.eslintrc.yml

 extends:
   - '@gitlab'
   - plugin:promise/recommended
+  - plugin:no-jquery/slim
 globals:
   __webpack_public_path__: true
   gl: false
@@ -44,10 +45,10 @@ rules:
   vue/no-use-v-if-with-v-for: off
   vue/no-v-html: off
   vue/use-v-on-exact: off
-  no-jquery/no-ajax: error
-  no-jquery/no-ajax-events: error
-  no-jquery/no-load: error
-  no-jquery/no-load-shorthand: error
+  no-jquery/no-animate: off
+  # all offenses of no-jquery/no-animate-toggle are false positives ( $toast.show() )
+  no-jquery/no-animate-toggle: off
+  no-jquery/no-fade: off
   no-jquery/no-serialize: error
   promise/always-return: off
   promise/no-callback-in-promise: off

.gitlab-ci.yml

-image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.6.3-golang-1.12-git-2.22-lfs-2.9-chrome-73.0-node-12.x-yarn-1.16-postgresql-9.6-graphicsmagick-1.3.33"
+image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.6.3-golang-1.12-git-2.24-lfs-2.9-chrome-73.0-node-12.x-yarn-1.16-postgresql-9.6-graphicsmagick-1.3.33"
 
 stages:
   - sync
@@ -17,19 +17,20 @@ variables:
   RAILS_ENV: "test"
   NODE_ENV: "test"
   SIMPLECOV: "true"
-  GIT_DEPTH: "50"
+  GIT_DEPTH: "20"
   GIT_SUBMODULE_STRATEGY: "none"
   GET_SOURCES_ATTEMPTS: "3"
   KNAPSACK_RSPEC_SUITE_REPORT_PATH: knapsack/report-master.json
   FLAKY_RSPEC_SUITE_REPORT_PATH: rspec_flaky/report-suite.json
   BUILD_ASSETS_IMAGE: "false"
   ES_JAVA_OPTS: "-Xms256m -Xmx256m"
-  ELASTIC_URL: "http://elastic:changeme@docker.elastic.co-elasticsearch-elasticsearch:9200"
+  ELASTIC_URL: "http://elastic:changeme@elasticsearch:9200"
 
 after_script:
   - date
 
 include:
+  - local: .gitlab/ci/cache-repo.gitlab-ci.yml
   - local: .gitlab/ci/cng.gitlab-ci.yml
   - local: .gitlab/ci/docs.gitlab-ci.yml
   - local: .gitlab/ci/frontend.gitlab-ci.yml

.gitlab/ci/cache-repo.gitlab-ci.yml

+# Builds a cached .tar.gz of the master branch with full history and
+# uploads it to Google Cloud Storage. This archive is downloaded by a
+# script defined by a CI/CD variable named CI_PRE_CLONE_SCRIPT. This has
+# two benefits:
+#
+# 1. It speeds up builds. A 800 MB download only takes seconds.
+# 2. It significantly reduces load on the file server. Smaller deltas
+#    means less time spent in git pack-objects.
+#
+# Since the destination directory of the archive depends on the project
+# ID, this is only run on GitLab.com.
+#
+# CI_REPO_CACHE_CREDENTIALS contains the Google Cloud service account
+# JSON for uploading to the gitlab-ci-git-repo-cache bucket. These
+# credentials are stored in the Production vault.
+#
+# Note that this bucket should be located in the same continent as the
+# runner, or network egress charges will apply:
+# https://cloud.google.com/storage/pricing
+cache-repo:
+  extends:
+    - .only:variables_refs-canonical-dot-com-schedules
+  image: gcr.io/google.com/cloudsdktool/cloud-sdk:alpine
+  stage: sync
+  allow_failure: true
+  variables:
+    GIT_DEPTH: 0
+    TAR_FILENAME: /tmp/gitlab-master.tar
+  script:
+    - gcloud auth activate-service-account --key-file=$CI_REPO_CACHE_CREDENTIALS
+    - tar cf $TAR_FILENAME .
+    - gzip $TAR_FILENAME
+    - gsutil cp $TAR_FILENAME.gz gs://gitlab-ci-git-repo-cache/project-$CI_PROJECT_ID/gitlab-master.tar.gz

.gitlab/ci/docs.gitlab-ci.yml

@@ -24,7 +24,8 @@
     - apk add --update openssl
     - wget $CI_PROJECT_URL/raw/$CI_COMMIT_SHA/scripts/trigger-build-docs
     - chmod 755 trigger-build-docs
-    - gem install gitlab --no-document
+    - gem install httparty --no-document --version 0.17.3
+    - gem install gitlab --no-document --version 4.13.0
 
 # Always trigger a docs build in gitlab-docs only on docs-only branches.
 # Useful to preview the docs changes live.

.gitlab/ci/frontend.gitlab-ci.yml

@@ -13,7 +13,7 @@
     - .default-before_script
     - .assets-compile-cache
     - .only:changes-code-backstage-qa
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.6.3-git-2.22-lfs-2.9-chrome-73.0-node-12.x-yarn-1.16-graphicsmagick-1.3.33-docker-19.03.1
+  image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.6.3-git-2.24-lfs-2.9-chrome-73.0-node-12.x-yarn-1.16-graphicsmagick-1.3.33-docker-19.03.1
   stage: test
   dependencies: ["setup-test-env"]
   needs: ["setup-test-env"]
@@ -74,7 +74,6 @@ gitlab:assets:compile pull-cache:
     - .default-before_script
     - .assets-compile-cache
     - .only:changes-code-backstage-qa
-    - .use-pg9
   stage: prepare
   script:
     - node --version
@@ -83,6 +82,7 @@ gitlab:assets:compile pull-cache:
     - retry bundle exec rake gitlab:assets:compile
     - scripts/clean-old-cached-assets
   variables:
+    SETUP_DB: "false"
     # we override the max_old_space_size to prevent OOM errors
     NODE_OPTIONS: --max_old_space_size=3584
   cache:
@@ -244,7 +244,9 @@ webpack-dev-server:
   dependencies: ["setup-test-env", "compile-assets pull-cache"]
   variables:
     WEBPACK_MEMORY_TEST: "true"
+    WEBPACK_VENDOR_DLL: "true"
   script:
+    - yarn webpack-vendor
     - node --expose-gc node_modules/.bin/webpack-dev-server --config config/webpack.config.js
   artifacts:
     name: webpack-dev-server

.gitlab/ci/global.gitlab-ci.yml

@@ -202,7 +202,7 @@
     - name: redis:alpine
 
 .use-pg10:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.6.3-golang-1.12-git-2.22-lfs-2.9-chrome-73.0-node-12.x-yarn-1.16-postgresql-10-graphicsmagick-1.3.33"
+  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.6.3-golang-1.12-git-2.24-lfs-2.9-chrome-73.0-node-12.x-yarn-1.16-postgresql-10-graphicsmagick-1.3.33"
   services:
     - name: postgres:10.9
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
@@ -213,15 +213,15 @@
     - name: postgres:9.6
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
     - name: redis:alpine
-    - name: docker.elastic.co/elasticsearch/elasticsearch:5.6.12
+    - name: elasticsearch:5.6.12
 
 .use-pg10-ee:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.6.3-golang-1.12-git-2.22-lfs-2.9-chrome-73.0-node-12.x-yarn-1.16-postgresql-10-graphicsmagick-1.3.33"
+  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.6.3-golang-1.12-git-2.24-lfs-2.9-chrome-73.0-node-12.x-yarn-1.16-postgresql-10-graphicsmagick-1.3.33"
   services:
     - name: postgres:10.9
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
     - name: redis:alpine
-    - name: docker.elastic.co/elasticsearch/elasticsearch:5.6.12
+    - name: elasticsearch:5.6.12
 
 .only-ee:
   only:

.gitlab/ci/notifications.gitlab-ci.yml

 .notify:
-  image: alpine
+  image: ruby:2.6-alpine
   stage: notification
   dependencies: []
   cache: {}
   before_script:
     - apk update && apk add git curl bash
+    - source scripts/utils.sh
+    - source scripts/notifications.sh
+    - install_gitlab_gem
   variables:
-    COMMIT_NOTES_URL: "https://$CI_SERVER_HOST/$CI_PROJECT_PATH/commit/$CI_COMMIT_SHA#notes-list"
+    COMMIT_NOTES_URL: "https://${CI_SERVER_HOST}/${CI_PROJECT_PATH}/commit/${CI_COMMIT_SHA}#notes-list"
 
 schedule:package-and-qa:notify-failure:
   extends:
     - .only:variables_refs-canonical-dot-com-schedules
     - .notify
   script:
-    - 'scripts/notify-slack qa-master ":skull_and_crossbones: Scheduled QA against master failed! :skull_and_crossbones: See $CI_PIPELINE_URL. For downstream pipelines, see $COMMIT_NOTES_URL" ci_failing'
+    - 'export NOTIFICATION_MESSAGE=":skull_and_crossbones: Scheduled QA against master failed! :skull_and_crossbones: See ${CI_PIPELINE_URL}. For downstream pipelines, see ${COMMIT_NOTES_URL}"'
+    - 'notify_on_job_failure schedule:package-and-qa qa-master "${NOTIFICATION_MESSAGE}" ci_failing'
   needs: ["schedule:package-and-qa"]
-  when: on_failure
+  allow_failure: true
+  when: always

.gitlab/ci/releases.gitlab-ci.yml

 ---
 
-# Syncs any changes pushed to a stable branch to the corresponding CE stable
-# branch. We run this prior to any tests so that random failures don't prevent a
-# sync.
-sync-stable-branch:
+# Syncs any changes pushed to a stable branch to the corresponding
+# gitlab-foss/CE stable branch. We run this prior to any tests so that random
+# failures don't prevent a sync.
+.merge-train-sync:
   # We don't need/want any global before/after commands, so we overwrite these
   # settings.
   image: alpine:edge
   stage: sync
-  # This job should only run on EE stable branches on the canonical GitLab.com
-  # repository.
-  only:
-    variables:
-      - $CI_SERVER_HOST == "gitlab.com"
-    refs:
-      - /^[\d-]+-stable-ee$/@gitlab-org/gitlab
   before_script:
     - apk add --no-cache --update curl bash
   after_script: []
   script:
     - bash scripts/sync-stable-branch.sh
+  only:
+    variables:
+      - $CI_SERVER_HOST == "gitlab.com"
+
+sync-stable-branch:
+  extends: .merge-train-sync
+  variables:
+    SOURCE_PROJECT: gitlab-org/gitlab
+    TARGET_PROJECT: gitlab-org/gitlab-foss
+  only:
+    refs:
+      - /^[\d-]+-stable-ee$/@gitlab-org/gitlab
+
+sync-security-branch:
+  extends: .merge-train-sync
+  variables:
+    SOURCE_PROJECT: gitlab-org/security/gitlab
+    TARGET_PROJECT: gitlab-org/security/gitlab-foss
+  only:
+    refs:
+      - /^[\d-]+-stable-ee$/@gitlab-org/security/gitlab

.gitlab/ci/reports.gitlab-ci.yml

@@ -37,6 +37,8 @@ code_quality:
   artifacts:
     reports:
       codequality: gl-code-quality-report.json
+    paths:
+      - gl-code-quality-report.json
     expire_in: 1 week
   dependencies: []
   except:
@@ -232,9 +234,3 @@ dast:
       - gl-dast-report.json
     reports:
       dast: gl-dast-report.json
-  only:
-    variables:
-      - $GITLAB_FEATURES =~ /\bdast\b/
-  except:
-    variables:
-      - $DAST_DISABLED

.gitlab/ci/review.gitlab-ci.yml

@@ -23,8 +23,10 @@ build-qa-image:
   stage: prepare
   script:
     - '[[ ! -d "ee/" ]] || export GITLAB_EDITION="ee"'
+    - export QA_MASTER_IMAGE="${CI_REGISTRY}/${CI_PROJECT_PATH}/gitlab/gitlab-${GITLAB_EDITION}-qa:master"
     - export QA_IMAGE="${CI_REGISTRY}/${CI_PROJECT_PATH}/gitlab/gitlab-${GITLAB_EDITION}-qa:${CI_COMMIT_REF_SLUG}"
-    - time docker build --cache-from gitlab/gitlab-${GITLAB_EDITION}-qa:nightly --tag ${QA_IMAGE} --file ./qa/Dockerfile ./
+    - time docker pull "${QA_MASTER_IMAGE}"
+    - time docker build --cache-from "${QA_MASTER_IMAGE}" --tag ${QA_IMAGE} --file ./qa/Dockerfile ./
     - echo "${CI_JOB_TOKEN}" | docker login --username gitlab-ci-token --password-stdin ${CI_REGISTRY}
     - time docker push ${QA_IMAGE}
 

.gitlab/issue_templates/Productivity Improvement.md

+## What is the productivity problem to solve?
+
+<!--
+Please describe the productivity problem that needs to be solved backed by charts from
+https://about.gitlab.com/handbook/engineering/quality/engineering-productivity-team/#engineering-productivity-team-metrics.
+-->
+
+### Problem identification checklist
+
+- [ ] The root cause of the problem is identified.
+- [ ] The surface of the problem is as small as possible.
+
+## What are the potential solutions?
+
+<!--
+Please provide potential solutions here. Example solutions could be:
+
+- Dogfood a feature.
+- Refactor/improve some workflow code.
+- Throw more money at the problem.
+
+Please provide pros/cons and a weight estimate for each solution.
+-->
+
+- [ ] All potential solutions are listed.
+- [ ] A solution has been chosen for the first iteration: `PUT THE CHOSEN SOLUTION HERE`
+
+## Who and when will the solution be implemented?
+
+<!--
+For history reason, please list the person that will implement the solution and
+the planned milestone/date.
+-->
+
+## Verify that the solution has improved the situation
+
+<!--
+Ideally, looking at the charts from the first part, we should see an improvement
+after the implementation is merged/deployed/released.
+-->
+
+- [ ] The solution improved the situation.
+  - If yes, check this box and close the issue. Well done! :tada:
+  - Otherwise, create a new "Productivity Improvement" issue. You can re-use the description from this issue, but obviously another solution should be chosen this time.
+
+/label ~"Engineering Productivity" ~meta
+/cc @gl-quality/eng-prod

.haml-lint_todo.yml

@@ -411,6 +411,7 @@ linters:
       - 'app/views/shared/snippets/_snippet.html.haml'
       - 'app/views/shared/tokens/_scopes_list.html.haml'
       - 'app/views/shared/web_hooks/_form.html.haml'
+      - 'app/views/shared/web_hooks/_hook.html.haml'
       - 'app/views/shared/web_hooks/_test_button.html.haml'
       - 'app/views/u2f/_authenticate.html.haml'
       - 'app/views/u2f/_register.html.haml'
@@ -442,7 +443,7 @@ linters:
       - 'ee/app/views/groups/epics/_epic.html.haml'
       - 'ee/app/views/groups/group_members/_ldap_sync.html.haml'
       - 'ee/app/views/groups/group_members/_sync_button.html.haml'
-      - 'ee/app/views/groups/hooks/_project_hook.html.haml'
+      - 'ee/app/views/groups/hooks/edit.html.haml'
       - 'ee/app/views/groups/hooks/index.html.haml'
       - 'ee/app/views/groups/ldap_group_links/index.html.haml'
       - 'ee/app/views/groups/pipeline_quota/index.html.haml'

.markdownlint.json

@@ -26,5 +26,102 @@
   "first-line-h1": false,
   "code-block-style": {
     "style": "fenced"
+  },
+  "proper-names": {
+    "names": [
+      "Akismet",
+      "Alertmanager",
+      "API",
+      "Asana",
+      "Auth0",
+      "Authentiq",
+      "Azure",
+      "Bamboo",
+      "Bitbucket",
+      "Bugzilla",
+      "CAS",
+      "CentOS",
+      "Consul",
+      "Debian",
+      "Elasticsearch",
+      "Facebook",
+      "Git LFS",
+      "git-annex",
+      "Git",
+      "Gitaly",
+      "GitHub",
+      "GitLab Geo",
+      "GitLab Monitor",
+      "GitLab Operator",
+      "GitLab Pages",
+      "GitLab Rails",
+      "GitLab Runner",
+      "GitLab Shell",
+      "GitLab Workhorse",
+      "GitLab",
+      "Gmail",
+      "Google",
+      "Grafana",
+      "Helm",
+      "HipChat",
+      "Ingress",
+      "jasmine-jquery",
+      "JavaScript",
+      "Jaeger",
+      "Jenkins",
+      "Jira",
+      "Jira Cloud",
+      "Jira Server",
+      "jQuery",
+      "JupyterHub",
+      "Karma",
+      "Kerberos",
+      "Knative",
+      "Kubernetes",
+      "LDAP",
+      "Let's Encrypt",
+      "Markdown",
+      "markdownlint",
+      "Mattermost",
+      "Microsoft",
+      "MinIO",
+      "NGINX Ingress",
+      "NGINX",
+      "OAuth",
+      "OAuth 2",
+      "OmniAuth",
+      "Omnibus GitLab",
+      "OpenID",
+      "OpenShift",
+      "PgBouncer",
+      "PostgreSQL",
+      "Prometheus",
+      "Puma",
+      "Python",
+      "Redis",
+      "Redmine",
+      "reCAPTCHA",
+      "runit",
+      "Salesforce",
+      "SAML",
+      "Sentry",
+      "Sidekiq",
+      "Shibboleth",
+      "Slack",
+      "SMTP",
+      "SSH",
+      "Tiller",
+      "Trello",
+      "Trello Power-Ups",
+      "TypeScript",
+      "Twitter",
+      "Ubuntu",
+      "Ultra Auth",
+      "Unicorn",
+      "unicorn-worker-killer",
+      "WebdriverIO",
+      "YouTrack"
+    ],
+    "code_blocks": false
   }
 }

.nvmrc

-12.4.0
+12.10.0

CHANGELOG-EE.md

 Please view this file on the master branch, on stable branches it's out of date.
 
+## 12.5.5
+
+- No changes.
+
+## 12.5.4
+
+### Security (1 change)
+
+- Fix stale Elasticsearch permissions when moving group from public group to private parent group.
+
+
 ## 12.5.3
 
 ### Performance (1 change)
@@ -251,6 +262,13 @@ Please view this file on the master branch, on stable branches it's out of date.
 - Docs for protected branch code owner approval API. !17132
 
 
+## 12.3.9
+
+### Security (1 change)
+
+- Fix stale Elasticsearch permissions when moving group from public group to private parent group.
+
+
 ## 12.3.7
 
 ### Security (6 changes)
@@ -466,6 +484,13 @@ Please view this file on the master branch, on stable branches it's out of date.
 - Fixes style-lint errors and warnings for EE builds.scss file.
 
 
+## 12.2.11
+
+### Fixed (1 change)
+
+- Backport the new reliable fetcher. !21198
+
+
 ## 12.2.8
 
 ### Fixed (1 change)
@@ -814,6 +839,21 @@ Please view this file on the master branch, on stable branches it's out of date.
 - Don't send CI usage email notifications for self-hosted instances. !14809
 
 
+## 12.0.12
+
+### Fixed (1 change)
+
+- Backport the new reliable fetcher to 12.0.9. !20532
+
+
+## 12.0.10
+
+- No changes.
+### Fixed (1 change)
+
+- Backport the new reliable fetcher to 12.0.9. !20532
+
+
 ## 12.0.7
 
 ### Security (3 changes)

CHANGELOG.md

@@ -2,6 +2,25 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
+## 12.5.5
+
+### Security (1 change)
+
+- Upgrade Akismet gem to v3.0.0. !21786
+
+### Fixed (2 changes)
+
+- Fix error in updating runner session. !20902
+- Fix Asana integration. !21501
+
+
+## 12.5.4
+
+### Security (1 change)
+
+- Update maven_file_name_regex for full string match.
+
+
 ## 12.5.3
 ### Fixed (4 changes)
@@ -756,6 +775,13 @@ entry.
 - Remove Postgresql specific setup tasks and move to schema.rb.
+## 12.3.9
+
+### Security (1 change)
+
+- Update maven_file_name_regex for full string match.
+
+
 ## 12.3.7
 ### Security (12 changes)
@@ -1079,6 +1105,10 @@ entry.
 - Updates tooltip of 'detached' label/state.
+## 12.2.11
+
+- No changes.
+
 ## 12.2.8
 ### Security (1 change)
@@ -1793,6 +1823,15 @@ entry.
 - Removes EE differences for app/views/admin/users/show.html.haml.
+## 12.0.12
+
+- No changes.
+
+## 12.0.10
+
+- No changes.
+- No changes.
+
 ## 12.0.7
 ### Security (22 changes)

Dangerfile

@@ -5,6 +5,7 @@ require_relative 'lib/gitlab/danger/request_helper'
 
 danger.import_plugin('danger/plugins/helper.rb')
 danger.import_plugin('danger/plugins/roulette.rb')
+danger.import_plugin('danger/plugins/changelog.rb')
 
 unless helper.release_automation?
   GitlabDanger.new(helper.gitlab_helper).rule_names.each do |file|

GITALY_SERVER_VERSION

-1.75.0
+1.76.0

Gemfile

@@ -22,6 +22,7 @@ gem 'rugged', '~> 0.28'
 gem 'grape-path-helpers', '~> 1.1'
 
 gem 'faraday', '~> 0.12'
+gem 'marginalia', '~> 1.8.0'
 
 # Authentication libraries
 gem 'devise', '~> 4.6'
@@ -53,7 +54,7 @@ gem 'gssapi', group: :kerberos
 
 # Spam and anti-bot protection
 gem 'recaptcha', '~> 4.11', require: 'recaptcha/rails'
-gem 'akismet', '~> 2.0'
+gem 'akismet', '~> 3.0'
 gem 'invisible_captcha', '~> 0.12.1'
 
 # Two-factor authentication
@@ -101,7 +102,7 @@ gem 'hashie-forbidden_attributes'
 gem 'kaminari', '~> 1.0'
 
 # HAML
-gem 'hamlit', '~> 2.10.0'
+gem 'hamlit', '~> 2.11.0'
 
 # Files attachments
 gem 'carrierwave', '~> 1.3'
@@ -170,8 +171,8 @@ group :unicorn do
 end
 
 group :puma do
-  gem 'puma', '~> 4.3.0', require: false
-  gem 'puma_worker_killer', '~> 0.1.1', require: false
+  gem 'gitlab-puma', '~> 4.3.1.gitlab.2', require: false
+  gem 'gitlab-puma_worker_killer', '~> 0.1.1.gitlab.1', require: false
   gem 'rack-timeout', require: false
 end
 
@@ -242,7 +243,7 @@ gem 'slack-notifier', '~> 1.5.1'
 gem 'hangouts-chat', '~> 0.0.5'
 
 # Asana integration
-gem 'asana', '~> 0.8.1'
+gem 'asana', '~> 0.9'
 
 # FogBugz integration
 gem 'ruby-fogbugz', '~> 0.2.1'
@@ -346,7 +347,7 @@ group :development do
 end
 
 group :development, :test do
-  gem 'bullet', '~> 5.5.0', require: !!ENV['ENABLE_BULLET']
+  gem 'bullet', '~> 6.0.2', require: !!ENV['ENABLE_BULLET']
   gem 'pry-byebug', '~> 3.5.1', platform: :mri
   gem 'pry-rails', '~> 0.3.4'
 
@@ -416,7 +417,7 @@ end
 
 gem 'octokit', '~> 4.9'
 
-gem 'mail_room', '~> 0.9.1'
+gem 'mail_room', '~> 0.10.0'
 
 gem 'email_reply_trimmer', '~> 0.1'
 gem 'html2text'

Gemfile.lock

@@ -58,16 +58,16 @@ GEM
     addressable (2.5.2)
       public_suffix (>= 2.0.2, < 4.0)
     aes_key_wrap (1.0.1)
-    akismet (2.0.0)
+    akismet (3.0.0)
     apollo_upload_server (2.0.0.beta.3)
       graphql (>= 1.8)
       rails (>= 4.2)
     arel (9.0.0)
-    asana (0.8.1)
+    asana (0.9.3)
       faraday (~> 0.9)
       faraday_middleware (~> 0.9)
       faraday_middleware-multi_json (~> 0.0)
-      oauth2 (~> 1.0)
+      oauth2 (~> 1.4)
     asciidoctor (2.0.10)
     asciidoctor-include-ext (0.3.1)
       asciidoctor (>= 1.5.6, < 3.0.0)
@@ -118,9 +118,9 @@ GEM
     brakeman (4.2.1)
     browser (2.5.3)
     builder (3.2.3)
-    bullet (5.5.1)
+    bullet (6.0.2)
       activesupport (>= 3.0.0)
-      uniform_notifier (~> 1.10.0)
+      uniform_notifier (~> 1.11)
     bundler-audit (0.5.0)
       bundler (~> 1.2)
       thor (~> 0.18)
@@ -372,6 +372,11 @@ GEM
     gitlab-license (1.0.0)
     gitlab-markup (1.7.0)
     gitlab-net-dns (0.9.1)
+    gitlab-puma (4.3.1.gitlab.2)
+      nio4r (~> 2.0)
+    gitlab-puma_worker_killer (0.1.1.gitlab.1)
+      get_process_mem (~> 0.2)
+      gitlab-puma (>= 2.7, < 5)
     gitlab-sidekiq-fetcher (0.5.2)
       sidekiq (~> 5)
     gitlab-styles (2.8.0)
@@ -466,7 +471,7 @@ GEM
       rainbow
       rubocop (>= 0.50.0)
       sysexits (~> 1.1)
-    hamlit (2.10.0)
+    hamlit (2.11.0)
       temple (>= 0.8.2)
       thor
       tilt
@@ -588,9 +593,12 @@ GEM
     lumberjack (1.0.13)
     mail (2.7.1)
       mini_mime (>= 0.1.1)
-    mail_room (0.9.1)
+    mail_room (0.10.0)
     marcel (0.3.3)
       mimemagic (~> 0.3.2)
+    marginalia (1.8.0)
+      actionpack (>= 2.3)
+      activerecord (>= 2.3)
     memoist (0.16.0)
     memoizable (0.4.2)
       thread_safe (~> 0.3, >= 0.3.1)
@@ -619,7 +627,7 @@ GEM
     net-ntp (2.1.3)
     net-ssh (5.2.0)
     netrc (0.11.0)
-    nio4r (2.3.1)
+    nio4r (2.5.2)
     no_proxy_fix (0.1.2)
     nokogiri (1.10.5)
       mini_portile2 (~> 2.4.0)
@@ -748,11 +756,6 @@ GEM
     pry-rails (0.3.6)
       pry (>= 0.10.4)
     public_suffix (3.1.1)
-    puma (4.3.1)
-      nio4r (~> 2.0)
-    puma_worker_killer (0.1.1)
-      get_process_mem (~> 0.2)
-      puma (>= 2.7, < 5)
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.1.6)
     rack (2.0.7)
@@ -927,7 +930,7 @@ GEM
     rubyntlm (0.6.2)
     rubypants (0.2.0)
     rubyzip (1.3.0)
-    rugged (0.28.3.1)
+    rugged (0.28.4.1)
     safe_yaml (1.0.4)
     sanitize (4.6.6)
       crass (~> 1.0.2)
@@ -1026,10 +1029,10 @@ GEM
       daemons (~> 1.0, >= 1.0.9)
       eventmachine (~> 1.0, >= 1.0.4)
       rack (>= 1, < 3)
-    thor (0.19.4)
+    thor (0.20.3)
     thread_safe (0.3.6)
     thrift (0.11.0.0)
-    tilt (2.0.9)
+    tilt (2.0.10)
     timecop (0.8.1)
     timfel-krb5-auth (0.8.3)
     toml (0.2.0)
@@ -1057,7 +1060,7 @@ GEM
     unicorn-worker-killer (0.4.4)
       get_process_mem (~> 0)
       unicorn (>= 4, < 6)
-    uniform_notifier (1.10.0)
+    uniform_notifier (1.13.0)
     unleash (0.1.5)
       murmurhash3 (~> 0.1.6)
     unparser (0.4.5)
@@ -1117,9 +1120,9 @@ DEPENDENCIES
   activerecord-explain-analyze (~> 0.1)
   acts-as-taggable-on (~> 6.0)
   addressable (~> 2.5.2)
-  akismet (~> 2.0)
+  akismet (~> 3.0)
   apollo_upload_server (~> 2.0.0.beta3)
-  asana (~> 0.8.1)
+  asana (~> 0.9)
   asciidoctor (~> 2.0.10)
   asciidoctor-include-ext (~> 0.3.1)
   asciidoctor-plantuml (= 0.0.9)
@@ -1139,7 +1142,7 @@ DEPENDENCIES
   bootstrap_form (~> 4.2.0)
   brakeman (~> 4.2)
   browser (~> 2.5)
-  bullet (~> 5.5.0)
+  bullet (~> 6.0.2)
   bundler-audit (~> 0.5.0)
   capybara (~> 3.22.0)
   capybara-screenshot (~> 1.0.22)
@@ -1200,6 +1203,8 @@ DEPENDENCIES
   gitlab-license (~> 1.0)
   gitlab-markup (~> 1.7.0)
   gitlab-net-dns (~> 0.9.1)
+  gitlab-puma (~> 4.3.1.gitlab.2)
+  gitlab-puma_worker_killer (~> 0.1.1.gitlab.1)
   gitlab-sidekiq-fetcher (= 0.5.2)
   gitlab-styles (~> 2.7)
   gitlab_chronic_duration (~> 0.10.6.2)
@@ -1219,7 +1224,7 @@ DEPENDENCIES
   gssapi
   guard-rspec
   haml_lint (~> 0.34.0)
-  hamlit (~> 2.10.0)
+  hamlit (~> 2.11.0)
   hangouts-chat (~> 0.0.5)
   hashie-forbidden_attributes
   health_check (~> 2.6.0)
@@ -1242,7 +1247,8 @@ DEPENDENCIES
   licensee (~> 8.9)
   lograge (~> 0.5)
   loofah (~> 2.2)
-  mail_room (~> 0.9.1)
+  mail_room (~> 0.10.0)
+  marginalia (~> 1.8.0)
   memory_profiler (~> 0.9)
   method_source (~> 0.8)
   mimemagic (~> 0.3.2)
@@ -1280,8 +1286,6 @@ DEPENDENCIES
   prometheus-client-mmap (~> 0.9.10)
   pry-byebug (~> 3.5.1)
   pry-rails (~> 0.3.4)
-  puma (~> 4.3.0)
-  puma_worker_killer (~> 0.1.1)
   rack (~> 2.0.7)
   rack-attack (~> 6.2.0)
   rack-cors (~> 1.0.0)