Use regular non-Markdown single line pipeline for issuable titles (!224839) · Merge requests · GitLab.org / GitLab

What does this MR do and why?

Changes Issuable's cache_markdown_field :title to use the :single_line pipeline, instead of :single_line_markdown.
Removes Banzai::Pipeline::SingleLineMarkdownPipeline as it has no other users.
- Removes Banzai::Filter::MarkdownEngines::GlfmMarkdown::MINIMUM_MARKDOWN as it has no other users.
- Removes Banzai::Filter::MinimumMarkdownSanitizationFilter as it has no other users.
Relies on titleHtml being correctly and meaningfully populated in the frontend; no need for any more hack fallbacks to displaying title when titleHtml is surprisingly empty.
- Uses titleHtml instead of title in a few places now that it no longer contains consistency-breaking formatting.
Describes title_html in GraphQL as a HTML rendering rather than a Markdown rendering when the input isn't interpreted as Markdown.
- I've applied this to all such places where it's correct, not just Issue/WorkItem.
Documented SingleLinePipeline in the development docs so we know it exists and how it works.
Documented how formatting works in titles GitLab-wide.
- This documentation has always been missing and necessary. Before this MR it would've been true for all items except issuables/work items; now it's true for all.

This is, in essence, a revert of Allow _markdown_ to be `used` in titles 🚀 (!184070 - merged). The rationale is laid out in #587818+ (staff only). In summary:

Issuable titles are the only way in which Markdown is interpreted in this restricted and unpredictable way.
Every other title uses a common format.
Issuable titles are inconsistently rendered due to this discrepancy:
We've had a high number of vulnerabilities reported (and paid out) for insecure code resulting from this discrepancy.
The implementation of this feature wasn't done with product input, nor has it been documented.
This has led to a reasonable degree of user confusion because e.g. you can't enter text in <angle> brackets:
Engineering and security have jointly decided to revert this feature and restore consistency in the product in this area.

References

Closes Stop stripping HTML from issuable titles (#582606).

Relates to:

Staff only:

Screenshots or screen recordings

The only display area that is affected is the main work item view, when you're scrolled to the top. Here is a detailed look at the potential (worst-case) customer impact as a result of this change:

Customer has a habit of using Markdown in work item titles.
Customer has work items with names like:
- *IMPORTANT*: do this thing
- `2026q7` Prepare release notes
- Think about <input> tags in our app :rocket:
- We need to use [CATAAS](https://cataas.com)
Customer puts up with them looking like this in the work item list:

... because, at least when you view the work items one-by-one, you see this:

Note that, in one of these cases, it's actually a workaround for what's been broken by this "feature": if you want to write < or >, you have to write the entity out.

Of course, if you scroll down, it turns back to plain text again:

As of this MR, these work items now appear like this when viewed one-by-one:

Note the rocket emoji is still rendered: this is intentional, and should have been happening in every view from the start! Other titles in the app do this — label descriptions, WIT descriptions, milestone titles, commit titles, and snippet titles — and likewise do autolinking (type out a URL and it gets linked) and reference processing (#1 -> link to work item 1).

So, as a bonus, this MR also fixes the work items list and sticky header to render these as intended:

Note that, re: this example, as of this MR customers can now actually enter the title Think about <input> tags in our app :rocket: and they'll get "Think about <input> tags in our app 🚀", as expected!

How to set up and validate locally

Check out the branch.
Face the sun and take a deep breath in, hold, and exhale.
- You may face the moon if it is night-time, or the brightest star if the moon is new.
Go create a work item, or edit an existing one, and enter the title *Hello* <world>! :smile_cat:.
It should appear like this: "*Hello* <world>! 😸" ...
- ... in the work item list view.
- ... in the work item main view (scrolled to the very top).
- ... in the work item sticky header (shrink your browser height and scroll down to make it appear).

There are many places issuable titles are shown, and not all of them will necessarily render the emoji yet, but they will be able to safely and easily do so as of this MR, so we'll fix those iteratively

One example of where we went quite a bit out of our way to do this was this contributor MR: fix: Epic and Issue board emoji render (!208174 - merged). This can now be done easily and correctly with v-safe-html="item.titleHtml".

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited Mar 04, 2026 by Asherah Connor

Use regular non-Markdown single line pipeline for issuable titles

What does this MR do and why?

References

Screenshots or screen recordings

How to set up and validate locally

MR acceptance checklist

Merge request reports