= GitLab Community Edition + Nexedi patches

[ci skip]

Mark thunky as MIT license for license_finder

See merge request !2165

Fix file disclosure via hidden symlinks using the project import (8.17)

See merge request !2160

Ensure user and hostnames begin with an alnum character in UrlBlocker

See merge request !2153

[ci skip]

[8-17 security fix] Renders 404 if given project is not readable by the user on Todos dashboard

See merge request !2136

Fix filename used for CHANGELOG entry

See merge request !2140

Merge branch 'security-8-17-backport-33323-fix-incorrect-project-authorizations' into 'security-8-17'

Escape the underscore char inside the LIKE operator

See merge request !2134

[ci skip]

https://dev.gitlab.org/gitlab/gitlabhq/builds/1072446

New Hamlit XSS fix, does not include extraneous changes

See merge request !2095

Refactor snippets finder & dont return internal snippets for external users

See merge request !2094

Fix XSS in branches dropdown

See merge request !2093

Respect project features in wiki and blob search

See merge request !2089

Fix snippets visibility for show action - external users can not see internal snippets

See merge request !2087

Sanitize submodule URLs before linking to them in the file tree view

See merge request !2084

Render asciidoc & other markup using banzai in a pipeline

See merge request !2088

Add correct `rel` attributes to external links when rendering markdown

See merge request !2086

[ci skip]

Fix for three open redirect vulns using redirect_to url_for(params.merge)))

See merge request !2082

Fix for path disclosure in project import/export

See merge request !2080

Previously accidently added a test for a feature that does not exist in this release
: preserved styles in labels

Fix for open redirect vuln involving continue[to] params

See merge request !2083

Don’t show source project name when user does not have access

See merge request !2081

Remove class from SanitizationFilter whitelist

See merge request !2079

[ci skip]

nil check for url_blocker?

See merge request !2076

fix for render json include leaks

See merge request !2074
Conflicts:
	app/controllers/projects/merge_requests_controller.rb
	spec/controllers/projects/issues_controller_spec.rb

Adds rel="noopener noreferrer" to all links with target="_blank"

See merge request !2071
Conflicts:
	app/assets/javascripts/environments/components/environment_external_url.js

Protect server against SSRF in project import URLs

See merge request !2068