Prevent password sign in restriction bypass

See merge request gitlab/gitlabhq!2702

Resolve: Milestones leaked via search API

Closes #2822

See merge request gitlab/gitlabhq!2997

Disallow invalid MR branch name

See merge request gitlab/gitlabhq!3052

Handling password on import by url page

See merge request gitlab/gitlabhq!3061

Protect Gitlab::HTTP against DNS rebinding attack

See merge request gitlab/gitlabhq!3071

Fix url redaction for issue links

See merge request gitlab/gitlabhq!3091

Hide issue title on unsubscribe for anonymous users

See merge request gitlab/gitlabhq!3097

Fix confidential issue label disclosure on milestone view

See merge request gitlab/gitlabhq!3098

Gitlab::HTTP now resolves the hostname only once, verifies the IP is not
blocked, and then uses the same IP to perform the actual request, while
passing the original hostname in the `Host` header and SSL SNI field.

[ci skip]

Revert "Add expand/collapse button to operation settings"

See merge request gitlab-org/gitlab-ce!28818

This reverts merge request !28620

Move more project routes under /-/ scope

See merge request gitlab-org/gitlab-ce!28717

Upgrade Jest to v24.8.0

See merge request gitlab-org/gitlab-ce!28786

Use source ref in pipeline webhook

Closes #61553

See merge request gitlab-org/gitlab-ce!28772

added code differences from EE to CE

See merge request gitlab-org/gitlab-ce!28711

added a new conditional to add `display: none;` dynamically if the row should be hidden, indicated by the variable `rowHidden`

this solves issue #9978

Update dependency @gitlab/svgs to ^1.63.0

See merge request gitlab-org/gitlab-ce!28715

Throw an error when formatDate's input is invalid

See merge request gitlab-org/gitlab-ce!28713

Resolve CE/EE diffs in project members

Closes gitlab-ee#10496

See merge request gitlab-org/gitlab-ce!28550

Externalize strings of preferences page in user profile

See merge request gitlab-org/gitlab-ce!28746

Append endline only if suggestion present

Closes #58566

See merge request gitlab-org/gitlab-ce!28703

Before this fix, a suggestion which just removes
an empty line wasn't appliable

Externalize stirngs of Authentication log page in user profile

See merge request gitlab-org/gitlab-ce!28750

protected should be Boolean type

See merge request gitlab-org/gitlab-ce!28766

Add expand/collapse button to operation settings

Closes #61511

See merge request gitlab-org/gitlab-ce!28620

Add ability to expand/collapse operation settings

Docs: Remove stray full stop from the middle of the sentence

See merge request gitlab-org/gitlab-ce!28403

Update order of list to match HA setup order

See merge request gitlab-org/gitlab-ce!28429

Improve performance of jobs controller show

Closes #60708

See merge request gitlab-org/gitlab-ce!28093

Merge branch '28996-automatic-https-certificate-creation-renewal-for-pages-custom-domains-4' into 'master'

Store Let's Encrypt private_key in `application_settings` instead of `secrets.yml`

See merge request gitlab-org/gitlab-ce!28353

Storing this key in secrets.yml was a bad idea,
it would require users using HA setups to manually
replicate secrets across nodes during update,
it also needed support from omnibus package

* Revert "Generate Let's Encrypt private key"
  This reverts commit 444959bf.

* Add Let's Encrypt private key to settings
  as encrypted attribute

* Generate Let's Encrypt private key
  in database migration

Group SAML docs explain GitLab.com SSO sign in

See merge request gitlab-org/gitlab-ce!28699