Merge branch 'master' of gitlab.com:gitlab-org/gitlab-ce into acet-mr-diffs-autosave

.gitignore

@@ -29,7 +29,7 @@ eslint-report.html
 /app/assets/javascripts/locale/**/app.js
 /backups/*
 /config/aws.yml
-/config/database.yml
+/config/database*.yml
 /config/gitlab.yml
 /config/gitlab_ci.yml
 /config/initializers/rack_attack.rb

.gitlab-ci.yml

@@ -220,18 +220,6 @@ stages:
     paths:
       - log/development.log
 
-# Review docs base
-.review-docs: &review-docs
-  <<: *dedicated-runner
-  <<: *except-qa
-  <<: *single-script-job
-  variables:
-    <<: *single-script-job-variables
-    SCRIPT_NAME: trigger-build-docs
-  when: manual
-  only:
-    - branches
-
 # DB migration, rollback, and seed jobs
 .db-migrate-reset: &db-migrate-reset
   <<: *dedicated-no-docs-and-no-qa-pull-cache-job
@@ -273,20 +261,44 @@ package-and-qa:
     - //@gitlab-org/gitlab-ce
     - //@gitlab-org/gitlab-ee
 
-# Trigger a docs build in gitlab-docs
-# Useful to preview the docs changes live
-review-docs-deploy:
-  <<: *review-docs
-  stage: build
+# Review docs base
+.review-docs: &review-docs
+  <<: *dedicated-runner
+  <<: *single-script-job
+  variables:
+    <<: *single-script-job-variables
+    SCRIPT_NAME: trigger-build-docs
   environment:
     name: review-docs/$CI_COMMIT_REF_NAME
     # DOCS_REVIEW_APPS_DOMAIN and DOCS_GITLAB_REPO_SUFFIX are secret variables
     # Discussion: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/14236/diffs#note_40140693
-    url: http://$DOCS_GITLAB_REPO_SUFFIX-$CI_COMMIT_REF_SLUG.$DOCS_REVIEW_APPS_DOMAIN/$DOCS_GITLAB_REPO_SUFFIX
+    url: http://$DOCS_GITLAB_REPO_SUFFIX-$CI_ENVIRONMENT_SLUG.$DOCS_REVIEW_APPS_DOMAIN/$DOCS_GITLAB_REPO_SUFFIX
     on_stop: review-docs-cleanup
+
+# Trigger a manual docs build in gitlab-docs only on non docs-only branches.
+# Useful to preview the docs changes live.
+review-docs-deploy-manual:
+  <<: *review-docs
+  stage: build
+  script:
+    - gem install gitlab --no-ri --no-rdoc
+    - ./$SCRIPT_NAME deploy
+  when: manual
+  only:
+    - branches
+  <<: *except-docs-and-qa
+
+# Always trigger a docs build in gitlab-docs only on docs-only branches.
+# Useful to preview the docs changes live.
+review-docs-deploy:
+  <<: *review-docs
+  stage: post-test
   script:
     - gem install gitlab --no-ri --no-rdoc
     - ./$SCRIPT_NAME deploy
+  only:
+    - /(^docs[\/-].*|.*-docs$)/
+  <<: *except-qa
 
 # Cleanup remote environment of gitlab-docs
 review-docs-cleanup:
@@ -295,9 +307,10 @@ review-docs-cleanup:
   environment:
     name: review-docs/$CI_COMMIT_REF_NAME
     action: stop
+  when: manual
   script:
     - gem install gitlab --no-ri --no-rdoc
-    - ./SCRIPT_NAME cleanup
+    - ./$SCRIPT_NAME cleanup
 
 ##
 # Trigger a docker image build in CNG (Cloud Native GitLab) repository

.nvmrc

-9.0.0
+8.11.3

CHANGELOG.md

@@ -2,6 +2,17 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 11.0.1 (2018-06-21)
+
+### Security (5 changes)
+
+- Fix XSS vulnerability for table of content generation.
+- Update sanitize gem to 4.6.5 to fix HTML injection vulnerability.
+- HTML escape branch name in project graphs page.
+- HTML escape the name of the user in ProjectsHelper#link_to_member.
+- Don't show events from internal projects for anonymous users in public feed.
+
+
 ## 11.0.0 (2018-06-22)
 
 ### Security (3 changes)
@@ -242,6 +253,17 @@ entry.
 - Workhorse to send raw diff and patch for commits.
 
 
+## 10.8.5 (2018-06-21)
+
+### Security (5 changes)
+
+- Fix XSS vulnerability for table of content generation.
+- Update sanitize gem to 4.6.5 to fix HTML injection vulnerability.
+- HTML escape branch name in project graphs page.
+- HTML escape the name of the user in ProjectsHelper#link_to_member.
+- Don't show events from internal projects for anonymous users in public feed.
+
+
 ## 10.8.4 (2018-06-06)
 
 - No changes.
@@ -460,6 +482,22 @@ entry.
 - Gitaly handles repository forks by default.
 
 
+## 10.7.6 (2018-06-21)
+
+### Security (6 changes)
+
+- Fix XSS vulnerability for table of content generation.
+- Update sanitize gem to 4.6.5 to fix HTML injection vulnerability.
+- HTML escape branch name in project graphs page.
+- HTML escape the name of the user in ProjectsHelper#link_to_member.
+- Don't show events from internal projects for anonymous users in public feed.
+- XSS fix to use safe_params instead of params in url_for helpers.
+
+### Other (1 change)
+
+- Replacing gollum libraries for gitlab custom libs. !18343
+
+
 ## 10.7.5 (2018-05-28)
 
 ### Security (3 changes)

CONTRIBUTING.md

@@ -650,7 +650,7 @@ the feature you contribute through all of these steps.
 1. Working and clean code that is commented where needed
 1. [Unit, integration, and system tests][testing] that pass on the CI server
 1. Performance/scalability implications have been considered, addressed, and tested
-1. [Documented][doc-styleguide] in the `/doc` directory
+1. [Documented][doc-guidelines] in the `/doc` directory
 1. [Changelog entry added][changelog], if necessary
 1. Reviewed and any concerns are addressed
 1. Merged by a project maintainer
@@ -687,7 +687,7 @@ merge request:
     contributors to enhance security
 1.  [Database Migrations](doc/development/migration_style_guide.md)
 1.  [Markdown](http://www.cirosantilli.com/markdown-styleguide)
-1.  [Documentation styleguide][doc-styleguide]
+1.  [Documentation styleguide](https://docs.gitlab.com/ee/development/documentation/styleguide.html)
 1.  Interface text should be written subjectively instead of objectively. It
     should be the GitLab core team addressing a person. It should be written in
     present time and never use past tense (has been/was). For example instead

Gemfile

@@ -230,7 +230,7 @@ gem 'ruby-fogbugz', '~> 0.2.1'
 gem 'kubeclient', '~> 3.1.0'
 
 # Sanitize user input
-gem 'sanitize', '~> 2.0'
+gem 'sanitize', '~> 4.6.5'
 gem 'babosa', '~> 1.0.2'
 
 # Sanitizes SVG input

Gemfile.lock

@@ -295,13 +295,13 @@ GEM
       flowdock (~> 0.7)
       gitlab-grit (>= 2.4.1)
       multi_json
-    gitlab-gollum-lib (4.2.7.4)
+    gitlab-gollum-lib (4.2.7.5)
       gemojione (~> 3.2)
       github-markup (~> 1.6)
       gollum-grit_adapter (~> 1.0)
       nokogiri (>= 1.6.1, < 2.0)
       rouge (~> 3.1)
-      sanitize (~> 2.1)
+      sanitize (~> 4.6.4)
       stringex (~> 2.6)
     gitlab-gollum-rugged_adapter (0.4.4.1)
       mime-types (>= 1.15)
@@ -514,6 +514,8 @@ GEM
     netrc (0.11.0)
     nokogiri (1.8.2)
       mini_portile2 (~> 2.3.0)
+    nokogumbo (1.5.0)
+      nokogiri
     numerizer (0.1.1)
     oauth (0.5.4)
     oauth2 (1.4.0)
@@ -804,8 +806,10 @@ GEM
       et-orbi (~> 1.0)
     rugged (0.27.2)
     safe_yaml (1.0.4)
-    sanitize (2.1.0)
+    sanitize (4.6.5)
+      crass (~> 1.0.2)
       nokogiri (>= 1.4.4)
+      nokogumbo (~> 1.4)
     sass (3.5.5)
       sass-listen (~> 4.0.0)
     sass-listen (4.0.0)
@@ -1151,7 +1155,7 @@ DEPENDENCIES
   ruby_parser (~> 3.8)
   rufus-scheduler (~> 3.4)
   rugged (~> 0.27)
-  sanitize (~> 2.0)
+  sanitize (~> 4.6.5)
   sass-rails (~> 5.0.6)
   scss_lint (~> 0.56.0)
   seed-fu (~> 2.3.7)

Gemfile.rails5.lock

@@ -298,13 +298,13 @@ GEM
       flowdock (~> 0.7)
       gitlab-grit (>= 2.4.1)
       multi_json
-    gitlab-gollum-lib (4.2.7.4)
+    gitlab-gollum-lib (4.2.7.5)
       gemojione (~> 3.2)
       github-markup (~> 1.6)
       gollum-grit_adapter (~> 1.0)
       nokogiri (>= 1.6.1, < 2.0)
       rouge (~> 3.1)
-      sanitize (~> 2.1)
+      sanitize (~> 4.6.4)
       stringex (~> 2.6)
     gitlab-gollum-rugged_adapter (0.4.4.1)
       mime-types (>= 1.15)
@@ -518,6 +518,8 @@ GEM
     nio4r (2.3.1)
     nokogiri (1.8.2)
       mini_portile2 (~> 2.3.0)
+    nokogumbo (1.5.0)
+      nokogiri
     numerizer (0.1.1)
     oauth (0.5.4)
     oauth2 (1.4.0)
@@ -813,8 +815,10 @@ GEM
       et-orbi (~> 1.0)
     rugged (0.27.1)
     safe_yaml (1.0.4)
-    sanitize (2.1.0)
+    sanitize (4.6.5)
+      crass (~> 1.0.2)
       nokogiri (>= 1.4.4)
+      nokogumbo (~> 1.4)
     sass (3.5.5)
       sass-listen (~> 4.0.0)
     sass-listen (4.0.0)
@@ -1162,7 +1166,7 @@ DEPENDENCIES
   ruby_parser (~> 3.8)
   rufus-scheduler (~> 3.4)
   rugged (~> 0.27)
-  sanitize (~> 2.0)
+  sanitize (~> 4.6.5)
   sass-rails (~> 5.0.6)
   scss_lint (~> 0.56.0)
   seed-fu (~> 2.3.7)

app/assets/javascripts/boards/components/board_sidebar.js

@@ -6,13 +6,13 @@ import Flash from '../../flash';
 import { __ } from '../../locale';
 import Sidebar from '../../right_sidebar';
 import eventHub from '../../sidebar/event_hub';
-import assigneeTitle from '../../sidebar/components/assignees/assignee_title.vue';
-import assignees from '../../sidebar/components/assignees/assignees.vue';
+import AssigneeTitle from '../../sidebar/components/assignees/assignee_title.vue';
+import Assignees from '../../sidebar/components/assignees/assignees.vue';
 import DueDateSelectors from '../../due_date_select';
-import './sidebar/remove_issue';
+import RemoveBtn from './sidebar/remove_issue.vue';
 import IssuableContext from '../../issuable_context';
 import LabelsSelect from '../../labels_select';
-import subscriptions from '../../sidebar/components/subscriptions/subscriptions.vue';
+import Subscriptions from '../../sidebar/components/subscriptions/subscriptions.vue';
 import MilestoneSelect from '../../milestone_select';
 
 const Store = gl.issueBoards.BoardsStore;
@@ -22,10 +22,10 @@ window.gl.issueBoards = window.gl.issueBoards || {};
 
 gl.issueBoards.BoardSidebar = Vue.extend({
   components: {
-    assigneeTitle,
-    assignees,
-    removeBtn: gl.issueBoards.RemoveIssueBtn,
-    subscriptions,
+    AssigneeTitle,
+    Assignees,
+    RemoveBtn,
+    Subscriptions,
   },
   props: {
     currentUser: {

app/assets/javascripts/boards/components/modal/footer.js → app/assets/javascripts/boards/components/modal/footer.vue

-import Vue from 'vue';
+<script>
 import Flash from '../../../flash';
 import { __ } from '../../../locale';
-import './lists_dropdown';
+import ListsDropdown from './lists_dropdown.vue';
 import { pluralize } from '../../../lib/utils/text_utility';
 import ModalStore from '../../stores/modal_store';
 import modalMixin from '../../mixins/modal_mixins';
 
-gl.issueBoards.ModalFooter = Vue.extend({
+export default {
   components: {
-    'lists-dropdown': gl.issueBoards.ModalFooterListsDropdown,
+    ListsDropdown,
   },
   mixins: [modalMixin],
   data() {
@@ -55,28 +55,32 @@ gl.issueBoards.ModalFooter = Vue.extend({
       this.toggleModal(false);
     },
   },
-  template: `
-    <footer
-      class="form-actions add-issues-footer">
-      <div class="float-left">
-        <button
-          class="btn btn-success"
-          type="button"
-          :disabled="submitDisabled"
-          @click="addIssues">
-          {{ submitText }}
-        </button>
-        <span class="inline add-issues-footer-to-list">
-          to list
-        </span>
-        <lists-dropdown></lists-dropdown>
-      </div>
+};
+</script>
+<template>
+  <footer
+    class="form-actions add-issues-footer"
+  >
+    <div class="float-left">
       <button
-        class="btn btn-default float-right"
+        :disabled="submitDisabled"
+        class="btn btn-success"
         type="button"
-        @click="toggleModal(false)">
-        Cancel
+        @click="addIssues"
+      >
+        {{ submitText }}
       </button>
-    </footer>
-  `,
-});
+      <span class="inline add-issues-footer-to-list">
+        to list
+      </span>
+      <lists-dropdown/>
+    </div>
+    <button
+      class="btn btn-default float-right"
+      type="button"
+      @click="toggleModal(false)"
+    >
+      Cancel
+    </button>
+  </footer>
+</template>

app/assets/javascripts/boards/components/modal/header.js

 import Vue from 'vue';
 import modalFilters from './filters';
-import './tabs';
+import modalTabs from './tabs.vue';
 import ModalStore from '../../stores/modal_store';
 import modalMixin from '../../mixins/modal_mixins';
 
 gl.issueBoards.ModalHeader = Vue.extend({
   components: {
-    'modal-tabs': gl.issueBoards.ModalTabs,
+    modalTabs,
     modalFilters,
   },
   mixins: [modalMixin],

app/assets/javascripts/boards/components/modal/index.js

@@ -5,7 +5,7 @@ import queryData from '~/boards/utils/query_data';
 import loadingIcon from '~/vue_shared/components/loading_icon.vue';
 import './header';
 import './list';
-import './footer';
+import ModalFooter from './footer.vue';
 import EmptyState from './empty_state.vue';
 import ModalStore from '../../stores/modal_store';
 
@@ -14,7 +14,7 @@ gl.issueBoards.IssuesModal = Vue.extend({
     EmptyState,
     'modal-header': gl.issueBoards.ModalHeader,
     'modal-list': gl.issueBoards.ModalList,
-    'modal-footer': gl.issueBoards.ModalFooter,
+    ModalFooter,
     loadingIcon,
   },
   props: {

app/assets/javascripts/boards/components/modal/lists_dropdown.js

-import Vue from 'vue';
-import ModalStore from '../../stores/modal_store';
-
-gl.issueBoards.ModalFooterListsDropdown = Vue.extend({
-  data() {
-    return {
-      modal: ModalStore.store,
-      state: gl.issueBoards.BoardsStore.state,
-    };
-  },
-  computed: {
-    selected() {
-      return this.modal.selectedList || this.state.lists[1];
-    },
-  },
-  destroyed() {
-    this.modal.selectedList = null;
-  },
-  template: `
-    <div class="dropdown inline">
-      <button
-        class="dropdown-menu-toggle"
-        type="button"
-        data-toggle="dropdown"
-        aria-expanded="false">
-        <span
-          class="dropdown-label-box"
-          :style="{ backgroundColor: selected.label.color }">
-        </span>
-        {{ selected.title }}
-        <i class="fa fa-chevron-down"></i>
-      </button>
-      <div class="dropdown-menu dropdown-menu-selectable dropdown-menu-drop-up">
-        <ul>
-          <li
-            v-for="list in state.lists"
-            v-if="list.type == 'label'">
-            <a
-              href="#"
-              role="button"
-              :class="{ 'is-active': list.id == selected.id }"
-              @click.prevent="modal.selectedList = list">
-              <span
-                class="dropdown-label-box"
-                :style="{ backgroundColor: list.label.color }">
-              </span>
-              {{ list.title }}
-            </a>
-          </li>
-        </ul>
-      </div>
-    </div>
-  `,
-});

app/assets/javascripts/boards/components/modal/lists_dropdown.vue

+<script>
+import ModalStore from '../../stores/modal_store';
+
+export default {
+  data() {
+    return {
+      modal: ModalStore.store,
+      state: gl.issueBoards.BoardsStore.state,
+    };
+  },
+  computed: {
+    selected() {
+      return this.modal.selectedList || this.state.lists[1];
+    },
+  },
+  destroyed() {
+    this.modal.selectedList = null;
+  },
+};
+</script>
+<template>
+  <div class="dropdown inline">
+    <button
+      class="dropdown-menu-toggle"
+      type="button"
+      data-toggle="dropdown"
+      aria-expanded="false">
+      <span
+        :style="{ backgroundColor: selected.label.color }"
+        class="dropdown-label-box">
+      </span>
+      {{ selected.title }}
+      <i class="fa fa-chevron-down"></i>
+    </button>
+    <div class="dropdown-menu dropdown-menu-selectable dropdown-menu-drop-up">
+      <ul>
+        <li
+          v-for="(list, i) in state.lists"
+          v-if="list.type == 'label'"
+          :key="i">
+          <a
+            :class="{ 'is-active': list.id == selected.id }"
+            href="#"
+            role="button"
+            @click.prevent="modal.selectedList = list">
+            <span
+              :style="{ backgroundColor: list.label.color }"
+              class="dropdown-label-box">
+            </span>
+            {{ list.title }}
+          </a>
+        </li>
+      </ul>
+    </div>
+  </div>
+</template>

app/assets/javascripts/boards/components/modal/tabs.js

-import Vue from 'vue';
-import ModalStore from '../../stores/modal_store';
-import modalMixin from '../../mixins/modal_mixins';
-
-gl.issueBoards.ModalTabs = Vue.extend({
-  mixins: [modalMixin],
-  data() {
-    return ModalStore.store;
-  },
-  computed: {
-    selectedCount() {
-      return ModalStore.selectedCount();
-    },
-  },
-  destroyed() {
-    this.activeTab = 'all';
-  },
-  template: `
-    <div class="top-area prepend-top-10 append-bottom-10">
-      <ul class="nav-links issues-state-filters">
-        <li :class="{ 'active': activeTab == 'all' }">
-          <a
-            href="#"
-            role="button"
-            @click.prevent="changeTab('all')">
-            Open issues
-            <span class="badge badge-pill">
-              {{ issuesCount }}
-            </span>
-          </a>
-        </li>
-        <li :class="{ 'active': activeTab == 'selected' }">
-          <a
-            href="#"
-            role="button"
-            @click.prevent="changeTab('selected')">
-            Selected issues
-            <span class="badge badge-pill">
-              {{ selectedCount }}
-            </span>
-          </a>
-        </li>
-      </ul>
-    </div>
-  `,
-});

app/assets/javascripts/boards/components/modal/tabs.vue

+<script>
+  import ModalStore from '../../stores/modal_store';
+  import modalMixin from '../../mixins/modal_mixins';
+
+  export default {
+    mixins: [modalMixin],
+    data() {
+      return ModalStore.store;
+    },
+    computed: {
+      selectedCount() {
+        return ModalStore.selectedCount();
+      },
+    },
+    destroyed() {
+      this.activeTab = 'all';
+    },
+  };
+</script>
+<template>
+  <div class="top-area prepend-top-10 append-bottom-10">
+    <ul class="nav-links issues-state-filters">
+      <li :class="{ 'active': activeTab == 'all' }">
+        <a
+          href="#"
+          role="button"
+          @click.prevent="changeTab('all')"
+        >
+          Open issues
+          <span class="badge badge-pill">
+            {{ issuesCount }}
+          </span>
+        </a>
+      </li>
+      <li :class="{ 'active': activeTab == 'selected' }">
+        <a
+          href="#"
+          role="button"
+          @click.prevent="changeTab('selected')"
+        >
+          Selected issues
+          <span class="badge badge-pill">
+            {{ selectedCount }}
+          </span>
+        </a>
+      </li>
+    </ul>
+  </div>
+</template>

app/assets/javascripts/boards/components/sidebar/remove_issue.js

-import Vue from 'vue';
-import Flash from '../../../flash';
-import { __ } from '../../../locale';
-
-const Store = gl.issueBoards.BoardsStore;
-
-window.gl = window.gl || {};
-window.gl.issueBoards = window.gl.issueBoards || {};
-
-gl.issueBoards.RemoveIssueBtn = Vue.extend({
-  props: {
-    issue: {
-      type: Object,
-      required: true,
-    },
-    list: {
-      type: Object,
-      required: true,
-    },
-  },
-  computed: {
-    updateUrl() {
-      return this.issue.path;
-    },
-  },
-  methods: {
-    removeIssue() {
-      const issue = this.issue;
-      const lists = issue.getLists();
-      const listLabelIds = lists.map(list => list.label.id);
-
-      let labelIds = issue.labels
-        .map(label => label.id)
-        .filter(id => !listLabelIds.includes(id));
-      if (labelIds.length === 0) {
-        labelIds = [''];
-      }
-
-      const data = {
-        issue: {
-          label_ids: labelIds,
-        },
-      };
-
-      // Post the remove data
-      Vue.http.patch(this.updateUrl, data).catch(() => {
-        Flash(__('Failed to remove issue from board, please try again.'));
-
-        lists.forEach((list) => {
-          list.addIssue(issue);
-        });
-      });
-
-      // Remove from the frontend store
-      lists.forEach((list) => {
-        list.removeIssue(issue);
-      });
-
-      Store.detail.issue = {};
-    },
-  },
-  template: `
-    <div
-      class="block list">
-      <button
-        class="btn btn-default btn-block"
-        type="button"
-        @click="removeIssue">
-        Remove from board
-      </button>
-    </div>
-  `,
-});

app/assets/javascripts/boards/components/sidebar/remove_issue.vue

+<script>
+  import Vue from 'vue';
+  import Flash from '../../../flash';
+  import { __ } from '../../../locale';
+
+  const Store = gl.issueBoards.BoardsStore;
+
+  export default {
+    props: {
+      issue: {
+        type: Object,
+        required: true,
+      },
+      list: {
+        type: Object,
+        required: true,
+      },
+    },
+    computed: {
+      updateUrl() {
+        return this.issue.path;
+      },
+    },
+    methods: {
+      removeIssue() {
+        const issue = this.issue;
+        const lists = issue.getLists();
+        const listLabelIds = lists.map(list => list.label.id);
+
+        let labelIds = issue.labels.map(label => label.id).filter(id => !listLabelIds.includes(id));
+        if (labelIds.length === 0) {
+          labelIds = [''];
+        }
+
+        const data = {
+          issue: {
+            label_ids: labelIds,
+          },
+        };
+
+        // Post the remove data
+        Vue.http.patch(this.updateUrl, data).catch(() => {
+          Flash(__('Failed to remove issue from board, please try again.'));
+
+          lists.forEach(list => {
+            list.addIssue(issue);
+          });
+        });
+
+        // Remove from the frontend store
+        lists.forEach(list => {
+          list.removeIssue(issue);
+        });
+
+        Store.detail.issue = {};
+      },
+    },
+  };
+</script>
+<template>
+  <div
+    class="block list"
+  >
+    <button
+      class="btn btn-default btn-block"
+      type="button"
+      @click="removeIssue"
+    >
+      Remove from board
+    </button>
+  </div>
+</template>

app/assets/javascripts/gfm_auto_complete.js

@@ -7,6 +7,16 @@ function sanitize(str) {
   return str.replace(/<(?:.|\n)*?>/gm, '');
 }
 
+export const defaultAutocompleteConfig = {
+  emojis: true,
+  members: true,
+  issues: true,
+  mergeRequests: true,
+  epics: false,
+  milestones: true,
+  labels: true,
+};
+
 class GfmAutoComplete {
   constructor(dataSources) {
     this.dataSources = dataSources || {};
@@ -14,14 +24,7 @@ class GfmAutoComplete {
     this.isLoadingData = {};
   }
 
-  setup(input, enableMap = {
-    emojis: true,
-    members: true,
-    issues: true,
-    milestones: true,
-    mergeRequests: true,
-    labels: true,
-  }) {
+  setup(input, enableMap = defaultAutocompleteConfig) {
     // Add GFM auto-completion to all input fields, that accept GFM input.
     this.input = input || $('.js-gfm-input');
     this.enableMap = enableMap;

app/assets/javascripts/gl_form.js

 import $ from 'jquery';
 import autosize from 'autosize';
-import GfmAutoComplete from './gfm_auto_complete';
+import GfmAutoComplete, * as GFMConfig from './gfm_auto_complete';
 import dropzoneInput from './dropzone_input';
 import { addMarkdownListeners, removeMarkdownListeners } from './lib/utils/text_markdown';
 
 export default class GLForm {
-  constructor(form, enableGFM = false) {
+  constructor(form, enableGFM = {}) {
     this.form = form;
     this.textarea = this.form.find('textarea.js-gfm-input');
-    this.enableGFM = enableGFM;
+    this.enableGFM = Object.assign({}, GFMConfig.defaultAutocompleteConfig, enableGFM);
     // Before we start, we should clean up any previous data for this form
     this.destroy();
     // Setup the form
@@ -34,14 +34,7 @@ export default class GLForm {
       // remove notify commit author checkbox for non-commit notes
       gl.utils.disableButtonIfEmptyField(this.form.find('.js-note-text'), this.form.find('.js-comment-button, .js-note-new-discussion'));
       this.autoComplete = new GfmAutoComplete(gl.GfmAutoComplete && gl.GfmAutoComplete.dataSources);
-      this.autoComplete.setup(this.form.find('.js-gfm-input'), {
-        emojis: true,
-        members: this.enableGFM,
-        issues: this.enableGFM,
-        milestones: this.enableGFM,
-        mergeRequests: this.enableGFM,
-        labels: this.enableGFM,
-      });
+      this.autoComplete.setup(this.form.find('.js-gfm-input'), this.enableGFM);
       dropzoneInput(this.form);
       autosize(this.textarea);
     }

app/assets/javascripts/ide/components/commit_sidebar/list_item.vue

@@ -89,14 +89,14 @@ export default {
 
 <template>
   <div class="multi-file-commit-list-item position-relative">
-    <button
+    <div
       v-tooltip
       :title="tooltipTitle"
       :class="{
         'is-active': isActive
       }"
-      type="button"
       class="multi-file-commit-list-path w-100 border-0 ml-0 mr-0"
+      role="button"
       @dblclick="fileAction"
       @click="openFileInEditor"
     >
@@ -107,7 +107,7 @@ export default {
           :css-classes="iconClass"
         />{{ file.name }}
       </span>
-    </button>
+    </div>
     <component
       :is="actionComponent"
       :path="file.path"

app/assets/javascripts/ide/components/panes/right.vue

@@ -69,7 +69,7 @@ export default {
           >
             <icon
               :size="16"
-              name="pipeline"
+              name="rocket"
             />
           </button>
         </li>

app/assets/javascripts/ide/components/repo_tab.vue

@@ -44,6 +44,8 @@ export default {
   methods: {
     ...mapActions(['closeFile', 'updateDelayViewerUpdated', 'openPendingTab']),
     clickFile(tab) {
+      if (tab.active) return;
+
       this.updateDelayViewerUpdated(true);
 
       if (tab.pending) {

app/assets/javascripts/init_notes.js

@@ -7,10 +7,10 @@ export default () => {
     notesIds,
     now,
     diffView,
-    autocomplete,
+    enableGFM,
   } = JSON.parse(dataEl.innerHTML);
 
   // Create a singleton so that we don't need to assign
   // into the window object, we can just access the current isntance with Notes.instance
-  Notes.initialize(notesUrl, notesIds, now, diffView, autocomplete);
+  Notes.initialize(notesUrl, notesIds, now, diffView, enableGFM);
 };

app/assets/javascripts/notes.js

@@ -20,6 +20,7 @@ import SkeletonLoadingContainer from '~/vue_shared/components/skeleton_loading_c
 import axios from './lib/utils/axios_utils';
 import { getLocationHash } from './lib/utils/url_utility';
 import Flash from './flash';
+import { defaultAutocompleteConfig } from './gfm_auto_complete';
 import CommentTypeToggle from './comment_type_toggle';
 import GLForm from './gl_form';
 import loadAwardsHandler from './awards_handler';
@@ -45,7 +46,7 @@ const MAX_VISIBLE_COMMIT_LIST_COUNT = 3;
 const REGEX_QUICK_ACTIONS = /^\/\w+.*$/gm;
 
 export default class Notes {
-  static initialize(notes_url, note_ids, last_fetched_at, view, enableGFM = true) {
+  static initialize(notes_url, note_ids, last_fetched_at, view, enableGFM) {
     if (!this.instance) {
       this.instance = new Notes(notes_url, note_ids, last_fetched_at, view, enableGFM);
     }
@@ -55,7 +56,7 @@ export default class Notes {
     return this.instance;
   }
 
-  constructor(notes_url, note_ids, last_fetched_at, view, enableGFM = true) {
+  constructor(notes_url, note_ids, last_fetched_at, view, enableGFM = defaultAutocompleteConfig) {
     this.updateTargetButtons = this.updateTargetButtons.bind(this);
     this.updateComment = this.updateComment.bind(this);
     this.visibilityChange = this.visibilityChange.bind(this);
@@ -94,7 +95,7 @@ export default class Notes {
     this.cleanBinding();
     this.addBinding();
     this.setPollingInterval();
-    this.setupMainTargetNoteForm();
+    this.setupMainTargetNoteForm(enableGFM);
     this.taskList = new TaskList({
       dataType: 'note',
       fieldName: 'note',
@@ -598,14 +599,14 @@ export default class Notes {
    *
    * Sets some hidden fields in the form.
    */
-  setupMainTargetNoteForm() {
+  setupMainTargetNoteForm(enableGFM) {
     var form;
     // find the form
     form = $('.js-new-note-form');
     // Set a global clone of the form for later cloning
     this.formClone = form.clone();
     // show the form
-    this.setupNoteForm(form);
+    this.setupNoteForm(form, enableGFM);
     // fix classes
     form.removeClass('js-new-note-form');
     form.addClass('js-main-target-form');
@@ -633,9 +634,9 @@ export default class Notes {
    * setup GFM auto complete
    * show the form
    */
-  setupNoteForm(form) {
+  setupNoteForm(form, enableGFM = defaultAutocompleteConfig) {
     var textarea, key;
-    this.glForm = new GLForm(form, this.enableGFM);
+    this.glForm = new GLForm(form, enableGFM);
     textarea = form.find('.js-note-text');
     key = [
       'Note',

app/assets/javascripts/notes/components/note_form.vue

@@ -194,7 +194,7 @@ js-autosize markdown-area js-vue-issue-note-form js-vue-textarea"
           class="btn btn-cancel note-edit-cancel js-close-discussion-note-form"
           type="button"
           @click="cancelHandler()">
-          Cancel
+          {{ __('Discard draft') }}
         </button>
       </div>
     </form>

app/assets/javascripts/pages/projects/init_form.js

@@ -3,5 +3,5 @@ import GLForm from '~/gl_form';
 
 export default function ($formEl) {
   new ZenMode(); // eslint-disable-line no-new
-  new GLForm($formEl, true); // eslint-disable-line no-new
+  new GLForm($formEl); // eslint-disable-line no-new
 }

app/assets/javascripts/pages/projects/issues/form.js

@@ -10,7 +10,7 @@ import IssuableTemplateSelectors from '~/templates/issuable_template_selectors';
 
 export default () => {
   new ShortcutsNavigation();
-  new GLForm($('.issue-form'), true);
+  new GLForm($('.issue-form'));
   new IssuableForm($('.issue-form'));
   new LabelsSelect();
   new MilestoneSelect();

app/assets/javascripts/pages/projects/merge_requests/init_merge_request.js

@@ -12,7 +12,7 @@ import IssuableTemplateSelectors from '~/templates/issuable_template_selectors';
 export default () => {
   new Diff();
   new ShortcutsNavigation();
-  new GLForm($('.merge-request-form'), true);
+  new GLForm($('.merge-request-form'));
   new IssuableForm($('.merge-request-form'));
   new LabelsSelect();
   new MilestoneSelect();

app/assets/javascripts/pages/projects/tags/new/index.js

@@ -5,6 +5,6 @@ import GLForm from '../../../../gl_form';
 
 document.addEventListener('DOMContentLoaded', () => {
   new ZenMode(); // eslint-disable-line no-new
-  new GLForm($('.tag-form'), true); // eslint-disable-line no-new
+  new GLForm($('.tag-form')); // eslint-disable-line no-new
   new RefSelectDropdown($('.js-branch-select')); // eslint-disable-line no-new
 });

app/assets/javascripts/pages/projects/wikis/index.js

@@ -12,7 +12,7 @@ document.addEventListener('DOMContentLoaded', () => {
   new Wikis(); // eslint-disable-line no-new
   new ShortcutsWiki(); // eslint-disable-line no-new
   new ZenMode(); // eslint-disable-line no-new
-  new GLForm($('.wiki-form'), true); // eslint-disable-line no-new
+  new GLForm($('.wiki-form')); // eslint-disable-line no-new
 
   const deleteWikiButton = document.getElementById('delete-wiki-button');
 

app/assets/javascripts/pages/snippets/form.js

@@ -3,6 +3,13 @@ import GLForm from '~/gl_form';
 import ZenMode from '~/zen_mode';
 
 export default () => {
-  new GLForm($('.snippet-form'), false); // eslint-disable-line no-new
+  // eslint-disable-next-line no-new
+  new GLForm($('.snippet-form'), {
+    members: false,
+    issues: false,
+    mergeRequests: false,
+    milestones: false,
+    labels: false,
+  });
   new ZenMode(); // eslint-disable-line no-new
 };

app/assets/javascripts/shared/milestones/form.js

@@ -6,5 +6,13 @@ import GLForm from '../../gl_form';
 export default (initGFM = true) => {
   new ZenMode(); // eslint-disable-line no-new
   new DueDateSelectors(); // eslint-disable-line no-new
-  new GLForm($('.milestone-form'), initGFM); // eslint-disable-line no-new
+  // eslint-disable-next-line no-new
+  new GLForm($('.milestone-form'), {
+    emojis: initGFM,
+    members: initGFM,
+    issues: initGFM,
+    mergeRequests: initGFM,
+    milestones: initGFM,
+    labels: initGFM,
+  });
 };

app/assets/javascripts/u2f/authenticate.js

@@ -11,7 +11,6 @@ export default class U2FAuthenticate {
   constructor(container, form, u2fParams, fallbackButton, fallbackUI) {
     this.u2fUtils = null;
     this.container = container;
-    this.renderNotSupported = this.renderNotSupported.bind(this);
     this.renderAuthenticated = this.renderAuthenticated.bind(this);
     this.renderError = this.renderError.bind(this);
     this.renderInProgress = this.renderInProgress.bind(this);
@@ -41,7 +40,6 @@ export default class U2FAuthenticate {
     this.signRequests = u2fParams.sign_requests.map(request => _(request).omit('challenge'));
 
     this.templates = {
-      notSupported: '#js-authenticate-u2f-not-supported',
       setup: '#js-authenticate-u2f-setup',
       inProgress: '#js-authenticate-u2f-in-progress',
       error: '#js-authenticate-u2f-error',
@@ -55,7 +53,7 @@ export default class U2FAuthenticate {
         this.u2fUtils = utils;
         this.renderInProgress();
       })
-      .catch(() => this.renderNotSupported());
+      .catch(() => this.switchToFallbackUI());
   }
 
   authenticate() {
@@ -96,10 +94,6 @@ export default class U2FAuthenticate {
     this.fallbackButton.classList.add('hidden');
   }
 
-  renderNotSupported() {
-    return this.renderTemplate('notSupported');
-  }
-
   switchToFallbackUI() {
     this.fallbackButton.classList.add('hidden');
     this.container[0].classList.add('hidden');

app/assets/javascripts/vue_shared/components/markdown/field.vue

@@ -62,7 +62,14 @@
       /*
         GLForm class handles all the toolbar buttons
       */
-      return new GLForm($(this.$refs['gl-form']), this.enableAutocomplete);
+      return new GLForm($(this.$refs['gl-form']), {
+        emojis: this.enableAutocomplete,
+        members: this.enableAutocomplete,
+        issues: this.enableAutocomplete,
+        mergeRequests: this.enableAutocomplete,
+        milestones: this.enableAutocomplete,
+        labels: this.enableAutocomplete,
+      });
     },
     beforeDestroy() {
       const glForm = $(this.$refs['gl-form']).data('glForm');

app/assets/stylesheets/bootstrap_migration.scss

@@ -310,7 +310,7 @@ pre code {
   color: $white-light;
 
   h4,
-  a,
+  a:not(.btn),
   .alert-link {
     color: $white-light;
   }

app/assets/stylesheets/framework/gitlab_theme.scss

@@ -180,10 +180,6 @@
     color: $border-and-box-shadow;
   }
 
-  .ide-file-list .file.file-active {
-    color: $border-and-box-shadow;
-  }
-
   .ide-sidebar-link {
     &.active {
       color: $border-and-box-shadow;

app/assets/stylesheets/framework/header.scss

@@ -527,7 +527,7 @@
 .header-user {
   .dropdown-menu {
     width: auto;
-    min-width: 160px;
+    min-width: unset;
     margin-top: 4px;
     color: $gl-text-color;
     left: auto;

app/assets/stylesheets/pages/repo.scss

@@ -23,6 +23,7 @@
   margin-top: 0;
   border-top: 1px solid $white-dark;
   padding-bottom: $ide-statusbar-height;
+  color: $gl-text-color;
 
   &.is-collapsed {
     .ide-file-list {
@@ -45,12 +46,8 @@
   .file {
     cursor: pointer;
 
-    &.file-open {
-      background: $white-normal;
-    }
-
     &.file-active {
-      font-weight: $gl-font-weight-bold;
+      background: $theme-gray-100;
     }
 
     .ide-file-name {
@@ -58,7 +55,9 @@
       white-space: nowrap;
       text-overflow: ellipsis;
       max-width: inherit;
-      line-height: 22px;
+      line-height: 16px;
+      display: inline-block;
+      height: 18px;
 
       svg {
         vertical-align: middle;
@@ -86,12 +85,14 @@
 
     .ide-new-btn {
       display: none;
+
+      .btn {
+        padding: 2px 5px;
+      }
     }
 
     &:hover,
     &:focus {
-      background: $white-normal;
-
       .ide-new-btn {
         display: block;
       }
@@ -281,8 +282,8 @@
     }
 
     .margin {
-      background-color: $gray-light;
-      border-right: 1px solid $white-normal;
+      background-color: $white-light;
+      border-right: 1px solid $theme-gray-100;
 
       .line-insert {
         border-right: 1px solid $line-added-dark;
@@ -303,6 +304,15 @@
 .multi-file-editor-holder {
   height: 100%;
   min-height: 0;
+
+  &.is-readonly,
+  .editor.original {
+    .monaco-editor,
+    .monaco-editor-background,
+    .monaco-editor .inputarea.ime-input {
+      background-color: $theme-gray-50;
+    }
+  }
 }
 
 .preview-container {
@@ -587,11 +597,17 @@
 
   &:hover,
   &:focus {
-    background: $white-normal;
+    background: $theme-gray-100;
+  }
+
+  &:active {
+    background: $theme-gray-200;
   }
 }
 
 .multi-file-commit-list-path {
+  cursor: pointer;
+
   &.is-active {
     background-color: $white-normal;
   }
@@ -611,10 +627,6 @@
 .multi-file-commit-list-file-path {
   @include str-truncated(calc(100% - 30px));
 
-  &:hover {
-    text-decoration: underline;
-  }
-
   &:active {
     text-decoration: none;
   }

app/assets/stylesheets/pages/search.scss

@@ -114,7 +114,7 @@ input[type="checkbox"]:hover {
     }
 
     .dropdown-content {
-      max-height: 302px;
+      max-height: none;
     }
   }
 

app/controllers/admin/application_settings_controller.rb

@@ -52,7 +52,7 @@ class Admin::ApplicationSettingsController < Admin::ApplicationController
   private
 
   def set_application_setting
-    @application_setting = ApplicationSetting.current_without_cache
+    @application_setting = Gitlab::CurrentSettings.current_application_settings
   end
 
   def application_setting_params

app/controllers/admin/groups_controller.rb

@@ -72,10 +72,10 @@ class Admin::GroupsController < Admin::ApplicationController
   end
 
   def group_params
-    params.require(:group).permit(group_params_ce)
+    params.require(:group).permit(allowed_group_params)
   end
 
-  def group_params_ce
+  def allowed_group_params
     [
       :avatar,
       :description,

app/controllers/admin/users_controller.rb

@@ -187,10 +187,10 @@ class Admin::UsersController < Admin::ApplicationController
   end
 
   def user_params
-    params.require(:user).permit(user_params_ce)
+    params.require(:user).permit(allowed_user_params)
   end
 
-  def user_params_ce
+  def allowed_user_params
     [
       :access_level,
       :avatar,

app/controllers/omniauth_callbacks_controller.rb

@@ -119,7 +119,7 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController
 
       set_remember_me(user)
 
-      if user.two_factor_enabled?
+      if user.two_factor_enabled? && !auth_user.bypass_two_factor?
         prompt_for_two_factor(user)
       else
         sign_in_and_redirect(user)

app/controllers/projects/jobs_controller.rb

@@ -160,7 +160,7 @@ class Projects::JobsController < Projects::ApplicationController
 
   def build
     @build ||= project.builds.find(params[:id])
-                 .present(current_user: current_user)
+      .present(current_user: current_user)
   end
 
   def build_path(build)

app/controllers/projects/wikis_controller.rb

@@ -95,6 +95,7 @@ class Projects::WikisController < Projects::ApplicationController
 
   def destroy
     @page = @project_wiki.find_page(params[:id])
+
     WikiPages::DestroyService.new(@project, current_user).execute(@page)
 
     redirect_to project_wiki_path(@project, :home),

app/controllers/projects_controller.rb

@@ -63,7 +63,7 @@ class ProjectsController < Projects::ApplicationController
           redirect_to(edit_project_path(@project))
         end
       else
-        flash[:alert] = result[:message]
+        flash.now[:alert] = result[:message]
 
         format.html { render 'edit' }
       end

app/finders/user_recent_events_finder.rb

@@ -56,7 +56,7 @@ class UserRecentEventsFinder
 
     visible = target_user
       .project_interactions
-      .where(visibility_level: [Gitlab::VisibilityLevel::INTERNAL, Gitlab::VisibilityLevel::PUBLIC])
+      .where(visibility_level: Gitlab::VisibilityLevel.levels_for_user(current_user))
       .select(:id)
 
     Gitlab::SQL::Union.new([authorized, visible]).to_sql

app/helpers/notes_helper.rb

@@ -143,7 +143,14 @@ module NotesHelper
       notesIds: @notes.map(&:id),
       now: Time.now.to_i,
       diffView: diff_view,
-      autocomplete: autocomplete
+      enableGFM: {
+        emojis: true,
+        members: autocomplete,
+        issues: autocomplete,
+        mergeRequests: autocomplete,
+        milestones: autocomplete,
+        labels: autocomplete
+      }
     }
   end
 

app/helpers/projects_helper.rb

@@ -40,7 +40,8 @@ module ProjectsHelper
       name_tag_options[:class] << 'has-tooltip'
     end
 
-    content_tag(:span, sanitize(username), name_tag_options)
+    # NOTE: ActionView::Helpers::TagHelper#content_tag HTML escapes username
+    content_tag(:span, username, name_tag_options)
   end
 
   def link_to_member(project, author, opts = {}, &block)
@@ -506,6 +507,14 @@ module ProjectsHelper
     end
   end
 
+  def sidebar_projects_paths
+    %w[
+      projects#show
+      projects#activity
+      cycle_analytics#show
+    ]
+  end
+
   def sidebar_settings_paths
     %w[
       projects#edit

app/models/application_setting.rb

@@ -212,14 +212,6 @@ class ApplicationSetting < ActiveRecord::Base
     end
   end
 
-  validates_each :disabled_oauth_sign_in_sources do |record, attr, value|
-    value&.each do |source|
-      unless Devise.omniauth_providers.include?(source.to_sym)
-        record.errors.add(attr, "'#{source}' is not an OAuth sign-in source")
-      end
-    end
-  end
-
   validate :terms_exist, if: :enforce_terms?
 
   before_validation :ensure_uuid!
@@ -330,6 +322,11 @@ class ApplicationSetting < ActiveRecord::Base
     ::Gitlab::Database.cached_column_exists?(:application_settings, :sidekiq_throttling_enabled)
   end
 
+  def disabled_oauth_sign_in_sources=(sources)
+    sources = (sources || []).map(&:to_s) & Devise.omniauth_providers.map(&:to_s)
+    super(sources)
+  end
+
   def domain_whitelist_raw
     self.domain_whitelist&.join("\n")
   end

app/models/ci/pipeline.rb

@@ -561,9 +561,9 @@ module Ci
         .append(key: 'CI_PIPELINE_IID', value: iid.to_s)
         .append(key: 'CI_CONFIG_PATH', value: ci_yaml_file_path)
         .append(key: 'CI_PIPELINE_SOURCE', value: source.to_s)
-        .append(key: 'CI_COMMIT_MESSAGE', value: git_commit_message)
-        .append(key: 'CI_COMMIT_TITLE', value: git_commit_full_title)
-        .append(key: 'CI_COMMIT_DESCRIPTION', value: git_commit_description)
+        .append(key: 'CI_COMMIT_MESSAGE', value: git_commit_message.to_s)
+        .append(key: 'CI_COMMIT_TITLE', value: git_commit_full_title.to_s)
+        .append(key: 'CI_COMMIT_DESCRIPTION', value: git_commit_description.to_s)
     end
 
     def queued_duration

app/models/concerns/sortable.rb

@@ -12,8 +12,8 @@ module Sortable
     scope :order_created_asc, -> { reorder(created_at: :asc) }
     scope :order_updated_desc, -> { reorder(updated_at: :desc) }
     scope :order_updated_asc, -> { reorder(updated_at: :asc) }
-    scope :order_name_asc, -> { reorder("lower(name) asc") }
-    scope :order_name_desc, -> { reorder("lower(name) desc") }
+    scope :order_name_asc, -> { reorder(Arel::Nodes::Ascending.new(arel_table[:name].lower)) }
+    scope :order_name_desc, -> { reorder(Arel::Nodes::Descending.new(arel_table[:name].lower)) }
   end
 
   module ClassMethods

app/models/merge_request.rb

@@ -129,9 +129,7 @@ class MergeRequest < ActiveRecord::Base
 
     after_transition unchecked: :cannot_be_merged do |merge_request, transition|
       begin
-        # Merge request can become unmergeable due to many reasons.
-        # We only notify if it is due to conflict.
-        unless merge_request.project.repository.can_be_merged?(merge_request.diff_head_sha, merge_request.target_branch)
+        if merge_request.notify_conflict?
           NotificationService.new.merge_request_unmergeable(merge_request)
           TodoService.new.merge_request_became_unmergeable(merge_request)
         end
@@ -378,6 +376,10 @@ class MergeRequest < ActiveRecord::Base
     end
   end
 
+  def non_latest_diffs
+    merge_request_diffs.where.not(id: merge_request_diff.id)
+  end
+
   def diff_size
     # Calling `merge_request_diff.diffs.real_size` will also perform
     # highlighting, which we don't need here.
@@ -619,18 +621,7 @@ class MergeRequest < ActiveRecord::Base
   def reload_diff(current_user = nil)
     return unless open?
 
-    old_diff_refs = self.diff_refs
-    new_diff = create_merge_request_diff
-
-    MergeRequests::MergeRequestDiffCacheService.new.execute(self, new_diff)
-
-    new_diff_refs = self.diff_refs
-
-    update_diff_discussion_positions(
-      old_diff_refs: old_diff_refs,
-      new_diff_refs: new_diff_refs,
-      current_user: current_user
-    )
+    MergeRequests::ReloadDiffsService.new(self, current_user).execute
   end
 
   def check_if_can_be_merged
@@ -715,6 +706,10 @@ class MergeRequest < ActiveRecord::Base
     should_remove_source_branch? || force_remove_source_branch?
   end
 
+  def notify_conflict?
+    (opened? || locked?) && !project.repository.can_be_merged?(diff_head_sha, target_branch)
+  end
+
   def related_notes
     # Fetch comments only from last 100 commits
     commits_for_notes_limit = 100

app/models/merge_request_diff.rb

@@ -3,6 +3,7 @@ class MergeRequestDiff < ActiveRecord::Base
   include Importable
   include ManualInverseAssociation
   include IgnorableColumn
+  include EachBatch
 
   # Don't display more than 100 commits at once
   COMMITS_SAFE_SIZE = 100
@@ -17,8 +18,14 @@ class MergeRequestDiff < ActiveRecord::Base
   has_many :merge_request_diff_commits, -> { order(:merge_request_diff_id, :relative_order) }
 
   state_machine :state, initial: :empty do
+    event :clean do
+      transition any => :without_files
+    end
+
     state :collected
     state :overflow
+    # Diff files have been deleted by the system
+    state :without_files
     # Deprecated states: these are no longer used but these values may still occur
     # in the database.
     state :timeout
@@ -27,6 +34,7 @@ class MergeRequestDiff < ActiveRecord::Base
     state :overflow_diff_lines_limit
   end
 
+  scope :with_files, -> { without_states(:without_files, :empty) }
   scope :viewable, -> { without_state(:empty) }
   scope :by_commit_sha, ->(sha) do
     joins(:merge_request_diff_commits).where(merge_request_diff_commits: { sha: sha }).reorder(nil)
@@ -42,6 +50,10 @@ class MergeRequestDiff < ActiveRecord::Base
     find_by(start_commit_sha: diff_refs.start_sha, head_commit_sha: diff_refs.head_sha, base_commit_sha: diff_refs.base_sha)
   end
 
+  def viewable?
+    collected? || without_files? || overflow?
+  end
+
   # Collect information about commits and diff from repository
   # and save it to the database as serialized data
   def save_git_content
@@ -170,6 +182,21 @@ class MergeRequestDiff < ActiveRecord::Base
   end
 
   def diffs(diff_options = nil)
+    if without_files? && comparison = diff_refs.compare_in(project)
+      # It should fetch the repository when diffs are cleaned by the system.
+      # We don't keep these for storage overload purposes.
+      # See https://gitlab.com/gitlab-org/gitlab-ce/issues/37639
+      comparison.diffs(diff_options)
+    else
+      diffs_collection(diff_options)
+    end
+  end
+
+  # Should always return the DB persisted diffs collection
+  # (e.g. Gitlab::Diff::FileCollection::MergeRequestDiff.
+  # It's useful when trying to invalidate old caches through
+  # FileCollection::MergeRequestDiff#clear_cache!
+  def diffs_collection(diff_options = nil)
     Gitlab::Diff::FileCollection::MergeRequestDiff.new(self, diff_options: diff_options)
   end
 

app/models/namespace.rb

@@ -228,6 +228,10 @@ class Namespace < ActiveRecord::Base
     parent.present?
   end
 
+  def root_ancestor
+    ancestors.reorder(nil).find_by(parent_id: nil)
+  end
+
   def subgroup?
     has_parent?
   end

app/models/project.rb

@@ -2019,6 +2019,10 @@ class Project < ActiveRecord::Base
   end
   request_cache(:any_lfs_file_locks?) { self.id }
 
+  def auto_cancel_pending_pipelines?
+    auto_cancel_pending_pipelines == 'enabled'
+  end
+
   private
 
   def storage

app/models/project_auto_devops.rb

@@ -29,8 +29,8 @@ class ProjectAutoDevops < ActiveRecord::Base
       end
 
       if manual?
-        variables.append(key: 'STAGING_ENABLED', value: 1)
-        variables.append(key: 'INCREMENTAL_ROLLOUT_ENABLED', value: 1)
+        variables.append(key: 'STAGING_ENABLED', value: '1')
+        variables.append(key: 'INCREMENTAL_ROLLOUT_ENABLED', value: '1')
       end
     end
   end

app/models/project_team.rb

@@ -24,7 +24,7 @@ class ProjectTeam
   end
 
   def add_role(user, role, current_user: nil)
-    send(:"add_#{role}", user, current_user: current_user) # rubocop:disable GitlabSecurity/PublicSend
+    public_send(:"add_#{role}", user, current_user: current_user) # rubocop:disable GitlabSecurity/PublicSend
   end
 
   def find_member(user_id)

app/models/repository.rb

@@ -21,7 +21,7 @@ class Repository
   attr_accessor :full_path, :disk_path, :project, :is_wiki
 
   delegate :ref_name_for_sha, to: :raw_repository
-  delegate :bundle_to_disk, :create_from_bundle, to: :raw_repository
+  delegate :bundle_to_disk, to: :raw_repository
 
   CreateTreeError = Class.new(StandardError)
 

app/services/base_count_service.rb

@@ -17,7 +17,7 @@ class BaseCountService
   end
 
   def refresh_cache(&block)
-    Rails.cache.write(cache_key, block_given? ? yield : uncached_count, raw: raw?)
+    update_cache_for_key(cache_key, &block)
   end
 
   def uncached_count
@@ -41,4 +41,8 @@ class BaseCountService
   def cache_options
     { raw: raw? }
   end
+
+  def update_cache_for_key(key, &block)
+    Rails.cache.write(key, block_given? ? yield : uncached_count, raw: raw?)
+  end
 end

app/services/merge_requests/delete_non_latest_diffs_service.rb

+module MergeRequests
+  class DeleteNonLatestDiffsService
+    BATCH_SIZE = 10
+
+    def initialize(merge_request)
+      @merge_request = merge_request
+    end
+
+    def execute
+      diffs = @merge_request.non_latest_diffs.with_files
+
+      diffs.each_batch(of: BATCH_SIZE) do |relation, index|
+        ids = relation.pluck(:id).map { |id| [id] }
+        DeleteDiffFilesWorker.bulk_perform_in(index * 5.minutes, ids)
+      end
+    end
+  end
+end

app/services/merge_requests/merge_request_diff_cache_service.rb

-module MergeRequests
-  class MergeRequestDiffCacheService
-    def execute(merge_request, new_diff)
-      # Executing the iteration we cache all the highlighted diff information
-      merge_request.diffs.diff_files.to_a
-
-      # Remove cache for all diffs on this MR. Do not use the association on the
-      # model, as that will interfere with other actions happening when
-      # reloading the diff.
-      MergeRequestDiff.where(merge_request: merge_request).each do |merge_request_diff|
-        next if merge_request_diff == new_diff
-
-        merge_request_diff.diffs.clear_cache!
-      end
-    end
-  end
-end

app/services/merge_requests/post_merge_service.rb

@@ -15,6 +15,7 @@ module MergeRequests
       execute_hooks(merge_request, 'merge')
       invalidate_cache_counts(merge_request, users: merge_request.assignees)
       merge_request.update_project_counter_caches
+      delete_non_latest_diffs(merge_request)
     end
 
     private
@@ -31,6 +32,10 @@ module MergeRequests
       end
     end
 
+    def delete_non_latest_diffs(merge_request)
+      DeleteNonLatestDiffsService.new(merge_request).execute
+    end
+
     def create_merge_event(merge_request, current_user)
       EventCreateService.new.merge_mr(merge_request, current_user)
     end

app/services/merge_requests/reload_diffs_service.rb

+module MergeRequests
+  class ReloadDiffsService
+    def initialize(merge_request, current_user)
+      @merge_request = merge_request
+      @current_user = current_user
+    end
+
+    def execute
+      old_diff_refs = merge_request.diff_refs
+      new_diff = merge_request.create_merge_request_diff
+
+      clear_cache(new_diff)
+      update_diff_discussion_positions(old_diff_refs)
+    end
+
+    private
+
+    attr_reader :merge_request, :current_user
+
+    def update_diff_discussion_positions(old_diff_refs)
+      new_diff_refs = merge_request.diff_refs
+
+      merge_request.update_diff_discussion_positions(old_diff_refs: old_diff_refs,
+                                                     new_diff_refs: new_diff_refs,
+                                                     current_user: current_user)
+    end
+
+    def clear_cache(new_diff)
+      # Executing the iteration we cache highlighted diffs for each diff file of
+      # MergeRequestDiff.
+      new_diff.diffs_collection.diff_files.to_a
+
+      # Remove cache for all diffs on this MR. Do not use the association on the
+      # model, as that will interfere with other actions happening when
+      # reloading the diff.
+      MergeRequestDiff.where(merge_request: merge_request).each do |merge_request_diff|
+        next if merge_request_diff == new_diff
+
+        merge_request_diff.diffs_collection.clear_cache!
+      end
+    end
+  end
+end

app/services/projects/count_service.rb

@@ -22,8 +22,10 @@ module Projects
       )
     end
 
-    def cache_key
-      ['projects', 'count_service', VERSION, @project.id, cache_key_name]
+    def cache_key(key = nil)
+      cache_key = key || cache_key_name
+
+      ['projects', 'count_service', VERSION, @project.id, cache_key]
     end
 
     def self.query(project_ids)

app/services/projects/open_issues_count_service.rb

@@ -4,6 +4,10 @@ module Projects
   class OpenIssuesCountService < Projects::CountService
     include Gitlab::Utils::StrongMemoize
 
+    # Cache keys used to store issues count
+    PUBLIC_COUNT_KEY = 'public_open_issues_count'.freeze
+    TOTAL_COUNT_KEY = 'total_open_issues_count'.freeze
+
     def initialize(project, user = nil)
       @user = user
 
@@ -11,7 +15,7 @@ module Projects
     end
 
     def cache_key_name
-      public_only? ? 'public_open_issues_count' : 'total_open_issues_count'
+      public_only? ? PUBLIC_COUNT_KEY : TOTAL_COUNT_KEY
     end
 
     def public_only?
@@ -28,6 +32,32 @@ module Projects
       end
     end
 
+    def public_count_cache_key
+      cache_key(PUBLIC_COUNT_KEY)
+    end
+
+    def total_count_cache_key
+      cache_key(TOTAL_COUNT_KEY)
+    end
+
+    def refresh_cache(&block)
+      if block_given?
+        super(&block)
+      else
+        count_grouped_by_confidential = self.class.query(@project, public_only: false).group(:confidential).count
+        public_count = count_grouped_by_confidential[false] || 0
+        total_count = public_count + (count_grouped_by_confidential[true] || 0)
+
+        update_cache_for_key(public_count_cache_key) do
+          public_count
+        end
+
+        update_cache_for_key(total_count_cache_key) do
+          total_count
+        end
+      end
+    end
+
     # We only show total issues count for reporters
     # which are allowed to view confidential issues
     # This will still show a discrepancy on issues number but should be less than before.

app/services/web_hook_service.rb

@@ -82,7 +82,7 @@ class WebHookService
     post_url = hook.url.gsub("#{parsed_url.userinfo}@", '')
     basic_auth = {
       username: CGI.unescape(parsed_url.user),
-      password: CGI.unescape(parsed_url.password)
+      password: CGI.unescape(parsed_url.password.presence || '')
     }
     make_request(post_url, basic_auth)
   end

app/views/admin/application_settings/show.html.haml

@@ -324,3 +324,6 @@
       = _('Configure push mirrors.')
   .settings-content
     = render partial: 'repository_mirrors_form'
+
+= render_if_exists 'admin/application_settings/pseudonymizer_settings', expanded: expanded
+

app/views/admin/labels/_form.html.haml

@@ -10,16 +10,16 @@
     .col-sm-10
       = f.text_field :description, class: "form-control js-quick-submit"
   .form-group.row
-    = f.label :color, "Background color", class: 'col-form-label col-sm-2'
+    = f.label :color, _("Background color"), class: 'col-form-label col-sm-2'
     .col-sm-10
       .input-group
         .input-group-prepend
           .input-group-text.label-color-preview  
         = f.text_field :color, class: "form-control"
       .form-text.text-muted
-        Choose any color.
+        = _('Choose any color.')
         %br
-        Or you can choose one of the suggested colors below
+        = _("Or you can choose one of the suggested colors below")
 
       .suggest-colors
         - suggested_colors.each do |color|
@@ -27,5 +27,5 @@
              
 
   .form-actions
-    = f.submit 'Save', class: 'btn btn-save js-save-button'
-    = link_to "Cancel", admin_labels_path, class: 'btn btn-cancel'
+    = f.submit _('Save'), class: 'btn btn-save js-save-button'
+    = link_to _("Cancel"), admin_labels_path, class: 'btn btn-cancel'

app/views/admin/labels/_label.html.haml

@@ -3,5 +3,5 @@
     = render_colored_label(label, tooltip: false)
     = markdown_field(label, :description)
     .float-right
-      = link_to 'Edit', edit_admin_label_path(label), class: 'btn btn-sm'
-      = link_to 'Delete', admin_label_path(label), class: 'btn btn-sm btn-remove remove-row', method: :delete, remote: true, data: {confirm: "Delete this label? Are you sure?"}
+      = link_to _('Edit'), edit_admin_label_path(label), class: 'btn btn-sm'
+      = link_to _('Delete'), admin_label_path(label), class: 'btn btn-sm btn-remove remove-row', method: :delete, remote: true, data: {confirm: "Delete this label? Are you sure?"}

app/views/admin/labels/edit.html.haml

-- add_to_breadcrumbs "Labels", admin_labels_path
-- breadcrumb_title "Edit Label"
-- page_title "Edit", @label.name, "Labels"
+- add_to_breadcrumbs _("Labels"), admin_labels_path
+- breadcrumb_title _("Edit Label")
+- page_title _("Edit"), @label.name, _("Labels")
 %h3.page-title
-  Edit Label
+  = _('Edit Label')
 %hr
 = render 'form'

app/views/admin/labels/index.html.haml

-- page_title "Labels"
+- page_title _("Labels")
 
 %div
   = link_to new_admin_label_path, class: "float-right btn btn-nr btn-new" do
-    New label
+    = _('New label')
   %h3.page-title
-    Labels
+    = _('Labels')
 %hr
 
 .labels
@@ -14,5 +14,5 @@
     = paginate @labels, theme: 'gitlab'
   - else
     .card.bg-light
-      .nothing-here-block There are no labels yet
+      .nothing-here-block= _('There are no labels yet')
 

app/views/admin/labels/new.html.haml

-- page_title "New Label"
+- page_title _("New Label")
 %h3.page-title
-  New Label
+  = _('New Label')
 %hr
 = render 'form'

app/views/layouts/header/_current_user_dropdown.html.haml

@@ -17,6 +17,11 @@
       = link_to _("Help"), help_path
   - if current_user_menu?(:help) || current_user_menu?(:settings) || current_user_menu?(:profile)
     %li.divider
+  %li
+    = link_to "https://about.gitlab.com/contributing", target: '_blank', class: 'text-nowrap' do
+      = _("Contribute to GitLab")
+      = icon('external-link')
+  %li.divider
   - if current_user_menu?(:sign_out)
     %li
       = link_to _("Sign out"), destroy_user_session_path, class: "sign-out-link"

app/views/layouts/nav/sidebar/_project.html.haml

@@ -8,7 +8,7 @@
         .sidebar-context-title
           = @project.name
     %ul.sidebar-top-level-items
-      = nav_link(path: ['projects#show', 'projects#activity', 'cycle_analytics#show'], html_options: { class: 'home' }) do
+      = nav_link(path: sidebar_projects_paths, html_options: { class: 'home' }) do
         = link_to project_path(@project), class: 'shortcuts-project' do
           .nav-icon-container
             = sprite_icon('project')
@@ -29,13 +29,13 @@
             = link_to activity_project_path(@project), title: _('Activity'), class: 'shortcuts-project-activity' do
               %span= _('Activity')
 
+          = render_if_exists 'projects/sidebar/security_dashboard'
+
           - if can?(current_user, :read_cycle_analytics, @project)
             = nav_link(path: 'cycle_analytics#show') do
               = link_to project_cycle_analytics_path(@project), title: _('Cycle Analytics'), class: 'shortcuts-project-cycle-analytics' do
                 %span= _('Cycle Analytics')
 
-      = render_if_exists 'projects/sidebar/security_dashboard'
-
       - if project_nav_tab? :files
         = nav_link(controller: sidebar_repository_paths) do
           = link_to project_tree_path(@project), class: 'shortcuts-tree' do

app/views/profiles/keys/_form.html.haml

@@ -4,10 +4,12 @@
 
     .form-group
       = f.label :key, class: 'label-light'
-      = f.text_area :key, class: "form-control", rows: 8, required: true, placeholder: "Don't paste the private part of the SSH key. Paste the public part, which is usually contained in the file '~/.ssh/id_rsa.pub' and begins with 'ssh-rsa'."
+      %p= _("Paste your public SSH key, which is usually contained in the file '~/.ssh/id_rsa.pub' and begins with 'ssh-rsa'. Don't use your private SSH key.")
+      = f.text_area :key, class: "form-control", rows: 8, required: true, placeholder: 'Typically starts with "ssh-rsa …"'
     .form-group
       = f.label :title, class: 'label-light'
-      = f.text_field :title, class: "form-control", required: true
+      = f.text_field :title, class: "form-control", required: true, placeholder: 'e.g. My MacBook key'
+      %p.form-text.text-muted= _('Name your individual key via a title')
 
     .prepend-top-default
       = f.submit 'Add key', class: "btn btn-create"

app/views/profiles/keys/index.html.haml

@@ -11,10 +11,11 @@
     %h5.prepend-top-0
       Add an SSH key
     %p.profile-settings-content
-      Before you can add an SSH key you need to
-      = link_to "generate one", help_page_path("ssh/README", anchor: 'generating-a-new-ssh-key-pair')
-      or use an
-      = link_to "existing key.", help_page_path("ssh/README", anchor: 'locating-an-existing-ssh-key-pair')
+      - generate_link_url = help_page_path("ssh/README", anchor: 'generating-a-new-ssh-key-pair')
+      - existing_link_url = help_page_path("ssh/README", anchor: 'locating-an-existing-ssh-key-pair')
+      - generate_link_start = '<a href="%{url}" target="_blank" rel="noopener noreferrer">'.html_safe % { url: generate_link_url }
+      - existing_link_start = '<a href="%{url}" target="_blank" rel="noopener noreferrer">'.html_safe % { url: existing_link_url }
+      = _('To add an SSH key you need to %{generate_link_start}generate one%{link_end} or use an %{existing_link_start}existing key%{link_end}.').html_safe % { generate_link_start: generate_link_start, existing_link_start: existing_link_start, link_end: '</a>'.html_safe }
     = render 'form'
     %hr
     %h5

app/views/projects/clusters/_gcp_signup_offer_banner.html.haml

@@ -6,7 +6,7 @@
       = image_tag 'illustrations/logos/google-cloud-platform_logo.svg'
     .col-sm-10
       %h4= s_('ClusterIntegration|Redeem up to $500 in free credit for Google Cloud Platform')
-      %p= s_('ClusterIntegration|Every new Google Cloud Platform (GCP) account receives $300 in credit upon %{sign_up_link}. In partnership with Google, GitLab is able to offer an additional $200 for new GCP accounts to get started with GitLab\'s Google Kubernetes Engine Integration.').html_safe % { sign_up_link: link }
+      %p= s_('ClusterIntegration|Every new Google Cloud Platform (GCP) account receives $300 in credit upon %{sign_up_link}. In partnership with Google, GitLab is able to offer an additional $200 for both new and existing GCP accounts to get started with GitLab\'s Google Kubernetes Engine Integration.').html_safe % { sign_up_link: link }
       %a.btn.btn-info{ href: 'https://goo.gl/AaJzRW', target: '_blank', rel: 'noopener noreferrer' }
         Apply for credit
 

app/views/projects/deployments/_commit.html.haml

@@ -14,4 +14,4 @@
           = author_avatar(deployment.commit, size: 20)
           = link_to_markdown commit_title, project_commit_path(@project, deployment.sha), class: "commit-row-message"
         - else
-          Cant find HEAD commit for this branch
+          = _("Can't find HEAD commit for this branch")

app/views/projects/deployments/_deployment.html.haml

 .gl-responsive-table-row.deployment{ role: 'row' }
   .table-section.section-10{ role: 'gridcell' }
-    .table-mobile-header{ role: 'rowheader' } ID
+    .table-mobile-header{ role: 'rowheader' }= _("ID")
     %strong.table-mobile-content ##{deployment.iid}
 
   .table-section.section-30{ role: 'gridcell' }
-    .table-mobile-header{ role: 'rowheader' } Commit
+    .table-mobile-header{ role: 'rowheader' }= _("Commit")
     = render 'projects/deployments/commit', deployment: deployment
 
   .table-section.section-25.build-column{ role: 'gridcell' }
-    .table-mobile-header{ role: 'rowheader' } Job
+    .table-mobile-header{ role: 'rowheader' }= _("Job")
     - if deployment.deployable
       .table-mobile-content
         .flex-truncate-parent
@@ -21,7 +21,7 @@
             = user_avatar(user: deployment.user, size: 20)
 
   .table-section.section-15{ role: 'gridcell' }
-    .table-mobile-header{ role: 'rowheader' } Created
+    .table-mobile-header{ role: 'rowheader' }= _("Created")
     %span.table-mobile-content= time_ago_with_tooltip(deployment.created_at)
 
   .table-section.section-20.table-button-footer{ role: 'gridcell' }

app/views/projects/deployments/_rollback.haml

 - if can?(current_user, :create_deployment, deployment) && deployment.deployable
   = link_to [:retry, @project.namespace.becomes(Namespace), @project, deployment.deployable], method: :post, class: 'btn btn-build' do
     - if deployment.last?
-      Re-deploy
+      = _("Re-deploy")
     - else
-      Rollback
+      = _("Rollback")

app/views/projects/graphs/charts.html.haml

@@ -30,7 +30,7 @@
           #{@commits_graph.start_date.strftime('%b %d')}
         - end_time = capture do
           #{@commits_graph.end_date.strftime('%b %d')}
-        = (_("Commit statistics for %{ref} %{start_time} - %{end_time}") % { ref: "<strong>#{@ref}</strong>", start_time: start_time, end_time: end_time }).html_safe
+        = (_("Commit statistics for %{ref} %{start_time} - %{end_time}") % { ref: "<strong>#{h @ref}</strong>", start_time: start_time, end_time: end_time }).html_safe
 
     .col-md-6
       .tree-ref-container

app/views/projects/merge_requests/diffs/_diffs.html.haml

@@ -16,6 +16,6 @@
           %span.ref-name= @merge_request.target_branch
           .text-center= link_to 'Create commit', project_new_blob_path(@project, @merge_request.source_branch), class: 'btn btn-save'
 - else
-  - diff_viewable = @merge_request_diff ? @merge_request_diff.collected? || @merge_request_diff.overflow? : true
+  - diff_viewable = @merge_request_diff ? @merge_request_diff.viewable? : true
   - if diff_viewable
     = render "projects/diffs/diffs", diffs: @diffs, environment: @environment, merge_request: true

app/views/shared/boards/_show.html.haml

@@ -3,8 +3,8 @@
 - @no_breadcrumb_container = true
 - @no_container = true
 - @content_class = "issue-boards-content"
-- breadcrumb_title "Issue Board"
-- page_title "Boards"
+- breadcrumb_title _("Issue Board")
+- page_title _("Boards")
 
 - content_for :page_specific_javascripts do
 

app/views/shared/boards/components/_board.html.haml

@@ -30,7 +30,7 @@
           %board-delete{ "inline-template" => true,
             ":list" => "list",
             "v-if" => "!list.preset && list.id" }
-            %button.board-delete.has-tooltip.float-right{ type: "button", title: "Delete list", "aria-label" => "Delete list", data: { placement: "bottom" }, "@click.stop" => "deleteBoard" }
+            %button.board-delete.has-tooltip.float-right{ type: "button", title: _("Delete list"), "aria-label" => _("Delete list"), data: { placement: "bottom" }, "@click.stop" => "deleteBoard" }
               = icon("trash")
         .issue-count-badge.clearfix{ "v-if" => 'list.type !== "blank"' }
           %span.issue-count-badge-count.float-left{ ":class" => '{ "has-btn": list.type !== "closed" && !disabled }' }
@@ -39,8 +39,8 @@
             %button.issue-count-badge-add-button.btn.btn-sm.btn-default.has-tooltip.js-no-trigger-collapse{ type: "button",
               "@click" => "showNewIssueForm",
               "v-if" => 'list.type !== "closed"',
-              "aria-label" => "New issue",
-              "title" => "New issue",
+              "aria-label" => _("New issue"),
+              "title" => _("New issue"),
               data: { placement: "top", container: "body" } }
               = icon("plus", class: "js-no-trigger-collapse")
 

app/views/shared/boards/components/sidebar/_due_date.html.haml

 .block.due_date
   .title
-    Due date
+    = _("Due date")
     - if can_admin_issue?
       = icon("spinner spin", class: "block-loading")
-      = link_to "Edit", "#", class: "js-sidebar-dropdown-toggle edit-link float-right"
+      = link_to _("Edit"), "#", class: "js-sidebar-dropdown-toggle edit-link float-right"
   .value
     .value-content
       %span.no-value{ "v-if" => "!issue.dueDate" }
-        No due date
+        = _("No due date")
       %span.bold{ "v-if" => "issue.dueDate" }
         {{ issue.dueDate | due-date }}
       - if can_admin_issue?
         %span.no-value.js-remove-due-date-holder{ "v-if" => "issue.dueDate" }
           \-
           %a.js-remove-due-date{ href: "#", role: "button" }
-            remove due date
+            = _('remove due date')
   - if can_admin_issue?
     .selectbox
       %input{ type: "hidden",
@@ -23,9 +23,9 @@
       .dropdown
         %button.dropdown-menu-toggle.js-due-date-select.js-issue-boards-due-date{ type: 'button',
           data: { toggle: 'dropdown', field_name: "issue[due_date]", ability_name: "issue" } }
-          %span.dropdown-toggle-text Due date
+          %span.dropdown-toggle-text= _("Due date")
           = icon('chevron-down')
         .dropdown-menu.dropdown-menu-due-date
-          = dropdown_title('Due date')
+          = dropdown_title(_('Due date'))
           = dropdown_content do
             .js-due-date-calendar

app/views/shared/boards/components/sidebar/_labels.html.haml

 .block.labels
   .title
-    Labels
+    = _("Labels")
     - if can_admin_issue?
       = icon("spinner spin", class: "block-loading")
-      = link_to "Edit", "#", class: "js-sidebar-dropdown-toggle edit-link float-right"
+      = link_to _("Edit"), "#", class: "js-sidebar-dropdown-toggle edit-link float-right"
   .value.issuable-show-labels.dont-hide
     %span.no-value{ "v-if" => "issue.labels && issue.labels.length === 0" }
-      None
+      = _("None")
     %a{ href: "#",
       "v-for" => "label in issue.labels" }
       .badge.color-label.has-tooltip{ ":style" => "{ backgroundColor: label.color, color: label.textColor }" }
@@ -28,7 +28,7 @@
             namespace_path: @namespace_path,
             project_path: @project.try(:path) } }
           %span.dropdown-toggle-text
-            Label
+            = _("Label")
           = icon('chevron-down')
         .dropdown-menu.dropdown-select.dropdown-menu-paging.dropdown-menu-labels.dropdown-menu-selectable
           = render partial: "shared/issuable/label_page_default"

app/views/shared/boards/components/sidebar/_milestone.html.haml

 .block.milestone
   .title
-    Milestone
+    = _("Milestone")
     - if can_admin_issue?
       = icon("spinner spin", class: "block-loading")
-      = link_to "Edit", "#", class: "js-sidebar-dropdown-toggle edit-link float-right"
+      = link_to _("Edit"), "#", class: "js-sidebar-dropdown-toggle edit-link float-right"
   .value
     %span.no-value{ "v-if" => "!issue.milestone" }
-      None
+      = _("None")
     %span.bold.has-tooltip{ "v-if" => "issue.milestone" }
       {{ issue.milestone.title }}
   - if can_admin_issue?
@@ -19,10 +19,10 @@
         %button.dropdown-menu-toggle.js-milestone-select.js-issue-board-sidebar{ type: "button", data: { toggle: "dropdown", show_no: "true", field_name: "issue[milestone_id]", milestones: milestones_filter_path(format: :json), ability_name: "issue", use_id: "true", default_no: "true" },
           ":data-selected" => "milestoneTitle",
           ":data-issuable-id" => "issue.iid" }
-          Milestone
+          = _("Milestone")
           = icon("chevron-down")
         .dropdown-menu.dropdown-select.dropdown-menu-selectable
-          = dropdown_title("Assign milestone")
-          = dropdown_filter("Search milestones")
+          = dropdown_title(_("Assign milestone"))
+          = dropdown_filter(_("Search milestones"))
           = dropdown_content
           = dropdown_loading

app/views/shared/notes/_form.html.haml

@@ -40,5 +40,5 @@
 
       = yield(:note_actions)
 
-      %a.btn.btn-cancel.js-note-discard{ role: "button", data: {cancel_text: "Cancel" } }
+      %a.btn.btn-cancel.js-note-discard{ role: "button", data: {cancel_text: "Discard draft" } }
         Discard draft

app/views/shared/tokens/_scopes_form.html.haml

@@ -6,5 +6,4 @@
   %fieldset
     = check_box_tag "#{prefix}[scopes][]", scope, token.scopes.include?(scope), id: "#{prefix}_scopes_#{scope}"
     = label_tag ("#{prefix}_scopes_#{scope}"), scope, class: "label-light"
-    %span= t(scope, scope: [:doorkeeper, :scopes])
     .scope-description= t scope, scope: [:doorkeeper, :scope_desc]

app/views/u2f/_authenticate.html.haml

@@ -2,9 +2,6 @@
 %a.btn.btn-block.btn-info#js-login-2fa-device{ href: '#' } Sign in via 2FA code
 
 -# haml-lint:disable InlineJavaScript
-%script#js-authenticate-u2f-not-supported{ type: "text/template" }
-  %p Your browser doesn't support U2F. Please use Google Chrome desktop (version 41 or newer).
-
 %script#js-authenticate-u2f-in-progress{ type: "text/template" }
   %p Trying to communicate with your device. Plug it in (if you haven't already) and press the button on the device now.
 

app/workers/all_queues.yml

@@ -118,3 +118,4 @@
 - web_hook
 - repository_update_remote_mirror
 - create_note_diff_file
+- delete_diff_files

app/workers/delete_diff_files_worker.rb

+class DeleteDiffFilesWorker
+  include ApplicationWorker
+
+  def perform(merge_request_diff_id)
+    merge_request_diff = MergeRequestDiff.find(merge_request_diff_id)
+
+    return if merge_request_diff.without_files?
+
+    MergeRequestDiff.transaction do
+      merge_request_diff.clean!
+
+      MergeRequestDiffFile
+        .where(merge_request_diff_id: merge_request_diff.id)
+        .delete_all
+    end
+  end
+end

bin/changelog

@@ -19,7 +19,24 @@ Options = Struct.new(
 )
 INVALID_TYPE = -1
 
+module ChangelogHelpers
+  Abort = Class.new(StandardError)
+  Done = Class.new(StandardError)
+
+  def capture_stdout(cmd)
+    output = IO.popen(cmd, &:read)
+    fail_with "command failed: #{cmd.join(' ')}" unless $?.success?
+    output
+  end
+
+  def fail_with(message)
+    raise Abort, "\e[31merror\e[0m #{message}"
+  end
+end
+
 class ChangelogOptionParser
+  extend ChangelogHelpers
+
   Type = Struct.new(:name, :description)
   TYPES = [
     Type.new('added', 'New feature'),
@@ -68,7 +85,7 @@ class ChangelogOptionParser
 
         opts.on('-h', '--help', 'Print help message') do
           $stdout.puts opts
-          exit
+          raise Done.new
         end
       end
 
@@ -108,18 +125,19 @@ class ChangelogOptionParser
 
     def assert_valid_type!(type)
       unless type
-        $stderr.puts "Invalid category index, please select an index between 1 and #{TYPES.length}"
-        exit 1
+        raise Abort, "Invalid category index, please select an index between 1 and #{TYPES.length}"
       end
     end
 
     def git_user_name
-      %x{git config user.name}.strip
+      capture_stdout(%w[git config user.name]).strip
     end
   end
 end
 
 class ChangelogEntry
+  include ChangelogHelpers
+
   attr_reader :options
 
   def initialize(options)
@@ -159,13 +177,9 @@ class ChangelogEntry
   end
 
   def amend_commit
-    %x{git add #{file_path}}
-    exec("git commit --amend")
-  end
+    fail_with "git add failed" unless system(*%W[git add #{file_path}])
 
-  def fail_with(message)
-    $stderr.puts "\e[31merror\e[0m #{message}"
-    exit 1
+    Kernel.exec(*%w[git commit --amend])
   end
 
   def assert_feature_branch!
@@ -203,7 +217,7 @@ class ChangelogEntry
   end
 
   def last_commit_subject
-    %x{git log --format="%s" -1}.strip
+    capture_stdout(%w[git log --format=%s -1]).strip
   end
 
   def file_path
@@ -225,7 +239,7 @@ class ChangelogEntry
   end
 
   def branch_name
-    @branch_name ||= %x{git symbolic-ref --short HEAD}.strip
+    @branch_name ||= capture_stdout(%w[git symbolic-ref --short HEAD]).strip
   end
 
   def remove_trailing_whitespace(yaml_content)
@@ -234,8 +248,15 @@ class ChangelogEntry
 end
 
 if $0 == __FILE__
-  options = ChangelogOptionParser.parse(ARGV)
-  ChangelogEntry.new(options)
+  begin
+    options = ChangelogOptionParser.parse(ARGV)
+    ChangelogEntry.new(options)
+  rescue ChangelogHelpers::Abort => ex
+    $stderr.puts ex.message
+    exit 1
+  rescue ChangelogHelpers::Done
+    exit
+  end
 end
 
 # vim: ft=ruby

changelogs/unreleased/40005-u2f-unspported-browsers.yml

+---
+title: Improve U2F workflow when using unsupported browsers
+merge_request: 19938
+author: Jan Beckmann
+type: changed

changelogs/unreleased/45933-webide-fade-uneditable-area.yml

+---
+title: Fade uneditable area in Web IDE
+merge_request: 20008
+author:
+type: changed

changelogs/unreleased/46202-webide-file-states.yml

+---
+title: Update Web IDE file tree styles
+merge_request: 19969
+author:
+type: changed

changelogs/unreleased/46396-recognise-when-a-user-is-trying-to-validate-a-private-ssh-key-part-1.yml

+---
+title: Update new SSH key page to improve copy
+merge_request: 19994
+author:
+type: other

changelogs/unreleased/46571-webhooks-nil-password.yml

+---
+title: Fix webhook error when password is not present
+merge_request: 19945
+author: Jan Beckmann
+type: fixed