4 files changed, 21 insertions, 5 deletions
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index c0148acd7..d511edea8 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -30,7 +30,6 @@ variables:
   TEST_UID: 9999
 
 include:
-  - template: Workflows/MergeRequest-Pipelines.gitlab-ci.yml
   - template: Security/License-Scanning.gitlab-ci.yml
   - template: Security/SAST.gitlab-ci.yml
   - template: Security/Dependency-Scanning.gitlab-ci.yml
@@ -39,6 +38,13 @@ include:
     file:
       - '/ci/danger-review.yml'
 
+workflow:
+  rules:
+    - if: $CI_MERGE_REQUEST_IID
+    - if: $CI_COMMIT_TAG
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - if: '$CI_COMMIT_BRANCH =~ /^[\d-]+-stable$/'
+
 .cache_deps:
   cache: &cache_deps_configuration
     key:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b4494911c..a0bec5a8a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Gitaly changelog
 
+## 15.5.9 (2023-01-12)
+
+No changes.
+
+## 15.5.8 (2023-01-12)
+
+### Security (1 change)
+
+- [Makefile: Upgrade Git to address out-of-bounds reads and writes](gitlab-org/security/gitaly@a8d8a7d7880477b141f75c300fa4be3542acbc4a) ([merge request](gitlab-org/security/gitaly!70))
+
 ## 15.5.7 (2023-01-09)
 
 ### Fixed (3 changes)
diff --git a/Makefile b/Makefile
index 791da823c..ca9b7bb21 100644
--- a/Makefile
+++ b/Makefile
@@ -127,9 +127,9 @@ GIT_EXECUTABLES += git-http-backend
 ## tags, branches, and commit ids.
 GIT_VERSION ?=
 ## The Git version used for bundled Git v2.35.
-GIT_VERSION_2_35_1 ?= v2.35.5.gl1
+GIT_VERSION_2_35_1 ?= v2.35.6.gl1
 ## The Git version used for bundled Git v2.37.
-GIT_VERSION_2_37_1 ?= v2.37.4.gl1
+GIT_VERSION_2_37_1 ?= v2.37.5.gl1
 
 ## Skip overriding the Git version and instead use the Git version as specified
 ## in the Git sources. This is required when building Git from a version that
@@ -139,7 +139,7 @@ SKIP_OVERRIDING_GIT_VERSION ?=
 # The default version is used in case the caller does not set the variable or
 # if it is either set to the empty string or "default".
 ifeq (${GIT_VERSION:default=},)
-    override GIT_VERSION := v2.37.4.gl1
+    override GIT_VERSION := v2.37.5.gl1
 else
     # Support both vX.Y.Z and X.Y.Z version patterns, since callers across GitLab
     # use both.
diff --git a/VERSION b/VERSION
index 7a3ee10d5..8fef0a2b0 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-15.5.7
-\ No newline at end of file
+15.5.9
+\ No newline at end of file