We now make use of the `content_tag` helper so that the untrusted input
is escaped and the trusted output is then automatically safe. When we
don't need to wrap the name in a `span` tag (when `avatar` is falsey),
it's treated as unsafe by default, so no further sanitization/escaping
is necessary.

Fixes race condition in project uploads

See merge request !2141

Fix XSS issue in go-get handling

See merge request !2128

Fixes the User Selection Display (9.5)

See merge request gitlab/gitlabhq!2177

Fire system hooks when a user is created via LDAP or OAuth

Closes #37073

See merge request !13846

Fix old MR diffs

Closes #36516

See merge request !13744

Fix displaying events of removed events and events without commit messages

Closes #36685 and #36722

See merge request !13721

Remove tooltip from filtered search user

Closes #36696

See merge request !13752

Fix blank button not resetting project template value

Closes #36816

See merge request !13757

Properly encode Gitaly RawBlame request params

See merge request !13764

Support simple string LDAP attribute specifications, and search for name rather…

Closes #36841

See merge request !13776

Fix alignment of gpg status

Closes #36709

See merge request !13772

Hide group title on sidebar collapse; use more generic class for titles

Closes #36589

See merge request !13777

Stub `ForkedStorageCheck.storage_available?` by default in all specs

See merge request !13726

Fix inability to test some project integrations

Closes gitlab-ee#3194

See merge request !13729

Resolve "Badges should not be HUGE"

Closes #36496

See merge request !13635

Update GitLab Pages (9.5)

See merge request !2159

[ci skip]

Fix merge request head pipeline when pipeline has errors

Closes #36657

See merge request !13664
# Conflicts:
#	spec/services/ci/create_pipeline_service_spec.rb

Fix caching of future broadcast messages

Closes #36661

See merge request !13667

Update form to properly set the path

Closes #36519

See merge request !13722

36721 Remove incorrect paragraph regarding renaming repos in settings

Closes #36721

See merge request !13718

Raise Git GC (Housekeeping) Lease Timeout to 24h

See merge request !13719

Circuitbreaker settings to avoid spec-failures

Closes #36324

See merge request !13519

Correctly encode string params for Gitaly's TreeEntries RPC

Closes #36720

See merge request !13724

Greatly reduce test duration for git_access_spec

See merge request !13675

Add docs for group issues page and group merge requests page

Closes #36533

See merge request !13678

Only require sidekiq-limit_fetch when enabled in settings

Closes #36253

See merge request !13715

Resolve "User profile activity feed contains broken image links"

Closes #36458

See merge request !13606

Remove superfluous users bundle

See merge request !13684