[merge-train skip]

[ci skip]

[ci skip]

Fix infinite loop when finding component project

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3666



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Laura Montemayor <lmontemayor@gitlab.com>
Co-authored-by: Fabio Pitino <fpitino@gitlab.com>

Merge branch 'security-security/fix-infinite-loop-component-project-16-4' into '16-4-stable-ee'

See merge request gitlab-org/security/gitlab!3666

Changelog: security

Update gitlab-chronic-duration to 0.12

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3628



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Laura Montemayor <lmontemayor@gitlab.com>
Co-authored-by: Avielle Wolfe <awolfe@gitlab.com>

Merge branch '16-4-update-cdg-version' into '16-4-stable-ee'

See merge request gitlab-org/security/gitlab!3628

Changelog: security

Guard gitlab_version_check helper

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3653



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Kassio Borges <kborges@gitlab.com>
Co-authored-by: Lukas Eipert <leipert@gitlab.com>

Merge branch 'security-no-version-ping-from-super-sidebar-16-4' into '16-4-stable-ee'

See merge request gitlab-org/security/gitlab!3653

Changelog: security

Add the environment action to the CI JWT token fields

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3616



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Shinya Maeda <shinya@gitlab.com>
Approved-by: Nikola Milojevic <nmilojevic@gitlab.com>
Approved-by: Ameya Darshan <adarshan@gitlab.com>
Co-authored-by: Timo Furrer <tfurrer@gitlab.com>

Merge branch 'security-ci-jwt-add-environment-action-16-4' into '16-4-stable-ee'

See merge request gitlab-org/security/gitlab!3616

Changelog: security

Remove FIFO files from tarball extract

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3633



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Rémy Coutable <remy@rymai.me>
Co-authored-by: James Nutt <jnutt@gitlab.com>

Merge branch 'security-blocking-fifo-16-4' into '16-4-stable-ee'

See merge request gitlab-org/security/gitlab!3633

Changelog: security

Backport add abuse detection for pipes

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3618



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Madelein van Niekerk <mvanniekerk@gitlab.com>
Co-authored-by: John Mason <jmason@gitlab.com>

Merge branch 'security-jm-abusive-pipes-16-4' into '16-4-stable-ee'

See merge request gitlab-org/security/gitlab!3618

Changelog: security

Prevent unprivileged user assignment in templated projects

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3636



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Heinrich Lee Yu <heinrich@gitlab.com>
Co-authored-by: Joe Woodward <jwoodward@gitlab.com>

Merge branch 'security-416244-user-swap-on-templated-project-16-4' into '16-4-stable-ee'

See merge request gitlab-org/security/gitlab!3636

Changelog: security

Merge branch 'security-16-4-ms-fix-sd-email-template-issue-description-privileges' into '16-4-stable-ee'

Fixes Service Desk email template issue description privileges

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3640



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Felipe Artur <fcardozo@gitlab.com>
Co-authored-by: Marc Saleiko <msaleiko@gitlab.com>

Merge branch 'security-16-4-ms-fix-sd-email-template-issue-description-privileges' into '16-4-stable-ee'

See merge request gitlab-org/security/gitlab!3640

Changelog: security

Update mermaid version for DOS fixes

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3626



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Dheeraj Joshi <djoshi@gitlab.com>
Co-authored-by: Deepika Guliani <dguliani@gitlab.com>

Merge branch 'security-977-update-mermaid-16-4' into '16-4-stable-ee'

See merge request gitlab-org/security/gitlab!3626

Changelog: security

Fix bug with batched gitaly ref deletion duplicates

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/134328



Merged-by: Kamil Trzciński <ayufan@ayufan.eu>
Approved-by: Kamil Trzciński <ayufan@ayufan.eu>
Reviewed-by: Kamil Trzciński <ayufan@ayufan.eu>
Co-authored-by: Dylan Griffith <dyl.griffith@gmail.com>

Create Geo event when project is created

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/134264



Merged-by: Michael Kozono <mkozono@gitlab.com>
Approved-by: Javiera Tapia <jtapia@gitlab.com>
Approved-by: Michael Kozono <mkozono@gitlab.com>
Reviewed-by: Michael Kozono <mkozono@gitlab.com>
Reviewed-by: Aakriti Gupta <agupta@gitlab.com>
Reviewed-by: Javiera Tapia <jtapia@gitlab.com>
Co-authored-by: Aakriti Gupta <agupta@gitlab.com>

Changelog: other
EE: true

Quarantine flaky delete_job_spec:46

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/134565



Merged-by: Jennifer Li <jli@gitlab.com>
Approved-by: Jennifer Li <jli@gitlab.com>

Fix pipeline schedules view when owner is nil

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/134481



Merged-by: Payton Burdette <pburdette@gitlab.com>
Approved-by: Payton Burdette <pburdette@gitlab.com>
Co-authored-by: Stan Hu <stanhu@gmail.com>

The pipeline schedule Vue refactor in
https://gitlab.com/gitlab-org/gitlab/-/merge_requests/128913 caused
pipeline schedules not to be rendered when an owner of a pipeline
schedule was nil. This can happen if the user is deleted.

Update the GraphQL schema and Vue code to allow for a nil owner.

Relates to https://gitlab.com/gitlab-org/gitlab/-/issues/427747

Changelog: fixed

If there are duplicates sent in a single Git command we get an error.
This de-duplication works around this. We could also consider
de-duplicating in the queue but this is tricky to do without race
conditions and would also require a migration. Without the `uniq` fix
this new test fails with:

```
Gitlab::Git::CommandError:
13:unable to prepare: reference has been updated multiple times
within a transaction.
```

Backport to 16.4: Geo: Avoid getting resources stuck in Queued

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/134197



Merged-by: David Fernandez <dfernandez@gitlab.com>
Approved-by: David Fernandez <dfernandez@gitlab.com>

Geo: Avoid getting resources stuck in Queued

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/133782



Merged-by: David Fernandez <dfernandez@gitlab.com>
Approved-by: Ian Baum <ibaum@gitlab.com>
Approved-by: David Fernandez <dfernandez@gitlab.com>
Co-authored-by: Mike Kozono <mkozono@gitlab.com>

(cherry picked from commit 9f473420)

31442fb7 Geo: Avoid getting resources stuck in Queued

Backport: fix migration when commit_message_negative_regex is missing

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/133833



Merged-by: Dylan Griffith <dyl.griffith@gmail.com>
Approved-by: Dylan Griffith <dyl.griffith@gmail.com>
Co-authored-by: Vasilii Iakliushin <viakliushin@gitlab.com>

Update dependency prometheus-client-mmap to '>= 0.28.1'

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/133877



Merged-by: Mario Celi <mcelicalderon@gitlab.com>
Approved-by: Mario Celi <mcelicalderon@gitlab.com>
Co-authored-by: GitLab Renovate Bot <gitlab-bot@gitlab.com>

We've been seeing issues with client metrics being truncated after the
Puma master (worker 0) process is killed. It appears that this was
happening:

1. Puma `parent` process starts and opens `histogram_puma_master-0.db`
   and creates a bunch of metrics, causing the file size to increase
   to 16K.
2. Puma `parent` forks this process as `worker 0`.
3. Puma `worker 0` continues to add more metrics and increases the
   size of the metrics, from 32K to 64K, and so on.
4. Puma `worker 0` is killed.
5. A new Puma worker forks from `parent` and attempts to `close`.
   Although the actual length is 64K, this new worker inherits from
   `parent` and erroneously truncates the metrics file to 16K.

Upgrading prometheus-client-mmap disables this truncation since it
causes issues and doesn't really add value.

This fixes
https://gitlab.com/gitlab-org/ruby/gems/prometheus-client-mmap/-/issues/53.

Changelog: fixed

Contributes to https://gitlab.com/gitlab-org/gitlab/-/issues/426066

**Problem**

Some GitLab instances are missing a 'commit_message_negative_regex'
field. It leads to migration failures.

**Solution**

Fix migrations

Changelog: fixed

Backport notes.id BIGINT conversion fix to 16.4.0

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/133613



Merged-by: Krasimir Angelov <kangelov@gitlab.com>
Approved-by: Nailia Iskhakova <niskhakova@gitlab.com>
Approved-by: Krasimir Angelov <kangelov@gitlab.com>
Co-authored-by: Leonardo da Rosa <ldarosa@gitlab.com>

Prevents note column swap migration to fail

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/132686



Merged-by: Krasimir Angelov <kangelov@gitlab.com>
Approved-by: Krasimir Angelov <kangelov@gitlab.com>
Reviewed-by: Krasimir Angelov <kangelov@gitlab.com>
Reviewed-by: Prabakaran Murugesan <pmurugesan@gitlab.com>
Co-authored-by: Leonardo Rosa <ldarosa@gitlab.com>

(cherry picked from commit 235f08d8)

b0210924 Prevents note column swap migration to fail
01d2ac36 Apply reviewers suggestions

Backport fix flaky epic_show_spec.rb

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/133395



Merged-by: Dheeraj Joshi <djoshi@gitlab.com>
Approved-by: Dheeraj Joshi <djoshi@gitlab.com>
Co-authored-by: Deepika Guliani <dguliani@gitlab.com>

Changelog: fixed
EE: true