Update gitlab/gitlab-ce Docker tag to v18.11.12

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
gitlab/gitlab-ce (changelog)	minor	18.9.2-ce.0 → 18.11.12-ce.0

---

Release Notes

gitlab-org/gitlab-foss (gitlab/gitlab-ce)

v18.11.12

Compare Source

Security (5 changes)

• Anchor and escape EnvironmentMatcher wildcard regex (merge request)
• Sanitise items in JSONTable before passing to BTable (merge request)
• Upgrade graphql gem and backport GlobalID serialization fixes (merge request)
• Fix unauthenticated arbitrary local file read in commits API
• Fix iid bypass for complexity multiplier (merge request)

v18.11.11

Compare Source

No changes.

v18.11.9

Compare Source

No changes.

v18.11.8

Compare Source

Fixed (4 changes)

• Add postgres_index_bloat_estimate SQL function (merge request)
• Remove --unlink-first and --recursive-unlink from tar extract (merge request)
• Fix blob preview diff hiding blank added lines (merge request)
• Fix virtual registry settings toggle disappearing when disabled (merge request) GitLab Enterprise Edition

v18.11.7

Compare Source

Fixed (1 change)

• Fix ci_finished_builds engine swap on deferred post-deploy

Security (9 changes)

• Clear stored password when pull mirror destination changes (merge request)
• Address private project cross-references visibility issue (merge request)
• Treat failing markup renders as plain text (merge request)
• Sanitize vulnerability detail keys to prevent XSS via thAttr injection (merge request)
• Fix tag/branch ambiguity in blob view (merge request)
• Don't attempt placeholder replacement without a URL (merge request)
• Fix auditor write access to compliance violation mutations (merge request)
• Enforce group-level approval rule lock in approval policies (merge request)
• Fix WorkItems auth bypass for Minimal Access users (merge request)

v18.11.6

Compare Source

Fixed (2 changes)

• Fix Amazon Q usage quota check GitLab Enterprise Edition
• Allow job token basic auth for generic package upload

Security (13 changes)

• Fix versionless Maven metadata protected package bypass (merge request)
• Filter notes by readable_by? in Rapid Diffs commit discussions (merge request)
• Detect encoding collisions in snippet hidden file detection (merge request)
• Fix DNS rebinding SSRF in pull and push mirror services (merge request)
• Fix IDOR in virtual registry cleanup policy REST API (merge request)
• Exclude registry-disabled projects from group packages endpoints (merge request)
• Restrict DAST site profile modification when secrets are present (merge request)
• Fix Web IDE asset security header bypass (merge request)
• Restrict value_stream data source filters to known fields (merge request)
• Mask pipeline schedule variable values in API logs (merge request)
• Prevent protected environments access when CI/CD is disabled (merge request)
• Fix authorization bypass in securityMetrics.riskScore.byProject (merge request)
• Bump devfile gem to 0.5.2 GitLab Enterprise Edition

v18.11.5

Compare Source

Fixed (6 changes)

• Make CI cache limit per job configurable by admins
• Show ultimate_only agents when paid license is present GitLab Enterprise Edition
• Add fat manifest types to container registry Accept
• Fix MCP tools checkbox visibility for Premium groups GitLab Enterprise Edition
• Ensure uploads.id has the correct default
• Patching deployment bigint swap for missing index

Security (11 changes)

• [Backport for 18-11] Validate JSON body with no content-type (merge request)
• Don't render dashboard panels when the schema fails validation (merge request)
• Fix Service Desk template placeholder re-entrance, from header (merge request)
• Disallow style attribute in non_gfm_markdown (merge request)
• 18.11 Backport: Fix SAML identity takeover via trusted_extern_uid (merge request)
• Security fix privilages escalation when sec module disabled (merge request)
• Use encode_utf8_no_detect for diff file paths to handle binary filenames by @​garyh (merge request)
• Limit resource usage when parsing placeholder reassignment CSVs (merge request)
• Prevent non admins from accessing banned user mrs (merge request)
• HTML injection in audit events can lead to ATO (merge request)
• Delete confidential-issue todos when issue has no assignee (merge request)

v18.11.4

Compare Source

Fixed (4 changes)

• Use primary DB connection for advanced search bulk indexer GitLab Enterprise Edition
• Fix swimlane problem GitLab Enterprise Edition
• Send allowed endpoints to Workhorse for diagram proxy
• Fixes dropping successful builds

Changed (1 change)

• Add AI scopes to vulnerability findings GitLab Enterprise Edition

Security (7 changes)

• Prevent blocked bot_users from authenticating (merge request)
• Fix unauthorized project exposure via WorkItem GraphQL traversal (merge request)
• Enforce duo_foundational_flows_enabled in foundational flows execution (merge request)
• Fix authorization bypass in Operations and Environments dashboards (merge request)
• Backport of "Add size limit to redirects_yml in update_redirection_actions" into 18.11 (merge request)
• Use vulnerability author identity for AI workflow triggers (merge request)
• Fix child pipeline ref type to match parent pipeline (merge request)

Other (1 change)

• Fix flaky new_project_spec tests

v18.11.3

Compare Source

Fixed (3 changes)

• Fix import_url validation for passwords with special characters
• Fix project moved notification when project is scheduled for deletion
• Downgrade Rugged to 1.7.2 to avoid llhttp collision

Changed (2 changes)

• Raise permission for test upstream endpoints GitLab Enterprise Edition
• Gate trial CTA's on FF automatic_self_managed_trial_activation GitLab Enterprise Edition

Security (26 changes)

• 18.11 Backport: Fix missing DuoApiAuthenticator stub in json_validation_spec (merge request)
• Address XSS via file path in global search (merge request)
• Sanitize HTML in Duo Chat markdown renderer (merge request)
• Fix the group permission user search results (merge request)
• Filter tag names with invalid formats during deletion (merge request)
• Prevent source issue disclosure via issue links API (merge request)
• Remove componentProps from analytics dashboards DataTable (merge request)
• Fix value_stream data source passing arbitrary query fields (merge request)
• Fix HTML injection in achievement email notifications (merge request)
• Clarify Jira integration access scope in docs and UI (merge request)
• Authenticate internal API requests pre JSON parsing (merge request)
• Approval rule lock bypass via GraphQL mutations (merge request)
• Gate create_note_email on write-level token scope (merge request)
• Reject oversized job tokens early in AuthJobFinder (merge request)
• Normalize PyPI package names in protection rule checks (merge request)
• Enhance DNS rebinding protection in VirtualRegistries RedirectHandler (merge request)
• Count carriage-return separators in CSV structural char estimate (merge request)
• Fix DoS via unauthenticated POST to Duo Workflow endpoints - 18.11 backport (merge request)
• Remove legacy JiraConnect::Subscriptions#create to close CSRF vector (merge request)
• Remove all namespaced attributes in BaseSanitizationFilter (merge request)
• Filter out non-user-defined rules on approval update (merge request)
• Fix orphaned scan_result_policy_reads on policy project reassignment (merge request)
• Fix confidential issue data leak via move/clone API endpoints (merge request)
• Add Helm package protection rule check to CreatePackageFileService (merge request)
• Scope NuGet symbols lookup to projects within the requested namespace (merge request)
• Security Fix Vulnerability 586634 (merge request)

v18.11.2

Compare Source

Changed (1 change)

• Expose X-Streaming-Format header for api requests (merge request)

v18.11.1

Compare Source

Security (5 changes)

• Anchor and escape EnvironmentMatcher wildcard regex (merge request)
• Sanitise items in JSONTable before passing to BTable (merge request)
• Upgrade graphql gem and backport GlobalID serialization fixes (merge request)
• Fix unauthenticated arbitrary local file read in commits API
• Fix iid bypass for complexity multiplier (merge request)

v18.11.0

Compare Source

Added (194 changes)

• Hide restricted access configuration on contract overages allowed false (merge request) GitLab Enterprise Edition
• Add daily_average field to subscriptionUsage (merge request) GitLab Enterprise Edition
• Plumb format argument through MCP tool calls (merge request)
• Add Gitlab::Git::Finders::BranchesFinder implementation (merge request)
• Add REST API GET endpoint for Terraform state protection rules by @​gerardo-navarro (merge request)
• Add feature flag to gate default Sidekiq concurrency limit calculation (merge request)
• Add AiSession widget to work items (merge request) GitLab Enterprise Edition
• Add transferred activity status and email group transfers (merge request)
• Enable identifier chart by default (merge request) GitLab Enterprise Edition
• Enable new_security_dashboard_pdf_export flag by default (merge request) GitLab Enterprise Edition
• Enable budget_caps_graphql_api feature flag by default (merge request) GitLab Enterprise Edition
• Add state to organizations and organization_details tables (merge request)
• Expose licenced_feature_availability in GraphQl (merge request) GitLab Enterprise Edition
• Add policy dismissals to group-level dependency list (merge request) GitLab Enterprise Edition
• Remove work_item_planning_view feature flag (merge request)
• Include rules in Web Agentic Chat (merge request)
• Add merge train pipeline limit columns by @​Modjo85 (merge request)
• Add dependency resolution job for python to DS CI template v2 (merge request) GitLab Enterprise Edition
• Geo: Core integration of org migration target cell concept (merge request) GitLab Enterprise Edition
• Respect scan profiles when updating analyzer statuses (merge request) GitLab Enterprise Edition
• Add policy badge for block_branch_modification in branch rules UI (merge request) GitLab Enterprise Edition
• Add duo agent platform enabled metric (merge request) GitLab Enterprise Edition
• Allow MCP tool prefixing by @​Taucher2003 (merge request)
• Use REST API for Semantic Code Search MCP tool (behind feature flag) (merge request) GitLab Enterprise Edition
• Enqueue backfilling of epic resource_label_events (merge request)
• Workflow resume API (merge request) GitLab Enterprise Edition
• Mount Duo Usage Events AE (merge request) GitLab Enterprise Edition
• Add business_impact scope to security policies (merge request) GitLab Enterprise Edition
• Add migration for duo_workflow_session_artifacts table (merge request)
• Trigger API docs deployment (merge request)
• Add start_date and end_date args to subscriptionUsage (merge request) GitLab Enterprise Edition
• Protected terraform states: Enforce Terraform state protection rules by @​gerardo-navarro (merge request)
• Add project description warning (merge request)
• Docs: add packages to release evidence documentation (merge request)
• Make DAP Free tier available on self-managed (merge request) GitLab Enterprise Edition
• Add test runs tab with GraphQL query to fetch test run data (merge request)
• Update docs for Exploitability Risk in MR approval policies (merge request) GitLab Enterprise Edition
• Default enabled security_policies_kev_filter ff (merge request) GitLab Enterprise Edition
• Add audit event for enabled_foundational_flows changes (merge request) GitLab Enterprise Edition
• Add Terraform module support to package protection rules (merge request)
• Add can_transfer permission field to groups json response (merge request)
• Add componentUsages field to CiCatalogResource GraphQL type (merge request) GitLab Enterprise Edition
• Add repo filter in Zoekt search (merge request) GitLab Enterprise Edition
• Feat#: implement custom instance titles by @​j4lc (merge request)
• Docs: Add warning about promoting secondary with selective sync (merge request)
• Pass instance_beta_features_enabled to AI Catalog frontend (merge request) GitLab Enterprise Edition
• Add RuboCop cop to prevent unpartitioned CI relation queries (merge request)
• Remove enable_inputs_for_mr_pipelines ff (merge request)
• Remove atomic_scanner_rule_criteria feature flag (merge request) GitLab Enterprise Edition
• Add PEP Scoped Implicit Merge Check (merge request) GitLab Enterprise Edition
• Add dependency firewall policy service layer integration (merge request) GitLab Enterprise Edition
• Add search to catalog versions (merge request)
• Register export and import routes (merge request)
• Add mention trigger by default for Duo Developer (merge request) GitLab Enterprise Edition
• Enable Vulnerability Management Policy Severity Override (merge request) GitLab Enterprise Edition
• Add GraphQL mutation for starring AI catalog items (merge request) GitLab Enterprise Edition
• Introduce realtime mini-graph job statuses (merge request)
• Add index on vulnerability_finding_links with NULLS NOT DISTINCT (merge request)
• Add totalActiveUsers to subscriptionUsage.usersUsage (merge request) GitLab Enterprise Edition
• Add GitLab Duo agent/flow users metric tile (merge request) GitLab Enterprise Edition
• Add work_items scope to Search API with type filtering (merge request)
• Remove the dap_onboarding_empty_states feature flag (merge request) GitLab Enterprise Edition
• Initial migration to restore incorrect vuln states (merge request) GitLab Enterprise Edition
• graphql: Add updateTerraformStateProtectionRule mutation by @​gerardo-navarro (merge request)
• Add non_archived parameter to global merge requests API by @​Modjo85 (merge request)
• Add credits_used field to subscriptionUsage (merge request) GitLab Enterprise Edition
• Add setting to enable policies mergeability check (merge request) GitLab Enterprise Edition
• Show message when user prevented from creating project (merge request)
• Add identifier list popover to vulnerability report (merge request) GitLab Enterprise Edition
• Add gPAT support for semantic code search REST API endpoint (merge request) GitLab Enterprise Edition
• Add Achievements entry point to group sidebar Manage section (merge request)
• Add network settings columns (merge request)
• feat(siphon): Replicate routes table to ClickHouse (merge request)
• Render tool response in Duo workflow session log entry (merge request) GitLab Enterprise Edition
• Send repository name for indexing (merge request) GitLab Enterprise Edition
• Select collapsible section text in PTE by @​therealrinku (merge request)
• Remove work_items_consolidated_list_enabled? guards from CE (merge request)
• Add MCP orchestrator service for saved view work items (merge request)
• Add EnrichmentDataSettings component for scanners (merge request)
• Update SBOM API to add files under location (merge request) GitLab Enterprise Edition
• Create partitioned table p_ci_build_needs (merge request)
• Add fine-grained token support for project labels API endpoints (merge request)
• Add dependency resolution job for maven to DS CI template v2 (merge request) GitLab Enterprise Edition
• Geo: Replicate Achievements::Achievement uploads (merge request) GitLab Enterprise Edition
• Use duo planner agent for work item summary (merge request)
• Add GVL wait time metrics to Sidekiq structured logs (merge request)
• Add Orbit data layer, Three.js graph engine, and schema utilities (merge request)
• Disable README checkbox in UI when user cannot push initial commit (merge request)
• Add security update workload creation service (merge request) GitLab Enterprise Edition
• Use grouped evaluators for atomic scanner criteria (merge request) GitLab Enterprise Edition
• Add Prometheus instrumentation to Rails-side Orbit components (merge request) GitLab Enterprise Edition
• Implement resume workflow policy (merge request) GitLab Enterprise Edition
• Add editable weight to epics (merge request) GitLab Enterprise Edition
• Add rotating time-aware greeting messages to homepage (merge request) GitLab Enterprise Edition
• Add REST API endpoint for semantic code search (merge request) GitLab Enterprise Edition
• Cart Abandonment: Add event for DAP monthly commit checkout (merge request) GitLab Enterprise Edition
• Rollout the "/include repository" and "/include directory" features (merge request) GitLab Enterprise Edition
• Add 'third_party_agent_token_created' audit event (merge request) GitLab Enterprise Edition
• Add security update workload creation service (merge request) GitLab Enterprise Edition
• Protected terraform states: Add GraphQL query by @​gerardo-navarro (merge request)
• Add tag_name column to dast_profiles_tags table (merge request) GitLab Enterprise Edition
• Add test_runs field to SecurityPolicyType (merge request) GitLab Enterprise Edition
• Add canPushInitialCommit GraphQL field and namespace model logic (merge request)
• Add audit event for duo_foundational_flows_enabled changes (merge request) GitLab Enterprise Edition
• Added model selection for SAST VR and secret FP detection workflows (merge request) GitLab Enterprise Edition
• Prevent updating name/icon of archived work item type by @​therealrinku (merge request)
• Add rake task to verify MCP server setup (merge request) GitLab Enterprise Edition
• Add more options to the project header dropdown (merge request)
• Add host_keys parameter to remote mirrors REST API (merge request)
• Add sort argument to board epics GraphQL resolver by @​MatthewOscar (merge request)
• Archive labels: remove :labels_archive feature flag in frontend by @​nwittstruck (merge request)
• Add profile_based_update_service for analyzer statuses updates (merge request) GitLab Enterprise Edition
• Add by_category_template_type scope to Security::Attribute (merge request) GitLab Enterprise Edition
• Update projects controller to transfer async (merge request)
• Add tags field to Commit GraphQL type (merge request)
• Provide variables to MR pipelines (merge request)
• Add search for the pipeline inputs selector (merge request)
• Add policy bot access settings to project_settings (merge request) GitLab Enterprise Edition
• Trigger pipeline status updated subscription (merge request)
• Add Prometheus histogram for Puma readiness probe duration (merge request)
• Add audit event for auto_duo_code_review_enabled changes (merge request) GitLab Enterprise Edition
• Add CI_CONFIG_REF_URI predefined CI/CD variable (merge request)
• Add UI for connecting to custom Elasticsearch for semantic search (merge request) GitLab Enterprise Edition
• Add MCP orchestrator service for saved view work items (merge request)
• Consolidate virtual registry availability checks with memoization (merge request)
• Allow AI workflows access to vulnerability.webUrl (merge request) GitLab Enterprise Edition
• Add version dropdown in CI/CD details page ([merge request](https://gitlab.com/gitlab-org/gitlab/-/mer

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.