gitlab: 12.6.4 -> 12.7.4

 - CVE-2020-7966
 - CVE-2020-8114
 - CVE-2020-7973
 - CVE-2020-6833
 - CVE-2020-7971
 - CVE-2020-7967
 - CVE-2020-7972
 - CVE-2020-7968
 - CVE-2020-7979
 - CVE-2020-7969
 - CVE-2020-7978
 - CVE-2020-7974
 - CVE-2020-7977
 - CVE-2020-7976
 - CVE-2019-16779
 - CVE-2019-18978
 - CVE-2019-16892

1 files changed, 99 insertions, 79 deletions

diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
index 57e428ca955e..d4dd0a37570f 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -55,8 +55,8 @@ GEM
     adamantium (0.2.0)
       ice_nine (~> 0.11.0)
       memoizable (~> 0.4.0)
-    addressable (2.5.2)
-      public_suffix (>= 2.0.2, < 4.0)
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
     aes_key_wrap (1.0.1)
     akismet (3.0.0)
     apollo_upload_server (2.0.0.beta.3)
@@ -71,7 +71,7 @@ GEM
     asciidoctor (2.0.10)
     asciidoctor-include-ext (0.3.1)
       asciidoctor (>= 1.5.6, < 3.0.0)
-    asciidoctor-plantuml (0.0.9)
+    asciidoctor-plantuml (0.0.10)
       asciidoctor (>= 1.5.6, < 3.0.0)
     ast (2.4.0)
     atlassian-jwt (0.2.0)
@@ -81,13 +81,15 @@ GEM
     attr_required (1.0.1)
     awesome_print (1.8.0)
     aws-eventstream (1.0.3)
-    aws-sdk (2.11.374)
-      aws-sdk-resources (= 2.11.374)
-    aws-sdk-core (2.11.374)
-      aws-sigv4 (~> 1.0)
+    aws-partitions (1.263.0)
+    aws-sdk-cloudformation (1.29.0)
+      aws-sdk-core (~> 3, >= 3.71.0)
+      aws-sigv4 (~> 1.1)
+    aws-sdk-core (3.88.0)
+      aws-eventstream (~> 1.0, >= 1.0.2)
+      aws-partitions (~> 1, >= 1.239.0)
+      aws-sigv4 (~> 1.1)
       jmespath (~> 1.0)
-    aws-sdk-resources (2.11.374)
-      aws-sdk-core (= 2.11.374)
     aws-sigv4 (1.1.0)
       aws-eventstream (~> 1.0, >= 1.0.2)
     axiom-types (0.1.1)
@@ -117,7 +119,7 @@ GEM
       activemodel (>= 5.0)
     brakeman (4.2.1)
     browser (2.5.3)
-    builder (3.2.3)
+    builder (3.2.4)
     bullet (6.0.2)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.11)
@@ -192,7 +194,7 @@ GEM
     database_cleaner (1.7.0)
     debug_inspector (0.0.3)
     debugger-ruby_core_source (1.3.8)
-    deckar01-task_list (2.2.1)
+    deckar01-task_list (2.3.1)
       html-pipeline
     declarative (0.0.10)
     declarative-option (0.1.0)
@@ -235,17 +237,17 @@ GEM
       doorkeeper (~> 4.3)
       json-jwt (~> 1.6)
     ed25519 (1.2.4)
-    elasticsearch (5.0.3)
-      elasticsearch-api (= 5.0.3)
-      elasticsearch-transport (= 5.0.3)
-    elasticsearch-api (5.0.3)
+    elasticsearch (6.8.0)
+      elasticsearch-api (= 6.8.0)
+      elasticsearch-transport (= 6.8.0)
+    elasticsearch-api (6.8.0)
       multi_json
-    elasticsearch-model (0.1.9)
+    elasticsearch-model (6.1.0)
       activesupport (> 3)
-      elasticsearch (> 0.4)
+      elasticsearch (> 1)
       hashie
-    elasticsearch-rails (0.1.9)
-    elasticsearch-transport (5.0.3)
+    elasticsearch-rails (6.1.0)
+    elasticsearch-transport (6.8.0)
       faraday
       multi_json
     email_reply_trimmer (0.1.6)
@@ -260,7 +262,7 @@ GEM
     et-orbi (1.2.1)
       tzinfo
     eventmachine (1.2.7)
-    excon (0.62.0)
+    excon (0.71.1)
     execjs (2.6.0)
     expression_parser (0.9.0)
     extended-markdown-filter (0.6.0)
@@ -270,15 +272,15 @@ GEM
     factory_bot_rails (5.1.0)
       factory_bot (~> 5.1.0)
       railties (>= 4.2.0)
-    faraday (0.12.2)
+    faraday (0.15.4)
       multipart-post (>= 1.2, < 3)
     faraday-http-cache (2.0.0)
       faraday (~> 0.8)
     faraday_middleware (0.12.2)
       faraday (>= 0.7.4, < 1.0)
-    faraday_middleware-aws-signers-v4 (0.1.7)
-      aws-sdk-resources (~> 2)
-      faraday (~> 0.9)
+    faraday_middleware-aws-sigv4 (0.3.0)
+      aws-sigv4 (~> 1.0)
+      faraday (>= 0.15)
     faraday_middleware-multi_json (0.0.6)
       faraday_middleware
       multi_json
@@ -286,6 +288,9 @@ GEM
     fast_gettext (1.6.0)
     ffaker (2.10.0)
     ffi (1.11.3)
+    ffi-compiler (1.0.1)
+      ffi (>= 1.0.0)
+      rake
     flipper (0.17.1)
     flipper-active_record (0.17.1)
       activerecord (>= 4.2, < 7)
@@ -357,12 +362,12 @@ GEM
       po_to_json (>= 1.0.0)
       rails (>= 3.2.0)
     git (1.5.0)
-    gitaly (1.73.0)
+    gitaly (1.81.0)
       grpc (~> 1.0)
     github-markup (1.7.0)
     gitlab-chronic (0.10.5)
       numerizer (~> 0.2)
-    gitlab-labkit (0.7.0)
+    gitlab-labkit (0.8.0)
       actionpack (>= 5.0.0, < 6.1.0)
       activesupport (>= 5.0.0, < 6.1.0)
       grpc (~> 1.19)
@@ -379,11 +384,12 @@ GEM
       gitlab-puma (>= 2.7, < 5)
     gitlab-sidekiq-fetcher (0.5.2)
       sidekiq (~> 5)
-    gitlab-styles (2.8.0)
-      rubocop (~> 0.69.0)
+    gitlab-styles (3.1.0)
+      rubocop (~> 0.74.0)
       rubocop-gitlab-security (~> 0.1.0)
-      rubocop-performance (~> 1.1.0)
-      rubocop-rspec (~> 1.19)
+      rubocop-performance (~> 1.4.1)
+      rubocop-rails (~> 2.0)
+      rubocop-rspec (~> 1.36)
     gitlab_chronic_duration (0.10.6.2)
       numerizer (~> 0.2)
     gitlab_omniauth-ldap (2.1.1)
@@ -426,7 +432,7 @@ GEM
     grape-entity (0.7.1)
       activesupport (>= 4.0)
       multi_json (>= 1.3.2)
-    grape-path-helpers (1.1.0)
+    grape-path-helpers (1.2.0)
       activesupport
       grape (~> 1.0)
       rake (~> 12)
@@ -477,7 +483,7 @@ GEM
       tilt
     hangouts-chat (0.0.5)
     hashdiff (0.3.8)
-    hashie (3.5.7)
+    hashie (3.6.0)
     hashie-forbidden_attributes (0.1.1)
       hashie (>= 3.0)
     health_check (2.6.0)
@@ -492,20 +498,21 @@ GEM
     html2text (0.2.0)
       nokogiri (~> 1.6)
     htmlentities (4.3.4)
-    http (3.3.0)
+    http (4.2.0)
       addressable (~> 2.3)
       http-cookie (~> 1.0)
       http-form_data (~> 2.0)
-      http_parser.rb (~> 0.6.0)
+      http-parser (~> 1.2.0)
     http-cookie (1.0.3)
       domain_name (~> 0.5)
     http-form_data (2.1.1)
-    http_parser.rb (0.6.0)
+    http-parser (1.2.1)
+      ffi-compiler (>= 1.0, < 2.0)
     httparty (0.16.4)
       mime-types (~> 3.0)
       multi_xml (>= 0.5.2)
     httpclient (2.8.3)
-    i18n (1.7.0)
+    i18n (1.7.1)
       concurrent-ruby (~> 1.0)
     i18n_data (0.8.0)
     icalendar (2.4.1)
@@ -519,7 +526,7 @@ GEM
     jaeger-client (0.10.0)
       opentracing (~> 0.3)
       thrift
-    jaro_winkler (1.5.3)
+    jaro_winkler (1.5.4)
     jira-ruby (1.7.1)
       activesupport
       atlassian-jwt
@@ -556,8 +563,8 @@ GEM
     kramdown (2.1.0)
     kramdown-parser-gfm (1.1.0)
       kramdown (~> 2.0)
-    kubeclient (4.4.0)
-      http (~> 3.0)
+    kubeclient (4.6.0)
+      http (>= 3.0, < 5.0)
       recursive-open-struct (~> 1.0, >= 1.0.4)
       rest-client (~> 2.0)
     launchy (2.4.3)
@@ -577,6 +584,7 @@ GEM
       xml-simple
     licensee (8.9.2)
       rugged (~> 0.24)
+    liquid (4.0.3)
     listen (3.1.5)
       rb-fsevent (~> 0.9, >= 0.9.4)
       rb-inotify (~> 0.9, >= 0.9.7)
@@ -587,9 +595,10 @@ GEM
       activesupport (>= 4)
       railties (>= 4)
       request_store (~> 1.0)
-    loofah (2.3.1)
+    loofah (2.4.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
+    lru_redux (1.1.0)
     lumberjack (1.0.13)
     mail (2.7.1)
       mini_mime (>= 0.1.1)
@@ -613,9 +622,9 @@ GEM
     mini_portile2 (2.4.0)
     minitest (5.11.3)
     msgpack (1.3.1)
-    multi_json (1.13.1)
+    multi_json (1.14.1)
     multi_xml (0.6.0)
-    multipart-post (2.0.0)
+    multipart-post (2.1.1)
     murmurhash3 (0.1.6)
     mustermann (1.0.3)
     mustermann-grape (1.0.0)
@@ -623,13 +632,13 @@ GEM
     nakayoshi_fork (0.0.4)
     nap (1.1.0)
     nenv (0.3.0)
-    net-ldap (0.16.0)
+    net-ldap (0.16.2)
     net-ntp (2.1.3)
     net-ssh (5.2.0)
     netrc (0.11.0)
     nio4r (2.5.2)
     no_proxy_fix (0.1.2)
-    nokogiri (1.10.5)
+    nokogiri (1.10.7)
       mini_portile2 (~> 2.4.0)
     nokogumbo (1.5.0)
       nokogiri
@@ -644,7 +653,8 @@ GEM
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 3)
-    octokit (4.9.0)
+    octokit (4.15.0)
+      faraday (>= 0.9)
       sawyer (~> 0.8.0, >= 0.5.3)
     omniauth (1.9.0)
       hashie (>= 3.4.6, < 3.7.0)
@@ -725,13 +735,14 @@ GEM
       rubypants (~> 0.2)
     orm_adapter (0.5.0)
     os (1.0.0)
-    parallel (1.17.0)
-    parser (2.6.3.0)
+    parallel (1.19.1)
+    parser (2.6.5.0)
       ast (~> 2.4.0)
     parslet (1.8.2)
     peek (1.1.0)
       railties (>= 4.0.0)
     pg (1.1.4)
+    png_quantizator (0.2.1)
     po_to_json (1.0.1)
       json (>= 1.6.0)
     premailer (1.11.1)
@@ -755,7 +766,7 @@ GEM
       pry (~> 0.10)
     pry-rails (0.3.6)
       pry (>= 0.10.4)
-    public_suffix (3.1.1)
+    public_suffix (4.0.3)
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.1.6)
     rack (2.0.7)
@@ -763,7 +774,8 @@ GEM
       rack (>= 0.4)
     rack-attack (6.2.0)
       rack (>= 1.0, < 3)
-    rack-cors (1.0.2)
+    rack-cors (1.0.6)
+      rack (>= 1.6.0)
     rack-oauth2 (1.9.3)
       activesupport
       attr_required
@@ -820,7 +832,7 @@ GEM
       ffi (>= 1.0.6)
       msgpack (>= 0.4.3)
       optimist (>= 3.0.0)
-    rdoc (6.0.4)
+    rdoc (6.1.2)
     re2 (1.1.1)
     recaptcha (4.13.1)
       json
@@ -903,7 +915,7 @@ GEM
       pg
       rails
       sqlite3
-    rubocop (0.69.0)
+    rubocop (0.74.0)
       jaro_winkler (~> 1.5.1)
       parallel (~> 1.10)
       parser (>= 2.6)
@@ -912,10 +924,13 @@ GEM
       unicode-display_width (>= 1.4.0, < 1.7)
     rubocop-gitlab-security (0.1.1)
       rubocop (>= 0.51)
-    rubocop-performance (1.1.0)
-      rubocop (>= 0.67.0)
-    rubocop-rspec (1.22.2)
-      rubocop (>= 0.52.1)
+    rubocop-performance (1.4.1)
+      rubocop (>= 0.71.0)
+    rubocop-rails (2.4.0)
+      rack (>= 1.1)
+      rubocop (>= 0.72.0)
+    rubocop-rspec (1.37.0)
+      rubocop (>= 0.68.1)
     ruby-enum (0.7.2)
       i18n
     ruby-fogbugz (0.2.1)
@@ -929,7 +944,7 @@ GEM
       sexp_processor (~> 4.9)
     rubyntlm (0.6.2)
     rubypants (0.2.0)
-    rubyzip (1.3.0)
+    rubyzip (2.0.0)
     rugged (0.28.4.1)
     safe_yaml (1.0.4)
     sanitize (4.6.6)
@@ -950,9 +965,9 @@ GEM
       sprockets (> 3.0)
       sprockets-rails
       tilt
-    sawyer (0.8.1)
-      addressable (>= 2.3.5, < 2.6)
-      faraday (~> 0.8, < 1.0)
+    sawyer (0.8.2)
+      addressable (>= 2.3.5)
+      faraday (> 0.8, < 2.0)
     scss_lint (0.56.0)
       rake (>= 0.9, < 13)
       sass (~> 3.5.3)
@@ -1042,7 +1057,7 @@ GEM
     truncato (0.7.11)
       htmlentities (~> 4.3.1)
       nokogiri (>= 1.7.0, <= 2.0)
-    tzinfo (1.2.5)
+    tzinfo (1.2.6)
       thread_safe (~> 0.1)
     u2f (0.2.1)
     uber (0.1.0)
@@ -1119,17 +1134,18 @@ DEPENDENCIES
   acme-client (~> 2.0.2)
   activerecord-explain-analyze (~> 0.1)
   acts-as-taggable-on (~> 6.0)
-  addressable (~> 2.5.2)
+  addressable (~> 2.7)
   akismet (~> 3.0)
   apollo_upload_server (~> 2.0.0.beta3)
   asana (~> 0.9)
   asciidoctor (~> 2.0.10)
   asciidoctor-include-ext (~> 0.3.1)
-  asciidoctor-plantuml (= 0.0.9)
+  asciidoctor-plantuml (= 0.0.10)
   atlassian-jwt (~> 0.2.0)
   attr_encrypted (~> 3.1.0)
   awesome_print
-  aws-sdk
+  aws-sdk-cloudformation (~> 1)
+  aws-sdk-core (~> 3)
   babosa (~> 1.0.2)
   base32 (~> 0.3.0)
   batch-loader (~> 1.4.0)
@@ -1155,7 +1171,7 @@ DEPENDENCIES
   creole (~> 0.5.0)
   danger (~> 6.0)
   database_cleaner (~> 1.7.0)
-  deckar01-task_list (= 2.2.1)
+  deckar01-task_list (= 2.3.1)
   default_value_for (~> 3.3.0)
   derailed_benchmarks
   device_detector
@@ -1167,15 +1183,15 @@ DEPENDENCIES
   doorkeeper (~> 4.3)
   doorkeeper-openid_connect (~> 1.5)
   ed25519 (~> 1.2)
-  elasticsearch-api (= 5.0.3)
-  elasticsearch-model (~> 0.1.9)
-  elasticsearch-rails (~> 0.1.9)
+  elasticsearch-api (~> 6.8)
+  elasticsearch-model (~> 6.1)
+  elasticsearch-rails (~> 6.1)
   email_reply_trimmer (~> 0.1)
   email_spec (~> 2.2.0)
   escape_utils (~> 1.1)
   factory_bot_rails (~> 5.1.0)
   faraday (~> 0.12)
-  faraday_middleware-aws-signers-v4
+  faraday_middleware-aws-sigv4
   fast_blank
   ffaker (~> 2.10)
   flipper (~> 0.17.1)
@@ -1196,17 +1212,17 @@ DEPENDENCIES
   gettext (~> 3.2.2)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 1.73.0)
+  gitaly (~> 1.81.0)
   github-markup (~> 1.7.0)
   gitlab-chronic (~> 0.10.5)
-  gitlab-labkit (~> 0.5)
+  gitlab-labkit (= 0.8.0)
   gitlab-license (~> 1.0)
   gitlab-markup (~> 1.7.0)
   gitlab-net-dns (~> 0.9.1)
   gitlab-puma (~> 4.3.1.gitlab.2)
   gitlab-puma_worker_killer (~> 0.1.1.gitlab.1)
   gitlab-sidekiq-fetcher (= 0.5.2)
-  gitlab-styles (~> 2.7)
+  gitlab-styles (~> 3.1.0)
   gitlab_chronic_duration (~> 0.10.6.2)
   gitlab_omniauth-ldap (~> 2.1.1)
   gon (~> 6.2)
@@ -1215,7 +1231,7 @@ DEPENDENCIES
   gpgme (~> 2.0.19)
   grape (~> 1.1.0)
   grape-entity (~> 0.7.1)
-  grape-path-helpers (~> 1.1)
+  grape-path-helpers (~> 1.2)
   grape_logging (~> 1.7)
   graphiql-rails (~> 1.4.10)
   graphql (~> 1.9.11)
@@ -1241,12 +1257,14 @@ DEPENDENCIES
   jwt (~> 2.1.0)
   kaminari (~> 1.0)
   knapsack (~> 1.17)
-  kubeclient (~> 4.4.0)
+  kubeclient (~> 4.6.0)
   letter_opener_web (~> 1.3.4)
   license_finder (~> 5.4)
   licensee (~> 8.9)
+  liquid (~> 4.0)
   lograge (~> 0.5)
   loofah (~> 2.2)
+  lru_redux
   mail_room (~> 0.10.0)
   marginalia (~> 1.8.0)
   memory_profiler (~> 0.9)
@@ -1260,7 +1278,7 @@ DEPENDENCIES
   net-ssh (~> 5.2)
   nokogiri (~> 1.10.5)
   oauth2 (~> 1.4)
-  octokit (~> 4.9)
+  octokit (~> 4.15)
   omniauth (~> 1.8)
   omniauth-auth0 (~> 2.0.0)
   omniauth-authentiq (~> 0.3.3)
@@ -1280,8 +1298,10 @@ DEPENDENCIES
   omniauth_crowd (~> 2.2.0)
   omniauth_openid_connect (~> 0.3.3)
   org-ruby (~> 0.9.12)
+  parallel (~> 1.19)
   peek (~> 1.1)
   pg (~> 1.1)
+  png_quantizator (~> 0.2.1)
   premailer-rails (~> 1.10.3)
   prometheus-client-mmap (~> 0.10.0)
   pry-byebug (~> 3.5.1)
@@ -1299,7 +1319,7 @@ DEPENDENCIES
   raindrops (~> 0.18)
   rblineprof (~> 0.3.6)
   rbtrace (~> 0.4)
-  rdoc (~> 6.0)
+  rdoc (~> 6.1.2)
   re2 (~> 1.1.1)
   recaptcha (~> 4.11)
   redis (~> 4.0)
@@ -1316,14 +1336,14 @@ DEPENDENCIES
   rspec-set (~> 0.1.3)
   rspec_junit_formatter
   rspec_profiling (~> 0.0.5)
-  rubocop (~> 0.69.0)
-  rubocop-performance (~> 1.1.0)
-  rubocop-rspec (~> 1.22.1)
+  rubocop (~> 0.74.0)
+  rubocop-performance (~> 1.4.1)
+  rubocop-rspec (~> 1.37.0)
   ruby-fogbugz (~> 0.2.1)
   ruby-prof (~> 1.0.0)
   ruby-progressbar
   ruby_parser (~> 3.8)
-  rubyzip (~> 1.3.0)
+  rubyzip (~> 2.0.0)
   rugged (~> 0.28)
   sanitize (~> 4.6)
   sassc-rails (~> 2.1.0)