Merge remote-tracking branch 'dev/15-6-stable' into 15-6-stable

4 files changed, 21 insertions, 5 deletions

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index e66497f26..2ead11342 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -38,7 +38,6 @@ variables:
   TEST_UID: 9999
 
 include:
-  - template: Workflows/MergeRequest-Pipelines.gitlab-ci.yml
   - template: Security/License-Scanning.gitlab-ci.yml
   - template: Security/SAST.gitlab-ci.yml
   - template: Security/Dependency-Scanning.gitlab-ci.yml
@@ -47,6 +46,13 @@ include:
     file:
       - '/ci/danger-review.yml'
 
+workflow:
+  rules:
+    - if: $CI_MERGE_REQUEST_IID
+    - if: $CI_COMMIT_TAG
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - if: '$CI_COMMIT_BRANCH =~ /^[\d-]+-stable$/'
+
 .cache_deps:
   cache: &cache_deps_configuration
     key:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fb02f76e4..eeec37a38 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Gitaly changelog
 
+## 15.6.6 (2023-01-12)
+
+No changes.
+
+## 15.6.5 (2023-01-12)
+
+### Security (1 change)
+
+- [Makefile: Upgrade Git to address out-of-bounds reads and writes](gitlab-org/security/gitaly@64daa1b1fed7d0ea17abc47970c3933cfa6ebf03) ([merge request](gitlab-org/security/gitaly!71))
+
 ## 15.6.4 (2023-01-09)
 
 ### Fixed (1 change)
diff --git a/Makefile b/Makefile
index a07ac7cd5..8a6bde766 100644
--- a/Makefile
+++ b/Makefile
@@ -134,9 +134,9 @@ GIT_EXECUTABLES += git-http-backend
 ## tags, branches, and commit ids.
 GIT_VERSION ?=
 ## The Git version used for bundled Git v2.37.
-GIT_VERSION_2_37_1 ?= v2.37.4.gl1
+GIT_VERSION_2_37_1 ?= v2.37.5.gl1
 ## The Git version used for bundled Git v2.38.
-GIT_VERSION_2_38 ?= v2.38.2.gl1
+GIT_VERSION_2_38 ?= v2.38.3.gl1
 
 ## Skip overriding the Git version and instead use the Git version as specified
 ## in the Git sources. This is required when building Git from a version that
@@ -146,7 +146,7 @@ SKIP_OVERRIDING_GIT_VERSION ?=
 # The default version is used in case the caller does not set the variable or
 # if it is either set to the empty string or "default".
 ifeq (${GIT_VERSION:default=},)
-    override GIT_VERSION := v2.37.4.gl1
+    override GIT_VERSION := v2.37.5.gl1
 else
     # Support both vX.Y.Z and X.Y.Z version patterns, since callers across GitLab
     # use both.
diff --git a/VERSION b/VERSION
index 5d62dc831..eefeb00be 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-15.6.4
\ No newline at end of file
+15.6.6
\ No newline at end of file