[ci skip]

Add DNS rebinding protection settings

See merge request gitlab/gitlabhq!3130

Fix the overriding of EE import params

See merge request gitlab/gitlabhq!3129

Reject slug+uri concat if slug is deemed unsafe

See merge request gitlab/gitlabhq!3105

Persistent XSS in note objects

See merge request gitlab/gitlabhq!3127

Fix url redaction for issue links

See merge request gitlab/gitlabhq!3092

Disallow invalid MR branch name

See merge request gitlab/gitlabhq!3095

Hide issue title on unsubscribe for anonymous users

See merge request gitlab/gitlabhq!3099

Fix confidential issue label disclosure on milestone view

See merge request gitlab/gitlabhq!3102

Handling password on import by url page

See merge request gitlab/gitlabhq!3109

Resolve: Milestones leaked via search API

See merge request gitlab/gitlabhq!3110

Protect Gitlab::HTTP against DNS rebinding attack

See merge request gitlab/gitlabhq!3113

Update Gitaly to fix GetArchive vulnerability

See merge request gitlab/gitlabhq!3118

Prevent password sign in restriction bypass

See merge request gitlab/gitlabhq!3121

First reported:
  https://gitlab.com/gitlab-org/gitlab-ce/issues/60143

When the page slug is "javascript:" and we attempt to link to a relative
path (using `.` or `..`) the code will concatenate the slug and the uri.
This MR adds a guard to that concat step that will return `nil` if the
incoming slug matches against any of the "unsafe" slug regexes;
currently this is only for the slug "javascript:" but can be extended if
needed. Manually tested against a non-exhaustive list from OWASP of
common javascript XSS exploits that have to to with mangling the
"javascript:" method, and all are caught by this change or by existing
code that ingests the user-specified slug.

Replaces a hard-coded date in the job app spec

Closes #62283

See merge request gitlab-org/gitlab-ce!28709

Gitlab::HTTP now resolves the hostname only once, verifies the IP is not
blocked, and then uses the same IP to perform the actual request, while
passing the original hostname in the `Host` header and SSL SNI field.

[ci skip]

Prepare 11.11.0-rc5 release

See merge request gitlab-org/gitlab-ce!28537

Slight edit of text from earlier merge

Closes #61447

See merge request gitlab-org/gitlab-ce!28511

(cherry picked from commit 890fe4ea)

208dc117 Slight edit of text from earlier merge

Add to docs sentence about alertbot opening issues

See merge request gitlab-org/gitlab-ce!28503

(cherry picked from commit 5396b2a8)

afcbebd9 Add to docs sentence about alertbot opening issues

Adds documentation for 'Play all manual' button

See merge request gitlab-org/gitlab-ce!28502

(cherry picked from commit 7a9a65e5)

32a99c6c Adds documentation for stage button
4ec9f042 Apply suggestion to doc/ci/pipelines.md
062844cc Apply suggestion to doc/ci/pipelines.md
ecc7b72a Apply suggestion to doc/ci/pipelines.md
c4bcf858 Apply suggestion to doc/ci/pipelines.md
b0b16210 Apply suggestion to doc/ci/pipelines.md

API: Fix recursive flag not working with Rugged get_tree_entries flag

Closes #61979

See merge request gitlab-org/gitlab-ce!28494

(cherry picked from commit d951f047)

c1827f1c API: Fix recursive flag not working with Rugged get_tree_entries flag

Revert "Merge branch '55127-add-delay-after-mr-creation-for-async-tasks-to-complete' into 'master'"

See merge request gitlab-org/gitlab-ce!28492

(cherry picked from commit a5f810c9)

c04ea583 Revert "Merge branch '55127-add-delay-after-mr-creation-for-async-tasks-to-complete' into 'master'"

Adds arrow icons to select menu in CI/CD settings

Closes #62038

See merge request gitlab-org/gitlab-ce!28476

(cherry picked from commit 3c8bc807)

64f040e2 Adds arrow icons to select option in CI/CD settings

Update group security dashboard docs - CE backport

See merge request gitlab-org/gitlab-ce!28471

(cherry picked from commit d9877120)

6afda6d6 Update group security dashboard screenshot

Fix content to not contradict

Closes #61270

See merge request gitlab-org/gitlab-ce!28456

(cherry picked from commit 0bf8204a)

ec3e0da8 Fix content to not contradict
19b05a42 Apply suggestion to doc/ci/merge_request_pipelines/index.md

Initial instance level cluster docs

See merge request gitlab-org/gitlab-ce!27873

(cherry picked from commit 961a5f72)

96cec8bf Initial instance level cluster docs
a951adb6 Apply suggestion to doc/user/project/clusters/index.md
719b7a07 Apply suggestion to doc/user/group/clusters/index.md

Port for RC5 of Next badge must be visible when canary flag is true

See merge request gitlab-org/gitlab-ce!28540

Fix milestone titles being leaked using search API
when users cannot read milestones