Prevent DOS from Chaining in Mermaid

See merge request gitlab-org/gitlab!60382

Add gl-form-input class for fields in import page

See merge request gitlab-org/gitlab!58316

Added tracking to the different diff view settings [RUN ALL RSPEC] [RUN AS-IF-FOSS]

See merge request gitlab-org/gitlab!59979

Add descriptions for GroupMemberRelationEnum

See merge request gitlab-org/gitlab!60158

Update Gitaly version

See merge request gitlab-org/gitlab!60507

Geo Node Status 2.0 - Vuex Spec Cleanup

See merge request gitlab-org/gitlab!60151

[VSA] Enable pagination (frontend)

See merge request gitlab-org/gitlab!59650

Don't allow chaining of links to be rendered directly
in the Mermaid diagram.

Changelog: security

Add Merge Requests and Requirements Menu

See merge request gitlab-org/gitlab!59374

Rename routeQuery to queryString in standard_filter.vue

See merge request gitlab-org/gitlab!60371

[ci skip]

[ci skip]

[ci skip]

[ci skip]

[ci skip]

[ci skip]

Any objects other than `User` (such as `DeployToken`) are not allowed

Changelog: security

Verify that read_api tokens cannot run mutations.

Also: adds tests use of OAuth tokens for GraphQL

We make some changes to the sessionless_authentication module
in order to capture the request_authenticator, so that we can access
the token scopes, without making any extra queries.

We ensure we always authorize the mutation, which, like all resolvers,
needs to opt in to the check.

Unlike resolvers, mutations should always raise. So
`BaseMutation.authorized?` raises on failure.

Logic for handling scopes is pushed down to the `ObjectAuthorization`
class, and encapsulated in the `ScopeValidator`, which limits the
methods that can be called by resolvers.

When an issue is created or updated though API for import
purposes we allow providing created_at and updated_at params
these would then be reflected also in system notes. Only admins
and project owners should be able to set these dates.

It seems that with this feature flag enabled, pagination doesn't work
correctly in conjunction with a search. The FF is already disabled on
GitLab.com, but disabling it in the YAML file means that self-managed
instances will also be protected from the security issue (unless they
explicitly opt-in to some beta code, of course).

Changelog: security

Contributes to https://gitlab.com/gitlab-org/gitlab/-/issues/230864

* Remove password value from the pull mirror form
* Hide username from mirror url

Subscription Activation: Success Banner

See merge request gitlab-org/gitlab!60389

Docs: Remove create_default examples with freeze

See merge request gitlab-org/gitlab!60379

Document all the configuration options

See merge request gitlab-org/gitlab!59562

Document order-dependent flaky tests

See merge request gitlab-org/gitlab!59369

ImportExport: Validate URL before downloading

See merge request gitlab-org/gitlab!60388

ci: Streamline our usage of 'needs' after latest improvements

See merge request gitlab-org/gitlab!60030

Change success variant for primary button in upload file modal to confirm

See merge request gitlab-org/gitlab!59463

Merge branch '21033-controller-groups-groupmemberscontroller-index-executes-more-than-100-sql-queries-p80-108-5' into 'master'

Resolve admin_group_member group policy n+1

See merge request gitlab-org/gitlab!58948