See:

* https://github.com/rails/rails-html-sanitizer/releases
* https://github.com/flavorjones/loofah/releases

James Lopez authored 6 years ago and Mark Fletcher committed 6 years ago

[10.6] Fix GitLab Auth0 integration signs in the wrong user

See merge request gitlab/gitlabhq!2354

But first, rewrite the performance bar in Vue:

1. Remove the peek-host gem and replace it with existing code. This also allows
   us to include the host in the JSON response, rather than in the page HTML.
2. Leave the line profiler parts as here-be-dragons: nicer would be a separate
   endpoint for these, so we could use them on Ajax requests too.
3. The performance bar is too fiddly to rewrite right now, so apply the same
   logic to that.

Then, add features! All requests made through Axios are able to be tracked. To
keep a lid on memory usage, only the first two requests for a given URL are
tracked, though. Each request that's tracked has the same data as the initial
page load, with the exception of the performance bar and the line profiler, as
explained above.

This reverts merge request !17737

- only older ruby and activerecord support dropped

These warnings would show when running rspec:

```
warning: parser/current is loading parser/ruby23, which recognizes
warning: 2.3.5-compliant syntax, but you are running 2.3.6.
warning: please see https://github.com/whitequark/parser#compatibility-with-ruby-mri.
```

Related PRs:

* https://github.com/whitequark/parser/pull/422
* https://github.com/mbj/unparser/pull/79

Related to gitaly#1060

Given 1.9 has issues we're aware of, for now we're locking to 1.8.
Closes gitlab-org/gitaly#1059 and will probably be removed if 1.10 is
tested an deemed ok.

Closes gitaly#1046

36847 - add changelog

26039 - add merge request id


26039 change due to lingust source file updates