NixOS · Oct 31, 2019 · Oct 31, 2019 · Oct 31, 2019 · Oct 31, 2019 · Oct 31, 2019
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
@@ -610,6 +610,8 @@ in {
     # objects owners and extensions; for now we tack on what's needed
     # here.
     systemd.services.postgresql.postStart = mkAfter (optionalString databaseActuallyCreateLocally ''
+      set -eu
+
       $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${cfg.databaseName}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${cfg.databaseName}" OWNER "${cfg.databaseUsername}"'
       current_owner=$($PSQL -tAc "SELECT pg_catalog.pg_get_userbyid(datdba) FROM pg_catalog.pg_database WHERE datname = '${cfg.databaseName}'")
       if [[ "$current_owner" != "${cfg.databaseUsername}" ]]; then
@@ -741,7 +743,6 @@ in {
         gitlab-workhorse
       ];
       serviceConfig = {
-        PermissionsStartOnly = true; # preStart must be run as root
         Type = "simple";
         User = cfg.user;
         Group = cfg.group;
@@ -783,13 +784,18 @@ in {
         ExecStartPre = let
           preStartFullPrivileges = ''
             shopt -s dotglob nullglob
+            set -eu
+
             chown --no-dereference '${cfg.user}':'${cfg.group}' '${cfg.statePath}'/*
             chown --no-dereference '${cfg.user}':'${cfg.group}' '${cfg.statePath}'/config/*
           '';
           preStart = ''
+            set -eu
+
             cp -f ${cfg.packages.gitlab}/share/gitlab/VERSION ${cfg.statePath}/VERSION
             rm -rf ${cfg.statePath}/db/*
             rm -rf ${cfg.statePath}/config/initializers/*
+            rm -f ${cfg.statePath}/lib
             cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/config.dist/* ${cfg.statePath}/config
             cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/db/* ${cfg.statePath}/db
 

diff --git a/pkgs/applications/graphics/ImageMagick/7.0.nix b/pkgs/applications/graphics/ImageMagick/7.0.nix
@@ -13,8 +13,8 @@ let
     else throw "ImageMagick is not supported on this platform.";
 
   cfg = {
-    version = "7.0.8-58";
-    sha256 = "0yfw32nydwy7ag7ina1zc6yssa146x4v35hjv6v59bci9mmj9fb1";
+    version = "7.0.9-0";
+    sha256 = "1w7ci7v5qlayd7a5z69px94fz3fshvn1diqw7k1ymsyvz5888d39";
     patches = [];
   };
 in

diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -13,8 +13,8 @@ let
     else throw "ImageMagick is not supported on this platform.";
 
   cfg = {
-    version = "6.9.10-68";
-    sha256 = "0ldkw6j4x0k7l6ykgpx9hz9cs7dmlapz2lv3lbrgz2nn9znqswxk";
+    version = "6.9.10-69";
+    sha256 = "0l4lllis16gbwjpvvsyfz91i9nq11zb3lg2zlmyay7v5697jshh6";
     patches = [];
   }
     # Freeze version on mingw so we don't need to port the patch too often.

diff --git a/pkgs/applications/misc/kitty/default.nix b/pkgs/applications/misc/kitty/default.nix
@@ -79,9 +79,9 @@ buildPythonApplication rec {
   '';
 
   buildPhase = if stdenv.isDarwin then ''
-    make app
+    ${python.interpreter} setup.py kitty.app --update-check-interval=0
   '' else ''
-    ${python.interpreter} setup.py linux-package
+    ${python.interpreter} setup.py linux-package --update-check-interval=0
   '';
 
   installPhase = ''

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -127,9 +127,9 @@ let
       ./patches/nix_plugin_paths_68.patch
       ./patches/remove-webp-include-69.patch
       ./patches/no-build-timestamps.patch
-    ] ++ optionals (channel == "stable" || channel == "beta") [
+    ] ++ optionals (channel == "stable") [
       ./patches/widevine.patch
-    ] ++ optionals (channel == "dev") [
+    ] ++ optionals (channel == "beta" || channel == "dev") [
       ./patches/widevine-79.patch
       # Unfortunately, chromium regularly breaks on major updates and
       # then needs various patches backported in order to be compiled with GCC.

diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
@@ -1,13 +1,13 @@
 {
-  "version": "12.3.5",
-  "repo_hash": "12ywspgnbwm232vmzbqhkqmwmcrb9pvihsayzmw0cxvhlfwq6995",
+  "version": "12.4.1",
+  "repo_hash": "0dmb8ds6c5paxg35nricaywfhsgmp5rr46kk21hy2hsddgwkyb4k",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v12.3.5-ee",
+  "rev": "v12.4.1-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "1.65.1",
-    "GITLAB_PAGES_VERSION": "1.9.0",
-    "GITLAB_SHELL_VERSION": "10.0.0",
-    "GITLAB_WORKHORSE_VERSION": "8.10.0"
+    "GITALY_SERVER_VERSION": "1.67.0",
+    "GITLAB_PAGES_VERSION": "1.11.0",
+    "GITLAB_SHELL_VERSION": "10.2.0",
+    "GITLAB_WORKHORSE_VERSION": "8.14.0"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -17,14 +17,14 @@ let
       };
   };
 in buildGoPackage rec {
-  version = "1.65.1";
+  version = "1.67.0";
   pname = "gitaly";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "1a39i723na2xk4363a7v48ba23vi04qpg0119dw09g13m0k5hjc3";
+    sha256 = "1mj2l15hnxwqmyc8xn79d6qpmpqbqw2ishalr8qvn83nzdsbk8l3";
   };
 
   goPackagePath = "gitlab.com/gitlab-org/gitaly";

diff --git a/pkgs/applications/version-management/gitlab/gitaly/deps.nix b/pkgs/applications/version-management/gitlab/gitaly/deps.nix
diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/Gemfile b/pkgs/applications/version-management/gitlab/gitlab-shell/Gemfile
diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/Gemfile.lock b/pkgs/applications/version-management/gitlab/gitlab-shell/Gemfile.lock
diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@@ -1,65 +1,25 @@
-{ stdenv, ruby, bundler, fetchFromGitLab, buildGoPackage, bundlerEnv }:
+{ stdenv, fetchFromGitLab, buildGoPackage, ruby }:
 
-let
-  version = "10.0.0";
+buildGoPackage rec {
+  pname = "gitlab-shell-go";
+  version = "10.2.0";
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "0n1llkb0jrqxm10l9wqmqxjycydqphgz0chbbf395d8pywyz826x";
+    sha256 = "1mpzsdqd8mlsh8wccz4s8415w080z55lnifn7l7vd5rflpnyfhcj";
   };
-  rubyEnv = bundlerEnv {
-    name = "gitlab-shell-env";
-    inherit ruby;
-    gemdir = ./.;
-  };
-  goPackage = buildGoPackage {
-    pname = "gitlab-shell-go";
-    inherit src version;
-
-    patches = [ ./remove-hardcoded-locations-go.patch ];
-
-    goPackagePath = "gitlab.com/gitlab-org/gitlab-shell";
-    goDeps = ./deps.nix;
-
-    # gitlab-shell depends on an older version of gitaly which
-    # contains old, vendored versions of some packages; gitlab-shell
-    # also explicitly depends on newer versions of these libraries,
-    # but buildGoPackage exposes the vendored versions instead,
-    # leading to compilation errors. Since the vendored libraries
-    # aren't used here anyway, we'll just remove them.
-    postConfigure = ''
-      rm -r "$NIX_BUILD_TOP/go/src/gitlab.com/gitlab-org/gitaly/vendor/"
-    '';
-  };
-in
-stdenv.mkDerivation {
-  pname = "gitlab-shell";
-  inherit src version;
-
-  patches = [ ./remove-hardcoded-locations-ruby.patch ];
-
-  # gitlab-shell will try to read its config relative to the source
-  # code by default which doesn't work in nixos because it's a
-  # read-only filesystem
-  postPatch = ''
-    substituteInPlace lib/gitlab_config.rb --replace \
-    "File.join(ROOT_PATH, 'config.yml')" \
-    "'/run/gitlab/shell-config.yml'"
-  '';
-
-  buildInputs = [ rubyEnv.wrappedRuby ];
 
-  dontBuild = true;
+  buildInputs = [ ruby ];
 
-  installPhase = ''
-    runHook preInstall
+  patches = [ ./remove-hardcoded-locations.patch ];
 
-    mkdir -p $out/
-    cp -R . $out/
-    cp ${goPackage.bin}/bin/* $out/bin/
+  goPackagePath = "gitlab.com/gitlab-org/gitlab-shell";
+  goDeps = ./deps.nix;
 
-    runHook postInstall
+  postInstall = ''
+    cp -r "$NIX_BUILD_TOP/go/src/$goPackagePath"/bin/* $bin/bin
+    cp -r "$NIX_BUILD_TOP/go/src/$goPackagePath"/{support,VERSION} $bin/
   '';
 
   meta = with stdenv.lib; {

diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/deps.nix b/pkgs/applications/version-management/gitlab/gitlab-shell/deps.nix
diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/gemset.nix b/pkgs/applications/version-management/gitlab/gitlab-shell/gemset.nix
diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations-go.patch b/pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations-go.patch
diff --git a/...applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations-ruby.patch b/...applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations-ruby.patch
diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations.patch b/pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations.patch
@@ -0,0 +1,57 @@
+diff --git a/go/internal/config/config.go b/go/internal/config/config.go
+index 2231851..c869930 100644
+--- a/go/internal/config/config.go
++++ b/go/internal/config/config.go
+@@ -3,7 +3,6 @@ package config
+ import (
+ 	"io/ioutil"
+ 	"net/url"
+-	"os"
+ 	"path"
+ 	"path/filepath"
+
+@@ -38,16 +37,13 @@ type Config struct {
+ }
+
+ func New() (*Config, error) {
+-	dir, err := os.Getwd()
+-	if err != nil {
+-		return nil, err
+-	}
++	dir := "/run/gitlab"
+
+ 	return NewFromDir(dir)
+ }
+
+ func NewFromDir(dir string) (*Config, error) {
+-	return newFromFile(path.Join(dir, configFile))
++	return newFromFile("/run/gitlab/shell-config.yml")
+ }
+
+ func newFromFile(filename string) (*Config, error) {
+diff --git a/go/internal/keyline/key_line.go b/go/internal/keyline/key_line.go
+index f92f50b..160e287 100644
+--- a/go/internal/keyline/key_line.go
++++ b/go/internal/keyline/key_line.go
+@@ -36,7 +36,7 @@ func NewPrincipalKeyLine(keyId string, principal string, rootDir string) (*KeyLi
+ }
+
+ func (k *KeyLine) ToString() string {
+-	command := fmt.Sprintf("%s %s-%s", path.Join(k.RootDir, executable.BinDir, executable.GitlabShell), k.Prefix, k.Id)
++	command := fmt.Sprintf("%s %s-%s", path.Join("/run/current-system/sw/bin", executable.GitlabShell), k.Prefix, k.Id)
+
+ 	return fmt.Sprintf(`command="%s",%s %s`, command, SshOptions, k.Value)
+ }
+diff --git a/support/gitlab_config.rb b/support/gitlab_config.rb
+index 1416488..90a5f79 100644
+--- a/support/gitlab_config.rb
++++ b/support/gitlab_config.rb
+@@ -4,7 +4,7 @@ class GitlabConfig
+   attr_reader :config
+
+   def initialize
+-    @config = YAML.load_file(File.join(ROOT_PATH, 'config.yml'))
++    @config = YAML.load_file('/run/gitlab/shell-config.yml')
+   end
+
+   def auth_file
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -3,20 +3,19 @@
 buildGoPackage rec {
   pname = "gitlab-workhorse";
 
-  version = "8.10.0";
+  version = "8.14.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-workhorse";
     rev = "v${version}";
-    sha256 = "11cfhh48dga5ghfcijb68gbx0nfr5bs3vvp2j1gam9ac37fpvk0x";
+    sha256 = "1cqx75h4x4chjvp72kzbln8qkm5p7p2w7x8bdd99g38kf21wxxaq";
   };
 
   goPackagePath = "gitlab.com/gitlab-org/gitlab-workhorse";
   goDeps = ./deps.nix;
   buildInputs = [ git ];
-
-  makeFlags = [ "PREFIX=$(out)" "VERSION=${version}" "GOCACHE=$(TMPDIR)/go-cache" ];
+  buildFlagsArray = "-ldflags=-X main.Version=${version}";
 
   # gitlab-workhorse depends on an older version of labkit which
   # contains old, vendored versions of some packages; gitlab-workhorse

diff --git a/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch b/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
@@ -150,3 +150,14 @@ index b276a81eac..070e3ebd81 100644
        end
      end
    end
+--- a/lib/gitlab/authorized_keys.rb
++++ b/lib/gitlab/authorized_keys.rb
+@@ -157,7 +157,7 @@
+         raise KeyError, "Invalid ID: #{id.inspect}"
+       end
+
+-      "#{File.join(Gitlab.config.gitlab_shell.path, 'bin', 'gitlab-shell')} #{id}"
++      "#{File.join('/run/current-system/sw/bin', 'gitlab-shell')} #{id}"
+     end
+
+     def strip(key)
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@@ -87,9 +87,9 @@ gem 'rack-cors', '~> 1.0.0', require: 'rack/cors'
 
 # GraphQL API
 gem 'graphql', '~> 1.9.11'
-# NOTE: graphiql-rails v1.5+ doesn't work: https://gitlab.com/gitlab-org/gitlab-ce/issues/67293
+# NOTE: graphiql-rails v1.5+ doesn't work: https://gitlab.com/gitlab-org/gitlab/issues/31771
 # TODO: remove app/views/graphiql/rails/editors/show.html.erb when https://github.com/rmosolgo/graphiql-rails/pull/71 is released:
-# https://gitlab.com/gitlab-org/gitlab-ce/issues/67263
+# https://gitlab.com/gitlab-org/gitlab/issues/31747
 gem 'graphiql-rails', '~> 1.4.10'
 gem 'apollo_upload_server', '~> 2.0.0.beta3'
 gem 'graphql-docs', '~> 1.6.0', group: [:development, :test]
@@ -148,7 +148,7 @@ gem 'wikicloth', '0.8.1'
 gem 'asciidoctor', '~> 2.0.10'
 gem 'asciidoctor-include-ext', '~> 0.3.1', require: false
 gem 'asciidoctor-plantuml', '0.0.9'
-gem 'rouge', '~> 3.7'
+gem 'rouge', '~> 3.11.0'
 gem 'truncato', '~> 0.7.11'
 gem 'bootstrap_form', '~> 4.2.0'
 gem 'nokogiri', '~> 1.10.4'
@@ -311,7 +311,7 @@ gem 'gettext', '~> 3.2.2', require: false, group: :development
 gem 'batch-loader', '~> 1.4.0'
 
 # Perf bar
-# https://gitlab.com/gitlab-org/gitlab-ee/issues/13996
+# https://gitlab.com/gitlab-org/gitlab/issues/13996
 gem 'gitlab-peek', '~> 0.0.1', require: 'peek'
 
 # Snowplow events tracking
@@ -355,7 +355,7 @@ group :development, :test do
   gem 'fuubar', '~> 2.2.0'
 
   gem 'database_cleaner', '~> 1.7.0'
-  gem 'factory_bot_rails', '~> 4.8.2'
+  gem 'factory_bot_rails', '~> 5.1.0'
   gem 'rspec-rails', '~> 3.8.0'
   gem 'rspec-retry', '~> 0.6.1'
   gem 'rspec_profiling', '~> 0.0.5'
@@ -405,7 +405,7 @@ group :test do
   gem 'webmock', '~> 3.5.1'
   gem 'rails-controller-testing'
   gem 'concurrent-ruby', '~> 1.1'
-  gem 'test-prof', '~> 0.2.5'
+  gem 'test-prof', '~> 0.10.0'
   gem 'rspec_junit_formatter'
 end
 
@@ -446,7 +446,7 @@ group :ed25519 do
 end
 
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 1.58.0'
+gem 'gitaly', '~> 1.65.0'
 
 gem 'grpc', '~> 1.19.0'
 
@@ -465,7 +465,7 @@ gem 'lograge', '~> 0.5'
 gem 'grape_logging', '~> 1.7'
 
 # DNS Lookup
-gem 'net-dns', '~> 0.9.0'
+gem 'gitlab-net-dns', '~> 0.9.1'
 
 # Countries list
 gem 'countries', '~> 3.0'
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -108,7 +108,7 @@ GEM
     binding_ninja (0.2.3)
     binding_of_caller (0.8.0)
       debug_inspector (>= 0.0.1)
-    bootsnap (1.4.4)
+    bootsnap (1.4.5)
       msgpack (~> 1.0)
     bootstrap_form (4.2.0)
       actionpack (>= 5.0)
@@ -209,10 +209,10 @@ GEM
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
     device_detector (1.0.0)
-    devise (4.6.2)
+    devise (4.7.1)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
-      railties (>= 4.1.0, < 6.0)
+      railties (>= 4.1.0)
       responders
       warden (~> 1.2.3)
     devise-two-factor (3.0.0)
@@ -254,7 +254,7 @@ GEM
       mail (~> 2.7)
     encryptor (3.0.0)
     equalizer (0.0.11)
-    erubi (1.8.0)
+    erubi (1.9.0)
     escape_utils (1.2.1)
     et-orbi (1.2.1)
       tzinfo
@@ -264,11 +264,11 @@ GEM
     expression_parser (0.9.0)
     extended-markdown-filter (0.6.0)
       html-pipeline (~> 2.0)
-    factory_bot (4.8.2)
-      activesupport (>= 3.0.0)
-    factory_bot_rails (4.8.2)
-      factory_bot (~> 4.8.2)
-      railties (>= 3.0.0)
+    factory_bot (5.1.0)
+      activesupport (>= 4.2.0)
+    factory_bot_rails (5.1.0)
+      factory_bot (~> 5.1.0)
+      railties (>= 4.2.0)
     faraday (0.12.2)
       multipart-post (>= 1.2, < 3)
     faraday-http-cache (2.0.0)
@@ -358,7 +358,7 @@ GEM
       po_to_json (>= 1.0.0)
       rails (>= 3.2.0)
     git (1.5.0)
-    gitaly (1.58.0)
+    gitaly (1.65.0)
       grpc (~> 1.0)
     github-markup (1.7.0)
     gitlab-labkit (0.5.2)
@@ -370,6 +370,7 @@ GEM
       redis (> 3.0.0, < 5.0.0)
     gitlab-license (1.0.0)
     gitlab-markup (1.7.0)
+    gitlab-net-dns (0.9.1)
     gitlab-peek (0.0.1)
       railties (>= 4.0.0)
     gitlab-sidekiq-fetcher (0.5.2)
@@ -487,7 +488,7 @@ GEM
       mime-types (~> 3.0)
       multi_xml (>= 0.5.2)
     httpclient (2.8.3)
-    i18n (1.6.0)
+    i18n (1.7.0)
       concurrent-ruby (~> 1.0)
     i18n_data (0.8.0)
     icalendar (2.4.1)
@@ -565,7 +566,7 @@ GEM
       activesupport (>= 4)
       railties (>= 4)
       request_store (~> 1.0)
-    loofah (2.2.3)
+    loofah (2.3.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     mail (2.7.1)
@@ -586,7 +587,7 @@ GEM
     mini_mime (1.0.1)
     mini_portile2 (2.4.0)
     minitest (5.11.3)
-    msgpack (1.3.0)
+    msgpack (1.3.1)
     multi_json (1.13.1)
     multi_xml (0.6.0)
     multipart-post (2.0.0)
@@ -596,7 +597,6 @@ GEM
       mustermann (~> 1.0.0)
     nakayoshi_fork (0.0.4)
     nap (1.1.0)
-    net-dns (0.9.0)
     net-ldap (0.16.0)
     net-ntp (2.1.3)
     net-ssh (5.2.0)
@@ -770,8 +770,8 @@ GEM
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.2.0)
-      loofah (~> 2.2, >= 2.2.2)
+    rails-html-sanitizer (1.3.0)
+      loofah (~> 2.3)
     rails-i18n (5.1.1)
       i18n (>= 0.7, < 2)
       railties (>= 5.0, < 6)
@@ -783,7 +783,7 @@ GEM
       thor (>= 0.19.0, < 2.0)
     rainbow (3.0.0)
     raindrops (0.19.0)
-    rake (12.3.2)
+    rake (12.3.3)
     rb-fsevent (0.10.2)
     rb-inotify (0.9.10)
       ffi (>= 0.5.0, < 2)
@@ -824,17 +824,17 @@ GEM
       declarative-option (< 0.2.0)
       uber (< 0.2.0)
     request_store (1.3.1)
-    responders (2.4.0)
-      actionpack (>= 4.2.0, < 5.3)
-      railties (>= 4.2.0, < 5.3)
+    responders (2.4.1)
+      actionpack (>= 4.2.0, < 6.0)
+      railties (>= 4.2.0, < 6.0)
     rest-client (2.0.2)
       http-cookie (>= 1.0.2, < 2.0)
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
     retriable (3.1.2)
     rinku (2.0.0)
     rotp (2.1.2)
-    rouge (3.7.0)
+    rouge (3.11.0)
     rqrcode (0.7.0)
       chunky_png
     rqrcode-rails3 (0.1.7)
@@ -994,7 +994,7 @@ GEM
     temple (0.8.1)
     terminal-table (1.8.0)
       unicode-display_width (~> 1.1, >= 1.1.1)
-    test-prof (0.2.5)
+    test-prof (0.10.0)
     text (1.3.1)
     thin (1.7.2)
       daemons (~> 1.0, >= 1.0.9)
@@ -1058,8 +1058,8 @@ GEM
       descendants_tracker (~> 0.0, >= 0.0.3)
       equalizer (~> 0.0, >= 0.0.9)
     vmstat (2.3.0)
-    warden (1.2.7)
-      rack (>= 1.0)
+    warden (1.2.8)
+      rack (>= 2.0.6)
     webfinger (1.1.0)
       activesupport
       httpclient (>= 2.4)
@@ -1144,7 +1144,7 @@ DEPENDENCIES
   email_reply_trimmer (~> 0.1)
   email_spec (~> 2.2.0)
   escape_utils (~> 1.1)
-  factory_bot_rails (~> 4.8.2)
+  factory_bot_rails (~> 5.1.0)
   faraday (~> 0.12)
   faraday_middleware-aws-signers-v4
   fast_blank
@@ -1168,11 +1168,12 @@ DEPENDENCIES
   gettext (~> 3.2.2)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 1.58.0)
+  gitaly (~> 1.65.0)
   github-markup (~> 1.7.0)
   gitlab-labkit (~> 0.5)
   gitlab-license (~> 1.0)
   gitlab-markup (~> 1.7.0)
+  gitlab-net-dns (~> 0.9.1)
   gitlab-peek (~> 0.0.1)
   gitlab-sidekiq-fetcher (= 0.5.2)
   gitlab-styles (~> 2.7)
@@ -1222,7 +1223,6 @@ DEPENDENCIES
   mini_magick
   minitest (~> 5.11.0)
   nakayoshi_fork (~> 0.0.4)
-  net-dns (~> 0.9.0)
   net-ldap
   net-ntp
   net-ssh (~> 5.2)
@@ -1276,7 +1276,7 @@ DEPENDENCIES
   redis-rails (~> 5.0.2)
   request_store (~> 1.3)
   responders (~> 2.0)
-  rouge (~> 3.7)
+  rouge (~> 3.11.0)
   rqrcode-rails3 (~> 0.1.7)
   rspec-parameterized
   rspec-rails (~> 3.8.0)
@@ -1314,7 +1314,7 @@ DEPENDENCIES
   stackprof (~> 0.2.10)
   state_machines-activerecord (~> 0.5.1)
   sys-filesystem (~> 1.1.6)
-  test-prof (~> 0.2.5)
+  test-prof (~> 0.10.0)
   thin (~> 1.7.0)
   timecop (~> 0.8.0)
   toml-rb (~> 1.0.0)

diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@@ -482,10 +482,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1jcc0x0l3jqap8r8l1j994ljh93c8hcppm59mjzpa0hdvprh23av";
+      sha256 = "0dyjk2irr0d3d3am2dzipg1zyv2nz69a16g8xkprxfa0na07wvs0";
       type = "gem";
     };
-    version = "1.4.4";
+    version = "1.4.5";
   };
   bootstrap_form = {
     dependencies = ["actionpack" "activemodel"];
@@ -975,10 +975,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04b2p61mqfb6ln8s2lhmvnkd45wjjinykbn9svmhs54kacrrjkcf";
+      sha256 = "0a64xq0dj6p0firpg4mrrfmlakpv17hky5yfrjhchs2sybmymr9i";
       type = "gem";
     };
-    version = "4.6.2";
+    version = "4.7.1";
   };
   devise-two-factor = {
     dependencies = ["activesupport" "attr_encrypted" "devise" "railties" "rotp"];
@@ -1175,10 +1175,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kagnf6ziahj0d781s6ryy6fwqwa3ad4xbzzj84p9m4nv4c2jir1";
+      sha256 = "1nwzxnqhr31fn7nbqmffcysvxjdfl3bhxi0bld5qqhcnfc1xd13x";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "1.9.0";
   };
   escape_utils = {
     groups = ["default" "development" "test"];
@@ -1258,21 +1258,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r975ba6y0mcy3aya099gpnjn5gf1h6fbw8f3smmjay5zvin3nwx";
+      sha256 = "04mvwcdh1056r79vq969vlncrcy53fkhw0iixpqvp8gnx5ajbsv6";
       type = "gem";
     };
-    version = "4.8.2";
+    version = "5.1.0";
   };
   factory_bot_rails = {
     dependencies = ["factory_bot" "railties"];
     groups = ["development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0cdbp12ih2w77l331frv8gv6bv9dinn1663dy1jn0gb9ss1hwvs2";
+      sha256 = "02q7lwfdilwahza2jz0p0kc2rragv617q9r2yy72syv6lfy923sx";
       type = "gem";
     };
-    version = "4.8.2";
+    version = "5.1.0";
   };
   faraday = {
     dependencies = ["multipart-post"];
@@ -1645,10 +1645,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "00di7rl1171rvpncxnfdpnmqc32kx9xmi6nwrn52k8cyrxzz2ixf";
+      sha256 = "0h8jzwifqgkrgh9d05g0vsdkyrnk75i53lmm3pfp9rj47gvn1z1j";
       type = "gem";
     };
-    version = "1.58.0";
+    version = "1.65.0";
   };
   github-markup = {
     groups = ["default"];
@@ -1691,6 +1691,16 @@
     };
     version = "1.7.0";
   };
+  gitlab-net-dns = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1jylfc47477imjmzc4jq7zsxklhrws6q4bb0zzl33drirf6s1ldw";
+      type = "gem";
+    };
+    version = "0.9.1";
+  };
   gitlab-peek = {
     dependencies = ["railties"];
     groups = ["default"];
@@ -2127,10 +2137,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hfxnlyr618s25xpafw9mypa82qppjccbh292c4l3bj36az7f6wl";
+      sha256 = "0hmypvx9iyc0b4hski7aic2xzm09cg1c7q1qlpnk3k8s5acxzyhl";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "1.7.0";
   };
   i18n_data = {
     groups = ["default"];
@@ -2467,10 +2477,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ccsid33xjajd0im2xv941aywi58z7ihwkvaf1w2bv89vn5bhsjg";
+      sha256 = "06kfq90vi38gv6i128f4zg462kj32szs5vsgm25hxgw9zd12pj9x";
       type = "gem";
     };
-    version = "2.2.3";
+    version = "2.3.0";
   };
   mail = {
     dependencies = ["mini_mime"];
@@ -2625,10 +2635,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1186lhwnxiw5ryv6dbxrsfy0fajfll2l95kf9pmca50iyiqi86zn";
+      sha256 = "1qr2mkm2i3m76zarvy7qgjl9596hmvjrg7x6w42vx8cfsbf5p0y1";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "1.3.1";
   };
   multi_json = {
     groups = ["default"];
@@ -2711,16 +2721,6 @@
     };
     version = "1.1.0";
   };
-  net-dns = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "18d97xjphw21naaqfhgxp95ikr1d79rx708b2df3xm01j6isqy1d";
-      type = "gem";
-    };
-    version = "0.9.0";
-  };
   net-ldap = {
     groups = ["default"];
     platforms = [];
@@ -3480,10 +3480,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ilwxzm3a7bql5c9q2n9g9nb1hax7vd8d65a5yp3d967ld97nvrq";
+      sha256 = "1icpqmxbppl4ynzmn6dx7wdil5hhq6fz707m9ya6d86c7ys8sd4f";
       type = "gem";
     };
-    version = "1.2.0";
+    version = "1.3.0";
   };
   rails-i18n = {
     dependencies = ["i18n" "railties"];
@@ -3532,10 +3532,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1sy5a7nh6xjdc9yhcw31jji7ssrf9v5806hn95gbrzr998a2ydjn";
+      sha256 = "1cvaqarr1m84mhc006g3l1vw7sa5qpkcw0138lsxlf769zdllsgp";
       type = "gem";
     };
-    version = "12.3.2";
+    version = "12.3.3";
   };
   rb-fsevent = {
     groups = ["default" "development" "test"];
@@ -3758,10 +3758,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rhdyyvvm26f2l3fgwdp6xasfl2y0whwgy766bhdwz697mf78zfn";
+      sha256 = "18lqbiyc7234vd6iwxia5yvvzg6bdvdwl2nm4a5y7ia5fxjl3kqm";
       type = "gem";
     };
-    version = "2.4.0";
+    version = "2.4.1";
   };
   rest-client = {
     dependencies = ["http-cookie" "mime-types" "netrc"];
@@ -3809,10 +3809,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pv628bqalippv8vjs3003qpl3zab9g44vqzydgcwxd628r5k9sv";
+      sha256 = "1zsyv6abqrk7lpql5f1ja4m88bfy9qndi8xykpss6cpvjdmi3ydb";
       type = "gem";
     };
-    version = "3.7.0";
+    version = "3.11.0";
   };
   rqrcode = {
     dependencies = ["chunky_png"];
@@ -4513,10 +4513,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08nvn3c1mzgcjgk9lr3py0zjd8fjjrm3ncn9rpqkfbx429mgw2l3";
+      sha256 = "0ag33hv8ky8nxpsra9jkam9npi1jjwb7f7zmvi2najci5mdr10nr";
       type = "gem";
     };
-    version = "0.2.5";
+    version = "0.10.0";
   };
   text = {
     groups = ["default" "development"];
@@ -4839,10 +4839,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0va966lhpylcwbqb9n151kkihx30agh0a57mwjwdxyanll4s1q12";
+      sha256 = "1fr9n9i9r82xb6i61fdw4xgc7zjv7fsdrr4k0njchy87iw9fl454";
       type = "gem";
     };
-    version = "1.2.7";
+    version = "1.2.8";
   };
   webfinger = {
     dependencies = ["activesupport" "httpclient"];

diff --git a/pkgs/applications/version-management/gitlab/update.py b/pkgs/applications/version-management/gitlab/update.py
@@ -193,15 +193,10 @@ def update_gitlab_shell():
     repo = GitLabRepo(repo='gitlab-shell')
     gitlab_shell_dir = pathlib.Path(__file__).parent / 'gitlab-shell'
 
-    for fn in ['Gemfile.lock', 'Gemfile']:
-        with open(gitlab_shell_dir / fn, 'w') as f:
-            f.write(repo.get_file(fn, f"v{gitlab_shell_version}"))
-
     for fn in ['go.mod', 'go.sum']:
         with open(gitlab_shell_dir / fn, 'w') as f:
             f.write(repo.get_file(f"go/{fn}", f"v{gitlab_shell_version}"))
 
-    subprocess.check_output(['bundix'], cwd=gitlab_shell_dir)
     subprocess.check_output(['vgo2nix'], cwd=gitlab_shell_dir)
 
     for fn in ['go.mod', 'go.sum']:

diff --git a/pkgs/applications/version-management/gitlab/yarnPkgs.nix b/pkgs/applications/version-management/gitlab/yarnPkgs.nix
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl }:
 
 let
-  version = "12.4.0";
+  version = "12.4.1";
   # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
   docker_x86_64 = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-x86_64.tar.xz";
-    sha256 = "0x0i60l8w3iwf7kn1wi8hh87cc3rvxixi2bizd5807aw22g9z5pd";
+    sha256 = "0y68x5hl2gip7bpcgjychf5qd1535ry4qkjb3fybm2pb81qy2gy7";
   };
 
   docker_arm = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-arm.tar.xz";
-    sha256 = "1a2z2m4c2cixibjgh6xv9yi760n10v374nb9jl2pf62rlpqkwz83";
+    sha256 = "1nb0cspjqasyg7bppyrf3m3rg1c26iaw6h9dpnq2m7f60dciyiq2";
   };
 in
 buildGoPackage rec {
@@ -29,7 +29,7 @@ buildGoPackage rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "0sdf3w5iq08dyhn2b9rz0sssxq4yfbki2z834z5l02wzjl8h2nk6";
+    sha256 = "1smn7b1dvqvaka23a7zhnlnpbqw40hpdn8vvj1r3ivx20khpsnhn";
   };
 
   patches = [ ./fix-shell-path.patch ];

diff --git a/pkgs/servers/documize-community/default.nix b/pkgs/servers/documize-community/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "documize-community";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchFromGitHub {
     owner = "documize";
     repo = "community";
     rev = "v${version}";
-    sha256 = "0gmr61ga8ik7awaqcq74bg7h7m8ijqvf4xvr5s6agkmzym83sjsz";
+    sha256 = "1qbf5c42mf30kc4yrk7mav8hk91v5yjx32h9wirmqkcb9k2lpv7s";
   };
 
   goPackagePath = "github.com/documize/community";

diff --git a/pkgs/tools/filesystems/gocryptfs/default.nix b/pkgs/tools/filesystems/gocryptfs/default.nix
@@ -8,7 +8,7 @@ let
 in
 buildGoPackage rec {
   pname = "gocryptfs";
-  version = "1.7"; # TODO: Drop `patches` with next release. Remove `fix-unix2syscall_darwin.go-build-failure.patch`.
+  version = "1.7.1";
 
   goPackagePath = "github.com/rfjakob/gocryptfs";
 
@@ -19,13 +19,9 @@ buildGoPackage rec {
     owner = "rfjakob";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1sr3i73haw07faqpw785cdda2kna8q3a0zhwab1p3i935rvp4qaa";
+    sha256 = "1zhzhvjhvi6xzib985bsnj9yzp4zsnm91m1679nbab6vm3kanq06";
   };
 
-  # Fixes build on darwin
-  # Source: https://github.com/rfjakob/gocryptfs/commit/b1468a732fa26550f2a6f8a21cc7bd47b65a8c96
-  patches = [ ./fix-unix2syscall_darwin.go-build-failure.patch ];
-
   postPatch = "rm -r tests";
 
   buildFlagsArray = ''

diff --git a/pkgs/tools/filesystems/gocryptfs/deps.nix b/pkgs/tools/filesystems/gocryptfs/deps.nix
diff --git a/pkgs/tools/filesystems/gocryptfs/fix-unix2syscall_darwin.go-build-failure.patch b/pkgs/tools/filesystems/gocryptfs/fix-unix2syscall_darwin.go-build-failure.patch