GitLab

Prior to this commit, files downloaded in Azure Blob Storage would not
have a Content-Disposition header sent, which would cause files to be
saved with an unfriendly
filename. https://gitlab.com/gitlab-org/gitlab-fog-azure-rm/-/merge_requests/25
added support for retrieving this response header by requesting this in
the Azure shared access signature (SAS) token. We now patch CarrierWave
to send these custom options to the File object.

We drop the dynamic parameter check in the CarrierWave patch since we
have a fog-google version that supports the options. Plus, this dynamic
parameter doesn't work with mocks since the mocks don't copy the exactly
method signature.

Relates to https://gitlab.com/gitlab-org/gitlab/-/issues/341061

Changelog: fixed

Changelog: changed

which fixes several issues, including a `w` being in
a footnote, and exposing the XML interface

Changelog: fixed

This adds Rails/IncludeUrlHelper

See https://gitlab.com/gitlab-org/gitlab/-/issues/340567

Upgrading the gem from `0.9.0` to `0.10.0` which contains just one
change to address our patch.

In preparation for the Ruby 3 upgrade, we should update
json to match the minimum gem version as specified by
the default gem:

https://stdgems.org/json/#gem-version

Which for Ruby 3.0 is 2.5.1.

This will otherwise lead to errors, since rubygems
will encounter conflicting gemspecs during require.

See https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6286

This upgrade properly supports regional STS endpoints as well as the
ability to set the minimum and maximum multipart chunk size.

Diff:
https://github.com/fog/fog-aws/compare/v3.9.0..v3.12.0

Changelog: fixed

Can be used to increase max SAML message size

Changelog: added
EE: true

This prepares us for upgrading the redis-rb gem to 4.2+ which is
required for Sidekiq 6

This includes a bugfix for label ordering: if metrics were reported
with a different label ordering than they were initialized with, they
would not get stored in the file and thus not reported when scraped.

Diff in
https://my.diffend.io/gems/prometheus-client-mmap/0.14.0/0.15.0

Merge request with the changes
https://gitlab.com/gitlab-org/prometheus-client-mmap/-/merge_requests/60

Upgrade Gitaly's protobuf definitions to v14.3.0-rc1. Amongst other
changes, this also includes the new `with_paths` field in the ListBlobs
RPC call.

This enables us to make use of `strict_mode`, preventing denial of
service attacks.

Changelog: security

This will include fix for noisy warnings visible when running the app
with Ruby 3.

Changelog: other

The newer shared library contains CPU instructions
that are incompatible with some customer machines.

We need to ignore deprecation warnings from related
files as well until this is resolved.

Changelog: fixed

This includes a performance improvement when generating API routes

Changelog: performance

To fix https://github.com/thoughtbot/factory_bot/issues/1458.

Changelog: other

These are the minimum versions required to add
Ruby 3 support.

This ensures that deprecation warnings coming
from both Ruby and Rails are logged to a new
log file, deprecations_json.log.

Changelog: added

It is my understanding that this is currently
unused and just tech debt, but it is sitting
in the path for the Ruby 3 migration, and
using the latest version resolves this
problem.

When writing a repo's path (e.g. "gitlab-org/gitlab") into the
gitconfig, we currently use the `SetConfig()` RPC. This RPC has been
deprecated by Gitaly in favor of a new `SetFullPath()`, which can only
be used to explicitly write the repo's path into the gitconfig.

Convert the code to use the new RPC.

Signed-off-by: Rémy Coutable <remy@rymai.me>

This should address some remaining Ruby 3
deprecation warnings.

In https://gitlab.com/gitlab-org/gitaly/-/merge_requests/3648,
support for listing conflicts even when there's a missing side has
been added to ListConflictFiles RPC. This only happens when
`allow_tree_conflicts` is set to `true` in the RPC request.

This allows gitlab-rails to use that parameter when displaying
MR diffs with conflicts. The `allow_tree_conflicts` will be set
to `true` only when `display_merge_conflicts_in_diff` is enabled.
Otherwise, it'll be set to `false`.

This fixes issues with HS256-signed JWTs:
https://gitlab.com/gitlab-org/gitlab-omniauth-openid-connect/-/issues/1

Diff:
https://my.diffend.io/gems/gitlab-omniauth-openid-connect/0.4.0/0.8.0

Changelog: fixed

Diff: https://my.diffend.io/gems/addressable/2.7.0/2.8.0

Relates to https://gitlab.com/gitlab-org/gitlab/-/issues/336153

Changelog: security

Update gem and method reference

Signed-off-by: Rémy Coutable <remy@rymai.me>

This removes the dependency on gitlab-pg_query and adds fingerprinting
for SQL sampling.

Diff: https://my.diffend.io/gems/gitlab-labkit/0.18.0/0.20.0

Changelog: changed

Signed-off-by: Rémy Coutable <remy@rymai.me>

Implement a wrapper for the new `ListCommits()` RPC introduced in Gitaly
v14.0-rc3. This new RPC can take a set of revisions including the pseudo
revisions `--not` and `--all` and is thus slated to deprecate some of
the existing RPC calls which list commits.