GitLab

- Need the `mobile?` detection (that the new version provides) for the
  U2F registration/ authentication flow

- To hold registrations from U2F devices, and to authenticate them.
- Previously, `User#two_factor_enabled` was aliased to the
  `otp_required_for_login` column on `users`.
- This commit changes things a bit:
    - `User#two_factor_enabled` is not a method anymore
    - `User#two_factor_enabled?` checks both the
      `otp_required_for_login` column, as well as `U2fRegistration`s
    - Change all instances of `User#two_factor_enabled` to
      `User#two_factor_enabled?`
- Add the `u2f` gem, and implement registration/authentication at the
  model level.

Colorize is a gem licensed under the GPLv2, so we can’t use it in GitLab without relicensing GitLab under the terms of the GPL. Rainbow is licensed under the MIT license and does the exact same thing as Colorize, so Rainbow was added in place of Colorize.

The syntax is slightly different for Rainbow vs. Colorize, and was updated in accordance.

The gem is still a dependency of Spinach, so it’s included in the development/test environments, but won’t be packaged with the actual product, and therefore doesn’t require we relicense the product.

An attempt at relicensing Colorize was made, but didn’t succeed as the library owner never responded.

Rainbow library: https://github.com/sickill/rainbow
Relevant issue regarding licensing in GitLab's gems: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3775

Closes #15352

Changelog: https://github.com/amatsuda/kaminari/blob/master/CHANGELOG.rdoc#0170

Deprecates num_pages in favor of total_pages and includes Rails 5 support.

attr_encrypted (1.3.4 => 3.0.1) Changelog:
https://github.com/attr-encrypted/attr_encrypted/blob/master/CHANGELOG.m
d

attr_encrypted 2.x included a vulnerability, so that major version is
skipped. 3.x requires that the algorithm and mode used by each
encrypted attribute is specified explicitly.

`nil` is no longer a valid value for the encrypted_value_iv field, so
it’s changed to a randomly generated string.

Devise (3.5.4 => 4.1.1) Changelog:
https://github.com/plataformatec/devise/blob/master/CHANGELOG.md

devise-two-factor (2.0.1 => 3.0.0) Changelog:
https://github.com/tinfoil/devise-two-factor/blob/master/CHANGELOG.md

These are reliant on each other, so they have to be upgraded together.

devise-async is no longer necessary as Devise 4.1 fixes a bug with the
ActiveJob integration.

No changelog, see commits: https://github.com/state-machines/state_machines-activerecord/commits/master

Includes Rails 5 support.

Almost all cops are starting as disabled until we can fix their
violations.

Changelog: https://github.com/rails/activerecord-session_store/releases/tag/v1.0.0

Includes Rails 5 support.

We don’t use any of the deprecated finders, so it should be safe to
remove.

Resolves #17015.

Instead the script is now included directly from the vendor directory.

Resolves #17166.

In 8278b763 the default behaviour of annotation
has changes, which was causing a lot of noise in diffs. We decided in #17382
that it is better to get rid of the whole annotate gem, and instead let people
look at schema.rb for the columns in a table.

Fixes: #17382

This reverts commit 1cc614f2.

It was causing the ActiveJob integration to fail, so unfortunately we'll have to add the gem again.

This allows the removal of the monkey patch from this commit: 47ff1c56

It'll also make it slightly easier to upgrade to 3.5.0 later.

Changelog: https://github.com/rspec/rspec-rails/blob/master/Changelog.md#340--2015-11-11

Closes #13357

I’d rather upgrade one major version at a time, so Doorkeeper needs to
be upgraded to 3.x before it can be upgraded to 4.x (which includes
Rails 5 support).

Changelog:
https://github.com/doorkeeper-gem/doorkeeper/blob/master/NEWS.md#310

The extra gem isn’t necessary anymore since Rails 4.2 has ActiveJob integration.

Resolves #15575.

Sent emails in the development environment will no longer automatically
be opened in the browser. If a sent email needs to be viewed, it can be
found at the `/rails/letter_opener` route.

Signed-off-by: Rémy Coutable <remy@rymai.me>

Spring changelog: https://git.io/vVAUY

Upgrades jQuery to 1.12.1 and jquery-ujs to 1.2.1.

Changelogs:
https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md
https://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/
https://github.com/rails/jquery-ujs/releases

Includes compatibility with Rails 5. We don’t have any tests for this,
so no need to run them. [ci skip]

Changelog: https://github.com/ctran/annotate_models/releases/tag/v2.7.0

Working towards #14286.

Sprockets 3.5.0 reintroduces GZIP-ing and 3.6.0 includes performance improvements. Changelog: https://github.com/rails/sprockets/blob/3.x/CHANGELOG.md

Resolves #14344.

This removes a few dependencies! It was also rude to be using coveralls
0.8.9, considering 0.8.12 introduced support for GitLab CI :) Also
paves the way for updating mime-types to 3.0.

Coveralls Changelog:
https://github.com/lemurheavy/coveralls-ruby/releases

Simplecov Changelog:
https://github.com/colszowka/simplecov/blob/master/CHANGELOG.md

This was originally suggested by @ayufan and modified to be a bit
cleaner and use RequestStore instead of a regular Hash.

By caching the output of the two methods involved the number of queries
is reduced significantly. For example, for an issue with 200 notes (of
which 100 reference a number of merge requests) this cuts down the
amount of queries from around 6300 to around 3300.

Includes compatibility with Rails 5.

See the changelog for more information (https://github.com/modeset/teaspoon/blob/master/CHANGELOG.md).

Includes support for Rails 5, bug fixes, and various additional
vulnerability checks.

See Changelog for more information
(https://github.com/presidentbeef/brakeman/blob/master/CHANGES)

Discussed in #14233.

See [their releases](https://github.com/bbatsov/rubocop/releases) for
more info.

Changes:
- Enable DisplayCopNames for lint output.
- Default behavior for `Alias` changed, set to enforce `prefer_alias_method`.
- Enabling Rails cops changed to new syntax.
- Remove StyleGuides and move Descriptions to comments.
- Add missing cops.
- Add TODOs for cops that should be enabled in the future.
- Set TargetRubyVersion to 2.1.