gitlab-org--gitlab-foss/changelogs/archive-10.md

10.8.6 (2018-07-17)

Security (2 changes)

• Fix symlink vulnerability in project import.
• Merge branch 'fix-mr-widget-border' into 'master'.

10.8.5 (2018-06-21)

Security (5 changes)

• Fix XSS vulnerability for table of content generation.
• Update sanitize gem to 4.6.5 to fix HTML injection vulnerability.
• HTML escape branch name in project graphs page.
• HTML escape the name of the user in ProjectsHelper#link_to_member.
• Don't show events from internal projects for anonymous users in public feed.

10.8.4 (2018-06-06)

• No changes.

10.8.3 (2018-05-30)

Fixed (4 changes)

• Replace Gitlab::REVISION with Gitlab.revision and handle installations without a .git directory. !19125
• Fix encoding of branch names on compare and new merge request page. !19143
• Fix remote mirror database inconsistencies when upgrading from EE to CE. !19196
• Fix local storage not being cleared after creating a new issue.

Performance (1 change)

• Memoize Gitlab::Database.main.version.

10.8.2 (2018-05-28)

Security (3 changes)

• Prevent user passwords from being changed without providing the previous password.
• Fix API to remove deploy key from project instead of deleting it entirely.
• Fixed bug that allowed importing arbitrary project attributes.

10.8.1 (2018-05-23)

Fixed (9 changes)

• Allow CommitStatus class to use presentable methods. !18979
• Fix corrupted environment pages with unathorized proxy url. !18989
• Fixes deploy token variables on Ci::Build. !19047
• Fix project mirror database inconsistencies when upgrading from EE to CE. !19109
• Render 404 when prometheus adapter is disabled in Prometheus metrics controller. !19110
• Fix error when deleting an empty list of refs.
• Fixed U2F login when used with LDAP.
• Bump prometheus-client-mmap to 0.9.3 to fix nil exception error.
• Fix system hook not firing for blocked users when LDAP sign-in is used.

10.8.0 (2018-05-22)

Security (3 changes, 1 of them is from the community)

• Update faraday_middlewar to 0.12.2. !18397 (Takuya Noguchi)
• Serve archive requests with the correct file in all cases.
• Sanitizes user name to avoid XSS attacks.

Fixed (47 changes, 11 of them are from the community)

• Refactor CSS to eliminate vertical misalignment of login nav. !16275 (Takuya Noguchi)
• Fix pipeline status in branch/tag tree page. !17995
• Allow group owner to enable runners from subgroups (#41981). !18009
• Fix template selector menu visibility when toggling preview mode in file edit view. !18118 (Fabian Schneider)
• Fix confirmation modal for deleting a protected branch. !18176 (Paul Bonaud @PaulRbR)
• Triggering custom hooks by Wiki UI edit. !18251
• Now rake cache:clear will also clear pipeline status cache. !18257
• Fix joined information on project members page. !18290 (Fabian Schneider)
• Fix missing namespace for some internal users. !18357
• Show shared projects on group page. !18390
• Restore label underline color. !18407 (George Tsiolis)
• Fix undefined html_escape method during markdown rendering. !18418
• Fix unassign slash command preview. !18447
• Correct text and functionality for delete user / delete user and contributions modal. !18463 (Marc Schwede)
• Fix discussions API setting created_at for notable in a group or notable in a project in a group with owners. !18464
• Don't include lfs_file_locks data in export bundle. !18495
• Reset milestone filter when clicking "Any Milestone" in dashboard. !18531
• Ensure member notifications are sent after the member actual creation/update in the DB. !18538
• Update links to /ci/lint with ones to project ci/lint. !18539 (Takuya Noguchi)
• Fix tabs container styles to make RSS button clickable. !18559
• Raise NoRepository error for non-valid repositories when calculating repository checksum. !18594
• Don't automatically remove artifacts for pages jobs after pages:deploy has run. !18628
• Increase new issue metadata form margin. !18630 (George Tsiolis)
• Add loading icon padding for pipeline environments. !18631 (George Tsiolis)
• ShaAttribute no longer stops startup if database is missing. !18726
• Fix close keyboard shortcuts dialog using the keyboard shortcut. !18783 (Lars Greiss)
• Fixes database inconsistencies between Community and Enterprise Edition on import state. !18811
• Add database foreign key constraint between pipelines and build. !18822
• Fix finding wiki pages when they have invalidly-encoded content. !18856
• Fix outdated Web IDE welcome copy. !18861
• fixed copy to blipboard button in embed bar of snippets. !18923 (haseebeqx)
• Disables RBAC on nginx-ingress. !18947
• Correct skewed Kubernetes popover illustration. !18949
• Resolve Import/Export ci_cd_settings error updating the project. !46049
• Fix project creation for user endpoint when jobs_enabled parameter supplied.
• 46210 Display logo and user dropdown on mobile for terms page and fix styling.
• Adds illustration for when job log was erased.
• Ensure web hook 'blocked URL' errors are stored in web hook logs and properly surfaced to the user.
• Make toggle markdown preview shortcut only toggle selected field.
• Verifiy if pipeline has commit idetails and render information in MR widget when branch is deleted.
• Fixed inconsistent protected branch pill baseline.
• Fix setting GitLab metrics content types.
• Display only generic message on merge error to avoid exposing any potentially sensitive or user unfriendly backend messages.
• Fix label links update on project transfer.
• Breaks commit not found message in pipelines table.
• Adjust issue boards list header label text color.
• Prevent pipeline actions in dropdown to redirct to a new page.

Changed (35 changes, 15 of them are from the community)

• Improve tooltips in collapsed right sidebar. !17714
• Partition job_queue_duration_seconds with jobs_running_for_project. !17730
• For group dashboard, we no longer show groups which the visitor is not a member of (this applies to admins and auditors). !17884 (Roger Rüttimann)
• Use RFC 3676 mail signature delimiters. !17979 (Enrico Scholz)
• Add sha filter to pipelines list API. !18125
• New CI Job live-trace architecture. !18169
• Make project deploy keys table more clearly structured. !18279
• Remove green background from unlock button in admin area. !18288
• Renamed Overview to Project in the contextual navigation at a project level. !18295 (Constance Okoghenun)
• Load branches on new merge request page asynchronously. !18315
• Create settings section for autodevops. !18321
• Add a comma to the time estimate system notes. !18326
• Enable specifying variables when executing a manual pipeline. !18440
• Fix size and position for fork icon. !18449 (George Tsiolis)
• Refactored activity calendar. !18469 (Enrico Scholz)
• Small improvements to repository checks. !18484
• Add 2FA filter to users API for admins only. !18503
• Align project avatar on small viewports. !18513 (George Tsiolis)
• Show group and project LFS settings in the interface to Owners and Masters. !18562
• Update environment item action buttons icons. !18632 (George Tsiolis)
• Update timeline icon for description edit. !18633 (George Tsiolis)
• Revert discussion counter height. !18656 (George Tsiolis)
• Improve quick actions summary preview. !18659 (George Tsiolis)
• Change font for tables inside diff discussions. !18660 (George Tsiolis)
• Add padding to profile description. !18663 (George Tsiolis)
• Break issue title for board card title and issuable header text. !18674 (George Tsiolis)
• Adds push mirrors to GitLab Community Edition. !18715
• Inform the user when there are no project import options available. !18716 (George Tsiolis)
• Improve commit message body rendering and fix responsive compare panels. !18725 (Constance Okoghenun)
• Reconcile project templates with Auto DevOps. !18737
• Remove branch name from the status bar of WebIDE.
• Clean up WebIDE status bar and add useful info.
• Improve interaction on WebIDE commit panel.
• Keep current labels visible when editing them in the sidebar.
• Use VueJS for rendering pipeline stages.

Performance (26 changes, 11 of them are from the community)

• Move WorkInProgress vue component. !17536 (George Tsiolis)
• Move ReadyToMerge vue component. !17545 (George Tsiolis)
• Move BoardBlankState vue component. !17666 (George Tsiolis)
• Improve DB performance of calculating total artifacts size. !17839
• Add i18n and update specs for UnresolvedDiscussions vue component. !17866 (George Tsiolis)
• Introduce new ProjectCiCdSetting model with group_runners_enabled. !18144
• Move PipelineFailed vue component. !18277 (George Tsiolis)
• Move TimeTrackingEstimateOnlyPane vue component. !18318 (George Tsiolis)
• Move TimeTrackingHelpState vue component. !18319 (George Tsiolis)
• Reduce queries on merge requests list page for merge requests from forks. !18561
• Destroy build_chunks efficiently with FastDestroyAll module. !18575
• Improve performance of a service responsible for creating a pipeline. !18582
• Replace time_ago_in_words with JS-based one. !18607 (Takuya Noguchi)
• Move TimeTrackingNoTrackingPane vue component. !18676 (George Tsiolis)
• Move SidebarTimeTracking vue component. !18677 (George Tsiolis)
• Move TimeTrackingSpentOnlyPane vue component. !18710 (George Tsiolis)
• Detecting tags containing a commit uses Gitaly by default.
• Increase cluster applications installer availability using alpine linux mirrors.
• Compute notification recipients in background jobs.
• Use persisted diff data instead fetching Git on discussions.
• Detecting branchnames containing a commit uses Gitaly by default.
• Detect repository license on Gitaly by default.
• Finish NamespaceService migration to Gitaly.
• Check if a ref exists is done by Gitaly by default.
• Compute Gitlab::Git::Repository#checksum on Gitaly by default.
• Repository#exists? is always executed through Gitaly.

Added (22 changes, 10 of them are from the community)

• Allow group masters to configure runners for groups. !9646 (Alexis Reigel)
• Adds Embedded Snippets Support. !15695 (haseebeqx)
• Add Copy metadata quick action. !16473 (Mateusz Bajorski)
• Show Runner's description on job's page. !17321
• Add deprecation message to dynamic milestone pages. !17505
• Show new branch/mr button even when branch exists. !17712 (Jacopo Beschi @jacopo-beschi)
• API: add languages of project GET /projects/:id/languages. !17770 (Roger Rüttimann)
• Display active sessions and allow the user to revoke any of it. !17867 (Alexis Reigel)
• Add cron job to email users on issue due date. !17985 (Stuart Nelson)
• Rubocop rule to avoid returning from a block. !18000 (Jacopo Beschi @jacopo-beschi)
• Add the signature verification badge to the compare view. !18245 (Marc Shaw)
• Expose Deploy Token data as environment varialbes on CI/CD jobs. !18414
• Show group id in group settings. !18482 (George Tsiolis)
• Allow admins to enforce accepting Terms of Service on an instance. !18570
• Add CI_COMMIT_MESSAGE, CI_COMMIT_TITLE and CI_COMMIT_DESCRIPTION predefined variables. !18672
• Add GCP signup offer to cluster index / create pages. !18684
• Output some useful information when running the rails console. !18697
• Display merge commit SHA in merge widget after merge. !18722
• git SHA is now displayed alongside the GitLab version on the Admin Dashboard.
• Expose the target commit ID through the tag API.
• Added fuzzy file finder to web IDE.
• Add discussion API for merge requests and commits.

Other (22 changes, 8 of them are from the community)

• Replace the project/issues/milestones.feature spinach test with an rspec analog. !18300 (@blackst0ne)
• Replace the project/commits/branches.feature spinach test with an rspec analog. !18302 (@blackst0ne)
• Replacing gollum libraries for gitlab custom libs. !18343
• Replace the project/commits/comments.feature spinach test with an rspec analog. !18356 (@blackst0ne)
• Replace "Click" with "Select" to be more inclusive of people with accessibility requirements. !18386 (Mark Lapierre)
• Remove ahead/behind graphs on project branches on mobile. !18415 (Takuya Noguchi)
• Replace the project/source/markdown_render.feature spinach test with an rspec analog. !18525 (@blackst0ne)
• Add missing changelog type to docs. !18526 (@blackst0ne)
• Added Webhook SSRF prevention to documentation. !18532
• Upgrade underscore.js to 1.9.0. !18578
• Add documentation about how to use variables to define deploy policies for staging/production environments. !18675
• Replace the project/builds/artifacts.feature spinach test with an rspec analog. !18729 (@blackst0ne)
• Block access to the API & git for users that did not accept enforced Terms of Service. !18816
• Transition to atomic internal ids for all models. !44259
• Removes modal boards store and mixins from global scope.
• Replace GKE acronym with Google Kubernetes Engine.
• Replace vue resource with axios for pipelines details page.
• Enable prometheus monitoring by default.
• Replace vue resource with axios in pipelines table.
• Bump lograge to 0.10.0 and remove monkey patch.
• Improves wording in new pipeline page.
• Gitaly handles repository forks by default.

10.7.7 (2018-07-17)

Security (1 change)

• Fix symlink vulnerability in project import.

10.7.6 (2018-06-21)

Security (6 changes)

• Fix XSS vulnerability for table of content generation.
• Update sanitize gem to 4.6.5 to fix HTML injection vulnerability.
• HTML escape branch name in project graphs page.
• HTML escape the name of the user in ProjectsHelper#link_to_member.
• Don't show events from internal projects for anonymous users in public feed.
• XSS fix to use safe_params instead of params in url_for helpers.

Other (1 change)

• Replacing gollum libraries for gitlab custom libs. !18343

10.7.5 (2018-05-28)

Security (3 changes)

• Prevent user passwords from being changed without providing the previous password.
• Fix API to remove deploy key from project instead of deleting it entirely.
• Fixed bug that allowed importing arbitrary project attributes.

10.7.4 (2018-05-21)

Fixed (1 change)

• Fix error when deleting an empty list of refs.

10.7.3 (2018-05-02)

Fixed (8 changes)

• Fixed wrong avatar URL when the avatar is on object storage. !18092
• Fix errors on pushing to an empty repository. !18462
• Update doorkeeper to 4.3.2 to fix GitLab OAuth authentication. !18543
• Ports omniauth-jwt gem onto GitLab OmniAuth Strategies suite. !18580
• Fix redirection error for applications using OpenID. !18599
• Fix commit trailer rendering when Gravatar is disabled.
• Fix file_store for artifacts and lfs when saving.
• Fix users not seeing labels from private groups when being a member of a child project.

10.7.2 (2018-04-25)

Security (2 changes)

• Serve archive requests with the correct file in all cases.
• Sanitizes user name to avoid XSS attacks.

10.7.1 (2018-04-23)

Fixed (11 changes)

• [API] Fix URLs in the Link header for GET /projects/:id/repository/contributors when no value is passed for order_by or sort. !18393
• Fix a case with secret variables being empty sometimes. !18400
• Fix Trace::HttpIO can not render multi-byte chars. !18417
• Fix specifying a non-default ref when requesting an archive using the legacy URL. !18468
• Respect visibility options and description when importing project from template. !18473
• Removes 'No Job log' message from build trace. !18523
• Align action icons in pipeline graph.
• Fix direct_upload when records with null file_store are used.
• Removed alert box in IDE when redirecting to new merge request.
• Fixed IDE not loading for sub groups.
• Fixed IDE not showing loading state when tree is loading.

Performance (4 changes)

• Validate project path prior to hitting the database. !18322
• Add index to file_store on ci_job_artifacts. !18444
• Fix N+1 queries when loading participants for a commit note.
• Support Markdown rendering using multiple projects.

Added (1 change)

• Add an API endpoint to download git repository snapshots. !18173

10.7.0 (2018-04-22)

Security (6 changes, 2 of them are from the community)

• Fixed some SSRF vulnerabilities in services, hooks and integrations. !2337
• Update ruby-saml to 1.7.2 and omniauth-saml to 1.10.0. !17734 (Takuya Noguchi)
• Update rack-protection to 2.0.1. !17835 (Takuya Noguchi)
• Adds confidential notes channel for Slack/Mattermost.
• Fix XSS on diff view stored on filenames.
• Fix GitLab Auth0 integration signing in the wrong user.

Fixed (65 changes, 20 of them are from the community)

• File uploads in remote storage now support project renaming. !4597
• Fixed bug in dropdown selector when selecting the same selection again. !14631 (bitsapien)
• Fixed group deletion linked to Mattermost. !16209 (Julien Millau)
• Create commit API and Web IDE obey LFS filters. !16718
• Set breadcrumb for admin/runners/show. !17431 (Takuya Noguchi)
• Enable restore rake task to handle nested storage directories. !17516 (Balasankar C)
• Fix hover style of dropdown items in the right sidebar. !17519
• Improve empty state for canceled job. !17646
• Fix generated URL when listing repoitories for import. !17692
• Use singular in the diff stats if only one line has been changed. !17697 (Jan Beckmann)
• Long instance urls do not overflow anymore during project creation. !17717
• Fix importing multiple assignees from GitLab export. !17718
• Correct copy text for the promote milestone and label modals. !17726
• Fix search results stripping last endline when parsing the results. !17777 (Jasper Maes)
• Add read-only banner to all pages. !17798
• Fix viewing diffs on old merge requests. !17805
• Fix forking to subgroup via API when namespace is given by name. !17815 (Jan Beckmann)
• Fix UI breakdown for Create merge request button. !17821 (Takuya Noguchi)
• Unify format for nested non-task lists. !17823 (Takuya Noguchi)
• UX re-design branch items with flexbox. !17832 (Takuya Noguchi)
• Use porcelain commit lookup method on CI::CreatePipelineService. !17911
• Update dashboard milestones breadcrumb link. !17933 (George Tsiolis)
• Deleting a MR you are assigned to should decrements counter. !17951 (m b)
• Update no repository placeholder. !17964 (George Tsiolis)
• Drop JSON response in Project Milestone along with avoiding error. !17977 (Takuya Noguchi)
• Fix personal access token clipboard button style. !17978 (Fabian Schneider)
• Avoid validation errors when running the Pages domain verification service. !17992
• Project creation will now raise an error if a service template is invalid. !18013
• Add better LDAP connection handling. !18039
• Fix autolinking URLs containing ampersands. !18045
• Fix exceptions raised when migrating pipeline stages in the background. !18076
• Always display Labels section in issuable sidebar, even when the project has no labels. !18081 (Branka Martinovic)
• Fixed gitlab:uploads:migrate task ignoring some uploads. !18082
• Fixed gitlab:uploads:migrate task failing for Groups' avatar. !18088
• Increase dropdown width in pipeline graph & center action icon. !18089
• Fix JobsController#raw endpoint can not read traces in database. !18101
• Fix gitlab-rake gitlab:two_factor:disable_for_all_users. !18154
• Adjust 404's for LegacyDiffNote discussion rendering. !18201
• Work around Prometheus Helm chart name changes to fix integration. !18206 (joshlambert)
• Prioritize weight over title when sorting charts. !18233
• Verify that deploy token has valid access when pulling container registry image. !18260
• Stop redirecting the page in pipeline main actions.
• Fixed IDE button opening the wrong URL in tree list.
• Ensure hooks run when a deploy key without a user pushes.
• Fix 404 in group boards when moving issue between lists.
• Display state indicator for issuable references in non-project scope (e.g. when referencing issuables from group scope).
• Add missing port to artifact links.
• Fix data race between ObjectStorage background_upload and Pages publishing.
• Fixes unresolved discussions rendering the error state instead of the diff.
• Don't show Jump to Discussion button on Issues.
• Fix bug rendering group icons when forking.
• Automatically cleanup stale worktrees and lock files upon a push.
• Use the GitLab version as part of the appearances cache key.
• Fix Firefox stealing formatting characters on issue notes.
• Include matching branches and tags in protected branches / tags count. (Jan Beckmann)
• Fix 500 error when a merge request from a fork has conflicts and has not yet been updated.
• Test if remote repository exists when importing wikis.
• Hide emoji popup after multiple spaces. (Jan Beckmann)
• Fix relative uri when "#" is in branch name. (Jan)
• Escape Markdown characters properly when using autocomplete.
• Ignore project internal references in group context.
• Fix finding wiki file when Gitaly is enabled.
• Fix listing commit branch/tags that contain special characters.
• Ensure internal users (ghost, support bot) get assigned a namespace.
• Fix links to subdirectories of a directory with a plus character in its path.

Deprecated (1 change)

• Remove support for legacy tar.gz pages artifacts. !18090

Changed (22 changes, 2 of them are from the community)

• Add yellow favicon when CANARY=true to differientate canary environment. !12477
• Use human readable value build_timeout in Project. !17386
• Improved visual styles and consistency for commit hash and possible actions across commit lists. !17406
• Don't create permanent redirect routes. !17521
• Add empty repo check before running AutoDevOps pipeline. !17605
• Update wording to specify create/manage project vs group labels in labels dropdown. !17640
• Add tooltips to icons in lists of issues and merge requests. !17700
• Change avatar error message to include allowed file formats. !17747 (Fabian Schneider)
• Polish design for verifying domains. !17767
• Move email footer info to a single line. !17916
• Add average and maximum summary statistics to the prometheus dashboard. !17921
• Add additional cluster usage metrics to usage ping. !17922
• Move 'Registry' after 'CI/CD' in project navigation sidebar. !18018 (Elias Werberich)
• Redesign application settings to match project settings. !18019
• Allow HTTP(s) when git request is made by GitLab CI. !18021
• Added hover background color to IDE file list rows.
• Make project avatar in IDE consistent with the rest of GitLab.
• Show issues of subgroups in group-level issue board.
• Repository checksum calculation is handled by Gitaly when feature is enabled.
• Allow viewing timings for AJAX requests in the performance bar.
• Fixes remove source branch checkbox being visible when user cannot remove the branch.
• Make /-/ delimiter optional for search endpoints.

Performance (24 changes, 11 of them are from the community)

• Move AssigneeTitle vue component. !17397 (George Tsiolis)
• Move TimeTrackingCollapsedState vue component. !17399 (George Tsiolis)
• Move MemoryGraph and MemoryUsage vue components. !17533 (George Tsiolis)
• Move UnresolvedDiscussions vue component. !17538 (George Tsiolis)
• Move NothingToMerge vue component. !17544 (George Tsiolis)
• Move ShaMismatch vue component. !17546 (George Tsiolis)
• Stop caching highlighted diffs in Redis unnecessarily. !17746
• Add i18n and update specs for ShaMismatch vue component. !17870 (George Tsiolis)
• Update spec import path for vue mount component helper. !17880 (George Tsiolis)
• Move TimeTrackingComparisonPane vue component. !17931 (George Tsiolis)
• Improves the performance of projects list page. !17934
• Remove N+1 query for Noteable association. !17956
• Improve performance of loading issues with lots of references to merge requests. !17986
• Reuse root_ref_hash for performance on Branches. !17998 (Takuya Noguchi)
• Update asciidoctor-plantuml to 0.0.8. !18022 (Takuya Noguchi)
• Cache personal projects count. !18197
• Reduce complexity of issuable finder query. !18219
• Reduce number of queries when viewing a merge request.
• Free open file descriptors and libgit2 buffers in UpdatePagesService.
• Memoize Git::Repository#has_visible_content?.
• Require at least one filter when listing issues or merge requests on dashboard page.
• lazy load diffs on merge request discussions.
• Bulk deleting refs is handled by Gitaly by default.
• ListCommitsByOid is executed by Gitaly by default.

Added (38 changes, 7 of them are from the community)

• Add HTTPS-only pages. !16273 (rfwatson)
• adds closed by informations in issue api. !17042 (haseebeqx)
• Projects and groups badges settings UI. !17114
• Add per-runner configured job timeout. !17221
• Add alternate archive route for simplified packaging. !17225
• Add support for pipeline variables expressions in only/except. !17316
• Add object storage support for LFS objects, CI artifacts, and uploads. !17358
• Added confirmation modal for changing username. !17405
• Implement foreground verification of CI artifacts. !17578
• Extend API for exporting a project with direct upload URL. !17686
• Move ci/lint under project's namespace. !17729
• Add Total CPU/Memory consumption metrics for Kubernetes. !17731
• Adds the option to the project export API to override the project description and display GitLab export description once imported. !17744
• Port direct upload of LFS artifacts from EE. !17752
• Adds support for OmniAuth JWT provider. !17774
• Display error message on job's tooltip if this one fails. !17782
• Add 'Assigned Issues' and 'Assigned Merge Requests' as dashboard view choices for users. !17860 (Elias Werberich)
• Extend API for importing a project export with overwrite support. !17883
• Create Deploy Tokens to allow permanent access to repository and registry. !17894
• Detect commit message trailers and link users properly to their accounts on GitLab. !17919 (cousine)
• Adds cancel btn to new pages domain page. !18026 (Jacopo Beschi @jacopo-beschi)
• API: Add parameter merge_method to projects. !18031 (Jan Beckmann)
• Introduce simpler env vars for auto devops REPLICAS and CANARY_REPLICAS #41436. !18036
• Allow overriding params on project import through API. !18086
• Support LFS objects when importing/exporting GitLab project archives. !18115
• Store sha256 checksum of artifact metadata. !18149
• Limit the number of failed logins when using LDAP for authentication. !43525
• Allow assigning and filtering issuables by ancestor group labels.
• Include subgroup issues when searching for group issues using the API.
• Allow to store uploads by default on Object Storage.
• Add slash command for moving issues. (Adam Pahlevi)
• Render MR commit SHA instead "diffs" when viable.
• Send @mention notifications even if a user has explicitly unsubscribed from item.
• Add support for Sidekiq JSON logging.
• Add Gitaly call details to performance bar.
• Add support for patch link extension for commit links on GitLab Flavored Markdown.
• Allow feature gates to be removed through the API.
• Allow merge requests related to a commit to be found via API.

Other (27 changes, 11 of them are from the community)

• Send notification emails when push to a merge request. !7610 (YarNayar)
• Rename modal.vue to deprecated_modal.vue. !17438
• Atomic generation of internal ids for issues. !17580
• Use object ID to prevent duplicate keys Vue warning on Issue Boards page during development. !17682
• Update foreman from 0.78.0 to 0.84.0. !17690 (Takuya Noguchi)
• Add realtime pipeline status for adding/viewing files. !17705
• Update documentation to reflect current minimum required versions of node and yarn. !17706
• Update knapsack to 1.16.0. !17735 (Takuya Noguchi)
• Update CI services documnetation. !17749
• Added i18n support for the prometheus memory widget. !17753
• Use specific names for filtered CI variable controller parameters. !17796
• Apply NestingDepth (level 5) (framework/dropdowns.scss). !17820 (Takuya Noguchi)
• Clean up selectors in framework/header.scss. !17822 (Takuya Noguchi)
• Bump state_machines-activerecord to 0.5.1. !17924 (blackst0ne)
• Increase the memory limits used in the unicorn killer. !17948
• Replace the spinach test with an rspec analog. !17950 (blackst0ne)
• Remove unused index from events table. !18014
• Make all workhorse gitaly calls opt-out, take 2. !18043
• Update brakeman 3.6.1 to 4.2.1. !18122 (Takuya Noguchi)
• Replace the project/issues/labels.feature spinach test with an rspec analog. !18126 (blackst0ne)
• Bump html-pipeline to 2.7.1. !18132 (@blackst0ne)
• Remove test_ci rake task. !18139 (Takuya Noguchi)
• Add documentation for Pipelines failure reasons. !18352
• Improve JIRA event descriptions.
• Add query counts to profiler output.
• Move Sidekiq exporter logs to log/sidekiq_exporter.log.
• Upgrade Gitaly to upgrade its charlock_holmes.

10.6.6 (2018-05-28)

Security (4 changes)

• Do not allow non-members to create MRs via forked projects when MRs are private.
• Prevent user passwords from being changed without providing the previous password.
• Fix API to remove deploy key from project instead of deleting it entirely.
• Fixed bug that allowed importing arbitrary project attributes.

10.6.5 (2018-04-24)

Security (1 change)

• Sanitizes user name to avoid XSS attacks.

10.6.4 (2018-04-09)

Fixed (8 changes, 1 of them is from the community)

• Correct copy text for the promote milestone and label modals. !17726
• Avoid validation errors when running the Pages domain verification service. !17992
• Fix autolinking URLs containing ampersands. !18045
• Fix exceptions raised when migrating pipeline stages in the background. !18076
• Work around Prometheus Helm chart name changes to fix integration. !18206 (joshlambert)
• Don't show Jump to Discussion button on Issues.
• Fix listing commit branch/tags that contain special characters.
• Fix 404 in group boards when moving issue between lists.

Performance (1 change)

• Free open file descriptors and libgit2 buffers in UpdatePagesService.

10.6.3 (2018-04-03)

Security (2 changes)

• Fix XSS on diff view stored on filenames.
• Adds confidential notes channel for Slack/Mattermost.

10.6.2 (2018-03-29)

Fixed (2 changes, 1 of them is from the community)

• Don't capture trailing punctuation when autolinking. !17965
• Cloning a repository over HTTPS with LDAP credentials causes a HTTP 401 Access denied. (Horatiu Eugen Vlad)

10.6.1 (2018-03-27)

Security (1 change)

• Bump rails-html-sanitizer to 1.0.4.

Fixed (2 changes)

• Prevent auto-retry AccessDenied error from stopping transition to failed. !17862
• Fix 500 error when trying to resolve non-ASCII conflicts in the editor. !17962

Performance (1 change)

• Add indexes for user activity queries. !17890

Other (1 change)

• Add documentation for runner IP address (#44232). !17837

10.6.0 (2018-03-22)

Security (4 changes)

• Fixed some SSRF vulnerabilities in services, hooks and integrations. !2337
• Ensure that OTP backup codes are always invalidated.
• Add verification for GitLab Pages custom domains.
• Fix GitLab Auth0 integration signing in the wrong user.

Fixed (75 changes, 17 of them are from the community)

• Ensure users cannot create environments with leading or trailing slashes (Fixes #39885). !15273
• Fix new project path input overlapping. !16755 (George Tsiolis)
• Respect description and visibility when creating project from template. !16820 (George Tsiolis)
• Remove user notification settings for groups and projects when user leaves. !16906 (Jacopo Beschi @jacopo-beschi)
• Fix Teleporting Emoji. !16963 (Jared Deckard jared.deckard@gmail.com)
• Fix duplicate system notes when merging a merge request. !17035
• Fix breadcrumb on labels page for groups. !17045 (Onuwa Nnachi Isaac)
• Fix user avatar's vertical align on the issues and merge requests pages. !17072 (Laszlo Karpati)
• Fix settings panels not expanding when fragment hash linked. !17074
• Fix 404 when listing archived projects in a group where all projects have been archived. !17077 (Ashley Dumaine)
• Allow to call PUT /projects/:id API with only ci_config_path specified. !17105 (Laszlo Karpati)
• Fix long list of recipients on group request membership email. !17121 (Jacopo Beschi @jacopo-beschi)
• Remove duplicated error message on duplicate variable validation. !17135
• Keep "Import project" tab/form active when validation fails trying to import "Repo by URL". !17136
• Fixed bug with unauthenticated requests through git ssh. !17149
• Allows project rename after validation error. !17150
• Fix "Remove source branch" button in Merge request widget during merge when pipeline succeeds state. !17192
• Add missing pagination on the commit diff endpoint. !17203 (Maxime Roussin-Bélanger)
• Fix get a single pages domain when project path contains a period. !17206 (Travis Miller)
• remove avater underline. !17219 (Ken Ding)
• Allows the usage of /milestone quick action for group milestones. !17239 (Jacopo Beschi @jacopo-beschi)
• Encode branch name as binary before creating a RPC request to copy attributes. !17291
• Restart Unicorn and Sidekiq when GRPC throws 14:Endpoint read failed. !17293
• Do not persist Google Project verification flash errors after a page reload. !17299
• Ensure group issues and merge requests pages show results from subgroups when there are no results from the current group. !17312
• Prevent trace artifact migration to incur data loss. !17313
• Fixes gpg popover layout. !17323
• Return a 404 instead of 403 if the repository does not exist on disk. !17341
• Fix Slack/Mattermost notifications not respecting notify_only_default_branch setting for pushes. !17345
• Fix Group labels load failure when there are duplicate labels present. !17353
• Allow Prometheus application to be installed from Cluster applications. !17372
• Fixes Prometheus admin configuration page. !17377
• Enable filtering MR list based on clicked label in MR sidebar. !17390
• Fix code and wiki search results pages when non-ASCII text is displayed. !17413
• Count comments on diffs and discussions as contributions for the contributions calendar. !17418 (Riccardo Padovani)
• Add Assignees vue component missing data container. !17426 (George Tsiolis)
• Update tooltip on pipeline cancel to Stop (#42946). !17444
• Removing the two factor check when the user sets a new password. !17457
• Fix quick actions for users who cannot update issues and merge requests. !17482
• Stop loading spinner on error of milestone update on issue. !17507 (Takuya Noguchi)
• Set margins around dropdown dividers to 4px. !17517
• Fix pages flaky failure by reloading stale object. !17522
• Remove extra breadcrumb on tags. !17562 (Takuya Noguchi)
• Fix missing uploads after group transfer. !17658
• Fix markdown table showing extra column. !17669
• Ensure the API returns https links when https is configured. !17681
• Sanitize extra blank spaces used when uploading a SSH key. !40552
• Render htmlentities correctly for links not supported by Rinku.
• Keep link when redacting unauthorized object links.
• Handle empty state in Pipelines page.
• Revert Project.public_or_visible_to_user changes and only apply to snippets.
• Release libgit2 cache and open file descriptors after git gc run.
• Fix project dashboard showing the wrong timestamps.
• Fix "Can't modify frozen hash" error when project is destroyed.
• Fix Error 500 when viewing a commit with a GPG signature in Geo.
• Don't error out in system hook if user has nil datetime columns.
• Remove double caching of Repository#empty?.
• Don't delete todos or unassign issues and MRs when a user leaves a project.
• Don't cache a nil repository root ref to prevent caching issues.
• Escape HTML entities in commit messages.
• Verify project import status again before marking as failed.
• [GitHub Import] Create an empty wiki if wiki import failed.
• Create empty wiki when import from GitLab and wiki is not there.
• Make sure wiki exists when it's enabled.
• Fix broken loading state for close issue button.
• Fix code and wiki search results when filename is non-ASCII.
• Fix file upload on project show page.
• Fix squashing when a file is renamed.
• Show loading button inline in refresh button in MR widget.
• Fix close button on issues not working on mobile.
• Adds tooltip in environment names to increase readability.
• Fixed issue edit shortcut not opening edit form.
• Fix 500 error being shown when diff has context marker with invalid encoding.
• Render modified icon for moved file in changes dropdown.
• Remember assignee when moving an issue.

Changed (16 changes, 9 of them are from the community)

• Allow including custom attributes in API responses. !16526 (Markus Koller)
• Apply new default and inline label design. !16956 (George Tsiolis)
• Remove whitespace from the username/email sign in form field. !17020 (Peter lauck)
• CI charts now include the current day. !17032 (Dakkaron)
• Hide CI secret variable values after saving. !17044
• Add new modal Vue component. !17108
• Asciidoc now support inter-document cross references between files in repository. !17125 (Turo Soisenniemi)
• Update issue closing pattern to allow variations in punctuation. !17198 (Vicky Chijwani)
• Add a button to deploy a runner to a Kubernetes cluster in the settings page. !17278
• Pages custom domain: allow update of key/certificate. !17376 (rfwatson)
• Clear the Labels dropdown search filter after a selection is made. !17393 (Andrew Torres)
• Hook data for pipelines includes detailed_status. !17607
• Avoid showing unnecessary Trigger checkboxes for project Integrations with only one event. !17607
• Display a link to external issue tracker when enabled.
• Allow token authentication on go-get request.
• Update SSH key link to include existing keys. (Brendan O'Leary)

Performance (24 changes, 5 of them are from the community)

• Add catch-up background migration to migrate pipeline stages. !15741
• Move BoardNewIssue vue component. !16947 (George Tsiolis)
• Move IssuableTimeTracker vue component. !16948 (George Tsiolis)
• Move RecentSearchesDropdownContent vue component. !16951 (George Tsiolis)
• Move Assignees vue component. !16952 (George Tsiolis)
• Improve performance of pipeline page by reducing DB queries. !17168
• Store sha256 checksum to job artifacts. !17354
• Move SidebarAssignees vue component. !17398 (George Tsiolis)
• Improve database response time for user activity listing. !17454
• Use persisted/memoized value for MRs shas instead of doing git lookups. !17555
• Cache MergeRequests can_be_resolved_in_ui? git operations. !17589
• Prevent the graphs page from generating unnecessary Gitaly requests. !37602
• Use a user object in ApplicationHelper#avatar_icon where possible to avoid N+1 queries. !42800
• Submit a single batch blob RPC to Gitaly per HTTP request when viewing diffs.
• Avoid re-fetching merge-base SHA from Gitaly unnecessarily.
• Don't use ProjectsFinder in TodosFinder.
• Adding missing indexes on taggings table.
• Add index on section_name_id on ci_build_trace_sections table.
• Cache column_exists? for application settings.
• Cache table_exists?('application_settings') to reduce repeated schema reloads.
• Make --prune a configurable parameter in fetching a git remote.
• Fix timeouts loading /admin/projects page.
• Add partial indexes on todos to handle users with many todos.
• Optimize search queries on the search page by setting a limit for matching records in project scope.

Added (30 changes, 9 of them are from the community)

• Add CommonMark markdown engine (experimental). !14835 (blackst0ne)
• API: Get references a commit is pushed to. !15026 (Robert Schilling)
• Add overview of branches and a filter for active/stale branches. !15402 (Takuya Noguchi)
• Add project export API. !15860 (Travis Miller)
• expose more metrics in merge requests api. !16589 (haseebeqx)
• #28481: Display time tracking totals on milestone page. !16753 (Riccardo Padovani)
• Add a button on the project page to set up a Kubernetes cluster and enable Auto DevOps. !16900
• Include cycle time in usage ping data. !16973
• Add ability to use external plugins as an alternative to system hooks. !17003
• Add search param to Branches API. !17005 (bunufi)
• API endpoint for importing a project export. !17025
• Display ingress IP address in the Kubernetes page. !17052
• Implemented badge API endpoints. !17082
• Allow installation of GitLab Runner with a single click. !17134
• Allow commits endpoint to work over all commits of a repository. !17182
• Display Runner IP Address. !17286
• Add archive feature to trace. !17314
• Allow maintainers to push to forks of their projects when a merge request is open. !17395
• Foreground verification of uploads and LFS objects. !17402
• Adds updated_at filter to issues and merge_requests API. !17417 (Jacopo Beschi @jacopo-beschi)
• Port /wip quick action command to Merge Request creation (on description). !17463 (Adam Pahlevi)
• Add a paragraph about security implications on Cluster's page. !17486
• Add plugins list to the system hooks page. !17518
• Enable privileged mode for GitLab Runner. !17528
• Expose GITLAB_FEATURES as CI/CD variable (fixes #40994).
• Upgrade GitLab Workhorse to 4.0.0.
• Add discussions API for Issues and Snippets.
• Add one group board to Libre.
• Add support for filtering by source and target branch to merge requests API.

Other (18 changes, 7 of them are from the community)

• Group MRs on issue page by project and namespace. !8494 (Jeff Stubler)
• Make oauth provider login generic. !8809 (Horatiu Eugen Vlad)
• Add email button to new issue by email. !10942 (Islam Wazery)
• Update vue component naming guidelines. !17018 (George Tsiolis)
• Added new design for promotion modals. !17197
• Update to github-linguist 5.3.x. !17241 (Ken Ding)
• update toml-rb to 1.0.0. !17259 (Ken Ding)
• Keep track of projects a user interacted with. !17327
• Moved o_auth/saml/ldap modules under gitlab/auth. !17359 (Horatiu Eugen Vlad)
• Enables eslint in codeclimate job. !17392
• Port Labels Select dropdown to Vue. !17411
• Add NOT NULL constraint to projects.namespace_id. !17448
• Ensure foreign keys on clusters applications. !17488
• Started translation into Turkish, Indonesian and Filipino. !17526
• Add documentation for displayed K8s Ingress IP address (#44330). !17836
• Move Ruby endpoints to OPT_OUT.
• Upgrade Workhorse to version 3.8.0 to support structured logging.
• Use host URL to build JIRA remote link icon.

10.5.8 (2018-04-24)

Security (1 change)

• Sanitizes user name to avoid XSS attacks.

10.5.7 (2018-04-03)

Security (2 changes)

• Fix XSS on diff view stored on filenames.
• Adds confidential notes channel for Slack/Mattermost.

10.5.6 (2018-03-16)

Security (2 changes)

• Fixed some SSRF vulnerabilities in services, hooks and integrations. !2337
• Fix GitLab Auth0 integration signing in the wrong user.

10.5.5 (2018-03-15)

Fixed (3 changes)

• Fix missing uploads after group transfer. !17658
• Fix code and wiki search results when filename is non-ASCII.
• Remove double caching of Repository#empty?.

Performance (2 changes)

• Adding missing indexes on taggings table.
• Add index on section_name_id on ci_build_trace_sections table.

10.5.4 (2018-03-08)

Fixed (11 changes)

• Encode branch name as binary before creating a RPC request to copy attributes. !17291
• Restart Unicorn and Sidekiq when GRPC throws 14:Endpoint read failed. !17293
• Ensure group issues and merge requests pages show results from subgroups when there are no results from the current group. !17312
• Prevent trace artifact migration to incur data loss. !17313
• Return a 404 instead of 403 if the repository does not exist on disk. !17341
• Allow Prometheus application to be installed from Cluster applications. !17372
• Fixes Prometheus admin configuration page. !17377
• Fix code and wiki search results pages when non-ASCII text is displayed. !17413
• Fix pages flaky failure by reloading stale object. !17522
• Fixed issue edit shortcut not opening edit form.
• Revert Project.public_or_visible_to_user changes and only apply to snippets.

Performance (1 change)

• Don't use ProjectsFinder in TodosFinder.

10.5.3 (2018-03-01)

Security (1 change)

• Ensure that OTP backup codes are always invalidated.

10.5.2 (2018-02-25)

Fixed (7 changes)

• Fix single digit value clipping for stacked progress bar. !17217
• Fix issue with cache key being empty when variable used as the key. !17260
• Enable Legacy Authorization by default on Cluster creations. !17302
• Allow branch names to be named the same as the sha it points to.
• Fix 500 error when loading an invalid upload URL.
• Don't attempt to update user tracked fields if database is in read-only.
• Prevent MR Widget error when no CI configured.

Performance (5 changes)

• Improve query performance for snippets dashboard. !17088
• Only check LFS integrity for first ref in a push to avoid timeout. !17098
• Improve query performance of MembersFinder. !17190
• Increase feature flag cache TTL to one hour.
• Improve performance of searching for and autocompleting of users.

10.5.1 (2018-02-22)

• No changes.

10.5.0 (2018-02-22)

Security (3 changes, 1 of them is from the community)

• Update marked from 0.3.6 to 0.3.12. !16480 (Takuya Noguchi)
• Update nokogiri to 1.8.2. !16807
• Add verification for GitLab Pages custom domains.

Fixed (77 changes, 25 of them are from the community)

• Fix the Projects API with_issues_enabled filter behaving incorrectly any user. !12724 (Jan Christophersen)
• Hide pipeline schedule take ownership for current owner. !12986
• Handle special characters on API request of issuable templates. !15323 (Takuya Noguchi)
• Shows signin tab after new user email confirmation. !16174 (Jacopo Beschi @jacopo-beschi)
• Make project README containers wider on fixed layout. !16181 (Takuya Noguchi)
• Fix dashboard projects nav links height. !16204 (George Tsiolis)
• Fix error on empty query for Members API. !16235
• Issue board: fix for dragging an issue to the very bottom in long lists. !16250 (David Kuri)
• Make rich blob viewer wider for PC. !16262 (Takuya Noguchi)
• Substitute deprecated ui_charcoal with new default ui_indigo. !16271 (Takuya Noguchi)
• Generate HTTP URLs for custom Pages domains when appropriate. !16279
• Make modal dialog common for Groups tree app. !16311
• Allow moving wiki pages from the UI. !16313
• Filter groups and projects dropdowns of search page on backend. !16336
• Adjust layout width for fixed layout. !16337 (George Tsiolis)
• Fix custom header logo design nitpick: Remove unneeded margin on empty logo text. !16383 (Markus Doits)
• File Upload UI can create LFS pointers based on .gitattributes. !16412
• Fix Ctrl+Enter keyboard shortcut saving comment/note edit. !16415
• Fix file search results when they match file contents with a number between two colons. !16462
• Fix tooltip displayed for running manual actions. !16489
• Allow trailing + on labels in board filters. !16490
• Prevent JIRA issue identifier from being humanized. !16491 (Andrew McCallum)
• Add horizontal scroll to wiki tables. !16527 (George Tsiolis)
• Fix a bug calculating artifact size for project statistics. !16539
• Stop loading spinner on error of issuable templates. !16600 (Takuya Noguchi)
• Allows html text in commits atom feed. !16603 (Jacopo Beschi @jacopo-beschi)
• Disable MR check out button when source branch is deleted. !16631 (Jacopo Beschi @jacopo-beschi)
• Fix export removal for hashed-storage projects within a renamed or deleted namespace. !16658
• Default to HTTPS for all Gravatar URLs. !16666
• Login via OAuth now only marks new users as external. !16672
• Fix default avatar icon missing when Gravatar is disabled. !16681 (Felix Geyer)
• Change button group width on mobile. !16726 (George Tsiolis)
• Fix version information not showing on help page if commercial content display was disabled. !16743
• Adds spacing between edit and delete tag btn in tag list. !16757 (Jacopo Beschi @jacopo-beschi)
• Fix 500 error when loading a merge request with an invalid comment. !16795
• Deleting an upload will correctly clean up the filesystem. !16799
• Cleanup new branch/merge request form in issues. !16854
• Fix GitLab import leaving group_id on ProjectLabel. !16877
• Fix forking projects when no restricted visibility levels are defined applicationwide. !16881
• Trigger change event on filename input when file template is applied. !16911 (Sebastian Klingler)
• Fixes different margins between buttons in tag list. !16927 (Jacopo Beschi @jacopo-beschi)
• Close low level rugged repository in project cache worker. !16930 (Bastian Blank)
• Override group sidebar links. !16942 (George Tsiolis)
• Avoid running PopulateForkNetworksRange-migration multiple times. !16988
• Resolve PrepareUntrackedUploads PostgreSQL syntax error. !17019
• Fix monaco editor features which were incompatible with GitLab CDN settings. !17021
• Fixed error 500 when removing an identity with synced attributes and visiting the profile page. !17054
• Fix cnacel edit note button reverting changes. !42462
• For issues display time of last edit of title or description instead of time of any attribute change.
• Handle all Psych YAML parser exceptions (fixes #41209).
• Fix validation of environment scope of variables.
• Display user friendly error message if rebase fails.
• Hide new branch and tag links for projects with an empty repo.
• Fix protected branches API to accept name parameter with dot.
• Closes #38540 - Remove .ssh/environment file that now breaks the gitlab:check rake task.
• Keep subscribers when promoting labels to group labels.
• Replace verified badge icons and uniform colors.
• Fix error on changes tab when merge request cannot be created.
• Ignore leading slashes when searching for files within context of repository. (Andrew McCallum)
• Close and do not reload MR diffs when source branch is deleted.
• Bypass commits title markdown on notes.
• Reload MRs memoization after diffs creation.
• Return more consistent values for merge_status on MR APIs.
• Contribution calendar label was cut off. (Branka Martinovic)
• LDAP Person no longer throws exception on invalid entry.
• Fix bug where award emojis would be lost when moving issues between projects.
• Fix not all events being shown in group dashboard.
• Fix JIRA not working when a trailing slash is included.
• Fix squash not working when diff contained non-ASCII data.
• Remove erroneous text in shared runners page that suggested more runners available.
• Execute system hooks after-commit when executing project hooks.
• Makes forking protect default branch on completion.
• Validate user, group and project paths consistently, and only once.
• Validate user namespace before saving so that errors persist on model.
• Permits 'password_authentication_enabled_for_git' parameter for ApplicationSettingsController.
• Fix duplicate item in protected branch/tag dropdown.
• Open visibility level help in a new tab. (Jussi Räsänen)

Deprecated (1 change)

• Add note within ux documentation that further changes should be made within the design.gitlab project.

Changed (20 changes, 7 of them are from the community)

• Show coverage to two decimal points in coverage badge. !10083 (Jeff Stubler)
• Update 'removed assignee' note to include old assignee reference. !16301 (Maurizio De Santis)
• Move row containing Projects, Users and Groups count to the top in admin dashboard. !16421
• Add Auto DevOps Domain application setting. !16604
• Changes Revert this merge request text. !16611 (Jacopo Beschi @jacopo-beschi)
• Link Auto DevOps settings to Clusters page. !16641
• Internationalize charts page. !16687 (selrahman)
• Internationalize graph page selrahman. !16688 (Shah El-Rahman)
• Save traces as artifacts. !16702
• Hide variable values on pipeline schedule edit page. !16729
• Update runner info on all authenticated requests. !16756
• Improve issue note dropdown and mr button. !16758 (George Tsiolis)
• Replace "cluster" with "Kubernetes cluster". !16778
• Enable Prometheus metrics for deployed Ingresses. !16866 (joshlambert)
• Rename button to enable CI/CD configuration to "Set up CI/CD". !16870
• Double padding for file-content wiki class on larger screens.
• Improve wording about additional costs for Ingress on custom clusters.
• Last push widget will show banner for new pushes to previously merged branch.
• Save user ID and username in Grape API log (api_json.log).
• Include subgroup issues and merge requests on the group page.

Performance (14 changes, 1 of them is from the community)

• Fix double query execution on groups page. !16314
• Speed up loading merged merge requests when they contained a lot of commits before merging. !16320
• Properly memoize some predicate methods. !16329
• Reduce the number of Prometheus metrics. !16443
• Only highlight search results under the highlighting size limit. !16462
• Add fast-blank. !16468
• Move BoardList vue component to vue file. !16888 (George Tsiolis)
• Fix N+1 query problem for snippets dashboard. !16944
• Optimize search queries on the search page by setting a limit for matching records.
• Store number of commits in merge_request_diffs table.
• Improve performance of target branch dropdown.
• Remove duplicate calls of MergeRequest#can_be_reverted?.
• Stop checking if discussions are in a mergeable state if the MR isn't.
• Remove N+1 queries with /projects/:project_id/{access_requests,members} API endpoints.

Added (28 changes, 10 of them are from the community)

• Add link on commit page to merge request that introduced that commit. !13713 (Hiroyuki Sato)
• System hooks for Merge Requests. !14387 (Alexis Reigel)
• Add pipelines endpoint to merge requests API. !15454 (Tony Rom thetonyrom@gmail.com)
• Adds Rubocop rule for line break around conditionals. !15739 (Jacopo Beschi @jacopo-beschi)
• Add Colors to GitLab Flavored Markdown. !16095 (Tony Rom thetonyrom@gmail.com)
• Initial work to add notification reason to emails. !16160 (Mario de la Ossa)
• Implement multi server support and use kube proxy to connect to Prometheus servers inside K8S cluster. !16182
• Add ability to transfer a group into another group. !16302
• Add blue dot feature highlight to make GKE Clusters more visible to users. !16379
• Add section headers to plus button dropdown. !16394 (George Tsiolis)
• Support PostgreSQL 10. !16471
• Enables Project Milestone Deletion via the API. !16478 (Jacopo Beschi @jacopo-beschi)
• Add realtime ci status for the repository -> files view. !16523
• User can now git push to create a new project. !16547
• Improve empty project overview. !16617 (George Tsiolis)
• Added uploader metadata to the uploads. !16779
• Added ldap config setting to lower case the username. !16791
• Add search support into the API. !16878
• Backport of LFS File Locking API. !16935
• Add a link to documentation on how to get external ip in the Kubernetes cluster details page. !16937
• Add sorting options for /users API (admin only). !16945
• Adds sorting to deployments API. (Jacopo Beschi @jacopo-beschi)
• Add rake task to check integrity of uploaded files.
• Add backend for persistently dismissably callouts.
• Track and act upon the number of executed queries.
• Add a gRPC health check to ensure Gitaly is up.
• Log and send a system hook if a blocked user attempts to login.
• Add Gitaly Servers admin dashboard.

Other (25 changes, 7 of them are from the community)

• Updated the katex library. !15864
• Add modal for deleting a milestone. !16229
• Remove unused CSS selectors for Cycle Analytics. !16270 (Takuya Noguchi)
• Add reason to keep postgresql 9.2 for CI. !16277 (Takuya Noguchi)
• Adjust modal style to new design. !16310
• Default to Gitaly for 'git push' HTTP/SSH, and make Gitaly mandatory for SSH pull. !16586
• Set timezone for karma to UTC. !16602 (Takuya Noguchi)
• Make Gitaly RepositoryExists opt-out. !16680
• Update minimum git version to 2.9.5. !16683
• Disable throwOnError in KaTeX to reveal user where is the problem. !16684 (Jakub Jirutka)
• fix documentation about node version. !16720 (Tobias Gurtzick)
• Enable RuboCop Style/RegexpLiteral. !16752 (Takuya Noguchi)
• Add confirmation-input component. !16816
• Add unique constraint to trending_projects#project_id. !16846
• Add foreign key and NOT NULL constraints to todos table. !16849
• Include branch in mobile view for pipelines. !16910 (George Tsiolis)
• Downgrade google-protobuf gem. !16941
• Refactors mr widget components into vue files and adds i18n.
• increase-readability-of-colored-text-in-job-output-log.
• Finish any remaining jobs for issues.closed_at.
• Translate issuable sidebar.
• Set standard disabled state for all buttons.
• Upgrade GitLab Workhorse to v3.6.0.
• Improve readability of underlined links for dyslexic users.
• Adds empty state illustration for pending job.

10.4.7 (2018-04-03)

Security (2 changes)

• Fix XSS on diff view stored on filenames.
• Adds confidential notes channel for Slack/Mattermost.

10.4.6 (2018-03-16)

Security (2 changes)

• Fixed some SSRF vulnerabilities in services, hooks and integrations. !2337
• Fix GitLab Auth0 integration signing in the wrong user.

10.4.5 (2018-03-01)

Security (1 change)

• Ensure that OTP backup codes are always invalidated.

10.4.4 (2018-02-16)

Security (1 change)

• Update nokogiri to 1.8.2. !16807

Fixed (9 changes)

• Fix 500 error when loading a merge request with an invalid comment. !16795
• Cleanup new branch/merge request form in issues. !16854
• Fix GitLab import leaving group_id on ProjectLabel. !16877
• Fix forking projects when no restricted visibility levels are defined applicationwide. !16881
• Resolve PrepareUntrackedUploads PostgreSQL syntax error. !17019
• Fixed error 500 when removing an identity with synced attributes and visiting the profile page. !17054
• Validate user namespace before saving so that errors persist on model.
• LDAP Person no longer throws exception on invalid entry.
• Fix JIRA not working when a trailing slash is included.

10.4.3 (2018-02-05)

Security (4 changes)

• Fix namespace access issue for GitHub, BitBucket, and GitLab.com project importers.
• Fix stored XSS in code blocks that ignore highlighting.
• Fix wilcard protected tags protecting all branches.
• Restrict Todo API mark_as_done endpoint to the user's todos only.

10.4.2 (2018-01-30)

Fixed (6 changes)

• Fix copy/paste on iOS devices due to a bug in webkit. !15804
• Fix missing "allow users to request access" option in public project permissions. !16485
• Fix encoding issue when counting commit count. !16637
• Fixes destination already exists, and some particular service errors on Import/Export error. !16714
• Fix cache clear bug withg using : on Windows. !16740
• Use has_table_privilege for TRIGGER on PostgreSQL.

Changed (1 change)

• Vendor Auto DevOps template with DAST security checks enabled. !16691

10.4.1 (2018-01-24)

Fixed (4 changes)

• Ensure that users can reclaim a namespace or project path that is blocked by an orphaned route. !16242
• Correctly escape UTF-8 path elements for uploads. !16560
• Fix issues when rendering groups and their children. !16584
• Fix bug in which projects with forks could not change visibility settings from Private to Public. !16595

Performance (2 changes)

• rework indexes on redirect_routes.
• Remove unnecessary query from labels filter.

10.4.0 (2018-01-22)

Security (8 changes, 1 of them is from the community)

• Upgrade Ruby to 2.3.6 to include security patches. !16016
• Prevent a SQL injection in the MilestonesFinder.
• Check user authorization for source and target projects when creating a merge request.
• Fix path traversal in gitlab-ci.yml cache:key.
• Fix writable shared deploy keys.
• Filter out sensitive fields from the project services API. (Robert Schilling)
• Fix RCE via project import mechanism.
• Prevent OAuth login POST requests when a provider has been disabled.

Fixed (68 changes, 24 of them are from the community)

• Update comment on image cursor and icons. !15760
• Fixes the wording of headers in system info page. !15802 (Gilbert Roulot)
• Reset todo counters when the target is deleted. !15807
• Execute quick actions (if present) when creating MR from issue. !15810
• fix build count in pipeline success mail. !15827 (Christiaan Van den Poel)
• Fix error that was preventing users to change the access level of access requests for Groups or Projects. !15832
• Last push event widget width for fixed layout. !15862 (George Tsiolis)
• Hide link to issues/MRs from labels list if issues/MRs are disabled. !15863 (Sophie Herold)
• Use relative URL for projects to avoid storing domains. !15876
• Fix gitlab-rake gitlab:import:repos import schedule. !15931
• Removed incorrect guidance stating blocked users will be removed from groups and project as members. !15947 (CesarApodaca)
• Fix some POST/DELETE requests in IE by switching some bundles to Axios for Ajax requests. !15951
• Fixing error 500 when member exist but not the user. !15970
• show None when issue is in closed list and no labels assigned. !15976 (Christiaan Van den Poel)
• Fix tags in the Activity tab not being clickable. !15996 (Mario de la Ossa)
• Disable Vue pagination when only one page of content is available. !15999 (Mario de la Ossa)
• disables shortcut to issue boards when issues are not enabled. !16020 (Christiaan Van den Poel)
• Ignore lost+found folder during backup on a volume. !16036 (Julien Millau)
• Fix abuse reports link url in admin area navbar. !16068 (megos)
• Keep typographic hierarchy in User Settings. !16090 (George Tsiolis)
• Adjust content width for User Settings, GPG Keys. !16093 (George Tsiolis)
• Fix gitlab-rake gitlab:import:repos import schedule. !16115
• Fix import project url not updating project name. !16120
• Fix activity inline event line height on mobile. !16121 (George Tsiolis)
• Fix slash commands dropdown description mis-alignment on Firefox. !16125 (Maurizio De Santis)
• Remove unnecessary sidebar element realignment. !16159 (George Tsiolis)
• User#projects_limit remove DB default and added NOT NULL constraint. !16165 (Mario de la Ossa)
• Fix API endpoints to edit wiki pages where project belongs to a group. !16170
• Fix breadcrumbs in User Settings. !16172 (rfwatson)
• Move 2FA disable button. !16177 (George Tsiolis)
• Fixing bug when wiki last version. !16197
• Protected branch is now created for default branch on import. !16198
• Prevent excessive DB load due to faulty DeleteConflictingRedirectRoutes background migration. !16205
• Force Auto DevOps kubectl version to 1.8.6. !16218
• Fix missing references to pipeline objects when restoring project with import/export feature. !16221
• Fix inconsistent downcase of filenames in prefilled Add commit messages. !16232 (James Ramsay)
• Default merge request title is set correctly again when external issue tracker is activated. !16356 (Ben305)
• Ensure that emails contain absolute, rather than relative, links to user uploads. !16364
• Prevent invalid Route path if path is unchanged. !16397
• Fixing rack request mime type when using rack attack. !16427
• Prevent RevList failing on non utf8 paths. !16440
• Fix giant fork icons on forks page. !16474
• Fix links to uploaded files on wiki pages. !16499
• Modify LDAP::Person to return username value based on attributes.
• Fixed merge request status badge not updating after merging.
• Remove related links in MR widget when empty state.
• Gracefully handle garbled URIs in Markdown.
• Fix hooks not being set up properly for bare import Rake task.
• Fix Mermaid drawings not loading on some browsers.
• Humanize the units of "Showing last X KiB of log" in job trace.
• Avoid leaving a push event empty if payload cannot be created.
• Show authored date rather than committed date on the commit list.
• Fix when branch creation fails don't post system note. (Mateusz Bajorski)
• Fix viewing merge request diffs where the underlying blobs are unavailable.
• Fix 500 error when visiting a commit where the blobs do not exist.
• Set target_branch to the ref branch when creating MR from issue.
• Fix closed text for issues on Todos page.
• [API] Fix creating issue when assignee_id is empty.
• Fix false positive issue references in merge requests caused by header anchor links.
• Fixed chanages dropdown ellipsis positioning.
• Fix shortcut links on help page.
• Clears visual token on second backspace. (Martin Wortschack)
• Fix onion-skin re-entering state.
• fix button alignment on MWPS component.
• Add optional search param for Merge Requests API.
• Normalizing Identity extern_uid when saving the record.
• Fixed typo for issue description field declaration. (Marcus Amargi)
• Fix ANSI 256 bold colors in pipelines job output.

Changed (18 changes, 3 of them are from the community)

• Make mail notifications of discussion notes In-Reply-To of each other. !14289
• Migrate existing data from KubernetesService to Clusters::Platforms::Kubernetes. !15589
• Implement checking GCP project billing status in cluster creation form. !15665
• Present multiple clusters in a single list instead of a tabbed view. !15669
• Remove soft removals related code. !15789
• Only mark import and fork jobs as failed once all Sidekiq retries get exhausted. !15844
• Translate date ranges on contributors page. !15846
• Update issuable status icons. !15898
• Update feature toggle design to use icons and make it i18n friendly. !15904
• Update groups tree to use GitLab SVG icons, add last updated at information for projects. !15980
• Allow forking a public project to a private group. !16050
• Expose project_id on /api/v4/pages/domains. !16200 (Luc Didry)
• Display graph values on hover within monitoring page. !16261
• removed tabindexes from tag form. (Marcus Amargi)
• Move edit button to second row on issue page (and change it to a pencil icon).
• Run background migrations with a minimum interval.
• Provide additional cookies to JIRA service requests to allow Oracle WebGates Basic Auth. (Stanislaw Wozniak)
• Hide markdown toolbar in preview mode.

Performance (11 changes)

• Improve the performance for counting diverging commits. Show 999+ if it is more than 1000 commits. !15963
• Treat empty markdown and html strings as valid cached text, not missing cache that needs to be updated.
• Cache merged and closed events data in merge_request_metrics table.
• Speed up generation of commit stats by using Rugged native methods.
• Improve search query for issues.
• Improve search query for merge requests.
• Eager load event target authors whenever possible.
• Use simple Next/Prev paging for jobs to avoid large count queries on arbitrarily large sets of historical jobs.
• Improve performance of MR discussions on large diffs.
• Add index on namespaces lower(name) for UsersController#exists.
• Fix timeout when filtering issues by label.

Added (26 changes, 8 of them are from the community)

• Support new chat notifications parameters in Services API. !11435
• Add online and status attribute to runner api entity. !11750
• Adds ordering to projects contributors in API. !15469 (Jacopo Beschi @jacopo-beschi)
• Add assets_sync gem to Gemfile. !15734
• Add a gitlab:tcp_check rake task. !15759
• add support for sorting in tags api. !15772 (haseebeqx)
• Add Prometheus to available Cluster applications. !15895
• Validate file status when committing multiple files. !15922
• List of avatars should never show +1. !15972 (Jacopo Beschi @jacopo-beschi)
• Do not generate NPM links for private NPM modules in blob view. !16002 (Mario de la Ossa)
• Backport fast database lookup of SSH authorized_keys from EE. !16014
• Add i18n helpers to branch comparison view. !16031 (James Ramsay)
• Add pause/resume button to project runners. !16032 (Mario de la Ossa)
• Added option to user preferences to enable the multi file editor. !16056
• Implement project jobs cache reset. !16067
• Rendering of emoji's in Group-Overview. !16098 (Jacopo Beschi @jacopo-beschi)
• Allow automatic creation of Kubernetes Integration from template. !16104
• API: get participants from merge_requests & issues. !16187 (Brent Greeff)
• Added option to disable commits stats in the commit endpoint. !16309
• Disable creation of new Kubernetes Integrations unless they're active or created from template. !41054
• Added badge to tree & blob views to indicate LFS tracked files.
• Enable ordering of groups and their children by name.
• Add button to run scheduled pipeline immediately.
• Allow user to rebase merge requests.
• Handle GitLab hashed storage repositories using the repo import task.
• Hide runner token in CI/CD settings page.

Other (12 changes, 3 of them are from the community)

• Adds the multi file editor as a new beta feature. !15430
• Use relative URLs when linking to uploaded files. !15751
• Add docs for why you might be signed out when using the Remember me token. !15756
• Replace '.team << [user, role]' with 'add_role(user)' in specs. !16069 (@blackst0ne)
• Add id to modal.vue to support data-toggle="modal". !16189
• Update scss-lint to 0.56.0. !16278 (Takuya Noguchi)
• Fix web ide user preferences copy and buttons. !41789
• Update redis-rack to 2.0.4.
• Import some code and functionality from gitlab-shell to improve subprocess handling.
• Update Browse file to Choose file in all occurrences.
• Bump mysql2 gem version from 0.4.5 to 0.4.10. (asaparov)
• Use a background migration for issues.closed_at.

10.3.9 (2018-03-16)

Security (3 changes)

• Fixed some SSRF vulnerabilities in services, hooks and integrations. !2337
• Update nokogiri to 1.8.2. !16807
• Fix GitLab Auth0 integration signing in the wrong user.

10.3.8 (2018-03-01)

Security (1 change)

• Ensure that OTP backup codes are always invalidated.

10.3.7 (2018-02-05)

Security (4 changes)

• Fix namespace access issue for GitHub, BitBucket, and GitLab.com project importers.
• Fix stored XSS in code blocks that ignore highlighting.
• Fix wilcard protected tags protecting all branches.
• Restrict Todo API mark_as_done endpoint to the user's todos only.

10.3.6 (2018-01-22)

Fixed (17 changes, 2 of them are from the community)

• Fix abuse reports link url in admin area navbar. !16068 (megos)
• Fix gitlab-rake gitlab:import:repos import schedule. !16115
• Fixing bug when wiki last version. !16197
• Prevent excessive DB load due to faulty DeleteConflictingRedirectRoutes background migration. !16205
• Default merge request title is set correctly again when external issue tracker is activated. !16356 (Ben305)
• Prevent invalid Route path if path is unchanged. !16397
• Fixing rack request mime type when using rack attack. !16427
• Prevent RevList failing on non utf8 paths. !16440
• Fix 500 error when visiting a commit where the blobs do not exist.
• Fix viewing merge request diffs where the underlying blobs are unavailable.
• Gracefully handle garbled URIs in Markdown.
• Fix hooks not being set up properly for bare import Rake task.
• Fix Mermaid drawings not loading on some browsers.
• Fixed chanages dropdown ellipsis positioning.
• Avoid leaving a push event empty if payload cannot be created.
• Set target_branch to the ref branch when creating MR from issue.
• Fix shortcut links on help page.

10.3.5 (2018-01-18)

• Fix error that prevented the 'deploy_keys' migration from working in MySQL databases.

10.3.4 (2018-01-10)

Security (7 changes, 1 of them is from the community)

• Prevent a SQL injection in the MilestonesFinder.
• Fix RCE via project import mechanism.
• Prevent OAuth login POST requests when a provider has been disabled.
• Filter out sensitive fields from the project services API. (Robert Schilling)
• Check user authorization for source and target projects when creating a merge request.
• Fix path traversal in gitlab-ci.yml cache:key.
• Fix writable shared deploy keys.

10.3.3 (2018-01-02)

Fixed (3 changes)

• Fix links to old commits in merge request comments.
• Fix 404 errors after a user edits an issue description and solves the reCAPTCHA.
• Gracefully handle orphaned write deploy keys in /internal/post_receive.

10.3.2 (2017-12-28)

Fixed (1 change)

• Fix migration for removing orphaned issues.moved_to_id values in MySQL and PostgreSQL.

10.3.1 (2017-12-27)

Fixed (3 changes)

• Don't link LFS objects to a project when unlinking forks when they were already linked. !16006
• Execute project hooks and services after commit when moving an issue.
• Fix Error 500s with anonymous clones for a project that has moved.

Changed (1 change)

• Reduce the number of buckets in gitlab_cache_operation_duration_seconds metric. !15881

10.3.0 (2017-12-22)

Security (1 change, 1 of them is from the community)

• Upgrade jQuery to 2.2.4. !15570 (Takuya Noguchi)

Fixed (55 changes, 8 of them are from the community)

• Fail jobs if its dependency is missing. !14009
• Fix errors when selecting numeric-only labels in the labels autocomplete selector. !14607 (haseebeqx)
• Fix pipeline status transition for single manual job. This would also fix pipeline duration becuse it is depending on status transition. !15251
• Fix acceptance of username for Mattermost service update. !15275
• Set the default gitlab-shell timeout to 3 hours. !15292
• Make sure a user can add projects to subgroups they have access to. !15294
• OAuth identity lookups case-insensitive. !15312
• Fix filter by my reaction is not working. !15345 (Hiroyuki Sato)
• Avoid deactivation when pipeline schedules execute a branch includes [ci skip] comment. !15405
• Add recaptcha modal to issue updates detected as spam. !15408
• Fix item name and namespace text overflow in Projects dropdown. !15451
• Removed unused rake task, 'rake gitlab:sidekiq:drop_post_receive'. !15493
• Fix commits page throwing 500 when the multi-file editor was enabled. !15502
• Fix Issue comment submit button being disabled when pasting content from another GFM note. !15530
• Reenable Prometheus metrics, add more control over Prometheus method instrumentation. !15558
• Fix broadcast message not showing up on login page. !15578
• Initializes the branches dropdown when the 'Start new pipeline' failed due to validation errors. !15588 (Christiaan Van den Poel)
• Fix merge requests where the source or target branch name matches a tag name. !15591
• Create a fork network for forks with a deleted source. !15595
• Fix search results when a filename would contain a special character. !15606 (haseebeqx)
• Strip leading & trailing whitespaces in CI/CD secret variable keys. !15615
• Correctly link to a forked project from the new fork page. !15653
• Fix the fork project functionality for projects with hashed storage. !15671
• Added default order to UsersFinder. !15679
• Fix graph notes number duplication. !15696 (Vladislav Kaverin)
• Fix updateEndpoint undefined error for issue_show app root. !15698
• Change boards page boards_data absolute urls to paths. !15703
• Using appropriate services in the API for managing forks. !15709
• Confirming email with invalid token should no longer generate an error. !15726
• fix #39233 - 500 in merge request. !15774 (Martin Nowak)
• Use Markdown styling for new project guidelines. !15785 (Markus Koller)
• Fix error during schema dump. !15866
• Fix broken illustration images for monitoring page empty states. !15889
• Make sure user email is read only when synced with LDAP. !15915
• Fixed outdated browser flash positioning.
• Fix gitlab:import:repos Rake task moving repositories into the wrong location.
• Gracefully handle case when repository's root ref does not exist.
• Fix GitHub importer using removed interface.
• Align retry button with job title with new grid size.
• Fixed admin welcome screen new group path.
• Fix related branches/Merge requests failing to load when the hostname setting is changed.
• Init zen mode in snippets pages.
• Remove extra margin from wordmark in header.
• Fixed long commit links not wrapping correctly.
• Fixed deploy keys remove button loading state not resetting.
• Use app host instead of asset host when rendering image blob or diff.
• Hide log size for mobile screens.
• Fix sending notification emails to users with the mention level set who were mentioned in an issue or merge request description.
• Changed validation error message on wrong milestone dates. (Xurxo Méndez Pérez)
• Fix access to the final page of todos.
• Fixed new group milestone breadcrumbs.
• Fix image diff notification email from showing wrong content.
• Fixed merge request lock icon size.
• Make sure head pippeline always corresponds with the head sha of an MR.
• Prevent 500 error when inspecting job after trigger was removed.

Changed (14 changes, 2 of them are from the community)

• Only owner or master can erase jobs. !15216
• Allow password authentication to be disabled entirely. !15223 (Markus Koller)
• Add the option to automatically run a pipeline after updating AutoDevOps settings. !15380
• Add total_time_spent to the changes hash in issuable Webhook payloads. !15381
• Monitor NFS shards for circuitbreaker in a separate process. !15426
• Add inline editing to issues on mobile. !15438
• Add custom brand text on new project pages. !15541 (Markus Koller)
• Show only group name by default and put full namespace in tooltip in Groups tree. !15650
• Use custom user agent header in all GCP API requests. !15705
• Changed the deploy markers on the prometheus dashboard to be more verbose. !38032
• Animate contextual sidebar on collapse/expand.
• Update emojis. Add :gay_pride_flag: and :speech_left:. Remove extraneous comma in :cartwheel_tone4:.
• When a custom header logo is present, don't show GitLab type logo.
• Improved diff changed files dropdown design.

Performance (19 changes)

• Add timeouts for Gitaly calls. !15047
• Performance issues when loading large number of wiki pages. !15276
• Add performance logging to UpdateMergeRequestsWorker. !15360
• Keep track of all circuitbreaker keys in a set. !15613
• Improve the performance for counting commits. !15628
• Reduce requests for project forks on show page of projects that have forks. !15663
• Perform SQL matching of Build&Runner tags to greatly speed-up job picking.
• Only load branch names for protected branch checks.
• Optimize API /groups/:id/projects by preloading associations.
• Remove allocation tracking code from InfluxDB sampler for performance.
• Throttle the number of UPDATEs triggered by touch.
• Make finding most recent merge request diffs more efficient.
• Fetch blobs in bulk when generating diffs.
• Cache commits for MergeRequest diffs.
• Use fuzzy search with minimum length of 3 characters where appropriate.
• Add axios to common file.
• Remove template selector from global namespace.
• check the import_status field before doing SQL operations to check the import url.
• Stop sending milestone and labels data over the wire for MR widget requests.

Added (22 changes, 15 of them are from the community)

• Limit autocomplete menu to applied labels. !11110 (Vitaliy @blackst0ne Klachkov)
• Make diff notes created on a commit in a merge request to persist a rebase. !12148
• Allow creation of merge request from email. !13817 (janp)
• Add an ability to use a custom branch name on creation from issues. !13884 (Vitaliy @blackst0ne Klachkov)
• Add anonymous rate limit per IP, and authenticated (web or API) rate limits per user. !14708
• Create a new form to add Existing Kubernetes Cluster. !14805
• Add support of Mermaid (generation of diagrams and flowcharts from text). !15107 (Vitaliy @blackst0ne Klachkov)
• Add total time spent to milestones. !15116 (George Andrinopoulos)
• Add /groups/:id/subgroups endpoint to API. !15142 (marbemac)
• Add administrative endpoint to list all pages domains. !15160 (Travis Miller)
• Adds Rubocop rule for line break after guard clause. !15188 (Jacopo Beschi @jacopo-beschi)
• Add edit button to mobile file view. !15199 (Travis Miller)
• Add dropdown sort to group milestones. !15230 (George Andrinopoulos)
• added support for ordering and sorting in notes api. !15342 (haseebeqx)
• Hashed Storage migration script now supports migrating project attachments. !15352
• New API endpoint - list jobs for a specified runner. !15432
• Add new API endpoint - get a namespace by ID. !15442
• Disables autocomplete in filtered searc. !15477 (Jacopo Beschi @jacopo-beschi)
• Update empty state page of merge request 'changes' tab. !15611 (Vitaliy @blackst0ne Klachkov)
• Allow git pull/push on group/user/project redirects. !15670
• show status of gitlab reference links in wiki. !15694 (haseebeqx)
• Add email confirmation parameters for user creation and update via API. (Daniel Juarez)

Other (17 changes, 7 of them are from the community)

• Enable UnnecessaryMantissa in scss-lint. !15255 (Takuya Noguchi)
• Add untracked files to uploads table. !15270
• Move update_project_counter_caches? out of issue and merge request. !15300 (George Andrinopoulos)
• Removed tooltip from clone dropdown. !15334
• Clean up empty fork networks. !15373
• Create issuable destroy service. !15604 (George Andrinopoulos)
• Upgrade seed-fu to 2.3.7. !15607 (Takuya Noguchi)
• Rename GKE as Kubernetes Engine. !15608 (Takuya Noguchi)
• Prefer ci_config_path validation for leading slashes instead of sanitizing the input. !15672 (Christiaan Van den Poel)
• Fix typo in docs about Elasticsearch. !15699 (Takuya Noguchi)
• Add internationalization support for the prometheus integration. !33338
• Export text utils functions as es6 module and add tests.
• Stop reloading the page when using pagination and tabs - use API calls - in Pipelines table.
• Clean up schema of the "issues" table.
• Clarify wording of protected branch settings for the default branch.
• Update svg external dependency.
• Clean up schema of the "merge_requests" table.

10.2.8 (2018-02-07)

Security (4 changes)

• Fix namespace access issue for GitHub, BitBucket, and GitLab.com project importers.
• Fix stored XSS in code blocks that ignore highlighting.
• Fix wilcard protected tags protecting all branches.
• Restrict Todo API mark_as_done endpoint to the user's todos only.

10.2.7 (2018-01-18)

• No changes.

10.2.6 (2018-01-11)

Security (9 changes, 1 of them is from the community)

• Fix writable shared deploy keys.
• Filter out sensitive fields from the project services API. (Robert Schilling)
• Fix RCE via project import mechanism.
• Fixed IPython notebook output not being sanitized.
• Prevent OAuth login POST requests when a provider has been disabled.
• Prevent a SQL injection in the MilestonesFinder.
• Check user authorization for source and target projects when creating a merge request.
• Fix path traversal in gitlab-ci.yml cache:key.
• Fix XSS vulnerability in pipeline job trace.

10.2.5 (2017-12-15)

Fixed (8 changes)

• Create a fork network for forks with a deleted source. !15595
• Correctly link to a forked project from the new fork page. !15653
• Fix the fork project functionality for projects with hashed storage. !15671
• Fix updateEndpoint undefined error for issue_show app root. !15698
• Fix broken illustration images for monitoring page empty states. !15889
• Fix related branches/Merge requests failing to load when the hostname setting is changed.
• Fix gitlab:import:repos Rake task moving repositories into the wrong location.
• Gracefully handle case when repository's root ref does not exist.

Performance (3 changes)

• Keep track of all circuitbreaker keys in a set. !15613
• Only load branch names for protected branch checks.
• Optimize API /groups/:id/projects by preloading associations.

10.2.4 (2017-12-07)

Security (5 changes)

• Fix e-mail address disclosure through member search fields
• Prevent creating issues through API when user does not have permissions
• Prevent an information disclosure in the Groups API
• Fix user without access to private Wiki being able to see it on the project page
• Fix Cross-Site Scripting (XSS) vulnerability while editing a comment

10.2.3 (2017-11-30)

Fixed (7 changes)

• Fix hashed storage for Import/Export uploads. !15482
• Ensure that rake gitlab:cleanup:repos task does not mess with hashed repositories. !15520
• Ensure that rake gitlab:cleanup:dirs task does not mess with hashed repositories. !15600
• Fix WIP system note not being created.
• Fix link text from group context.
• Fix defaults for MR states and merge statuses.
• Fix pulling and pushing using a personal access token with the sudo scope.

Performance (3 changes)

• Drastically improve project search performance by no longer searching namespace name.
• Reuse authors when rendering event Atom feeds.
• Optimise StuckCiJobsWorker using cheap SQL query outside, and expensive inside.

10.2.2 (2017-11-23)

Fixed (5 changes)

• Label addition/removal are not going to be redacted wrongfully in the API. !15080
• Fix bitbucket wiki import with hashed storage enabled. !15490
• Impersonation no longer gets stuck on password change. !15497
• Fix blank states using old css.
• Fix promoting milestone updating all issuables without milestone.

Performance (3 changes)

• Update Issue Boards to fetch the notification subscription status asynchronously.
• Update composite pipelines index to include "id".
• Use arrays in Pipeline#latest_builds_with_artifacts.

Other (2 changes)

• Don't move repositories and attachments for projects using hashed storage. !15479
• Add logs for monitoring the merge process.

10.2.1 (2017-11-22)

Fixed (1 change)

• Force disable Prometheus metrics.

10.2.0 (2017-11-22)

Security (4 changes)

• Upgrade Ruby to 2.3.5 to include security patches. !15099
• Prevent OAuth phishing attack by presenting detailed wording about app to user during authorization.
• Convert private tokens to Personal Access Tokens with sudo scope.
• Remove private tokens from web interface and API.

Removed (5 changes)

• Remove help text from group issues page and group merge requests page. !14963
• Remove overzealous tooltips in projects page tabs. !15017
• Stop merge requests from fetching their refs when the data is already available. !15129
• Remove update merge request worker tagging.
• Remove Session API now that private tokens are removed from user API endpoints.

Fixed (75 changes, 18 of them are from the community)

• Fix 404 errors in API caused when the branch name had a dot. !14462 (gvieira37)
• Remove unnecessary alt-texts from pipeline emails. !14602 (gernberg)
• Renders 404 in commits controller if no commits are found for a given path. !14610 (Guilherme Vieira)
• Cleanup data-page attribute after each Karma test. !14742
• Removed extra border radius from .file-editor and .file-holder when editing a file. !14803 (Rachel Pipkin)
• Add support for markdown preview to group milestones. !14806 (Vitaliy @blackst0ne Klachkov)
• Fixed 'Removed source branch' checkbox in merge widget being ignored. !14832
• Fix unnecessary ajax requests in admin broadcast message form. !14853
• Make NamespaceSelect change URL when filtering. !14888
• Get true failure from evalulate_script by checking for element beforehand. !14898
• Fix SAML error 500 when no groups are defined for user. !14913
• Fix 500 errors caused by empty diffs in some discussions. !14945 (Alexander Popov)
• Fix the atom feed for group events. !14974
• Hides pipeline duration in commit box when it is zero (nil). !14979 (gvieira37)
• Add new diff discussions on MR diffs tab in "realtime". !14981
• Returns a ssh url for go-get=1. !14990 (gvieira37)
• Case insensitive search for branches. !14995 (George Andrinopoulos)
• Fixes 404 error to 'Issues assigned to me' and 'Issues I've created' when issues are disabled. !15021 (Jacopo Beschi @jacopo-beschi)
• Update the groups API documentation. !15024 (Robert Schilling)
• Validate username/pw for Jiraservice, require them in the API. !15025 (Robert Schilling)
• Update Merge Request polling so there is only one request at a time. !15032
• Use project select dropdown not only as a combobutton. !15043
• Remove create MR button from issues when MRs are disabled. !15071 (George Andrinopoulos)
• Tighten up whitelisting of certain Geo routes. !15082
• Allow to disable the Performance Bar. !15084
• Refresh open Issue and Merge Request project counter caches when re-opening. !15085 (Rob Ede @robjtede)
• Fix markdown form tabs toggling preview mode from double clicking write mode button. !15119
• Fix cancel button not working while uploading on the new issue page. !15137
• Fix webhooks recent deliveries. !15146 (Alexander Randa (@randaalex))
• Fix issues with forked projects of which the source was deleted. !15150
• Fix GPG signature popup info in Safari and Firefox. !15228
• Fix GFM reference links for closed milestones. !15234 (Vitaliy @blackst0ne Klachkov)
• When deleting merged branches, ignore protected tags. !15252
• Revert a regression on runners sorting (!15134). !15341 (Takuya Noguchi)
• Don't use JS to delete memberships from projects and groups. !15344
• Don't try to create fork network memberships for forks with a missing source. !15366
• Fix gitlab:backup rake for hashed storage based repositories. !15400
• Fix issue where clicking a GPG verification badge would scroll to the top of the page. !15407
• Update container repository path reference and allow using double underscore. !15417
• Fix crash when navigating to second page of the group dashboard when there are projects and groups on the first page. !15456
• Fix flash errors showing up on a non configured prometheus integration. !35652
• Fix timezone bug in Pikaday and upgrade Pikaday version.
• Fix arguments Import/Export error importing project merge requests.
• Moves mini graph of pipeline to the end of sentence in MR widget. Cleans HTML and tests.
• Fix user autocomplete in subgroups.
• Fixed user profile activity tab being off-screen on mobile.
• Fix diff parser so it tolerates to diff special markers in the content.
• Fix a migration that adds merge_requests_ff_only_enabled column to MR table.
• Don't create build failed todos when the job is automatically retried.
• Render 404 when polling commit notes without having permissions.
• Show error message when fast-forward merge is not possible.
• Prevents position update for image diff notes.
• Mobile-friendly table on Admin Runners. (Takuya Noguchi)
• Decreases z-index of select2 to a lower number of our navigation bar.
• Fix broken Members link when relative URL root paths are used.
• Avoid regenerating the ref path for the environment.
• Memoize GitLab logger to reduce open file descriptors.
• Fix hashed storage with project transfers to another namespace.
• Fix bad type checking to prevent 0 count badge to be shown.
• Fix problem with issuable header wrapping when content is too long.
• Move retry button in job page to sidebar.
• Formats bytes to human reabale number in registry table.
• Fix commit pipeline showing wrong status.
• Include link to issue in reopen message for Slack and Mattermost notifications.
• Fix double border UI bug on pipelines/environments table and pagination.
• Remove native title tooltip in pipeline jobs dropdown in Safari.
• Fix namespacing for MergeWhenPipelineSucceedsService in MR API.
• Prevent error when authorizing an admin-created OAauth application without a set owner.
• Always return full avatar URL for private/internal groups/projects when asset host is set.
• Make sure group and project creation is blocked for new users that are external by default.
• Make sure NotesActions#noteable returns a Noteable in the update action.
• Reallow project paths ending in periods.
• Only set Auto-Submitted header once for emails on push.
• Fix overlap of right-sidebar and main content when creating a Wiki page.
• Enables scroll to bottom once user has scrolled back to bottom in job log.

Changed (21 changes, 7 of them are from the community)

• Added possibility to enter past date in /spend command to log time in the past. !3044 (g3dinua, LockiStrike)
• Add Prometheus equivalent of all InfluxDB metrics. !13891
• Show collapsible project lists. !14055
• Make Prometheus metrics endpoint return empty response when metrics are disabled. !14490
• Support custom attributes on groups and projects. !14593 (Markus Koller)
• Avoid fetching all branches for branch existence checks. !14778
• Update participants and subscriptions button in issuable sidebar to be async. !14836
• Replace WikiPage::CreateService calls with wiki_page factory in specs. !14850 (Jacopo Beschi @jacopo-beschi)
• Add lazy option to UserAvatarImage. !14895
• Add readme only option as project view. !14900
• Todos spelled correctly on Todos list page. !15015
• Support uml:: and captions in reStructuredText. !15120 (Markus Koller)
• Add system hooks user_rename and group_rename. !15123
• Change tags order in refs dropdown. !15235 (Vitaliy @blackst0ne Klachkov)
• Change default cluster size to n1-default-2. !39649 (Fabio Busatto)
• Change 'Sign Out' route from a DELETE to a GET. !39708 (Joe Marty)
• Change background color of nav sidebar to match other gl sidebars.
• Update i18n section in FE docs for marking and interpolation.
• Add a count of changes to the merge requests API.
• Improve GitLab Import rake task to work with Hashed Storage and Subgroups.
• 14830 Move GitLab export option to top of import list when creating a new project.

Performance (14 changes)

• Improve branch listing page performance. !14729
• Improve DashboardController#activity.json performance. !14985
• Add a latest_merge_request_diff_id column to merge_requests. !15035
• Improve performance of the /projects/:id/repository/branches API endpoint. !15215
• Ensure merge requests with lots of version don't time out when searching for pipelines.
• Speed up issues list APIs.
• Remove Filesystem check metrics that use too much CPU to handle requests.
• Disable Unicorn sampling in Sidekiq since there are no Unicorn sockets to monitor.
• Truncate tree to max 1,000 items and display notice to users.
• Add Performance improvement as category on the changelog.
• Cache commits fetched from the repository.
• Cache the number of user SSH keys.
• Optimise getting the pipeline status of commits.
• Improve performance of commits list by fully using DB index when getting commit note counts.

Added (26 changes, 10 of them are from the community)

• Expose duration in Job entity. !13644 (Mehdi Lahmam (@mehlah))
• Prevent git push when LFS objects are missing. !13837
• Automatic configuration settings page. !13850 (Francisco Lopez)
• Add API endpoints for Pages Domains. !13917 (Travis Miller)
• Include the changes in issuable webhook payloads. !14308
• Add Packagist project service. !14493 (Matt Coleman)
• Add sort runners on admin runners. !14661 (Takuya Noguchi)
• Repo Editor: Add option to start a new MR directly from comit section. !14665
• Issue JWT token with registry:catalog:* scope when requested by GitLab admin. !14751 (Vratislav Kalenda)
• Support show-all-refs for git over HTTP. !14834
• Add loading button for new UX paradigm. !14883
• Get Project Branch API shows an helpful error message on invalid refname. !14884 (Jacopo Beschi @jacopo-beschi)
• Refactor have_http_status into have_gitlab_http_status. !14958 (Jacopo Beschi @jacopo-beschi)
• Suggest to rename the remote for existing repository instructions. !14970 (helmo42)
• Adds project_id to pipeline hook data. !15044 (Jacopo Beschi @jacopo-beschi)
• Hashed Storage support for Attachments. !15068
• Add metric tagging for sidekiq workers. !15111
• Expose project visibility as CI variable - CI_PROJECT_VISIBILITY. !15193
• Allow multiple queries in a single Prometheus graph to support additional environments (Canary, Staging, et al.). !15201
• Allow promoting project milestones to group milestones.
• Added submodule support in multi-file editor.
• Add applications section to GKE clusters page to easily install Helm Tiller, Ingress.
• Allow files to uploaded in the multi-file editor.
• Add Ingress to available Cluster applications.
• Adds typescript support.
• Add sudo scope for OAuth and Personal Access Tokens to be used by admins to impersonate other users on the API.

Other (18 changes, 8 of them are from the community)

• Decrease Perceived Complexity threshold to 14. !14231 (Maxim Rydkin)
• Replace the 'features/explore/projects.feature' spinach test with an rspec analog. !14755 (Vitaliy @blackst0ne Klachkov)
• While displaying a commit, do not show list of related branches if there are thousands of branches. !14812
• Removed d3.js from the graph and users bundles and used the common_d3 bundle instead. !14826
• Make contributors page translatable. !14915
• Decrease ABC threshold to 54.28. !14920 (Maxim Rydkin)
• Clarify system_hook triggers in documentation. !14957 (Joe Marty)
• Free up some reserved group names. !15052
• Bump carrierwave to 1.2.1. !15072 (Takuya Noguchi)
• Enable NestingDepth (level 6) on scss-lint. !15073 (Takuya Noguchi)
• Enable BorderZero rule in scss-lint. !15168 (Takuya Noguchi)
• Internationalized tags page. !38589
• Moves placeholders components into shared folder with documentation. Makes them easier to reuse in MR and Snippets comments.
• Reorganize welcome page for new users.
• Refactor GroupLinksController. (15121)
• Remove filter icon from search bar.
• Use title as placeholder instead of issue title for reusability.
• Add Gitaly metrics to the performance bar.

10.1.7 (2018-01-18)

• No changes.

10.1.6 (2018-01-11)

Security (8 changes, 1 of them is from the community)

• Fix writable shared deploy keys.
• Filter out sensitive fields from the project services API. (Robert Schilling)
• Fix RCE via project import mechanism.
• Prevent OAuth login POST requests when a provider has been disabled.
• Prevent a SQL injection in the MilestonesFinder.
• Check user authorization for source and target projects when creating a merge request.
• Fix path traversal in gitlab-ci.yml cache:key.
• Fix XSS vulnerability in pipeline job trace.

10.1.5 (2017-12-07)

Security (5 changes)

• Fix e-mail address disclosure through member search fields
• Prevent creating issues through API when user does not have permissions
• Prevent an information disclosure in the Groups API
• Fix user without access to private Wiki being able to see it on the project page
• Fix Cross-Site Scripting (XSS) vulnerability while editing a comment

10.1.4 (2017-11-14)

Fixed (4 changes)

• Don't try to create fork network memberships for forks with a missing source. !15366
• Formats bytes to human reabale number in registry table.
• Prevent error when authorizing an admin-created OAauth application without a set owner.
• Prevents position update for image diff notes.

10.1.3 (2017-11-10)

• [SECURITY] Prevent OAuth phishing attack by presenting detailed wording about app to user during authorization.
• [FIXED] Fix cancel button not working while uploading on the new issue page. !15137
• [FIXED] Fix webhooks recent deliveries. !15146 (Alexander Randa (@randaalex))
• [FIXED] Fix issues with forked projects of which the source was deleted. !15150
• [FIXED] Fix GPG signature popup info in Safari and Firefox. !15228
• [FIXED] Make sure group and project creation is blocked for new users that are external by default.
• [FIXED] Fix arguments Import/Export error importing project merge requests.
• [FIXED] Fix diff parser so it tolerates to diff special markers in the content.
• [FIXED] Fix a migration that adds merge_requests_ff_only_enabled column to MR table.
• [FIXED] Render 404 when polling commit notes without having permissions.
• [FIXED] Show error message when fast-forward merge is not possible.
• [FIXED] Avoid regenerating the ref path for the environment.
• [PERFORMANCE] Remove Filesystem check metrics that use too much CPU to handle requests.

10.1.2 (2017-11-08)

• [SECURITY] Add X-Content-Type-Options header in API responses to make it more difficult to find other vulnerabilities.
• [SECURITY] Properly translate IP addresses written in decimal, octal, or other formats in SSRF protections in project imports.
• [FIXED] Fix TRIGGER checks for MySQL.

10.1.1 (2017-10-31)

• [FIXED] Auto Devops kubernetes default namespace is now correctly built out of gitlab project group-name. !14642 (Mircea Danila Dumitrescu)
• [FIXED] Forbid the usage of Redis#keys. !14889
• [FIXED] Make the circuitbreaker more robust by adding higher thresholds, and multiple access attempts. !14933
• [FIXED] Only cache last push event for existing projects when pushing to a fork. !14989
• [FIXED] Fix bug preventing secondary emails from being confirmed. !15010
• [FIXED] Fix broken wiki pages that link to a wiki file. !15019
• [FIXED] Don't rename paths that were freed up when upgrading. !15029
• [FIXED] Fix bitbucket login. !15051
• [FIXED] Update gitaly in GitLab 10.1 to 0.43.1 for temp file cleanup. !15055
• [FIXED] Use the correct visibility attribute for projects in system hooks. !15065
• [FIXED] Normalize LDAP DN when looking up identity.
• [FIXED] Adds callback functions for initial request in clusters page.
• [FIXED] Fix missing Import/Export issue assignees.
• [FIXED] Allow boards as top level route.
• [FIXED] Fix widget of locked merge requests not being presented.
• [FIXED] Fix editing issue description in mobile view.
• [FIXED] Fix deletion of container registry or images returning an error.
• [FIXED] Fix the writing of invalid environment refs.
• [CHANGED] Store circuitbreaker settings in the database instead of config. !14842
• [CHANGED] Update default disabled merge request widget message to reflect a general failure. !14960
• [PERFORMANCE] Stop merge requests with thousands of commits from timing out. !15063

10.1.0 (2017-10-22)

• [SECURITY] Use a timeout on certain git operations. !14872
• [SECURITY] Move project repositories between namespaces when renaming users.
• [SECURITY] Prevent an open redirect on project pages.
• [SECURITY] Prevent a persistent XSS in user-provided markup.
• [REMOVED] Remove the ability to visit the issue edit form directly. !14523
• [REMOVED] Remove animate.js and label animation.
• [FIXED] Perform prometheus data endpoint requests in parallel. !14003
• [FIXED] Escape quotes in git username. !14020 (Brandon Everett)
• [FIXED] Fixed non-UTF-8 valid branch names from causing an error. !14090
• [FIXED] Read import sources from setting at first initialization. !14141 (Visay Keo)
• [FIXED] Display full pre-receive and post-receive hook output in GitLab UI. !14222 (Robin Bobbitt)
• [FIXED] Fix incorrect X-axis labels in Prometheus graphs. !14258
• [FIXED] Fix the default branches sorting to actually be 'Last updated'. !14295
• [FIXED] Fixes project denial of service via gitmodules using Extended ASCII. !14301
• [FIXED] Fix the filesystem shard health check to check all configured shards. !14341
• [FIXED] Compare email addresses case insensitively when verifying GPG signatures. !14376 (Tim Bishop)
• [FIXED] Allow the git circuit breaker to correctly handle missing repository storages. !14417
• [FIXED] Fix rake gitlab:incoming_email:check and make it report the actual error. !14423
• [FIXED] Does not check if an invariant hashed storage path exists on disk when renaming projects. !14428
• [FIXED] Also reserve refs/replace after importing a project. !14436
• [FIXED] Fix profile image orientation based on EXIF data gvieira37. !14461 (gvieira37)
• [FIXED] Move the deployment flag content to the left when deployment marker is near the end. !14514
• [FIXED] Fix notes type created from import. This should fix some missing notes issues from imported projects. !14524
• [FIXED] Fix bottom spacing for dropdowns that open upwards. !14535
• [FIXED] Adjusts tag link to avoid underlining spaces. !14544 (Guilherme Vieira)
• [FIXED] Add missing space in Sidekiq memory killer log message. !14553 (Benjamin Drung)
• [FIXED] Ensure no exception is raised when Raven tries to get the current user in API context. !14580
• [FIXED] Fix edit project service cancel button position. !14596 (Matt Coleman)
• [FIXED] Fix case sensitive email confirmation on signup. !14606 (robdel12)
• [FIXED] Whitelist authorized_keys.lock in the gitlab:check rake task. !14624
• [FIXED] Allow merge in MR widget with no pipeline but using "Only allow merge requests to be merged if the pipeline succeeds". !14633
• [FIXED] Fix navigation dropdown close animation on mobile screens. !14649
• [FIXED] Fix the project import with issues and milestones. !14657
• [FIXED] Use explicit boolean true attribute for show-disabled-button in Vue files. !14672
• [FIXED] Make tabs on top scrollable on admin dashboard. !14685 (Takuya Noguchi)
• [FIXED] Fix broken Y-axis scaling in some Prometheus graphs. !14693
• [FIXED] Search or compare LDAP DNs case-insensitively and ignore excess whitespace. !14697
• [FIXED] Allow prometheus graphs to correctly handle NaN values. !14741
• [FIXED] Don't show an "Unsubscribe" link in snippet comment notifications. !14764
• [FIXED] Fixed duplicate notifications when added multiple labels on an issue. !14798
• [FIXED] Fix alignment for indeterminate marker in dropdowns. !14809
• [FIXED] Fix error when updating a forked project with deleted ForkedProjectLink. !14916
• [FIXED] Correctly render asset path for locales with a region. !14924
• [FIXED] Fix the external URLs generated for online view of HTML artifacts. !14977
• [FIXED] Reschedule merge request diff background migrations to catch failures from 9.5 run.
• [FIXED] fix merge request widget status icon for failed CI.
• [FIXED] Fix the number representing the amount of commits related to a push event.
• [FIXED] Sync up hover and legend data across all graphs for the prometheus dashboard.
• [FIXED] Fixes mini pipeline graph in commit view.
• [FIXED] Fix comment deletion confirmation dialog typo.
• [FIXED] Fix project snippets breadcrumb link.
• [FIXED] Make usage ping scheduling more robust.
• [FIXED] Make "merge ongoing" check more consistent.
• [FIXED] Add 1000+ counters to job page.
• [FIXED] Fixed issue/merge request breadcrumb titles not having links.
• [FIXED] Fixed commit avatars being centered vertically.
• [FIXED] Tooltips in the commit info box now all face the same direction. (Jedidiah Broadbent)
• [FIXED] Fixed navbar title colors leaking out of the navbar.
• [FIXED] Fix bug that caused merge requests with diff notes imported from Bitbucket to raise errors.
• [FIXED] Correctly detect multiple issue URLs after 'Closes...' in MR descriptions.
• [FIXED] Set default scope on PATs that don't have one set to allow them to be revoked.
• [FIXED] Fix application setting to cache nil object.
• [FIXED] Fix image diff swipe handle offset to correctly align with the frame.
• [FIXED] Force non diff resolved discussion to display when collapse toggled.
• [FIXED] Fix resolved discussions not expanding on side by side view.
• [FIXED] Fixed the sidebar scrollbar overlapping links.
• [FIXED] Issue board tooltips are now the correct width when the column is collapsed. (Jedidiah Broadbent)
• [FIXED] Improve autodevops banner UX and render it only in project page.
• [FIXED] Fix typo in cycle analytics breaking time component.
• [FIXED] Force two up view to load by default for image diffs.
• [FIXED] Fixed milestone breadcrumb links.
• [FIXED] Fixed group sort dropdown defaulting to empty.
• [FIXED] Fixed notes not being scrolled to in merge requests.
• [FIXED] Adds Event polyfill for IE11.
• [FIXED] Update native unicode emojis to always render as normal text (previously could render italicized). (Branka Martinovic)
• [FIXED] Sort JobsController by id, not created_at.
• [FIXED] Fix revision and total size missing for Container Registry.
• [FIXED] Fixed milestone issuable assignee link URL.
• [FIXED] Fixed breadcrumbs container expanding in side-by-side diff view.
• [FIXED] Fixed merge request widget merged & closed date tooltip text.
• [FIXED] Prevent creating multiple ApplicationSetting instances.
• [FIXED] Fix username and ID not logging in production_json.log for Git activity.
• [FIXED] Make Redcarpet Markdown renderer thread-safe.
• [FIXED] Two factor auth messages in settings no longer overlap the button. (Jedidiah Broadbent)
• [FIXED] Made the "remember me" check boxes have consistent styles and alignment. (Jedidiah Broadbent)
• [FIXED] Prevent branches or tags from starting with invalid characters (e.g. -, .).
• [DEPRECATED] Removed two legacy config options. (Daniel Voogsgerd)
• [CHANGED] Show notes number more user-friendly in the graph. !13949 (Vladislav Kaverin)
• [CHANGED] Link SAML users to LDAP by email. !14216
• [CHANGED] Display whether branch has been merged when deleting protected branch. !14220
• [CHANGED] Make the labels in the Compare form less confusing. !14225
• [CHANGED] Confirmation email shows link as text instead of human readable text. !14243 (bitsapien)
• [CHANGED] Return only group's members in user dropdowns on issuables list pages. !14249
• [CHANGED] Added defaults for protected branches dropdowns on the repository settings. !14278
• [CHANGED] Show confirmation modal before deleting account. !14360
• [CHANGED] Allow creating merge requests across a fork network. !14422
• [CHANGED] Re-arrange script HTML tags before template HTML tags in .vue files. !14671
• [CHANGED] Create idea of read-only database. !14688
• [CHANGED] Add active states to nav bar counters.
• [CHANGED] Add view replaced file link for image diffs.
• [CHANGED] Adjust tooltips to adhere to 8px grid and make them more readable.
• [CHANGED] breadcrumbs receives padding when double lined.
• [CHANGED] Allow developer role to admin milestones.
• [CHANGED] Stop using Sidekiq for updating Key#last_used_at.
• [CHANGED] Include GitLab full name in Slack messages.
• [ADDED] Expose last pipeline details in API response when getting a single commit. !13521 (Mehdi Lahmam (@mehlah))
• [ADDED] Allow to use same periods for different housekeeping tasks (effectively skipping the lesser task). !13711 (cernvcs)
• [ADDED] Add GitLab-Pages version to Admin Dashboard. !14040 (travismiller)
• [ADDED] Commenting on image diffs. !14061
• [ADDED] Script to migrate project's repositories to new Hashed Storage. !14067
• [ADDED] Hide close MR button after merge without reloading page. !14122 (Jacopo Beschi @jacopo-beschi)
• [ADDED] Add Gitaly version to Admin Dashboard. !14313 (Jacopo Beschi @jacopo-beschi)
• [ADDED] Add 'closed_at' attribute to Issues API. !14316 (Vitaliy @blackst0ne Klachkov)
• [ADDED] Add tooltip for milestone due date to issue and merge request lists. !14318 (Vitaliy @blackst0ne Klachkov)
• [ADDED] Improve list of sorting options. !14320 (Vitaliy @blackst0ne Klachkov)
• [ADDED] Add client and call site metadata to Gitaly calls for better traceability. !14332
• [ADDED] Strip gitlab-runner section markers in build trace HTML view. !14393
• [ADDED] Add online view of HTML artifacts for public projects. !14399
• [ADDED] Create Kubernetes cluster on GKE from k8s service. !14470
• [ADDED] Add support for GPG subkeys in signature verification. !14517
• [ADDED] Parse and store gitlab-runner timestamped section markers. !14551
• [ADDED] Add "implements" to the default issue closing message regex. !14612 (Guilherme Vieira)
• [ADDED] Replace tag: true into :tag in the specs. !14653 (Jacopo Beschi @jacopo-beschi)
• [ADDED] Discussion lock for issues and merge requests.
• [ADDED] Add an API endpoint to determine the forks of a project.
• [ADDED] Add help text to runner edit: tags should be separated by commas. (Brendan O'Leary)
• [ADDED] Only copy old/new code when selecting left/right side of parallel diff.
• [ADDED] Expose avatar_url when requesting list of projects from API with simple=true.
• [ADDED] A confirmation email is now sent when adding a secondary email address. (digitalmoksha)
• [ADDED] Move Custom merge methods from EE.
• [ADDED] Makes @mentions links have a different styling for better separation.
• [ADDED] Added tabs to dashboard/projects to easily switch to personal projects.
• [OTHER] Extract AutocompleteController#users into finder. !13778 (Maxim Rydkin, Mayra Cabrera)
• [OTHER] Replace 'project/wiki.feature' spinach test with an rspec analog. !13856 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Expand docs for changing username or group path. !13914
• [OTHER] Move lib/ci to lib/gitlab/ci. !14078 (Maxim Rydkin)
• [OTHER] Decrease Cyclomatic Complexity threshold to 13. !14152 (Maxim Rydkin)
• [OTHER] Decrease Perceived Complexity threshold to 15. !14160 (Maxim Rydkin)
• [OTHER] Replace project/group_links.feature spinach test with an rspec analog. !14169 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Replace the project/milestone.feature spinach test with an rspec analog. !14171 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Replace the profile/emails.feature spinach test with an rspec analog. !14172 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Replace the project/team_management.feature spinach test with an rspec analog. !14173 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Replace the 'project/merge_requests/accept.feature' spinach test with an rspec analog. !14176 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Replace the 'project/builds/summary.feature' spinach test with an rspec analog. !14177 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Optimize the boards' issues fetching. !14198
• [OTHER] Replace the 'project/merge_requests/revert.feature' spinach test with an rspec analog. !14201 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Replace the 'project/issues/award_emoji.feature' spinach test with an rspec analog. !14202 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Replace the 'profile/active_tab.feature' spinach test with an rspec analog. !14239 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Replace the 'search.feature' spinach test with an rspec analog. !14248 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Load sidebar participants avatars only when visible. !14270
• [OTHER] Adds gitlab features and components to usage ping data. !14305
• [OTHER] Replace the 'project/archived.feature' spinach test with an rspec analog. !14322 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Replace the 'project/commits/revert.feature' spinach test with an rspec analog. !14325 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Replace the 'project/snippets.feature' spinach test with an rspec analog. !14326 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Add link to OpenID Connect documentation. !14368 (Markus Koller)
• [OTHER] Upgrade doorkeeper-openid_connect. !14372 (Markus Koller)
• [OTHER] Upgrade gitlab-markup gem. !14395 (Markus Koller)
• [OTHER] Index projects on repository storage. !14414
• [OTHER] Replace the 'project/shortcuts.feature' spinach test with an rspec analog. !14431 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Replace the 'project/service.feature' spinach test with an rspec analog. !14432 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Improve GitHub import performance. !14445
• [OTHER] Add basic sprintf implementation to JavaScript. !14506
• [OTHER] Replace the 'project/merge_requests.feature' spinach test with an rspec analog. !14621 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Update GitLab Pages to v0.6.0. !14630
• [OTHER] Add documentation to summarise project archiving. !14650
• [OTHER] Remove 'Repo' prefix from API entites. !14694 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Removes cycle analytics service and store from global namespace.
• [OTHER] Improves i18n for Auto Devops callout.
• [OTHER] Exports common_utils utility functions as modules.
• [OTHER] Use simple=true for projects API in Projects dropdown for better search performance.
• [OTHER] Change index on ci_builds to optimize Jobs Controller.
• [OTHER] Add index for merge_requests.merge_commit_sha.
• [OTHER] Add (partial) index on Labels.template.
• [OTHER] Cache issue and MR template names in Redis.
• [OTHER] changed dashed border button color to be darker.
• [OTHER] Speed up permission checks.
• [OTHER] Fix docs for lightweight tag creation via API.
• [OTHER] Clarify artifact download via the API only accepts branch or tag name for ref.
• [OTHER] Change recommended MySQL version to 5.6.
• [OTHER] Bump google-api-client Gem from 0.8.6 to 0.13.6.
• [OTHER] Detect when changelog entries are invalid.
• [OTHER] Use a UNION ALL for getting merge request notes.
• [OTHER] Remove an index on ci_builds meant to be only temporary.
• [OTHER] Remove a SQL query from the todos index page.
• Support custom attributes on users. !13038 (Markus Koller)
• made read-only APIs for public merge requests available without authentication. !13291 (haseebeqx)
• Hide read_registry scope when registry is disabled on instance. !13314 (Robin Bobbitt)
• creation of keys moved to services. !13331 (haseebeqx)
• Add username as GL_USERNAME in hooks.

10.0.7 (2017-12-07)

Security (5 changes)

• Fix e-mail address disclosure through member search fields
• Prevent creating issues through API when user does not have permissions
• Prevent an information disclosure in the Groups API
• Fix user without access to private Wiki being able to see it on the project page
• Fix Cross-Site Scripting (XSS) vulnerability while editing a comment

10.0.5 (2017-11-03)

• [FIXED] Fix incorrect X-axis labels in Prometheus graphs. !14258
• [FIXED] Fix rake gitlab:incoming_email:check and make it report the actual error. !14423
• [FIXED] Does not check if an invariant hashed storage path exists on disk when renaming projects. !14428
• [FIXED] Fix bottom spacing for dropdowns that open upwards. !14535
• [FIXED] Fix the project import with issues and milestones. !14657
• [FIXED] Fix broken Y-axis scaling in some Prometheus graphs. !14693
• [FIXED] Fixed duplicate notifications when added multiple labels on an issue. !14798
• [FIXED] Don't rename paths that were freed up when upgrading. !15029
• [FIXED] Fixed issue/merge request breadcrumb titles not having links.
• [FIXED] Fix application setting to cache nil object.
• [FIXED] Fix missing Import/Export issue assignees.
• [FIXED] Allow boards as top level route.
• [FIXED] Fixed milestone breadcrumb links.
• [FIXED] Fixed merge request widget merged & closed date tooltip text.
• [FIXED] fix merge request widget status icon for failed CI.

10.0.4 (2017-10-16)

• [SECURITY] Move project repositories between namespaces when renaming users.
• [SECURITY] Prevent an open redirect on project pages.
• [SECURITY] Prevent a persistent XSS in user-provided markup.

10.0.3 (2017-10-05)

• [FIXED] find_user Users helper method no longer overrides find_user API helper method. !14418
• [FIXED] Fix CSRF validation issue when closing/opening merge requests from the UI. !14555
• [FIXED] Kubernetes integration: ensure v1.8.0 compatibility. !14635
• [FIXED] Fixes data parameter not being sent in ajax request for jobs log.
• [FIXED] Improves UX of autodevops popover to match gpg one.
• [FIXED] Fixed commenting on side-by-side commit diff.
• [FIXED] Make sure API responds with 401 when invalid authentication info is provided.
• [FIXED] Fix merge request counter updates after merge.
• [FIXED] Fix gitlab-rake gitlab:import:repos task failing.
• [FIXED] Fix pushes to an empty repository not invalidating has_visible_content? cache.
• [FIXED] Ensure all refs are restored on a restore from backup.
• [FIXED] Gitaly RepositoryExists remains opt-in for all method calls.
• [FIXED] Fix 500 error on merged merge requests when GitLab is restored from a backup.
• [FIXED] Adjust MRs being stuck on "process of being merged" for more than 2 hours.

10.0.2 (2017-09-27)

• [FIXED] Notes will not show an empty bubble when the author isn't a member. !14450
• [FIXED] Some checks in rake gitlab:check were failling with 'undefined method run_command'. !14469
• [FIXED] Make locked setting of Runner to not affect jobs scheduling. !14483
• [FIXED] Re-allow name attribute on user-provided anchor HTML.

10.0.1 (2017-09-23)

• [FIXED] Fix duplicate key errors in PostDeployMigrateUserExternalMailData migration.

10.0.0 (2017-09-22)

• [SECURITY] Upgrade brace-expansion NPM package due to security issue. !13665 (Markus Koller)
• [REMOVED] Remove CI API v1.
• [FIXED] Ensure correct visibility level options shown on all Project, Group, and Snippets forms. !13442
• [FIXED] Fix the /projects/:id/repository/files/:file_path/raw endpoint to handle dots in the file_path. !13512 (mahcsig)
• [FIXED] Merge request reference in merge commit changed to full reference. !13518 (haseebeqx)
• [FIXED] Removes Sortable default scope. !13558
• [FIXED] Wiki table of contents are now properly nested to reflect header level. !13650 (Akihiro Nakashima)
• [FIXED] Improve bare project import: Allow subgroups, take default visibility level into account. !13670
• [FIXED] Fix group and project search for anonymous users. !13745
• [FIXED] Fix searching for files by path. !13798
• [FIXED] Fix division by zero error in blame age mapping. !13803 (Jeff Stubler)
• [FIXED] Fix incorrect date/time formatting on prometheus graphs. !13865
• [FIXED] Changes the password change workflow for admins. !13901
• [FIXED] API: Respect default group visibility when creating a group. !13903 (Robert Schilling)
• [FIXED] Unescape HTML characters in Wiki title. !13942 (Jacopo Beschi @jacopo-beschi)
• [FIXED] Make blob viewer for rich contents wider for mobile. !14011 (Takuya Noguchi)
• [FIXED] Fix typo in the API Deploy Keys documentation page. !14014 (Vitaliy @blackst0ne Klachkov)
• [FIXED] Hide admin link from default search results for non-admins. !14015
• [FIXED] Fix problems sanitizing URLs with empty passwords. !14083
• [FIXED] Fix stray OR in New Project page. !14096 (Robin Bobbitt)
• [FIXED] Fix a wrong X-Gitlab-Event header when testing webhooks. !14108
• [FIXED] Fix the diff file header from being html escaped for renamed files. !14121
• [FIXED] Image attachments are properly displayed in notification emails again. !14161
• [FIXED] Fixes the 500 errors caused by a race condition in GPG's tmp directory handling. !14194 (Alexis Reigel)
• [FIXED] Fix MR ready to merge buttons/controls at mobile breakpoint. !14242
• [FIXED] Fix Pipeline Triggers to show triggered label and predefined variables (e.g. CI_PIPELINE_TRIGGERED). !14244
• [FIXED] Allow using newlines in pipeline email service recipients. !14250
• [FIXED] Fix errors when moving issue with reference to a group milestone. !14294
• [FIXED] Fix the "resolve discussion in a new issue" button. !14357
• [FIXED] File uploaders do not perform hard check, only soft check.
• [FIXED] Add to_project_id parameter to Move Issue via API example.
• [FIXED] Update x/x discussions resolved checkmark icon to be green when all discussions resolved.
• [FIXED] Fixed add diff note button not showing after deleting a comment.
• [FIXED] Fix broken svg in jobs dropdown for success status.
• [FIXED] Fix buttons with different height in merge request widget.
• [FIXED] Removes disabled state from dashboard project button.
• [FIXED] Better align fallback image emojis.
• [FIXED] Remove focus styles from dropdown empty links.
• [FIXED] Fix inconsistent spacing for edit buttons on issues and merge request page.
• [FIXED] Fix edit merge request and issues button inconsistent letter casing.
• [FIXED] Improve Import/Export memory usage.
• [FIXED] Fix Import/Export issue to do with fork merge requests.
• [FIXED] Fix invite by email address duplication.
• [FIXED] Adds tooltip to the branch name and improves performance.
• [FIXED] Disable GitLab Project Import Button if source disabled.
• [FIXED] Migrate issues authored by deleted user to the Ghost user.
• [FIXED] Fix new navigation wrapping and causing height to grow.
• [FIXED] Normalize styles for empty state combo button.
• [FIXED] Fix external link to Composer website.
• [FIXED] Prevents jobs dropdown from closing in pipeline graph.
• [FIXED] Include the is_admin field in the GET /users/:id API when current user is an admin.
• [FIXED] Fix breadcrumbs container in issue boards.
• [FIXED] Fix project feature being deleted when updating project with invalid visibility level.
• [FIXED] Truncate milestone title if sidebar is collapsed.
• [FIXED] Prevents rendering empty badges when request fails.
• [FIXED] Fixes margins on the top buttons of the pipeline table.
• [FIXED] Bump jira-ruby gem to 1.4.1 to fix issues with HTTP proxies.
• [FIXED] Eliminate N+1 queries in loading discussions.json endpoint.
• [FIXED] Eliminate N+1 queries referencing issues.
• [FIXED] Remove unnecessary loading of discussions in IssuesController#show.
• [FIXED] Fix errors thrown in merge request widget with external CI service/integration.
• [FIXED] Do not show the Auto DevOps banner when the project has a .gitlab-ci.yml on master.
• [FIXED] Reword job to pipeline to reflect what the graphs are really about.
• [FIXED] Sort templates in the dropdown.
• [FIXED] Fix Auto DevOps banner to be shown on empty projects.
• [FIXED] Resolve Image onion skin + swipe does not work anymore.
• [FIXED] Fix mini graph pipeline breakin in merge request view.
• [FIXED] Fixed merge request changes bar jumping.
• [FIXED] Improve migrations using triggers.
• [FIXED] Fix ConvDev Index nav item and Monitoring submenu regression.
• [FIXED] disabling notifications globally now properly turns off group/project added emails !13325
• [DEPRECATED] Deprecate custom SSH client configuration for the git user. !13930
• [CHANGED] allow all users to delete their account. !13636 (Jacopo Beschi @jacopo-beschi)
• [CHANGED] Use full path of project's avatar in webhooks. !13649 (Vitaliy @blackst0ne Klachkov)
• [CHANGED] Add filtered search to group merge requests dashboard. !13688 (Hiroyuki Sato)
• [CHANGED] Fire hooks asynchronously when creating a new job to improve performance. !13734
• [CHANGED] Improve performance for AutocompleteController#users.json. !13754 (Hiroyuki Sato)
• [CHANGED] Update the GPG verification semantics: A GPG signature must additionally match the committer in order to be verified. !13771 (Alexis Reigel)
• [CHANGED] Support a multi-word fuzzy search issues/merge requests on search bar. !13780 (Hiroyuki Sato)
• [CHANGED] Default LDAP config "verify_certificates" to true for security. !13915
• [CHANGED] "Share with group lock" now applies to subgroups, but owner can override setting on subgroups. !13944
• [CHANGED] Make Gitaly PostUploadPack mandatory. !13953
• [CHANGED] Remove project select dropdown from breadcrumb. !14010
• [CHANGED] Redesign project feature permissions settings. !14062
• [CHANGED] Document version Group Milestones API introduced.
• [CHANGED] Finish migration to the new events setup.
• [CHANGED] restyling of OAuth authorization confirmation. (Jacopo Beschi @jacopo-beschi)
• [CHANGED] Added support for specific labels and colors.
• [CHANGED] Move "Move issue" controls to right-sidebar.
• [CHANGED] Remove pages settings when not available.
• [CHANGED] Allow all AutoDevOps banners to be turned off.
• [CHANGED] Update Rails project template to use Postgresql by default.
• [CHANGED] Added support the multiple time series for prometheus monitoring.
• [ADDED] API: Respect the "If-Unmodified-Since" header when delting a resource. !9621 (Robert Schilling)
• [ADDED] Protected runners. !13194
• [ADDED] Add support for copying permalink to notes via more actions dropdown. !13299
• [ADDED] Add API support for wiki pages. !13372 (Vitaliy @blackst0ne Klachkov)
• [ADDED] Add a Last 7 days option for Cycle Analytics view. !13443 (Mehdi Lahmam (@mehlah))
• [ADDED] inherits milestone and labels when a merge request is created from issue. !13461 (haseebeqx)
• [ADDED] Add 'from commit' information to cherry-picked commits. !13475 (Saverio Miroddi)
• [ADDED] Add an option to list only archived projects. !13492 (Mehdi Lahmam (@mehlah))
• [ADDED] Extend API: Pipeline Schedule Variable. !13653
• [ADDED] Add settings for minimum SSH key strength and allowed key type. !13712 (Cory Hinshaw)
• [ADDED] Add div id to the readme in the project overview. !13735 (Riccardo Padovani @rpadovani)
• [ADDED] Add CI/CD job predefined variables with user name and login. !13824
• [ADDED] API: Add GPG key management. !13828 (Robert Schilling)
• [ADDED] Add CI/CD active kubernetes job policy. !13849
• [ADDED] Add dropdown to Projects nav item. !13866
• [ADDED] Allow users and administrator to configure Auto-DevOps. !13923
• [ADDED] Implement failure_reason on ci_builds. !13937
• [ADDED] Add branch existence check to the APIv4 branches via HEAD request. !13979 (Vitaliy @blackst0ne Klachkov)
• [ADDED] Add quick submission on user settings page. !14007 (Vitaliy @blackst0ne Klachkov)
• [ADDED] Add my_reaction_emoji param to /issues and /merge_requests API. !14016 (Hiroyuki Sato)
• [ADDED] Make it possible to download a single job artifact file using the API. !14027
• [ADDED] Add repository toggle for automatically resolving outdated diff discussions. !14053 (AshleyDumaine)
• [ADDED] Scripts to detect orphaned repositories. !14204
• [ADDED] Created callout for auto devops.
• [ADDED] Add option in preferences to change navigation theme color.
• [ADDED] Add JSON logger in log/api_json.log for Grape API endpoints.
• [ADDED] Add CI_PIPELINE_SOURCE variable on CI Jobs.
• [ADDED] Changed message and title on the 404 page. (Branka Martinovic)
• [ADDED] Handle if Auto DevOps domain is not set in project settings.
• [ADDED] Add collapsable sections for Pipeline Settings.
• [OTHER] Add badge for dependency status. !13588 (Markus Koller)
• [OTHER] Migration to remove pending delete projects with non-existing namespace. !13598
• [OTHER] Bump rouge to v2.2.0. !13633
• [OTHER] Fix repository equality check and avoid fetching ref if the commit is already available. This affects merge request creation performance. !13685
• [OTHER] Replace 'source/search_code.feature' spinach test with an rspec analog. !13697 (blackst0ne)
• [OTHER] Remove unwanted refs after importing a project. !13766
• [OTHER] Never wait for sidekiq jobs when creating projects. !13775
• [OTHER] Gitaly feature toggles are on by default in development. !13802
• [OTHER] Remove is_ prefix from predicate method names. !13810 (Maxim Rydkin)
• [OTHER] Update 'Using Docker images' documentation. !13848
• [OTHER] Update gpg documentation with gpg2. !13851 (M M Arif)
• [OTHER] Replace 'project/star.feature' spinach test with an rspec analog. !13855 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Replace 'project/user_lookup.feature' spinach test with an rspec analog. !13863 (Vitaliy @blackst0ne Klachkov)
• [OTHER] Bump rouge to v2.2.1. !13887
• [OTHER] Add documentation for PlantUML in reStructuredText. !13900 (Markus Koller)
• [OTHER] Decrease ABC threshold to 55.25. !13904 (Maxim Rydkin)
• [OTHER] Decrease Cyclomatic Complexity threshold to 14. !13972 (Maxim Rydkin)
• [OTHER] Update documentation for confidential issue. !14117
• [OTHER] Remove redundant WHERE from event queries.
• [OTHER] Memoize the latest builds of a pipeline on a project's homepage.
• [OTHER] Re-use issue/MR counts for the pagination system.
• [OTHER] Memoize pipelines for project download buttons.
• [OTHER] Reorganize indexes for the "deployments" table.
• [OTHER] Improves markdown rendering performance for commit lists.
• [OTHER] Only update the sidebar count caches when needed.
• [OTHER] Improves performance of vue code by using vue files and moving svg out of data function in pipeline schedule callout.
• [OTHER] Rework how recent push events are retrieved.
• [OTHER] Restyle dropdown menus to make them look consistent.
• [OTHER] Upgrade grape to 1.0.
• [OTHER] Add usage data for Auto DevOps.
• [OTHER] Cache the number of open issues and merge requests.
• [OTHER] Constrain environment deployments to project IDs.
• [OTHER] Eager load namespace owners for project dashboards.
• [OTHER] Add description template examples to documentation.
• [OTHER] Disallow NULL values for environments.project_id.
• Add my reaction filter to search bar. !12962 (Hiroyuki Sato)
• Generalize profile updates from providers. !12968 (Alexandros Keramidas)
• Validate PO-files in static analysis. !13000
• First-time contributor badge. !13143 (Micaël Bergeron micaelbergeron@gmail.com)
• Add option to disable project export on instance. !13211 (Robin Bobbitt)
• Hashed Storage support for Repositories (EXPERIMENTAL). !13246
• Added tests for commits API unauthenticated user and public/private project. !13287 (Jacopo Beschi @jacopo-beschi)
• Fix CI_PROJECT_PATH_SLUG slugify. !13350 (Ivan Chernov)
• Add checks for branch existence before changing HEAD. !13359 (Vitaliy @blackst0ne Klachkov)
• Fix the alignment of line numbers to lines of code in code viewer. !13403 (Trevor Flynn)
• Allow users to move issues to other projects using a / command. !13436 (Manolis Mavrofidis)
• Bumps omniauth-ldap gem version to 2.0.4. !13465
• Implement the Gitaly RefService::RefExists endpoint. !13528 (Andrew Newdigate)
• Changed all font-weight values to 400 and 600 and introduced 2 variables to manage them.
• Simplify checking if objects exist code in new issaubles workers.
• Present enqueued merge jobs as Merging as well.
• Don't escape html entities in InlineDiffMarkdownMarker.
• Move ConvDev Index location to after Cohorts.
• Added type to CHANGELOG entries. (Jacopo Beschi @jacopo-beschi)
• [BUGIFX] Improves subgroup creation permissions. !13418