This pulls in fix for CVE-2019-5477, where usage of
Nokogiri::CSS::Tokenizer#load_file leads to potential command injection.

This reduces duplication on Omnibus GitLab and saves about ~8 MB of disk
space.

Full list of changes:
https://github.com/ffi/ffi/blob/master/CHANGELOG.md

This relaxes the gRPC version so that it can be updated. Also adds
cache support for distributed tracing.

Full release notes:
https://gitlab.com/gitlab-org/labkit-ruby/-/tags

These were disabled in production mode, but that also broke the rest of
the performance bar. As they were only enabled in development mode, we
can just remove them for now.

to address CVE-2019-13574
Signed-off-by: Takuya Noguchi <takninnovationresearch@gmail.com>

We added retry_count increment when job is recovered

This is the first step in providing a fault-tolerant and distributed
Redis caching store. We disable compression to avoid introducing a
change that could have an adverse effect in production.

Note that we won't be able to take advantage of the fault-tolerance and
distributed features yet until we solve
https://gitlab.com/gitlab-org/gitlab-ce/issues/64829.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/64794

1. The output isn't great. It can be hard to find hotspots and, even
   when you do find them, to find why those are hotspots.
2. It uses some jQuery-specific frontend code which we can remove now
   that we don't have this any more.
3. It's only possible to profile the initial request, not any subsequent
   AJAX requests.

This adds support for a number of new languages (e.g. Ada)
and fixes a number of lexers:
https://github.com/rouge-ruby/rouge/compare/v3.5.1..v3.7.0

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/64625

This means we have one less Net::HTTP monkeypatch.

sham_rack cannot handle IPv6 addresses which means it breaks Net::HTTP
connections because it monkey-patches Net::HTTP

This is a bug fix release:
https://github.com/libgit2/libgit2/releases

This uses an ActiveRecord subscriber to get queries and calculate the
total query time from that. This means that the total will always be
consistent with the queries in the table. It does however mean that we
could potentially miss some queries that don't go through ActiveRecord.

Making this change also allows us to unify the response JSON a little
bit, making the frontend slightly simpler as a result.

None of this code can be reached any more, so it can all be removed

Bootsnap speeds up Rails loading and now ships by default with Rails 5.2
apps. We should promote this to a default gem and test it out in
production. This will also make it possible for the Helm Charts to take
advantage of this.

It appears that Bootsnap with Rails 5.2.3 and all the GitLab CE gems
loads fine on an ARM platform now, so it's possible that
https://gitlab.com/gitlab-org/gitlab-ce/issues/34799 has been resolved.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/45230

peek-redis resets its counters at the start of an ActionController
notification (`start_processing.action_controller`), which causes it to
miss some Redis queries that precede it, such as the database load
balancer and Rack Attack queries. This produces inconsistencies in the
performance bar between the number of calls and their durations with the
actual calls in the detailed view.

We fix this by getting rid of peek-redis in favor of consolidating all
logic into the `RedisDetailed` view, which tracks Redis queries using
`RequestStore`. This has the nice property of removing thread-specific
counters as well.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/64707

This will make it possible for Oracle Cloud to work with S3 by disabling
Signature V4 streaming (https://github.com/fog/fog-aws/issues/523).

Full CHANGELOG:
https://github.com/fog/fog-aws/blob/master/CHANGELOG.md

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/63041

This was done to perform some local testing, but while the change was
already made it made sense to commit the change.

Updates changed method names and fixes spec failures

Adds more friendly docs for GraphQl implementation

This brings the rspec-core version in line with the Gitaly changes
and introduces Rails 5.1/5.2 improvements.

Full CHANGELOG:
https://github.com/rspec/rspec-rails/blob/master/Changelog.md

The configuration is currently only specified in CI, by moving it into
`.mdlrc` we get immediate feedback locally in supported editors.

To ensure `mdl` is available it's also added to the `Gemfile`, though
CI will still use the version installed in the `gitlab-docs-lint` image.

This fixes a critical error where a nil exception would be hit
if an error occurred while logging a Prometheus metric:

https://gitlab.com/gitlab-org/prometheus-client-mmap/merge_requests/36

This release includes continued improvements to the library, fixes for a
number of lexers and support for three new languages:
https://github.com/rouge-ruby/rouge/releases

This removes a warning message when prometheus_multiproc_dir is not set.

Currently, MergeToRefService is specifically designed for
createing merge commits from source branch and target branch of
merge reqeusts. We extend this behavior to source branch and any
target ref paths.

Signed-off-by: Rémy Coutable <remy@rymai.me>

https://github.com/rouge-ruby/rouge/blob/master/CHANGELOG.md#version-341-2019-06-13

This matches the version used in Gitaly, bumps the gRPC version to be
aligned with GitLab CE/EE, and adds gRPC interceptor support:
https://gitlab.com/gitlab-org/labkit-ruby/compare/v0.2.0...v0.3.0

This saves some space by matching the version used by Gitaly. List of
changes:

* https://github.com/msgpack/msgpack-ruby/blob/master/ChangeLog
* https://github.com/msgpack/msgpack-ruby/compare/v1.2.6..v1.2.10

This saves some disk space by matching the version used in Gitaly.

Only minor changes:
https://github.com/mime-types/mime-types-data/blob/master/History.md

See http://asciidoctor.org/docs/user-manual/#include-directive

Fix whitespace in specs because normalize_ws is slightly
different from Capybara 2 behavior

In https://gitlab.com/gitlab-org/gitlab-ce/issues/62208, users were
seeing 404 errors when they configured their OpenID provider without a
name parameter since OmniAuth would use the name `openidconnect` instead
`openid_connect`.

https://github.com/m0n9oose/omniauth_openid_connect/pull/23 makes the
default parameter `openid_connect` so this additional initializer in
GitLab is not necessary. Plus, this change enables users to use multiple
OpenID Connect providers if they desire.

Signed-off-by: Rémy Coutable <remy@rymai.me>