Gitaly calls to improve performance when rendering suggestions. !29027
- Use Redis for CacheMarkDownField on non AR models. !29054
- Add index on public_email for users. !29430
- Speed up commit loads by disabling BatchLoader replace_methods. !29633
- Add index on invite_email for members. !29768
- Improve performance of users autocomplete when there are lots of results.

### Added (47 changes, 12 of them are from the community)

- Added option to filter jobs by age in the /job/request API endpoint. !1340 (Dmitry Chepurovskiy)
- Add ability to define notification email addresses for groups you belong to. !25299
- Add wiki size to project statistics. !25321 (Peter Marko)
- 58404 - setup max depth for GraphQL. !25737 (Ken Ding)
- Add auto SSL toggle option to Pages domain settings page. !26438
- Empty project state for Web IDE. !26556
- Add support for multiple job parents in GitLab CI YAML. !26801 (Wolphin (Nikita))
- Pass user's identity and token from JupyterHub to user's Jupyter environment. !27314 (Amit Rathi)
- Add issues_statistics api endpoints and extend issues search api. !27366
- Validate Kubernetes credentials at cluster creation. !27403
- Update the merge request widget's "Merge" button to support merge trains. !27594
- Style the toast component according to design specs. !27734
- Add API support for committing changes to different projects in same fork network. !27915
- Add support for && and || to CI Pipeline Expressions. Change CI variable expression matching for Lexeme::Pattern to eagerly return tokens. !27925 (Martin Manelli)
- Added ref querystring parameter to project search API to allow searching on branches/tags other than the default. !28069 (Lee Tickett)
- Add notify_only_default_branch option to PipelinesEmailService. !28271 (Peter Marko)
- Support multiplex GraphQL queries. !28273
- Add Namespace and ProjectStatistics to GraphQL API. !28277
- Display classname JUnit attribute in report modal. !28376
- API: Allow to get and set "masked" attribute for variables. !28381 (Mathieu Parent)
- Add allow_failure attribute to Job API. !28406
- Add support for AsciiDoc include directive. !28417 (Jakub Jirutka & Guillaume Grossetie)
- Migrate Kubernetes service integration templates to clusters. !28534
- Allow issue list to be sorted by relative order. !28566
- Implement borderless discussion design with new reply field. !28580
- Add expand/collapse to error tracking settings. !28619
- Adds collapsible sections for job log. !28642
- Add LFS oid to GraphQL blob type. !28666
- Allow users to specify a time range on metrics dashboard. !28670
- Add a New Copy Button That Works in Modals. !28676
- Add Kubernetes logs to Admin Logs UI. !28685
- Set up git client in Jupyter installtion. !28783 (Amit Rathi)
- Add task count and completed count to responses of Issue and MR. !28859
- Add project level git depth CI/CD setting. !28919
- Use global IDs when exposing GraphQL resources. !29080
- Expose wiki_size on GraphQL API. !29123
- Expose notes and discussions in GraphQL. !29212
- Use to 'gitlabktl' build serverless applications. !29258
- Adds pagination component for graphql api. !29277
- Allow switching clusters between managed and unmanaged. !29322
- Get and edit ci_default_git_depth via project API. !29353
- Link to an external dashboard from metrics dashboard. !29369
- Add labels to note event payload. !29384 (Sujay Patel)
- Add Join meeting button to issues with Zoom links. !29454
- Add backtraces to Peek performance bar for SQL calls.
- Added diff suggestion feature discovery popover.
1269
- Make task completion status available via GraphQL.
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323

### Other (62 changes, 14 of them are from the community)

- Unified EE/CS differences in repository/show.html. !13562
- Remove legacy artifact related code. !26475
- Backport the EE schema and migrations to CE. !26940 (Yorick Peterse)
- Add dedicated logging for GraphQL queries. !27885
- i18n: externalize strings from user profile settings. !28088 (Antony Liu)
- Omit max-count for diverging_commit_counts behind feature flag. !28157
- Fix alignment of resend button in members page. !28202
- Update indirect dependency fsevents from 1.2.4 to 1.2.9. !28220 (Takuya Noguchi)
- Update get_process_mem to 0.2.3. !28248
- Add Pool repository to the usage ping. !28267
- Forbid NULL in project_statistics.packages_size. !28400
- Update Gitaly to v1.42.1. !28425
- Upgrade babel to 7.4.4. !28437 (Takuya Noguchi)
- Externalize profiles preferences. !28470 (George Tsiolis)
- Update GitLab Runner Helm Chart to 0.5.0. !28497
- Change collapse icon size to size of profile picture. !28512
- Resolve Snippet icon button is misaligned. !28522
- Bumps Kubernetes in Auto DevOps to 1.11.10. !28525
- Bump Helm version in Auto-DevOps.gitlab-ci.yml to 2.14.0. !28527
- Migrate the monitoring dashboard store to vuex. !28555
- Give New Snippet button green outline. !28559
- Removes project_auto_devops#domain column. !28574
- Externalize strings of email page in user profile. !28587 (antony liu)
- Externalize strings of active sessions page in user profile. !28590 (antony liu)
- Refactor and abstract Auto Merge Processes. !28595
- Add section to dev docs on accessing chatops. !28623
- Externalize strings of chat page in user profile. !28632
- Externalize strings of PGP Keys and SSH Keys page in user profile. !28653 (Antony Liu)
- Added the `.extended-height` class to the labels-dropdown. !28659 (Michel Engelen)
- Moved EE/CE code differences for `app/assets/javascripts/gl_dropdown.js` into CE. !28711 (Michel Engelen)
- Update GitLab Runner Helm Chart to 0.5.1. !28720
- Remove support for using Geo with an installation from source. !28737
- API: change masked attribute type to Boolean. !28758
- API: change protected attribute type to Boolean. !28766
- Add a column header to admin/jobs page. !28837
- Reset merge status from mergeable MRs. !28843
- Show tooltip on truncated commit title. !28865 (Timofey Trofimov)
- Added conditional rendering to `app/views/search/_form.html.haml` for CE/EE code base consistency. !28883 (Michel Engelen)
- Change "Report abuse to GitLab" to more generic wording. !28884 (Marc Schwede)
- Update GitLab Pages to v1.6.0. !29048
- Update GitLab Runner Helm Chart to 0.5.2. !29050
- User link styling for commits. !29150
- Fix null source_project_id in pool_repositories. !29157
- Add deletion protection setting column to application_settings table. !29268
- Added code differnces from EE in file 'app/assets/javascripts/pages/projects/project.js' to CE. !29271 (Michel Engelen)
- Update to GitLab Shell v9.3.0. !29283
- Document when milestones and labels links are missing. !29355
- Make margin between buttons consistent. !29378
- Changed the 'Created' label to 'Last Updated' on the container registry table to more accurately reflect what the date represents. !29464
- Update GitLab Pages to v1.6.1. !29559
- Indent collapsible sections. !29804
1324
- Use grid and correct border radius for status badge.
1325
- Remove fixed height from MR diff headers.
1326
1327
- Use blue for activity stream links; use monospace font for commit sha.
- Moves snowplow to CE repo.
1328
- Reduce height of issue board input to align with buttons.
1329
1330
1331
- Change default color of award emoji button.
- Group download buttons into a .btn-group.
- Add warning that gitlab-secrets isn't included in backup.
1332
- Increase height of move issue dropdown.
1333
1334
- Update merge request tabs so they no longer scroll.
- Moves the table pagination shared component.
1335
1336


1337
1338
1339
1340
1341
1342
1343
1344
## 11.11.8

### Security (2 changes)

- Upgrade Gitaly to 1.42.7 to prevent revision flag injection exploits.
- Upgrade pages to 1.5.1 to prevent gitlab api token recovery from cookie.


1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
## 11.11.7

### Security (9 changes)

- Restrict slash commands to users who can log in.
- Patch XSS issue in wiki links.
- Filter merge request params on the new merge request page.
- Fix Server Side Request Forgery mitigation bypass.
- Show badges if pipelines are public otherwise default to project permissions.
- Do not allow localhost url redirection in GitHub Integration.
- Do not show moved issue id for users that cannot read issue.
- Use source project as permissions reference for MergeRequestsController#pipelines.
- Drop feature to take ownership of trigger token.


1360
1361
1362
1363
1364
1365
1366
1367
1368
## 11.11.4 (2019-06-26)

### Fixed (3 changes)

- Fix Fogbugz Importer not working. !29383
- Fix scrolling to top on assignee change. !29500
- Fix IDE commit using latest ref in branch and overriding contents. !29769


1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
## 11.11.3 (2019-06-10)

### Fixed (5 changes)

- Fix invalid visibility string comparison in project import. !28612
- Remove a default git depth in Pipelines for merge requests. !28926
- Fix connection to Tiller error while uninstalling. !29131
- Fix label click scrolling to top. !29202
- Make OpenID Connect work without requiring a name. !29312


1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
## 11.11.2 (2019-06-04)

### Fixed (7 changes)

- Update SAST.gitlab-ci.yml - Add SAST_GITLEAKS_ENTROPY_LEVEL. !28607
- Fix OmniAuth OAuth2Generic strategy not loading. !28680
- Use source ref in pipeline webhook. !28772
- Fix migration failure when groups are missing route. !29022
- Stop two-step rebase from hanging when errors occur. !29068
- Fix project settings not being able to update. !29097
- Fix display of 'Promote to group label' button.

### Other (1 change)

- Fix input group height.


1397
1398
1399
1400
1401
1402
## 11.11.0 (2019-05-22)

### Security (1 change)

- Destroy project remote mirrors instead of disabling. !27087

1403
### Fixed (75 changes, 19 of them are from the community)
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463

- Don't create a temp reference for branch comparisons within project. !24038
- Fix some label links not appearing on group labels page and label title being a link on project labels page. !24060 (Tanya Pazitny)
- Fix extra emails for custom notifications. !25607
- Rewind IID on Ci::Pipelines. !26490
- Fix duplicate merge request pipelines created by Sidekiq worker retry. !26643
- Catch and report OpenSSL exceptions while fetching external configuration files in CI::Config. !26750 (Drew Cimino)
- stop rendering download links for expired artifacts on the project tags page. !26753 (Drew Cimino)
- Format extra help page text like wiki. !26782 (Bastian Blank)
- Always show instance configuration link. !26783 (Bastian Blank)
- Display maximum artifact size from runtime config. !26784 (Bastian Blank)
- Resolve issue where list labels did not have the correct text color on creation. !26794 (Tucker Chapman)
- Set release name when adding release notes to an existing tag. !26807
- Fix the bug that the project statistics is not updated. !26854 (Hiroyuki Sato)
- Client side changes for ListLastCommitsForTree response update. !26880
- Fix api group visibility. !26896
- Require all templates to use default stages. !26954
- Remove a "reopen merge request button" on a "merged" merge request. !26965 (Hiroyuki Sato)
- Fix misaligned image diff swipe view. !26969 (ftab)
- Add badge-pill class on group member count. !27019
- Remove leading / trailing spaces from heading when generating header ids. !27025 (Willian Balmant)
- Respect updated_at attribute in notes produced by API calls. !27124 (Ben Gamari)
- Fix GitHub project import visibility. !27133 (Daniel Wyatt)
- Fixes actions dropdowns in environments page. !27160
- Fixes create button background for Environments form. !27161
- Display scoped labels in Issue Boards. !27164
- Align UrlValidator to validate_url gem implementation. !27194 (Horatiu Eugen Vlad)
- Resolve Web IDE template dropdown showing duplicates. !27237
- Update GitLab Workhorse to v8.6.0. !27260
- Only show in autocomplete when author active. !27292
- Remove deadline for Git fsck. !27299
- Show prioritized labels to guests. !27307
- Properly expire all pipeline caches when pipeline is deleted. !27334
- Replaced icon for external URL with doc-text icon. !27365
- Add auto direction for issue title. !27378 (Ahmad Haghighi)
- fix wiki search result links in titles. !27400 (khm)
- Fix system notes timestamp when creating issue in the past. !27406
- Fix approvals sometimes being reset after a merge request is rebased. !27446
- Fix empty block in MR widget when user doesn't have permission. !27462
- Fix wrong use of ActiveRecord in PoolRepository. !27464
- Show proper preview for uploaded images in Web IDE. !27471
- Resolve Renaming an image via Web IDE corrupts it. !27486
- Clean up CarrierWave's import/export files. !27487
- Fix autocomplete dropdown for usernames starting with period. !27533 (Jan Beckmann)
- Disable password autocomplete in mirror repository form. !27542
- Always use internal ID tables in development and production. !27544
- Only show the "target branch has advanced" message when the merge request is open. !27588
- Resolve Misalignment on suggested changes diff table. !27612
- Update Workhorse to v8.7.0. !27630
- Fix FE API and IDE handling of '/' relative_url_root. !27635
- Hide ScopedBadge overflow notes. !27651
- Fix base domain help text update. !27746
- Upgrade letter_opener_web to support Rails 5.1. !27829
- Fix webpack assets handling when relative url root is '/'. !27909
- Fix IDE get file data with '/' as relative root. !27911
- Allow a member to have an access level equal to parent group. !27913
- Fix issuables state_id nil when importing projects from GitHub. !28027
- Fix uploading of LFS tracked file through UI. !28052
- Render Next badge only for gitlab.com. !28056
- Fix update head pipeline process of Pipelines for merge requests. !28057
1464
- Handle errors in successful notes reply. !28082
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
- Fix visual issues in set status modal. !28147
- Use a path for the related merge requests endpoint. !28171
- disable SSH key validation in key details view. !28180 (Roger Meier)
- Fix MR discussion border missing in chrome sometimes. !28185
- Fix Error 500 when inviting user already present. !28198
- Remove non-semantic use of `.row` in member listing controls. !28204
- Properly handle LFS Batch API response in project import. !28223
- Fix project visibility level validation. !28305 (Peter Marko)
- Fix incorrect prefix used in new uploads for personal snippets. !28337
- Fix Rugged get_tree_entries recursive flag not working. !28494
- Next badge must visible when canary flag is true.
- Vertically aligns the play button for stages.
1477
1478
- Fixes next badge being always visible.
- Adds arrow icons to select option in CI/CD settings.
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
- Allow replying to individual notes from API.

### Changed (19 changes, 3 of them are from the community)

- Sort by due date and popularity in both directions for Issues and Merge requests. !25502 (Nermin Vehabovic)
- Improve pipelines table spacing, add triggerer column. !26136
- Allow extra arguments in helm commands when deploying the application in Auto-DevOps.gitlab-ci.yml. !26171 (tortuetorche)
- Switch to sassc-rails for faster stylesheet compilation. !26224
- Reorganize project merge request settings. !26834
- Display a toast message when the Kubernetes runner has successfully upgraded. !27206
- Allow guests users to access project releases. !27247
- Add help texts to K8 form fields. !27274
- Support prometheus for group level clusters. !27280
- Include link to raw job log in plain-text emails. !27409
- Only escape Markdown emphasis characters in autocomplete when necessary. !27457
- Move location of charts/auto-deploy-app -> gitlab-org/charts/auto-deploy-app. !27477
- Make canceled jobs not retryable. !27503
- Upgrade to Gitaly v1.36.0. !27831
- Update deployment event chat notification message. !27972
- Upgrade to Gitaly v1.42.0. !28135
- Resolve discussion when apply suggestion. !28160
- Improve expanding diff to full file performance.
- Knative version bump 0.3 -> 0.5. (Chris Baumbauer <cab@cabnetworks.net>)

### Performance (5 changes)

- Added list_pages method to avoid loading all wiki pages content. !22801
- Add gitaly session id & catfile-cache feature flag. !27472
- Add improvements to global search of issues and merge requests. !27817
- Disable method replacement in avatar loading. !27866
- Fix Blob.lazy always loading all previously-requested blobs when a new request is made.

### Added (36 changes, 10 of them are from the community)

- Add time preferences for user. !25381
- Added write_repository scope for personal access token. !26021 (Horatiu Eugen Vlad)
- Mark disabled pages domains for removal, but don't remove them yet. !26212
- Remove pages domains if they weren't verified for 1 week. !26227
- Expose pipeline variables via API. !26501 (Agustin Henze <tin@redhat.com>)
- Download a folder from repository. !26532 (kiameisomabes)
- Remove cleaned up OIDs from database and cache. !26555
- Disables kubernetes resources creation if a cluster is not managed. !26565
- Add CI_COMMIT_REF_PROTECTED CI variable. !26716 (Jason van den Hurk)
- Add new API endpoint to expose a single environment. !26887
- Allow Sentry configuration to be passed on gitlab.yml. !27091 (Roger Meier)
- CI variables of type file. !27112
- Allow linking to a private helm repository by providing credentials, and customisation of repository name. !27123 (Stuart Moore @stjm-cc)
- Add time tracking information to Issue Boards sidebar. !27166
- Play all manual jobs in a stage. !27188
- Instance level kubernetes clusters. !27196
- Adds if InfluxDB and Prometheus metrics are enabled to usage ping data. !27238
- Autosave description in epics. !27296
- Add deployment events to chat notification services. !27338
- Add packages_size to ProjectStatistics. !27373
- Added OmniAuth OpenID Connect strategy. !27383 (Horatiu Eugen Vlad)
- Test using Git 2.21. !27418
- Use official Gitea logo in importer. !27424 (Matti Ranta (@techknowlogick))
- Add option to set access_level of runners upon registration. !27490 (Zelin L)
- Add initial GraphQL query for Groups. !27492
- Enable Sidekiq Reliable Fetcher for background jobs by default. !27530
- Add backend support for a External Dashboard URL setting. !27550
- Implement UI for uninstalling Cluster’s managed apps. !27559
- Resolve Salesforce.com omniauth support. !27834
- Leave project/group from access granted email. !27892
- Allow Sentry client-side DSN to be passed on gitlab.yml. !27967
- GraphQL: improve evaluation of query complexity based on arguments and query limits. !28017
- Support negative matches.
- Added Omniauth UltraAuth strategy to GitLab. (Kartikey Tanna)
1547
1548
- Adds badge for Canary environment and help link.
- Show category icons in user popover.
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577

### Other (29 changes, 8 of them are from the community)

- Validate refs used in controllers don't have spaces. !24037
- Migrate correlation and tracing code to LabKit. !25379
- Update node.js to 10.15.3 in CI template for Hexo. !25943 (Takuya Noguchi)
- Improve icons and button order in project overview. !26796
- Add instructions on how to contribute a Built-In template for project. !26976
- Extract DiscussionNotes component from NoteableDiscussion. !27066
- Bump gRPC to 1.19.0 and protobuf to 3.7.1. !27086
- Extract DiscussionActions component from NoteableDiscussion. !27227
- Show disabled project repo mirrors in settings. !27326
- Add backtrace to Gitaly performance bar. !27345
- Moved EE/CE differences for dropdown_value_collapsed into CE. !27367
- Remove "You are already signed in" banner. !27377
- Move ee-specific code from boards/components/issue_card_inner.vue. !27394 (Roman Rodionov)
- Upgrade to Rails 5.1. !27480 (Jasper Maes)
- Update GitLab Runner Helm Chart to 0.4.0. !27508
- Update GitLab Runner Helm Chart to 0.4.1. !27627
- Refactored notes tests from Karma to Jest. !27648 (Martin Hobert)
- refactor(issue): Refactored issue tests from Karma to Jest. !27673 (Martin Hobert)
- Refactored Karma spec files to Jest. !27688 (Martin Hobert)
- Add CSS fix for <wbr> elements on IE11. !27846
- Update clair-local-scan to v2.0.8 for container scanning. !27977
- Use PostgreSQL 10.7 in tests. !28020
- Document EE License Auto Import During Install. !28106
- Remove the note in the docs that multi-line suggestions are not yet available. !28119 (hardysim)
- Update gitlab-shell to v9.1.0. !28184
- Add EE fixtures to SeedFu list. !28241
1578
- Add some frozen string to spec/**/*.rb. (gfyoung)
1579
1580
- Replaces CSS with BS4 utility class for pipeline schedules.
- Creates a vendors folder for external CSS.
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593

### Performance (1 change)

- Add improvements to global search of issues and merge requests. !27817


## 11.10.7 (2019-06-26)

### Fixed (3 changes)

- Remove a default git depth in Pipelines for merge requests. !28926
- Fix label click scrolling to top. !29202
- Fix scrolling to top on assignee change. !29500
1594
1595


1596
1597
## 11.10.8 (2019-06-27)

1598
- No changes.
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
### Security (10 changes)

- Fix Denial of Service for comments when rendering issues/MR comments.
- Gate MR head_pipeline behind read_pipeline ability.
- Fix DoS vulnerability in color validation regex.
- Expose merge requests count based on user access.
- Persist tmp snippet uploads at users.
- Add missing authorizations in GraphQL.
- Disable Rails SQL query cache when applying service templates.
- Prevent Billion Laughs attack.
- Correctly check permissions when creating snippet notes.
- Prevent the detection of merge request templates by unauthorized users.

### Performance (1 change)

- Add improvements to global search of issues and merge requests. !27817


1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
## 11.10.6 (2019-06-04)

### Fixed (7 changes, 1 of them is from the community)

- Allow a member to have an access level equal to parent group. !27913
- Fix uploading of LFS tracked file through UI. !28052
- Use 3-way merge for squashing commits. !28078
- Use a path for the related merge requests endpoint. !28171
- Fix project visibility level validation. !28305 (Peter Marko)
- Fix Rugged get_tree_entries recursive flag not working. !28494
- Use source ref in pipeline webhook. !28772

### Other (1 change)

- Fix input group height.

1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
## 11.10.4 (2019-05-01)

### Fixed (12 changes)

- Fix MR popover on ToDos page. !27382
- Fix 500 in general pipeline settings when passing an invalid build timeout. !27416
- Fix bug where system note MR has no popover. !27589
- Fix bug when project export to remote url fails. !27614
- `on_stop` is not automatically triggered with pipelines for merge requests. !27618
- Update Workhorse to v8.5.2. !27631
- Show proper wiki links in search results. !27634
- Make `CI_COMMIT_REF_NAME` and `SLUG` variable idempotent. !27663
- Fix Kubernetes service template deployment jobs broken as of 11.10.0. !27687
- Prevent text selection when dragging in issue boards. !27724
- Fix pipelines for merge requests does not show pipeline page when source branch is removed. !27803
- Fix Metrics Environments dropdown.

### Performance (2 changes)

- Prevent concurrent execution of PipelineScheduleWorker. !27781
- Fix slow performance with compiling HAML templates. !27782


1656
1657
1658
1659
1660
1661
1662
## 11.10.3 (2019-04-30)

### Security (1 change)

- Allow to see project events only with api scope token.


1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
## 11.10.2 (2019-04-25)

### Security (4 changes)

- Loosen regex for exception sanitization. !3076
- Resolve: moving an issue to private repo leaks namespace and project name.
- Escape path in new merge request mail.
- Stop sending emails to users who can't read commit.


1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
## 11.10.1 (2019-04-23)

### Fixed (2 changes)

- Upgrade Gitaly to 1.34.0. !27494
- Fix filtering of labels from system note link. !27507

### Changed (1 change)

- Disable just-in-time Kubernetes resource creation for project level clusters. !27352

### Performance (1 change)

- Bring back Rugged implementation of ListCommitsByOid. !27441

### Other (1 change)

- Bump required Ruby version check to 2.5.3. !27495


1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
## 11.10.0 (2019-04-22)

### Security (9 changes)

- Update Rails to 5.0.7.2. !27022
- Disallow guest users from accessing Releases.
- Return cached languages if they've been detected before.
- Added rake task for removing EXIF data from existing uploads.
- Disallow updating namespace when updating a project.
- Fix XSS in resolve conflicts form.
- Hide "related branches" when user does not have permission.
- Fix PDF.js vulnerability.
- Use UntrustedRegexp for matching refs policy.

### Fixed (81 changes, 21 of them are from the community)

- Update `border-radius` of form controls and remove extra space above page titles. !24497
- Disallow reopening of a locked merge request. !24882 (Jan Beckmann)
- Align EmailValidator to validate_email gem implementation. !24971 (Horatiu Eugen Vlad)
- add a uniq constraints on issues and mrs labels. !25435 (Antoine Huret)
- Display draft when toggling replies. !25563
- Fix markdown table header and table content borders. !25666
- Fix authorized application count. !25715 (moyuru)
- Added "Add List" checkbox to create label dropdown to make creation of list optional. !25716 (Tucker Chapman)
- Makes emoji picker full width on mobile. !25883 (Jacopo Beschi @jacopo-beschi)
- Don't cutoff letters in MR and Issue links. !25910 (gfyoung)
- Fix unwanted character replacement on project members page caused by usage of sanitize function. !25946 (Elias Werberich)
- Fix UI for closed MR when source project is removed. !25967 (Takuya Noguchi)
- Keep inline as much as possible in system notes on issuable. !25968 (Takuya Noguchi)
- Fixes long review app subdomains. !25990 (walkafwalka)
- Fix counting of groups in admin dashboard. !26009
- Disable inaccessible navigation links upon archiving a project. !26020 (Elias Werberich)
- Fixed - Create project label window is cut off at the bottom. !26049
- Fix error shown when loading links to specific comments. !26092
- Fix group transfer selection possibilities. !26123 (Peter Marko)
- Fix UI layout on Commits on mobile. !26133 (Takuya Noguchi)
- Fix continuous bitbucket import loading spinner. !26175
- Resolves Branch name is lost if I change commit mode in Web IDE. !26180
- Fix removing remote mirror failure which leaves unnecessary refs behind. !26213
- Fix Error 500 when user commits Wiki page with no commit message. !26247
- Handle missing keys in sentry api response. !26264
- Implemented whitespace-trimming for file names in Web IDE. !26270
- Fix misalignment of group overview page buttons. !26292
- Reject HEAD requests to info/refs endpoint. !26334
- Prevent namespace dropdown in new project form from exceeding container. !26343
- Fix hover animation consistency in top navbar items. !26345
- Exclude system notes from commits in merge request discussions. !26396
- Resolve Code in other column of side-by-side diff is highlighted when selecting code on one side. !26423
- Prevent fade out transition on loading-button component. !26428
- Fix merge commits being used as default squash commit messages. !26445
- Expand resolved discussion when linking to a comment in the discussion. !26483
- Show statistics also when repository is disabled. !26509 (Peter Marko)
- Fix multiple series queries on metrics dashboard. !26514
- Releases will now be automatically deleted when deleting corresponding tag. !26530
- Make stylistic improvements to diff nav header. !26557
- Clear pipeline status cache after destruction of pipeline. !26575
- Update fugit which fixes a potential infinite loop. !26579
- Fixes job link in artifacts page breadcrumb. !26592
- Fix quick actions add label name middle word overlaps. !26602 (Jacopo Beschi @jacopo-beschi)
- Fix Auto DevOps missing domain error handling. !26627
- Fix jupyter rendering bug that ended in an infinite loop. !26656 (ROSPARS Benoit)
- Use a fixed git abbrev parameter when we fetch a git revision. !26707
- Enabled text selection highlighting in diffs in Web IDE. !26721 (Isaac Smith)
- Remove `path` and `branch` labels from metrics. !26744
- Resolve "Hide Kubernetes cluster warning if project has cluster related". !26749
- Fix long label overflow on metrics dashboard. !26775
- Group transfer now properly redirects to edit on failure. !26837
- Only execute system hooks once when pushing tags. !26888
- Fix UI anchor links after docs refactor. !26890
- Fix MWPS does not work for merge request pipelines. !26906
- Create pipelines for merge requests only when source branch is updated. !26921
- Fix notfication emails having wrong encoding. !26931
- Allow task lists that follow a blockquote to work correctly. !26937
- Fix image diff swipe view on commit and compare pages. !26968 (ftab)
- Fix IDE detection of MR from fork with same branch name. !26986
- Fix single string values for the 'include' keyword validation of gitlab-ci.yml. !26998 (Paul Bonaud (@paulrbr))
- Do not display Ingress IP help text when there isn’t an Ingress IP assigned. !27057
- Fix real-time updates for projects that contain a reserved word. !27060
- Remove duplicates from issue related merge requests. !27067
- Add to white-space nowrap to all buttons. !27069
- Handle possible HTTP exception for Sentry client. !27080
- Guard against nil dereferenced_target. !27192
- Update GitLab Workhorse to v8.5.1. !27217
- Fix long file header names bug in diffs. !27233
- Always return the deployment in the UpdateDeploymentService#execute method. !27322
- Fix remove_source_branch merge request API handling. !27392
- Fixed bug with hashes in urls in WebIDE. !54376 (Kieran Andrews)
- Fix bug where MR popover doesn't go away on mouse leave.
- Only consider active milestones when using the special Started milestone filter.
- Scroll to diff file content when clicking on file header name and it is not a link to other page.
- Remove non-functional add issue button on welcome list.
- Fixed expand full file button showing on images.
- Fixed Web IDE web workers not working with relative URLs.
- Fixed Web IDE not loading merge request files.
- Fixed duplicated diff too large error message.
- Fixed sticky headers in merge request creation diffs.
- Fix bug when reopening milestone from index page.

### Deprecated (1 change)

- Allow to use untrusted Regexp via feature flag. !26905

### Changed (35 changes, 4 of them are from the community)

- Create MR pipelines with `refs/merge-requests/:iid/head`. !25504
- Create Kubernetes resources for projects when their deployment jobs run. !25586
- Remove unnecessary folder prefix from environment name. !25600
- Update deploy boards to additionally select on "app.gitlab.com" annotations. !25623
- Allow failed custom hook script errors to safely appear in GitLab UI by filtering error messages by the prefix GL-HOOK-ERR:. !25625
- Add link on two-factor authorization settings page to leave group that enforces two-factor authorization. !25731
- Reduce height of instance system header and footer. !25752
- Unify behaviour of 'Copy commit SHA to clipboard' to use full commit SHA. !25829 (Max Winterstein)
- Show loading spinner while Ingress/Knative IP is being assigned. !25912
- Hashed Storage: Prevent a migration and rollback running at the same time. !25976
- Make time counters show 'just now' for everything under one minute. !25992 (Sergiu Marton)
- Allow filtering labels list by one or two characters. !26012
- Implements the creation strategy for multi-line suggestions. !26057
- Automate base domain help text on Clusters page. !26124
- Set user.name limit to 128 characters. !26146
- Update gitlab-markup to 1.7.0 which requies python3. !26246
- Update system message banner font size to 12px. !26293
- Extend timezone dropdown. !26311
- Upgrade to Gitaly v1.29.0. !26406
- Automatically set Prometheus step interval. !26441
- Knative version bump 0.2.2 -> 0.3.0. !26459 (Chris Baumbauer)
- Display cluster form validation error messages inline. !26502
- Split Auto-DevOps.gitlab-ci.yml into reusable templates. !26520
- Update spinners in group list component. !26572
- Allow removing last owner from subgroup if parent group has owners. !26718
- Check mergeability in MergeToRefService. !26757
- Show download diff links for closed MRs. !26772
- Fix Container Scanning in Kubernetes Runners. !26793
- Move "Authorize project access with external service" to Core. !26823
- Localize notifications dropdown. !26844
- Order labels alphabetically in issue boards. !26927
- Upgrade to Gitaly v1.32.0. !26989
- Upgrade to Gitaly v1.33.0. !27065
- collapse file tree by default if the merge request changes only one file. (Riccardo Padovani <riccardo@rpadovani.com>)
- Removes the undescriptive CI Charts header.

### Performance (17 changes)

- Drop legacy artifacts usage as there are no leftovers. !24294
- Cache Repository#root_ref within a request. !25903
- Allow ref name caching CommitService#find_commit. !26248
- Avoid loading pipeline status in project search. !26342
- Fix some N+1s in loading routes and counting members for groups in @-autocomplete. !26491
- GitHub import: Run housekeeping after initial import. !26600
- Add initial complexity limits to GraphQL queries. !26629
- Cache FindCommit results in pipelines view. !26776
- Fix and expand Gitaly FindCommit caching. !27018
- Enable FindCommit caching for project and commits pages. !27048
- Expand FindCommit caching to blob and refs. !27084
- Enable Gitaly FindCommit caching for TreeController. !27100
- Improve performance of PR import. !27121
- Process at most 4 pipelines during push. !27205
- Disable method instrumentation for diffs. !27235
- Speed up filtering issues in a project when searching.
- Speed up generation of avatar URLs when using object storage.

### Added (35 changes, 6 of them are from the community)

- Add users search results to global search. !21197 (Alexis Reigel)
- Add target branch filter to merge requests search bar. !24380 (Hiroyuki Sato)
- Add Knative metrics to Prometheus. !24663 (Chris Baumbauer <cab@cabnetworks.net>)
- Support multi-line suggestions. !25211
- Allow to sort wiki pages by date and title. !25365
- Allow external diffs to be used conditionally. !25432
- Add usage counts for error tracking feature. !25472
- Enable/disable Auto DevOps at the Group level. !25533
- Update pipeline list view to accommodate post-merge pipeline information. !25690
- GraphQL Types can be made to always authorize access to resources of that Type. !25724
- Update clair-local-scan to 2.0.6. !25743 (Takuya Noguchi)
- Update pipeline block on merge request page to accommodate post-merge pipeline information. !25745
- Support multiple queries per chart on metrics dash. !25758
- Update pipeline detail view to accommodate post-merge pipelines. !25775
- Update job detail sidebar to accommodate post-merge pipeline information. !25777
- Add merge request pipeline flag to pipeline entity. !25846
- Expose group id on home panel. !25897 (Peter Marko)
- Move allow developers to create projects in groups to Core. !25975
- Add two new warning messages to the MR widget about merge request pipelines. !25983
- Support installing Group runner on group-level cluster. !26260
- Improve the Knative installation on Clusters. !26339
- Show error when namespace/svc account missing. !26362
- Add select by title to milestones API. !26573
- Implemented support for creation of new files from URL in Web IDE. !26622
- Add control for masking variable values in runner logs. !26751
- Allow merge requests to be created via git push options. !26752
- Create a shortcut for a new MR in the Web IDE. !26792
- Allow reactive caching to be used in services. !26839
- Add a Prometheus API per environment. !26841
- Allow merge requests to be set to merge when pipeline succeeds via git push options. !26842
- Use gitlabktl to build and deploy GitLab Serverless Functions. !26926
- Make touch events work on image diff swipe view and onion skin. !26971 (ftab)
- Add extended merge request tooltip.
- Added prometheus monitoring to GraphQL.
- Adding highest role property to admin's user details page.

### Other (29 changes, 6 of them are from the community)

- Update rack-oauth2 1.2.1 -> 1.9.3. !17868
- Merge the gitlab-shell "gitlab-keys" functionality into GitLab CE. !25598
- Refactor all_pipelines in Merge request. !25676
- Show error backtrace when logging errors to kubernetes.log. !25726
- Apply recaptcha API change in 4.0. !25921 (Praveen Arimbrathodiyil)
- Remove fake repository_path response. !25942 (Fabio Papa)
- Use curl silent/show-error options on Auto DevOps. !25954 (Takuya Noguchi)
- Explicitly set master_auth setting to enable basic auth and client certificate for new GKE clusters. !26018
- Project: Improve empty repository state UI. !26024
- Externalize strings from `/app/views/projects/pipelines`. !26035 (George Tsiolis)
- Prepare multi-line suggestions for rendering in Markdown. !26107
- Improve mobile UI on User Profile page. !26240 (Takuya Noguchi)
- Update GitLab Runner Helm Chart to 0.3.0/11.9.0. !26467
- Improve project merge request settings. !26495
- Bump kubectl to 1.11.9 and Helm to 2.13.1 in Auto-DevOps.gitlab-ci.yml. !26534
- Upgrade bootstrap_form Gem. !26568
- Add API access check to Graphql. !26570
- Change project avatar remove button to a link. !26589
- Log Gitaly RPC duration to api_json.log and production_json.log. !26652
- Add cluster domain to Project Cluster API. !26735
- Move project tags to separate line. !26797
- Changed button label at /pipelines/new. !26893 (antfobe,leonardofl)
- Update GitLab Shell to v9.0.0. !27002
- Migrate clusters tests to jest. !27013
- Rewrite related MRs widget with Vue. !27027
- Restore HipChat project service. !27172
- Externalize admin deploy keys strings.
- Removes EE differences for environments_table.vue.
- Removes EE differences for environment_item.vue.


1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
## 11.9.12 (2019-05-30)

### Security (12 changes, 1 of them is from the community)

- Protect Gitlab::HTTP against DNS rebinding attack.
- Fix project visibility level validation. (Peter Marko)
- Update Knative version.
- Add DNS rebinding protection settings.
- Prevent XSS injection in note imports.
- Prevent invalid branch for merge request.
- Filter relative links in wiki for XSS.
- Fix confidential issue label disclosure on milestone view.
- Fix url redaction for issue links.
- Resolve: Milestones leaked via search API.
- Prevent bypass of restriction disabling web password sign in.
- Hide confidential issue title on unsubscribe for anonymous users.


1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
## 11.9.10 (2019-04-26)

### Security (5 changes)

- Loosen regex for exception sanitization. !3077
- Resolve: moving an issue to private repo leaks namespace and project name.
- Escape path in new merge request mail.
- Stop sending emails to users who can't read commit.
- Upgrade Rails to 5.0.7.2.


1953
1954
1955
1956
1957
1958
1959
## 11.9.9 (2019-04-23)

### Performance (1 change)

- Bring back Rugged implementation of ListCommitsByOid. !27441


1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
## 11.9.8 (2019-04-11)

### Deprecated (1 change)

- Allow to use untrusted Regexp via feature flag. !26905

### Performance (2 changes)

- Improve performance of PR import. !27121
- Disable method instrumentation for diffs. !27235

### Other (1 change)

- Restore HipChat project service. !27172


1976
1977
1978
1979
## 11.9.7 (2019-04-09)

- No changes.

1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
## 11.9.6 (2019-04-04)

### Fixed (3 changes)

- Force to recreate all MR diffs on import. !26480
- Fix API /project/:id/branches not returning correct merge status. !26785
- Avoid excessive recursive calls with Rugged TreeEntries. !26813

### Performance (1 change)

- Force a full GC after importing a project. !26803


1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
## 11.9.5 (2019-04-03)

### Fixed (3 changes)

- Force to recreate all MR diffs on import. !26480
- Fix API /project/:id/branches not returning correct merge status. !26785
- Avoid excessive recursive calls with Rugged TreeEntries. !26813

### Performance (1 change)

- Force a full GC after importing a project. !26803


2006
2007
## 11.9.3 (2019-03-27)

2008
- No changes.
2009

2010
2011
## 11.9.2 (2019-03-26)

2012
- No changes.
2013

2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
## 11.9.1 (2019-03-25)

### Fixed (7 changes)

- Fix issue that caused the "Show all activity" button to appear on top of the mini pipeline status dropdown on the merge request page. !26274
- Fix duplicated bottom match line on merge request parallel diff view. !26402
- Allow users who can push to protected branches to create protected branches via CLI. !26413
- Add missing .gitlab-ci.yml to Android template. !26415
- Refresh commit count after repository head changes. !26473
- Set proper default-branch for repository on GitHub Import. !26476
- GitHub importer: Use the project creator to create branches from forks. !26510

### Changed (1 change)

- Upgrade to Gitaly v1.27.1. !26533


2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
## 11.9.0 (2019-03-22)

### Security (24 changes)

- Use encrypted runner tokens. !25532
- Stop linking to unrecognized package sources. !55518
- Disable issue boards API when issues are disabled.
- Forbid creating discussions for users with restricted access.
- Fix leaking private repository information in API.
- Fixed ability to see private groups by users not belonging to given group.
Yoginth's avatar
Yoginth committed
2041
- Prevent releases links API to leak tag existence.
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
- Display the correct number of MRs a user has access to.
- Block local URLs for Kubernetes integration.
- Fix arbitrary file read via diffs during import.
- Check if desired milestone for an issue is available.
- Don't allow non-members to see private related MRs.
- Check snippet attached file to be moved is within designated directory.
- Fix blind SSRF in Prometheus integration by checking URL before querying.
- Fix git clone revealing private repo's presence.
- Remove project serialization in quick actions response.
- Don't show new issue link after move when a user does not have permissions.
- Limit mermaid rendering to 5K characters.
- Show only merge requests visible to user on milestone detail page.
- Display only information visible to current user on the Milestone page.
- Do not display impersonated sessions under active sessions and remove ability to revoke session.
- Validate session key when authorizing with GCP to create a cluster.
- Do not disclose milestone titles for unauthorized users.
- Remove the possibility to share a project with a group that a user is not a member of.

### Removed (1 change)

- Remove HipChat integration from GitLab. !22223

### Fixed (86 changes, 21 of them are from the community)

- Fixes issue with AWS V4 signatures not working with some S3 providers. !21788
- Validate 'include' keywords in gitlab-ci.yml configuration files. !24098 (Paul Bonaud)
- Close More Actions tooltip when menu opens. !24285
- API: Support Jira transition ID as string. !24400 (Robert Schilling)
- Fixed navigation sidebar flashing open on page load. !24555
- Fix username escaping when using assign to me for issues. !24673
- commit page info-well overflow fix #56436. !24799 (Gokhan Apaydin)
- Fix error tracking list page. !24806
- Fix overlapping empty-header logo. !24868 (Jonas L.)
- Resolve Jobs tab border top in pipeline's page is 1px off. !24878
- Require maintainer access to show pages domain settings. !24926
- Display error message when API call to list Sentry issues fails. !24936
- Fix rollout status for statefulsets and daemonsets. !24972 (Sergej Nikolaev <kinolaev@gmail.com>)
- Display job names consistently on pipelines and environments list. !24984
- Update new password breadcrumb. !25037 (George Tsiolis)
- Fixes functions finder for upgraded Knative app. !25067
- Provide expires_in in LFS authentication payload. !25082
- Fix validation of certain ed25519 keys. !25115 (Merlijn B. W. Wajer)
- Timer and action name aligned vertically for delayed jobs in pipeline actions. !25117 (Gokhan Apaydin)
- Fix the border style of CONTRIBUTING button when it exists. !25124 (Takuya Noguchi)
- Change badges.svg example to pipeline.svg. !25157 (Aviad Levy)
- API: Fix docs and parameters for hangouts-chat service. !25180 (Robert Schilling)
- API: Expose full commit title. !25189 (Robert Schilling)
- API: Require only one parameter when updating a wiki. !25191 (Robert Schilling)
- Hide pipeline status when pipelines are disabled on project. !25204
- Fix alignment of dropdown icon on issuable on mobile. !25205 (Takuya Noguchi)
- Add left margin to 1st time contributor badge. !25216 (Gokhan Apaydin)
- Use limited counter for runner build count in admin page. !25220
- API: Ensure that related merge requests are referenced cross-project. !25222 (Robert Schilling)
- Ensure the base pipeline of a Merge Request belongs to its target branch. !25226
- Fix import_jid error on project import. !25239
- Fix commenting on commits having SHA1 starting with a large number. !25278
- Allow empty values such as [] to be stored in reactive cache. !25283
- Remove vertical connecting line placeholder from diff discussion notes. !25292
- Fix hover and active state colors of award emoji button. !25295
- Fix author layouts in issuable meta line UIs on mobile. !25332 (Takuya Noguchi)
- Fix bug where project topics truncate. !25398
- Fix ETag caching not being used for AJAX requests. !25400
- Doc - fix the url of pipeline status badge. !25404 (Aviad Levy)
- Fix pipeline status icon mismatch. !25407
- Allow users to compare branches on a read-only instance. !25414
- Fix 404s when C++ .gitignore template selected. !25416
- Always fetch MR latest version when creating suggestions. !25441
- Only show borders for markdown images in notes. !25448
- Bring back Rugged implementation of find_commit. !25477
- Remove duplicate units from metrics graph. !25485
- Fix project import error importing releases. !25495
- Remove duplicate XHR request when requesting new pipeline page. !25506
- Properly handle multiple X-Forwarded-For addresses in runner IP. !25511
- Fix weekday shift in issue board cards for UTC+X timezones by removing local timezone to UTC conversion. !25512 (Elias Werberich)
- Fix large table horizontal scroll and prevent side-by-side tables. !25520 (Dany Jupille)
- Fix error when viewing group issue boards when user doesn't have explicit group permissions. !25524
- Respect the should_remove_source_branch parameter to the merge API. !25525
- Externalize markdown toolbar buttons tooltips. !25529
- Fix method to mark a project repository as writable. !25546
- fix group without owner after transfer. !25573 (Peter Marko)
- Fix pagination and duplicate requests in environments page. !25582
- Improve the JS pagination to handle the case when the `X-Total` and `X-Total-Pages` headers aren't present. !25601
- Add right padding to the repository mirror action buttons. !25606
- Use 'folder-open' from sprite icons for Browse Files button in Tag page. !25635
- Make merge to refs/merge-requests/:iid/merge not raise when FF-only enabled. !25653
- Fixed "Copying comment with ordered list includes extraneous newlines". !25695
- Fix bridge jobs only/except variables policy. !25710
- Allow GraphQL requests without CSRF token. !25719
- Skip Project validation during Hashed Storage migration or rollback. !25753
- Resolve showing squash commit edit issue when only single commit is present. !25807
- Fix the last-ditch memory killer pgroup SIGKILL. !25940
- Disable timeout on merge request merging poll. !25988
- Allow modifying squash commit message for fast-forward only merge method. !26017
- Fix bug in BitBucket imports with SHA shorter than 40 chars. !26050
- Fix health checks not working behind load balancers. !26055
- Fix 500 error caused by CODEOWNERS with no matches. !26072
- Fix notes being marked as edited after resolving. !26143
- Fix error creating a merge request when diff includes a null byte. !26190
- Fix undefined variable error on json project views. !26297
- GitHub import: Create new branches as project owner. !26335
- Gracefully handles excluded fields from attributes during serialization on JsonCache. !26368
- Admin section finds users case-insensitively.
- Fixes not working dropdowns in pipelines page.
- Do not show file templates when creating a new directory in WebIDE.
- Allow project members to see private group if the project is in the group namespace.
- Allow maintainers to remove pages.
- Fix inconsistent pagination styles.
- Fixed blob editor deleting file content for certain file paths.
- Fix upcoming milestone when there are milestones with far-future due dates.
- Fixed alignment of changed icon in Web IDE.

### Changed (31 changes, 10 of them are from the community)

- Improve snippets empty state. !18348 (George Tsiolis)
- Remove second primary button on wiki edit. !19959 (George Tsiolis)
- Allow raw `tls_options` to be passed in LDAP configuration. !20678
- Remove undigested token column from personal_access_tokens table from the database. !22743
- Update activity filter for issues. !23423 (George Tsiolis)
- Use auto-build-image for build job in Auto-DevOps.gitlab-ci.yml. !24279
- Error tracking configuration - add a Sentry project selection dropdown. !24701
- Move ChatOps to Core. !24780
- Implement new arguments `state`, `closed_before` and `closed_after` for `IssuesResolver` in GraphQL. !24910
- Validate kubernetes cluster CA certificate. !24990
- Review App Link to Changed Page if Only One Change Present. !25048
- Show pipeline ID, commit, and branch name on modal while stopping pipeline. !25059
- Improve empty state for starred projects. !25138
- Capture due date when importing milestones from Github. !25182 (dstanley)
- Add a spinner icon which is rendered using pure css. !25186
- Make emoji picker bigger. !25187 (Jacopo Beschi @jacopo-beschi)
- API: Sort tie breaker with id DESC. !25311 (Nermin Vehabovic)
- Add iOS-fastlane template for .gitlab-ci.yml. !25395
- Move language setting to preferences. !25427 (Fabian Schneider @fabsrc)
- Resolve Create Project Template for Netlify. !25453
- Sort labels alphabetically on issues and merge requests list. !25470
- Add Project template for .NET Core. !25486
- Update operations settings breadcrumb trail. !25539 (George Tsiolis)
- Add Project template for go-micro. !25553
- Jira: make issue links title compact. !25609 (Elan Ruusamäe @glensc)
- Project level filtering for JupyterHub. !25684 (Amit Rathi (amit1rrr))
- Clean up vendored templates. !25794
- Mask all TOKEN and PASSWORD CI variables. !25868
- Add project template for Android. !25870
- Add iOS project template. !25872
- Upgrade to Gitaly v1.26.0. !25890

### Performance (11 changes)

- Improve performance for diverging commit counts. !24287
- Optimize Redis usage in User::ActivityService. !25005
- Only load syntax highlight CSS of selected theme. !25232
- Improve label select rendering. !25281
- Enable persisted pipeline stages by default. !25347
- Speed up group issue search counts. !25411
- Load repository language from the database if detected before. !25518
- Remove N+1 query for tags in /admin/runners page. !25572
- Eliminate most N+1 queries loading UserController#calendar_activities. !25697
- Improve Web IDE launch performance. !25700
- Significantly reduce N+1 queries in /api/v4/todos endpoint. !25711

### Added (55 changes, 18 of them are from the community)

- Add a tag filter to the admin runners view. !19740 (Alexis Reigel)
- Add project fetch statistics. !23596 (Jacopo Beschi @jacopo-beschi)
- Hashed Storage rollback mechanism. !23955
- Allow to recursively expand includes. !24356
- Allow expanding a diff to display full file. !24406
- Support `only: changes:` on MR pipelines. !24490 (Hiroyuki Sato)
- Expose additional merge request pipeline variables. !24595 (Hiroyuki Sato)
- Add metadata about the GitLab server to GraphQL. !24636
- Support merge ref writing (without merging to target branch). !24692
- Add field mergeRequests for project in GraphQL. !24805
- API support for MR merge to temporary merge ref path. !24918
- Ability to filter confidential issues. !24960 (Robert Schilling)
- Allow creation of branches that match a wildcard protection, except directly through git. !24969
- Add related merge request count to api response. !24974
- Add realtime validation for user fullname and username on validation. !25017 (Ehsan Abdulqader @EhsanZ)
- Allow setting feature flags per GitLab group through the API. !25022
- Add API endpoint to get a commit's GPG signature. !25032
- Add support for FTP assets for releases. !25071 (Robert Schilling)
- Add Confirmation Modal to Rollback on Environment. !25110
- add title attribute to display file name. !25154 (Satoshi Nakamatsu @satoshicano)
- API: Expose text_color for project and group labels. !25172 (Robert Schilling)
- Added support for ingress hostnames. !25181 (walkafwalka)
- API: Promote project milestone to a group milestone. !25203 (Nermin Vehabovic)
- API: Expose if the current user can merge a MR. !25207 (Robert Schilling)
- add readme to changelogs directory. !25209 (@glensc)
- API: Indicate if label is a project label. !25219 (Robert Schilling)
- Expose refspecs and depth to runner. !25233
- Port System Header and Footer feature to Core. !25241
- Sort Environments by Last Updated. !25260
- Accept force option to overwrite branch on commit via API. !25286
- Add support for masking CI variables. !25293
- Add Link from Closed (moved) Issues to Moved Issue. !25300
- Next/previous navigation between files in MR review. !25355
- Add YouTrack integration service. !25361 (Yauhen Kotau @bessorion)
- Add ability to set path and name for project on fork using API. !25363
- Add project level config for merge pipelines. !25385
- Edit Knative domain after it has been deployed. !25386
- Add zoom and scroll to metrics dashboard. !25388
- Persist source sha and target sha for merge pipelines. !25417
- Add support for toggling discussion filter from notes section. !25426
- Resolve Move files in the Web IDE. !25431
- Show header and footer system messages in email. !25474
- Allow configuring POSTGRES_VERSION in Auto DevOps. !25500
- Add Saturday to Localization first day of the week. !25509 (Ahmad Haghighi)
- Extend the Gitlab API for deletion of job_artifacts of a single job. !25522 (rroger)
- Simplify CI/CD configuration on serverless projects. !25523
- Add button to start discussion from single comment. !25575
- sidekiq: terminate child processes at shutdown. !25669
- Expose merge request entity for pipelines. !25679
- Link to most recent MR from a branch. !25689
- Adds Auto DevOps build job for tags. !25718 (walkafwalka)
- Allow all snippets to be accessed by API. !25772
- Make file tree in merge requests resizable.
- Make the Web IDE the default editor.
- File uploads are deleted asynchronously when deleting a project or group.

### Other (28 changes, 6 of them are from the community)

- Improve GitHub and Gitea project import table UI. !24606
- Externalize strings from `/app/views/projects/commit`. !24668 (George Tsiolis)
- Correct non-standard unicode spaces to regular unicode. !24795 (Marcel Amirault)
- Provide a performance bar link to the Jaeger UI. !24902
- Remove BATCH_SIZE from WikiFileFinder. !24933
- Use export-import svgs from gitlab-svgs. !24954
- Fix N+1 query in Issues and MergeRequest API when issuable_metadata is present. !25042 (Alex Koval)
- Directly inheriting from ActiveRecord::Migration is deprecated. !25066 (Jasper Maes)
- Bump Helm and kubectl in Auto DevOps to 2.12.3 and 1.11.7 respectively. !25072
- Log queue duration in production_json.log. !25075
- Extracted ResolveWithIssueButton to its own component. !25093 (Martin Hobert)
- Add rectangular project and group avatars. !25098
- Include note in the Rails filter_parameters configuration. !25238
- Bump Helm and kubectl used in Kubernetes integration to 2.12.3 and 1.11.7 respectively. !25268
- Include gl_project_path in API /internal/allowed response. !25314
- Fix incorrect Pages Domains checkbox description. !25392 (Anton Melser)
- Update GitLab Runner Helm Chart to 0.2.0. !25493
- Add suffix (`_event`) to merge request source. !25508
- Creates a helper function to check if repo is EE. !25647
- If chpst is available, make fron-source installations run sidekiq as a process group leader. !25654
- Bring back Rugged implementation of GetTreeEntries. !25674
- Moves EE util into the CE file. !25680
- Bring back Rugged implementation of CommitIsAncestor. !25702
- Bring back Rugged implementation of TreeEntry. !25706
- Enable syntax highlighting to other supported markups. !25761
- Update GitLab Shell to v8.7.1. !25801
- Bring back Rugged implementation of commit_tree_entry. !25896
- Removes EE differences for jobs/getters.js.


2291
2292
2293
2294
2295
2296
2297
## 11.8.10 (2019-04-30)

### Security (1 change)

- Allow to see project events only with api scope token.


2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
## 11.8.8 (2019-04-23)

### Fixed (5 changes)

- Bring back Rugged implementation of find_commit. !25477
- Fix bug in BitBucket imports with SHA shorter than 40 chars. !26050
- Fix health checks not working behind load balancers. !26055
- Fix error creating a merge request when diff includes a null byte. !26190
- Avoid excessive recursive calls with Rugged TreeEntries. !26813

### Performance (1 change)

- Bring back Rugged implementation of ListCommitsByOid. !27441

### Other (4 changes)

- Bring back Rugged implementation of GetTreeEntries. !25674
- Bring back Rugged implementation of CommitIsAncestor. !25702
- Bring back Rugged implementation of TreeEntry. !25706
- Bring back Rugged implementation of commit_tree_entry. !25896


2320
2321
2322
2323
2324
2325
2326
## 11.8.3 (2019-03-19)

### Security (1 change)

- Remove project serialization in quick actions response.


2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
## 11.8.2 (2019-03-13)

### Security (1 change)

- Fixed ability to see private groups by users not belonging to given group.

### Fixed (5 changes)

- Fix import_jid error on project import. !25239
- Properly handle multiple X-Forwarded-For addresses in runner IP. !25511
- Fix error when viewing group issue boards when user doesn't have explicit group permissions. !25524
- Fix method to mark a project repository as writable. !25546
- Allow project members to see private group if the project is in the group namespace.


2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
## 11.8.0 (2019-02-22)

### Security (7 changes, 1 of them is from the community)

- Sanitize user full name to clean up any URL to prevent mail clients from auto-linking URLs. !2793
- Update Helm to 2.12.2 to address Helm client vulnerability. !24418 (Takuya Noguchi)
- Use sanitized user status message for user popover.
- Validate bundle files before unpacking them.
- Alias GitHub and BitBucket OAuth2 callback URLs.
- Fixed XSS content in KaTex links.
- Disallows unauthorized users from accessing the pipelines section.

### Removed (2 changes, 1 of them is from the community)

- Removed deprecated Redcarpet markdown engine.
- Remove Cancel all jobs button in general jobs list view. (Jordi Llull)

### Fixed (84 changes, 20 of them are from the community)

- Fix ambiguous brackets in task lists. !18514 (Jared Deckard <jared.deckard@gmail.com>)
- Fix lost line number when navigating to a specific line in a protected file before authenticating. !19165 (Scott Escue)
- Fix suboptimal handling of checkbox and radio input events causing group general settings submit button to stay disabled after changing its visibility. !23022
- Fix upcoming milestones filter not including group milestones. !23098 (Heinrich Lee Yu)
- Update runner admin page to make description field larger. !23593 (Sascha Reynolds)
- Fix Bitbucket Server import not allowing personal projects. !23601
- Fix bug causing repository mirror settings UI to break. !23712
- Fix foreground color for labels to ensure consistency of label appearance. !23873 (Nathan Friend)
- Resolve In Merge Request diff screen, master is not a hyperlink. !23874
- Show the correct error page when access is denied. !23932
- Increase reliability and performance of toggling task items. !23938
- Modify file restore to rectify tar issue. !24000
- Fix default visibility_level for new projects. !24120 (Fabian Schneider @fabsrc)
- Footnotes now render properly in markdown. !24168
- Emoji and cancel button are taller than input in set user status modal. !24173 (Dhiraj Bodicherla)
- Adjusts duplicated line when commenting on unfolded diff lines (in the bottom). !24201
- Adjust height of "Add list" dropdown in issue boards. !24227
- Improves restriction of multiple Kubernetes clusters through API. !24251
- Fix files/blob api endpoints content disposition. !24267
- Cleanup stale +deleted repo paths on project removal (adjusts project removal bug). !24269
- Handle regular job dependencies next to parallelized job dependencies. !24273
- Proper align Projects dropdown on issue boards page. !24277 (Johann Hubert Sonntagbauer)
- Resolve When merging an MR, the squash checkbox isnt always supported. !24296
- Fix Bitbucket Server importer error handling. !24343
- Fix syntax highlighting for suggested changes preview. !24358
- API: Support dots in wiki slugs. !24383 (Robert Schilling)
- Show CI artifact file size with 3 significant digits on 'browse job artifacts' page. !24387
- API: Support username with dots. !24395 (Robert Schilling)
- API: Fix default_branch_protection admin setting. !24398 (Robert Schilling)
- Remove unwanted margin above suggested changes. !24419
- Prevent checking protected_ref? for ambiguous refs. !24437
- Update metrics environment dropdown to show complete option set. !24441
- Fix empty labels of CI builds for gitlab-pages on pipeline page. !24451
- Do not run spam checks on confidential issues. !24453
- Upgrade KaTeX to version 0.10.0. !24478 (Andrew Harmon)
- Avoid overwriting default jaeger values with nil. !24482
- Display SAML failure messages instead of expecting CSRF token. !24509
- Adjust vertical alignment for project visibility icons. !24511 (Martin Hobert)
- Load initUserInternalRegexPlaceholder only when required. !24522
Yoginth's avatar
Yoginth committed
2400
- Hashed Storage: `AfterRenameService` was receiving the wrong `old_path` under some circumstances. !24526
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
- Resolve Runners IPv6 address overlaps other values. !24531
- Fix 404s with snippet uploads in object storage. !24550
- Fixed oversized custom project notification selector dropdown. !24557
- Allow users with full private access to read private personal snippets. !24560
- Resolve Pipeline stages job action button icon is not aligned. !24577
- Fix cluster page non-interactive on form validation error. !24583
- Fix 404s for snippet uploads when relative URL root used. !24588
- Fix markdown table border. !24601
- Fix CSS grid on a new Project/Group Milestone. !24614 (Takuya Noguchi)
- Prevent unload when Recaptcha is open. !24625
- Clean up unicorn sampler metric labels. !24626 (bjk-gitlab)
- Support bamboo api polymorphism. !24680 (Alex Lossent)
- Ensure Cert Manager works with Auto DevOps URLs greater than 64 bytes. !24683
- Fix failed LDAP logins when nil user_id present. !24749
- fix display comment avatars issue in IE 11. !24777 (Gokhan Apaydin)
- Fix template labels not being created on new projects. !24803
- Fix cluster installation processing spinner. !24814
- Append prioritized label before pagination. !24815
- Resolve UI bug adding group members with lower permissions. !24820
- Make `ActionController::Parameters` serializable for sidekiq jobs. !24864
- Fix Jira Service password validation on project integration services. !24896 (Daniel Juarez)
- Fix potential Addressable::URI::InvalidURIError. !24908
- Update Workhorse to v8.2.0. !24909
- Encode Content-Disposition filenames. !24919
- Avoid race conditions when creating GpgSignature. !24939
- Create the source branch for a GitHub import. !25064
- Fix suggested changes syntax highlighting. !25116
- Fix counts in milestones dashboard. !25230
- Fixes incorrect TLD validation errors for Kubernetes cluster domain. !25262
- Fix 403 errors when adding an assignee list in project boards. !25263
- Prevent Auto DevOps from trying to deploy without a domain name. !25308
- Fix uninitialized constant with GitLab Pages.
- Increase line height of project summaries. (gfyoung)
- Remove extra space between MR tab bar and sticky file headers.
- Correct spacing for comparison page.
- Update CI YAML param table with include.
- Return bottom border on MR Tabs.
- Fixes z-index and margins of archived alert in job page.
Yoginth's avatar
Yoginth committed
2439
- Fixes archived sticky top bar without performance bar.
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482
2483
2484
2485
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550
2551
2552
2553
2554
2555
2556
2557
2558
2559
2560
2561
2562
2563
2564
2565
2566
2567
2568
2569
2570
2571
2572
2573
2574
2575
2576
2577
2578
2579
2580
2581
2582
2583
2584
2585
2586
2587
2588
- Fixed rebase button not showing in merge request widget.
- Fixed double tooltips on note awards buttons.
- Allow suggestions to be copied and pasted as GFM.
- Fix bug that caused Suggestion Markdown toolbar button to insert snippet with leading +/-/<space>.
- Moved primary button for labels to follow the design patterns used on rest of the site. (Martin Hobert)

### Changed (37 changes, 11 of them are from the community)

- Change spawning of tooltips to be top by default. !21223
- Standardize filter value capitlization in filter bar in both issues and boards pages. !23846 (obahareth)
- Refresh group overview to match project overview. !23866
- Build number does not need to be tweaked anymore for the TeamCity integration to work properly. !23898
- Added empty project illustration and updated text to user profile overview. !23973 (Fernando Arias)
- Modified Knative list view to provide more details. !24072 (Chris Baumbauer)
- Move cancel & new issue button on job page. !24074
- Make issuable empty states actionable. !24077
- Fix code search when text is larger than max gRPC message size. !24111
- Update string structure for available group runners. !24187 (George Tsiolis)
- Remove multilingual translation from the word "in" in the job details sidebar. !24192 (Nathan Friend)
- Fix duplicate project disk path in BackfillLegacyProjectRepositories. !24213
- Ensured links to a comment or system note anchor resolves to the right note if a user has a discussion filter. !24228
- Remove expansion hover animation from pipeline status icon buttons. !24268 (Nathan Friend)
- Redesigned related merge requests in issue page. !24270
- Return the maximum group access level in the projects API. !24403
- Update project topics styling to use badges design. !24415
- Display "commented" only for commit discussions on merge requests. !24427
- Upgrade js-regex gem to version 3.1. !24433 (rroger)
- Prevent Sidekiq arguments over 10 KB in size from being logged to JSON. !24493
- Added Avatar in the settings sidebar. !24515 (Yoginth)
- Refresh empty states for profile page tabs. !24549
- remove red/green colors from diff view of no-color syntax theme. !24582 (khm)
- Get remote IP address of runner. !24624
- Update last_activity_on for Users on some main GET endpoints. !24642
- Update metrics dashboard graph design. !24653
- Update to GitLab SVG icon from Font Awesome in profile for location and work. !24671 (Yoginth)
- Add template for Android with Fastlane. !24722
- Display timestamps to messages printed by gitlab:backup:restore rake tasks. (Will Chandler)
- Show MR statistics in diff comparisons.
- Make possible to toggle file tree while scrolling through diffs.
- Use delete instead of remove when referring to `git branch -D`.
- Add folder header to files in merge request tree list.
- Added fuzzy file finder to merge requests.
- Collapse directory structure in merge request file tree.
- Adds skeleton loading to releases page.
- Support multiple outputs in jupyter notebooks.

### Performance (8 changes, 1 of them is from the community)

- Remove unused button classes `btn-create` and `comment-btn`. !23232 (George Tsiolis)
- [API] Omit `X-Total` and `X-Total-Pages` headers when items count is more than 10,000. !23931
- Improve efficiency of GitHub importer by reducing amount of locks needed. !24102
- Improve milestone queries using subqueries instead of separate queries for ids. !24325
- Efficiently remove expired artifacts in `ExpireBuildArtifactsWorker`. !24450
- Eliminate N+1 queries in /api/groups/:id. !24513
- Use deployment relation to get an environment name. !24890
- Do not reload daemon if configuration file of pages does not change.

### Added (35 changes, 18 of them are from the community)

- Add badge count to projects. !18425 (George Tsiolis)
- API: Add support for group labels. !21368 (Robert Schilling)
- Add setting for first day of the week. !22755 (Fabian Schneider @fabsrc)
- Pages for subgroups. !23505
- Add support for customer provided encryption keys for Amazon S3 remote backups. !23797 (Pepijn Van Eeckhoudt)
- Add Knative detailed view. !23863 (Chris Baumbauer)
- Add group full path to project's shared_with_groups. !24052 (Mathieu Parent)
- Added feature to specify a custom Auto DevOps chart repository. !24162 (walkafwalka)
- Add flat-square badge style. !24172 (Fabian Schneider @fabsrc)
- Display last activity and created at datetimes for users. !24181
- Allow setting of feature gates per project. !24184
- Save issues/merge request sorting options to backend. !24198
- Added support for custom hosts/domains to Auto DevOps. !24248 (walkafwalka)
- Adds milestone search. !24265 (Jacopo Beschi @jacopo-beschi)
- Allow merge request diffs to be placed into an object store. !24276
- Add Container Registry API with cleanup function. !24303
- GitLab now supports the profile and email scopes from OpenID Connect. !24335 (Goten Xiao)
- Add 'in' filter that modifies scope of 'search' filter to issues and merge requests API. !24350 (Hiroyuki Sato)
- Add `with_programming_language` filter for projects to API. !24377 (Dylan MacKenzie)
- API: Support searching for tags. !24385 (Robert Schilling)
- Document graphicsmagick installation for source installation. !24404 (Alexis Reigel)
- Redirect GET projects/:id to project page. !24467
- Indicate on Issue Status if an Issue was Moved. !24470
- Redeploy Auto DevOps deployment on variable updates. !24498 (walkafwalka)
- Don't create new merge request pipeline without commits. !24503 (Hiroyuki Sato)
- Add GitLab Pages predefined CI variables 'CI_PAGES_DOMAIN' and 'CI_PAGES_URL'. !24504 (Adrian Moisey)
- Moves domain setting from Auto DevOps to Cluster's page. !24580
- API allows setting the squash commit message when squashing a merge request. !24784
- Added ability to upgrade cluster applications. !24789
- Add argument iids for issues in GraphQL. !24802
- Add repositories count to usage ping data. !24823
- Add support for extensionless pages URLs. !24876
- Add templates for most popular Pages templates. !24906
- Introduce Internal API for searching environment names. !24923
- Allow admins to invalidate markdown texts by setting local markdown version.

### Other (50 changes, 18 of them are from the community)

- Externalize strings from `/app/views/projects/project_members`. !23227 (Tao Wang)
- Add CSS & JS global flags to represent browser and platform. !24017
- Fix deprecation: Passing an argument to force an association to reload is now deprecated. !24136 (Jasper Maes)
- Cleanup legacy artifact background migration. !24144
- Bump kubectl in Auto DevOps to 1.11.6. !24176
- Conditionally initialize the global opentracing tracer. !24186
- Remove horizontal whitespace on user profile overview on small breakpoints. !24189
- Bump nginx-ingress chart to 1.1.2. !24203
- Use monospace font for registry table tag id and tag name. !24205
- Rename project tags to project topics. !24219
- Add uniqueness validation to url column in Releases::Link model. !24223
- Update sidekiq-cron to 1.0.4 and use fugit to replace rufus-scheduler to parse cron syntax. !24235
- Adds inter-service OpenTracing propagation. !24239
- Fixes Auto DevOps title on CI/CD admin settings. !24249
- Upgrade kubeclient to 4.2.2 and swap out monkey-patch to disallow redirects. !24284
- i18n: externalize strings from 'app/views/search'. !24297 (Tao Wang)
- Fix several ActionController::Parameters deprecations. !24332 (Jasper Maes)
- Remove all `$theme-gray-{weight}` variables in favor of `$gray-{weight}`. !24333 (George Tsiolis)
- Update gitlab-styles to 2.5.1. !24336 (Jasper Maes)
- Modifies environment scope UI on cluster page. !24376
- Extract process_name from GitLab::Sentry. !24422
- Upgrade Gitaly to 1.13.0. !24429
- Actually set raise_on_unfiltered_parameters to true. !24443 (Jasper Maes)
- Refactored NoteableDiscussion by extracting ResolveDiscussionButton. !24505 (Martin Hobert)
- Extracted JumpToNextDiscussionButton to its own component. !24506 (Martin Hobert)
- Extracted ReplyPlaceholder to its own component. !24507 (Martin Hobert)
- Block emojis and symbol characters from users full names. !24523
- Update GitLab Runner Helm Chart to 0.1.45. !24564
- Updated docs for fields in pushing mirror from GitLab to GitHub. !24566 (Joseph Yu)
- Upgrade gitlab-workhorse to 8.1.0. !24571
- Externalize strings from `/app/views/sent_notifications`. !24576 (George Tsiolis)
- Adds tracing support for ActiveRecord notifications. !24604
- Externalize strings from `/app/views/projects/ci`. !24617 (George Tsiolis)
- Move permission check of manual actions of deployments. !24660
- Externalize strings from `/app/views/clusters`. !24666 (George Tsiolis)
- Update UI for admin appearance settings. !24685
- Externalize strings from `/app/views/projects/pages_domains`. !24723 (George Tsiolis)
- Externalize strings from `/app/views/projects/milestones`. !24726 (George Tsiolis)
- Add OpenTracing instrumentation for Action View Render events. !24728
- Expose version for each application in cluster_status JSON endpoint. !24791
- Externalize strings from `/app/views/instance_statistics`. !24809 (George Tsiolis)
- Update cluster application version on updated and installed status. !24810
- Project list UI improvements. !24855
- Externalize strings from `/app/views/email_rejection_mailer`. !24869 (George Tsiolis)
- Update Gitaly to v1.17.0. !24873
- Update Workhorse to v8.3.0. !24959
- Upgrade gitaly to 1.18.0. !24981
- Update Workhorse to v8.3.1.
- Upgraded Codesandbox smooshpack package.
- Creates mixin to reduce code duplication between CE and EE in graph component.


2589
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
## 11.7.12 (2019-04-23)

### Fixed (2 changes)

- Bring back Rugged implementation of find_commit. !25477
- Avoid excessive recursive calls with Rugged TreeEntries. !26813

### Performance (1 change)

- Bring back Rugged implementation of ListCommitsByOid. !27441

### Other (4 changes)

- Bring back Rugged implementation of GetTreeEntries. !25674
- Bring back Rugged implementation of CommitIsAncestor. !25702
- Bring back Rugged implementation of TreeEntry. !25706
- Bring back Rugged implementation of commit_tree_entry. !25896


2608
2609
2610
2611
## 11.7.11 (2019-04-09)

- No changes.

2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624
## 11.7.10 (2019-03-28)

### Security (7 changes)

- Disallow guest users from accessing Releases.
- Fix PDF.js vulnerability.
- Hide "related branches" when user does not have permission.
- Fix XSS in resolve conflicts form.
- Added rake task for removing EXIF data from existing uploads.
- Disallow updating namespace when updating a project.
- Use UntrustedRegexp for matching refs policy.


2625
2626
## 11.7.8 (2019-03-26)

2627
- No changes.
2628

2629
2630
2631
2632
2633
2634
2635
2636
## 11.7.7 (2019-03-19)

### Security (2 changes)

- Remove project serialization in quick actions response.
- Fixed ability to see private groups by users not belonging to given group.


2637
## 11.7.5 (2019-02-05)
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647
2648
2649
2650

### Fixed (8 changes)

- Fix import handling errors in Bitbucket Server importer. !24499
- Adjusts suggestions unable to be applied. !24603
- Fix 500 errors with legacy appearance logos. !24615
- Fix form functionality for edit tag page. !24645
- Update Workhorse to v8.0.2. !24870
- Downcase aliased OAuth2 callback providers. !24877
- Fix Detect Host Keys not working. !24884
- Changed external wiki query method to prevent attribute caching. !24907


2651
2652
2653
2654
2655
2656
2657
## 11.7.2 (2019-01-29)

### Fixed (1 change)

- Fix uninitialized constant with GitLab Pages.


2658
2659
2660
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687
## 11.7.1 (2019-01-28)

### Security (24 changes)

- Make potentially malicious links more visible in the UI and scrub RTLO chars from links. !2770
- Don't process MR refs for guests in the notes. !2771
- Sanitize user full name to clean up any URL to prevent mail clients from auto-linking URLs. !2828
- Fixed XSS content in KaTex links.
- Disallows unauthorized users from accessing the pipelines section.
- Verify that LFS upload requests are genuine.
- Extract GitLab Pages using RubyZip.
- Prevent awarding emojis to notes whose parent is not visible to user.
- Prevent unauthorized replies when discussion is locked or confidential.
- Disable git v2 protocol temporarily.
- Fix showing ci status for guest users when public pipline are not set.
- Fix contributed projects info still visible when user enable private profile.
- Add subresources removal to member destroy service.
- Add more LFS validations to prevent forgery.
- Use common error for unauthenticated users when creating issues.
- Fix slow regex in project reference pattern.
- Fix private user email being visible in push (and tag push) webhooks.
- Fix wiki access rights when external wiki is enabled.
- Group guests are no longer able to see merge requests they don't have access to at group level.
- Fix path disclosure on project import error.
- Restrict project import visibility based on its group.
- Expose CI/CD trigger token only to the trigger owner.
- Notify only users who can access the project on project move.
- Alias GitHub and BitBucket OAuth2 callback URLs.


2688
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699
2700
2701
2702
2703
2704
2705
2706
2707
2708
2709
2710
2711
2712
2713
2714
2715
2716
2717
2718
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755
2756
2757
2758
2759
2760
2761
2762
2763
2764
2765
2766
2767
2768
2769
2770
2771
2772
2773
2774
2775
2776
2777
2778
2779
2780
2781
2782
2783
2784
2785
2786
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838
2839
2840
2841
2842
2843
2844
2845
2846
2847
2848
2849
2850
2851
2852
2853
2854
2855
2856
2857
2858
2859
2860
2861
2862
## 11.7.0 (2019-01-22)

### Security (14 changes, 1 of them is from the community)

- Escape label and milestone titles to prevent XSS in GFM autocomplete. !2693
- Bump Ruby on Rails to 5.0.7.1. !23396 (@blackst0ne)
- Delete confidential todos for user when downgraded to Guest.
- Project guests no longer are able to see refs page.
- Set URL rel attribute for broken URLs.
- Prevent leaking protected variables for ambiguous refs.
- Authorize before reading job information via API.
- Allow changing group CI/CD settings only for owners.
- Fix SSRF with import_url and remote mirror url.
- Don't expose cross project repositories through diffs when creating merge reqeusts.
- Validate bundle files before unpacking them.
- Issuable no longer is visible to users when project can't be viewed.
- Escape html entities in LabelReferenceFilter when no label found.
- Prevent private snippets from being embeddable.

### Removed (3 changes, 1 of them is from the community)

- Removes all instances of deprecated Gitlab Upgrader calls. !23603 (@jwolen)
- Removed discard draft comment button form notes. !24185
- Remove migration to backfill project_repositories for legacy storage projects. !24299

### Fixed (42 changes, 7 of them are from the community)

- Prevent awards emoji being updated when updating status. !23470
- Allow merge after rebase without page refresh on FF repositories. !23572
- Prevent admins from attempting hashed storage migration on read only DB. !23597
- Correct the ordering of metrics on the performance dashboard. !23630
- Display empty files properly on MR diffs. !23671 (Sean Nichols)
- Allow GitHub imports via token even if OAuth2 provider not configured. !23703
- Update header navigation theme colors. !23734 (George Tsiolis)
- Fix login box bottom margins on signin page. !23739 (@gear54)
- Return an ApplicationSetting in CurrentSettings. !23766
- Fix bug commenting on LFS images. !23812
- Only prompt user once when navigating away from file editor. !23820 (Sam Bigelow)
- Display commit ID for discussions made on merge request commits. !23837
- Stop autofocusing on diff comment after initial mount. !23849
- Fix object storage not working properly with Google S3 compatibility. !23858
- Fix project calendar feed when sorted by priority. !23870
- Fix edit button disappearing in issue title. !23948 (Ruben Moya)
- Aligns build loader animation with the job log. !23959
- Allow 'rake gitlab:cleanup:remote_upload_files' to read bucket files without having permissions to see all buckets. !23981
- Correctly externalize pipeline tags. !24028
- Fix error when creating labels in a new issue in the boards page. !24039 (Ruben Moya)
- Use 'parsePikadayDate' to parse due date string. !24045
- Fix commit SHA not showing in merge request compare dropdown. !24084
- Remove top margin in modal header titles. !24108
- Drop Webhooks from project import/export config. !24121
- Only validate project visibility when it has changed. !24142
- Resolve About this feature link should open in new window. !24149
- Add syntax highlighting to suggestion diff. !24156
- Fix Bitbucket Server import only including first 25 pull requests. !24178
- Enable caching for records which primary key is not `id`. !24245
- Adjust applied suggestion reverting previous changes. !24250
- Fix unexpected exception by failure of finding an actual head pipeline. !24257
- Fix broken templated "Too many changes to show" text. !24282
- Fix requests profiler in admin page not rendering HTML properly. !24291
- Fix no avatar not showing in user selection box. !24346
- Upgrade to gitaly 1.12.1. !24361
- Fix runner eternal loop when update job result. !24481
- Fix notification email for image diff notes.
- Fixed merge request diffs empty states.
- Fixed diff suggestions removing dashes.
- Don't hide CI dropdown behind diff summary. (gfyoung)
- Fix spacing on discussions.
- Fixes missing margin in releases block.

### Changed (22 changes, 8 of them are from the community)

- Show clusters of ancestors in cluster list page. !22996
- Remove unnecessary line before reply holder. !23092 (George Tsiolis)
- Make the Pages permission setting more clear. !23146
- Disable merging of labels with same names. !23265
- Allow basic authentication on go get middleware. !23497 (Morty Choi @mortyccp)
- No longer require email subaddressing for issue creation by email. !23523
- Adjust padding of .dropdown-title to comply with design specs. !23546
- Make commit IDs in merge request discussion header monospace. !23562
- Update environments breadcrumb. !23751 (George Tsiolis)
- Add date range in milestone change email notifications. !23762
- Require Knative to be installed only on an RBAC kubernetes cluster. !23807 (Chris Baumbauer)
- Fix label and header styles in the job details sidebar. !23816 (Nathan Friend)
- Add % prefix to milestone reference links. !23928
- Reorder sidebar menu item for group clusters. !24001 (George Tsiolis)
- Support CURD operation for Links as one of the Release assets. !24056
- Upgrade Omniauth and JWT gems to switch away from Google+ API. !24068
- Renames Milestone sort into Milestone due date. !24080 (Jacopo Beschi @jacopo-beschi)
- Discussion filter only displayed in discussions tab for merge requests. !24082
- Make RBAC enabled default for new clusters. !24119
- Hashed Storage: Only set as `read_only` when starting the per-project migration. !24128
- Knative version bump 0.1.3 -> 0.2.2. (Chris Baumbauer)
- Show message on non-diff discussions.

### Performance (7 changes)

- Fix some N+1 queries related to Admin Dashboard, User Dashboards and Activity Stream. !23034
- Add indexes to speed up CI query. !23188
- Improve the loading time on merge request's discussion page by caching diff highlight. !23857
- Cache avatar URLs and paths within a request. !23950
- Improve snippet search performance by removing duplicate counts. !23952
- Skip per-commit validations already evaluated. !23984
- Fix timeout issues retrieving branches via API. !24034

### Added (29 changes, 6 of them are from the community)

- Handle ci.skip push option. !15643 (Jonathon Reinhart)
- Add NGINX 0.16.0 and above metrics. !22133
- Add project milestone link. !22552
- Support tls communication in gitaly. !22602
- Add option to make ci variables protected by default. !22744 (Alexis Reigel)
- Add project identifier as List-Id email Header to ease filtering. !22817 (Olivier Crête)
- Add markdown helper buttons to file editor. !23480
- Allow to include templates in gitlab-ci.yml. !23495
- Extend override check to also check arity. !23498 (Jacopo Beschi @jacopo-beschi)
- Add importing of issues from CSV file. !23532
- Add submit feedback link to help dropdown. !23547
- Send a notification email to project maintainers when a mirror update fails. !23595
- Restore Object Pools when restoring an object pool. !23682
- Creates component for release block. !23697
- Configure Auto DevOps deployed applications with secrets from prefixed CI variables. !23719
- Add name, author_id, and sha to releases table. !23763
- Display a list of Sentry Issues in GitLab. !23770
- Releases API. !23795
- Creates frontend app for releases. !23796
- Add new pipeline variable CI_COMMIT_SHORT_SHA. !23822
- Create system notes on issue / MR creation when labels, milestone, or due date is set. !23859
- Adds API documentation for releases. !23901
- Add API Support for Kubernetes integration. !23922
- Expose CI/CD predefined variable `CI_API_V4_URL`. !23936
- Add Knative metrics to Prometheus. !23972 (Chris Baumbauer)
- Use reports syntax for Dependency scanning in Auto DevOps. !24081
- Allow to include files from another projects in gitlab-ci.yml. !24101
- User Popovers for Commit Infos, Member Lists and Snippets. !24132
- Add no-color theme for syntax highlighting. (khm)

### Other (45 changes, 30 of them are from the community)

- Redesign project lists UI. !22682
- [Rails5.1] Update functional specs to use new keyword format. !23095 (@blackst0ne)
- Update a condition to visibility a merge request collaboration message. !23104 (Harry Kiselev)
- Remove framework/mobile.scss. !23301 (Takuya Noguchi)
- Passing the separator argument as a positional parameter is deprecated. !23334 (Jasper Maes)
- Clarifies docs about CI `allow_failure`. !23367 (C.J. Jameson)
- Refactor issuable sidebar to use serializer. !23379
- Refactor the logic of updating head pipelines for merge requests. !23502
- Allow user to add Kubernetes cluster for clusterable when there are ancestor clusters. !23569
- Adds explanatory text to input fields on user profile settings page. !23673
- Externalize strings from `/app/views/shared/notes`. !23696 (Tao Wang)
- Remove rails 4 support in CI, Gemfiles, bin/ and config/. !23717 (Jasper Maes)
- Fix calendar events fetching error on private profile page. !23718 (Harry Kiselev)
- Update GitLab Workhorse to v8.0.0. !23740
- Hide confidential events in the API. !23746
- Changed Userpopover Fixtures and shadow color. !23768
- Fix deprecation: Passing conditions to delete_all is deprecated. !23817 (Jasper Maes)
- Fix deprecation: Passing ActiveRecord::Base objects to sanitize_sql_hash_for_assignment. !23818 (Jasper Maes)
- Remove rails4 specific code. !23847 (Jasper Maes)
- Remove deprecated ActionDispatch::ParamsParser. !23848 (Jasper Maes)
- Fix deprecation: Comparing equality between ActionController::Parameters and a Hash is deprecated. !23855 (Jasper Maes)
- Fix deprecation: Directly inheriting from ActiveRecord::Migration is deprecated. !23884 (Jasper Maes)
- Fix deprecation: alias_method_chain is deprecated. Please, use Module#prepend instead. !23887 (Jasper Maes)
- Update specs to exclude possible false positive pass. !23893 (@blackst0ne)
- Passing an argument to force an association to reload is now deprecated. !23894 (Jasper Maes)
- ActiveRecord::Migration -> ActiveRecord::Migration[5.0]. !23910 (Jasper Maes)
- Split bio into individual line in extended user tooltips. !23940
- Fix deprecation: redirect_to :back is deprecated. !23943 (Jasper Maes)
- Fix deprecation: insert_sql is deprecated and will be removed. !23944 (Jasper Maes)
- Upgrade @gitlab/ui to 1.16.2. !23946
- convert specs in javascripts/ and support/ to new syntax. !23947 (Jasper Maes)
- Remove deprecated xhr from specs. !23949 (Jasper Maes)
- Remove app/views/shared/issuable/_filter.html.haml. !24008 (Takuya Noguchi)
- Fix deprecation: Using positional arguments in integration tests. !24009 (Jasper Maes)
- UI improvements for redesigned project lists. !24011
- Update cert-manager chart from v0.5.0 to v0.5.2. !24025 (Takuya Noguchi)
Yoginth's avatar
Yoginth committed
2863
- Hide spinner on empty activities list on user profile overview. !24063
2864
2865
2866
2867
2868
2869
2870
2871
2872
2873
- Don't show Auto DevOps enabled banner for projects with CI file or CI disabled. !24067
- Update GitLab Runner Helm Chart to 0.1.43. !24083
- Fix navigation style in docs. !24090 (Takuya Noguchi)
- Remove gem install bundler from Docker-based Ruby environments. !24093 (Takuya Noguchi)
- Fix deprecation: Using positional arguments in integration tests. !24110 (Jasper Maes)
- Fix deprecation: returning false in Active Record and Active Model callbacks will not implicitly halt a callback chain. !24134 (Jasper Maes)
- ActiveRecord::Migration -> ActiveRecord::Migration[5.0] for AddIndexesToCiBuildsAndPipelines. !24167 (Jasper Maes)
- Update url placeholder for the sentry configuration page. !24338


2874
2875
## 11.6.11 (2019-04-23)

2876
### Security (1 change)
2877
2878
2879
2880
2881
2882
2883
2884
2885
2886
2887
2888
2889
2890
2891
2892
2893
2894
2895
2896

- Fixed ability to see private groups by users not belonging to given group.

### Fixed (2 changes)

- Bring back Rugged implementation of find_commit. !25477
- Avoid excessive recursive calls with Rugged TreeEntries. !26813

### Performance (1 change)

- Bring back Rugged implementation of ListCommitsByOid. !27441

### Other (4 changes)

- Bring back Rugged implementation of GetTreeEntries. !25674
- Bring back Rugged implementation of CommitIsAncestor. !25702
- Bring back Rugged implementation of TreeEntry. !25706
- Bring back Rugged implementation of commit_tree_entry. !25896


2897
2898
2899
2900
2901
2902
2903
2904
2905
2906
2907
2908
2909
2910
2911
2912
2913
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
## 11.6.10 (2019-02-28)

### Security (21 changes)

- Stop linking to unrecognized package sources. !55518
- Check snippet attached file to be moved is within designated directory.
- Fix potential Addressable::URI::InvalidURIError.
- Do not display impersonated sessions under active sessions and remove ability to revoke session.
- Display only information visible to current user on the Milestone page.
- Show only merge requests visible to user on milestone detail page.
- Disable issue boards API when issues are disabled.
- Don't show new issue link after move when a user does not have permissions.
- Fix git clone revealing private repo's presence.
- Fix blind SSRF in Prometheus integration by checking URL before querying.
- Check if desired milestone for an issue is available.
- Don't allow non-members to see private related MRs.
- Fix arbitrary file read via diffs during import.
- Display the correct number of MRs a user has access to.
- Forbid creating discussions for users with restricted access.
- Do not disclose milestone titles for unauthorized users.
- Validate session key when authorizing with GCP to create a cluster.
- Block local URLs for Kubernetes integration.
- Limit mermaid rendering to 5K characters.
- Remove the possibility to share a project with a group that a user is not a member of.
- Fix leaking private repository information in API.


2924
2925
2926
2927
2928
2929
2930
## 11.6.9 (2019-02-04)

### Security (1 change)

- Use sanitized user status message for user popover.


2931
2932
2933
2934
## 11.6.8 (2019-01-30)

- No changes.

2935
2936
2937
2938
2939
2940
2941
2942
2943
2944
2945
## 11.6.5 (2019-01-17)

### Fixed (5 changes)

- Add syntax highlighting to suggestion diff. !24156
- Fix broken templated "Too many changes to show" text. !24282
- Fix requests profiler in admin page not rendering HTML properly. !24291
- Fix no avatar not showing in user selection box. !24346
- Fixed diff suggestions removing dashes.


2946
2947
2948
2949
2950
2951
2952
## 11.6.4 (2019-01-15)

### Security (1 change)

- Validate bundle files before unpacking them.


2953
2954
2955
2956
2957
2958
2959
## 11.6.3 (2019-01-04)

### Fixed (1 change)

- Fix clone URL not showing if protocol is HTTPS. !24131


2960
2961
2962
2963
2964
2965
2966
2967