NixOS · Sep 28, 2017 · Sep 28, 2017 · Sep 28, 2017
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
@@ -635,6 +635,13 @@ in {
         chown -R ${cfg.user}:${cfg.group} ${cfg.statePath}
         chmod -R ug+rwX,o-rwx+X ${cfg.statePath}
         chmod -R u+rwX,go-rwx+X ${gitlabEnv.HOME}
+        chmod -R ug+rwX,o-rwx ${cfg.statePath}/repositories
+        chmod -R ug-s ${cfg.statePath}/repositories
+        find ${cfg.statePath}/repositories -type d -print0 | xargs -0 chmod g+s
+        chmod 700 ${cfg.statePath}/uploads
+        chown -R git ${cfg.statePath}/uploads
+        find ${cfg.statePath}/uploads -type f -exec chmod 0644 {} \;
+        find ${cfg.statePath}/uploads -type d -not -path ${cfg.statePath}/uploads -exec chmod 0700 {} \;
       '';
 
       serviceConfig = {

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "09q7s5x22vnmvqyz0f1l6qnaryglmsp0rc63qcg5sfvgv2g17g5x";
-    sha256bin64 = "12z6z8gjxl4mx8j6db8nnlzrj03rh4qwyrvcf4hqcsv7b1armg6j";
-    version = "61.0.3163.79";
+    sha256 = "0c8qn2i7iygl3kgrdwwd8h3l5j8hg66dw99qgr618cgca1b4im68";
+    sha256bin64 = "04mfg18zpx19ha0mrlwx2aabn0vhl08n9c60hazivmw99pzlg8dn";
+    version = "62.0.3202.29";
   };
   dev = {
-    sha256 = "168i6dcdl13an3vlr2m83q8fcprgckmclkmzwj70jdkp84qx80fq";
-    sha256bin64 = "116vddp01m2ls337zj6r4h1nvybphvldlk9bs8czypx5skn29vbz";
-    version = "62.0.3202.9";
+    sha256 = "1zd7rid626fglbyrp7c6517jldhgfk3vjn357vhlhy6pgj1ydrrn";
+    sha256bin64 = "0hqb5prf0ags4bnla6skyi5vmkrazhd8n3ri4ijhbqjbb536bfpb";
+    version = "63.0.3218.0";
   };
   stable = {
-    sha256 = "09q7s5x22vnmvqyz0f1l6qnaryglmsp0rc63qcg5sfvgv2g17g5x";
-    sha256bin64 = "0a0wd06c0v061lnmb8x20gqgsg9zqafp2kq1fl3cjm0ldg9rwayw";
-    version = "61.0.3163.79";
+    sha256 = "06r89jim9cq87668ya8wwk69hh17rl04cj94nb9c28v6mj69cda1";
+    sha256bin64 = "1cm9snw29nkzq4bafqgi6fd0gqcc3jp60y6vfsrf9k4dvdard2sv";
+    version = "61.0.3163.100";
   };
 }
diff --git a/pkgs/applications/version-management/gitaly/Gemfile b/pkgs/applications/version-management/gitaly/Gemfile
@@ -1,5 +1,5 @@
 source 'https://rubygems.org'
 
 gem 'github-linguist', '~> 4.7.0', require: 'linguist'
-gem 'gitaly-proto', '~> 0.31.0', require: 'gitaly'
+gem 'gitaly-proto', '~> 0.37.0', require: 'gitaly'
 gem 'activesupport'
diff --git a/pkgs/applications/version-management/gitaly/Gemfile.lock b/pkgs/applications/version-management/gitaly/Gemfile.lock
@@ -13,15 +13,15 @@ GEM
     escape_utils (1.1.1)
     faraday (0.12.2)
       multipart-post (>= 1.2, < 3)
-    gitaly-proto (0.31.0)
+    gitaly-proto (0.37.0)
       google-protobuf (~> 3.1)
       grpc (~> 1.0)
     github-linguist (4.7.6)
       charlock_holmes (~> 0.7.3)
       escape_utils (~> 1.1.0)
       mime-types (>= 1.19)
       rugged (>= 0.23.0b)
-    google-protobuf (3.3.0)
+    google-protobuf (3.4.0.2)
     googleauth (0.5.3)
       faraday (~> 0.12)
       jwt (~> 1.4)
@@ -30,7 +30,7 @@ GEM
       multi_json (~> 1.11)
       os (~> 0.9)
       signet (~> 0.7)
-    grpc (1.4.5)
+    grpc (1.6.0)
       google-protobuf (~> 3.1)
       googleauth (~> 0.5.1)
     i18n (0.8.1)
@@ -63,8 +63,8 @@ PLATFORMS
 
 DEPENDENCIES
   activesupport
-  gitaly-proto (~> 0.31.0)
+  gitaly-proto (~> 0.37.0)
   github-linguist (~> 4.7.0)
 
 BUNDLED WITH
-   1.15.3
+   1.15.4
diff --git a/pkgs/applications/version-management/gitaly/default.nix b/pkgs/applications/version-management/gitaly/default.nix
@@ -7,14 +7,14 @@ let
     gemdir = ./.;
   };
 in buildGoPackage rec {
-  version = "0.35.0";
+  version = "0.38.0";
   name = "gitaly-${version}";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "0h3gh4y571wrnnsg5wpi67psih8yssaw24v3vrcpqpkz5linj7pl";
+    sha256 = "02s5gjxbjvm990n4h5zkyqj71a9mp4yj83hfl8mma0g7gx00icsf";
   };
 
   goPackagePath = "gitlab.com/gitlab-org/gitaly";

diff --git a/pkgs/applications/version-management/gitaly/gemset.nix b/pkgs/applications/version-management/gitaly/gemset.nix
@@ -54,10 +54,10 @@
     dependencies = ["google-protobuf" "grpc"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1n5bpclizxc42m5kbrhdgsb0ddkl47d0rgmcya5b6sv8qbclkkds";
+      sha256 = "1nqp9ib00q55ig8zf1r6ldf3xkqw0874ra1mbcsm8sl46l84lx11";
       type = "gem";
     };
-    version = "0.31.0";
+    version = "0.37.0";
   };
   github-linguist = {
     dependencies = ["charlock_holmes" "escape_utils" "mime-types" "rugged"];
@@ -71,10 +71,10 @@
   google-protobuf = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1q0ka7x53b9vx4wdb2jdvwxxpb5i5ns7fhqb9zgbrp8yy1bg9m9p";
+      sha256 = "1jh8axm5m75rvdf2i3s24pmi7p613armh9vk3p1d0ryfx159mqkl";
       type = "gem";
     };
-    version = "3.3.0";
+    version = "3.4.0.2";
   };
   googleauth = {
     dependencies = ["faraday" "jwt" "logging" "memoist" "multi_json" "os" "signet"];
@@ -89,10 +89,10 @@
     dependencies = ["google-protobuf" "googleauth"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zhci260088zlghpaz6ania1blz1dd7lgklsjnqk1vcymhpr6b38";
+      sha256 = "056ipqai887x5jpbgcc215kdi0lfqjzcjbx3hx11cjrfww01zc52";
       type = "gem";
     };
-    version = "1.4.5";
+    version = "1.6.0";
   };
   i18n = {
     source = {

diff --git a/pkgs/applications/version-management/gitlab-shell/default.nix b/pkgs/applications/version-management/gitlab-shell/default.nix
@@ -1,14 +1,14 @@
 { stdenv, ruby, bundler, fetchFromGitLab, go }:
 
 stdenv.mkDerivation rec {
-  version = "5.8.0";
+  version = "5.9.0";
   name = "gitlab-shell-${version}";
 
   srcs = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "1zqd7lys309ylbg45vm1apyx9r82kq1drwinr3di2ybb64v3z2q8";
+    sha256 = "1zjlwivksaqlfxxhxjgpqa3293nhijw76fj7nv0l11820wplc7yf";
   };
 
   buildInputs = [

diff --git a/pkgs/applications/version-management/gitlab/Gemfile b/pkgs/applications/version-management/gitlab/Gemfile
@@ -16,7 +16,7 @@ gem 'mysql2', '~> 0.4.5', group: :mysql
 gem 'pg', '~> 0.18.2', group: :postgres
 
 gem 'rugged', '~> 0.26.0'
-gem 'grape-route-helpers', '~> 2.0.0'
+gem 'grape-route-helpers', '~> 2.1.0'
 
 gem 'faraday', '~> 0.12'
 
@@ -31,7 +31,7 @@ gem 'omniauth-cas3', '~> 1.1.4'
 gem 'omniauth-facebook', '~> 4.0.0'
 gem 'omniauth-github', '~> 1.1.1'
 gem 'omniauth-gitlab', '~> 1.0.2'
-gem 'omniauth-google-oauth2', '~> 0.4.1'
+gem 'omniauth-google-oauth2', '~> 0.5.2'
 gem 'omniauth-kerberos', '~> 0.3.0', group: :kerberos
 gem 'omniauth-oauth2-generic', '~> 0.2.2'
 gem 'omniauth-saml', '~> 1.7.0'
@@ -64,7 +64,7 @@ gem 'gpgme'
 # LDAP Auth
 # GitLab fork with several improvements to original library. For full list of changes
 # see https://github.com/intridea/omniauth-ldap/compare/master...gitlabhq:master
-gem 'gitlab_omniauth-ldap', '~> 2.0.3', require: 'omniauth-ldap'
+gem 'gitlab_omniauth-ldap', '~> 2.0.4', require: 'omniauth-ldap'
 gem 'net-ldap'
 
 # Git Wiki
@@ -76,7 +76,7 @@ gem 'gollum-rugged_adapter', '~> 0.4.4', require: false
 gem 'github-linguist', '~> 4.7.0', require: 'linguist'
 
 # API
-gem 'grape', '~> 0.19.2'
+gem 'grape', '~> 1.0'
 gem 'grape-entity', '~> 0.6.0'
 gem 'rack-cors', '~> 0.4.0', require: 'rack/cors'
 
@@ -128,7 +128,7 @@ gem 'asciidoctor-plantuml', '0.0.7'
 gem 'rouge', '~> 2.0'
 gem 'truncato', '~> 0.7.9'
 gem 'bootstrap_form', '~> 2.7.0'
-gem 'nokogiri', '~> 1.8.0'
+gem 'nokogiri', '~> 1.8.1'
 
 # Diffs
 gem 'diffy', '~> 3.1.0'
@@ -141,8 +141,6 @@ end
 
 # State machine
 gem 'state_machines-activerecord', '~> 0.4.0'
-# Run events after state machine commits
-gem 'after_commit_queue', '~> 1.3.0'
 
 # Issue tags
 gem 'acts-as-taggable-on', '~> 4.0'
@@ -183,7 +181,7 @@ gem 'connection_pool', '~> 2.0'
 gem 'hipchat', '~> 1.5.0'
 
 # JIRA integration
-gem 'jira-ruby', '~> 1.1.2'
+gem 'jira-ruby', '~> 1.4'
 
 # Flowdock integration
 gem 'gitlab-flowdock-git-hook', '~> 1.0.1'
@@ -206,9 +204,6 @@ gem 'kubeclient', '~> 2.2.0'
 # d3
 gem 'd3_rails', '~> 3.5.0'
 
-# underscore-rails
-gem 'underscore-rails', '~> 1.8.0'
-
 # Sanitize user input
 gem 'sanitize', '~> 2.0'
 gem 'babosa', '~> 1.0.2'
@@ -229,7 +224,7 @@ gem 'ace-rails-ap', '~> 4.1.0'
 gem 'mousetrap-rails', '~> 1.4.6'
 
 # Detect and convert string character encoding
-gem 'charlock_holmes', '~> 0.7.3'
+gem 'charlock_holmes', '~> 0.7.5'
 
 # Faster JSON
 gem 'oj', '~> 2.17.4'
@@ -329,7 +324,7 @@ group :development, :test do
   # Generate Fake data
   gem 'ffaker', '~> 2.4'
 
-  gem 'capybara', '~> 2.6.2'
+  gem 'capybara', '~> 2.15.0'
   gem 'capybara-screenshot', '~> 1.0.0'
   gem 'poltergeist', '~> 1.9.0'
 
@@ -339,6 +334,7 @@ group :development, :test do
 
   gem 'rubocop', '~> 0.49.1', require: false
   gem 'rubocop-rspec', '~> 1.15.1', require: false
+  gem 'rubocop-gitlab-security', '~> 0.1.0', require: false
   gem 'scss_lint', '~> 0.54.0', require: false
   gem 'haml_lint', '~> 0.26.0', require: false
   gem 'simplecov', '~> 0.14.0', require: false
@@ -352,7 +348,9 @@ group :development, :test do
 
   gem 'activerecord_sane_schema_dumper', '0.2'
 
-  gem 'stackprof', '~> 0.2.10'
+  gem 'stackprof', '~> 0.2.10', require: false
+
+  gem 'simple_po_parser', '~> 1.1.2', require: false
 end
 
 group :test do
@@ -394,12 +392,12 @@ gem 'net-ssh', '~> 4.1.0'
 # Required for ED25519 SSH host key support
 group :ed25519 do
   gem 'rbnacl-libsodium'
-  gem 'rbnacl', '~> 3.2'
+  gem 'rbnacl', '~> 4.0'
   gem 'bcrypt_pbkdf', '~> 1.0'
 end
 
 # Gitaly GRPC client
-gem 'gitaly', '~> 0.26.0'
+gem 'gitaly-proto', '~> 0.33.0', require: 'gitaly'
 
 gem 'toml-rb', '~> 0.3.15', require: false
 
@@ -409,5 +407,6 @@ gem 'flipper-active_record', '~> 0.10.2'
 
 # Structured logging
 gem 'lograge', '~> 0.5'
+gem 'grape_logging', '~> 1.7'
 
 gem 'activerecord-nulldb-adapter'