[ci skip]

Fix PDF.js vulnerability

See merge request gitlab/gitlabhq!3026

Disallow changing namespace of a project in update method

See merge request gitlab/gitlabhq!3031

Check label_ids parent when updating issue board

See merge request gitlab/gitlabhq!3037

Use UntrustedRegexp for CI refs matching

See merge request gitlab/gitlabhq!3008

Rake task for removing exif from uploads

See merge request gitlab/gitlabhq!3012

Fix XSS in resolve conflicts form

See merge request gitlab/gitlabhq!2988

Fix related branches visible in issues for guests

See merge request gitlab/gitlabhq!3020

Disallow guest users from accessing Releases

See merge request gitlab/gitlabhq!3044

As they do not have a permission to read git tag

Adds a rake task which can be used for removing EXIF
data from existing uploads.

- labels have to be in the same project/group
as an issuable

fix: changed PDFJS prop to GlobalWorkerOptions

Fixed pdf tests

Added changelog entry

Guest user of a project should not see branches

[ci skip]

Fix project serialization in quick actions response

See merge request gitlab/gitlabhq!3017

When executing quick actions, this limits the `commands_changes`
response to only those used by the frontend

This makes ref validation to use always `UntrustedRegexp`.
This also splits the existing RubySyntax into separate
class.

The issue arose when the branch name contained Vue template
JavaScript. The fix is to use `v-pre` which disables Vue
compilation in a template.

Sharing a public project with a private group makes the group page publicly accessible

See merge request gitlab/gitlabhq!2985

[ci skip]

Display only information visible to current user on Milestone detail

See merge request gitlab/gitlabhq!2918

Display only labels and assignees of issues
visible by the currently logged user
Display only issues visible to user in the burndown chart

Display the correct number of MRs a user has access to

See merge request gitlab/gitlabhq!2928

Filter impersonated sessions from active sessions and remove ability to revoke session

See merge request gitlab/gitlabhq!2982

Forbid creating discussions for users with restricted access

See merge request gitlab/gitlabhq!2891

Check issue milestone availability

See merge request gitlab/gitlabhq!2905

Prevent Releases links API to leak tag existence

See merge request gitlab/gitlabhq!2909

Disable issue board policies when issues are disabled

See merge request gitlab/gitlabhq!2911

Show only MRs visible to user on milestone detail

See merge request gitlab/gitlabhq!2924

Don't allow non-members to see private related MRs

See merge request gitlab/gitlabhq!2931

Validate session key when authorizing with GCP to create a cluster

See merge request gitlab/gitlabhq!2935