Blog post: https://about.gitlab.com/releases/2025/06/11/patch-release-gitlab-18-0-2-released/
Includes the following fixes:
```
HTML injection impacts GitLab CE/EE High
Cross-site scripting issue impacts GitLab CE/EE High
Missing authorization issue impacts GitLab Ultimate EE High
Denial of Service impacts GitLab CE/EE High
Denial of Service via unbounded Webhook token names impacts GitLab CE/EE Medium
Denial of Service via unbounded Board Names impacts GitLab CE/EE Medium
Information disclosure issue impacts GitLab CE/EE Medium
Denial of Service (DoS) via uncontrolled HTTP Response Processing impacts GitLab CE/EE Medium
Information disclosure via authorization bypass impacts GitLab CE/EE Medium
Sensitive information disclosure via Group IP restriction bypass Low
```
[docs](https://wikitech.wikimedia.org/wiki/GitLab/Upgrade#Automated_Upgrade_(sre.gitlab.upgrade_coobook))
[version specific upgrade docs]()
[deprecations]()
[changelog]()
Test instance:
[x] gitlab-prod-1002.devtools.eqiad1.wikimedia.cloud (currenlty broken {T396622})
[x] gitlab-runner-1008.devtools.eqiad1.wikimedia.cloud
[x] gitlab-runner-1006.devtools.eqiad1.wikimedia.cloud
Replicas:
[x] gitlab1003.wikimedia.org
[x] gitlab1004.wikimedia.org
Production:
[x] gitlab2002.wikimedia.org
[] Trusted runners
[] Shared runners
[x] Cloud runners [MR created](https://gitlab.wikimedia.org/repos/releng/gitlab-cloud-runner/-/merge_requests/475)