[merge-train skip]

[ci skip]

Prepare 16.0.7 release for gitlab-jh

See merge request gitlab-cn/gitlab!1815

[merge-train skip]

[ci skip]

[ci skip]

Add authorization to the subscriptions group controller

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3380



Merged-by: Mayra Cabrera <mcabrera@gitlab.com>
Approved-by: Doug Stull <dstull@gitlab.com>
Approved-by: Thong Kuah <tkuah@gitlab.com>
Co-authored-by: Doug Stull <dstull@gitlab.com>

Merge branch 'security-416797-fix-auth-issue-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3380

Changelog: security

[merge-train skip]

[ci skip]

Prepare 16.0.6 release for gitlab-jh

See merge request gitlab-cn/gitlab!1791

[merge-train skip]

[ci skip]

[ci skip]

Revert 'security-leaked-ci-job-token-permission-16-0' from '16-0'"

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3373



Merged-by: John Skarbek <jskarbek@gitlab.com>
Approved-by: A Browne <abrowne@gitlab.com>
Approved-by: Dominic Couture <dcouture@gitlab.com>
Co-authored-by: Max Fan <mfan@gitlab.com>

Merge branch 'revert-98be80c9' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3373

Changelog: security

Use fully qualified ref when loading code owner file

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3355



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Vasilii Iakliushin <viakliushin@gitlab.com>
Co-authored-by: Joe Woodward <jwoodward@gitlab.com>

Merge branch 'security-410123-bypass-code-owner-approvals-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3355

Changelog: security

Maintainer can leak masked webhook secrets by manipulating URL masking

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3360



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Luke Duncalfe <lduncalfe@gitlab.com>
Co-authored-by: bmarjanovic <bmarjanovic@gitlab.com>

Merge branch 'security-410433-confidential-issue-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3360

Changelog: security

Remove approvals when the only commit gets amended

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3367



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Patrick Bajao <ebajao@gitlab.com>
Co-authored-by: David Kim <dkim@gitlab.com>

Merge branch 'security-fix-907-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3367

Changelog: security

Merge branch 'security-415131-add-authorization-to-failures-action-16-0-stable' into '16-0-stable-ee'

Add authorization validation to GithubController#failures action

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3334



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Mark Chao <mchao@gitlab.com>
Co-authored-by: Rodrigo Tomonari <rtomonari@gitlab.com>

Merge branch 'security-415131-add-authorization-to-failures-action-16-0-stable' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3334

Changelog: security

Fix for fork permissions check in compare controller

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3343



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Vasilii Iakliushin <viakliushin@gitlab.com>
Co-authored-by: Robert May <rmay@gitlab.com>

Merge branch 'security-408137-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3343

Changelog: security

Webhook token leaked in Sidekiq logs if log format is 'default'

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3346



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Roy Zwambag <rzwambag@gitlab.com>
Co-authored-by: bmarjanovic <bmarjanovic@gitlab.com>

Merge branch 'security-409034-confidential-issue-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3346

Changelog: security

Mitigate epic reference filter ReDOS

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3340



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Vitali Tatarintev <vtatarintev@gitlab.com>
Co-authored-by: Brett Walker <bwalker@gitlab.com>

Merge branch 'security-untrusted-epic-reference-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3340

Changelog: security

Increasing security for CI_JOB_TOKEN on public and internal projects

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3318



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: A Browne <abrowne@gitlab.com>
Co-authored-by: Max Fan <mfan@gitlab.com>

Merge branch 'security-leaked-ci-job-token-permission-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3318

Changelog: security

Adjust access to value stream create, edit and destroy actions

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3321



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Felipe Artur <fcardozo@gitlab.com>
Co-authored-by: cablett <cablett@gitlab.com>
Co-authored-by: Adam Hegyi <ahegyi@gitlab.com>

Merge branch 'security_cablett_414269_16-0-fix_value_streams' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3321

Changelog: security

Merge branch 'security-dblessing_fix_html_injection_admin_unconfirmed_user-16-0' into '16-0-stable-ee'

Sanitize user email addresses in admin confirm user dialog

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3331



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Kassio Borges <kborges@gitlab.com>
Co-authored-by: Drew Blessing <drew@gitlab.com>

Merge branch 'security-dblessing_fix_html_injection_admin_unconfirmed_user-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3331

Changelog: security