Add latest changes from gitlab-org/gitlab@master

Author: GitLab Bot

CHANGELOG.md

@@ -2,6 +2,23 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 17.11.1 (2025-04-22)
+
+### Fixed (1 change)
+
+- [Fix string conversion for CI Inputs](https://gitlab.com/gitlab-org/security/gitlab/-/commit/aceb71126fb8ea5be6259a2156c6255bbaa1f3de)
+
+### Changed (1 change)
+
+- [Put allow_composite_identities_to_run_pipelines behind ff](https://gitlab.com/gitlab-org/security/gitlab/-/commit/2287e37df7c9ed82aa54643759e00bbf30a788c8)
+
+### Security (4 changes)
+
+- [Add SecureHeaders middleware with the Nel header](https://gitlab.com/gitlab-org/security/gitlab/-/commit/5a586de4d56429eabe0fb6ebc524894925759d2e) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4934))
+- [Restrict forwarded headers in Maven dependency proxy](https://gitlab.com/gitlab-org/security/gitlab/-/commit/80244b98dd92312510f4a9276b5adfcbaba8e68a) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4929))
+- [Security unauthorized access to reading branch names](https://gitlab.com/gitlab-org/security/gitlab/-/commit/9f9724584d109181e764f79a3b61667520d2212f) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4933))
+- [Simplify detecting paragraphs for quick actions](https://gitlab.com/gitlab-org/security/gitlab/-/commit/78466ef2cd3ddee5fbf0db67056a5bccf7c59907) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4925))
+
 ## 17.11.0 (2025-04-16)
 
 ### Added (211 changes)
@@ -767,6 +784,25 @@ entry.
 - [Remove feature flag allow_merge_request_pipelines_from_fork](https://gitlab.com/gitlab-org/gitlab/-/commit/b62f9187a57cc5ba66ce26889516cc55a425181a) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/182862))
 - [Finalize migration BackfillNewAuditEventTables](https://gitlab.com/gitlab-org/gitlab/-/commit/1bc0f07ffd3af5b9fab8a0ea0b1af5f2759d25db) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/181881))
 
+## 17.10.5 (2025-04-22)
+
+### Fixed (3 changes)
+
+- [Fix 500 in Todo API when wiki page todo exists](https://gitlab.com/gitlab-org/security/gitlab/-/commit/71215f0615fad3167fb96b521b9628e11ea30a5d)
+- [Clear session cookie when browser is closed](https://gitlab.com/gitlab-org/security/gitlab/-/commit/7c77ca404d9be7166d8ef991013394483b3f0371)
+- [Fix workspaces reconciliation to send inventory config map correctly](https://gitlab.com/gitlab-org/security/gitlab/-/commit/aba508e925aea81c4d47555254e6a657edc94863) **GitLab Enterprise Edition**
+
+### Security (4 changes)
+
+- [Add SecureHeaders middleware with the Nel header](https://gitlab.com/gitlab-org/security/gitlab/-/commit/0e180be62768513438f86ea99f0a4a305cca46b6) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4919))
+- [Restrict forwarded headers in Maven dependency proxy](https://gitlab.com/gitlab-org/security/gitlab/-/commit/faa100503f89d08e51549e4f35f362c9945dbb6f) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4930))
+- [Security unauthorized access to reading branch names](https://gitlab.com/gitlab-org/security/gitlab/-/commit/dc2f917499f58ed9ccff23158b39528b62b71c2f) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4895))
+- [Simplify detecting paragraphs for quick actions](https://gitlab.com/gitlab-org/security/gitlab/-/commit/507e465f21b5be5297eda7a67f0ba75994df88d8) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4926))
+
+### Other (1 change)
+
+- [No-op FinalizeBackfillCiRunnerMachinesPartitionedTable migration](https://gitlab.com/gitlab-org/security/gitlab/-/commit/119891459658f48120bcef02b1b66e3e78c78865)
+
 ## 17.10.4 (2025-04-09)
 
 ### Fixed (2 changes)
@@ -1608,6 +1644,20 @@ No changes.
 - [Quarantine a flaky test](https://gitlab.com/gitlab-org/gitlab/-/commit/998d8028213da6bf0c3c1c08301797c8b3395c28) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/180234))
 - [Quarantine a flaky test](https://gitlab.com/gitlab-org/gitlab/-/commit/8ae69a3765cfb7561db95e43faa30cc60fac6444) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/177662))
 
+## 17.9.7 (2025-04-22)
+
+### Security (4 changes)
+
+- [Add SecureHeaders middleware with the Nel header](https://gitlab.com/gitlab-org/security/gitlab/-/commit/5e9112ba2d6fac340e1dbfc4b0330bdcff2f82bc) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4920))
+- [Restrict forwarded headers in Maven dependency proxy](https://gitlab.com/gitlab-org/security/gitlab/-/commit/24d73f3e778471c4e0153af174f2d8b44e106108) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4931))
+- [Security unauthorized access to reading branch names](https://gitlab.com/gitlab-org/security/gitlab/-/commit/cb09987371857b97ec3cc5774b9f214c9db7c8a6) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4923))
+- [Simplify detecting paragraphs for quick actions](https://gitlab.com/gitlab-org/security/gitlab/-/commit/29d3f746b02137aaff4364473ce62f701d208e27) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4927))
+
+### Other (2 changes)
+
+- [Clean up BackfillCiRunnerMachinesPartitionedTable migration](https://gitlab.com/gitlab-org/security/gitlab/-/commit/76d351431e07b3a695356c7b78ac16d23b180302)
+- [No-op FinalizeBackfillCiRunnerMachinesPartitionedTable migration](https://gitlab.com/gitlab-org/security/gitlab/-/commit/fb16e2ebcc6188b3f9bb0bc30e7e2b709484f3b1)
+
 ## 17.9.6 (2025-04-09)
 
 ### Security (6 changes)

app/assets/javascripts/environments/graphql/resolvers/flux.js

@@ -117,11 +117,12 @@ const watchFluxResource = async ({
     };
 
     try {
+      const config = new Configuration(variables.configuration);
       await subscribeToSocket({
         watchId,
         watchParams,
-        configuration: variables.configuration,
         cacheParams,
+        config,
       });
     } catch {
       await watchFunction();

app/assets/javascripts/environments/services/websocket_connection_service.js

@@ -0,0 +1,18 @@
+import { WebSocketWatchManager } from '@gitlab/cluster-client';
+
+let watchManagerInstance = null;
+
+export function resetWatchManager() {
+  watchManagerInstance = null;
+}
+
+export function getWatchManager(configuration) {
+  if (!watchManagerInstance) {
+    if (!configuration) {
+      throw new Error('WebSocketWatchManager not initialized. Provide configuration first.');
+    }
+    watchManagerInstance = new WebSocketWatchManager(configuration);
+  }
+
+  return watchManagerInstance;
+}

app/assets/javascripts/kubernetes_dashboard/graphql/helpers/resolver_helpers.js

@@ -2,11 +2,11 @@ import {
   CoreV1Api,
   Configuration,
   WatchApi,
-  webSocketWatchManager,
   EVENT_DATA,
   EVENT_TIMEOUT,
   EVENT_ERROR,
 } from '@gitlab/cluster-client';
+import { getWatchManager } from '~/environments/services/websocket_connection_service';
 import { connectionStatus } from '~/environments/graphql/resolvers/kubernetes/constants';
 import { updateConnectionStatus } from '~/environments/graphql/resolvers/kubernetes/k8s_connection_status';
 import { s__ } from '~/locale';
@@ -54,13 +54,14 @@ export const mapEventItem = ({
   type,
 }) => ({ lastTimestamp, eventTime, message, reason, source, type });
 
-export const subscribeToSocket = async ({ watchId, watchParams, configuration, cacheParams }) => {
+export const subscribeToSocket = async ({ watchId, watchParams, cacheParams, config }) => {
   const { updateQueryCache, updateConnectionStatusFn } = cacheParams;
 
   try {
-    const watcher = await webSocketWatchManager.initConnection({
+    const watcherConnection = getWatchManager(config);
+
+    const watcher = await watcherConnection.initConnection({
       message: { watchId, watchParams },
-      configuration,
     });
 
     const handleConnectionStatus = (status) => {
@@ -142,7 +143,7 @@ export const watchWorkloadItems = async ({
     };
 
     try {
-      await subscribeToSocket({ watchId, watchParams, configuration, cacheParams });
+      await subscribeToSocket({ watchId, watchParams, cacheParams, config });
     } catch {
       await watchFunction();
     }

app/assets/javascripts/work_items/components/notes/work_item_add_note.vue

@@ -6,14 +6,14 @@ import * as Sentry from '~/sentry/sentry_browser_wrapper';
 import Tracking from '~/tracking';
 import { __ } from '~/locale';
 import { clearDraft } from '~/lib/utils/autosave';
-import { findWidget } from '~/issues/list/utils';
 import DiscussionReplyPlaceholder from '~/notes/components/discussion_reply_placeholder.vue';
 import ResolveDiscussionButton from '~/notes/components/discussion_resolve_button.vue';
 import { updateCacheAfterCreatingNote } from '../../graphql/cache_utils';
 import createNoteMutation from '../../graphql/notes/create_work_item_note.mutation.graphql';
 import workItemNotesByIidQuery from '../../graphql/notes/work_item_notes_by_iid.query.graphql';
 import workItemByIidQuery from '../../graphql/work_item_by_iid.query.graphql';
-import { TRACKING_CATEGORY_SHOW, WIDGET_TYPE_EMAIL_PARTICIPANTS, i18n } from '../../constants';
+import { TRACKING_CATEGORY_SHOW, i18n } from '../../constants';
+import { findEmailParticipantsWidget } from '../../utils';
 import WorkItemNoteSignedOut from './work_item_note_signed_out.vue';
 import WorkItemCommentLocked from './work_item_comment_locked.vue';
 import WorkItemCommentForm from './work_item_comment_form.vue';
@@ -223,7 +223,7 @@ export default {
       return this.isDiscussionResolved ? __('Unresolve thread') : __('Resolve thread');
     },
     hasEmailParticipantsWidget() {
-      return Boolean(findWidget(WIDGET_TYPE_EMAIL_PARTICIPANTS, this.workItem));
+      return Boolean(findEmailParticipantsWidget(this.workItem));
     },
   },
   watch: {

app/assets/javascripts/work_items/components/notes/work_item_comment_form.vue

@@ -3,14 +3,8 @@ import { GlButton, GlFormCheckbox, GlTooltipDirective } from '@gitlab/ui';
 import { helpPagePath } from '~/helpers/help_page_helper';
 import { s__, __ } from '~/locale';
 import { capitalizeFirstCharacter } from '~/lib/utils/text_utility';
-import {
-  STATE_OPEN,
-  WORK_ITEM_TYPE_NAME_TASK,
-  WIDGET_TYPE_EMAIL_PARTICIPANTS,
-  i18n,
-} from '~/work_items/constants';
+import { STATE_OPEN, WORK_ITEM_TYPE_NAME_TASK, i18n } from '~/work_items/constants';
 import { getDraft, clearDraft, updateDraft } from '~/lib/utils/autosave';
-import { findWidget } from '~/issues/list/utils';
 import { confirmAction } from '~/lib/utils/confirm_via_gl_modal/confirm_via_gl_modal';
 import glAbilitiesMixin from '~/vue_shared/mixins/gl_abilities_mixin';
 import MarkdownEditor from '~/vue_shared/components/markdown/markdown_editor.vue';
@@ -19,6 +13,7 @@ import WorkItemStateToggle from '~/work_items/components/work_item_state_toggle.
 import CommentFieldLayout from '~/notes/components/comment_field_layout.vue';
 import workItemByIidQuery from '../../graphql/work_item_by_iid.query.graphql';
 import workItemEmailParticipantsByIidQuery from '../../graphql/notes/work_item_email_participants_by_iid.query.graphql';
+import { findEmailParticipantsWidget } from '../../utils';
 
 const DOCS_WORK_ITEM_LOCKED_TASKS_PATH = helpPagePath('user/tasks.html', {
   anchor: 'lock-discussion',
@@ -269,8 +264,7 @@ export default {
       },
       update(data) {
         return (
-          findWidget(WIDGET_TYPE_EMAIL_PARTICIPANTS, data?.workspace?.workItem)?.emailParticipants
-            ?.nodes || []
+          findEmailParticipantsWidget(data?.workspace?.workItem)?.emailParticipants?.nodes || []
         );
       },
     },

app/assets/javascripts/work_items/components/shared/work_item_relationship_popover_metadata.vue

@@ -2,9 +2,7 @@
 import { GlTooltipDirective, GlAvatarsInline, GlAvatar, GlAvatarLink } from '@gitlab/ui';
 import ItemMilestone from '~/issuable/components/issue_milestone.vue';
 import { s__, sprintf } from '~/locale';
-import { WIDGET_TYPE_MILESTONE, WIDGET_TYPE_ASSIGNEES } from '~/work_items/constants';
-import { findWidget } from '~/issues/list/utils';
-import { getDisplayReference } from '../../utils';
+import { findAssigneesWidget, findMilestoneWidget, getDisplayReference } from '../../utils';
 
 export default {
   name: 'WorkItemRelationshipPopoverMetadata',
@@ -30,10 +28,10 @@ export default {
   assigneesDisplayLimit: 3,
   computed: {
     workItemAssignees() {
-      return findWidget(WIDGET_TYPE_ASSIGNEES, this.workItem)?.assignees?.nodes || [];
+      return findAssigneesWidget(this.workItem)?.assignees?.nodes || [];
     },
     workItemMilestone() {
-      return findWidget(WIDGET_TYPE_MILESTONE, this.workItem)?.milestone;
+      return findMilestoneWidget(this.workItem)?.milestone;
     },
     fullReference() {
       return getDisplayReference(this.workItemFullPath, this.workItem.reference);

app/assets/javascripts/work_items/components/work_item_crm_contacts.vue

@@ -1,16 +1,15 @@
 <script>
 import { GlLink, GlPopover, GlTooltipDirective, GlTruncateText } from '@gitlab/ui';
 import { difference, groupBy, xor } from 'lodash';
-import { findWidget } from '~/issues/list/utils';
 import { __, n__, s__ } from '~/locale';
 import WorkItemSidebarDropdownWidget from '~/work_items/components/shared/work_item_sidebar_dropdown_widget.vue';
 import Tracking from '~/tracking';
 import getGroupContactsQuery from '~/crm/contacts/components/graphql/get_group_contacts.query.graphql';
 import workItemByIidQuery from '~/work_items/graphql/work_item_by_iid.query.graphql';
 import updateWorkItemMutation from '../graphql/update_work_item.mutation.graphql';
 import updateNewWorkItemMutation from '../graphql/update_new_work_item.mutation.graphql';
-import { i18n, TRACKING_CATEGORY_SHOW, WIDGET_TYPE_CRM_CONTACTS } from '../constants';
-import { newWorkItemFullPath, newWorkItemId } from '../utils';
+import { i18n, TRACKING_CATEGORY_SHOW } from '../constants';
+import { findCrmContactsWidget, newWorkItemFullPath, newWorkItemId } from '../utils';
 
 export default {
   directives: {
@@ -86,7 +85,7 @@ export default {
       return this.groupByOrganization(this.selectedItems, false);
     },
     workItemCrmContacts() {
-      return findWidget(WIDGET_TYPE_CRM_CONTACTS, this.workItem);
+      return findCrmContactsWidget(this.workItem);
     },
     workItemFullPath() {
       return this.createFlow

app/assets/javascripts/work_items/components/work_item_development/work_item_development.vue

@@ -1,20 +1,12 @@
 <script>
 import { GlIcon, GlAlert, GlTooltipDirective } from '@gitlab/ui';
 import * as Sentry from '~/sentry/sentry_browser_wrapper';
-
 import { s__, __ } from '~/locale';
-import { findWidget } from '~/issues/list/utils';
-
 import workItemByIidQuery from '~/work_items/graphql/work_item_by_iid.query.graphql';
 import workItemDevelopmentQuery from '~/work_items/graphql/work_item_development.query.graphql';
 import workItemDevelopmentUpdatedSubscription from '~/work_items/graphql/work_item_development.subscription.graphql';
-import {
-  sprintfWorkItem,
-  WIDGET_TYPE_DEVELOPMENT,
-  STATE_OPEN,
-  DEVELOPMENT_ITEMS_ANCHOR,
-} from '~/work_items/constants';
-
+import { sprintfWorkItem, STATE_OPEN, DEVELOPMENT_ITEMS_ANCHOR } from '~/work_items/constants';
+import { findDevelopmentWidget } from '~/work_items/utils';
 import CrudComponent from '~/vue_shared/components/crud_component.vue';
 import WorkItemActionsSplitButton from '~/work_items/components/work_item_links/work_item_actions_split_button.vue';
 import WorkItemDevelopmentRelationshipList from './work_item_development_relationship_list.vue';
@@ -204,7 +196,7 @@ export default {
         };
       },
       update(data) {
-        return findWidget(WIDGET_TYPE_DEVELOPMENT, data?.workItem) || {};
+        return findDevelopmentWidget(data?.workItem) || {};
       },
       skip() {
         return !this.workItemIid;

app/assets/javascripts/work_items/components/work_item_links/work_item_rolled_up_data.vue

@@ -2,13 +2,8 @@
 import { GlIcon, GlTooltip, GlPopover } from '@gitlab/ui';
 import { s__, __ } from '~/locale';
 import workItemByIidQuery from '~/work_items/graphql/work_item_by_iid.query.graphql';
-import { findWidget } from '~/issues/list/utils';
-import {
-  i18n,
-  WIDGET_TYPE_WEIGHT,
-  WORK_ITEM_TYPE_NAME_EPIC,
-  WIDGET_TYPE_HEALTH_STATUS,
-} from '../../constants';
+import { i18n, WORK_ITEM_TYPE_NAME_EPIC } from '../../constants';
+import { findHealthStatusWidget, findWeightWidget } from '../../utils';
 
 export default {
   components: {
@@ -72,10 +67,10 @@ export default {
   },
   computed: {
     workItemWeight() {
-      return findWidget(WIDGET_TYPE_WEIGHT, this.workItem);
+      return findWeightWidget(this.workItem);
     },
     workItemHealthStatus() {
-      return findWidget(WIDGET_TYPE_HEALTH_STATUS, this.workItem);
+      return findHealthStatusWidget(this.workItem);
     },
     shouldRolledUpWeightBeVisible() {
       return this.showRolledUpWeight && this.rolledUpWeight !== null;

app/assets/javascripts/work_items/components/work_item_links/work_item_tree.vue

@@ -3,7 +3,6 @@ import { GlAlert } from '@gitlab/ui';
 import { sprintf, s__ } from '~/locale';
 import { createAlert } from '~/alert';
 import CrudComponent from '~/vue_shared/components/crud_component.vue';
-import { findWidget } from '~/issues/list/utils';
 import { getParameterByName } from '~/lib/utils/url_utility';
 import { getIdFromGraphQLId } from '~/graphql_shared/utils';
 import {
@@ -192,7 +191,7 @@ export default {
   },
   computed: {
     workItemHierarchy() {
-      return findWidget(WIDGET_TYPE_HIERARCHY, this.workItem);
+      return findHierarchyWidget(this.workItem);
     },
     rolledUpCountsByType() {
       return this.workItemHierarchy?.rolledUpCountsByType || [];

app/assets/javascripts/work_items/graphql/cache_utils.js

@@ -8,7 +8,6 @@ import { convertToGraphQLId } from '~/graphql_shared/utils';
 import { getBaseURL } from '~/lib/utils/url_utility';
 import { convertEachWordToTitleCase } from '~/lib/utils/text_utility';
 import { getDraft, clearDraft } from '~/lib/utils/autosave';
-import { findWidget } from '~/issues/list/utils';
 import {
   newWorkItemOptimisticUserPermissions,
   WIDGET_TYPE_ASSIGNEES,
@@ -32,6 +31,7 @@ import {
 } from 'ee_else_ce/work_items/constants';
 import {
   findCurrentUserTodosWidget,
+  findDescriptionWidget,
   findHierarchyWidget,
   findHierarchyWidgetChildren,
   findNotesWidget,
@@ -350,8 +350,7 @@ export const setNewWorkItemCache = async (
   const draftData = JSON.parse(getDraft(autosaveKey));
 
   const draftTitle = draftData?.workspace?.workItem?.title || '';
-  const draftDescriptionWidget =
-    findWidget(WIDGET_TYPE_DESCRIPTION, draftData?.workspace?.workItem) || {};
+  const draftDescriptionWidget = findDescriptionWidget(draftData?.workspace?.workItem) || {};
   const draftDescription = draftDescriptionWidget?.description || null;
 
   widgets.push({

app/assets/javascripts/work_items/graphql/resolvers.js

@@ -5,7 +5,12 @@ import { findWidget } from '~/issues/list/utils';
 import { newDate, toISODateFormat } from '~/lib/utils/datetime_utility';
 import { updateDraft } from '~/lib/utils/autosave';
 import { getParameterByName } from '~/lib/utils/url_utility';
-import { getNewWorkItemAutoSaveKey, newWorkItemFullPath } from '../utils';
+import {
+  findCustomFieldsWidget,
+  findStartAndDueDateWidget,
+  getNewWorkItemAutoSaveKey,
+  newWorkItemFullPath,
+} from '../utils';
 import {
   WIDGET_TYPE_ASSIGNEES,
   WIDGET_TYPE_COLOR,
@@ -15,7 +20,6 @@ import {
   WIDGET_TYPE_CRM_CONTACTS,
   WIDGET_TYPE_ITERATION,
   WIDGET_TYPE_WEIGHT,
-  WIDGET_TYPE_START_AND_DUE_DATE,
   NEW_WORK_ITEM_IID,
   WIDGET_TYPE_MILESTONE,
   WIDGET_TYPE_HIERARCHY,
@@ -44,7 +48,7 @@ const updateDatesWidget = (draftData, dates) => {
   const dueDate = dates.dueDate ? toISODateFormat(newDate(dates.dueDate)) : null;
   const startDate = dates.startDate ? toISODateFormat(newDate(dates.startDate)) : null;
 
-  const widget = findWidget(WIDGET_TYPE_START_AND_DUE_DATE, draftData.workspace.workItem);
+  const widget = findStartAndDueDateWidget(draftData.workspace.workItem);
   Object.assign(widget, {
     dueDate,
     startDate,
@@ -57,7 +61,7 @@ const updateDatesWidget = (draftData, dates) => {
 const updateCustomFieldsWidget = (sourceData, draftData, customField) => {
   if (!customField) return;
 
-  const widget = findWidget(WIDGET_TYPE_CUSTOM_FIELDS, draftData.workspace.workItem);
+  const widget = findCustomFieldsWidget(draftData.workspace.workItem);
 
   if (!widget) return;