From bb771faec6ad7288d4596bf681fd5fc82368bd7f Mon Sep 17 00:00:00 2001 From: GitLab Release Tools Bot Date: Thu, 27 Jun 2019 12:06:53 +0000 Subject: Update CHANGELOG.md for 11.10.8 [ci skip] --- CHANGELOG.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) (limited to 'CHANGELOG.md') diff --git a/CHANGELOG.md b/CHANGELOG.md index 8d4509e370d..4625685dc9a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -555,6 +555,26 @@ entry. - Add some frozen string to spec/**/*.rb. (gfyoung) +## 11.10.8 (2019-06-27) + +### Security (10 changes) + +- Fix Denial of Service for comments when rendering issues/MR comments. +- Gate MR head_pipeline behind read_pipeline ability. +- Fix DoS vulnerability in color validation regex. +- Expose merge requests count based on user access. +- Persist tmp snippet uploads at users. +- Add missing authorizations in GraphQL. +- Disable Rails SQL query cache when applying service templates. +- Prevent Billion Laughs attack. +- Correctly check permissions when creating snippet notes. +- Prevent the detection of merge request templates by unauthorized users. + +### Performance (1 change) + +- Add improvements to global search of issues and merge requests. !27817 + + ## 11.10.6 (2019-06-04) ### Fixed (7 changes, 1 of them is from the community) -- cgit v1.2.1