GitLab

## 18.3.1 (2025-08-26)
### Fixed (1 change)
- [Fix trusted proxies regression when hostname is specified](https://gitlab.com/gitlab-org/security/gitlab/-/commit/70f1e084bfff4ee4e66c25729afba77d11f567f1)
### Security (4 changes)
- [Gitea import rate limiting](https://gitlab.com/gitlab-org/security/gitlab/-/commit/eba1f64c91f30a3196b176cd02212a66b1602437) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5253))
- [Fix tag/branch ambiguity in raw file display](https://gitlab.com/gitlab-org/security/gitlab/-/commit/5c48100ee91213b8ba0d607a67b2dcd972cee889) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5248))
- [Add authentication check for manual variables via new policy](https://gitlab.com/gitlab-org/security/gitlab/-/commit/bf00956e1861280ab7e12e2ecc86f314ea125ade) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5255))
## 18.2.5 (2025-08-26)
### Fixed (2 changes)
- [Ignore silent mode in clickhouse http calls](https://gitlab.com/gitlab-org/security/gitlab/-/commit/ed59a658334df6d01362f6d23c08f5acd768ff8e)
- [Check Stage for self-managed](https://gitlab.com/gitlab-org/security/gitlab/-/commit/eb039f297e553de4847c97eff3c7c6f6f303fd7b) **GitLab Enterprise Edition**
### Security (4 changes)
- [Gitea import rate limiting](https://gitlab.com/gitlab-org/security/gitlab/-/commit/a9dd8d3b15f7b4b5a6c9775d9f72de2cf8fa36f3) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5252))
- [Fix tag/branch ambiguity in raw file display](https://gitlab.com/gitlab-org/security/gitlab/-/commit/f871b4ea8a988103c28423a99b7907fe1b36705a) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5238))
- [Add authentication check for manual variables via new policy](https://gitlab.com/gitlab-org/security/gitlab/-/commit/1f5b9f623bcc43612fa07861a57d0901291be72c) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5194))
## 18.1.5 (2025-08-26)
### Security (4 changes)
- [Gitea import rate limiting](https://gitlab.com/gitlab-org/security/gitlab/-/commit/5e14b26cb33e61c0605f1a0ec91c3e0467533fb3) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5254))
- [Fix tag/branch ambiguity in raw file display](https://gitlab.com/gitlab-org/security/gitlab/-/commit/ffb1039c1e06962b217b479799b6b3052a824b7b) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5239))
- [Add authentication check for manual variables via new policy](https://gitlab.com/gitlab-org/security/gitlab/-/commit/e4fa4e405ddb8eca1cfccc9a8db355a07254f8f3) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5195))

## 18.3.0 (2025-08-20)
### Added (205 changes)
- [Use Lookahead for work items children field](https://gitlab.com/gitlab-org/gitlab/-/commit/88fd35c29fcc27f174e80a513bf2d449938b8703) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/201725)) **GitLab Enterprise Edition**
- [Add security_inventory_filters table](https://gitlab.com/gitlab-org/gitlab/-/commit/fc95b7f4c8ae135db9f8b1003ba5442ae6b22a15) by @ysiev ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/198459)) **GitLab Enterprise Edition**
- [Add workflow events to project graphql](https://gitlab.com/gitlab-org/gitlab/-/commit/45cc21b30ac038dcc47427c6b458dc30d053ba3c) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/200083)) **GitLab Enterprise Edition**
- [Allow for editing of service account email address via UI](https://gitlab.com/gitlab-org/gitlab/-/commit/04ff57cc7ca7f60365f270ef359bd0d93dc042d6) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/201536))
- [Add trigger for work_item_transitions](https://gitlab.com/gitlab-org/gitlab/-/commit/aec76eda3ead8794fc6d9a3ddccec56d86df5cca) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/200955))
- [Add cron schedule option for LdapAddOnSeatSyncWorker](https://gitlab.com/gitlab-org/gitlab/-/commit/36fcc905a0957791a2e87575a11dfcf7f5bd14ec) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/200729)) **GitLab Enterprise Edition**
- [Add duo agent platform create and start events](https://gitlab.com/gitlab-org/gitlab/-/commit/77edea09fe29e9afec073e13d27493f94cc5f6e1) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/201505)) **GitLab Enterprise Edition**
- [Clickhouse model for ci_finished_builds](https://gitlab.com/gitlab-org/gitlab/-/commit/2a9b8e6fdc61814d92b8328b1a55dac7e3cce7a6) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/198683))
- [Adds FE for ui setting](https://gitlab.com/gitlab-org/gitlab/-/commit/32e39afc14df8f4a8fe8ff438c94af812ba5e666) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/200503))
- [Add JiraTrackerData sharding key db trigger](https://gitlab.com/gitlab-org/gitlab/-/commit/da0952c6b6bbeafc67b583ff204f15c204e223bb) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/201119))
- [Add MCP get_merge_request_pipelines_service](https://gitlab.com/gitlab-org/gitlab/-/commit/8a0390c0a30ecef47718e270db3834744387e8c9) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/201586))
- [Add backend link for email work item modal](https://gitlab.com/gitlab-org/gitlab/-/commit/9da1c9321d091776a4432bf8c51d79ed94128139) by @n.h.long.9697 ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/201422))
- [Gitaly page-token pagination for protected_tags and protected_branches](https://gitlab.com/gitlab-org/gitlab/-/commit/77978da98300bdf28bcf4d37d4ea70f326c30094) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/200493))
- [Enable committer_email feature flag to true](https://gitlab.com/gitlab-org/gitlab/-/commit/59cb2d23714db729dd84a538dc3a2cc561462a00) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/201519))
- [Add vertical resizing to text boxes](https://gitlab.com/gitlab-org/gitlab/-/commit/8e61b92cc785dfa25a1bf4c18b807587cdd818a7) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/198307))
- [Project level open vulnnerabiltiies](https://gitlab.com/gitlab-org/gitlab/-/commit/4e714bd9c871ba69379f90efda42063072f59eb6) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/201036)) **GitLab Enterprise Edition**
- [Add bypass options to a police drawer](https://gitlab.com/gitlab-org/gitlab/-/commit/c3b118436b9528e66b5f70d2c5a66df867a9ef3f) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/200328)) **GitLab Enterprise Edition**
(省略されました)

## 18.2.4 (2025-08-18)
### Fixed (1 change)
- [Update gitlab-shell to v14.44.0](https://gitlab.com/gitlab-org/gitlab/-/commit/b68a4e61107e7317839d60ba2bd2ca9c75c2be4b) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/201780))

## 18.2.3 (2025-08-18)
### Fixed (2 changes)
- [Merge branch 'bw-delegate-placeholder-check' into 'master'](https://gitlab.com/gitlab-org/gitlab/-/commit/c7370850eefb04eca86be0119b28fd85fe4b74b3) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/201366))
- [Fix the reset of sidebar navigation](https://gitlab.com/gitlab-org/gitlab/-/commit/6908b7b9653109d202e13973da3f91a38f30b961) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/200234))
## 17.11.7 (2025-08-14)
No changes.

## 18.2.2 (2025-08-12)
### Added (1 change)
- [Add outbound allowlist to allowed endpoints for SSRF filter](https://gitlab.com/gitlab-org/security/gitlab/-/commit/23e2fe82bd5ccb84b739833ecd0092129c690c2a)
### Fixed (7 changes)
- [Detect CORS problems in Web IDE](https://gitlab.com/gitlab-org/security/gitlab/-/commit/84bd4650037396a8b0df0dcf6b7747b669418e91)
- [Fix Web IDE loading race condition](https://gitlab.com/gitlab-org/security/gitlab/-/commit/8b48753fdce4a4fac10a07f45f1c1208afc32227)
- [Fix numpad enter not working for revision compare dropdown](https://gitlab.com/gitlab-org/security/gitlab/-/commit/a802fcffc7359add5f39acfd6a1ef057f4b5ea08)
- [Fix another case where Sidekiq can take too long to shut down](https://gitlab.com/gitlab-org/security/gitlab/-/commit/0d78035880ee5ed4f3fc7eac3b0aff67a5262103)
- [Fix: include relative URL root in PDF worker and cMap paths](https://gitlab.com/gitlab-org/security/gitlab/-/commit/f7254c6383db50493e211a79a5a3dec7a8b603c4)
- [New projects inherit parent value for duo_features_enabled](https://gitlab.com/gitlab-org/security/gitlab/-/commit/478689b1f93ee21bb8bfa38eb7142e3e2ed3822b) **GitLab Enterprise Edition**
- [Skip Geo secondary for SyncProjectPolicyWorker](https://gitlab.com/gitlab-org/security/gitlab/-/commit/20de308d39a6821b741b83d37cdef1d3718ace50) **GitLab Enterprise Edition**
### Changed (2 changes)
- [Check root namespace of project framework for SAAS only](https://gitlab.com/gitlab-org/security/gitlab/-/commit/051fe36ef0e9b208a8ede74bce73c8a6082f94d5) **GitLab Enterprise Edition**
- [Fix case sensitivity in CODEOWNERS validation](https://gitlab.com/gitlab-org/security/gitlab/-/commit/3c87a2c77787747a37be3069a91d7bdf7f98f42b) **GitLab Enterprise Edition**
### Security (12 changes)
- [Remove the destroy issue permission from the planner role](https://gitlab.com/gitlab-org/security/gitlab/-/commit/d604e0418ef28a03d49aa38830e1e8a6862d50ec) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5145))
- [Release names are unbounded, leads to server crash](https://gitlab.com/gitlab-org/security/gitlab/-/commit/bc504676f35f3cd17a6e397b2e14c232e4982c19) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5208))
- [Block access to assigned issues when group has IP restriction](https://gitlab.com/gitlab-org/security/gitlab/-/commit/859a6a48b098369ff31878d8caad7916be4bbc21) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5161))
- [More rigorous sanitization of placeholders](https://gitlab.com/gitlab-org/security/gitlab/-/commit/2c5937032ef4ef28234fecfe291bd072550e2545) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5205))
(省略されました)

## 18.2.1 (2025-07-22)
### Fixed (1 change)
- [Fix S3 compatibility in Workhorse uploads for non-AWS S3 providers](https://gitlab.com/gitlab-org/security/gitlab/-/commit/053528b7e6e451f7b7e41e3ea1be98fc79bdc98a)
### Changed (1 change)
- [Preserve workflowID when canceling duo agentic chat](https://gitlab.com/gitlab-org/security/gitlab/-/commit/974f1b29a43b61f1644d1f0e89152921fa6e093a) **GitLab Enterprise Edition**
### Security (4 changes)
- [Prevent Duo Code Review from Showing Internal Notes](https://gitlab.com/gitlab-org/security/gitlab/-/commit/49eb66cb6c57e074077f6e48e09e8e3699dd5937) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5143))
- [Restrict Service Desk email visibility to reporter+ role](https://gitlab.com/gitlab-org/security/gitlab/-/commit/ea29f809e2bb029e18506afa58d2f0eea337c4d2) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5150))
- [Add authorization to job field on deployment type](https://gitlab.com/gitlab-org/security/gitlab/-/commit/56e86a993e0954d7bb1b5883872f3016ed451550) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5140))
## 18.1.3 (2025-07-22)
### Security (4 changes)
- [Prevent Duo Code Review from Showing Internal Notes](https://gitlab.com/gitlab-org/security/gitlab/-/commit/181999a033b2b0972c4b22edcea776a68a3d4a13) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5086))
- [Restrict Service Desk email visibility to reporter+ role](https://gitlab.com/gitlab-org/security/gitlab/-/commit/22af4f97cd80bffcba82b311d4caa31a075ae2f3) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5151))
- [Add authorization to job field on deployment type](https://gitlab.com/gitlab-org/security/gitlab/-/commit/743c520ceffb91b16590355ebbaf9a97b413ff5f) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5133))
## 18.0.5 (2025-07-22)
### Security (4 changes)
- [Prevent Duo Code Review from Showing Internal Notes](https://gitlab.com/gitlab-org/security/gitlab/-/commit/7e057275a4ccc5b03270a37822f0bd5906379bc7) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5087))
- [Restrict Service Desk email visibility to reporter+ role](https://gitlab.com/gitlab-org/security/gitlab/-/commit/b8e10067cdaa6f2fcb8e737ff98cbbda7a3c1c42) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5152))
- [Add authorization to job field on deployment type](https://gitlab.com/gitlab-org/security/gitlab/-/commit/14ccab850f5a380811dd495aeec0b035dadfc288) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5132))

## 18.2.0 (2025-07-16)
### Added (203 changes)
- [Cleanup package_registry_audit_events FF](https://gitlab.com/gitlab-org/gitlab/-/commit/a2203b63af9306abb314ee7a4a899b27705b6367) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197329))
- [Add vulnerability id to csv export](https://gitlab.com/gitlab-org/gitlab/-/commit/9ccaa0414e3d8aff61dfa210850f16a06e439a65) by @he-patrick ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197038)) **GitLab Enterprise Edition**
- [Archived & Stalled status for agent flows](https://gitlab.com/gitlab-org/gitlab/-/commit/92d4b5edda4f1088902f9ebeccb576e124f071a8) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197587))
- [Add issue to MR feature flag](https://gitlab.com/gitlab-org/gitlab/-/commit/41942778c06d7ece5a9e3a0a1c58b012f847a064) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197601)) **GitLab Enterprise Edition**
- [Project webhook events for Groups](https://gitlab.com/gitlab-org/gitlab/-/commit/ecedfe6746c2bc42672face501846620ec596d14) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197489)) **GitLab Enterprise Edition**
- [Detect incorrect sequence owners](https://gitlab.com/gitlab-org/gitlab/-/commit/d0f0f47e2c84285bc4c62bf82bcef44c25ba3d40) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197521))
- [Add visibility to projects API when using `simple` flag](https://gitlab.com/gitlab-org/gitlab/-/commit/35a57c5237aa23df26c36f2d67df699f5ec67455) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/196896))
- [Release the beta of the Maven Virtual Registry](https://gitlab.com/gitlab-org/gitlab/-/commit/50e6adbdcce0c99d7f5e370b4b89b23b57bf8510) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197432))
- [Add support for placeholder variables in markdown](https://gitlab.com/gitlab-org/gitlab/-/commit/e817748d61cf4b24db38e4573f863842adf04540) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/194934))
- [Default enable consolidation audit event feature flags](https://gitlab.com/gitlab-org/gitlab/-/commit/301a6df351ec6e5b8b234f94700914116b9c46f9) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197001)) **GitLab Enterprise Edition**
- [Add user preference for maintaining cursor](https://gitlab.com/gitlab-org/gitlab/-/commit/e8d58c9f583c4a1e3fc0d8de79426fda1c733345) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197504))
- [Add bypass_settings to MR approval policy](https://gitlab.com/gitlab-org/gitlab/-/commit/8dd73bf3fe8498b500e08f93bd8c1c180d5ec831) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/196249)) **GitLab Enterprise Edition**
- [Update GitLab Pages version](https://gitlab.com/gitlab-org/gitlab/-/commit/cbdf3075e42e88fa9fd660d75d9de5845a01089b) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197471))
- [Add new mutation that adds children items to work items](https://gitlab.com/gitlab-org/gitlab/-/commit/098b7d39f77322c7425bd54e65956e3ae9e075da) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/196291))
- [Cleanup feature flag and add feature spec](https://gitlab.com/gitlab-org/gitlab/-/commit/9ff53e981f03281f322ed27da95f20f35a33f42e) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/195665)) **GitLab Enterprise Edition**
- [feat: Add bulk move functionality to WorkItems::BulkUpdate](https://gitlab.com/gitlab-org/gitlab/-/commit/2846395973ea2c456c676a8e05ae736e8306f85b) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/196698))
- [Add support for pagination in GLQL](https://gitlab.com/gitlab-org/gitlab/-/commit/ca3c24b24928c45134bc95a9c878bb56e51610c9) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/196188))
(省略されました)

## 18.1.2 (2025-07-09)
### Fixed (5 changes)
- [Rake Doctor Secrets: Fix WebHook error](https://gitlab.com/gitlab-org/security/gitlab/-/commit/ce02068cccff230ffbef2f88b169902fe7f43bbf)
- [Fix title on empty projects](https://gitlab.com/gitlab-org/security/gitlab/-/commit/3ea74609f662c78433afcfe160a028a5bbbdf2fc)
- [Show both author and committer in last commit](https://gitlab.com/gitlab-org/security/gitlab/-/commit/52ba3c0f90dd0ebc4f6a27beab60588f091068af)
- [Remove Sidekiq shutdown delay in ConcurrencyLimitSampler](https://gitlab.com/gitlab-org/security/gitlab/-/commit/03315bd4f35d87ff58220bf581158698ce163b72)
- [Fix code owner validation for roles](https://gitlab.com/gitlab-org/security/gitlab/-/commit/e797849679b80d660a34b65f11dd7506e9fdf35b) **GitLab Enterprise Edition**
### Changed (2 changes)
- [Fix the owner for sequence ci_builds_id_seq](https://gitlab.com/gitlab-org/security/gitlab/-/commit/d594b6dc14fc5b2ed52f49e7d97d1a2363397185)
- [Enable using glab for CI release](https://gitlab.com/gitlab-org/security/gitlab/-/commit/b91e1226900cbdbb1dfd53efd65c9cb2b6d2f64a)
### Security (6 changes)
- [Revert "Merge branch..." from 18.1](https://gitlab.com/gitlab-org/security/gitlab/-/commit/5384ab91a8eaaa1cfe253eb093277f76cde48d09) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5126))
- [Enforces invite_group_members permission when creating group members](https://gitlab.com/gitlab-org/security/gitlab/-/commit/e3f78357e039d70c0eaf67d86f46cced28c8ce3b) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5105))
- [Fix XSS via blob rich viewer](https://gitlab.com/gitlab-org/security/gitlab/-/commit/2cd8baa02ea37d89d2f7c67749947da520cb4ea1) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5119))
- [Fix CI ID Token claims for forked project MR jobs](https://gitlab.com/gitlab-org/security/gitlab/-/commit/1a79ece45035eec1d5daee10f89363be089ff069) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5114))
- [Prevent linking fork if target group disallows external forks](https://gitlab.com/gitlab-org/security/gitlab/-/commit/3ccce42e662ce3849c8dde62975e21146d6ef0fa) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5102))
## 18.0.4 (2025-07-09)
### Fixed (8 changes)
- [Fix incorrect redirect when branch doesn't include files](https://gitlab.com/gitlab-org/security/gitlab/-/commit/3e7fb0bdef7ebc8ac321646a94305eacfd93acc0)
(省略されました)

## 18.1.1 (2025-06-24)
### Security (5 changes)
- [Fix guest permissions for incident hierarchy updates](https://gitlab.com/gitlab-org/security/gitlab/-/commit/f3cd30dec5fc9123ce7afecc5f94d74b4083f7cf) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5078))
- [Fix the validation logic for IDP Certificate Fingerprint](https://gitlab.com/gitlab-org/security/gitlab/-/commit/f53497ee0ff29b45f4a3698a7085d036891afbe2) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5081))
- [Checking if framework and project have same namespace](https://gitlab.com/gitlab-org/security/gitlab/-/commit/e328730a2b5373b3b400d734b1d6ac3cdb436b19) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5075))
- [Fix incorrect role grant after a user access_request](https://gitlab.com/gitlab-org/security/gitlab/-/commit/cb1b44753248959f3738c502570148cd6ad43059) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5077))
- [Prevent anonymous users from creating uploads](https://gitlab.com/gitlab-org/security/gitlab/-/commit/6e8cee2e35a2f61c610b95569b76ac74d546455a) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5076))
## 18.0.3 (2025-06-24)
### Fixed (1 change)
- [Support markdown anchors and multi-line in permalink](https://gitlab.com/gitlab-org/security/gitlab/-/commit/1aca27fe15724ca4a6bff73f65fa3155b202b32c)
### Changed (2 changes)
- [Revert "Merge branch 'backport-bugfix-restrict-LFS-download--18-0' into '18-0-stable-ee'"](https://gitlab.com/gitlab-org/security/gitlab/-/commit/f0cc5baad16efa00a8278c4d4234385c2039182c)
- [Restrict LFS file download to project-bound objects](https://gitlab.com/gitlab-org/security/gitlab/-/commit/c5676a6947bb17a155a0c9b3b2c45d7105e2e2e2)
### Security (5 changes)
- [Fix guest permissions for incident hierarchy updates](https://gitlab.com/gitlab-org/security/gitlab/-/commit/393fa90059048c02b2c23d9ce05714380d42422c) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5079))
- [Fix the validation logic for IDP Certificate Fingerprint](https://gitlab.com/gitlab-org/security/gitlab/-/commit/4db4074ab27350a14d21850ca2c316d40af10954) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5082))
- [Checking if framework and project have same namespace](https://gitlab.com/gitlab-org/security/gitlab/-/commit/37ee6b859cb83fb2565e8ad0a46b131b7cd12358) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5066))
- [Fix incorrect role grant after a user access_request](https://gitlab.com/gitlab-org/security/gitlab/-/commit/26d16766ba6535c99938736f27d7cf6aba3f9ff0) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5054))
- [Prevent anonymous users from creating uploads](https://gitlab.com/gitlab-org/security/gitlab/-/commit/9f6b810f819bb80ef3f0643cafe7e6d442f804b7) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5063))
(省略されました)

## 18.1.0 (2025-06-18)
### Added (182 changes)
- [Update yaml with branch patterns](https://gitlab.com/gitlab-org/gitlab/-/commit/2ce0ac184a6644496b6ed97db1a155984cba2ca3) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/193441)) **GitLab Enterprise Edition**
- [Show warning for incidents dragging on status list](https://gitlab.com/gitlab-org/gitlab/-/commit/7aaa20fe6b9ccabe78f6f127e8b10c6213679a7e) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/193563))
- [Extracts logic for Pipeline Secret Detection into its own feature card](https://gitlab.com/gitlab-org/gitlab/-/commit/b8c283030b543d87ae62797dfb59c1f54eb7b4bd) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/194103))
- [Update table_size database dictionary entries](https://gitlab.com/gitlab-org/gitlab/-/commit/da28142b6e18617a080dee0924cab70fd32910e5) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/193853))
- [Remove experiment flag from CiLint mutation](https://gitlab.com/gitlab-org/gitlab/-/commit/aac08a48dcf18fbd420f76216a7b9a33b1990980) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/194599))
- [New UI for the personal access tokens in the profile settings](https://gitlab.com/gitlab-org/gitlab/-/commit/e5394a7d66393d4881e6ebbcc1e3c96e30ea886a) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/194582))
- [Clean up duo_workflow_commit_tools feature flag](https://gitlab.com/gitlab-org/gitlab/-/commit/62e708f3761f60e5a0bc3349388138afb3c1c0ea) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/194486)) **GitLab Enterprise Edition**
- [Add work items display settings to user preferences](https://gitlab.com/gitlab-org/gitlab/-/commit/f99042538ab1cc62c0222d30fbd9cfa9a4751aac) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/193878))
- [Add marked_for_deletion field to Projects GraphQL query](https://gitlab.com/gitlab-org/gitlab/-/commit/fbb60e4f9e7f086d0e3e9546f32b6030e82b5974) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/193696))
- [WIP Add toggle for new violations view](https://gitlab.com/gitlab-org/gitlab/-/commit/b0091695cd0843e4bae98d2012201b711cfa8c89) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/193226)) **GitLab Enterprise Edition**
- [Implement `DELETE /Groups/:id` SCIM endpoint](https://gitlab.com/gitlab-org/gitlab/-/commit/91864e91e0f8a5e4868b53c51b98305a46d2d94b) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/192421)) **GitLab Enterprise Edition**
- [Implement grouping for new adherence report](https://gitlab.com/gitlab-org/gitlab/-/commit/ccb2135f4d7300fe5abd9cb5e47d7f6a19e3c049) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/193794)) **GitLab Enterprise Edition**
- [Graphql query for controls coverage](https://gitlab.com/gitlab-org/gitlab/-/commit/8e496e01af42c208b38a1ab1f470f97a6c741f0e) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/192880)) **GitLab Enterprise Edition**
- [Add zoekt node services](https://gitlab.com/gitlab-org/gitlab/-/commit/91efe37e0bf253740f497cfc9c61c9acf6146d31) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/192789)) **GitLab Enterprise Edition**
- [Add a worker to update minimum override role](https://gitlab.com/gitlab-org/gitlab/-/commit/b643f313f64b8508686eb87d59fd8cb9ea177347) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/188932))
- [Show icons on status lists](https://gitlab.com/gitlab-org/gitlab/-/commit/ebfe58dd27f641446609c2533079b626ca374e6d) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/193966))
- [Implement compliance requirement status hover popup](https://gitlab.com/gitlab-org/gitlab/-/commit/f7b5080207ba8ae313efc9b9f09e03246e3239f8) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/188369)) **GitLab Enterprise Edition**
(省略されました)

## 18.0.2 (2025-06-11)
### Fixed (5 changes)
- [Fix Upgrade to 18.0: No such column](https://gitlab.com/gitlab-org/security/gitlab/-/commit/bde20c3f31d324493d032be57be4465f0919760e)
- [Fix IDE links returns about:blank in old code dropdown](https://gitlab.com/gitlab-org/security/gitlab/-/commit/633864727f574f9d9b93826bb76d66a790382915)
- [Fix the title/body issue for todo apis when it is a duo todo](https://gitlab.com/gitlab-org/security/gitlab/-/commit/d8080ea15af34cf804ce024b207f2fa4817c87a6) **GitLab Enterprise Edition**
- [Fix gitpod button is missing in the edit dropdown](https://gitlab.com/gitlab-org/security/gitlab/-/commit/4bbef760c63924f2821233d98dc04c1982751430)
- [Move fork_networks organization_id NOT NULL to post-migrate](https://gitlab.com/gitlab-org/security/gitlab/-/commit/2bbea09c16044981bf316dd43544a87e4bf67147)
### Security (8 changes)
- [Protect webhook from excessive payload lengths](https://gitlab.com/gitlab-org/security/gitlab/-/commit/990fae5b6be86c6769c2086578ae2096762e21a8) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5059))
- [Backport for "Add validation for board name length" to 18-0 stable](https://gitlab.com/gitlab-org/security/gitlab/-/commit/ba616a03359751fc3add6f8504c79f4381efa703) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5044))
- [Fix # #1329 - IDOR in compliance framework export endpoint](https://gitlab.com/gitlab-org/security/gitlab/-/commit/ffea57e8e171b120f5f66fe81da39a21e5ab0258) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5041))
- [Fix authorization for compliance frameworks projects](https://gitlab.com/gitlab-org/security/gitlab/-/commit/0d783852162009bc5286a939534f2a5e2f1ae7ef) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5034))
- [security: Git redirection inconsistency](https://gitlab.com/gitlab-org/security/gitlab/-/commit/3fb95759edb3e7729b981bf48140ef9a05a32761) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5020))
- [Fix XSS with CSP bypass in JSON tables](https://gitlab.com/gitlab-org/security/gitlab/-/commit/fcfebf2f188ed90eea3f7db92ebeedcbadc6504d) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5022))
- [Limit HTTP response size](https://gitlab.com/gitlab-org/security/gitlab/-/commit/f8bf80825e1bd802be7be374905600059abd2726) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/5014))
## 17.11.4 (2025-06-11)
### Fixed (2 changes)
- [Fix gitpod button is missing in the edit dropdown](https://gitlab.com/gitlab-org/security/gitlab/-/commit/813a005dc240c1bfafc313ded694317a96f1a877)
- [Attempt to migrate ci_runner_taggings table (try 2)](https://gitlab.com/gitlab-org/security/gitlab/-/commit/706a075f79838d5d8421c5eae2e96a7601164201)
(省略されました)