Merge remote-tracking branch 'dev/master'

* dev/master:
  Update CHANGELOG.md for 9.0.11
  Update CHANGELOG-EE.md for 9.0.11-ee
  Update CHANGELOG.md for 9.1.8
  Update CHANGELOG-EE.md for 9.1.8-ee
  Update CHANGELOG.md for 8.17.7
  Update CHANGELOG-EE.md for 8.17.7-ee
  Update CHANGELOG.md for 9.2.8
  Update CHANGELOG-EE.md for 9.2.8-ee
  Update CHANGELOG.md for 9.3.8
  Update CHANGELOG-EE.md for 9.3.8-ee

CHANGELOG-EE.md

 Please view this file on the master branch, on stable branches it's out of date.
 
+## 9.3.8 (2017-07-19)
+
+- Escape symbols in exported CSV columns to prevent command execution in Microsoft Excel.
+- Prevent mirror user to be assigned to users other than the current one.
+
 ## 9.3.7 (2017-07-18)
 
 - No changes.
@@ -72,6 +77,11 @@ Please view this file on the master branch, on stable branches it's out of date.
 - Fix: /unassign by default unassigns everyone. Implement /reassign command.
 - Speed up checking for approvers remaining.
 
+## 9.2.8 (2017-07-19)
+
+- Escape symbols in exported CSV columns to prevent command execution in Microsoft Excel.
+- Prevent mirror user to be assigned to users other than the current one.
+
 ## 9.2.7 (2017-06-21)
 
 - Geo: fixed Dynamic Backoff strategy that was not being used by workers. !2128
@@ -128,6 +138,11 @@ Please view this file on the master branch, on stable branches it's out of date.
 - Feature availability check using feature list AND license addons.
 - Disable mirror workers for Geo secondaries.
 
+## 9.1.8 (2017-07-19)
+
+- Escape symbols in exported CSV columns to prevent command execution in Microsoft Excel.
+- Prevent mirror user to be assigned to users other than the current one.
+
 ## 9.1.7 (2017-06-07)
 
 - No changes.
@@ -207,6 +222,11 @@ Please view this file on the master branch, on stable branches it's out of date.
 - Show user cohorts data when usage ping is enabled.
 - Visualise Canary Deployments.
 
+## 9.0.11 (2017-07-19)
+
+- Escape symbols in exported CSV columns to prevent command execution in Microsoft Excel.
+- Prevent mirror user to be assigned to users other than the current one.
+
 ## 9.0.10 (2017-06-07)
 
 - No changes.
@@ -299,6 +319,10 @@ Please view this file on the master branch, on stable branches it's out of date.
 - [Elasticsearch] More efficient search.
 - Get Geo secondaries nodes statuses over AJAX.
 
+## 8.17.7 (2017-07-19)
+
+- Prevent mirror user to be assigned to users other than the current one.
+
 ## 8.17.6 (2017-05-05)
 
 - Respect project features when searching alternative branches with elasticsearch enabled.

CHANGELOG.md

@@ -2,6 +2,13 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 9.3.8 (2017-07-19)
+
+- Improve support for external issue references. !12485
+- Renders 404 if given project is not readable by the user on Todos dashboard.
+- Use uploads/system directory for personal snippets.
+- Remove uploads/appearance symlink. A leftover from a previous migration.
+
 ## 9.3.7 (2017-07-18)
 
 - Prevent bad data being added to application settings when Redis is unavailable. !12750
@@ -264,6 +271,13 @@ entry.
 - Remove foreigh key on ci_trigger_schedules only if it exists.
 - Allow translation of Pipeline Schedules.
 
+## 9.2.8 (2017-07-19)
+
+- Improve support for external issue references. !12485
+- Renders 404 if given project is not readable by the user on Todos dashboard.
+- Fix incorrect project authorizations.
+- Remove uploads/appearance symlink. A leftover from a previous migration.
+
 ## 9.2.7 (2017-06-21)
 
 - Reinstate is_admin flag in users api when authenticated user is an admin. !12211 (rickettm)
@@ -510,6 +524,13 @@ entry.
 - Fix preemptive scroll bar on user activity calendar.
 - Pipeline chat notifications convert seconds to minutes and hours.
 
+## 9.1.8 (2017-07-19)
+
+- Improve support for external issue references. !12485
+- Renders 404 if given project is not readable by the user on Todos dashboard.
+- Fix incorrect project authorizations.
+- Remove uploads/appearance symlink. A leftover from a previous migration.
+
 ## 9.1.7 (2017-06-07)
 
 - No changes.
@@ -823,6 +844,12 @@ entry.
 - Only send chat notifications for the default branch.
 - Don't fill in the default kubernetes namespace.
 
+## 9.0.11 (2017-07-19)
+
+- Renders 404 if given project is not readable by the user on Todos dashboard.
+- Fix incorrect project authorizations.
+- Remove uploads/appearance symlink. A leftover from a previous migration.
+
 ## 9.0.10 (2017-06-07)
 
 - No changes.
@@ -1193,6 +1220,11 @@ entry.
 - Change development tanuki favicon colors to match logo color order.
 - API issues - support filtering by iids.
 
+## 8.17.7 (2017-07-19)
+
+- Renders 404 if given project is not readable by the user on Todos dashboard.
+- Fix incorrect project authorizations.
+
 ## 8.17.6 (2017-05-05)
 
 - Enforce project features when searching blobs and wikis.

changelogs/unreleased/adam-external-issue-references-spike.yml

----
-title: Improve support for external issue references
-merge_request: 12485
-author: