Merge branch '9-3-stable-rc6' into '9-3-stable'

Prepare 9.3 for RC6

See merge request !12312

64 files changed, 860 insertions, 561 deletions

diff --git a/.rubocop.yml b/.rubocop.yml
index 8f611a96702..66a40f2cf57 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -397,7 +397,7 @@ Style/ParenthesesAroundCondition:
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: short, verbose
 Style/PreferredHashMethods:
-  Enabled: true
+  Enabled: false
 
 # Checks for an obsolete RuntimeException argument in raise/fail.
 Style/RedundantException:
diff --git a/app/assets/javascripts/notes.js b/app/assets/javascripts/notes.js
index 88e834815e1..2a999dd61ba 100644
--- a/app/assets/javascripts/notes.js
+++ b/app/assets/javascripts/notes.js
@@ -187,7 +187,7 @@ const normalizeNewlines = function(str) {
           if ($textarea.val() !== '') {
             return;
           }
-          myLastNote = $(`li.note[data-author-id='${gon.current_user_id}'][data-editable]:last`, $textarea.closest('.note, #notes'));
+          myLastNote = $(`li.note[data-author-id='${gon.current_user_id}'][data-editable]:last`, $textarea.closest('.note, .notes_holder, #notes'));
           if (myLastNote.length) {
             myLastNoteEditBtn = myLastNote.find('.js-note-edit');
             return myLastNoteEditBtn.trigger('click', [true, myLastNote]);
diff --git a/app/assets/javascripts/vue_merge_request_widget/components/mr_widget_related_links.js b/app/assets/javascripts/vue_merge_request_widget/components/mr_widget_related_links.js
index 686cb38cbb1..205804670fa 100644
--- a/app/assets/javascripts/vue_merge_request_widget/components/mr_widget_related_links.js
+++ b/app/assets/javascripts/vue_merge_request_widget/components/mr_widget_related_links.js
@@ -1,63 +1,42 @@
 export default {
   name: 'MRWidgetRelatedLinks',
   props: {
-    isMerged: { type: Boolean, required: true },
     relatedLinks: { type: Object, required: true },
   },
   computed: {
-    // TODO: the following should be handled by i18n
-    closingText() {
-      if (this.isMerged) {
-        return `Closed ${this.issueLabel('closing')}`;
-      }
-
-      return `Closes ${this.issueLabel('closing')}`;
-    },
     hasLinks() {
       const { closing, mentioned, assignToMe } = this.relatedLinks;
       return closing || mentioned || assignToMe;
     },
-    // TODO: the following should be handled by i18n
-    mentionedText() {
-      if (this.isMerged) {
-        if (this.hasMultipleIssues(this.relatedLinks.mentioned)) {
-          return 'are mentioned but were not closed';
-        }
-
-        return 'is mentioned but was not closed';
-      }
-
-      if (this.hasMultipleIssues(this.relatedLinks.mentioned)) {
-        return 'are mentioned but will not be closed';
-      }
-
-      return 'is mentioned but will not be closed';
-    },
   },
   methods: {
     hasMultipleIssues(text) {
-      return /<\/a>,? and <a/.test(text);
+      return !text ? false : text.match(/<\/a> and <a/);
     },
-    // TODO: the following should be handled by i18n
     issueLabel(field) {
       return this.hasMultipleIssues(this.relatedLinks[field]) ? 'issues' : 'issue';
     },
+    verbLabel(field) {
+      return this.hasMultipleIssues(this.relatedLinks[field]) ? 'are' : 'is';
+    },
   },
   template: `
-    <div v-if="hasLinks">
+    <section
+      v-if="hasLinks"
+      class="mr-info-list mr-links">
       <div class="legend"></div>
       <p v-if="relatedLinks.closing">
-        {{closingText}}
+        Closes {{issueLabel('closing')}}
         <span v-html="relatedLinks.closing"></span>.
       </p>
       <p v-if="relatedLinks.mentioned">
         <span class="capitalize">{{issueLabel('mentioned')}}</span>
         <span v-html="relatedLinks.mentioned"></span>
-        {{mentionedText}}
+        {{verbLabel('mentioned')}} mentioned but will not be closed.
       </p>
       <p v-if="relatedLinks.assignToMe">
         <span v-html="relatedLinks.assignToMe"></span>
       </p>
-    </div>
+    </section>
   `,
 };
diff --git a/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_merged.js b/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_merged.js
index 9b8eed9016d..c7d32d18141 100644
--- a/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_merged.js
+++ b/app/assets/javascripts/vue_merge_request_widget/components/states/mr_widget_merged.js
@@ -1,9 +1,7 @@
 /* global Flash */
 
 import mrWidgetAuthorTime from '../../components/mr_widget_author_time';
-import mrWidgetRelatedLinks from '../../components/mr_widget_related_links';
 import eventHub from '../../event_hub';
-import '../../../flash';
 
 export default {
   name: 'MRWidgetMerged',
@@ -13,7 +11,6 @@ export default {
   },
   components: {
     'mr-widget-author-and-time': mrWidgetAuthorTime,
-    'mr-widget-related-links': mrWidgetRelatedLinks,
   },
   data() {
     return {
@@ -21,9 +18,6 @@ export default {
     };
   },
   computed: {
-    shouldRenderRelatedLinks() {
-      return this.mr.relatedLinks && this.mr.isMerged;
-    },
     shouldShowRemoveSourceBranch() {
       const { sourceBranchRemoved, isRemovingSourceBranch, canRemoveSourceBranch } = this.mr;
 
@@ -92,10 +86,6 @@ export default {
             aria-hidden="true" />
           The source branch is being removed.
         </p>
-        <mr-widget-related-links
-          v-if="shouldRenderRelatedLinks"
-          :is-merged="mr.isMerged()"
-          :related-links="mr.relatedLinks" />
       </section>
       <div
         v-if="shouldShowMergedButtons"
diff --git a/app/assets/javascripts/vue_merge_request_widget/mr_widget_options.js b/app/assets/javascripts/vue_merge_request_widget/mr_widget_options.js
index 222d0b7f79e..2339a00ddd0 100644
--- a/app/assets/javascripts/vue_merge_request_widget/mr_widget_options.js
+++ b/app/assets/javascripts/vue_merge_request_widget/mr_widget_options.js
@@ -48,7 +48,7 @@ export default {
       return stateMaps.stateToComponentMap[this.mr.state];
     },
     shouldRenderMergeHelp() {
-      return !this.mr.isMerged;
+      return stateMaps.statesToShowHelpWidget.indexOf(this.mr.state) > -1;
     },
     shouldRenderPipelines() {
       return Object.keys(this.mr.pipeline).length || this.mr.hasCI;
@@ -238,14 +238,9 @@ export default {
         :is="componentName"
         :mr="mr"
         :service="service" />
-      <section
+      <mr-widget-related-links
         v-if="shouldRenderRelatedLinks"
-        class="mr-info-list mr-links">
-        <div class="legend"></div>
-        <mr-widget-related-links
-          :is-merged="mr.isMerged"
-          :related-links="mr.relatedLinks" />
-      </section>
+        :related-links="mr.relatedLinks" />
       <mr-widget-merge-help v-if="shouldRenderMergeHelp" />
     </div>
   `,
diff --git a/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js b/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js
index ad73efb37e1..69bc1436284 100644
--- a/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js
+++ b/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js
@@ -1,18 +1,6 @@
 import Timeago from 'timeago.js';
 import { getStateKey } from '../dependencies';
 
-const unmergedStates = [
-  'locked',
-  'conflicts',
-  'workInProgress',
-  'readyToMerge',
-  'checking',
-  'unresolvedDiscussions',
-  'pipelineFailed',
-  'pipelineBlocked',
-  'autoMergeFailed',
-];
-
 export default class MergeRequestStore {
 
   constructor(data) {
@@ -77,7 +65,6 @@ export default class MergeRequestStore {
     this.mergeActionsContentPath = data.commit_change_content_path;
     this.isRemovingSourceBranch = this.isRemovingSourceBranch || false;
     this.isOpen = data.state === 'opened' || data.state === 'reopened' || false;
-    this.isMerged = unmergedStates.indexOf(data.state) === -1;
     this.hasMergeableDiscussionsState = data.mergeable_discussions_state === false;
     this.canRemoveSourceBranch = currentUser.can_remove_source_branch || false;
     this.canMerge = !!data.merge_path;
diff --git a/app/assets/javascripts/vue_merge_request_widget/stores/state_maps.js b/app/assets/javascripts/vue_merge_request_widget/stores/state_maps.js
index dd939d98d0f..605dd3a1ff4 100644
--- a/app/assets/javascripts/vue_merge_request_widget/stores/state_maps.js
+++ b/app/assets/javascripts/vue_merge_request_widget/stores/state_maps.js
@@ -19,6 +19,19 @@ const stateToComponentMap = {
   shaMismatch: 'mr-widget-sha-mismatch',
 };
 
+const statesToShowHelpWidget = [
+  'locked',
+  'conflicts',
+  'workInProgress',
+  'readyToMerge',
+  'checking',
+  'unresolvedDiscussions',
+  'pipelineFailed',
+  'pipelineBlocked',
+  'autoMergeFailed',
+];
+
 export default {
   stateToComponentMap,
+  statesToShowHelpWidget,
 };
diff --git a/app/assets/stylesheets/framework/filters.scss b/app/assets/stylesheets/framework/filters.scss
index cfbaaaa04c7..9e876d7572d 100644
--- a/app/assets/stylesheets/framework/filters.scss
+++ b/app/assets/stylesheets/framework/filters.scss
@@ -236,9 +236,6 @@
     width: 35px;
     background-color: $white-light;
     border: none;
-    position: static;
-    right: 0;
-    height: 100%;
     outline: none;
     z-index: 1;
 
diff --git a/app/assets/stylesheets/pages/issuable.scss b/app/assets/stylesheets/pages/issuable.scss
index b3f310ff67d..4abad3f2697 100644
--- a/app/assets/stylesheets/pages/issuable.scss
+++ b/app/assets/stylesheets/pages/issuable.scss
@@ -729,33 +729,3 @@
     }
   }
 }
-
-.confidential-issue-warning {
-  background-color: $gl-gray;
-  border-radius: 3px;
-  padding: $gl-btn-padding $gl-padding;
-  margin-top: $gl-padding-top;
-  font-size: 14px;
-  color: $white-light;
-
-  .fa {
-    margin-right: 8px;
-  }
-
-  a {
-    color: $white-light;
-    text-decoration: underline;
-  }
-
-  &.affix {
-    position: static;
-    width: initial;
-
-    @media (min-width: $screen-sm-min) {
-      position: sticky;
-      position: -webkit-sticky;
-      top: 60px;
-      z-index: 200;
-    }
-  }
-}
diff --git a/app/assets/stylesheets/pages/merge_requests.scss b/app/assets/stylesheets/pages/merge_requests.scss
index c0bd045f1fc..2dc7f73a295 100644
--- a/app/assets/stylesheets/pages/merge_requests.scss
+++ b/app/assets/stylesheets/pages/merge_requests.scss
@@ -372,10 +372,6 @@
       margin-left: 12px;
     }
 
-    &.mr-state-locked + .mr-info-list.mr-links {
-      margin-top: -16px;
-    }
-
     &.empty-state {
       .artwork {
         margin-bottom: $gl-padding;
diff --git a/app/assets/stylesheets/pages/note_form.scss b/app/assets/stylesheets/pages/note_form.scss
index aa307414737..69fed4e6bf7 100644
--- a/app/assets/stylesheets/pages/note_form.scss
+++ b/app/assets/stylesheets/pages/note_form.scss
@@ -103,6 +103,42 @@
   }
 }
 
+.confidential-issue-warning {
+  background-color: $gray-normal;
+  border-radius: 3px;
+  padding: 3px 12px;
+  margin: auto;
+  margin-top: 0;
+  text-align: center;
+  font-size: 12px;
+  align-items: center;
+
+  @media (max-width: $screen-md-max) {
+    // On smaller devices the warning becomes the fourth item in the list,
+    // rather than centering, and grows to span the full width of the
+    // comment area.
+    order: 4;
+    margin: 6px auto;
+    width: 100%;
+  }
+
+  .fa {
+    margin-right: 8px;
+  }
+}
+
+.right-sidebar-expanded {
+  .confidential-issue-warning {
+    // When the sidebar is open the warning becomes the fourth item in the list,
+    // rather than centering, and grows to span the full width of the
+    // comment area.
+    order: 4;
+    margin: 6px auto;
+    width: 100%;
+  }
+}
+
+
 .discussion-form {
   padding: $gl-padding-top $gl-padding $gl-padding;
   background-color: $white-light;
diff --git a/app/finders/events_finder.rb b/app/finders/events_finder.rb
index b0450ddc1fd..29beb6cb224 100644
--- a/app/finders/events_finder.rb
+++ b/app/finders/events_finder.rb
@@ -33,7 +33,8 @@ class EventsFinder
   private
 
   def by_current_user_access(events)
-    events.merge(ProjectsFinder.new(current_user: current_user).execute).references(:project)
+    events.merge(ProjectsFinder.new(current_user: current_user).execute).
+      joins(:project)
   end
 
   def by_action(events)
diff --git a/app/finders/group_projects_finder.rb b/app/finders/group_projects_finder.rb
index f043c38c6f9..f2d3b90b8e2 100644
--- a/app/finders/group_projects_finder.rb
+++ b/app/finders/group_projects_finder.rb
@@ -29,35 +29,69 @@ class GroupProjectsFinder < ProjectsFinder
   private
 
   def init_collection
-    only_owned  = options.fetch(:only_owned, false)
-    only_shared = options.fetch(:only_shared, false)
+    projects = if current_user
+                 collection_with_user
+               else
+                 collection_without_user
+               end
 
-    projects = []
+    union(projects)
+  end
 
-    if current_user
-      if group.users.include?(current_user)
-        projects << group.projects unless only_shared
-        projects << group.shared_projects unless only_owned
+  def collection_with_user
+    if group.users.include?(current_user)
+      if only_shared?
+        [shared_projects]
+      elsif only_owned?
+        [owned_projects]
       else
-        unless only_shared
-          projects << group.projects.visible_to_user(current_user)
-          projects << group.projects.public_to_user(current_user)
-        end
-
-        unless only_owned
-          projects << group.shared_projects.visible_to_user(current_user)
-          projects << group.shared_projects.public_to_user(current_user)
-        end
+        [shared_projects, owned_projects]
       end
     else
-      projects << group.projects.public_only unless only_shared
-      projects << group.shared_projects.public_only unless only_owned
+      if only_shared?
+        [shared_projects.public_or_visible_to_user(current_user)]
+      elsif only_owned?
+        [owned_projects.public_or_visible_to_user(current_user)]
+      else
+        [
+          owned_projects.public_or_visible_to_user(current_user),
+          shared_projects.public_or_visible_to_user(current_user)
+        ]
+      end
     end
+  end
 
-    projects
+  def collection_without_user
+    if only_shared?
+      [shared_projects.public_only]
+    elsif only_owned?
+      [owned_projects.public_only]
+    else
+      [shared_projects.public_only, owned_projects.public_only]
+    end
   end
 
   def union(items)
-    find_union(items, Project)
+    if items.one?
+      items.first
+    else
+      find_union(items, Project)
+    end
+  end
+
+  def only_owned?
+    options.fetch(:only_owned, false)
+  end
+
+  def only_shared?
+    options.fetch(:only_shared, false)
+  end
+
+  def owned_projects
+    group.projects
+  end
+
+  def shared_projects
+    group.shared_projects
   end
 end
diff --git a/app/finders/projects_finder.rb b/app/finders/projects_finder.rb
index 5bf722d1ec6..8bfbe37c543 100644
--- a/app/finders/projects_finder.rb
+++ b/app/finders/projects_finder.rb
@@ -28,34 +28,56 @@ class ProjectsFinder < UnionFinder
   end
 
   def execute
-    items = init_collection
-    items = items.map do |item|
-      item = by_ids(item)
-      item = by_personal(item)
-      item = by_starred(item)
-      item = by_trending(item)
-      item = by_visibilty_level(item)
-      item = by_tags(item)
-      item = by_search(item)
-      by_archived(item)
-    end
-    items = union(items)
-    sort(items)
+    collection = init_collection
+    collection = by_ids(collection)
+    collection = by_personal(collection)
+    collection = by_starred(collection)
+    collection = by_trending(collection)
+    collection = by_visibilty_level(collection)
+    collection = by_tags(collection)
+    collection = by_search(collection)
+    collection = by_archived(collection)
+
+    sort(collection)
   end
 
   private
 
   def init_collection
-    projects = []
+    if current_user
+      collection_with_user
+    else
+      collection_without_user
+    end
+  end
 
-    if params[:owned].present?
-      projects << current_user.owned_projects if current_user
+  def collection_with_user
+    if owned_projects?
+      current_user.owned_projects
     else
-      projects << current_user.authorized_projects if current_user
-      projects << Project.unscoped.public_to_user(current_user) unless params[:non_public].present?
+      if private_only?
+        current_user.authorized_projects
+      else
+        Project.public_or_visible_to_user(current_user)
+      end
     end
+  end
+
+  # Builds a collection for an anonymous user.
+  def collection_without_user
+    if private_only? || owned_projects?
+      Project.none
+    else
+      Project.public_to_user
+    end
+  end
+
+  def owned_projects?
+    params[:owned].present?
+  end
 
-    projects
+  def private_only?
+    params[:non_public].present?
   end
 
   def by_ids(items)
diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 7a5fbaf33f2..f854d98aeb7 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -68,7 +68,7 @@ module ApplicationHelper
     end
   end
 
-  def avatar_icon(user_or_email = nil, size = nil, scale = 2)
+  def avatar_icon(user_or_email = nil, size = nil, scale = 2, only_path: true)
     user =
       if user_or_email.is_a?(User)
         user_or_email
@@ -77,7 +77,7 @@ module ApplicationHelper
       end
 
     if user
-      user.avatar_url(size: size) || default_avatar
+      user.avatar_url(size: size, only_path: only_path) || default_avatar
     else
       gravatar_icon(user_or_email, size, scale)
     end
diff --git a/app/models/project.rb b/app/models/project.rb
index 4c394646787..36ec4f398ca 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -266,20 +266,49 @@ class Project < ActiveRecord::Base
 
   enum auto_cancel_pending_pipelines: { disabled: 0, enabled: 1 }
 
+  # Returns a collection of projects that is either public or visible to the
+  # logged in user.
+  def self.public_or_visible_to_user(user = nil)
+    if user
+      authorized = user.
+        project_authorizations.
+        select(1).
+        where('project_authorizations.project_id = projects.id')
+
+      levels = Gitlab::VisibilityLevel.levels_for_user(user)
+
+      where('EXISTS (?) OR projects.visibility_level IN (?)', authorized, levels)
+    else
+      public_to_user
+    end
+  end
+
   # project features may be "disabled", "internal" or "enabled". If "internal",
   # they are only available to team members. This scope returns projects where
   # the feature is either enabled, or internal with permission for the user.
+  #
+  # This method uses an optimised version of `with_feature_access_level` for
+  # logged in users to more efficiently get private projects with the given
+  # feature.
   def self.with_feature_available_for_user(feature, user)
-    return with_feature_enabled(feature) if user.try(:admin?)
+    visible = [nil, ProjectFeature::ENABLED]
 
-    unconditional = with_feature_access_level(feature, [nil, ProjectFeature::ENABLED])
-    return unconditional if user.nil?
+    if user&.admin?
+      with_feature_enabled(feature)
+    elsif user
+      column = ProjectFeature.quoted_access_level_column(feature)
 
-    conditional = with_feature_access_level(feature, ProjectFeature::PRIVATE)
-    authorized = user.authorized_projects.merge(conditional.reorder(nil))
+      authorized = user.project_authorizations.select(1).
+        where('project_authorizations.project_id = projects.id')
 
-    union = Gitlab::SQL::Union.new([unconditional.select(:id), authorized.select(:id)])
-    where(arel_table[:id].in(Arel::Nodes::SqlLiteral.new(union.to_sql)))
+      with_project_feature.
+        where("#{column} IN (?) OR (#{column} = ? AND EXISTS (?))",
+              visible,
+              ProjectFeature::PRIVATE,
+              authorized)
+    else
+      with_feature_access_level(feature, visible)
+    end
   end
 
   scope :active, -> { joins(:issues, :notes, :merge_requests).order('issues.created_at, notes.created_at, merge_requests.created_at DESC') }
diff --git a/app/models/project_feature.rb b/app/models/project_feature.rb
index e3ef4919b28..dde2a11440d 100644
--- a/app/models/project_feature.rb
+++ b/app/models/project_feature.rb
@@ -27,6 +27,13 @@ class ProjectFeature < ActiveRecord::Base
 
       "#{feature}_access_level".to_sym
     end
+
+    def quoted_access_level_column(feature)
+      attribute = connection.quote_column_name(access_level_attribute(feature))
+      table = connection.quote_table_name(table_name)
+
+      "#{table}.#{attribute}"
+    end
   end
 
   # Default scopes force us to unscope here since a service may need to check
diff --git a/app/models/project_services/chat_message/pipeline_message.rb b/app/models/project_services/chat_message/pipeline_message.rb
index 3edc395033c..d63d4ec2b12 100644
--- a/app/models/project_services/chat_message/pipeline_message.rb
+++ b/app/models/project_services/chat_message/pipeline_message.rb
@@ -70,7 +70,7 @@ module ChatMessage
     end
 
     def branch_link
-      "`[#{ref}](#{branch_url})`"
+      "[#{ref}](#{branch_url})"
     end
 
     def project_link
diff --git a/app/models/project_services/chat_message/push_message.rb b/app/models/project_services/chat_message/push_message.rb
index 04a59d559ca..c52dd6ef8ef 100644
--- a/app/models/project_services/chat_message/push_message.rb
+++ b/app/models/project_services/chat_message/push_message.rb
@@ -61,7 +61,7 @@ module ChatMessage
     end
 
     def removed_branch_message
-      "#{user_name} removed #{ref_type} `#{ref}` from #{project_link}"
+      "#{user_name} removed #{ref_type} #{ref} from #{project_link}"
     end
 
     def push_message
@@ -102,7 +102,7 @@ module ChatMessage
     end
 
     def branch_link
-      "`[#{ref}](#{branch_url})`"
+      "[#{ref}](#{branch_url})"
     end
 
     def project_link
diff --git a/app/views/admin/application_settings/_form.html.haml b/app/views/admin/application_settings/_form.html.haml
index 280c5930f3d..1e37859b92b 100644
--- a/app/views/admin/application_settings/_form.html.haml
+++ b/app/views/admin/application_settings/_form.html.haml
@@ -311,6 +311,10 @@
           = f.label :prometheus_metrics_enabled do
             = f.check_box :prometheus_metrics_enabled
             Enable Prometheus Metrics
+            - unless Gitlab::Metrics.metrics_folder_present?
+              .help-block
+                %strong.cred WARNING:
+                Environment variable `prometheus_multiproc_dir` does not exist or is not pointing to a valid directory.
 
   %fieldset
     %legend Background Jobs
diff --git a/app/views/notify/pipeline_failed_email.html.haml b/app/views/notify/pipeline_failed_email.html.haml
index a83faa839df..b7a60938132 100644
--- a/app/views/notify/pipeline_failed_email.html.haml
+++ b/app/views/notify/pipeline_failed_email.html.haml
@@ -60,7 +60,7 @@
               %tbody
                 %tr
                   %td{ style: "font-family:'Helvetica Neue',Helvetica,Arial,sans-serif;font-size:15px;line-height:1.4;vertical-align:middle;padding-right:5px;" }
-                    %img.avatar{ height: "24", src: avatar_icon(commit.author || commit.author_email, 24), style: "display:block;border-radius:12px;margin:-2px 0;", width: "24", alt: "Avatar" }/
+                    %img.avatar{ height: "24", src: avatar_icon(commit.author || commit.author_email, 24, only_path: false), style: "display:block;border-radius:12px;margin:-2px 0;", width: "24", alt: "Avatar" }/
                   %td{ style: "font-family:'Helvetica Neue',Helvetica,Arial,sans-serif;font-size:15px;line-height:1.4;vertical-align:middle;" }
                     - if commit.author
                       %a.muted{ href: user_url(commit.author), style: "color:#333333;text-decoration:none;" }
@@ -76,7 +76,7 @@
                 %tbody
                   %tr
                     %td{ style: "font-family:'Helvetica Neue',Helvetica,Arial,sans-serif;font-size:15px;line-height:1.4;vertical-align:middle;padding-right:5px;" }
-                      %img.avatar{ height: "24", src: avatar_icon(commit.committer || commit.committer_email, 24), style: "display:block;border-radius:12px;margin:-2px 0;", width: "24", alt: "Avatar" }/
+                      %img.avatar{ height: "24", src: avatar_icon(commit.committer || commit.committer_email, 24, only_path: false), style: "display:block;border-radius:12px;margin:-2px 0;", width: "24", alt: "Avatar" }/
                     %td{ style: "font-family:'Helvetica Neue',Helvetica,Arial,sans-serif;font-size:15px;line-height:1.4;vertical-align:middle;" }
                       - if commit.committer
                         %a.muted{ href: user_url(commit.committer), style: "color:#333333;text-decoration:none;" }
@@ -100,7 +100,7 @@
             triggered by
           - if @pipeline.user
             %td{ style: "font-family:'Helvetica Neue',Helvetica,Arial,sans-serif;font-size:15px;line-height:1.4;vertical-align:middle;padding-right:5px;padding-left:5px", width: "24" }
-              %img.avatar{ height: "24", src: avatar_icon(@pipeline.user, 24), style: "display:block;border-radius:12px;margin:-2px 0;", width: "24", alt: "Avatar" }/
+              %img.avatar{ height: "24", src: avatar_icon(@pipeline.user, 24, only_path: false), style: "display:block;border-radius:12px;margin:-2px 0;", width: "24", alt: "Avatar" }/
             %td{ style: "font-family:'Helvetica Neue',Helvetica,Arial,sans-serif;font-size:15px;font-weight:500;line-height:1.4;vertical-align:baseline;" }
               %a.muted{ href: user_url(@pipeline.user), style: "color:#333333;text-decoration:none;" }
                 = @pipeline.user.name
diff --git a/app/views/notify/pipeline_success_email.html.haml b/app/views/notify/pipeline_success_email.html.haml
index 9c2e2a599b2..3f16885b8e3 100644
--- a/app/views/notify/pipeline_success_email.html.haml
+++ b/app/views/notify/pipeline_success_email.html.haml
@@ -60,7 +60,7 @@
               %tbody
                 %tr
                   %td{ style: "font-family:'Helvetica Neue',Helvetica,Arial,sans-serif;font-size:15px;line-height:1.4;vertical-align:middle;padding-right:5px;" }
-                    %img.avatar{ height: "24", src: avatar_icon(commit.author || commit.author_email, 24), style: "display:block;border-radius:12px;margin:-2px 0;", width: "24", alt: "Avatar" }/
+                    %img.avatar{ height: "24", src: avatar_icon(commit.author || commit.author_email, 24, only_path: false), style: "display:block;border-radius:12px;margin:-2px 0;", width: "24", alt: "Avatar" }/
                   %td{ style: "font-family:'Helvetica Neue',Helvetica,Arial,sans-serif;font-size:15px;line-height:1.4;vertical-align:middle;" }
                     - if commit.author
                       %a.muted{ href: user_url(commit.author), style: "color:#333333;text-decoration:none;" }
@@ -76,7 +76,7 @@
                 %tbody
                   %tr
                     %td{ style: "font-family:'Helvetica Neue',Helvetica,Arial,sans-serif;font-size:15px;line-height:1.4;vertical-align:middle;padding-right:5px;" }
-                      %img.avatar{ height: "24", src: avatar_icon(commit.committer || commit.committer_email, 24), style: "display:block;border-radius:12px;margin:-2px 0;", width: "24", alt: "Avatar" }/
+                      %img.avatar{ height: "24", src: avatar_icon(commit.committer || commit.committer_email, 24, only_path: false), style: "display:block;border-radius:12px;margin:-2px 0;", width: "24", alt: "Avatar" }/
                     %td{ style: "font-family:'Helvetica Neue',Helvetica,Arial,sans-serif;font-size:15px;line-height:1.4;vertical-align:middle;" }
                       - if commit.committer
                         %a.muted{ href: user_url(commit.committer), style: "color:#333333;text-decoration:none;" }
@@ -100,7 +100,7 @@
             triggered by
           - if @pipeline.user
             %td{ style: "font-family:'Helvetica Neue',Helvetica,Arial,sans-serif;font-size:15px;line-height:1.4;vertical-align:middle;padding-right:5px;padding-left:5px", width: "24" }
-              %img.avatar{ height: "24", src: avatar_icon(@pipeline.user, 24), style: "display:block;border-radius:12px;margin:-2px 0;", width: "24", alt: "Avatar" }/
+              %img.avatar{ height: "24", src: avatar_icon(@pipeline.user, 24, only_path: false), style: "display:block;border-radius:12px;margin:-2px 0;", width: "24", alt: "Avatar" }/
             %td{ style: "font-family:'Helvetica Neue',Helvetica,Arial,sans-serif;font-size:15px;font-weight:500;line-height:1.4;vertical-align:baseline;" }
               %a.muted{ href: user_url(@pipeline.user), style: "color:#333333;text-decoration:none;" }
                 = @pipeline.user.name
diff --git a/app/views/projects/_md_preview.html.haml b/app/views/projects/_md_preview.html.haml
index 07445434cf3..d0698285f84 100644
--- a/app/views/projects/_md_preview.html.haml
+++ b/app/views/projects/_md_preview.html.haml
@@ -9,6 +9,12 @@
       %li
         %a.js-md-preview-button{ href: "#md-preview-holder", tabindex: -1 }
           Preview
+
+      - if defined?(@issue) && @issue.confidential?
+        %li.confidential-issue-warning
+          = icon('warning')
+          %span This is a confidential issue. Your comment will not be visible to the public.
+
       %li.pull-right
         .toolbar-group
           = markdown_toolbar_button({ icon: "bold fw", data: { "md-tag" => "**" }, title: "Add bold text" })
diff --git a/app/views/projects/blob/_upload.html.haml b/app/views/projects/blob/_upload.html.haml
index 24314e03b46..32dbc1b3417 100644
--- a/app/views/projects/blob/_upload.html.haml
+++ b/app/views/projects/blob/_upload.html.haml
@@ -9,7 +9,7 @@
           .dropzone
             .dropzone-previews.blob-upload-dropzone-previews
               %p.dz-message.light
-                - upload_link = link_to n_('UploadLink|click to upload'), '#', class: "markdown-selector"
+                - upload_link = link_to s_('UploadLink|click to upload'), '#', class: "markdown-selector"
                 - dropzone_text = _('Attach a file by drag &amp; drop or %{upload_link}') % { upload_link: upload_link }
                 #{ dropzone_text.html_safe }
 
diff --git a/app/views/projects/commit/_change.html.haml b/app/views/projects/commit/_change.html.haml
index 208d4908721..2267f123e38 100644
--- a/app/views/projects/commit/_change.html.haml
+++ b/app/views/projects/commit/_change.html.haml
@@ -22,7 +22,7 @@
             = label_tag 'start_branch', branch_label, class: 'control-label'
             .col-sm-10
               = hidden_field_tag :start_branch, @project.default_branch, id: 'start_branch'
-              = dropdown_tag(@project.default_branch, options: { title: n_("BranchSwitcherTitle|Switch branch"), filter: true, placeholder: n_("BranchSwitcherPlaceholder|Search branches"), toggle_class: 'js-project-refs-dropdown dynamic', dropdown_class: 'dropdown-menu-selectable', data: { field_name: "start_branch", selected: @project.default_branch, start_branch: @project.default_branch, refs_url: namespace_project_branches_path(@project.namespace, @project), submit_form_on_click: false } })
+              = dropdown_tag(@project.default_branch, options: { title: s_("BranchSwitcherTitle|Switch branch"), filter: true, placeholder: s_("BranchSwitcherPlaceholder|Search branches"), toggle_class: 'js-project-refs-dropdown dynamic', dropdown_class: 'dropdown-menu-selectable', data: { field_name: "start_branch", selected: @project.default_branch, start_branch: @project.default_branch, refs_url: namespace_project_branches_path(@project.namespace, @project), submit_form_on_click: false } })
 
               - if can?(current_user, :push_code, @project)
                 = render 'shared/new_merge_request_checkbox'
diff --git a/app/views/projects/issues/show.html.haml b/app/views/projects/issues/show.html.haml
index 5f92d020eef..d909b0bfbbd 100644
--- a/app/views/projects/issues/show.html.haml
+++ b/app/views/projects/issues/show.html.haml
@@ -5,13 +5,6 @@
 - can_update_issue = can?(current_user, :update_issue, @issue)
 - can_report_spam = @issue.submittable_as_spam_by?(current_user)
 
-- if defined?(@issue) && @issue.confidential?
-  .confidential-issue-warning{ data: { spy: 'affix' } }
-    %span.confidential-issue-text
-      #{confidential_icon(@issue)} This issue is confidential.
-      %a{ href: help_page_path('user/project/issues/confidential_issues'), target: '_blank' }
-        What are confidential issues?
-
 .clearfix.detail-page-header
   .issuable-header
     .issuable-status-box.status-box.status-box-closed{ class: issue_button_visibility(@issue, false) }
@@ -26,6 +19,7 @@
       = icon('angle-double-left')
 
     .issuable-meta
+      = confidential_icon(@issue)
       = issuable_meta(@issue, @project, "Issue")
 
   .issuable-actions
diff --git a/app/views/projects/notes/_more_actions_dropdown.html.haml b/app/views/projects/notes/_more_actions_dropdown.html.haml
index e0d45054854..75a4687e1e3 100644
--- a/app/views/projects/notes/_more_actions_dropdown.html.haml
+++ b/app/views/projects/notes/_more_actions_dropdown.html.haml
@@ -1,14 +1,19 @@
-.dropdown.more-actions
-  = button_tag title: 'More actions', class: 'note-action-button more-actions-toggle has-tooltip btn btn-transparent', data: { toggle: 'dropdown', container: 'body' } do
-    = icon('ellipsis-v', class: 'icon')
-  %ul.dropdown-menu.more-actions-dropdown.dropdown-open-left
-    %li
-      = button_tag 'Edit comment', class: 'js-note-edit btn btn-transparent'
-    %li.divider
-      %li
-        = link_to new_abuse_report_path(user_id: note.author.id, ref_url: noteable_note_url(note)) do
-          Report as abuse
-    - if note_editable
-      %li
-        = link_to note_url(note), method: :delete, data: { confirm: 'Are you sure you want to delete this comment?' }, remote: true, class: 'js-note-delete' do
-          %span.text-danger Delete comment
+- is_current_user = current_user == note.author
+
+- if note_editable || !is_current_user
+  .dropdown.more-actions
+    = button_tag title: 'More actions', class: 'note-action-button more-actions-toggle has-tooltip btn btn-transparent', data: { toggle: 'dropdown', container: 'body' } do
+      = icon('ellipsis-v', class: 'icon')
+    %ul.dropdown-menu.more-actions-dropdown.dropdown-open-left
+      - if note_editable
+        %li
+          = button_tag 'Edit comment', class: 'js-note-edit btn btn-transparent'
+        %li.divider
+      - unless is_current_user
+        %li
+          = link_to new_abuse_report_path(user_id: note.author.id, ref_url: noteable_note_url(note)) do
+            Report as abuse
+      - if note_editable
+        %li
+          = link_to note_url(note), method: :delete, data: { confirm: 'Are you sure you want to delete this comment?' }, remote: true, class: 'js-note-delete' do
+            %span.text-danger Delete comment
diff --git a/app/views/projects/pipeline_schedules/_form.html.haml b/app/views/projects/pipeline_schedules/_form.html.haml
index 50bbe109b87..ab3829d010e 100644
--- a/app/views/projects/pipeline_schedules/_form.html.haml
+++ b/app/views/projects/pipeline_schedules/_form.html.haml
@@ -15,12 +15,12 @@
   .form-group
     .col-md-9
       = f.label :cron_timezone, _('Cron Timezone'), class: 'label-light'
-      = dropdown_tag(_("Select a timezone"), options: { toggle_class: 'btn js-timezone-dropdown', title: _("Select a timezone"), filter: true, placeholder: _("OfSearchInADropdown|Filter"), data: { data: timezone_data } } )
+      = dropdown_tag(_("Select a timezone"), options: { toggle_class: 'btn js-timezone-dropdown', title: _("Select a timezone"), filter: true, placeholder: s_("OfSearchInADropdown|Filter"), data: { data: timezone_data } } )
       = f.text_field :cron_timezone, value: @schedule.cron_timezone, id: 'schedule_cron_timezone', class: 'hidden', name: 'schedule[cron_timezone]', required: true
   .form-group
     .col-md-9
       = f.label :ref, _('Target Branch'), class: 'label-light'
-      = dropdown_tag(_("Select target branch"), options: { toggle_class: 'btn js-target-branch-dropdown git-revision-dropdown-toggle', dropdown_class: 'git-revision-dropdown', title: _("Select target branch"), filter: true, placeholder: _("OfSearchInADropdown|Filter"), data: { data: @project.repository.branch_names, default_branch: @project.default_branch } } )
+      = dropdown_tag(_("Select target branch"), options: { toggle_class: 'btn js-target-branch-dropdown git-revision-dropdown-toggle', dropdown_class: 'git-revision-dropdown', title: _("Select target branch"), filter: true, placeholder: s_("OfSearchInADropdown|Filter"), data: { data: @project.repository.branch_names, default_branch: @project.default_branch } } )
       = f.text_field :ref, value: @schedule.ref, id: 'schedule_ref', class: 'hidden', name: 'schedule[ref]', required: true
   .form-group
     .col-md-9
diff --git a/changelogs/unreleased/33260-allow-admins-to-list-admins.yml b/changelogs/unreleased/33260-allow-admins-to-list-admins.yml
new file mode 100644
index 00000000000..a3b2053e005
--- /dev/null
+++ b/changelogs/unreleased/33260-allow-admins-to-list-admins.yml
@@ -0,0 +1,4 @@
+---
+title: Reinstate is_admin flag in users api when authenticated user is an admin
+merge_request: 12211
+author: rickettm
diff --git a/changelogs/unreleased/fix-missing-function-dropzone-input.yml b/changelogs/unreleased/fix-missing-function-dropzone-input.yml
deleted file mode 100644
index d9dfc76faaf..00000000000
--- a/changelogs/unreleased/fix-missing-function-dropzone-input.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Fix for cut & pasted images not working
-merge_request:
-author:
diff --git a/changelogs/unreleased/fixed-confidential-issue-bar.yml b/changelogs/unreleased/fixed-confidential-issue-bar.yml
deleted file mode 100644
index 6a41590d0af..00000000000
--- a/changelogs/unreleased/fixed-confidential-issue-bar.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Make confidential issues more obviously confidential
-merge_request:
-author:
diff --git a/changelogs/unreleased/refactor-projects-finder-init-collection.yml b/changelogs/unreleased/refactor-projects-finder-init-collection.yml
new file mode 100644
index 00000000000..c8113419f21
--- /dev/null
+++ b/changelogs/unreleased/refactor-projects-finder-init-collection.yml
@@ -0,0 +1,5 @@
+---
+title: Refactor ProjectsFinder#init_collection to produce more efficient queries for
+  retrieving projects
+merge_request:
+author:
diff --git a/config/boot.rb b/config/boot.rb
index 17a71148370..16de55d7a86 100644
--- a/config/boot.rb
+++ b/config/boot.rb
@@ -5,6 +5,11 @@ ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../Gemfile', __FILE__)
 
 require 'bundler/setup' if File.exist?(ENV['BUNDLE_GEMFILE'])
 
+# set default directory for multiproces metrics gathering
+if ENV['RAILS_ENV'] == 'development' || ENV['RAILS_ENV'] == 'test'
+  ENV['prometheus_multiproc_dir'] ||= 'tmp/prometheus_multiproc_dir'
+end
+
 # Default Bootsnap configuration from https://github.com/Shopify/bootsnap#usage
 require 'bootsnap'
 Bootsnap.setup(
diff --git a/doc/administration/monitoring/prometheus/gitlab_metrics.md b/doc/administration/monitoring/prometheus/gitlab_metrics.md
new file mode 100644
index 00000000000..fc3e8e63c5e
--- /dev/null
+++ b/doc/administration/monitoring/prometheus/gitlab_metrics.md
@@ -0,0 +1,47 @@
+# GitLab Prometheus metrics
+
+>**Note:**
+Available since [Omnibus GitLab 9.3][29118]. Currently experimental. For installations from source
+you'll have to configure it yourself.
+
+GitLab monitors its own internal service metrics, and makes them available at the `/-/metrics` endpoint. Unlike other [Prometheus] exporters, this endpoint requires authentication as it is available on the same URL and port as user traffic.
+
+To enable the GitLab Prometheus metrics:
+
+1. Log into GitLab as an administrator, and go to the Admin area.
+1. Click on the gear, then click on Settings.
+1. Find the `Metrics - Prometheus` section, and click `Enable Prometheus Metrics`
+1. [Restart GitLab][restart] for the changes to take effect
+
+## Collecting the metrics
+
+Since the metrics endpoint is available on the same host and port as other traffic, it requires authentication. The token and URL to access is displayed on the [Health Check][health-check] page.
+
+Currently the embedded Prometheus server is not automatically configured to collect metrics from this endpoint. We recommend setting up another Prometheus server, because the embedded server configuration is overwritten one every reconfigure of GitLab. In the future this will not be required.
+
+## Metrics available
+
+In this experimental phase, only a few metrics are available:
+
+| Metric | Type | Description |
+| ------ | ---- | ----------- |
+| db_ping_timeout | Gauge | Whether or not the last database ping timed out |
+| db_ping_success | Gauge | Whether or not the last database ping succeeded |
+| db_ping_latency | Gauge | Round trip time of the database ping |
+| redis_ping_timeout | Gauge | Whether or not the last redis ping timed out |
+| redis_ping_success | Gauge | Whether or not the last redis ping succeeded |
+| redis_ping_latency | Gauge | Round trip time of the redis ping |
+| filesystem_access_latency | gauge | Latency in accessing a specific filesystem |
+| filesystem_accessible | gauge | Whether or not a specific filesystem is accessible |
+| filesystem_write_latency | gauge | Write latency of a specific filesystem |
+| filesystem_writable | gauge | Whether or not the filesystem is writable |
+| filesystem_read_latency | gauge | Read latency of a specific filesystem |
+| filesystem_readable | gauge | Whether or not the filesystem is readable |
+| user_sessions_logins | Counter | Counter of how many users have logged in |
+
+[← Back to the main Prometheus page](index.md)
+
+[29118]: https://gitlab.com/gitlab-org/gitlab-ce/issues/29118
+[Prometheus]: https://prometheus.io
+[restart]: ../../restart_gitlab.md#omnibus-gitlab-restart
+[health-check]: ../../../user/admin_area/monitoring/health_check.md
diff --git a/doc/administration/monitoring/prometheus/gitlab_monitor_exporter.md b/doc/administration/monitoring/prometheus/gitlab_monitor_exporter.md
index edb9c911aac..f68b03d1ade 100644
--- a/doc/administration/monitoring/prometheus/gitlab_monitor_exporter.md
+++ b/doc/administration/monitoring/prometheus/gitlab_monitor_exporter.md
@@ -4,7 +4,7 @@
 Available since [Omnibus GitLab 8.17][1132]. For installations from source
 you'll have to install and configure it yourself.
 
-The [GitLab monitor exporter] allows you to measure various GitLab metrics.
+The [GitLab monitor exporter] allows you to measure various GitLab metrics, pulled from Redis and the database.
 
 To enable the GitLab monitor exporter:
 
diff --git a/doc/administration/monitoring/prometheus/index.md b/doc/administration/monitoring/prometheus/index.md
index b2445d1c0e5..695fdf09a87 100644
--- a/doc/administration/monitoring/prometheus/index.md
+++ b/doc/administration/monitoring/prometheus/index.md
@@ -110,6 +110,14 @@ To disable the monitoring of Kubernetes:
 1. Save the file and [reconfigure GitLab][reconfigure] for the changes to
    take effect
 
+## GitLab Prometheus metrics
+
+> Introduced as an experimental feature in GitLab 9.3.
+
+GitLab monitors its own internal service metrics, and makes them available at the `/-/metrics` endpoint. Unlike other exporters, this endpoint requires authentication as it is available on the same URL and port as user traffic.
+
+[➔ Read more about the GitLab Metrics.](gitlab_metrics.md)
+
 ## Prometheus exporters
 
 There are a number of libraries and servers which help in exporting existing
@@ -143,7 +151,7 @@ The Postgres exporter allows you to measure various PostgreSQL metrics.
 
 ### GitLab monitor exporter
 
-The GitLab monitor exporter allows you to measure various GitLab metrics.
+The GitLab monitor exporter allows you to measure various GitLab metrics, pulled from Redis and the database.
 
 [➔ Read more about the GitLab monitor exporter.](gitlab_monitor_exporter.md)
 
diff --git a/doc/api/users.md b/doc/api/users.md
index 91ce4f6dac3..43d53756e44 100644
--- a/doc/api/users.md
+++ b/doc/api/users.md
@@ -62,6 +62,7 @@ GET /users
     "avatar_url": "http://localhost:3000/uploads/user/avatar/1/index.jpg",
     "web_url": "http://localhost:3000/john_smith",
     "created_at": "2012-05-23T08:00:58Z",
+    "is_admin": false,
     "bio": null,
     "location": null,
     "skype": "",
@@ -94,6 +95,7 @@ GET /users
     "avatar_url": "http://localhost:3000/uploads/user/avatar/2/index.jpg",
     "web_url": "http://localhost:3000/jack_smith",
     "created_at": "2012-05-23T08:01:01Z",
+    "is_admin": false,
     "bio": null,
     "location": null,
     "skype": "",
@@ -197,6 +199,7 @@ Parameters:
   "avatar_url": "http://localhost:3000/uploads/user/avatar/1/index.jpg",
   "web_url": "http://localhost:3000/john_smith",
   "created_at": "2012-05-23T08:00:58Z",
+  "is_admin": false,
   "bio": null,
   "location": null,
   "skype": "",
diff --git a/doc/install/requirements.md b/doc/install/requirements.md
index 197a92905c8..e5aaccdeadf 100644
--- a/doc/install/requirements.md
+++ b/doc/install/requirements.md
@@ -86,56 +86,31 @@ if your available memory changes.
 
 Notice: The 25 workers of Sidekiq will show up as separate processes in your process overview (such as top or htop) but they share the same RAM allocation since Sidekiq is a multithreaded application. Please see the section below about Unicorn workers for information about many you need of those.
 
-## GitLab Runner
-
-We strongly advise against installing GitLab Runner on the same machine you plan
-to install GitLab on. Depending on how you decide to configure GitLab Runner and
-what tools you use to exercise your application in the CI environment, GitLab
-Runner can consume significant amount of available memory.
-
-Memory consumption calculations, that are available above, will not be valid if
-you decide to run GitLab Runner and the GitLab Rails application on the same
-machine.
-
-It is also not safe to install everything on a single machine, because of the
-[security reasons] - especially when you plan to use shell executor with GitLab
-Runner.
-
-We recommend using a separate machine for each GitLab Runner, if you plan to
-use the CI features.
-
-[security reasons]: https://gitlab.com/gitlab-org/gitlab-ci-multi-runner/blob/master/docs/security/index.md
-
-## Unicorn Workers
-
-It's possible to increase the amount of unicorn workers and this will usually help to reduce the response time of the applications and increase the ability to handle parallel requests.
-
-For most instances we recommend using: CPU cores + 1 = unicorn workers.
-So for a machine with 2 cores, 3 unicorn workers is ideal.
-
-For all machines that have 2GB and up we recommend a minimum of three unicorn workers.
-If you have a 1GB machine we recommend to configure only two Unicorn workers to prevent excessive swapping.
-
-To change the Unicorn workers when you have the Omnibus package please see [the Unicorn settings in the Omnibus GitLab documentation](https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/doc/settings/unicorn.md#unicorn-settings).
-
 ## Database
 
+The server running the database should have _at least_ 5-10 GB of storage
+available, though the exact requirements depend on the size of the GitLab
+installation (e.g. the number of users, projects, etc).
+
 We currently support the following databases:
 
 - PostgreSQL
 - MySQL/MariaDB
 
-We _highly_ recommend the use of PostgreSQL instead of MySQL/MariaDB as not all
-features of GitLab may work with MySQL/MariaDB. For example, MySQL does not have
-the right features to support nested groups in an efficient manner; see
-<https://gitlab.com/gitlab-org/gitlab-ce/issues/30472> for more information
-about this. GitLab Geo also does [not support MySQL](https://docs.gitlab.com/ee/gitlab-geo/database.html#mysql-replication).
+We **highly recommend** the use of PostgreSQL instead of MySQL/MariaDB as not all
+features of GitLab may work with MySQL/MariaDB:
+
+1. MySQL support for subgroups was [dropped with GitLab 9.3][post].
+   See [issue #30472][30472] for more information.
+1. GitLab Geo does [not support MySQL](https://docs.gitlab.com/ee/gitlab-geo/database.html#mysql-replication).
+1. [Zero downtime migrations][zero] do not work with MySQL
+
 Existing users using GitLab with MySQL/MariaDB are advised to
-migrate to PostgreSQL instead.
+[migrate to PostgreSQL](../update/mysql_to_postgresql.md) instead.
 
-The server running the database should have _at least_ 5-10 GB of storage
-available, though the exact requirements depend on the size of the GitLab
-installation (e.g. the number of users, projects, etc).
+[30472]: https://gitlab.com/gitlab-org/gitlab-ce/issues/30472
+[zero]: ../update/README.md#upgrading-without-downtime
+[post]: https://about.gitlab.com/2017/06/22/gitlab-9-3-released/#dropping-support-for-subgroups-in-mysql
 
 ### PostgreSQL Requirements
 
@@ -154,6 +129,18 @@ CREATE EXTENSION pg_trgm;
 On some systems you may need to install an additional package (e.g.
 `postgresql-contrib`) for this extension to become available.
 
+## Unicorn Workers
+
+It's possible to increase the amount of unicorn workers and this will usually help to reduce the response time of the applications and increase the ability to handle parallel requests.
+
+For most instances we recommend using: CPU cores + 1 = unicorn workers.
+So for a machine with 2 cores, 3 unicorn workers is ideal.
+
+For all machines that have 2GB and up we recommend a minimum of three unicorn workers.
+If you have a 1GB machine we recommend to configure only two Unicorn workers to prevent excessive swapping.
+
+To change the Unicorn workers when you have the Omnibus package please see [the Unicorn settings in the Omnibus GitLab documentation](https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/doc/settings/unicorn.md#unicorn-settings).
+
 ## Redis and Sidekiq
 
 Redis stores all user sessions and the background task queue.
@@ -172,6 +159,26 @@ default settings.
 If you would like to disable Prometheus and it's exporters or read more information
 about it, check the [Prometheus documentation](../administration/monitoring/prometheus/index.md).
 
+## GitLab Runner
+
+We strongly advise against installing GitLab Runner on the same machine you plan
+to install GitLab on. Depending on how you decide to configure GitLab Runner and
+what tools you use to exercise your application in the CI environment, GitLab
+Runner can consume significant amount of available memory.
+
+Memory consumption calculations, that are available above, will not be valid if
+you decide to run GitLab Runner and the GitLab Rails application on the same
+machine.
+
+It is also not safe to install everything on a single machine, because of the
+[security reasons] - especially when you plan to use shell executor with GitLab
+Runner.
+
+We recommend using a separate machine for each GitLab Runner, if you plan to
+use the CI features.
+
+[security reasons]: https://gitlab.com/gitlab-org/gitlab-ci-multi-runner/blob/master/docs/security/index.md
+
 ## Supported web browsers
 
 We support the current and the previous major release of Firefox, Chrome/Chromium, Safari and Microsoft browsers (Microsoft Edge and Internet Explorer 11).
diff --git a/doc/update/README.md b/doc/update/README.md
index d024a809f24..22dbc7c750f 100644
--- a/doc/update/README.md
+++ b/doc/update/README.md
@@ -11,22 +11,6 @@ There are currently 3 official ways to install GitLab:
 
 Based on your installation, choose a section below that fits your needs.
 
----
-
-<!-- START doctoc generated TOC please keep comment here to allow auto update -->
-<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
-**Table of Contents**  *generated with [DocToc](https://github.com/thlorenz/doctoc)*
-
-- [Omnibus Packages](#omnibus-packages)
-- [Installation from source](#installation-from-source)
-- [Installation using Docker](#installation-using-docker)
-- [Upgrading between editions](#upgrading-between-editions)
-    - [Community to Enterprise Edition](#community-to-enterprise-edition)
-    - [Enterprise to Community Edition](#enterprise-to-community-edition)
-- [Miscellaneous](#miscellaneous)
-
-<!-- END doctoc generated TOC please keep comment here to allow auto update -->
-
 ## Omnibus Packages
 
 - The [Omnibus update guide](http://docs.gitlab.com/omnibus/update/README.html)
diff --git a/doc/user/group/subgroups/index.md b/doc/user/group/subgroups/index.md
index c4921c74a17..5724dcfab48 100644
--- a/doc/user/group/subgroups/index.md
+++ b/doc/user/group/subgroups/index.md
@@ -1,6 +1,9 @@
 # Subgroups
 
-> [Introduced][ce-2772] in GitLab 9.0.
+>**Notes:**
+- [Introduced][ce-2772] in GitLab 9.0.
+- Not available when using MySQL as external database (support removed in
+  GitLab 9.3 [due to performance reasons][issue]).
 
 With subgroups (aka nested groups or hierarchical groups) you can have
 up to 20 levels of nested groups, which among other things can help you to:
@@ -173,3 +176,4 @@ Here's a list of what you can't do with subgroups:
 [ce-2772]: https://gitlab.com/gitlab-org/gitlab-ce/issues/2772
 [permissions]: ../../permissions.md#group
 [reserved]:  https://gitlab.com/gitlab-org/gitlab-ce/blob/master/lib/gitlab/path_regex.rb
+[issue]: https://gitlab.com/gitlab-org/gitlab-ce/issues/30472#note_27747600
diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index a836df3dc81..a4c41ceb724 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -43,11 +43,14 @@ module API
       expose :external
     end
 
-    class UserWithPrivateDetails < UserPublic
-      expose :private_token
+    class UserWithAdmin < UserPublic
       expose :admin?, as: :is_admin
     end
 
+    class UserWithPrivateDetails < UserWithAdmin
+      expose :private_token
+    end
+
     class Email < Grape::Entity
       expose :id, :email
     end
diff --git a/lib/api/users.rb b/lib/api/users.rb
index dda64715ee1..37f868bb343 100644
--- a/lib/api/users.rb
+++ b/lib/api/users.rb
@@ -58,7 +58,7 @@ module API
 
         users = UsersFinder.new(current_user, params).execute
 
-        entity = current_user.admin? ? Entities::UserPublic : Entities::UserBasic
+        entity = current_user.admin? ? Entities::UserWithAdmin : Entities::UserBasic
         present paginate(users), with: entity
       end
 
diff --git a/lib/gitlab/metrics/prometheus.rb b/lib/gitlab/metrics/prometheus.rb
index 60686509332..9d314a56e58 100644
--- a/lib/gitlab/metrics/prometheus.rb
+++ b/lib/gitlab/metrics/prometheus.rb
@@ -5,8 +5,16 @@ module Gitlab
     module Prometheus
       include Gitlab::CurrentSettings
 
+      def metrics_folder_present?
+        ENV.has_key?('prometheus_multiproc_dir') &&
+          ::Dir.exist?(ENV['prometheus_multiproc_dir']) &&
+          ::File.writable?(ENV['prometheus_multiproc_dir'])
+      end
+
       def prometheus_metrics_enabled?
-        @prometheus_metrics_enabled ||= current_application_settings[:prometheus_metrics_enabled] || false
+        return @prometheus_metrics_enabled if defined?(@prometheus_metrics_enabled)
+
+        @prometheus_metrics_enabled = prometheus_metrics_enabled_unmemoized
       end
 
       def registry
@@ -36,6 +44,12 @@ module Gitlab
           NullMetric.new
         end
       end
+
+      private
+
+      def prometheus_metrics_enabled_unmemoized
+        metrics_folder_present? && current_application_settings[:prometheus_metrics_enabled] || false
+      end
     end
   end
 end
diff --git a/lib/gitlab/visibility_level.rb b/lib/gitlab/visibility_level.rb
index 2b53798e70f..36e5b5041a6 100644
--- a/lib/gitlab/visibility_level.rb
+++ b/lib/gitlab/visibility_level.rb
@@ -13,18 +13,8 @@ module Gitlab
       scope :public_and_internal_only,  -> { where(visibility_level: [PUBLIC, INTERNAL] ) }
       scope :non_public_only,           -> { where.not(visibility_level: PUBLIC) }
 
-      scope :public_to_user, -> (user) do
-        if user
-          if user.admin?
-            all
-          elsif !user.external?
-            public_and_internal_only
-          else
-            public_only
-          end
-        else
-          public_only
-        end
+      scope :public_to_user, -> (user = nil) do
+        where(visibility_level: VisibilityLevel.levels_for_user(user))
       end
     end
 
@@ -35,6 +25,18 @@ module Gitlab
     class << self
       delegate :values, to: :options
 
+      def levels_for_user(user = nil)
+        return [PUBLIC] unless user
+
+        if user.admin?
+          [PRIVATE, INTERNAL, PUBLIC]
+        elsif user.external?
+          [PUBLIC]
+        else
+          [INTERNAL, PUBLIC]
+        end
+      end
+
       def string_values
         string_options.keys
       end
diff --git a/locale/es/gitlab.po b/locale/es/gitlab.po
index 4ce9ce4b28a..bf6743c1b98 100644
--- a/locale/es/gitlab.po
+++ b/locale/es/gitlab.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gitlab 1.0.0\n"
 "Report-Msgid-Bugs-To: \n"
-"PO-Revision-Date: 2017-06-15 21:59-0500\n"
+"PO-Revision-Date: 2017-06-19 15:22-0500\n"
 "Language-Team: Spanish\n"
 "Language: es\n"
 "MIME-Version: 1.0\n"
@@ -61,6 +61,12 @@ msgstr[1] "Ramas"
 msgid "Branch <strong>%{branch_name}</strong> was created. To set up auto deploy, choose a GitLab CI Yaml template and commit your changes. %{link_to_autodeploy_doc}"
 msgstr "La rama <strong>%{branch_name}</strong> fue creada. Para configurar el auto despliegue, escoge una plantilla Yaml para GitLab CI y envía tus cambios. %{link_to_autodeploy_doc}"
 
+msgid "BranchSwitcherPlaceholder|Search branches"
+msgstr "Buscar ramas"
+
+msgid "BranchSwitcherTitle|Switch branch"
+msgstr "Cambiar rama"
+
 msgid "Branches"
 msgstr "Ramas"
 
@@ -945,6 +951,9 @@ msgstr "Subir nuevo archivo"
 msgid "Upload file"
 msgstr "Subir archivo"
 
+msgid "UploadLink|click to upload"
+msgstr "Hacer clic para subir"
+
 msgid "Use your global notification setting"
 msgstr "Utiliza tu configuración de notificación global"
 
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index cbfd6100ca7..7ece605a5a4 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -8,8 +8,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gitlab 1.0.0\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2017-06-16 18:53-0500\n"
-"PO-Revision-Date: 2017-06-16 18:53-0500\n"
+"POT-Creation-Date: 2017-06-19 15:13-0500\n"
+"PO-Revision-Date: 2017-06-19 15:13-0500\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
 "Language: \n"
@@ -62,6 +62,12 @@ msgstr[1] ""
 msgid "Branch <strong>%{branch_name}</strong> was created. To set up auto deploy, choose a GitLab CI Yaml template and commit your changes. %{link_to_autodeploy_doc}"
 msgstr ""
 
+msgid "BranchSwitcherPlaceholder|Search branches"
+msgstr ""
+
+msgid "BranchSwitcherTitle|Switch branch"
+msgstr ""
+
 msgid "Branches"
 msgstr ""
 
@@ -946,6 +952,9 @@ msgstr ""
 msgid "Upload file"
 msgstr ""
 
+msgid "UploadLink|click to upload"
+msgstr ""
+
 msgid "Use your global notification setting"
 msgstr ""
 
diff --git a/spec/features/merge_requests/closes_issues_spec.rb b/spec/features/merge_requests/closes_issues_spec.rb
index 26444bb7a55..e627618042a 100644
--- a/spec/features/merge_requests/closes_issues_spec.rb
+++ b/spec/features/merge_requests/closes_issues_spec.rb
@@ -36,7 +36,7 @@ feature 'Merge Request closing issues message', feature: true, js: true do
     let(:merge_request_description) { "Description\n\nclosing #{issue_1.to_reference}, #{issue_2.to_reference}" }
 
     it 'does not display closing issue message' do
-      expect(page).to have_content("Closed issues #{issue_1.to_reference} and #{issue_2.to_reference}")
+      expect(page).to have_content("Closes issues #{issue_1.to_reference} and #{issue_2.to_reference}")
     end
   end
 
@@ -44,7 +44,7 @@ feature 'Merge Request closing issues message', feature: true, js: true do
     let(:merge_request_description) { "Description\n\nRefers to #{issue_1.to_reference} and #{issue_2.to_reference}" }
 
     it 'does not display closing issue message' do
-      expect(page).to have_content("Issues #{issue_1.to_reference} and #{issue_2.to_reference} are mentioned but were not closed")
+      expect(page).to have_content("Issues #{issue_1.to_reference} and #{issue_2.to_reference} are mentioned but will not be closed.")
     end
   end
 
@@ -52,8 +52,8 @@ feature 'Merge Request closing issues message', feature: true, js: true do
     let(:merge_request_title) { "closes #{issue_1.to_reference}\n\n refers to #{issue_2.to_reference}" }
 
     it 'does not display closing issue message' do
-      expect(page).to have_content("Closed issue #{issue_1.to_reference}")
-      expect(page).to have_content("Issue #{issue_2.to_reference} is mentioned but was not closed")
+      expect(page).to have_content("Closes issue #{issue_1.to_reference}.")
+      expect(page).to have_content("Issue #{issue_2.to_reference} is mentioned but will not be closed.")
     end
   end
 
@@ -61,7 +61,7 @@ feature 'Merge Request closing issues message', feature: true, js: true do
     let(:merge_request_title) { "closing #{issue_1.to_reference}, #{issue_2.to_reference}" }
 
     it 'does not display closing issue message' do
-      expect(page).to have_content("Closed issues #{issue_1.to_reference} and #{issue_2.to_reference}")
+      expect(page).to have_content("Closes issues #{issue_1.to_reference} and #{issue_2.to_reference}")
     end
   end
 
@@ -69,7 +69,7 @@ feature 'Merge Request closing issues message', feature: true, js: true do
     let(:merge_request_title) { "Refers to #{issue_1.to_reference} and #{issue_2.to_reference}" }
 
     it 'does not display closing issue message' do
-      expect(page).to have_content("Issues #{issue_1.to_reference} and #{issue_2.to_reference} are mentioned but were not closed")
+      expect(page).to have_content("Issues #{issue_1.to_reference} and #{issue_2.to_reference} are mentioned but will not be closed.")
     end
   end
 
@@ -77,8 +77,8 @@ feature 'Merge Request closing issues message', feature: true, js: true do
     let(:merge_request_title) { "closes #{issue_1.to_reference}\n\n refers to #{issue_2.to_reference}" }
 
     it 'does not display closing issue message' do
-      expect(page).to have_content("Closed issue #{issue_1.to_reference}")
-      expect(page).to have_content("Issue #{issue_2.to_reference} is mentioned but was not closed")
+      expect(page).to have_content("Closes issue #{issue_1.to_reference}. Issue #{issue_2.to_reference} is mentioned but will not be closed.")
+      expect(page).to have_content("Issue #{issue_2.to_reference} is mentioned but will not be closed.")
     end
   end
 end
diff --git a/spec/features/reportable_note/snippets_spec.rb b/spec/features/reportable_note/snippets_spec.rb
index 3f1e0cf9097..f761371323f 100644
--- a/spec/features/reportable_note/snippets_spec.rb
+++ b/spec/features/reportable_note/snippets_spec.rb
@@ -19,15 +19,4 @@ describe 'Reportable note on snippets', :feature, :js do
 
     it_behaves_like 'reportable note'
   end
-
-  describe 'on personal snippet' do
-    let(:snippet) { create(:personal_snippet, :public, author: user) }
-    let!(:note) { create(:note_on_personal_snippet, noteable: snippet, author: user) }
-
-    before do
-      visit snippet_path(snippet)
-    end
-
-    it_behaves_like 'reportable note'
-  end
 end
diff --git a/spec/helpers/application_helper_spec.rb b/spec/helpers/application_helper_spec.rb
index 49df91b236f..28a154fd9e2 100644
--- a/spec/helpers/application_helper_spec.rb
+++ b/spec/helpers/application_helper_spec.rb
@@ -82,42 +82,71 @@ describe ApplicationHelper do
   end
 
   describe 'avatar_icon' do
-    it 'returns an url for the avatar' do
-      user = create(:user, avatar: File.open(uploaded_image_temp_path))
-
-      avatar_url = "/uploads/system/user/avatar/#{user.id}/banana_sample.gif"
-
-      expect(helper.avatar_icon(user.email).to_s).to match(avatar_url)
-
-      allow(ActionController::Base).to receive(:asset_host).and_return(gitlab_host)
-      avatar_url = "#{gitlab_host}/uploads/system/user/avatar/#{user.id}/banana_sample.gif"
-
-      expect(helper.avatar_icon(user.email).to_s).to match(avatar_url)
-    end
-
-    it 'returns an url for the avatar with relative url' do
-      stub_config_setting(relative_url_root: '/gitlab')
-      # Must be stubbed after the stub above, and separately
-      stub_config_setting(url: Settings.send(:build_gitlab_url))
-
-      user = create(:user, avatar: File.open(uploaded_image_temp_path))
-
-      expect(helper.avatar_icon(user.email).to_s).
-        to match("/gitlab/uploads/system/user/avatar/#{user.id}/banana_sample.gif")
-    end
+    let(:user) { create(:user, avatar: File.open(uploaded_image_temp_path)) }
+
+    context 'using an email' do
+      context 'when there is a matching user' do
+        it 'returns a relative URL for the avatar' do
+          expect(helper.avatar_icon(user.email).to_s).
+            to eq("/uploads/system/user/avatar/#{user.id}/banana_sample.gif")
+        end
+
+        context 'when an asset_host is set in the config' do
+          let(:asset_host) { 'http://assets' }
+
+          before do
+            allow(ActionController::Base).to receive(:asset_host).and_return(asset_host)
+          end
+
+          it 'returns an absolute URL on that asset host' do
+            expect(helper.avatar_icon(user.email, only_path: false).to_s).
+              to eq("#{asset_host}/uploads/system/user/avatar/#{user.id}/banana_sample.gif")
+          end
+        end
+
+        context 'when only_path is set to false' do
+          it 'returns an absolute URL for the avatar' do
+            expect(helper.avatar_icon(user.email, only_path: false).to_s).
+              to eq("#{gitlab_host}/uploads/system/user/avatar/#{user.id}/banana_sample.gif")
+          end
+        end
+
+        context 'when the GitLab instance is at a relative URL' do
+          before do
+            stub_config_setting(relative_url_root: '/gitlab')
+            # Must be stubbed after the stub above, and separately
+            stub_config_setting(url: Settings.send(:build_gitlab_url))
+          end
+
+          it 'returns a relative URL with the correct prefix' do
+            expect(helper.avatar_icon(user.email).to_s).
+              to eq("/gitlab/uploads/system/user/avatar/#{user.id}/banana_sample.gif")
+          end
+        end
+      end
 
-    it 'calls gravatar_icon when no User exists with the given email' do
-      expect(helper).to receive(:gravatar_icon).with('foo@example.com', 20, 2)
+      context 'when no user exists for the email' do
+        it 'calls gravatar_icon' do
+          expect(helper).to receive(:gravatar_icon).with('foo@example.com', 20, 2)
 
-      helper.avatar_icon('foo@example.com', 20, 2)
+          helper.avatar_icon('foo@example.com', 20, 2)
+        end
+      end
     end
 
-    describe 'using a User' do
-      it 'returns an URL for the avatar' do
-        user = create(:user, avatar: File.open(uploaded_image_temp_path))
+    describe 'using a user' do
+      context 'when only_path is true' do
+        it 'returns a relative URL for the avatar' do
+          expect(helper.avatar_icon(user, only_path: true).to_s).
+            to eq("/uploads/system/user/avatar/#{user.id}/banana_sample.gif")
+        end
+      end
 
-        expect(helper.avatar_icon(user).to_s).
-          to match("/uploads/system/user/avatar/#{user.id}/banana_sample.gif")
+      context 'when only_path is false' do
+        it 'returns an absolute URL for the avatar' do
+          expect(helper.avatar_icon(user, only_path: false).to_s).
+            to eq("#{gitlab_host}/uploads/system/user/avatar/#{user.id}/banana_sample.gif")
+        end
       end
     end
   end
diff --git a/spec/javascripts/fixtures/merge_requests.rb b/spec/javascripts/fixtures/merge_requests.rb
index a746a776548..0715f4d5f6b 100644
--- a/spec/javascripts/fixtures/merge_requests.rb
+++ b/spec/javascripts/fixtures/merge_requests.rb
@@ -55,13 +55,20 @@ describe Projects::MergeRequestsController, '(JavaScript fixtures)', type: :cont
     render_merge_request(example.description, merge_request)
   end
 
+  it 'merge_requests/changes_tab_with_comments.json' do |example|
+    create(:diff_note_on_merge_request, project: project, author: admin, position: position, noteable: merge_request)
+    create(:note_on_merge_request, author: admin, project: project, noteable: merge_request)
+    render_merge_request(example.description, merge_request, action: :diffs, format: :json)
+  end
+
   private
 
-  def render_merge_request(fixture_file_name, merge_request)
-    get :show,
+  def render_merge_request(fixture_file_name, merge_request, action: :show, format: :html)
+    get action,
       namespace_id: project.namespace.to_param,
       project_id: project,
-      id: merge_request.to_param
+      id: merge_request.to_param,
+      format: format
 
     expect(response).to be_success
     store_frontend_fixture(response, fixture_file_name)
diff --git a/spec/javascripts/merge_request_notes_spec.js b/spec/javascripts/merge_request_notes_spec.js
index e54acfa8e44..b6d0ce02c4f 100644
--- a/spec/javascripts/merge_request_notes_spec.js
+++ b/spec/javascripts/merge_request_notes_spec.js
@@ -7,54 +7,92 @@ import '~/render_gfm';
 import '~/render_math';
 import '~/notes';
 
+const upArrowKeyCode = 38;
+
 describe('Merge request notes', () => {
   window.gon = window.gon || {};
   window.gl = window.gl || {};
   gl.utils = gl.utils || {};
 
-  const fixture = 'merge_requests/diff_comment.html.raw';
-  preloadFixtures(fixture);
+  const discussionTabFixture = 'merge_requests/diff_comment.html.raw';
+  const changesTabJsonFixture = 'merge_requests/changes_tab_with_comments.json';
+  preloadFixtures(discussionTabFixture, changesTabJsonFixture);
 
-  beforeEach(() => {
-    loadFixtures(fixture);
-    gl.utils.disableButtonIfEmptyField = _.noop;
-    window.project_uploads_path = 'http://test.host/uploads';
-    $('body').data('page', 'projects:merge_requests:show');
-    window.gon.current_user_id = $('.note:last').data('author-id');
+  describe('Discussion tab with diff comments', () => {
+    beforeEach(() => {
+      loadFixtures(discussionTabFixture);
+      gl.utils.disableButtonIfEmptyField = _.noop;
+      window.project_uploads_path = 'http://test.host/uploads';
+      $('body').data('page', 'projects:merge_requests:show');
+      window.gon.current_user_id = $('.note:last').data('author-id');
 
-    return new Notes('', []);
-  });
+      return new Notes('', []);
+    });
+
+    describe('up arrow', () => {
+      it('edits last comment when triggered in main form', () => {
+        const upArrowEvent = $.Event('keydown');
+        upArrowEvent.which = upArrowKeyCode;
+
+        spyOnEvent('.note:last .js-note-edit', 'click');
+
+        $('.js-note-text').trigger(upArrowEvent);
+
+        expect('click').toHaveBeenTriggeredOn('.note:last .js-note-edit');
+      });
+
+      it('edits last comment in discussion when triggered in discussion form', (done) => {
+        const upArrowEvent = $.Event('keydown');
+        upArrowEvent.which = upArrowKeyCode;
+
+        spyOnEvent('.note-discussion .js-note-edit', 'click');
+
+        $('.js-discussion-reply-button').click();
 
-  describe('up arrow', () => {
-    it('edits last comment when triggered in main form', () => {
-      const upArrowEvent = $.Event('keydown');
-      upArrowEvent.which = 38;
+        setTimeout(() => {
+          expect(
+            $('.note-discussion .js-note-text'),
+          ).toExist();
 
-      spyOnEvent('.note:last .js-note-edit', 'click');
+          $('.note-discussion .js-note-text').trigger(upArrowEvent);
 
-      $('.js-note-text').trigger(upArrowEvent);
+          expect('click').toHaveBeenTriggeredOn('.note-discussion .js-note-edit');
 
-      expect('click').toHaveBeenTriggeredOn('.note:last .js-note-edit');
+          done();
+        });
+      });
     });
+  });
 
-    it('edits last comment in discussion when triggered in discussion form', (done) => {
-      const upArrowEvent = $.Event('keydown');
-      upArrowEvent.which = 38;
+  describe('Changes tab with diff comments', () => {
+    beforeEach(() => {
+      const diffsResponse = getJSONFixture(changesTabJsonFixture);
+      const noteFormHtml = `<form class="js-new-note-form">
+        <textarea class="js-note-text"></textarea>
+      </form>`;
+      setFixtures(diffsResponse.html + noteFormHtml);
+      $('body').data('page', 'projects:merge_requests:show');
+      window.gon.current_user_id = $('.note:last').data('author-id');
+
+      return new Notes('', []);
+    });
 
-      spyOnEvent('.note-discussion .js-note-edit', 'click');
+    describe('up arrow', () => {
+      it('edits last comment in discussion when triggered in discussion form', (done) => {
+        const upArrowEvent = $.Event('keydown');
+        upArrowEvent.which = upArrowKeyCode;
 
-      $('.js-discussion-reply-button').click();
+        spyOnEvent('.note:last .js-note-edit', 'click');
 
-      setTimeout(() => {
-        expect(
-          $('.note-discussion .js-note-text'),
-        ).toExist();
+        $('.js-discussion-reply-button').trigger('click');
 
-        $('.note-discussion .js-note-text').trigger(upArrowEvent);
+        setTimeout(() => {
+          $('.js-note-text').trigger(upArrowEvent);
 
-        expect('click').toHaveBeenTriggeredOn('.note-discussion .js-note-edit');
+          expect('click').toHaveBeenTriggeredOn('.note:last .js-note-edit');
 
-        done();
+          done();
+        });
       });
     });
   });
diff --git a/spec/javascripts/vue_mr_widget/components/mr_widget_related_links_spec.js b/spec/javascripts/vue_mr_widget/components/mr_widget_related_links_spec.js
index 6a44c54cdee..f6e0c3dfb74 100644
--- a/spec/javascripts/vue_mr_widget/components/mr_widget_related_links_spec.js
+++ b/spec/javascripts/vue_mr_widget/components/mr_widget_related_links_spec.js
@@ -1,31 +1,20 @@
 import Vue from 'vue';
-import MRWidgetRelatedLinks from '~/vue_merge_request_widget/components/mr_widget_related_links';
+import relatedLinksComponent from '~/vue_merge_request_widget/components/mr_widget_related_links';
 
-describe('MRWidgetRelatedLinks', () => {
-  let vm;
-
-  beforeEach(() => {
-    const Component = Vue.extend(MRWidgetRelatedLinks);
-    vm = new Component({
-      el: document.createElement('div'),
-      propsData: {
-        isMerged: false,
-        relatedLinks: {},
-      },
-    });
-  });
+const createComponent = (data) => {
+  const Component = Vue.extend(relatedLinksComponent);
 
-  afterEach(() => {
-    vm.$destroy();
+  return new Component({
+    el: document.createElement('div'),
+    propsData: data,
   });
+};
 
+describe('MRWidgetRelatedLinks', () => {
   describe('props', () => {
     it('should have props', () => {
-      const { isMerged, relatedLinks } = MRWidgetRelatedLinks.props;
+      const { relatedLinks } = relatedLinksComponent.props;
 
-      expect(isMerged).toBeDefined();
-      expect(isMerged.type).toBe(Boolean);
-      expect(isMerged.required).toBeTruthy();
       expect(relatedLinks).toBeDefined();
       expect(relatedLinks.type instanceof Object).toBeTruthy();
       expect(relatedLinks.required).toBeTruthy();
@@ -33,38 +22,16 @@ describe('MRWidgetRelatedLinks', () => {
   });
 
   describe('computed', () => {
-    describe('closingText', () => {
-      const dummyIssueLabel = 'dummy label';
-
-      beforeEach(() => {
-        spyOn(vm, 'issueLabel').and.returnValue(dummyIssueLabel);
-      });
-
-      it('outputs text for closing issues', () => {
-        vm.isMerged = false;
-
-        const text = vm.closingText;
-
-        expect(text).toBe(`Closes ${dummyIssueLabel}`);
-      });
-
-      it('outputs text for closed issues', () => {
-        vm.isMerged = true;
-
-        const text = vm.closingText;
-
-        expect(text).toBe(`Closed ${dummyIssueLabel}`);
-      });
-    });
-
     describe('hasLinks', () => {
       it('should return correct value when we have links reference', () => {
-        vm.relatedLinks = {
-          closing: '/foo',
-          mentioned: '/foo',
-          assignToMe: '/foo',
+        const data = {
+          relatedLinks: {
+            closing: '/foo',
+            mentioned: '/foo',
+            assignToMe: '/foo',
+          },
         };
-
+        const vm = createComponent(data);
         expect(vm.hasLinks).toBeTruthy();
 
         vm.relatedLinks.closing = null;
@@ -77,160 +44,95 @@ describe('MRWidgetRelatedLinks', () => {
         expect(vm.hasLinks).toBeFalsy();
       });
     });
-
-    describe('mentionedText', () => {
-      it('outputs text for one mentioned issue before merging', () => {
-        vm.isMerged = false;
-        spyOn(vm, 'hasMultipleIssues').and.returnValue(false);
-
-        const text = vm.mentionedText;
-
-        expect(text).toBe('is mentioned but will not be closed');
-      });
-
-      it('outputs text for one mentioned issue after merging', () => {
-        vm.isMerged = true;
-        spyOn(vm, 'hasMultipleIssues').and.returnValue(false);
-
-        const text = vm.mentionedText;
-
-        expect(text).toBe('is mentioned but was not closed');
-      });
-
-      it('outputs text for multiple mentioned issue before merging', () => {
-        vm.isMerged = false;
-        spyOn(vm, 'hasMultipleIssues').and.returnValue(true);
-
-        const text = vm.mentionedText;
-
-        expect(text).toBe('are mentioned but will not be closed');
-      });
-
-      it('outputs text for multiple mentioned issue after merging', () => {
-        vm.isMerged = true;
-        spyOn(vm, 'hasMultipleIssues').and.returnValue(true);
-
-        const text = vm.mentionedText;
-
-        expect(text).toBe('are mentioned but were not closed');
-      });
-    });
   });
 
   describe('methods', () => {
-    const relatedLinks = {
-      oneIssue: '<a href="#">#7</a>',
-      twoIssues: '<a href="#">#23</a> and <a>#42</a>',
-      threeIssues: '<a href="#">#1</a>, <a>#2</a>, and <a>#3</a>',
+    const data = {
+      relatedLinks: {
+        closing: '<a href="#">#23</a> and <a>#42</a>',
+        mentioned: '<a href="#">#7</a>',
+      },
     };
-
-    beforeEach(() => {
-      vm.relatedLinks = relatedLinks;
-    });
+    const vm = createComponent(data);
 
     describe('hasMultipleIssues', () => {
       it('should return true if the given text has multiple issues', () => {
-        expect(vm.hasMultipleIssues(relatedLinks.twoIssues)).toBeTruthy();
-        expect(vm.hasMultipleIssues(relatedLinks.threeIssues)).toBeTruthy();
+        expect(vm.hasMultipleIssues(data.relatedLinks.closing)).toBeTruthy();
       });
 
       it('should return false if the given text has one issue', () => {
-        expect(vm.hasMultipleIssues(relatedLinks.oneIssue)).toBeFalsy();
+        expect(vm.hasMultipleIssues(data.relatedLinks.mentioned)).toBeFalsy();
       });
     });
 
     describe('issueLabel', () => {
       it('should return true if the given text has multiple issues', () => {
-        expect(vm.issueLabel('twoIssues')).toEqual('issues');
-        expect(vm.issueLabel('threeIssues')).toEqual('issues');
+        expect(vm.issueLabel('closing')).toEqual('issues');
+      });
+
+      it('should return false if the given text has one issue', () => {
+        expect(vm.issueLabel('mentioned')).toEqual('issue');
+      });
+    });
+
+    describe('verbLabel', () => {
+      it('should return true if the given text has multiple issues', () => {
+        expect(vm.verbLabel('closing')).toEqual('are');
       });
 
       it('should return false if the given text has one issue', () => {
-        expect(vm.issueLabel('oneIssue')).toEqual('issue');
+        expect(vm.verbLabel('mentioned')).toEqual('is');
       });
     });
   });
 
   describe('template', () => {
-    it('should have only have closing issues text', (done) => {
-      vm.relatedLinks = {
-        closing: '<a href="#">#23</a> and <a>#42</a>',
-      };
-
-      Vue.nextTick()
-      .then(() => {
-        const content = vm.$el.textContent.replace(/\n(\s)+/g, ' ').trim();
+    it('should have only have closing issues text', () => {
+      const vm = createComponent({
+        relatedLinks: {
+          closing: '<a href="#">#23</a> and <a>#42</a>',
+        },
+      });
+      const content = vm.$el.textContent.replace(/\n(\s)+/g, ' ').trim();
 
-        expect(content).toContain('Closes issues #23 and #42');
-        expect(content).not.toContain('mentioned');
-      })
-      .then(done)
-      .catch(done.fail);
+      expect(content).toContain('Closes issues #23 and #42');
+      expect(content).not.toContain('mentioned');
     });
 
-    it('should have only have mentioned issues text', (done) => {
-      vm.relatedLinks = {
-        mentioned: '<a href="#">#7</a>',
-      };
-
-      Vue.nextTick()
-      .then(() => {
-        expect(vm.$el.innerText).toContain('issue #7');
-        expect(vm.$el.innerText).toContain('is mentioned but will not be closed');
-        expect(vm.$el.innerText).not.toContain('Closes');
-      })
-      .then(done)
-      .catch(done.fail);
-    });
+    it('should have only have mentioned issues text', () => {
+      const vm = createComponent({
+        relatedLinks: {
+          mentioned: '<a href="#">#7</a>',
+        },
+      });
 
-    it('should have closing and mentioned issues at the same time', (done) => {
-      vm.relatedLinks = {
-        closing: '<a href="#">#7</a>',
-        mentioned: '<a href="#">#23</a> and <a>#42</a>',
-      };
-
-      Vue.nextTick()
-      .then(() => {
-        const content = vm.$el.textContent.replace(/\n(\s)+/g, ' ').trim();
-
-        expect(content).toContain('Closes issue #7.');
-        expect(content).toContain('issues #23 and #42');
-        expect(content).toContain('are mentioned but will not be closed');
-      })
-      .then(done)
-      .catch(done.fail);
+      expect(vm.$el.innerText).toContain('issue #7');
+      expect(vm.$el.innerText).toContain('is mentioned but will not be closed.');
+      expect(vm.$el.innerText).not.toContain('Closes');
     });
 
-    it('should have assing issues link', (done) => {
-      vm.relatedLinks = {
-        assignToMe: '<a href="#">Assign yourself to these issues</a>',
-      };
-
-      Vue.nextTick()
-      .then(() => {
-        expect(vm.$el.innerText).toContain('Assign yourself to these issues');
-      })
-      .then(done)
-      .catch(done.fail);
+    it('should have closing and mentioned issues at the same time', () => {
+      const vm = createComponent({
+        relatedLinks: {
+          closing: '<a href="#">#7</a>',
+          mentioned: '<a href="#">#23</a> and <a>#42</a>',
+        },
+      });
+      const content = vm.$el.textContent.replace(/\n(\s)+/g, ' ').trim();
+
+      expect(content).toContain('Closes issue #7.');
+      expect(content).toContain('issues #23 and #42');
+      expect(content).toContain('are mentioned but will not be closed.');
     });
 
-    it('should use different wording after merging', (done) => {
-      vm.isMerged = true;
-      vm.relatedLinks = {
-        closing: '<a href="#">#7</a>',
-        mentioned: '<a href="#">#23</a> and <a>#42</a>',
-      };
-
-      Vue.nextTick()
-      .then(() => {
-        const content = vm.$el.textContent.replace(/\n(\s)+/g, ' ').trim();
-
-        expect(content).toContain('Closed issue #7.');
-        expect(content).toContain('issues #23 and #42');
-        expect(content).toContain('are mentioned but were not closed');
-      })
-      .then(done)
-      .catch(done.fail);
+    it('should have assing issues link', () => {
+      const vm = createComponent({
+        relatedLinks: {
+          assignToMe: '<a href="#">Assign yourself to these issues</a>',
+        },
+      });
+
+      expect(vm.$el.innerText).toContain('Assign yourself to these issues');
     });
   });
 });
diff --git a/spec/javascripts/vue_mr_widget/mr_widget_options_spec.js b/spec/javascripts/vue_mr_widget/mr_widget_options_spec.js
index 425dff89439..3a0c50b750f 100644
--- a/spec/javascripts/vue_mr_widget/mr_widget_options_spec.js
+++ b/spec/javascripts/vue_mr_widget/mr_widget_options_spec.js
@@ -48,13 +48,12 @@ describe('mrWidgetOptions', () => {
     });
 
     describe('shouldRenderMergeHelp', () => {
-      it('should return false after merging', () => {
-        vm.mr.isMerged = true;
+      it('should return false for the initial merged state', () => {
         expect(vm.shouldRenderMergeHelp).toBeFalsy();
       });
 
-      it('should return true before merging', () => {
-        vm.mr.isMerged = false;
+      it('should return true for a state which requires help widget', () => {
+        vm.mr.state = 'conflicts';
         expect(vm.shouldRenderMergeHelp).toBeTruthy();
       });
     });
diff --git a/spec/javascripts/vue_mr_widget/stores/mr_widget_store_spec.js b/spec/javascripts/vue_mr_widget/stores/mr_widget_store_spec.js
index 71285866302..56dd0198ae2 100644
--- a/spec/javascripts/vue_mr_widget/stores/mr_widget_store_spec.js
+++ b/spec/javascripts/vue_mr_widget/stores/mr_widget_store_spec.js
@@ -18,17 +18,5 @@ describe('MergeRequestStore', () => {
       store.setData({ ...mockData, work_in_progress: !mockData.work_in_progress });
       expect(store.hasSHAChanged).toBe(false);
     });
-
-    it('sets isMerged to true for merged state', () => {
-      store.setData({ ...mockData, state: 'merged' });
-
-      expect(store.isMerged).toBe(true);
-    });
-
-    it('sets isMerged to false for readyToMerge state', () => {
-      store.setData({ ...mockData, state: 'readyToMerge' });
-
-      expect(store.isMerged).toBe(false);
-    });
   });
 });
diff --git a/spec/lib/gitlab/metrics_spec.rb b/spec/lib/gitlab/metrics_spec.rb
index 5a87b906609..58a84cd3fe1 100644
--- a/spec/lib/gitlab/metrics_spec.rb
+++ b/spec/lib/gitlab/metrics_spec.rb
@@ -15,6 +15,36 @@ describe Gitlab::Metrics do
     end
   end
 
+  describe '.prometheus_metrics_enabled_unmemoized' do
+    subject { described_class.send(:prometheus_metrics_enabled_unmemoized) }
+
+    context 'prometheus metrics enabled in config' do
+      before do
+        allow(described_class).to receive(:current_application_settings).and_return(prometheus_metrics_enabled: true)
+      end
+
+      context 'when metrics folder is present' do
+        before do
+          allow(described_class).to receive(:metrics_folder_present?).and_return(true)
+        end
+
+        it 'metrics are enabled' do
+          expect(subject).to eq(true)
+        end
+      end
+
+      context 'when metrics folder is missing' do
+        before do
+          allow(described_class).to receive(:metrics_folder_present?).and_return(false)
+        end
+
+        it 'metrics are disabled' do
+          expect(subject).to eq(false)
+        end
+      end
+    end
+  end
+
   describe '.prometheus_metrics_enabled?' do
     it 'returns a boolean' do
       expect(described_class.prometheus_metrics_enabled?).to be_in([true, false])
diff --git a/spec/lib/gitlab/visibility_level_spec.rb b/spec/lib/gitlab/visibility_level_spec.rb
index 3255c6f1ef7..a8f21803ec7 100644
--- a/spec/lib/gitlab/visibility_level_spec.rb
+++ b/spec/lib/gitlab/visibility_level_spec.rb
@@ -18,4 +18,35 @@ describe Gitlab::VisibilityLevel, lib: true do
       expect(described_class.level_value(100)).to eq(Gitlab::VisibilityLevel::PRIVATE)
     end
   end
+
+  describe '.levels_for_user' do
+    it 'returns all levels for an admin' do
+      user = double(:user, admin?: true)
+
+      expect(described_class.levels_for_user(user)).
+        to eq([Gitlab::VisibilityLevel::PRIVATE,
+               Gitlab::VisibilityLevel::INTERNAL,
+               Gitlab::VisibilityLevel::PUBLIC])
+    end
+
+    it 'returns INTERNAL and PUBLIC for internal users' do
+      user = double(:user, admin?: false, external?: false)
+
+      expect(described_class.levels_for_user(user)).
+        to eq([Gitlab::VisibilityLevel::INTERNAL,
+               Gitlab::VisibilityLevel::PUBLIC])
+    end
+
+    it 'returns PUBLIC for external users' do
+      user = double(:user, admin?: false, external?: true)
+
+      expect(described_class.levels_for_user(user)).
+        to eq([Gitlab::VisibilityLevel::PUBLIC])
+    end
+
+    it 'returns PUBLIC when no user is given' do
+      expect(described_class.levels_for_user).
+        to eq([Gitlab::VisibilityLevel::PUBLIC])
+    end
+  end
 end
diff --git a/spec/models/project_feature_spec.rb b/spec/models/project_feature_spec.rb
index 09a4448d387..580c83c12c0 100644
--- a/spec/models/project_feature_spec.rb
+++ b/spec/models/project_feature_spec.rb
@@ -4,6 +4,18 @@ describe ProjectFeature do
   let(:project) { create(:empty_project) }
   let(:user) { create(:user) }
 
+  describe '.quoted_access_level_column' do
+    it 'returns the table name and quoted column name for a feature' do
+      expected = if Gitlab::Database.postgresql?
+                   '"project_features"."issues_access_level"'
+                 else
+                   '`project_features`.`issues_access_level`'
+                 end
+
+      expect(described_class.quoted_access_level_column(:issues)).to eq(expected)
+    end
+  end
+
   describe '#feature_available?' do
     let(:features) { %w(issues wiki builds merge_requests snippets repository) }
 
diff --git a/spec/models/project_services/chat_message/pipeline_message_spec.rb b/spec/models/project_services/chat_message/pipeline_message_spec.rb
index 7d2599dc703..43b02568cb9 100644
--- a/spec/models/project_services/chat_message/pipeline_message_spec.rb
+++ b/spec/models/project_services/chat_message/pipeline_message_spec.rb
@@ -62,7 +62,7 @@ describe ChatMessage::PipelineMessage do
     def build_message(status_text = status, name = user[:name])
       "<http://example.gitlab.com|project_name>:" \
         " Pipeline <http://example.gitlab.com/pipelines/123|#123>" \
-        " of branch `<http://example.gitlab.com/commits/develop|develop>`" \
+        " of branch <http://example.gitlab.com/commits/develop|develop>" \
         " by #{name} #{status_text} in 02:00:10"
     end
   end
@@ -81,7 +81,7 @@ describe ChatMessage::PipelineMessage do
         expect(subject.pretext).to be_empty
         expect(subject.attachments).to eq(message)
         expect(subject.activity).to eq({
-          title: 'Pipeline [#123](http://example.gitlab.com/pipelines/123) of branch `[develop](http://example.gitlab.com/commits/develop)` by hacker passed',
+          title: 'Pipeline [#123](http://example.gitlab.com/pipelines/123) of branch [develop](http://example.gitlab.com/commits/develop) by hacker passed',
           subtitle: 'in [project_name](http://example.gitlab.com)',
           text: 'in 02:00:10',
           image: ''
@@ -98,7 +98,7 @@ describe ChatMessage::PipelineMessage do
         expect(subject.pretext).to be_empty
         expect(subject.attachments).to eq(message)
         expect(subject.activity).to eq({
-          title: 'Pipeline [#123](http://example.gitlab.com/pipelines/123) of branch `[develop](http://example.gitlab.com/commits/develop)` by hacker failed',
+          title: 'Pipeline [#123](http://example.gitlab.com/pipelines/123) of branch [develop](http://example.gitlab.com/commits/develop) by hacker failed',
           subtitle: 'in [project_name](http://example.gitlab.com)',
           text: 'in 02:00:10',
           image: ''
@@ -113,7 +113,7 @@ describe ChatMessage::PipelineMessage do
           expect(subject.pretext).to be_empty
           expect(subject.attachments).to eq(message)
           expect(subject.activity).to eq({
-            title: 'Pipeline [#123](http://example.gitlab.com/pipelines/123) of branch `[develop](http://example.gitlab.com/commits/develop)` by API failed',
+            title: 'Pipeline [#123](http://example.gitlab.com/pipelines/123) of branch [develop](http://example.gitlab.com/commits/develop) by API failed',
             subtitle: 'in [project_name](http://example.gitlab.com)',
             text: 'in 02:00:10',
             image: ''
@@ -125,7 +125,7 @@ describe ChatMessage::PipelineMessage do
     def build_markdown_message(status_text = status, name = user[:name])
       "[project_name](http://example.gitlab.com):" \
         " Pipeline [#123](http://example.gitlab.com/pipelines/123)" \
-        " of branch `[develop](http://example.gitlab.com/commits/develop)`" \
+        " of branch [develop](http://example.gitlab.com/commits/develop)" \
         " by #{name} #{status_text} in 02:00:10"
     end
   end
diff --git a/spec/models/project_services/chat_message/push_message_spec.rb b/spec/models/project_services/chat_message/push_message_spec.rb
index e38117b75f6..c794f659c41 100644
--- a/spec/models/project_services/chat_message/push_message_spec.rb
+++ b/spec/models/project_services/chat_message/push_message_spec.rb
@@ -28,7 +28,7 @@ describe ChatMessage::PushMessage, models: true do
     context 'without markdown' do
       it 'returns a message regarding pushes' do
         expect(subject.pretext).to eq(
-          'test.user pushed to branch `<http://url.com/commits/master|master>` of '\
+          'test.user pushed to branch <http://url.com/commits/master|master> of '\
             '<http://url.com|project_name> (<http://url.com/compare/before...after|Compare changes>)')
         expect(subject.attachments).to eq([{
           text: "<http://url1.com|abcdefgh>: message1 - author1\n\n"\
@@ -45,7 +45,7 @@ describe ChatMessage::PushMessage, models: true do
 
       it 'returns a message regarding pushes' do
         expect(subject.pretext).to eq(
-          'test.user pushed to branch `[master](http://url.com/commits/master)` of [project_name](http://url.com) ([Compare changes](http://url.com/compare/before...after))')
+          'test.user pushed to branch [master](http://url.com/commits/master) of [project_name](http://url.com) ([Compare changes](http://url.com/compare/before...after))')
         expect(subject.attachments).to eq(
           "[abcdefgh](http://url1.com): message1 - author1\n\n[12345678](http://url2.com): message2 - author2")
         expect(subject.activity).to eq({
@@ -74,7 +74,7 @@ describe ChatMessage::PushMessage, models: true do
     context 'without markdown' do
       it 'returns a message regarding pushes' do
         expect(subject.pretext).to eq('test.user pushed new tag ' \
-          '`<http://url.com/commits/new_tag|new_tag>` to ' \
+          '<http://url.com/commits/new_tag|new_tag> to ' \
           '<http://url.com|project_name>')
         expect(subject.attachments).to be_empty
       end
@@ -87,7 +87,7 @@ describe ChatMessage::PushMessage, models: true do
 
       it 'returns a message regarding pushes' do
         expect(subject.pretext).to eq(
-          'test.user pushed new tag `[new_tag](http://url.com/commits/new_tag)` to [project_name](http://url.com)')
+          'test.user pushed new tag [new_tag](http://url.com/commits/new_tag) to [project_name](http://url.com)')
         expect(subject.attachments).to be_empty
         expect(subject.activity).to eq({
           title: 'test.user created tag',
@@ -107,7 +107,7 @@ describe ChatMessage::PushMessage, models: true do
     context 'without markdown' do
       it 'returns a message regarding a new branch' do
         expect(subject.pretext).to eq(
-          'test.user pushed new branch `<http://url.com/commits/master|master>` to '\
+          'test.user pushed new branch <http://url.com/commits/master|master> to '\
             '<http://url.com|project_name>')
         expect(subject.attachments).to be_empty
       end
@@ -120,7 +120,7 @@ describe ChatMessage::PushMessage, models: true do
 
       it 'returns a message regarding a new branch' do
         expect(subject.pretext).to eq(
-          'test.user pushed new branch `[master](http://url.com/commits/master)` to [project_name](http://url.com)')
+          'test.user pushed new branch [master](http://url.com/commits/master) to [project_name](http://url.com)')
         expect(subject.attachments).to be_empty
         expect(subject.activity).to eq({
           title: 'test.user created branch',
@@ -140,7 +140,7 @@ describe ChatMessage::PushMessage, models: true do
     context 'without markdown' do
       it 'returns a message regarding a removed branch' do
         expect(subject.pretext).to eq(
-          'test.user removed branch `master` from <http://url.com|project_name>')
+          'test.user removed branch master from <http://url.com|project_name>')
         expect(subject.attachments).to be_empty
       end
     end
@@ -152,7 +152,7 @@ describe ChatMessage::PushMessage, models: true do
 
       it 'returns a message regarding a removed branch' do
         expect(subject.pretext).to eq(
-          'test.user removed branch `master` from [project_name](http://url.com)')
+          'test.user removed branch master from [project_name](http://url.com)')
         expect(subject.attachments).to be_empty
         expect(subject.activity).to eq({
           title: 'test.user removed branch',
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index 454eeb58ecd..820c6edd36f 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -2046,4 +2046,36 @@ describe Project, models: true do
       expect(project.last_repository_updated_at.to_i).to eq(project.created_at.to_i)
     end
   end
+
+  describe '.public_or_visible_to_user' do
+    let!(:user) { create(:user) }
+
+    let!(:private_project) do
+      create(:empty_project, :private, creator: user, namespace: user.namespace)
+    end
+
+    let!(:public_project) { create(:empty_project, :public) }
+
+    context 'with a user' do
+      let(:projects) do
+        Project.all.public_or_visible_to_user(user)
+      end
+
+      it 'includes projects the user has access to' do
+        expect(projects).to include(private_project)
+      end
+
+      it 'includes projects the user can see' do
+        expect(projects).to include(public_project)
+      end
+    end
+
+    context 'without a user' do
+      it 'only includes public projects' do
+        projects = Project.all.public_or_visible_to_user
+
+        expect(projects).to eq([public_project])
+      end
+    end
+  end
 end
diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb
index ec51b96c86b..b93a5828e14 100644
--- a/spec/requests/api/users_spec.rb
+++ b/spec/requests/api/users_spec.rb
@@ -11,7 +11,7 @@ describe API::Users do
   let(:not_existing_user_id) { (User.maximum('id') || 0 ) + 10 }
   let(:not_existing_pat_id) { (PersonalAccessToken.maximum('id') || 0 ) + 10 }
 
-  describe "GET /users" do
+  describe 'GET /users' do
     context "when unauthenticated" do
       it "returns authentication error" do
         get api("/users")
@@ -76,6 +76,12 @@ describe API::Users do
 
         expect(response).to have_http_status(403)
       end
+
+      it 'does not reveal the `is_admin` flag of the user' do
+        get api('/users', user)
+
+        expect(json_response.first.keys).not_to include 'is_admin'
+      end
     end
 
     context "when admin" do
@@ -92,6 +98,7 @@ describe API::Users do
         expect(json_response.first.keys).to include 'two_factor_enabled'
         expect(json_response.first.keys).to include 'last_sign_in_at'
         expect(json_response.first.keys).to include 'confirmed_at'
+        expect(json_response.first.keys).to include 'is_admin'
       end
 
       it "returns an array of external users" do
diff --git a/spec/requests/api/v3/users_spec.rb b/spec/requests/api/v3/users_spec.rb
index e9c57f7c6c3..6d7401f9764 100644
--- a/spec/requests/api/v3/users_spec.rb
+++ b/spec/requests/api/v3/users_spec.rb
@@ -7,6 +7,38 @@ describe API::V3::Users do
   let(:email)   { create(:email, user: user) }
   let(:ldap_blocked_user) { create(:omniauth_user, provider: 'ldapmain', state: 'ldap_blocked') }
 
+  describe 'GET /users' do
+    context 'when authenticated' do
+      it 'returns an array of users' do
+        get v3_api('/users', user)
+
+        expect(response).to have_http_status(200)
+        expect(response).to include_pagination_headers
+        expect(json_response).to be_an Array
+        username = user.username
+        expect(json_response.detect do |user|
+          user['username'] == username
+        end['username']).to eq(username)
+      end
+    end
+
+    context 'when authenticated as user' do
+      it 'does not reveal the `is_admin` flag of the user' do
+        get v3_api('/users', user)
+
+        expect(json_response.first.keys).not_to include 'is_admin'
+      end
+    end
+
+    context 'when authenticated as admin' do
+      it 'reveals the `is_admin` flag of the user' do
+        get v3_api('/users', admin)
+
+        expect(json_response.first.keys).to include 'is_admin'
+      end
+    end
+  end
+
   describe 'GET /user/:id/keys' do
     before { admin }
 
diff --git a/spec/support/features/reportable_note_shared_examples.rb b/spec/support/features/reportable_note_shared_examples.rb
index 0d80c95e826..27e079c01dd 100644
--- a/spec/support/features/reportable_note_shared_examples.rb
+++ b/spec/support/features/reportable_note_shared_examples.rb
@@ -13,9 +13,7 @@ shared_examples 'reportable note' do
 
   it 'dropdown has Edit, Report and Delete links' do
     dropdown = comment.find(more_actions_selector)
-
-    dropdown.click
-    dropdown.find('.dropdown-menu li', match: :first)
+    open_dropdown(dropdown)
 
     expect(dropdown).to have_button('Edit comment')
     expect(dropdown).to have_link('Report as abuse', href: abuse_report_path)
@@ -24,13 +22,16 @@ shared_examples 'reportable note' do
 
   it 'Report button links to a report page' do
     dropdown = comment.find(more_actions_selector)
-
-    dropdown.click
-    dropdown.find('.dropdown-menu li', match: :first)
+    open_dropdown(dropdown)
 
     dropdown.click_link('Report as abuse')
 
     expect(find('#user_name')['value']).to match(note.author.username)
     expect(find('#abuse_report_message')['value']).to match(noteable_note_url(note))
   end
+
+  def open_dropdown(dropdown)
+    dropdown.click
+    dropdown.find('.dropdown-menu li', match: :first)
+  end
 end
diff --git a/spec/views/projects/notes/_more_actions_dropdown.html.haml_spec.rb b/spec/views/projects/notes/_more_actions_dropdown.html.haml_spec.rb
new file mode 100644
index 00000000000..e56c0f6be03
--- /dev/null
+++ b/spec/views/projects/notes/_more_actions_dropdown.html.haml_spec.rb
@@ -0,0 +1,41 @@
+require 'spec_helper'
+
+describe 'projects/notes/_more_actions_dropdown', :view do
+  let(:author_user) { create(:user) }
+  let(:not_author_user) { create(:user) }
+
+  let(:project) { create(:empty_project) }
+  let(:issue) { create(:issue, project: project) }
+  let!(:note) { create(:note_on_issue, author: author_user, noteable: issue, project: project) }
+
+  before do
+    assign(:project, project)
+  end
+
+  it 'shows Report as abuse button if not editable and not current users comment' do
+    render 'projects/notes/more_actions_dropdown', current_user: not_author_user, note_editable: false, note: note
+
+    expect(rendered).to have_link('Report as abuse')
+  end
+
+  it 'does not show the More actions button if not editable and current users comment' do
+    render 'projects/notes/more_actions_dropdown', current_user: author_user, note_editable: false, note: note
+
+    expect(rendered).not_to have_selector('.dropdown.more-actions')
+  end
+
+  it 'shows Report as abuse, Edit and Delete buttons if editable and not current users comment' do
+    render 'projects/notes/more_actions_dropdown', current_user: not_author_user, note_editable: true, note: note
+
+    expect(rendered).to have_link('Report as abuse')
+    expect(rendered).to have_button('Edit comment')
+    expect(rendered).to have_link('Delete comment')
+  end
+
+  it 'shows Edit and Delete buttons if editable and current users comment' do
+    render 'projects/notes/more_actions_dropdown', current_user: author_user, note_editable: true, note: note
+
+    expect(rendered).to have_button('Edit comment')
+    expect(rendered).to have_link('Delete comment')
+  end
+end