.babelrc

+{
+  "presets": [
+    ["latest", { "es2015": { "modules": false } }],
+    "stage-2"
+  ],
+  "env": {
+    "coverage": {
+      "plugins": [
+        ["istanbul", {
+          "exclude": [
+            "spec/javascripts/**/*"
+          ]
+        }],
+        ["transform-define", {
+          "process.env.BABEL_ENV": "coverage"
+        }]
+      ]
+    }
+  }
+}

.eslintignore

+/builds/
 /coverage/
 /coverage-javascript/
 /node_modules/
 /public/
 /tmp/
 /vendor/
-/builds/
+karma.config.js
+webpack.config.js
+/app/assets/javascripts/locale/**/*.js

.eslintrc

@@ -12,9 +12,22 @@
     "localStorage": false
   },
   "plugins": [
-    "filenames"
+    "filenames",
+    "import",
+    "html",
+    "promise"
   ],
+  "settings": {
+    "html/html-extensions": [".html", ".html.raw", ".vue"],
+    "import/resolver": {
+      "webpack": {
+        "config": "./config/webpack.config.js"
+      }
+    }
+  },
   "rules": {
-    "filenames/match-regex": [2, "^[a-z0-9_]+(.js)?$"]
+    "filenames/match-regex": [2, "^[a-z0-9_]+$"],
+    "no-multiple-empty-lines": ["error", { "max": 1 }],
+    "promise/catch-or-return": "error"
   }
 }

.flayignore

 *.erb
 lib/gitlab/sanitizers/svg/whitelist.rb
 lib/gitlab/diff/position_tracer.rb
+app/policies/project_policy.rb
+app/models/concerns/relative_positioning.rb

.gitattributes

-*.js.es6 gitlab-language=javascript

.gitignore

 *.log
 *.swp
+*.mo
+*.edit.po
 .DS_Store
 .bundle
 .chef
@@ -16,6 +18,7 @@ eslint-report.html
 .sass-cache/
 /.secret
 /.vagrant
+/.yarn-cache
 /.byebug_history
 /Vagrantfile
 /backups/*
@@ -30,6 +33,7 @@ eslint-report.html
 /config/unicorn.rb
 /config/secrets.yml
 /config/sidekiq.yml
+/config/registry.key
 /coverage/*
 /coverage-javascript/
 /db/*.sqlite3
@@ -44,10 +48,14 @@ eslint-report.html
 /public/uploads.*
 /public/uploads/
 /shared/artifacts/
+/spec/javascripts/fixtures/blob/pdf/
+/spec/javascripts/fixtures/blob/balsamiq/
 /rails_best_practices_output.html
 /tags
 /tmp/*
 /vendor/bundle/*
-/builds/*
+/builds*
 /shared/*
 /.gitlab_workhorse_secret
+/webpack-report/
+/locale/**/LC_MESSAGES

.gitlab/issue_templates/Bug.md

+Please read this!
+
+Before opening a new issue, make sure to search for keywords in the issues
+filtered by the "regression" or "bug" label:
+
+- https://gitlab.com/gitlab-org/gitlab-ce/issues?label_name%5B%5D=regression
+- https://gitlab.com/gitlab-org/gitlab-ce/issues?label_name%5B%5D=bug
+
+and verify the issue you're about to submit isn't a duplicate.
+
+Please remove this notice if you're confident your issue isn't a duplicate.
+
+------
+
 ### Summary
 (Summarize the bug encountered concisely)
@@ -6,13 +20,13 @@
 (How one can reproduce the issue - this is very important)
-### Expected behavior
-(What you should see instead)
-### Actual behavior
-(What actually happens)
+### What is the current *bug* behavior?
+(What actually happens)
+### What is the expected *correct* behavior?
+(What you should see instead)
 ### Relevant logs and/or screenshots
@@ -23,24 +37,40 @@ logs, and code as it's very hard to read otherwise.)
 (If you are reporting a bug on GitLab.com, write: This bug happens on GitLab.com)
-#### Results of GitLab application Check
+#### Results of GitLab environment info
+
+<details>
+<summary>Expand for output related to GitLab environment info</summary>
+<pre>
 (For installations with omnibus-gitlab package run and paste the output of:
-`sudo gitlab-rake gitlab:check SANITIZE=true`)
+`sudo gitlab-rake gitlab:env:info`)
 (For installations from source run and paste the output of:
-`sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true`)
-(we will only investigate if the tests are passing)
-#### Results of GitLab environment info
+`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)
+</pre>
+</details>
+#### Results of GitLab application Check
+
+<details>
+<summary>Expand for output related to the GitLab application check</summary>
+<pre>
 (For installations with omnibus-gitlab package run and paste the output of:
-`sudo gitlab-rake gitlab:env:info`)
+`sudo gitlab-rake gitlab:check SANITIZE=true`)
 (For installations from source run and paste the output of:
-`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)
+`sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true`)
+
+(we will only investigate if the tests are passing)
+
+</pre>
+</details>
 ### Possible fixes
 (If you can, link to the line of code that might be responsible for the problem)
+
+/label ~bug

.gitlab/issue_templates/Feature Proposal.md

+Please read this!
+
+Before opening a new issue, make sure to search for keywords in the issues
+filtered by the "feature proposal" label:
+
+- https://gitlab.com/gitlab-org/gitlab-ce/issues?label_name%5B%5D=feature+proposal
+
+and verify the issue you're about to submit isn't a duplicate.
+
+Please remove this notice if you're confident your issue isn't a duplicate.
+
+------
+
 ### Description
 (Include problem, use cases, benefits, and/or goals)
@@ -5,3 +18,15 @@
 ### Proposal
 ### Links / references
+
+### Documentation blurb
+
+(Write the start of the documentation of this feature here, include:
+
+1. Why should someone use it; what's the underlying problem.
+2. What is the solution.
+3. How does someone use this
+
+During implementation, this can then be copied and used as a starter for the documentation.)
+
+/label ~"feature proposal"

.gitlab/issue_templates/Research Proposal.md

+### Background:
+
+(Include problem, use cases, benefits, and/or goals)
+
+**What questions are you trying to answer?**
+
+**Are you looking to verify an existing hypothesis or uncover new issues you should be exploring?**
+
+**What is the backstory of this project and how does it impact the approach?**
+
+**What do you already know about the areas you are exploring?**
+
+**What does success look like at the end of the project?**
+
+### Links / references:
+
+/label ~"UX research"

.haml-lint.yml

@@ -46,7 +46,7 @@ linters:
     max: 80
   MultilinePipe:
-    enabled: false
+    enabled: true
   MultilineScript:
     enabled: true
@@ -77,7 +77,7 @@ linters:
       - Style/WhileUntilModifier
   RubyComments:
-    enabled: false
+    enabled: true
   SpaceBeforeScript:
     enabled: true
@@ -97,7 +97,7 @@ linters:
     enabled: true
   UnnecessaryInterpolation:
-    enabled: false
+    enabled: true
   UnnecessaryStringOutput:
-    enabled: false
+    enabled: true

.rubocop.yml

@@ -5,7 +5,7 @@ require:
 inherit_from: .rubocop_todo.yml
 AllCops:
-  TargetRubyVersion: 2.1
+  TargetRubyVersion: 2.3
   # Cop names are not d§splayed in offense messages by default. Change behavior
   # by overriding DisplayCopNames, or by giving the -D/--display-cop-names
   # option.
@@ -17,21 +17,19 @@ AllCops:
   # Exclude some GitLab files
   Exclude:
     - 'vendor/**/*'
+    - 'node_modules/**/*'
     - 'db/*'
     - 'db/fixtures/**/*'
     - 'tmp/**/*'
     - 'bin/**/*'
-    - 'lib/backup/**/*'
-    - 'lib/ci/backup/**/*'
-    - 'lib/tasks/**/*'
-    - 'lib/ci/migrate/**/*'
-    - 'lib/email_validator.rb'
-    - 'lib/gitlab/upgrader.rb'
-    - 'lib/gitlab/seeder.rb'
     - 'generator_templates/**/*'
-##################### Style ##################################
+    - 'builds/**/*'
+# Gems in consecutive lines should be alphabetically sorted
+Bundler/OrderedGems:
+  Enabled: false
+# Style #######################################################################
 # Check indentation of private/protected visibility modifiers.
 Style/AccessModifierIndentation:
@@ -54,6 +52,16 @@ Style/AlignArray:
 Style/AlignHash:
   Enabled: true
+# Here we check if the parameters on a multi-line method call or
+# definition are aligned.
+Style/AlignParameters:
+  Enabled: false
+
+# Whether `and` and `or` are banned only in conditionals (conditionals)
+# or completely (always).
+Style/AndOr:
+  Enabled: true
+
 # Use `Array#join` instead of `Array#*`.
 Style/ArrayJoin:
   Enabled: true
@@ -78,15 +86,24 @@ Style/BeginBlock:
 Style/BlockComments:
   Enabled: true
-# Put end statement of multiline block on its own line.
-Style/BlockEndNewline:
-  Enabled: true
-
 # Avoid using {...} for multi-line blocks (multiline chaining is # always
 # ugly). Prefer {...} over do...end for single-line blocks.
 Style/BlockDelimiters:
   Enabled: true
+# Put end statement of multiline block on its own line.
+Style/BlockEndNewline:
+  Enabled: true
+
+ # This cop checks for braces around the last parameter in a method call
+# if the last parameter is a hash.
+Style/BracesAroundHashParameters:
+  Enabled: false
+
+# This cop checks for uses of the case equality operator(===).
+Style/CaseEquality:
+  Enabled: false
+
 # Indentation of when in a case/when/[else/]end.
 Style/CaseIndentation:
   Enabled: true
@@ -105,7 +122,7 @@ Style/ClassAndModuleChildren:
 # Enforces consistent use of `Object#is_a?` or `Object#kind_of?`.
 Style/ClassCheck:
-  Enabled: false
+  Enabled: true
 # Use self when defining module/class methods.
 Style/ClassMethods:
@@ -115,10 +132,26 @@ Style/ClassMethods:
 Style/ClassVars:
   Enabled: true
+# This cop checks for methods invoked via the :: operator instead
+# of the . operator (like FileUtils::rmdir instead of FileUtils.rmdir).
+Style/ColonMethodCall:
+  Enabled: true
+
+# This cop checks that comment annotation keywords are written according
+# to guidelines.
+Style/CommentAnnotation:
+  Enabled: false
+
 # Indentation of comments.
 Style/CommentIndentation:
   Enabled: true
+# Check for `if` and `case` statements where each branch is used for
+# assignment to the same variable when using the return of the
+# condition can be used instead.
+Style/ConditionalAssignment:
+  Enabled: true
+
 # Constants should use SCREAMING_SNAKE_CASE.
 Style/ConstantName:
   Enabled: true
@@ -131,13 +164,19 @@ Style/DefWithParentheses:
 Style/Documentation:
   Enabled: false
+# This cop checks for uses of double negation (!!) to convert something
+# to a boolean value. As this is both cryptic and usually redundant, it
+# should be avoided.
+Style/DoubleNegation:
+  Enabled: false
+
 # Align elses and elsifs correctly.
 Style/ElseAlignment:
   Enabled: true
 # Use empty lines between defs.
 Style/EmptyLineBetweenDefs:
-  Enabled: false
+  Enabled: true
 # Don't use several empty lines in a row.
 Style/EmptyLines:
@@ -155,14 +194,14 @@ Style/EmptyLinesAroundBlockBody:
 Style/EmptyLinesAroundClassBody:
   Enabled: true
-# Keeps track of empty lines around module bodies.
-Style/EmptyLinesAroundModuleBody:
-  Enabled: true
-
 # Keeps track of empty lines around method bodies.
 Style/EmptyLinesAroundMethodBody:
   Enabled: true
+# Keeps track of empty lines around module bodies.
+Style/EmptyLinesAroundModuleBody:
+  Enabled: true
+
 # Avoid the use of END blocks.
 Style/EndBlock:
   Enabled: true
@@ -195,24 +234,28 @@ Style/For:
 # Checks if there is a magic comment to enforce string literals
 Style/FrozenStringLiteralComment:
   Enabled: false
+
 # Do not introduce global variables.
 Style/GlobalVars:
   Enabled: true
+  Exclude:
+    - 'lib/backup/**/*'
+    - 'lib/tasks/**/*'
 # Prefer Ruby 1.9 hash syntax `{ a: 1, b: 2 }`
 # over 1.8 syntax `{ :a => 1, :b => 2 }`.
 Style/HashSyntax:
   Enabled: true
-# Do not use if x; .... Use the ternary operator instead.
-Style/IfWithSemicolon:
-  Enabled: true
-
 # Checks that conditional statements do not have an identical line at the
 # end of each branch, which can validly be moved out of the conditional.
 Style/IdenticalConditionalBranches:
   Enabled: true
+# Do not use if x; .... Use the ternary operator instead.
+Style/IfWithSemicolon:
+  Enabled: true
+
 # Checks the indentation of the first line of the right-hand-side of a
 # multi-line assignment.
 Style/IndentAssignment:
@@ -253,7 +296,7 @@ Style/ModuleFunction:
 # Checks that the closing brace in an array literal is either on the same line
 # as the last array element, or a new line.
 Style/MultilineArrayBraceLayout:
-  Enabled: false
+  Enabled: true
   EnforcedStyle: symmetrical
 # Avoid multi-line chains of blocks.
@@ -267,7 +310,7 @@ Style/MultilineBlockLayout:
 # Checks that the closing brace in a hash literal is either on the same line as
 # the last hash element, or a new line.
 Style/MultilineHashBraceLayout:
-  Enabled: false
+  Enabled: true
   EnforcedStyle: symmetrical
 # Do not use then for multi-line if/unless.
@@ -299,6 +342,14 @@ Style/MultilineOperationIndentation:
 Style/MultilineTernaryOperator:
   Enabled: true
+# This cop checks whether some constant value isn't a
+# mutable literal (e.g. array or hash).
+Style/MutableConstant:
+  Enabled: true
+  Exclude:
+    - 'db/migrate/**/*'
+    - 'db/post_migrate/**/*'
+
 # Favor unless over if for negative conditions (or control flow or).
 Style/NegatedIf:
   Enabled: true
@@ -339,6 +390,10 @@ Style/OpMethod:
 Style/ParenthesesAroundCondition:
   Enabled: true
+# Checks for an obsolete RuntimeException argument in raise/fail.
+Style/RedundantException:
+  Enabled: true
+
 # Checks for parentheses that seem not to serve any purpose.
 Style/RedundantParentheses:
   Enabled: true
@@ -397,6 +452,10 @@ Style/SpaceBeforeComment:
 Style/SpaceBeforeSemicolon:
   Enabled: true
+# Checks for spaces inside square brackets.
+Style/SpaceInsideBrackets:
+  Enabled: true
+
 # Use spaces inside hash literal braces - or don't.
 Style/SpaceInsideHashLiteralBraces:
   Enabled: true
@@ -433,6 +492,16 @@ Style/Tab:
 Style/TrailingBlankLines:
   Enabled: true
+# This cop checks for trailing comma in array and hash literals.
+Style/TrailingCommaInLiteral:
+  Enabled: true
+  EnforcedStyleForMultiline: no_comma
+
+# This cop checks for trailing comma in argument lists.
+Style/TrailingCommaInArguments:
+  Enabled: true
+  EnforcedStyleForMultiline: no_comma
+
 # Checks for %W when interpolation is not needed.
 Style/UnneededCapitalW:
   Enabled: true
@@ -468,15 +537,23 @@ Style/WhileUntilModifier:
 # Use %w or %W for arrays of words.
 Style/WordArray:
-  Enabled: false
-#################### Metrics ################################
+  Enabled: true
+
+# Use `proc` instead of `Proc.new`.
+Style/Proc:
+  Enabled: true
+# Metrics #####################################################################
 # A calculated magnitude based on number of assignments,
 # branches, and conditions.
 Metrics/AbcSize:
   Enabled: true
-  Max: 60
+  Max: 57.08
+
+# This cop checks if the length of a block exceeds some maximum value.
+Metrics/BlockLength:
+  Enabled: false
 # Avoid excessive block nesting.
 Metrics/BlockNesting:
@@ -491,7 +568,7 @@ Metrics/ClassLength:
 # of test cases needed to validate a method.
 Metrics/CyclomaticComplexity:
   Enabled: true
-  Max: 17
+  Max: 16
 # Limit lines to 80 characters.
 Metrics/LineLength:
@@ -515,23 +592,23 @@ Metrics/PerceivedComplexity:
   Enabled: true
   Max: 18
-
-#################### Lint ################################
-
-# Checks for useless access modifiers.
-Lint/UselessAccessModifier:
-  Enabled: true
-
-# Checks for attempts to use `private` or `protected` to set the visibility
-# of a class method, which does not work.
-Lint/IneffectiveAccessModifier:
-  Enabled: false
+# Lint ########################################################################
 # Checks for ambiguous operators in the first argument of a method invocation
 # without parentheses.
 Lint/AmbiguousOperator:
   Enabled: true
+# This cop checks for ambiguous regexp literals in the first argument of
+# a method invocation without parentheses.
+Lint/AmbiguousRegexpLiteral:
+  Enabled: false
+
+# This cop checks for assignments in the conditions of
+# if/while/until.
+Lint/AssignmentInCondition:
+  Enabled: false
+
 # Align block ends correctly.
 Lint/BlockAlignment:
   Enabled: true
@@ -569,6 +646,10 @@ Lint/ElseLayout:
 Lint/EmptyEnsure:
   Enabled: true
+# Checks for the presence of `when` branches without a body.
+Lint/EmptyWhen:
+  Enabled: true
+
 # Align ends correctly.
 Lint/EndAlignment:
   Enabled: true
@@ -581,10 +662,6 @@ Lint/EndInMethod:
 Lint/EnsureReturn:
   Enabled: true
-# The use of eval represents a serious security risk.
-Lint/Eval:
-  Enabled: true
-
 # Catches floating-point literals too large or small for Ruby to represent.
 Lint/FloatOutOfRange:
   Enabled: true
@@ -593,11 +670,20 @@ Lint/FloatOutOfRange:
 Lint/FormatParameterMismatch:
   Enabled: true
+# This cop checks for *rescue* blocks with no body.
+Lint/HandleExceptions:
+  Enabled: false
+
 # Checks for adjacent string literals on the same line, which could better be
 # represented as a single string literal.
 Lint/ImplicitStringConcatenation:
   Enabled: true
+# Checks for attempts to use `private` or `protected` to set the visibility
+# of a class method, which does not work.
+Lint/IneffectiveAccessModifier:
+  Enabled: false
+
 # Checks for invalid character literals with a non-escaped whitespace
 # character.
 Lint/InvalidCharacterLiteral:
@@ -611,6 +697,10 @@ Lint/LiteralInCondition:
 Lint/LiteralInInterpolation:
   Enabled: true
+# This cop checks for uses of *begin...end while/until something*.
+Lint/Loop:
+  Enabled: false
+
 # Do not use nested method definitions.
 Lint/NestedMethodDefinition:
   Enabled: true
@@ -640,6 +730,11 @@ Lint/RescueException:
 Lint/ShadowedException:
   Enabled: false
+# This cop looks for use of the same name as outer local variables
+# for block arguments or block local variables.
+Lint/ShadowingOuterLocalVariable:
+  Enabled: false
+
 # Checks for Object#to_s usage in string interpolation.
 Lint/StringConversionInInterpolation:
   Enabled: true
@@ -648,16 +743,36 @@ Lint/StringConversionInInterpolation:
 Lint/UnderscorePrefixedVariableName:
   Enabled: true
+# This cop checks for using Fixnum or Bignum constant
+Lint/UnifiedInteger:
+  Enabled: true
+
 # Checks for rubocop:disable comments that can be removed.
 # Note: this cop is not disabled when disabling all cops.
 # It must be explicitly disabled.
 Lint/UnneededDisable:
   Enabled: false
+# This cop checks for unneeded usages of splat expansion
+Lint/UnneededSplatExpansion:
+  Enabled: false
+
 # Unreachable code.
 Lint/UnreachableCode:
   Enabled: true
+# This cop checks for unused block arguments.
+Lint/UnusedBlockArgument:
+  Enabled: false
+
+# This cop checks for unused method arguments.
+Lint/UnusedMethodArgument:
+  Enabled: false
+
+# Checks for useless access modifiers.
+Lint/UselessAccessModifier:
+  Enabled: true
+
 # Checks for useless assignment to a local variable.
 Lint/UselessAssignment:
   Enabled: true
@@ -678,8 +793,7 @@ Lint/UselessSetterCall:
 Lint/Void:
   Enabled: true
-
-##################### Performance ############################
+# Performance #################################################################
 # Use `casecmp` rather than `downcase ==`.
 Performance/Casecmp:
@@ -698,6 +812,22 @@ Performance/LstripRstrip:
 Performance/RangeInclude:
   Enabled: true
+# This cop identifies the use of a `&block` parameter and `block.call`
+# where `yield` would do just as well.
+Performance/RedundantBlockCall:
+  Enabled: true
+
+# This cop identifies use of `Regexp#match` or `String#match in a context
+# where the integral return value of `=~` would do just as well.
+Performance/RedundantMatch:
+  Enabled: true
+
+# This cop identifies places where `Hash#merge!` can be replaced by
+# `Hash#[]=`.
+Performance/RedundantMerge:
+  Enabled: true
+  MaxKeyValuePairs: 1
+
 # Use `sort` instead of `sort_by { |x| x }`.
 Performance/RedundantSortBy:
   Enabled: true
@@ -717,8 +847,18 @@ Performance/StringReplacement:
 Performance/TimesMap:
   Enabled: true
-##################### Rails ##################################
+# Security ####################################################################
+
+# This cop checks for the use of JSON class methods which have potential
+# security issues.
+Security/JSONLoad:
+  Enabled: true
+
+# This cop checks for the use of *Kernel#eval*.
+Security/Eval:
+  Enabled: true
+# Rails #######################################################################
 # Enables Rails cops.
 Rails:
@@ -736,8 +876,19 @@ Rails/Date:
 # Prefer delegate method for delegations.
 Rails/Delegate:
+  Enabled: true
+
+# This cop checks dynamic `find_by_*` methods.
+Rails/DynamicFindBy:
   Enabled: false
+# This cop enforces that 'exit' calls are not used within a rails app.
+Rails/Exit:
+  Enabled: true
+  Exclude:
+    - lib/gitlab/upgrader.rb
+    - 'lib/backup/**/*'
+
 # Prefer `find_by` over `where.first`.
 Rails/FindBy:
   Enabled: true
@@ -750,9 +901,25 @@ Rails/FindEach:
 Rails/HasAndBelongsToMany:
   Enabled: true
+# This cop is used to identify usages of http methods like `get`, `post`,
+# `put`, `patch` without the usage of keyword arguments in your tests and
+# change them to use keyword args.
+Rails/HttpPositionalArguments:
+  Enabled: false
+
 # Checks for calls to puts, print, etc.
 Rails/Output:
   Enabled: true
+  Exclude:
+    - lib/gitlab/seeder.rb
+    - lib/gitlab/upgrader.rb
+    - 'lib/backup/**/*'
+    - 'lib/tasks/**/*'
+
+# This cop checks for the use of output safety calls like html_safe and
+# raw.
+Rails/OutputSafety:
+  Enabled: false
 # Checks for incorrect grammar when using methods like `3.day.ago`.
 Rails/PluralizationGrammar:
@@ -766,12 +933,24 @@ Rails/ReadWriteAttribute:
 Rails/ScopeArgs:
   Enabled: true
-##################### RSpec ##################################
+# This cop checks for the use of Time methods without zone.
+Rails/TimeZone:
+  Enabled: false
+
+# This cop checks for the use of old-style attribute validation macros.
+Rails/Validation:
+  Enabled: true
+
+# RSpec #######################################################################
 # Check that instances are not being stubbed globally.
 RSpec/AnyInstance:
   Enabled: false
+# Check for expectations where `be(...)` can replace `eql(...)`.
+RSpec/BeEql:
+  Enabled: true
+
 # Check that the first argument to the top level describe is the tested class or
 # module.
 RSpec/DescribeClass:
@@ -781,10 +960,20 @@ RSpec/DescribeClass:
 RSpec/DescribeMethod:
   Enabled: false
+# Avoid describing symbols.
+RSpec/DescribeSymbol:
+  Enabled: true
+
 # Checks that the second argument to top level describe is the tested method
 # name.
 RSpec/DescribedClass:
-  Enabled: false
+  Enabled: true
+
+# Checks if an example group does not include any tests.
+RSpec/EmptyExampleGroup:
+  Enabled: true
+  CustomIncludeMethods:
+    - run_permission_checks
 # Checks for long example.
 RSpec/ExampleLength:
@@ -800,12 +989,22 @@ RSpec/ExampleWording:
     not: does not
   IgnoredWords: []
+# Checks for `expect(...)` calls containing literal values.
+RSpec/ExpectActual:
+  Enabled: true
+
+# Checks for opportunities to use `expect { … }.to output`.
+RSpec/ExpectOutput:
+  Enabled: true
+
 # Checks the file and folder naming of the spec file.
 RSpec/FilePath:
-  Enabled: false
-  CustomTransform:
-    RuboCop: rubocop
-    RSpec: rspec
+  Enabled: true
+  IgnoreMethods: true
+  Exclude:
+    - 'qa/**/*'
+    - 'spec/javascripts/fixtures/*'
+    - 'spec/requests/api/v3/*'
 # Checks if there are focused specs.
 RSpec/Focus:
@@ -815,15 +1014,51 @@ RSpec/Focus:
 RSpec/InstanceVariable:
   Enabled: false
+# Checks for `subject` definitions that come after `let` definitions.
+RSpec/LeadingSubject:
+  Enabled: false
+
+# Checks unreferenced `let!` calls being used for test setup.
+RSpec/LetSetup:
+  Enabled: false
+
+# Check that chains of messages are not being stubbed.
+RSpec/MessageChain:
+  Enabled: false
+
+# Checks that message expectations are set using spies.
+RSpec/MessageSpies:
+  Enabled: false
+
 # Checks for multiple top-level describes.
 RSpec/MultipleDescribes:
   Enabled: false
+# Checks if examples contain too many `expect` calls.
+RSpec/MultipleExpectations:
+  Enabled: false
+
+# Checks for explicitly referenced test subjects.
+RSpec/NamedSubject:
+  Enabled: false
+
+# Checks for nested example groups.
+RSpec/NestedGroups:
+  Enabled: false
+
 # Enforces the usage of the same method on all negative message expectations.
 RSpec/NotToNot:
   EnforcedStyle: not_to
   Enabled: true
+# Check for repeated description strings in example groups.
+RSpec/RepeatedDescription:
+  Enabled: false
+
+# Checks for stubbed test subjects.
+RSpec/SubjectStub:
+  Enabled: false
+
 # Prefer using verifying doubles over normal doubles.
 RSpec/VerifiedDoubles:
   Enabled: false

.rubocop_todo.yml

 # This configuration was generated by
 # `rubocop --auto-gen-config --exclude-limit 0`
-# on 2017-01-11 09:38:25 +0000 using RuboCop version 0.46.0.
+# on 2017-04-07 20:17:35 -0400 using RuboCop version 0.47.1.
 # The point is for the user to remove these configuration records
 # one by one as the offenses are removed from the code base.
 # Note that changes in the inspected code, or installation of new
 # versions of RuboCop, may require this file to be generated again.
-# Offense count: 27
-# Configuration parameters: Include.
-# Include: **/Gemfile, **/gems.rb
-Bundler/OrderedGems:
-  Enabled: false
-
-# Offense count: 175
-Lint/AmbiguousRegexpLiteral:
-  Enabled: false
-
-# Offense count: 53
-# Configuration parameters: AllowSafeAssignment.
-Lint/AssignmentInCondition:
-  Enabled: false
-
-# Offense count: 1
-Lint/EmptyWhen:
-  Enabled: false
-
-# Offense count: 20
-Lint/HandleExceptions:
-  Enabled: false
-
-# Offense count: 1
-Lint/Loop:
-  Enabled: false
-
-# Offense count: 27
-Lint/ShadowingOuterLocalVariable:
-  Enabled: false
-
-# Offense count: 10
-# Cop supports --auto-correct.
-Lint/UnifiedInteger:
-  Enabled: false
-
-# Offense count: 21
-# Cop supports --auto-correct.
-Lint/UnneededSplatExpansion:
-  Enabled: false
-
-# Offense count: 82
-# Cop supports --auto-correct.
-# Configuration parameters: IgnoreEmptyBlocks, AllowUnusedKeywordArguments.
-Lint/UnusedBlockArgument:
-  Enabled: false
-
-# Offense count: 173
-# Cop supports --auto-correct.
-# Configuration parameters: AllowUnusedKeywordArguments, IgnoreEmptyMethods.
-Lint/UnusedMethodArgument:
-  Enabled: false
-
-# Offense count: 93
-# Configuration parameters: CountComments.
-Metrics/BlockLength:
-  Enabled: false
-
-# Offense count: 3
-# Cop supports --auto-correct.
-Performance/RedundantBlockCall:
-  Enabled: false
-
-# Offense count: 5
-# Cop supports --auto-correct.
-Performance/RedundantMatch:
-  Enabled: false
-
-# Offense count: 32
-# Cop supports --auto-correct.
-# Configuration parameters: MaxKeyValuePairs.
-Performance/RedundantMerge:
-  Enabled: false
-
-# Offense count: 7
-RSpec/BeEql:
+# Offense count: 54
+RSpec/BeforeAfterAll:
   Enabled: false
-# Offense count: 15
-# Configuration parameters: CustomIncludeMethods.
-RSpec/EmptyExampleGroup:
+# Offense count: 233
+RSpec/EmptyLineAfterFinalLet:
   Enabled: false
-# Offense count: 24
-RSpec/ExpectActual:
+# Offense count: 167
+RSpec/EmptyLineAfterSubject:
   Enabled: false
-# Offense count: 58
+# Offense count: 72
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: implicit, each, example
 RSpec/HookArgument:
@@ -105,154 +30,77 @@ RSpec/HookArgument:
 RSpec/ImplicitExpect:
   Enabled: false
-# Offense count: 237
-RSpec/LeadingSubject:
-  Enabled: false
-
-# Offense count: 253
-RSpec/LetSetup:
-  Enabled: false
-
-# Offense count: 13
-RSpec/MessageChain:
+# Offense count: 11
+# Configuration parameters: EnforcedStyle, SupportedStyles.
+# SupportedStyles: it_behaves_like, it_should_behave_like
+RSpec/ItBehavesLike:
   Enabled: false
-# Offense count: 479
-# Configuration parameters: EnforcedStyle, SupportedStyles.
-# SupportedStyles: have_received, receive
-RSpec/MessageSpies:
+# Offense count: 4
+RSpec/IteratedExpectation:
   Enabled: false
-# Offense count: 3036
-RSpec/MultipleExpectations:
+# Offense count: 3
+RSpec/OverwritingSetup:
   Enabled: false
-# Offense count: 2133
-RSpec/NamedSubject:
+# Offense count: 34
+RSpec/RepeatedExample:
   Enabled: false
-# Offense count: 1974
-# Configuration parameters: MaxNesting.
-RSpec/NestedGroups:
+# Offense count: 43
+RSpec/ScatteredLet:
   Enabled: false
 # Offense count: 32
-RSpec/RepeatedDescription:
+RSpec/ScatteredSetup:
   Enabled: false
 # Offense count: 1
-RSpec/SingleArgumentMessageChain:
+RSpec/SharedContext:
   Enabled: false
-# Offense count: 133
-RSpec/SubjectStub:
-  Enabled: false
-
-# Offense count: 104
-# Cop supports --auto-correct.
-# Configuration parameters: Whitelist.
-# Whitelist: find_by_sql
-Rails/DynamicFindBy:
-  Enabled: false
-
-# Offense count: 932
-# Cop supports --auto-correct.
-# Configuration parameters: Include.
-# Include: spec/**/*, test/**/*
-Rails/HttpPositionalArguments:
-  Enabled: false
-
-# Offense count: 55
-Rails/OutputSafety:
-  Enabled: false
-
-# Offense count: 182
-# Configuration parameters: EnforcedStyle, SupportedStyles.
-# SupportedStyles: strict, flexible
-Rails/TimeZone:
+# Offense count: 150
+Rails/FilePath:
   Enabled: false
-# Offense count: 15
-# Cop supports --auto-correct.
+# Offense count: 2
 # Configuration parameters: Include.
-# Include: app/models/**/*.rb
-Rails/Validation:
+# Include: db/migrate/*.rb
+Rails/ReversibleMigration:
   Enabled: false
-# Offense count: 8
-# Cop supports --auto-correct.
-# Configuration parameters: AutoCorrect.
-Security/JSONLoad:
+# Offense count: 302
+# Configuration parameters: Blacklist.
+# Blacklist: decrement!, decrement_counter, increment!, increment_counter, toggle!, touch, update_all, update_attribute, update_column, update_columns, update_counters
+Rails/SkipsModelValidations:
   Enabled: false
-# Offense count: 346
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle, SupportedStyles, IndentationWidth.
-# SupportedStyles: with_first_parameter, with_fixed_indentation
-Style/AlignParameters:
-  Enabled: false
-
-# Offense count: 27
+# Offense count: 7
 # Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle, SupportedStyles.
-# SupportedStyles: always, conditionals
-Style/AndOr:
+Security/YAMLLoad:
   Enabled: false
-# Offense count: 54
+# Offense count: 59
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: percent_q, bare_percent
 Style/BarePercentLiterals:
   Enabled: false
-# Offense count: 358
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle, SupportedStyles.
-# SupportedStyles: braces, no_braces, context_dependent
-Style/BracesAroundHashParameters:
-  Enabled: false
-
-# Offense count: 6
-Style/CaseEquality:
-  Enabled: false
-
-# Offense count: 37
-# Cop supports --auto-correct.
-Style/ColonMethodCall:
-  Enabled: false
-
-# Offense count: 4
-# Cop supports --auto-correct.
-# Configuration parameters: Keywords.
-# Keywords: TODO, FIXME, OPTIMIZE, HACK, REVIEW
-Style/CommentAnnotation:
-  Enabled: false
-
-# Offense count: 29
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle, SupportedStyles, SingleLineConditionsOnly.
-# SupportedStyles: assign_to_condition, assign_inside_condition
-Style/ConditionalAssignment:
-  Enabled: false
-
-# Offense count: 1210
+# Offense count: 1403
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: leading, trailing
 Style/DotPosition:
   Enabled: false
-# Offense count: 18
-Style/DoubleNegation:
-  Enabled: false
-
-# Offense count: 7
+# Offense count: 5
 # Cop supports --auto-correct.
 Style/EachWithObject:
   Enabled: false
-# Offense count: 24
+# Offense count: 28
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: empty, nil, both
@@ -264,72 +112,72 @@ Style/EmptyElse:
 Style/EmptyLiteral:
   Enabled: false
-# Offense count: 57
+# Offense count: 59
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: compact, expanded
 Style/EmptyMethod:
   Enabled: false
-# Offense count: 147
+# Offense count: 214
 # Cop supports --auto-correct.
 # Configuration parameters: AllowForAlignment, ForceEqualSignAlignment.
 Style/ExtraSpacing:
   Enabled: false
-# Offense count: 8
+# Offense count: 9
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: format, sprintf, percent
 Style/FormatString:
   Enabled: false
-# Offense count: 238
+# Offense count: 285
 # Configuration parameters: MinBodyLength.
 Style/GuardClause:
   Enabled: false
-# Offense count: 11
+# Offense count: 16
 Style/IfInsideElse:
   Enabled: false
-# Offense count: 173
+# Offense count: 186
 # Cop supports --auto-correct.
 # Configuration parameters: MaxLineLength.
 Style/IfUnlessModifier:
   Enabled: false
-# Offense count: 55
+# Offense count: 99
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles, IndentationWidth.
 # SupportedStyles: special_inside_parentheses, consistent, align_brackets
 Style/IndentArray:
   Enabled: false
-# Offense count: 101
+# Offense count: 160
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles, IndentationWidth.
 # SupportedStyles: special_inside_parentheses, consistent, align_braces
 Style/IndentHash:
   Enabled: false
-# Offense count: 41
+# Offense count: 50
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: line_count_dependent, lambda, literal
 Style/Lambda:
   Enabled: false
-# Offense count: 5
+# Offense count: 6
 # Cop supports --auto-correct.
 Style/LineEndConcatenation:
   Enabled: false
-# Offense count: 19
+# Offense count: 34
 # Cop supports --auto-correct.
-Style/MethodCallParentheses:
+Style/MethodCallWithoutArgsParentheses:
   Enabled: false
-# Offense count: 9
+# Offense count: 10
 Style/MethodMissing:
   Enabled: false
@@ -338,61 +186,49 @@ Style/MethodMissing:
 Style/MultilineIfModifier:
   Enabled: false
-# Offense count: 179
-# Cop supports --auto-correct.
-Style/MutableConstant:
-  Enabled: false
-
-# Offense count: 8
+# Offense count: 24
 # Cop supports --auto-correct.
 Style/NestedParenthesizedCalls:
   Enabled: false
-# Offense count: 13
+# Offense count: 18
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, MinBodyLength, SupportedStyles.
 # SupportedStyles: skip_modifier_ifs, always
 Style/Next:
   Enabled: false
-# Offense count: 19
+# Offense count: 37
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedOctalStyle, SupportedOctalStyles.
 # SupportedOctalStyles: zero_with_o, zero_only
 Style/NumericLiteralPrefix:
   Enabled: false
-# Offense count: 19
+# Offense count: 88
 # Cop supports --auto-correct.
 # Configuration parameters: AutoCorrect, EnforcedStyle, SupportedStyles.
 # SupportedStyles: predicate, comparison
 Style/NumericPredicate:
   Enabled: false
-# Offense count: 34
+# Offense count: 36
 # Cop supports --auto-correct.
 Style/ParallelAssignment:
   Enabled: false
-# Offense count: 417
+# Offense count: 570
 # Cop supports --auto-correct.
 # Configuration parameters: PreferredDelimiters.
 Style/PercentLiteralDelimiters:
   Enabled: false
-# Offense count: 10
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle, SupportedStyles.
-# SupportedStyles: lower_case_q, upper_case_q
-Style/PercentQLiterals:
-  Enabled: false
-
-# Offense count: 13
+# Offense count: 14
 # Cop supports --auto-correct.
 Style/PerlBackrefs:
   Enabled: false
-# Offense count: 64
+# Offense count: 83
 # Configuration parameters: NamePrefix, NamePrefixBlacklist, NameWhitelist.
 # NamePrefix: is_, has_, have_
 # NamePrefixBlacklist: is_, has_, have_
@@ -400,59 +236,49 @@ Style/PerlBackrefs:
 Style/PredicateName:
   Enabled: false
-# Offense count: 33
+# Offense count: 45
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: short, verbose
 Style/PreferredHashMethods:
   Enabled: false
-# Offense count: 8
-# Cop supports --auto-correct.
-Style/Proc:
-  Enabled: false
-
-# Offense count: 50
+# Offense count: 65
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: compact, exploded
 Style/RaiseArgs:
   Enabled: false
-# Offense count: 4
+# Offense count: 5
 # Cop supports --auto-correct.
 Style/RedundantBegin:
   Enabled: false
-# Offense count: 1
-# Cop supports --auto-correct.
-Style/RedundantException:
-  Enabled: false
-
-# Offense count: 29
+# Offense count: 32
 # Cop supports --auto-correct.
 Style/RedundantFreeze:
   Enabled: false
-# Offense count: 11
+# Offense count: 15
 # Cop supports --auto-correct.
 # Configuration parameters: AllowMultipleReturnValues.
 Style/RedundantReturn:
   Enabled: false
-# Offense count: 359
+# Offense count: 382
 # Cop supports --auto-correct.
 Style/RedundantSelf:
   Enabled: false
-# Offense count: 105
+# Offense count: 111
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles, AllowInnerSlashes.
 # SupportedStyles: slashes, percent_r, mixed
 Style/RegexpLiteral:
   Enabled: false
-# Offense count: 19
+# Offense count: 24
 # Cop supports --auto-correct.
 Style/RescueModifier:
   Enabled: false
@@ -462,19 +288,13 @@ Style/RescueModifier:
 Style/SelfAssignment:
   Enabled: false
-# Offense count: 2
-# Configuration parameters: Methods.
-# Methods: {"reduce"=>["acc", "elem"]}, {"inject"=>["acc", "elem"]}
-Style/SingleLineBlockParams:
-  Enabled: false
-
 # Offense count: 50
 # Cop supports --auto-correct.
 # Configuration parameters: AllowIfMethodIsEmpty.
 Style/SingleLineMethods:
   Enabled: false
-# Offense count: 138
+# Offense count: 168
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: space, no_space
@@ -487,84 +307,66 @@ Style/SpaceBeforeBlockBraces:
 Style/SpaceBeforeFirstArg:
   Enabled: false
-# Offense count: 37
+# Offense count: 46
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: require_no_space, require_space
 Style/SpaceInLambdaLiteral:
   Enabled: false
-# Offense count: 174
+# Offense count: 229
 # Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle, SupportedStyles, EnforcedStyleForEmptyBraces, SpaceBeforeBlockParameters.
+# Configuration parameters: EnforcedStyle, SupportedStyles, EnforcedStyleForEmptyBraces, SupportedStylesForEmptyBraces, SpaceBeforeBlockParameters.
 # SupportedStyles: space, no_space
+# SupportedStylesForEmptyBraces: space, no_space
 Style/SpaceInsideBlockBraces:
   Enabled: false
-# Offense count: 115
-# Cop supports --auto-correct.
-Style/SpaceInsideBrackets:
-  Enabled: false
-
-# Offense count: 77
+# Offense count: 116
 # Cop supports --auto-correct.
 Style/SpaceInsideParens:
   Enabled: false
-# Offense count: 4
+# Offense count: 12
 # Cop supports --auto-correct.
 Style/SpaceInsidePercentLiteralDelimiters:
   Enabled: false
-# Offense count: 53
+# Offense count: 57
 # Cop supports --auto-correct.
 # Configuration parameters: SupportedStyles.
 # SupportedStyles: use_perl_names, use_english_names
 Style/SpecialGlobalVars:
   EnforcedStyle: use_perl_names
-# Offense count: 25
+# Offense count: 42
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: single_quotes, double_quotes
 Style/StringLiteralsInInterpolation:
   Enabled: false
-# Offense count: 54
+# Offense count: 64
 # Cop supports --auto-correct.
 # Configuration parameters: IgnoredMethods.
 # IgnoredMethods: respond_to, define_method
 Style/SymbolProc:
   Enabled: false
-# Offense count: 5
+# Offense count: 6
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles, AllowSafeAssignment.
 # SupportedStyles: require_parentheses, require_no_parentheses, require_parentheses_when_complex
 Style/TernaryParentheses:
   Enabled: false
-# Offense count: 36
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyleForMultiline, SupportedStyles.
-# SupportedStyles: comma, consistent_comma, no_comma
-Style/TrailingCommaInArguments:
-  Enabled: false
-
-# Offense count: 150
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyleForMultiline, SupportedStyles.
-# SupportedStyles: comma, consistent_comma, no_comma
-Style/TrailingCommaInLiteral:
-  Enabled: false
-
-# Offense count: 7
+# Offense count: 18
 # Cop supports --auto-correct.
 # Configuration parameters: AllowNamedUnderscoreVariables.
 Style/TrailingUnderscoreVariable:
   Enabled: false
-# Offense count: 67
+# Offense count: 78
 # Cop supports --auto-correct.
 Style/TrailingWhitespace:
   Enabled: false
@@ -576,12 +378,12 @@ Style/TrailingWhitespace:
 Style/TrivialAccessors:
   Enabled: false
-# Offense count: 2
+# Offense count: 6
 # Cop supports --auto-correct.
 Style/UnlessElse:
   Enabled: false
-# Offense count: 17
+# Offense count: 24
 # Cop supports --auto-correct.
 Style/UnneededInterpolation:
   Enabled: false

GITALY_SERVER_VERSION

+0.10.0

GITLAB_PAGES_VERSION

+0.4.2

GITLAB_SHELL_VERSION

-4.1.1
+5.0.3

GITLAB_WORKHORSE_VERSION

-1.3.0
+2.0.0

Gemfile

 source 'https://rubygems.org'
-gem 'rails', '4.2.7.1'
+gem 'rails', '4.2.8'
 gem 'rails-deprecated_sanitizer', '~> 1.0.3'
 # Responders respond_to and respond_with
 gem 'responders', '~> 2.0'
 gem 'sprockets', '~> 3.7.0'
-gem 'sprockets-es6', '~> 0.9.2'
 # Default values for AR models
 gem 'default_value_for', '~> 3.0.0'
@@ -16,27 +15,31 @@ gem 'default_value_for', '~> 3.0.0'
 gem 'mysql2', '~> 0.3.16', group: :mysql
 gem 'pg', '~> 0.18.2', group: :postgres
-gem 'rugged', '~> 0.24.0'
+gem 'rugged', '~> 0.25.1.1'
+
+gem 'faraday', '~> 0.11.0'
 # Authentication libraries
-gem 'devise',                 '~> 4.2'
-gem 'doorkeeper',             '~> 4.2.0'
-gem 'omniauth',               '~> 1.3.2'
-gem 'omniauth-auth0',         '~> 1.4.1'
-gem 'omniauth-azure-oauth2',  '~> 0.0.6'
-gem 'omniauth-cas3',          '~> 1.1.2'
-gem 'omniauth-facebook',      '~> 4.0.0'
-gem 'omniauth-github',        '~> 1.1.1'
-gem 'omniauth-gitlab',        '~> 1.0.2'
+gem 'devise', '~> 4.2'
+gem 'doorkeeper', '~> 4.2.0'
+gem 'doorkeeper-openid_connect', '~> 1.1.0'
+gem 'omniauth', '~> 1.4.2'
+gem 'omniauth-auth0', '~> 1.4.1'
+gem 'omniauth-azure-oauth2', '~> 0.0.6'
+gem 'omniauth-cas3', '~> 1.1.2'
+gem 'omniauth-facebook', '~> 4.0.0'
+gem 'omniauth-github', '~> 1.1.1'
+gem 'omniauth-gitlab', '~> 1.0.2'
 gem 'omniauth-google-oauth2', '~> 0.4.1'
-gem 'omniauth-kerberos',      '~> 0.3.0', group: :kerberos
-gem 'omniauth-saml',          '~> 1.7.0'
-gem 'omniauth-shibboleth',    '~> 1.2.0'
-gem 'omniauth-twitter',       '~> 1.2.0'
-gem 'omniauth_crowd',         '~> 2.2.0'
-gem 'omniauth-authentiq',     '~> 0.2.0'
-gem 'rack-oauth2',            '~> 1.2.1'
-gem 'jwt'
+gem 'omniauth-kerberos', '~> 0.3.0', group: :kerberos
+gem 'omniauth-oauth2-generic', '~> 0.2.2'
+gem 'omniauth-saml', '~> 1.7.0'
+gem 'omniauth-shibboleth', '~> 1.2.0'
+gem 'omniauth-twitter', '~> 1.2.0'
+gem 'omniauth_crowd', '~> 2.2.0'
+gem 'omniauth-authentiq', '~> 0.3.0'
+gem 'rack-oauth2', '~> 1.2.1'
+gem 'jwt', '~> 1.5.6'
 # Spam and anti-bot protection
 gem 'recaptcha', '~> 3.0', require: 'recaptcha/rails'
@@ -48,6 +51,9 @@ gem 'rqrcode-rails3', '~> 0.1.7'
 gem 'attr_encrypted', '~> 3.0.0'
 gem 'u2f', '~> 0.2.1'
+# GitLab Pages
+gem 'validates_hostname', '~> 1.0.6'
+
 # Browser detection
 gem 'browser', '~> 2.2'
@@ -59,15 +65,18 @@ gem 'gitlab_omniauth-ldap', '~> 1.2.1', require: 'omniauth-ldap'
 # Git Wiki
 # Required manually in config/initializers/gollum.rb to control load order
 gem 'gollum-lib', '~> 4.2', require: false
-gem 'gollum-rugged_adapter', '~> 0.4.2', require: false
+gem 'gollum-rugged_adapter', '~> 0.4.4', require: false
 # Language detection
 gem 'github-linguist', '~> 4.7.0', require: 'linguist'
 # API
-gem 'grape',        '~> 0.18.0'
+gem 'grape', '~> 0.19.0'
 gem 'grape-entity', '~> 0.6.0'
-gem 'rack-cors',    '~> 0.4.0', require: 'rack/cors'
+gem 'rack-cors', '~> 0.4.0', require: 'rack/cors'
+
+# Disable strong_params so that Mash does not respond to :permitted?
+gem 'hashie-forbidden_attributes'
 # Pagination
 gem 'kaminari', '~> 0.17.0'
@@ -76,14 +85,14 @@ gem 'kaminari', '~> 0.17.0'
 gem 'hamlit', '~> 2.6.1'
 # Files attachments
-gem 'carrierwave', '~> 0.10.0'
+gem 'carrierwave', '~> 1.0'
 # Drag and Drop UI
 gem 'dropzonejs-rails', '~> 0.7.1'
 # for backups
 gem 'fog-aws', '~> 0.9'
-gem 'fog-core', '~> 1.40'
+gem 'fog-core', '~> 1.44'
 gem 'fog-google', '~> 0.5'
 gem 'fog-local', '~> 0.3'
 gem 'fog-openstack', '~> 0.1'
@@ -99,19 +108,19 @@ gem 'unf', '~> 0.1.4'
 gem 'seed-fu', '~> 2.3.5'
 # Markdown and HTML processing
-gem 'html-pipeline',        '~> 1.11.0'
-gem 'deckar01-task_list',   '1.0.6', require: 'task_list/railtie'
-gem 'gitlab-markup',        '~> 1.5.1'
-gem 'redcarpet',            '~> 3.3.3'
-gem 'RedCloth',             '~> 4.3.2'
-gem 'rdoc',                 '~> 4.2'
-gem 'org-ruby',             '~> 0.9.12'
-gem 'creole',               '~> 0.5.0'
-gem 'wikicloth',            '0.8.1'
-gem 'asciidoctor',          '~> 1.5.2'
-gem 'asciidoctor-plantuml', '0.0.6'
-gem 'rouge',                '~> 2.0'
-gem 'truncato',             '~> 0.7.8'
+gem 'html-pipeline', '~> 1.11.0'
+gem 'deckar01-task_list', '1.0.6', require: 'task_list/railtie'
+gem 'gitlab-markup', '~> 1.5.1'
+gem 'redcarpet', '~> 3.4'
+gem 'RedCloth', '~> 4.3.2'
+gem 'rdoc', '~> 4.2'
+gem 'org-ruby', '~> 0.9.12'
+gem 'creole', '~> 0.5.0'
+gem 'wikicloth', '0.8.1'
+gem 'asciidoctor', '~> 1.5.2'
+gem 'asciidoctor-plantuml', '0.0.7'
+gem 'rouge', '~> 2.0'
+gem 'truncato', '~> 0.7.8'
 # See https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s
 # and https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM
@@ -135,11 +144,14 @@ gem 'after_commit_queue', '~> 1.3.0'
 gem 'acts-as-taggable-on', '~> 4.0'
 # Background jobs
-gem 'sidekiq', '~> 4.2.7'
-gem 'sidekiq-cron', '~> 0.4.4'
+gem 'sidekiq', '~> 5.0'
+gem 'sidekiq-cron', '~> 0.6.0'
 gem 'redis-namespace', '~> 1.5.2'
 gem 'sidekiq-limit_fetch', '~> 3.4'
+# Cron Parser
+gem 'rufus-scheduler', '~> 3.4'
+
 # HTTP requests
 gem 'httparty', '~> 0.13.3'
@@ -176,7 +188,7 @@ gem 'gemnasium-gitlab-service', '~> 0.2'
 gem 'slack-notifier', '~> 1.5.1'
 # Asana integration
-gem 'asana', '~> 0.4.0'
+gem 'asana', '~> 0.6.0'
 # FogBugz integration
 gem 'ruby-fogbugz', '~> 0.2.1'
@@ -198,7 +210,7 @@ gem 'babosa', '~> 1.0.2'
 gem 'loofah', '~> 2.0.3'
 # Working with license
-gem 'licensee', '~> 8.0.0'
+gem 'licensee', '~> 8.7.0'
 # Protect against bruteforcing
 gem 'rack-attack', '~> 4.4.1'
@@ -219,30 +231,37 @@ gem 'oj', '~> 2.17.4'
 gem 'chronic', '~> 0.10.2'
 gem 'chronic_duration', '~> 0.10.6'
+gem 'webpack-rails', '~> 0.9.10'
+gem 'rack-proxy', '~> 0.6.0'
+
 gem 'sass-rails', '~> 5.0.6'
 gem 'coffee-rails', '~> 4.1.0'
 gem 'uglifier', '~> 2.7.2'
-gem 'gitlab-turbolinks-classic', '~> 2.5', '>= 2.5.6'
-gem 'addressable',        '~> 2.3.8'
-gem 'bootstrap-sass',     '~> 3.3.0'
-gem 'font-awesome-rails', '~> 4.6.1'
-gem 'gemojione',          '~> 3.0'
-gem 'gon',                '~> 6.1.0'
+gem 'addressable', '~> 2.3.8'
+gem 'bootstrap-sass', '~> 3.3.0'
+gem 'font-awesome-rails', '~> 4.7'
+gem 'gemojione', '~> 3.0'
+gem 'gon', '~> 6.1.0'
 gem 'jquery-atwho-rails', '~> 1.3.2'
-gem 'jquery-rails',       '~> 4.1.0'
-gem 'jquery-ui-rails',    '~> 5.0.0'
-gem 'request_store',      '~> 1.3'
-gem 'select2-rails',      '~> 3.5.9'
-gem 'virtus',             '~> 1.0.1'
-gem 'net-ssh',            '~> 3.0.1'
-gem 'base32',             '~> 0.3.0'
+gem 'jquery-rails', '~> 4.1.0'
+gem 'request_store', '~> 1.3'
+gem 'select2-rails', '~> 3.5.9'
+gem 'virtus', '~> 1.0.1'
+gem 'net-ssh', '~> 3.0.1'
+gem 'base32', '~> 0.3.0'
 # Sentry integration
-gem 'sentry-raven', '~> 2.0.0'
+gem 'sentry-raven', '~> 2.4.0'
 gem 'premailer-rails', '~> 1.9.0'
+# I18n
+gem 'ruby_parser', '~> 3.8.4', require: false
+gem 'gettext_i18n_rails', '~> 1.8.0'
+gem 'gettext_i18n_rails_js', '~> 1.2.0'
+gem 'gettext', '~> 3.2.2', require: false, group: :development
+
 # Metrics
 group :metrics do
   gem 'allocations', '~> 1.0', require: false, platform: :mri
@@ -252,15 +271,13 @@ end
 group :development do
   gem 'foreman', '~> 0.78.0'
-  gem 'brakeman', '~> 3.4.0', require: false
+  gem 'brakeman', '~> 3.6.0', require: false
   gem 'letter_opener_web', '~> 1.3.0'
-  gem 'bullet', '~> 5.2.0', require: false
   gem 'rblineprof', '~> 0.3.6', platform: :mri, require: false
-  gem 'web-console', '~> 2.0'
   # Better errors handler
-  gem 'better_errors', '~> 1.0.1'
+  gem 'better_errors', '~> 2.1.0'
   gem 'binding_of_caller', '~> 0.7.2'
   # thin instead webrick
@@ -268,18 +285,21 @@ group :development do
 end
 group :development, :test do
+  gem 'bullet', '~> 5.5.0', require: !!ENV['ENABLE_BULLET']
   gem 'pry-byebug', '~> 3.4.1', platform: :mri
   gem 'pry-rails', '~> 0.3.4'
   gem 'awesome_print', '~> 1.2.0', require: false
   gem 'fuubar', '~> 2.0.0'
-  gem 'database_cleaner',   '~> 1.5.0'
+  gem 'database_cleaner', '~> 1.5.0'
   gem 'factory_girl_rails', '~> 4.7.0'
-  gem 'rspec-rails',        '~> 3.5.0'
-  gem 'rspec-retry',        '~> 0.4.5'
-  gem 'spinach-rails',      '~> 0.2.1'
+  gem 'rspec-rails', '~> 3.5.0'
+  gem 'rspec-retry', '~> 0.4.5'
+  gem 'spinach-rails', '~> 0.2.1'
   gem 'spinach-rerun-reporter', '~> 0.0.2'
+  gem 'rspec_profiling', '~> 0.0.5'
+  gem 'rspec-set', '~> 0.1.3'
   # Prevent occasions where minitest is not bundled in packaged versions of ruby (see #3826)
   gem 'minitest', '~> 5.7.0'
@@ -287,24 +307,20 @@ group :development, :test do
   # Generate Fake data
   gem 'ffaker', '~> 2.4'
-  gem 'capybara',            '~> 2.6.2'
+  gem 'capybara', '~> 2.6.2'
   gem 'capybara-screenshot', '~> 1.0.0'
-  gem 'poltergeist',         '~> 1.9.0'
-
-  gem 'teaspoon', '~> 1.1.0'
-  gem 'teaspoon-jasmine', '~> 2.2.0'
-  gem 'spring',                   '~> 1.7.0'
-  gem 'spring-commands-rspec',    '~> 1.0.4'
-  gem 'spring-commands-spinach',  '~> 1.1.0'
-  gem 'spring-commands-teaspoon', '~> 0.0.2'
-  gem 'rubocop', '~> 0.46.0', require: false
-  gem 'rubocop-rspec', '~> 1.9.1', require: false
+  gem 'poltergeist', '~> 1.9.0'
+  gem 'spring', '~> 2.0.0'
+  gem 'spring-commands-rspec', '~> 1.0.4'
+  gem 'spring-commands-spinach', '~> 1.1.0'
+  gem 'rubocop', '~> 0.47.1', require: false
+  gem 'rubocop-rspec', '~> 1.15.0', require: false
   gem 'scss_lint', '~> 0.47.0', require: false
-  gem 'haml_lint', '~> 0.18.2', require: false
-  gem 'simplecov', '0.12.0', require: false
-  gem 'flay', '~> 2.6.1', require: false
+  gem 'haml_lint', '~> 0.21.0', require: false
+  gem 'simplecov', '~> 0.14.0', require: false
+  gem 'flay', '~> 2.8.0', require: false
   gem 'bundler-audit', '~> 0.5.0', require: false
   gem 'benchmark-ips', '~> 2.3.0', require: false
@@ -321,17 +337,16 @@ group :test do
   gem 'shoulda-matchers', '~> 2.8.0', require: false
   gem 'email_spec', '~> 1.6.0'
   gem 'json-schema', '~> 2.6.2'
-  gem 'webmock', '~> 1.21.0'
-  gem 'test_after_commit', '~> 0.4.2'
+  gem 'webmock', '~> 1.24.0'
+  gem 'test_after_commit', '~> 1.1'
   gem 'sham_rack', '~> 1.3.6'
   gem 'timecop', '~> 0.8.0'
+  gem 'concurrent-ruby', '~> 1.0.5'
 end
-gem 'newrelic_rpm', '~> 3.16'
-
 gem 'octokit', '~> 4.6.2'
-gem 'mail_room', '~> 0.9.0'
+gem 'mail_room', '~> 0.9.1'
 gem 'email_reply_trimmer', '~> 0.1'
 gem 'html2text'
@@ -339,14 +354,19 @@ gem 'html2text'
 gem 'ruby-prof', '~> 0.16.2'
 # OAuth
-gem 'oauth2', '~> 1.2.0'
+gem 'oauth2', '~> 1.3.0'
 # Soft deletion
 gem 'paranoia', '~> 2.2'
 # Health check
-gem 'health_check', '~> 2.2.0'
+gem 'health_check', '~> 2.6.0'
 # System information
 gem 'vmstat', '~> 2.3.0'
 gem 'sys-filesystem', '~> 1.1.6'
+
+# Gitaly GRPC client
+gem 'gitaly', '~> 0.7.0'
+
+gem 'toml-rb', '~> 0.3.15', require: false