[merge-train skip]

[ci skip]

Prepare 16.0.2 release for gitlab-jh

See merge request gitlab-cn/gitlab!1721

[merge-train skip]

[ci skip]

[ci skip]

Fix DoS on test report artifacts

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3271



Merged-by: Jenny Kim <yjeankim@gitlab.com>
Approved-by: Ethan Urie <eurie@gitlab.com>
Approved-by: Félix Veillette-Potvin <fveillette@gitlab.com>
Co-authored-by: Dmytro Biryukov <dbiryukov@gitlab.com>

Merge branch 'security-fix-DoS-on-test-report-artifacts_mr-850-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3271

Changelog: security

Fix XSS in Abuse Reports form action

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3289



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Jessie Young <jessieyoung@gitlab.com>
Co-authored-by: Dheeraj Joshi <djoshi@gitlab.com>

Merge branch 'security-xss-abuse-reports-url-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3289

Changelog: security

Escape the source branch link correctly

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3286



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Peter Leitzen <pleitzen@gitlab.com>
Co-authored-by: Dheeraj Joshi <djoshi@gitlab.com>

Merge branch 'security-xss-merge-request-fork-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3286

Changelog: security

Import source owners with maintainer access if importer is a maintainer

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3282



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Tetiana Chupryna <tchupryna@gitlab.com>
Co-authored-by: Abdul Wadood <awadood@gitlab.com>

Merge branch 'security-892-importing-members-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3282

Changelog: security

Filter inaccessible issuable notes when exporting project

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3275



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Max Woolf <mwoolf@gitlab.com>
Co-authored-by: Eugenia Grieff <egrieff@gitlab.com>

Merge branch 'security-cross-group-child-issues-export-notes-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3275

Changelog: security

Block tag names that are prepended with refs/tags/, due to conflicts

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3269



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Vasilii Iakliushin <viakliushin@gitlab.com>
Reviewed-by: Vasilii Iakliushin <viakliushin@gitlab.com>
Co-authored-by: Robert May <rmay@gitlab.com>

Merge branch 'security-406764-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3269

Changelog: security

Set IP in ActionContoller filter before IP enforcement is evaluated

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3278



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Stan Hu <stanhu@gmail.com>
Co-authored-by: Imre Farkas <ifarkas@gitlab.com>

Merge branch 'security-407891-ip_enforcement_for_public_projects-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3278

Changelog: security

Merge branch 'security-dblessing_fix_unverified_primary_email_commit_public-16-0' into '16-0-stable-ee'

Prevent primary email returned as verified on unsaved change

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3259



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Allen Cook <acook@gitlab.com>
Co-authored-by: Drew Blessing <drew@gitlab.com>

Merge branch 'security-dblessing_fix_unverified_primary_email_commit_public-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3259

Changelog: security

Use UntrustedRegexp to protect FrontMatter filter

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3258



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Etienne Baqué <ebaque@gitlab.com>
Co-authored-by: Brett Walker <bwalker@gitlab.com>

Merge branch 'security-untrusted-front-matter-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3258

Changelog: security

Improve ambiguous_ref? logic to include heads and tags

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3294



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Robert May <rmay@gitlab.com>
Co-authored-by: Joe Woodward <jwoodward@gitlab.com>

Merge branch 'security-security/406844-ambiguous-branch-name-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3294

Changelog: security

Use UntrustedRegexp to protect InlineDiff filter

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3253



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Rajendra Kadam <rkadam@gitlab.com>
Co-authored-by: Brett Walker <bwalker@gitlab.com>

Merge branch 'security-untrusted-inlinediff-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3253

Changelog: security

Ignore user-defined diff paths in diff notes

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3266



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Phil Hughes <me@iamphill.com>
Co-authored-by: Jacques <jerasmus@gitlab.com>

Merge branch 'security-prevent-diff-for-path-vulnerability-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3266

Changelog: security

Reject NPM metadata requests with invalid package_name

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3281



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: David Fernandez <dfernandez@gitlab.com>
Co-authored-by: Radamanthus Batnag <rbatnag@gitlab.com>

Merge branch 'security-fix-open-redirection-npm-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3281

Changelog: security

Use UntrustedRegexp to protect MathFilter regex

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3252



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Kerri Miller <kerrizor@kerrizor.com>
Co-authored-by: Brett Walker <bwalker@gitlab.com>

Merge branch 'security-untrusted-math-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3252

Changelog: security

Resolve Overall Project Vulnerability Disclosure

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3270



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Harsha Muralidhar <hmuralidhar@gitlab.com>
Approved-by: Kevin Morrison <kmorrison@gitlab.com>
Co-authored-by: Gregory <11164960-ghavenga@users.noreply.gitlab.com>

Merge branch 'security-heads/security/390840-confidential-issue-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3270

Changelog: security

Validate description length in labels

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3244



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Bob Van Landuyt <bob@gitlab.com>
Co-authored-by: Mario Celi <mcelicalderon@gitlab.com>