.gitlab/CODEOWNERS

@@ -795,7 +795,6 @@ lib/gitlab/checks/**
 /doc/api/import.md @ashrafkhamis
 /doc/api/instance_clusters.md @z_painter
 /doc/api/instance_level_ci_variables.md @marcel.amirault
-/doc/api/integrations.md @ashrafkhamis
 /doc/api/invitations.md @emily.sahlani
 /doc/api/issue_links.md @msedlakjakubowski
 /doc/api/issues.md @msedlakjakubowski
@@ -840,6 +839,7 @@ lib/gitlab/checks/**
 /doc/api/project_clusters.md @z_painter
 /doc/api/project_forks.md @emily.sahlani
 /doc/api/project_import_export.md @ashrafkhamis
+/doc/api/project_integrations.md @ashrafkhamis
 /doc/api/project_job_token_scopes.md @marcel.amirault
 /doc/api/project_level_variables.md @marcel.amirault
 /doc/api/project_markdown_uploads.md @msedlakjakubowski
@@ -1027,7 +1027,7 @@ lib/gitlab/checks/**
 /doc/raketasks/x509_signatures.md @brendan777
 /doc/security/ @idurham
 /doc/security/hardening_nist_800_53.md @emily.sahlani
-/doc/solutions/ @jfullam @brianwald @Darwinjs
+/doc/solutions/ @jfullam @Darwinjs @sbrightwell
 /doc/solutions/integrations/servicenow.md @ashrafkhamis
 /doc/subscriptions/ @lciutacu
 /doc/subscriptions/gitlab_com/ @lyspin
@@ -1111,8 +1111,6 @@ lib/gitlab/checks/**
 /doc/user/group/_index.md @emily.sahlani
 /doc/user/group/access_and_permissions.md @emily.sahlani
 /doc/user/group/clusters/ @z_painter
-/doc/user/group/compliance_frameworks.md @eread
-/doc/user/group/compliance_pipelines.md @eread
 /doc/user/group/contribution_analytics/ @lciutacu
 /doc/user/group/credentials_inventory.md @idurham
 /doc/user/group/custom_project_templates.md @brendan777

.rubocop_todo/lint/non_atomic_file_operation.yml

----
-# Cop supports --autocorrect.
-Lint/NonAtomicFileOperation:
-  Exclude:
-    - 'lib/gitlab/ci/trace.rb'
-    - 'lib/gitlab/database/migrations/test_batched_background_runner.rb'
-    - 'lib/gitlab/gpg.rb'
-    - 'lib/gitlab/import_export/after_export_strategies/base_after_export_strategy.rb'
-    - 'lib/gitlab/import_export/recursive_merge_folders.rb'
-    - 'lib/gitlab/memory/upload_and_cleanup_reports.rb'
-    - 'lib/tasks/gitlab/update_templates.rake'
-    - 'lib/tasks/tanuki_emoji.rake'

.rubocop_todo/rspec/be_nil.yml

@@ -69,21 +69,6 @@ RSpec/BeNil:
     - 'spec/requests/api/markdown_uploads_spec.rb'
     - 'spec/requests/api/merge_requests_spec.rb'
     - 'spec/requests/api/settings_spec.rb'
-    - 'spec/serializers/issue_entity_spec.rb'
-    - 'spec/serializers/member_user_entity_spec.rb'
-    - 'spec/services/alert_management/alerts/todo/create_service_spec.rb'
-    - 'spec/services/groups/transfer_service_spec.rb'
-    - 'spec/services/merge_requests/merge_service_spec.rb'
-    - 'spec/services/packages/ml_model/create_package_file_service_spec.rb'
-    - 'spec/services/packages/npm/generate_metadata_service_spec.rb'
-    - 'spec/services/projects/create_from_template_service_spec.rb'
-    - 'spec/services/projects/enable_deploy_key_service_spec.rb'
-    - 'spec/services/service_desk/custom_email_verifications/create_service_spec.rb'
-    - 'spec/services/service_desk/custom_emails/create_service_spec.rb'
-    - 'spec/services/service_desk/custom_emails/destroy_service_spec.rb'
-    - 'spec/services/suggestions/apply_service_spec.rb'
-    - 'spec/services/users/untrust_service_spec.rb'
-    - 'spec/services/users/upsert_credit_card_validation_service_spec.rb'
     - 'spec/support/shared_examples/lib/gitlab/gitaly_client_shared_examples.rb'
     - 'spec/support/shared_examples/lib/gitlab/template/template_shared_examples.rb'
     - 'spec/support/shared_examples/models/diff_positionable_note_shared_examples.rb'

.rubocop_todo/style/symbol_proc.yml

@@ -2,15 +2,8 @@
 # Cop supports --autocorrect.
 Style/SymbolProc:
   Exclude:
-    - 'app/controllers/profiles_controller.rb'
     - 'app/models/ci/pipeline.rb'
-    - 'app/models/container_repository.rb'
-    - 'app/models/discussion.rb'
     - 'app/models/environment.rb'
-    - 'app/models/integrations/prometheus.rb'
-    - 'app/models/members/project_member.rb'
-    - 'app/models/preloaders/merge_request_diff_preloader.rb'
-    - 'app/models/release.rb'
     - 'app/models/remote_mirror.rb'
     - 'app/models/snippet_input_action_collection.rb'
     - 'app/policies/group_policy.rb'
@@ -95,10 +88,6 @@ Style/SymbolProc:
     - 'lib/api/helpers/internal_helpers.rb'
     - 'lib/atlassian/jira_connect/serializers/base_entity.rb'
     - 'lib/bulk_imports/common/pipelines/entity_finisher.rb'
-    - 'lib/bulk_imports/ndjson_pipeline.rb'
-    - 'lib/container_registry/client.rb'
-    - 'lib/container_registry/gitlab_api_client.rb'
-    - 'lib/gitlab/analytics/cycle_analytics/stage_events.rb'
     - 'lib/gitlab/auth/o_auth/auth_hash.rb'
     - 'lib/gitlab/blob_helper.rb'
     - 'lib/gitlab/cache/ci/project_pipeline_status.rb'
@@ -188,4 +177,3 @@ Style/SymbolProc:
     - 'spec/support/shared_examples/models/label_note_shared_examples.rb'
     - 'spec/views/layouts/_published_experiments.html.haml_spec.rb'
     - 'spec/workers/snippets/schedule_bulk_repository_shard_moves_worker_spec.rb'
-    - 'tooling/lib/tooling/test_map_generator.rb'

CHANGELOG.md

@@ -2,6 +2,19 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
+## 17.9.1 (2025-02-26)
+
+### Fixed (1 change)
+
+- [Fix instance level dashboard by default severity override](https://gitlab.com/gitlab-org/security/gitlab/-/commit/56d2f940bb6e87b34e4f26ba9a298f28360dd23a) **GitLab Enterprise Edition**
+
+### Security (4 changes)
+
+- [Increase minimum role in SPP to read policy yaml](https://gitlab.com/gitlab-org/security/gitlab/-/commit/593c0a6f70564e9570fb16b25a37298eacf6c644) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4718))
+- [Fix access to read code review analytics in private projects](https://gitlab.com/gitlab-org/security/gitlab/-/commit/0faa526c76e3c523ff6486057c5b5b07e8e4e5d9) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4794))
+- [Escape work item dropdown items and restrict HTML tags](https://gitlab.com/gitlab-org/security/gitlab/-/commit/fc777a98ebd45b30ab95bc0d94a418479d15f09c) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4788))
+- [Use stricter CSP values in the packages dependency proxy](https://gitlab.com/gitlab-org/security/gitlab/-/commit/922d3ad17cf7493a10f8dbf90c0cae8d9d4b063d) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4787))
+
 ## 17.9.0 (2025-02-19)
 ### Added (202 changes)
@@ -1083,6 +1096,15 @@ entry.
 - [Quarantine a flaky test](https://gitlab.com/gitlab-org/gitlab/-/commit/c932e35efdc0e3c6f316a3c2d37045e115ce8cd5) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/176452))
 - [Finalize migration BackfillRemoteDevelopmentAgentConfigsProjectId](https://gitlab.com/gitlab-org/gitlab/-/commit/da4c63d7aab3685c3fbe9d1e48f68ba2162a0b5e) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/172769))
+## 17.8.4 (2025-02-26)
+
+### Security (4 changes)
+
+- [Increase minimum role in SPP to read policy yaml](https://gitlab.com/gitlab-org/security/gitlab/-/commit/9bfcf4a596b965ce73426d68861cec83ee70f19e) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4716))
+- [Fix access to read code review analytics in private projects](https://gitlab.com/gitlab-org/security/gitlab/-/commit/537159f505cad7d23cded01140fbdfd84e9cdfa2) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4758))
+- [Escape work item dropdown items and restrict HTML tags](https://gitlab.com/gitlab-org/security/gitlab/-/commit/5548168c3d4e0ba660ed934f23c332045a640799) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4784))
+- [Use stricter CSP values in the packages dependency proxy](https://gitlab.com/gitlab-org/security/gitlab/-/commit/d491abd511c9c1cb00c928e28dc84cb7ef8e4cd3) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4764))
+
 ## 17.8.3 (2025-02-21)
 ### Fixed (2 changes)
@@ -1574,6 +1596,19 @@ entry.
 - [Remove default on `group_saved_replies_flag feature flag](https://gitlab.com/gitlab-org/gitlab/-/commit/75d49fe13646e1e0d3b68233ac4a965c86853917) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/175647))
 - [Remove use_actual_plan_in_license_check flag](https://gitlab.com/gitlab-org/gitlab/-/commit/b8c3fe16aedb69c82ff52d1c695d72e933c4b946) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/175649))
+## 17.7.6 (2025-02-26)
+
+### Fixed (1 change)
+
+- [Fix failed jobs widget polling issue](https://gitlab.com/gitlab-org/security/gitlab/-/commit/e2154d3d886d82e1f5fe62fb9d234d00e257e784)
+
+### Security (4 changes)
+
+- [Increase minimum role in SPP to read policy yaml](https://gitlab.com/gitlab-org/security/gitlab/-/commit/6d5c2ea1feb6097cb5720650f39b3808554b6a29) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4717))
+- [Fix access to read code review analytics in private projects](https://gitlab.com/gitlab-org/security/gitlab/-/commit/4454c18d19d2d8df92520f4c0fafa24ddbf9fbe4) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4757))
+- [Escape work item dropdown items and restrict HTML tags](https://gitlab.com/gitlab-org/security/gitlab/-/commit/a834b94cf4e967065590f6b78b15c8733d67df30) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4785))
+- [Use stricter CSP values in the packages dependency proxy](https://gitlab.com/gitlab-org/security/gitlab/-/commit/d975b402434b9e17ff2963d9c4c6f438f52545ed) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4765))
+
 ## 17.7.5 (2025-02-21)
 ### Fixed (1 change)

GITLAB_KAS_VERSION

-afc35fcc49db7d999d74b4f2fcccc2625567bd75
+efced52dc4e4f9f202e32dc6239573d4aceb4d4e

Gemfile

@@ -379,7 +379,7 @@ gem 'gitlab_chronic_duration', '~> 0.12', feature_category: :shared
 
 gem 'rack-proxy', '~> 0.7.7', feature_category: :shared
 
-gem 'cssbundling-rails', '1.4.1', feature_category: :shared
+gem 'cssbundling-rails', '1.4.2', feature_category: :shared
 gem 'terser', '1.0.2', feature_category: :shared
 
 gem 'click_house-client', path: 'gems/click_house-client', require: 'click_house/client', feature_category: :database

Gemfile.checksum

@@ -96,7 +96,7 @@
 {"name":"creole","version":"0.5.0","platform":"ruby","checksum":"951701e2d80760f156b1cb2a93471ca97c076289becc067a33b745133ed32c03"},
 {"name":"crystalball","version":"0.7.0","platform":"ruby","checksum":"6e729f372a5071daec877adb40c5df4cb25fe21f350635e2a9624373fc151ef2"},
 {"name":"css_parser","version":"1.14.0","platform":"ruby","checksum":"f2ce6148cd505297b07bdbe7a5db4cce5cf530071f9b732b9a23538d6cdc0113"},
-{"name":"cssbundling-rails","version":"1.4.1","platform":"ruby","checksum":"4b21273d627b21890da9155c88c67efc9274373d8b0add09149c262cf56c7ce1"},
+{"name":"cssbundling-rails","version":"1.4.2","platform":"ruby","checksum":"285c5768097ad9802911bd1d6b45fd5c8586ecc26ab6e4c7ad91d918d0ec4ccf"},
 {"name":"csv","version":"3.3.0","platform":"ruby","checksum":"0bbd1defdc31134abefed027a639b3723c2753862150f4c3ee61cab71b20d67d"},
 {"name":"cvss-suite","version":"3.3.0","platform":"ruby","checksum":"54199fc1e0d5d833b1cb161453439143665c644cd3be2d21c2eee57fa06ed843"},
 {"name":"danger","version":"9.4.2","platform":"ruby","checksum":"43e552c6731030235a30fdeafe703d2e2ab9c30917154489cb0ecd9ad3259d80"},

Gemfile.lock

@@ -465,7 +465,7 @@ GEM
       git
     css_parser (1.14.0)
       addressable
-    cssbundling-rails (1.4.1)
+    cssbundling-rails (1.4.2)
       railties (>= 6.0.0)
     csv (3.3.0)
     cvss-suite (3.3.0)
@@ -2043,7 +2043,7 @@ DEPENDENCIES
   coverband (= 6.1.4)
   creole (~> 0.5.0)
   crystalball (~> 0.7.0)
-  cssbundling-rails (= 1.4.1)
+  cssbundling-rails (= 1.4.2)
   csv_builder!
   cvss-suite (~> 3.3.0)
   database_cleaner-active_record (~> 2.2.0)
@@ -2364,4 +2364,4 @@ DEPENDENCIES
   yajl-ruby (~> 1.4.3)
 
 BUNDLED WITH
-   2.6.5
+   2.5.11

Gemfile.next.checksum

@@ -96,7 +96,7 @@
 {"name":"creole","version":"0.5.0","platform":"ruby","checksum":"951701e2d80760f156b1cb2a93471ca97c076289becc067a33b745133ed32c03"},
 {"name":"crystalball","version":"0.7.0","platform":"ruby","checksum":"6e729f372a5071daec877adb40c5df4cb25fe21f350635e2a9624373fc151ef2"},
 {"name":"css_parser","version":"1.14.0","platform":"ruby","checksum":"f2ce6148cd505297b07bdbe7a5db4cce5cf530071f9b732b9a23538d6cdc0113"},
-{"name":"cssbundling-rails","version":"1.4.1","platform":"ruby","checksum":"4b21273d627b21890da9155c88c67efc9274373d8b0add09149c262cf56c7ce1"},
+{"name":"cssbundling-rails","version":"1.4.2","platform":"ruby","checksum":"285c5768097ad9802911bd1d6b45fd5c8586ecc26ab6e4c7ad91d918d0ec4ccf"},
 {"name":"csv","version":"3.3.0","platform":"ruby","checksum":"0bbd1defdc31134abefed027a639b3723c2753862150f4c3ee61cab71b20d67d"},
 {"name":"cvss-suite","version":"3.3.0","platform":"ruby","checksum":"54199fc1e0d5d833b1cb161453439143665c644cd3be2d21c2eee57fa06ed843"},
 {"name":"danger","version":"9.4.2","platform":"ruby","checksum":"43e552c6731030235a30fdeafe703d2e2ab9c30917154489cb0ecd9ad3259d80"},
@@ -802,8 +802,8 @@
 {"name":"webmock","version":"3.25.0","platform":"ruby","checksum":"573c23fc4887008c830f22da588db339ca38b6d59856fd57f5a068959474198e"},
 {"name":"webrick","version":"1.8.2","platform":"ruby","checksum":"431746a349199546ff9dd272cae10849c865f938216e41c402a6489248f12f21"},
 {"name":"websocket","version":"1.2.10","platform":"ruby","checksum":"2cc1a4a79b6e63637b326b4273e46adcddf7871caa5dc5711f2ca4061a629fa8"},
-{"name":"websocket-driver","version":"0.7.6","platform":"java","checksum":"bc894b9e9d5aee55ac04b61003e1957c4ef411a5a048199587d0499785b505c3"},
-{"name":"websocket-driver","version":"0.7.6","platform":"ruby","checksum":"f69400be7bc197879726ad8e6f5869a61823147372fd8928836a53c2c741d0db"},
+{"name":"websocket-driver","version":"0.7.7","platform":"java","checksum":"e2520a6049feb88691e042d631063fa96d50620fb7f53b30180ae6fb2cf75eb1"},
+{"name":"websocket-driver","version":"0.7.7","platform":"ruby","checksum":"056d99f2cd545712cfb1291650fde7478e4f2661dc1db6a0fa3b966231a146b4"},
 {"name":"websocket-extensions","version":"0.1.5","platform":"ruby","checksum":"1c6ba63092cda343eb53fc657110c71c754c56484aad42578495227d717a8241"},
 {"name":"wikicloth","version":"0.8.1","platform":"ruby","checksum":"7ac8a9ca0a948cf472851e521afc6c2a6b04a8f91ef1d824ba6a61ffbd60e6ca"},
 {"name":"wisper","version":"2.0.1","platform":"ruby","checksum":"ce17bc5c3a166f241a2e6613848b025c8146fce2defba505920c1d1f3f88fae6"},

Gemfile.next.lock

@@ -477,7 +477,7 @@ GEM
       git
     css_parser (1.14.0)
       addressable
-    cssbundling-rails (1.4.1)
+    cssbundling-rails (1.4.2)
       railties (>= 6.0.0)
     csv (3.3.0)
     cvss-suite (3.3.0)
@@ -2008,7 +2008,8 @@ GEM
       hashdiff (>= 0.4.0, < 2.0.0)
     webrick (1.8.2)
     websocket (1.2.10)
-    websocket-driver (0.7.6)
+    websocket-driver (0.7.7)
+      base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
     wikicloth (0.8.1)
@@ -2077,7 +2078,7 @@ DEPENDENCIES
   coverband (= 6.1.4)
   creole (~> 0.5.0)
   crystalball (~> 0.7.0)
-  cssbundling-rails (= 1.4.1)
+  cssbundling-rails (= 1.4.2)
   csv_builder!
   cvss-suite (~> 3.3.0)
   database_cleaner-active_record (~> 2.2.0)
@@ -2398,4 +2399,4 @@ DEPENDENCIES
   yajl-ruby (~> 1.4.3)
 
 BUNDLED WITH
-   2.6.5
+   2.5.11

app/assets/javascripts/behaviors/smooth_scroll.js

+/**
+ * Check if user prefers reduced motion, return 'auto' if true, otherwise return 'smooth'.
+ * This helps support accessibility preferences for users who experience motion sickness.
+ */
+export function scrollBehavior() {
+  return window.matchMedia(`(prefers-reduced-motion: reduce)`).matches ? 'auto' : 'smooth';
+}
+
+/**
+ * Scrolls with smooth behavior, respecting user's motion preferences.
+ * @param {ScrollToOptions} [options] - Additional scroll options
+ */
+export function smoothScrollTo(options) {
+  const behavior = scrollBehavior();
+
+  window.scrollTo({ ...options, behavior });
+}
+
+/**
+ * Scrolls to the top of the page with smooth behavior, respecting user's motion preferences.
+ */
+export function smoothScrollTop() {
+  smoothScrollTo({ top: 0 });
+}

app/assets/javascripts/blob/components/blob_header_filepath.vue

@@ -74,7 +74,7 @@ export default {
     </template>
 
     <clipboard-button
-      v-if="!glFeatures.blobOverflowMenu"
+      v-if="!glFeatures.directoryCodeDropdownUpdates"
       :text="blob.path"
       :gfm="gfmCopyText"
       :title="__('Copy file path')"

app/assets/javascripts/ci/ci_environments_dropdown/ci_environments_dropdown.vue

@@ -58,6 +58,11 @@ export default {
       required: false,
       default: '',
     },
+    ariaLabelledBy: {
+      type: String,
+      required: false,
+      default: '',
+    },
   },
   data() {
     return {
@@ -158,6 +163,7 @@ export default {
     :loading="isDropdownLoading"
     :searching="isDropdownSearching"
     :toggle-text="toggleText"
+    :toggle-aria-labelled-by="ariaLabelledBy"
     @search="debouncedSearch"
     @select="selectEnvironment"
     @shown="toggleDropdownShown(true)"

app/assets/javascripts/ci/ci_variable_list/components/ci_variable_drawer.vue

@@ -482,16 +482,18 @@ export default {
       </gl-alert>
       <gl-form-group
         :label="$options.i18n.type"
-        label-for="ci-variable-type"
+        label-class="!gl-pt-5 -gl-mb-5"
         class="gl-border-none"
         :class="{
           '-gl-mb-5': !hideEnvironmentScope,
           '-gl-mb-1': hideEnvironmentScope,
         }"
       >
+        <span id="ci-variable-type" class="gl-sr-only">{{ $options.i18n.type }}</span>
         <gl-collapsible-listbox
           v-model="variable.variableType"
           :items="$options.variableOptions"
+          toggle-aria-labelled-by="ci-variable-type"
           block
           fluid-width
         />
@@ -499,12 +501,12 @@ export default {
       <gl-form-group
         v-if="!hideEnvironmentScope"
         class="-gl-mb-5 gl-border-none"
-        label-for="ci-variable-env"
+        label-class="!gl-pt-5 -gl-mb-5"
         data-testid="environment-scope"
       >
         <template #label>
           <div class="gl-flex gl-items-center">
-            <span class="gl-mr-2">
+            <span id="ci-variable-environments" class="gl-mr-2">
               {{ $options.i18n.environments }}
             </span>
             <span
@@ -533,6 +535,7 @@ export default {
         </template>
         <ci-environments-dropdown
           v-if="areScopedVariablesAvailable"
+          aria-labelled-by="ci-variable-environments"
           class="gl-mb-5"
           :are-environments-loading="areEnvironmentsLoading"
           :environments="environments"
@@ -636,8 +639,8 @@ export default {
         </gl-form-checkbox>
       </gl-form-group>
       <gl-form-group
-        label-for="ci-variable-description"
         :label="$options.i18n.description"
+        label-for="ci-variable-description"
         class="-gl-mb-5 gl-border-none"
         data-testid="ci-variable-description-label"
         :description="$options.i18n.descriptionHelpText"

app/assets/javascripts/content_editor/services/serialization_helpers.js

-import { isFunction } from 'lodash';
+import { identity, isFunction } from 'lodash';
 
 const defaultAttrs = {
   td: { colspan: 1, rowspan: 1, colwidth: null, align: 'left' },
@@ -194,10 +194,11 @@ export function preserveUnchanged(configOrRender) {
   };
 }
 
-export function preserveUnchangedMark({ open, close, ...restConfig }) {
+export function preserveUnchangedMark({ open, close, escape = true, ...restConfig }) {
   // use a buffer to replace the content of the serialized mark with the sourceMarkdown
   // when the mark is unchanged
   let bufferStartPos = -1;
+  let esc;
 
   function startBuffer(state) {
     bufferStartPos = state.out.length;
@@ -216,6 +217,11 @@ export function preserveUnchangedMark({ open, close, ...restConfig }) {
     ...restConfig,
     // eslint-disable-next-line max-params
     open: (state, mark, parent, index) => {
+      if (!escape) {
+        esc = state.esc;
+        state.esc = identity;
+      }
+
       const same = state.options.changeTracker.get(mark);
 
       if (same) {
@@ -227,6 +233,10 @@ export function preserveUnchangedMark({ open, close, ...restConfig }) {
     },
     // eslint-disable-next-line max-params
     close: (state, mark, parent, index) => {
+      if (!escape) {
+        state.esc = esc;
+      }
+
       const { sourceMarkdown } = mark.attrs;
 
       if (bufferStarted()) {

app/assets/javascripts/content_editor/services/serializer/image.js

 import { pickBy, identity } from 'lodash';
 import { preserveUnchanged, openTag } from '../serialization_helpers';
+import { escape, quote } from './link';
 
 function getMediaSrc(node, useCanonicalSrc = true) {
   const { canonicalSrc, src } = node.attrs;
@@ -12,7 +13,7 @@ const image = preserveUnchanged({
   render: (state, node) => {
     const { alt, title, width, height, isReference, sourceMarkdown, sourceTagName } = node.attrs;
 
-    const realSrc = getMediaSrc(node, state.options.useCanonicalSrc);
+    const realSrc = escape(getMediaSrc(node, state.options.useCanonicalSrc));
     // eslint-disable-next-line @gitlab/require-i18n-strings
     if (realSrc.startsWith('data:') || realSrc.startsWith('blob:')) return;
 
@@ -22,7 +23,7 @@ const image = preserveUnchanged({
         state.write(openTag(sourceTagName, { src: realSrc, ...attrs }));
         return;
       }
-      const quotedTitle = title ? ` ${state.quote(title)}` : '';
+      const quotedTitle = title ? ` ${quote(title)}` : '';
       const sourceExpression = isReference ? `[${realSrc}]` : `(${realSrc}${quotedTitle})`;
 
       const sizeAttributes = [];
@@ -35,7 +36,7 @@ const image = preserveUnchanged({
 
       const attributes = sizeAttributes.length ? `{${sizeAttributes.join(' ')}}` : '';
 
-      state.write(`![${state.esc(alt || '')}]${sourceExpression}${attributes}`);
+      state.write(`![${escape(alt || '')}]${sourceExpression}${attributes}`);
     }
   },
   inline: true,

app/assets/javascripts/content_editor/services/serializer/link.js

@@ -25,6 +25,9 @@ const normalizeUrl = (url) => {
   }
 };
 
+export const escape = (link) => link.replace(/[()"]/g, '\\$&');
+export const quote = (title) => `"${title.replace(/"/g, '\\"')}"`;
+
 /**
  * This function detects whether a link should be serialized
  * as an autolink.
@@ -67,6 +70,7 @@ function getLinkHref(mark, useCanonicalSrc = true) {
 }
 
 const link = preserveUnchangedMark({
+  escape: false,
   open(state, mark, parent) {
     if (isAutoLink(mark, parent)) {
       return isBracketAutoLink(mark.attrs.sourceMarkdown) ? '<' : '';
@@ -78,11 +82,11 @@ const link = preserveUnchangedMark({
     if (href.startsWith('data:') || href.startsWith('blob:')) return '';
 
     const attrs = {
-      href: state.esc(getLinkHref(mark, state.options.useCanonicalSrc)),
+      href: escape(getLinkHref(mark, state.options.useCanonicalSrc)),
     };
 
     if (title) {
-      attrs.title = state.esc(title);
+      attrs.title = title;
     }
 
     if (sourceTagName && !sourceMarkdown) return openTag(sourceTagName, attrs);
@@ -112,12 +116,12 @@ const link = preserveUnchangedMark({
     }
 
     if (isReference) {
-      return `][${state.esc(getLinkHref(mark, state.options.useCanonicalSrc))}]`;
+      return `][${escape(getLinkHref(mark, state.options.useCanonicalSrc))}]`;
     }
 
     if (isGollumLink) {
       const text = getMarkText(mark, parent);
-      const escapedCanonicalSrc = state.esc(canonicalSrc);
+      const escapedCanonicalSrc = escape(canonicalSrc);
 
       if (text.toLowerCase() === escapedCanonicalSrc.toLowerCase()) {
         return ']]';
@@ -126,8 +130,8 @@ const link = preserveUnchangedMark({
       return `|${escapedCanonicalSrc}]]`;
     }
 
-    return `](${state.esc(getLinkHref(mark, state.options.useCanonicalSrc))}${
-      title ? ` ${state.quote(title)}` : ''
+    return `](${escape(getLinkHref(mark, state.options.useCanonicalSrc))}${
+      title ? ` ${quote(title)}` : ''
     })`;
   },
 });

app/assets/javascripts/graphql_shared/constants.js

@@ -2,6 +2,7 @@ export const MINIMUM_SEARCH_LENGTH = 3;
 
 export const TYPENAME_BOARD = 'Board';
 export const TYPENAME_CI_BUILD = 'Ci::Build';
+export const TYPENAME_CI_JOB_TOKEN_ACCESSIBLE_GROUP = 'CiJobTokenAccessibleGroup';
 export const TYPENAME_CI_RUNNER = 'Ci::Runner';
 export const TYPENAME_CI_PIPELINE = 'Ci::Pipeline';
 export const TYPENAME_CI_STAGE = 'Ci::Stage';

app/assets/javascripts/members/placeholders/components/csv_upload_modal.vue

@@ -87,7 +87,7 @@ export default {
   },
   dropzoneAllowList: ['.csv'],
   docsLink: helpPagePath('user/project/import/_index', {
-    anchor: 'reassign-contributions-and-memberships',
+    anchor: 'request-reassignment-by-using-a-csv-file',
   }),
   i18n: {
     description: s__(