Add latest changes from gitlab-org/security/gitlab@13-9-stable-eev13.9.2

8 files changed, 13 insertions, 31 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1bd602f975d..b5a038d9106 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,18 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 13.9.2 (2021-03-04)
+
+### Security (6 changes)
+
+- Bump thrift gem to 0.14.0.
+- Allow only owners to manage group variables.
+- Do not store marshalled sessions ids in Redis.
+- Fix XSS in wiki author email and name.
+- Workhorse: prevent escaped router path traversal.
+- Fix XSS vulnerability for swagger file viewer.
+
+
 ## 13.9.1 (2021-02-23)
 
 ### Fixed (6 changes, 1 of them is from the community)
diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index f8b8809d011..8b723ee01f4 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-13.9.1
\ No newline at end of file
+13.9.2
\ No newline at end of file
diff --git a/changelogs/unreleased/security-bvl-update-thrift-gem.yml b/changelogs/unreleased/security-bvl-update-thrift-gem.yml
deleted file mode 100644
index afe1a0332e3..00000000000
--- a/changelogs/unreleased/security-bvl-update-thrift-gem.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Bump thrift gem to 0.14.0
-merge_request:
-author:
-type: security
diff --git a/changelogs/unreleased/security-ci-api-variables-permissions.yml b/changelogs/unreleased/security-ci-api-variables-permissions.yml
deleted file mode 100644
index 05642a0ff57..00000000000
--- a/changelogs/unreleased/security-ci-api-variables-permissions.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Allow only owners to manage group variables
-merge_request:
-author:
-type: security
diff --git a/changelogs/unreleased/security-clean-up-active-sessions.yml b/changelogs/unreleased/security-clean-up-active-sessions.yml
deleted file mode 100644
index 49d24584ddb..00000000000
--- a/changelogs/unreleased/security-clean-up-active-sessions.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Do not store marshalled sessions ids in Redis
-merge_request:
-author:
-type: security
diff --git a/changelogs/unreleased/security-fj-fix-xss-wiki-email.yml b/changelogs/unreleased/security-fj-fix-xss-wiki-email.yml
deleted file mode 100644
index 9faabdc9750..00000000000
--- a/changelogs/unreleased/security-fj-fix-xss-wiki-email.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix XSS in wiki author email and name
-merge_request:
-author:
-type: security
diff --git a/changelogs/unreleased/security-jv-workhorse-router-13-9.yml b/changelogs/unreleased/security-jv-workhorse-router-13-9.yml
deleted file mode 100644
index af17a71086d..00000000000
--- a/changelogs/unreleased/security-jv-workhorse-router-13-9.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: 'Workhorse: prevent escaped router path traversal'
-merge_request:
-author:
-type: security
diff --git a/changelogs/unreleased/security-upgrade-swagger-ui.yml b/changelogs/unreleased/security-upgrade-swagger-ui.yml
deleted file mode 100644
index 280dd92e23e..00000000000
--- a/changelogs/unreleased/security-upgrade-swagger-ui.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix XSS vulnerability for swagger file viewer
-merge_request:
-author:
-type: security