diff --git a/devel/gitaly/Makefile b/devel/gitaly/Makefile
index db6a9c2d85f0..b1a32e32adf7 100644
--- a/devel/gitaly/Makefile
+++ b/devel/gitaly/Makefile
@@ -1,53 +1,56 @@
 PORTNAME=	gitaly
 DISTVERSIONPREFIX=	v
-DISTVERSION=	17.1.6
+DISTVERSION=	${GITLAB_VERSION}
 CATEGORIES=	devel
 
 MAINTAINER=	mfechner@FreeBSD.org
 COMMENT=	Smart reverse proxy for GitLab
 WWW=		https://gitlab.com/gitlab-org/gitaly
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
-# define dependencies that are required for build and run under MY_DEPENDS
-MY_DEPENDS=	git>=2.45.2:devel/git
 BUILD_DEPENDS=	bash>0:shells/bash \
 		${LOCALBASE}/bin/cmake:devel/cmake-core \
 		pcre2>0:devel/pcre2 \
-		http-parser>0:www/http-parser \
-		${MY_DEPENDS}
-RUN_DEPENDS=	${MY_DEPENDS}
+		http-parser>0:www/http-parser
+LIB_DEPENDS=	libcurl.so:ftp/curl \
+		libiconv.so:converters/libiconv \
+		libpcre2-8.so:devel/pcre2
 
-USES=		cpe gmake go:modules,no_targets,1.22 iconv pkgconfig ssl
+USES=		cpe gmake go:modules,no_targets,1.22 iconv pkgconfig
 
 CPE_VENDOR=	gitlab
 
 USE_GITLAB=	yes
 GL_ACCOUNT=	gitlab-org
 GO_MOD_DIST=	gitlab
-GO_MODULE=	gitlab.com/gitlab-org/gitaly/v16
+GO_MODULE=	gitlab.com/gitlab-org/gitaly/v17
+GL_TUPLE=	gitlab-org:git:v${GITLAB_GIT_VERSION}:_build/_build/deps/git-v${GITLAB_GIT_VERSION_SHORT}
 
 MAKE_ENV=	GOFLAGS="${GO_BUILDFLAGS}"
 # make sure to pass go build options into make process
 MAKE_ENV+=	${GO_ENV}
+# parallel build failed in my tests, so disable it here
+MAKE_JOBS_UNSAFE=yes
 
 post-patch:
 	${REINPLACE_CMD} -e "s|%%PREFIX%%|${PREFIX}|" ${WRKSRC}/config.toml.example
 	${MV} ${WRKSRC}/config.toml.example ${WRKSRC}/config.toml.sample
 
 do-install:
 	${MKDIR} ${STAGEDIR}${DATADIR}
 	${MKDIR} ${STAGEDIR}${DATADIR}/bin
 	${FIND} ${WRKSRC} -name '*.orig' -delete
 	(cd ${WRKSRC}/_build/bin/ && ${COPYTREE_BIN} .  ${STAGEDIR}${DATADIR}/bin && \
 	cd ${WRKSRC} && ${COPYTREE_SHARE} config.toml.sample  ${STAGEDIR}${DATADIR})
 
 post-install:
 	${FIND} -s ${STAGEDIR}${DATADIR} -not -type d | ${SORT} | \
 		${SED} -e 's#^${STAGEDIR}${PREFIX}/##' | \
 		${SED} -E -e '/sample$$/ s#^#@sample #; \
 		/gitlab-shell-hook$$/ s#^#@(,,755) #; \
 		s#${DATADIR_REL}/bin#@(,,555) ${DATADIR_REL}/bin#; ' >> ${TMPPLIST}
 
+.include "${.CURDIR}/../../www/gitlab/Makefile.common"
 .include <bsd.port.mk>
diff --git a/devel/gitaly/distinfo b/devel/gitaly/distinfo
index fdfdb6ff5169..e4dc53e9b3ce 100644
--- a/devel/gitaly/distinfo
+++ b/devel/gitaly/distinfo
@@ -1,5 +1,7 @@
-TIMESTAMP = 1724572877
-SHA256 (go/devel_gitaly/gitaly-v17.1.6/go.mod) = 46321e96184062643db930c26d8033bdb94f79cd766b3768b96cf2feced18b8b
-SIZE (go/devel_gitaly/gitaly-v17.1.6/go.mod) = 11095
-SHA256 (go/devel_gitaly/gitaly-v17.1.6/gitaly-v17.1.6.tar.bz2) = 0e8ce19bbc74da091653aad2b02ee69f17afdd30f186a600e561828f287541f8
-SIZE (go/devel_gitaly/gitaly-v17.1.6/gitaly-v17.1.6.tar.bz2) = 2629818
+TIMESTAMP = 1724605762
+SHA256 (go/devel_gitaly/gitaly-v17.3.1/go.mod) = 27f37cc992540a2c53a90a47c503860a012051134ac616859cc2e662ee9c0d54
+SIZE (go/devel_gitaly/gitaly-v17.3.1/go.mod) = 12846
+SHA256 (go/devel_gitaly/gitaly-v17.3.1/gitaly-v17.3.1.tar.bz2) = 1e80133aace4a703c5dacbcdaa72ce8ff86d123bc8253c0d4ccf1ace9da81950
+SIZE (go/devel_gitaly/gitaly-v17.3.1/gitaly-v17.3.1.tar.bz2) = 2914897
+SHA256 (go/devel_gitaly/gitaly-v17.3.1/git-v2.45.2.tar.bz2) = da929efd422d9e7e030ccbfac4c51acd56f63e96f67f2714fe906bf7f033604e
+SIZE (go/devel_gitaly/gitaly-v17.3.1/git-v2.45.2.tar.bz2) = 8710568
diff --git a/devel/gitaly/files/patch-Makefile b/devel/gitaly/files/patch-Makefile
new file mode 100644
index 000000000000..29da174b7379
--- /dev/null
+++ b/devel/gitaly/files/patch-Makefile
@@ -0,0 +1,21 @@
+--- Makefile.orig	2024-08-20 19:30:28 UTC
++++ Makefile
+@@ -618,12 +618,12 @@ ${DEPENDENCY_DIR}/git-%/Makefile: ${DEPENDENCY_DIR}/gi
+ # otherwise try to rebuild all targets depending on it whenever we build
+ # something else. We thus depend on the Makefile instead.
+ ${DEPENDENCY_DIR}/git-%/Makefile: ${DEPENDENCY_DIR}/git-%.version
+-	${Q}${GIT} -c init.defaultBranch=master init ${GIT_QUIET} "${@D}"
+-	${Q}${GIT} -C "${@D}" config remote.origin.url ${GIT_REPO_URL}
+-	${Q}${GIT} -C "${@D}" config remote.origin.tagOpt --no-tags
+-	${Q}${GIT} -C "${@D}" fetch --depth 1 ${GIT_QUIET} origin ${GIT_VERSION}
+-	${Q}${GIT} -C "${@D}" reset --hard
+-	${Q}${GIT} -C "${@D}" checkout ${GIT_QUIET} --detach FETCH_HEAD
++	#${Q}${GIT} -c init.defaultBranch=master init ${GIT_QUIET} "${@D}"
++	#${Q}${GIT} -C "${@D}" config remote.origin.url ${GIT_REPO_URL}
++	#${Q}${GIT} -C "${@D}" config remote.origin.tagOpt --no-tags
++	#${Q}${GIT} -C "${@D}" fetch --depth 1 ${GIT_QUIET} origin ${GIT_VERSION}
++	#${Q}${GIT} -C "${@D}" reset --hard
++	#${Q}${GIT} -C "${@D}" checkout ${GIT_QUIET} --detach FETCH_HEAD
+ ifeq ($(OVERRIDE_GIT_VERSION),)
+ 	${Q}rm -f "${@D}"/version
+ else
diff --git a/devel/gitaly/files/patch-config.toml.example b/devel/gitaly/files/patch-config.toml.example
index 1ade94b72f95..13378b8efdae 100644
--- a/devel/gitaly/files/patch-config.toml.example
+++ b/devel/gitaly/files/patch-config.toml.example
@@ -1,72 +1,59 @@
---- config.toml.example.orig	2024-01-17 10:05:29 UTC
+--- config.toml.example.orig	2024-08-20 19:30:28 UTC
 +++ config.toml.example
 @@ -2,10 +2,10 @@
  # For Gitaly documentation, see https://docs.gitlab.com/ee/administration/gitaly/.
  
  # A path which Gitaly should open a Unix socket.
 -socket_path = "/home/git/gitlab/tmp/sockets/private/gitaly.socket"
 +socket_path = "%%PREFIX%%/www/gitlab/tmp/sockets/private/gitaly.socket"
  
  # Directory containing Gitaly executables.
 -bin_dir = "/home/git/gitaly/_build/bin"
 +bin_dir = "%%PREFIX%%/share/gitaly/bin/"
  
  # # Optional. The directory where Gitaly can create all files required to
  # # properly operate at runtime. If not set, Gitaly will create a directory in
 @@ -40,9 +40,9 @@ bin_dir = "/home/git/gitaly/_build/bin"
  # key_path = '/home/git/key.pem'
  
  # # Git settings
 -# [git]
 -# # Path to Git binary. If not set, is resolved using PATH.
 -# bin_path = "/usr/bin/git"
 +[git]
 +# Path to Git binary. If not set, is resolved using PATH.
 +bin_path = "%%PREFIX%%/bin/git"
  # # Maximum number of cached 'cat-file' processes, which constitute a pair of 'git cat-file --batch' and
  # # 'git cat-file --batch-check' processes. Defaults to '100'.
  # catfile_cache_size = 100
-@@ -58,7 +58,7 @@ bin_dir = "/home/git/gitaly/_build/bin"
+@@ -58,7 +58,7 @@ name = "default"
  # # The name of the storage
  name = "default"
  # # The path to the storage.
 -path = "/home/git/repositories"
 +path = "%%PREFIX%%/git/repositories"
  
  # # You can optionally configure more storages for this Gitaly instance to serve up
  #
-@@ -68,9 +68,9 @@ path = "/home/git/repositories"
- #
- 
- # # Optional. Configure Gitaly to output JSON-formatted log messages to stdout.
--# [logging]
--# # Directory where Gitaly stores extra log files.
--dir = "/home/git/gitlab/log"
-+[logging]
-+# Directory where Gitaly stores extra log files.
-+dir = "%%PREFIX%%/www/gitlab/log"
- # # Log format. Either 'text' or 'json'.
- # format = "json"
- # # Optional. Set log level to only log entries with that severity or above.
-@@ -91,18 +91,18 @@ sentry_environment = ""
+@@ -89,18 +89,18 @@ sentry_environment = ""
  # # Custom Git hooks that are used to perform tasks based on changes performed in any repository.
  [hooks]
  # # Directory where custom Git hooks are installed. If left unset, no custom hooks are used.
 -custom_hooks_dir = "/home/git/custom_hooks"
 +custom_hooks_dir = "%%PREFIX%%/git/custom_hooks"
  
  # # Gitaly must connect to the GitLab application to perform access checks when a user performs a change.
  [gitlab]
  # # URL of the GitLab server.
 -url = "http+unix://%2Fhome%2Fgit%2Fgitlab%2Ftmp%2Fsockets%2Fgitlab-workhorse.socket"
 +url = "http+unix://%2Fusr%2Flocal%2Fwww%2Fgitlab%2Ftmp%2Fsockets%2Fgitlab-workhorse.socket"
  # # 'relative_url_root' is only needed if a UNIX socket is used in 'url' and GitLab is configured to
  # # use a relative path. For example, '/gitlab'.
  # relative_url_root = '/'
  # # Path of the file containing the secret token used to authenticate with GitLab. Use either 'secret_token' or 'secret'
  # # but not both.
 -secret_file = "/home/git/gitlab-shell/.gitlab_shell_secret"
 +secret_file = "%%PREFIX%%/share/gitlab-shell/.gitlab_shell_secret"
  # # Secret token used to authenticate with GitLab.
  # secret = ""
  
diff --git a/devel/gitlab-runner/Makefile b/devel/gitlab-runner/Makefile
index 89e3d38e1d7a..bb5d1626c63d 100644
--- a/devel/gitlab-runner/Makefile
+++ b/devel/gitlab-runner/Makefile
@@ -1,73 +1,73 @@
 PORTNAME=	gitlab-runner
 DISTVERSIONPREFIX=	v
-DISTVERSION=	17.2.0
+DISTVERSION=	17.3.1
 CATEGORIES=	devel
 MASTER_SITES=	https://gitlab-runner-downloads.s3.amazonaws.com/master/docker/:dockerx64 \
 		https://gitlab-runner-downloads.s3.amazonaws.com/master/docker/:dockerarm
 DISTFILES=	prebuilt-x86_64.tar.xz:dockerx64 \
 		prebuilt-arm.tar.xz:dockerarm
 
 #PATCH_SITES=	https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/
 #PATCHFILES+=	4551.patch:-p1 # https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/4551, Allow FreeBSD to be used with Docker builds
 
 MAINTAINER=	mfechner@FreeBSD.org
 COMMENT=	Official GitLab Runner written in Go
 WWW=		https://gitlab.com/gitlab-org/gitlab-runner
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 BUILD_DEPENDS=	go-bindata:devel/go-bindata
 RUN_DEPENDS=	bash:shells/bash \
 		ca_root_nss>=0:security/ca_root_nss \
 		git:devel/git
 
 USES=		go:modules,1.22
 USE_GITLAB=	yes
 GL_ACCOUNT=	gitlab-org
 USE_RC_SUBR=	gitlab_runner
 
 GITBRANCH=	17-1-stable
 GO_MODULE=	gitlab.com/gitlab-org/gitlab-runner
 
 _BUILD_DATE=	$$(date -u +%Y-%m-%dT%H:%M:%S%z)
 GO_BUILDFLAGS= -ldflags=" \
 		-X gitlab.com/gitlab-org/gitlab-runner/commands.ROOTCONFIGDIR=${ETCDIR} \
 		-X gitlab.com/gitlab-org/gitlab-runner/common.VERSION=${PORTVERSION} \
 		-X gitlab.com/gitlab-org/gitlab-runner/common.REVISION=${DISTVERSION} \
 		-X gitlab.com/gitlab-org/gitlab-runner/common.BUILT=${_BUILD_DATE} \
 		-X gitlab.com/gitlab-org/gitlab-runner/common.BRANCH=${GITBRANCH} \
 		-s -w"
 
 # for go dependencies
 # Gitlab hosts there dependencies on their own platform and not on go-proxy
 # so we download the required go.mod file from gitlab
 # lines are taken from go.mk
 # ---------------------------
 MASTER_SITES+=	https://gitlab.com/gitlab-org/gitlab-runner/-/raw/v${DISTVERSION}/
 DISTFILES+=	go.mod
 EXTRACT_ONLY+=	${DISTFILES:N*.mod\:*:N*.mod:C/:.*//:Nprebuilt*:}
 # ---------------------------
 
 USERS=		gitlab-runner
 GROUPS=		gitlab-runner
 
 PLIST_FILES=	bin/gitlab-runner
 
 post-patch:
 	@${MKDIR} ${WRKSRC}/out/docker/
 	@${CP} ${DISTDIR}/${DIST_SUBDIR}/prebuilt-x86_64.tar.xz ${WRKSRC}/out/docker/
 	@${CP} ${DISTDIR}/${DIST_SUBDIR}/prebuilt-arm.tar.xz ${WRKSRC}/out/docker/
 
 pre-build:
 	@cd ${WRKSRC} && go-bindata \
 		-pkg docker \
 		-nocompress \
 		-nomemcopy \
 		-nometadata \
 		-prefix out/docker/ \
 		-o executors/docker/bindata.go \
 		out/docker/prebuilt-x86_64.tar.xz \
 		out/docker/prebuilt-arm.tar.xz
 
 .include <bsd.port.mk>
diff --git a/devel/gitlab-runner/distinfo b/devel/gitlab-runner/distinfo
index eb1196cfb668..70aa3a51aac2 100644
--- a/devel/gitlab-runner/distinfo
+++ b/devel/gitlab-runner/distinfo
@@ -1,9 +1,9 @@
-TIMESTAMP = 1721624584
-SHA256 (go/devel_gitlab-runner/gitlab-runner-v17.2.0/prebuilt-x86_64.tar.xz) = b0dccc53f415962dde3f5a7e6f1ab068b8da5484a7fefdae2c5e39d8bb6c637e
-SIZE (go/devel_gitlab-runner/gitlab-runner-v17.2.0/prebuilt-x86_64.tar.xz) = 9594352
-SHA256 (go/devel_gitlab-runner/gitlab-runner-v17.2.0/prebuilt-arm.tar.xz) = 5018c6b661ebf4b9c661593548e45394c553bbd4082b5ef744a39a1f7f1fee32
-SIZE (go/devel_gitlab-runner/gitlab-runner-v17.2.0/prebuilt-arm.tar.xz) = 9020896
-SHA256 (go/devel_gitlab-runner/gitlab-runner-v17.2.0/go.mod) = 2c7421c611c5133e5bc43399c2c20b4ab5ad4153e10a49b3c1159241c3c90008
-SIZE (go/devel_gitlab-runner/gitlab-runner-v17.2.0/go.mod) = 11273
-SHA256 (go/devel_gitlab-runner/gitlab-runner-v17.2.0/gitlab-runner-v17.2.0.tar.bz2) = 266b5d7f50d947d727b1dcaebdafe811e6bbf1be976ec8ece9a8dd158ba92e31
-SIZE (go/devel_gitlab-runner/gitlab-runner-v17.2.0/gitlab-runner-v17.2.0.tar.bz2) = 1377145
+TIMESTAMP = 1724596164
+SHA256 (go/devel_gitlab-runner/gitlab-runner-v17.3.1/prebuilt-x86_64.tar.xz) = b0dccc53f415962dde3f5a7e6f1ab068b8da5484a7fefdae2c5e39d8bb6c637e
+SIZE (go/devel_gitlab-runner/gitlab-runner-v17.3.1/prebuilt-x86_64.tar.xz) = 9594352
+SHA256 (go/devel_gitlab-runner/gitlab-runner-v17.3.1/prebuilt-arm.tar.xz) = 5018c6b661ebf4b9c661593548e45394c553bbd4082b5ef744a39a1f7f1fee32
+SIZE (go/devel_gitlab-runner/gitlab-runner-v17.3.1/prebuilt-arm.tar.xz) = 9020896
+SHA256 (go/devel_gitlab-runner/gitlab-runner-v17.3.1/go.mod) = 94bc0ceb7e38b13ce972673ba049b6425e0a2bec75b0e8d7abdab35e7fe1726b
+SIZE (go/devel_gitlab-runner/gitlab-runner-v17.3.1/go.mod) = 11274
+SHA256 (go/devel_gitlab-runner/gitlab-runner-v17.3.1/gitlab-runner-v17.3.1.tar.bz2) = ef1fd3832ad993d7cb980e63154eb0d6eb28b9d33858d658d15d231297e154e5
+SIZE (go/devel_gitlab-runner/gitlab-runner-v17.3.1/gitlab-runner-v17.3.1.tar.bz2) = 1382824
diff --git a/devel/gitlab-shell/Makefile b/devel/gitlab-shell/Makefile
index 256e37e42f64..b57f786d4616 100644
--- a/devel/gitlab-shell/Makefile
+++ b/devel/gitlab-shell/Makefile
@@ -1,65 +1,64 @@
 PORTNAME=	gitlab-shell
-PORTVERSION=	14.36.0
+PORTVERSION=	14.38.0
 DISTVERSIONPREFIX=	v
-PORTREVISION=	1
 CATEGORIES=	devel
 
 MAINTAINER=	mfechner@FreeBSD.org
 COMMENT=	GitLab Shell handles git commands for GitLab
 WWW=		https://gitlab.com/gitlab-org/gitlab-shell
 
 LICENSE=	MIT
 
 # GSSAPI support can maybe be removed by disable CGO:
 # https://gitlab.com/gitlab-org/gitlab-shell/-/merge_requests/720
 #BUILD_DEPENDS=	heimdal>=0:security/heimdal
 
-USES=		gmake go:modules,no_targets,1.21 pkgconfig
+USES=		gmake go:modules,no_targets,1.22 pkgconfig
 
 USE_GITLAB=	yes
 GL_ACCOUNT=	gitlab-org
 GO_MOD_DIST=	gitlab
 GO_MODULE=	gitlab.com/gitlab-org/gitlab-shell/v14
 
 MAKE_ENV=	GOFLAGS="${GO_BUILDFLAGS}"
 # make sure to pass go build options into make process
 MAKE_ENV+=	${GO_ENV}
 ALL_TARGET=	build
 
 USERS=		git
 GROUPS=		git
 
 VARLOGDIR=	/var/log/gitlab-shell
 
 PLIST_FILES+=	"@dir(git,,755) ${VARLOGDIR}"
 
 post-patch:
 	${REINPLACE_CMD} -e "s|%%PREFIX%%|${PREFIX}|" ${WRKSRC}/config.yml.example
 	${MV} ${WRKSRC}/config.yml.example ${WRKSRC}/config.yml.sample
 	${CP} ${WRKSRC}/config.yml.sample ${WRKSRC}/config.yml
 	${REINPLACE_CMD} -e 's|VERSION_STRING :=.*|VERSION_STRING := v${PORTVERSION}|g' ${WRKSRC}/Makefile
 
 pre-install:
 	${RM} -rf ${WRKSRC}/config.yml
 
 do-install:
 	@${MKDIR} ${STAGEDIR}${DATADIR}
 	${MKDIR} ${STAGEDIR}${DATADIR}/bin
 	${FIND} ${WRKSRC} -name '*.orig' -delete
 	(cd ${WRKSRC}/bin/ && ${COPYTREE_BIN} .  ${STAGEDIR}${DATADIR}/bin)
 .for x in CHANGELOG LICENSE README.md VERSION config.yml.sample
 	${INSTALL_DATA} ${WRKSRC}/${x} ${STAGEDIR}${DATADIR}/
 .endfor
 .for x in support
 	@${MKDIR} ${STAGEDIR}${DATADIR}/${x}
 	(cd ${WRKSRC}/${x} && ${COPYTREE_SHARE} . ${STAGEDIR}${DATADIR}/${x})
 .endfor
 	@${MKDIR} ${STAGEDIR}${VARLOGDIR}
 
 post-install:
 	${FIND} -s ${STAGEDIR}${DATADIR} -not -type d | ${SORT} | \
 		${SED} -e 's#^${STAGEDIR}${PREFIX}/##' | \
 		${SED} -E -e '/sample$$/ s#^#@sample #; \
 		s#${DATADIR_REL}/bin#@(,,555) ${DATADIR_REL}/bin#; ' >> ${TMPPLIST}
 
 .include <bsd.port.mk>
diff --git a/devel/gitlab-shell/distinfo b/devel/gitlab-shell/distinfo
index 98d9588b4e7c..912029793e8c 100644
--- a/devel/gitlab-shell/distinfo
+++ b/devel/gitlab-shell/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1718793702
-SHA256 (go/devel_gitlab-shell/gitlab-shell-v14.36.0/go.mod) = c28824464f523f79c5eff5f104f4c34fda80bcf62957e66d1e087a2cb2066109
-SIZE (go/devel_gitlab-shell/gitlab-shell-v14.36.0/go.mod) = 5424
-SHA256 (go/devel_gitlab-shell/gitlab-shell-v14.36.0/gitlab-shell-v14.36.0.tar.bz2) = c1c9c0759ddf815ee37365cb48801273af19a25995685c9212b28abe2516500b
-SIZE (go/devel_gitlab-shell/gitlab-shell-v14.36.0/gitlab-shell-v14.36.0.tar.bz2) = 158039
+TIMESTAMP = 1724586105
+SHA256 (go/devel_gitlab-shell/gitlab-shell-v14.38.0/go.mod) = 00bddbd45813229c6a72e87051101ea76997822abb2ebf9bfea6fc69a3fcd9f6
+SIZE (go/devel_gitlab-shell/gitlab-shell-v14.38.0/go.mod) = 5327
+SHA256 (go/devel_gitlab-shell/gitlab-shell-v14.38.0/gitlab-shell-v14.38.0.tar.bz2) = aa09fd94525c33782f4d1c18802fa6ceb180df6a03ce95e849f96baeb533b6ab
+SIZE (go/devel_gitlab-shell/gitlab-shell-v14.38.0/gitlab-shell-v14.38.0.tar.bz2) = 157526
diff --git a/net/gitlab-agent/Makefile b/net/gitlab-agent/Makefile
index 91fc48f1c82c..4c388df6842c 100644
--- a/net/gitlab-agent/Makefile
+++ b/net/gitlab-agent/Makefile
@@ -1,32 +1,33 @@
 PORTNAME=	gitlab-agent
-PORTVERSION=	17.1.6
+PORTVERSION=	${GITLAB_VERSION}
 DISTVERSIONPREFIX=	v
 CATEGORIES=	net
 
 MAINTAINER=	mfechner@FreeBSD.org
 COMMENT=	GitLab kubernetes agent
 WWW=		https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent
 
 LICENSE=	MIT
 
 # bazel>=0:devel/bazel  \
 BUILD_DEPENDS=	git>=0:devel/git \
 		golangci-lint>=0:devel/golangci-lint
 
 USES=		go:modules,1.22
 GO_MODULE=	gitlab.com/gitlab-org/cluster-integration/gitlab-agent/v17
 
 _BUILD_DATE=	$$(date -u "+%Y-%m-%d-%H%M UTC")
 GO_TARGET=     ./cmd/kas
 GO_BUILDFLAGS= -tags="tracer_static,tracer_static_jaeger" \
 		-ldflags=" \
 		-X 'gitlab.com/gitlab-org/cluster-integration/gitlab-agent/v16/cmd.Version=v${PORTVERSION}' \
 		-X 'gitlab.com/gitlab-org/cluster-integration/gitlab-agent/v16/cmd.Commit=${GL_TAGNAME:C/^(........).*/\1/}' \
 		-X 'gitlab.com/gitlab-org/cluster-integration/gitlab-agent/v16/cmd.BuildTime=${_BUILD_DATE}'"
 
 PLIST_FILES=	bin/kas
 
 do-install:
 	${INSTALL_PROGRAM} ${WRKDIR}/bin/kas ${STAGEDIR}${PREFIX}/bin/kas
 
+.include "${.CURDIR}/../../www/gitlab/Makefile.common"
 .include <bsd.port.mk>
diff --git a/net/gitlab-agent/distinfo b/net/gitlab-agent/distinfo
index c5e758327257..0df9472cfeb7 100644
--- a/net/gitlab-agent/distinfo
+++ b/net/gitlab-agent/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1724573038
-SHA256 (go/net_gitlab-agent/gitlab-agent-v17.1.6/v17.1.6.mod) = 7ab7b64f4dbcbf2f73c13ae82253a7f4d9a05c7a1b16c90bf11b4bd084a41704
-SIZE (go/net_gitlab-agent/gitlab-agent-v17.1.6/v17.1.6.mod) = 7042
-SHA256 (go/net_gitlab-agent/gitlab-agent-v17.1.6/v17.1.6.zip) = 629a1a807308c23ac555a2d43487b14344161092f17567296962e1f604ee3654
-SIZE (go/net_gitlab-agent/gitlab-agent-v17.1.6/v17.1.6.zip) = 1237736
+TIMESTAMP = 1724586111
+SHA256 (go/net_gitlab-agent/gitlab-agent-v17.3.1/v17.3.1.mod) = 394483a3087d074c2fbbf29414d34c1f75d176f33d2fb530275ad5ea8361ebb0
+SIZE (go/net_gitlab-agent/gitlab-agent-v17.3.1/v17.3.1.mod) = 8581
+SHA256 (go/net_gitlab-agent/gitlab-agent-v17.3.1/v17.3.1.zip) = c6f566ab12b5053764c556aa4bcadf14322433a6f4e13d152e95ab6caeaf933a
+SIZE (go/net_gitlab-agent/gitlab-agent-v17.3.1/v17.3.1.zip) = 1334017
diff --git a/net/rubygem-gitaly/Makefile b/net/rubygem-gitaly/Makefile
index 2402e57dc408..259a8f465138 100644
--- a/net/rubygem-gitaly/Makefile
+++ b/net/rubygem-gitaly/Makefile
@@ -1,20 +1,20 @@
 PORTNAME=	gitaly
-PORTVERSION=	17.1.6
+PORTVERSION=	17.2.4
 CATEGORIES=	net rubygems
 MASTER_SITES=	RG
 
 MAINTAINER=	mfechner@FreeBSD.org
 COMMENT=	Auto-generated gRPC client for gitaly
 WWW=		https://gitlab.com/gitlab-org/gitaly
 
 LICENSE=	MIT
 
 RUN_DEPENDS=	rubygem-grpc>=1.0<2.0:net/rubygem-grpc
 
 USES=		cpe gem
 
 CPE_VENDOR=	gitlab
 
 NO_ARCH=	yes
 
 .include <bsd.port.mk>
diff --git a/net/rubygem-gitaly/distinfo b/net/rubygem-gitaly/distinfo
index 4a4646b2b2b1..c2fd1852c0e0 100644
--- a/net/rubygem-gitaly/distinfo
+++ b/net/rubygem-gitaly/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1724572939
-SHA256 (rubygem/gitaly-17.1.6.gem) = 16526f571684fefafb25736ec44d4aaf8ec5552e2c9e05e1db900a4e4674324e
-SIZE (rubygem/gitaly-17.1.6.gem) = 47616
+TIMESTAMP = 1724589837
+SHA256 (rubygem/gitaly-17.2.4.gem) = 44bf9dd279b4f50d121b3c87771879c11963aa5a4669cda078208a479a4a5735
+SIZE (rubygem/gitaly-17.2.4.gem) = 48128
diff --git a/textproc/gitlab-elasticsearch-indexer/Makefile b/textproc/gitlab-elasticsearch-indexer/Makefile
index ffb95d022ee3..18e65b5c6636 100644
--- a/textproc/gitlab-elasticsearch-indexer/Makefile
+++ b/textproc/gitlab-elasticsearch-indexer/Makefile
@@ -1,45 +1,44 @@
 PORTNAME=	gitlab-elasticsearch-indexer
-PORTVERSION=	5.0.0
+PORTVERSION=	5.2.0
 DISTVERSIONPREFIX=	v
-PORTREVISION=	1
 CATEGORIES=	textproc
 
 MAINTAINER=	mfechner@FreeBSD.org
 COMMENT=	Elasticsearch indexer for GitLab
 WWW=		https://gitlab.com/gitlab-org/gitlab-elasticsearch-indexer
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE.md
 
 BUILD_DEPENDS=	git>=2.38.1:devel/git
 LIB_DEPENDS=	libicui18n.so:devel/icu \
 		libicuuc.so:devel/icu
 #RUN_DEPENDS=	p5-Image-ExifTool>=0:graphics/p5-Image-ExifTool
 
 USES=		gmake go:modules,no_targets,1.22 pkgconfig
 
 USE_GITLAB=	yes
 GL_ACCOUNT=	gitlab-org
 GO_MOD_DIST=	gitlab
 GO_MODULE=	gitlab.com/gitlab-org/gitlab-elasticsearch-indexer
 
 MAKE_ENV=	GOFLAGS="${GO_BUILDFLAGS}"
 # make sure to pass go build options into make process
 MAKE_ENV+=	${GO_ENV}
 
 PLIST_FILES=	bin/${PORTNAME}
 
 # add a git tag, as that is required by the build script
 pre-build:
 	cd ${WRKSRC} && \
 		git init && \
 		git config user.email "${MAINTAINER}" && \
 		git config user.name "Matthias Fechner" && \
 		git add . && \
 		git commit -m "tag" && \
 		git tag v${PORTVERSION}
 
 do-install:
 	${INSTALL_PROGRAM} ${WRKSRC}/bin/${PORTNAME} ${STAGEDIR}${PREFIX}/bin/${PORTNAME}
 
 .include <bsd.port.mk>
diff --git a/textproc/gitlab-elasticsearch-indexer/distinfo b/textproc/gitlab-elasticsearch-indexer/distinfo
index dd6f19514097..b5e20f89afb1 100644
--- a/textproc/gitlab-elasticsearch-indexer/distinfo
+++ b/textproc/gitlab-elasticsearch-indexer/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1718793811
-SHA256 (go/textproc_gitlab-elasticsearch-indexer/gitlab-elasticsearch-indexer-v5.0.0/go.mod) = 8ce949b5e4a0cb10ae0ed0857bac2590d2868d89c254f00ec607dc59346e0d74
-SIZE (go/textproc_gitlab-elasticsearch-indexer/gitlab-elasticsearch-indexer-v5.0.0/go.mod) = 5189
-SHA256 (go/textproc_gitlab-elasticsearch-indexer/gitlab-elasticsearch-indexer-v5.0.0/gitlab-elasticsearch-indexer-v5.0.0.tar.bz2) = 4f2c33e18a131b76309e9c13db1ff4824f208c3914f3707a5ff75047831ec6bf
-SIZE (go/textproc_gitlab-elasticsearch-indexer/gitlab-elasticsearch-indexer-v5.0.0/gitlab-elasticsearch-indexer-v5.0.0.tar.bz2) = 68731
+TIMESTAMP = 1721626377
+SHA256 (go/textproc_gitlab-elasticsearch-indexer/gitlab-elasticsearch-indexer-v5.2.0/go.mod) = f8080fedd1cf8350a8c222e2179df2aeb30df6fd741d2bd473d82ddb334d8a8f
+SIZE (go/textproc_gitlab-elasticsearch-indexer/gitlab-elasticsearch-indexer-v5.2.0/go.mod) = 4995
+SHA256 (go/textproc_gitlab-elasticsearch-indexer/gitlab-elasticsearch-indexer-v5.2.0/gitlab-elasticsearch-indexer-v5.2.0.tar.bz2) = 4ca774d2e25aacd2450c82fa078fc886f22d87b2a267009a4353a43daa6c0b31
+SIZE (go/textproc_gitlab-elasticsearch-indexer/gitlab-elasticsearch-indexer-v5.2.0/gitlab-elasticsearch-indexer-v5.2.0.tar.bz2) = 67582
diff --git a/www/gitlab-pages/Makefile b/www/gitlab-pages/Makefile
index af9a490ae05d..3ae22f35ad07 100644
--- a/www/gitlab-pages/Makefile
+++ b/www/gitlab-pages/Makefile
@@ -1,45 +1,46 @@
 PORTNAME=	gitlab-pages
-PORTVERSION=	17.1.6
+PORTVERSION=	${GITLAB_VERSION}
 DISTVERSIONPREFIX=	v
 CATEGORIES=	www
 MASTER_SITES+=	https://gitlab.com/gitlab-org/gitlab-pages/-/raw/v${DISTVERSION}/
 DISTFILES+=	go.mod
 
 MAINTAINER=	mfechner@FreeBSD.org
 COMMENT=	Official GitLab Pages daemon
 WWW=		https://gitlab.com/gitlab-org/gitlab-pages
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		go:modules,1.22
 
 USE_GITLAB=	yes
 GL_ACCOUNT=	gitlab-org
 USE_RC_SUBR=	gitlab_pages
 
 GO_MODULE=	gitlab.com/gitlab-org/gitlab-pages
 GO_BUILDFLAGS=	-ldflags="-X 'main.VERSION=${PORTVERSION}' -X 'main.REVISION=${GL_TAGNAME}'"
 
 USERS=		gitlab-pages
 GROUPS=		gitlab-pages
 
 post-patch:
 	${REINPLACE_CMD} -e "s|%%PREFIX%%|${PREFIX}|" ${WRKSRC}/gitlab-pages.conf.sample
 
 do-install:
 	@${MKDIR} ${STAGEDIR}${DATADIR}
 	${MKDIR} ${STAGEDIR}${DATADIR}/bin
 	(cd ${WRKDIR}/bin/ && ${COPYTREE_BIN} .  ${STAGEDIR}${DATADIR}/bin)
 .for x in gitlab-pages.conf.sample
 	${INSTALL_DATA} ${WRKSRC}/${x} ${STAGEDIR}${DATADIR}/
 .endfor
 
 post-install:
 	${FIND} -s ${STAGEDIR}${DATADIR} -not -type d | ${SORT} | \
 		${SED} -e 's#^${STAGEDIR}${PREFIX}/##' | \
 		${SED} -E -e '/sample$$/ s#^#@sample #; \
 		s#${DATADIR_REL}/bin#@(,,555) ${DATADIR_REL}/bin#; ' >> ${TMPPLIST}
 	cat ${TMPPLIST}
 
+.include "${.CURDIR}/../gitlab/Makefile.common"
 .include <bsd.port.mk>
diff --git a/www/gitlab-pages/distinfo b/www/gitlab-pages/distinfo
index c4d9dc4c18bb..821e3f2e7e97 100644
--- a/www/gitlab-pages/distinfo
+++ b/www/gitlab-pages/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1724572993
-SHA256 (go/www_gitlab-pages/gitlab-pages-v17.1.6/go.mod) = dc647bef3c9a1eb596f949dd6bdaee81bc6a791f8a4ad6f34e5e09b13c0e0350
-SIZE (go/www_gitlab-pages/gitlab-pages-v17.1.6/go.mod) = 3269
-SHA256 (go/www_gitlab-pages/gitlab-pages-v17.1.6/gitlab-pages-v17.1.6.tar.bz2) = 5c0d90ebc68c3d99c22a4fc7ab59a89ed29286595ea485db642349f8dda9b3aa
-SIZE (go/www_gitlab-pages/gitlab-pages-v17.1.6/gitlab-pages-v17.1.6.tar.bz2) = 218565
+TIMESTAMP = 1724586028
+SHA256 (go/www_gitlab-pages/gitlab-pages-v17.3.1/go.mod) = 93577d318362d9d4259b4ccfeda9e91e8af7ab256befb41845e5ccd4e37d55b5
+SIZE (go/www_gitlab-pages/gitlab-pages-v17.3.1/go.mod) = 3327
+SHA256 (go/www_gitlab-pages/gitlab-pages-v17.3.1/gitlab-pages-v17.3.1.tar.bz2) = 3baafba124ce4a5554b66c893851409e8e38bdb7e938ab9a7d2025589ba87c1a
+SIZE (go/www_gitlab-pages/gitlab-pages-v17.3.1/gitlab-pages-v17.3.1.tar.bz2) = 229329
diff --git a/www/gitlab-workhorse/Makefile b/www/gitlab-workhorse/Makefile
index 9ea6e4636f3a..b3153a9a08b6 100644
--- a/www/gitlab-workhorse/Makefile
+++ b/www/gitlab-workhorse/Makefile
@@ -1,32 +1,33 @@
 PORTNAME=	gitlab-workhorse
-PORTVERSION=	17.1.6
+PORTVERSION=	${GITLAB_VERSION}
 DISTVERSIONPREFIX=	v
 CATEGORIES=	www
 
 MAINTAINER=	mfechner@FreeBSD.org
 COMMENT=	Smart reverse proxy for GitLab
 WWW=		https://gitlab.com/gitlab-org/gitlab/
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/../LICENSE
 
 BUILD_DEPENDS=	git>=2.42.0:devel/git
 RUN_DEPENDS=	p5-Image-ExifTool>=0:graphics/p5-Image-ExifTool
 
 USES=		gmake go:modules,no_targets,1.22
 USE_GITLAB=	yes
 GL_ACCOUNT=	gitlab-org
 GL_PROJECT=	gitlab-foss
 GO_MOD_DIST=	gitlab
 MAKE_ENV=	GOFLAGS="${GO_BUILDFLAGS}"
 MAKE_ENV+=	${GO_ENV}
 WRKSRC_SUBDIR=	workhorse
 # found in work/gitlab-foss*/workhorse/go.mod
 GO_MODULE=	gitlab.com/gitlab-org/gitlab/workhorse
 
 PLIST_FILES=	bin/gitlab-resize-image \
 		bin/gitlab-workhorse \
 		bin/gitlab-zip-cat \
 		bin/gitlab-zip-metadata
 
+.include "${.CURDIR}/../gitlab/Makefile.common"
 .include <bsd.port.mk>
diff --git a/www/gitlab-workhorse/distinfo b/www/gitlab-workhorse/distinfo
index edaaa52d0493..d406f3f08f64 100644
--- a/www/gitlab-workhorse/distinfo
+++ b/www/gitlab-workhorse/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1724573060
-SHA256 (go/www_gitlab-workhorse/gitlab-foss-v17.1.6/go.mod) = eb2321aa5993d64f24051d87d4ffd701d2054c1084e55af4ec654a289e2dba95
-SIZE (go/www_gitlab-workhorse/gitlab-foss-v17.1.6/go.mod) = 6994
-SHA256 (go/www_gitlab-workhorse/gitlab-foss-v17.1.6/gitlab-foss-v17.1.6.tar.bz2) = 256be185af59a1d148af2567cbfd2657bdb33bf19ba38939f54eee2f38990eca
-SIZE (go/www_gitlab-workhorse/gitlab-foss-v17.1.6/gitlab-foss-v17.1.6.tar.bz2) = 106430228
+TIMESTAMP = 1724586334
+SHA256 (go/www_gitlab-workhorse/gitlab-foss-v17.3.1/go.mod) = 34bb920b000d41f8dc9da500411a9212a56d06b5e94e380b366c25ce5157bd68
+SIZE (go/www_gitlab-workhorse/gitlab-foss-v17.3.1/go.mod) = 7141
+SHA256 (go/www_gitlab-workhorse/gitlab-foss-v17.3.1/gitlab-foss-v17.3.1.tar.bz2) = a4b7f5f8d7ef54652e6dec83bd7d160e5b066580571e123684cfb91b155aac9d
+SIZE (go/www_gitlab-workhorse/gitlab-foss-v17.3.1/gitlab-foss-v17.3.1.tar.bz2) = 104061075
diff --git a/www/gitlab/Makefile b/www/gitlab/Makefile
index 4eda507a1ecb..4ebc11cc5227 100644
--- a/www/gitlab/Makefile
+++ b/www/gitlab/Makefile
@@ -1,526 +1,543 @@
 PORTNAME=	gitlab-${FLAVOR:Uce}
-PORTVERSION=	17.1.6
+PORTVERSION=	${GITLAB_VERSION}
 DISTVERSIONPREFIX=	v
 .if ${FLAVOR:U} == ee
 DISTVERSIONSUFFIX=	-ee
 .endif
 CATEGORIES=	www devel
 
 # include patch to fix database migration
 #https://gitlab.com/gitlab-org/gitlab/-/merge_requests/153560.patch
 #PATCH_SITES=	https://gitlab.com/gitlab-org/gitlab/-/merge_requests/
 #PATCHFILES+=	153560.patch:-p1 # https://gitlab.com/gitlab-org/gitlab/-/merge_requests/153560
 
 MAINTAINER=	mfechner@FreeBSD.org
 COMMENT=	Web GUI for managing git repositories
 WWW=		https://gitlab.com/ \
 		https://gitlab.com/gitlab-org/gitlab
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 # the rubygems of RUN_DEPENDS matches the order of the Gemfile
 # which makes maintaining this long list much easier!
 # devel/rubygem-parser is required for database upgrade process
 # see https://gitlab.com/gitlab-org/gitlab/-/issues/350866
 # mail/rubygem-net-smtp is required as ruby 3.1 removed it
 # textproc/rubygem-psych3 is required as ruby 3.1 applied an update to psych 4.0 which has breaking changes
 # mail/rubygem-net-pop is required as ruby 3.1 removed it
 MY_DEPENDS=	git>=2.41.0:devel/git \
-	gitaly>=${PORTVERSION}:devel/gitaly \
-	gitlab-elasticsearch-indexer>=5.0.0:textproc/gitlab-elasticsearch-indexer \
-	gitlab-agent>=${PORTVERSION}:net/gitlab-agent \
-	gitlab-pages>=${PORTVERSION}:www/gitlab-pages \
-	gitlab-shell>=14.36.0:devel/gitlab-shell \
-	gitlab-workhorse>=${PORTVERSION}:www/gitlab-workhorse \
+	gitaly>=${GITLAB_VERSION}:devel/gitaly \
+	gitlab-elasticsearch-indexer>=5.2.0:textproc/gitlab-elasticsearch-indexer \
+	gitlab-agent>=${GITLAB_VERSION}:net/gitlab-agent \
+	gitlab-pages>=${GITLAB_VERSION}:www/gitlab-pages \
+	gitlab-shell>=14.38.0:devel/gitlab-shell \
+	gitlab-workhorse>=${GITLAB_VERSION}:www/gitlab-workhorse \
 	redis>=6.2.11:databases/redis \
 	yarn${NODEJS_SUFFIX}>=1.10.0:www/yarn${NODEJS_SUFFIX} \
 	gtar>0:archivers/gtar \
 	bash>0:shells/bash \
 	rubygem-net-smtp>=0:mail/rubygem-net-smtp \
 	rubygem-net-pop>=0:mail/rubygem-net-pop \
 	rubygem-psych3>=3.1<4:textproc/rubygem-psych3 \
 	rubygem-rails70>=7.0.8.4<7.1:www/rubygem-rails70 \
 	rubygem-bootsnap>=1.18.3<1.19:devel/rubygem-bootsnap \
 	rubygem-openssl>=3.0<4:security/rubygem-openssl \
 	rubygem-ipaddr>=1.2.5<1.3:net/rubygem-ipaddr \
 	rubygem-responders-rails70>=3.0<4.0:www/rubygem-responders-rails70 \
-	rubygem-sprockets3>=3.7<3.8:devel/rubygem-sprockets3 \
-	rubygem-view_component-rails70>=3.12.1<3.13:devel/rubygem-view_component-rails70 \
+	rubygem-sprockets3>=3.7.0<3.8:devel/rubygem-sprockets3 \
+	rubygem-sprockets-rails-rails70>=3.5.1<3.6:devel/rubygem-sprockets-rails-rails70 \
+	rubygem-view_component-rails70>=3.13.0<3.14:devel/rubygem-view_component-rails70 \
 	rubygem-pg>=1.5.6<1.6:databases/rubygem-pg \
 	rubygem-neighbor>=0.3.2<0.4:databases/rubygem-neighbor \
 	rubygem-rugged>=1.6<2:devel/rubygem-rugged \
-	rubygem-faraday1>=1.10.0<3:www/rubygem-faraday1 \
+	rubygem-faraday>=2<3:www/rubygem-faraday \
+	rubygem-faraday-retry>=2<3:www/rubygem-faraday-retry \
+	rubygem-logger15>=1.5.3<1.6:devel/rubygem-logger15 \
 	rubygem-marginalia>=1.11.1<1.12:databases/rubygem-marginalia \
 	rubygem-declarative_policy>=1.1.0<1.2:security/rubygem-declarative_policy \
 	rubygem-coverband>=6.1.2<6.2:www/rubygem-coverband \
 	rubygem-devise-rails70>=4.9.3<4.10:devel/rubygem-devise-rails70 \
 	rubygem-bcrypt>=3.1.14<3.2:security/rubygem-bcrypt \
 	rubygem-doorkeeper-rails70>=5.6.6<6:security/rubygem-doorkeeper-rails70 \
 	rubygem-doorkeeper-openid_connect>=1.8.7<2:security/rubygem-doorkeeper-openid_connect \
-	rubygem-rexml32>=3.2.6<3.3:textproc/rubygem-rexml32 \
+	rubygem-doorkeeper-device_authorization_grant>=1.0.0<1.1:security/rubygem-doorkeeper-device_authorization_grant \
+	rubygem-rexml>=3.3.2<3.4:textproc/rubygem-rexml \
 	rubygem-ruby-saml115>=1.15.0<1.16:security/rubygem-ruby-saml115 \
 	rubygem-omniauth>=2.1.0<3:security/rubygem-omniauth \
 	rubygem-omniauth-auth0>=3.1.0<3.2.0:net/rubygem-omniauth-auth0 \
 	rubygem-omniauth-azure-activedirectory-v2>=2.0<3:net/rubygem-omniauth-azure-activedirectory-v2 \
 	rubygem-omniauth-alicloud>=3.0.0<3.1:security/rubygem-omniauth-alicloud \
 	rubygem-omniauth-github>=2.0.1<2.1:net/rubygem-omniauth-github \
 	rubygem-omniauth-google-oauth2>=1.1<2:net/rubygem-omniauth-google-oauth2 \
 	rubygem-omniauth-oauth2-generic>=0.2.2<0.3.0:security/rubygem-omniauth-oauth2-generic \
 	rubygem-omniauth-saml>=2.1.0<3:security/rubygem-omniauth-saml \
 	rubygem-omniauth-shibboleth-redux>=2.0<3:security/rubygem-omniauth-shibboleth-redux \
-	rubygem-omniauth_openid_connect>=0.6.1<0.7.0:net/rubygem-omniauth_openid_connect \
-	rubygem-openid_connect>=1.3.1<1.3.2:net/rubygem-openid_connect \
+	rubygem-omniauth_openid_connect>=0.8.0<0.9:net/rubygem-omniauth_openid_connect \
+	rubygem-openid_connect>=2.3.0<2.4:net/rubygem-openid_connect \
 	rubygem-omniauth-atlassian-oauth2>=0.2.0<0.3:security/rubygem-omniauth-atlassian-oauth2 \
-	rubygem-rack-oauth21>=1.21.3<1.22.0:security/rubygem-rack-oauth21 \
+	rubygem-rack-oauth2>=2.2.1<2.3:security/rubygem-rack-oauth2 \
 	rubygem-jwt>=2.5<3:www/rubygem-jwt \
 	rubygem-gssapi>=1.3.1<1.4:security/rubygem-gssapi \
 	rubygem-recaptcha>=5.12<6.0:devel/rubygem-recaptcha \
 	rubygem-akismet>=3.0<4.0:devel/rubygem-akismet \
 	rubygem-invisible_captcha>=2.1.0<2.2.0:graphics/rubygem-invisible_captcha \
 	rubygem-devise-two-factor41-rails70>=4.1.1<4.2:security/rubygem-devise-two-factor41-rails70 \
 	rubygem-rqrcode>=2.2.0<3:www/rubygem-rqrcode \
 	rubygem-validates_hostname>=1.0.13<1.1.0:dns/rubygem-validates_hostname \
 	rubygem-rubyzip>=2.3.2<2.4:archivers/rubygem-rubyzip \
-	rubygem-acme-client>=2.0.9<3:security/rubygem-acme-client \
+	rubygem-acme-client>=2.0.18<3:security/rubygem-acme-client \
 	rubygem-browser5>=5.3.1<5.4:www/rubygem-browser5 \
 	rubygem-ohai>=18.1<19:sysutils/rubygem-ohai \
 	rubygem-gpgme>=2.0.23<2.1.0:security/rubygem-gpgme \
 	rubygem-gitlab_omniauth-ldap>=2.2.0<2.3.0:net/rubygem-gitlab_omniauth-ldap \
 	rubygem-net-ldap017>=0.17.1<0.18:net/rubygem-net-ldap017 \
 	rubygem-grape20>=2.0.0<2.1:devel/rubygem-grape20 \
 	rubygem-grape-entity>=1.0.1<1.1,1:devel/rubygem-grape-entity \
 	rubygem-grape-swagger>=2.1.0<2.2:devel/rubygem-grape-swagger \
 	rubygem-grape-swagger-entity>=0.5.1<0.6:devel/rubygem-grape-swagger-entity \
 	rubygem-grape-path-helpers>=2.0.1<2.1:devel/rubygem-grape-path-helpers \
 	rubygem-rack-cors>=2.0.1<2.1:www/rubygem-rack-cors \
-	rubygem-graphql>=2.3.4<2.4:devel/rubygem-graphql \
-	rubygem-graphql-docs>=4.0.0<4.1.0:devel/rubygem-graphql-docs \
-	rubygem-graphiql-rails>=1.8.0<1.9:devel/rubygem-graphiql-rails \
+	rubygem-graphql>=2.3.5<2.4:devel/rubygem-graphql \
+	rubygem-graphiql-rails>=1.10<1.11:devel/rubygem-graphiql-rails \
 	rubygem-apollo_upload_server>=2.1.6<2.2:net/rubygem-apollo_upload_server \
-	rubygem-graphlient>=0.6.0<0.7:devel/rubygem-graphlient \
+	rubygem-graphlient>=0.8.0<0.9:devel/rubygem-graphlient \
 	rubygem-ffaker>=2.10<3:devel/rubygem-ffaker \
 	rubygem-hashie>=5.0.0<5.1:devel/rubygem-hashie \
 	rubygem-kaminari-rails70>=1.2.2<1.3:www/rubygem-kaminari-rails70 \
 	rubygem-hamlit>=2.15.0<2.16:www/rubygem-hamlit \
 	rubygem-carrierwave1>=1.3.4<2.0:www/rubygem-carrierwave1 \
 	rubygem-mini_magick>=4.12<5:graphics/rubygem-mini_magick \
 	rubygem-fog-aws>=3.18<4:net/rubygem-fog-aws \
 	rubygem-fog-core210>=2.1.0<2.1.1:devel/rubygem-fog-core210 \
 	rubygem-fog-google>=1.24.1<1.25:net/rubygem-fog-google \
 	rubygem-fog-local>=0.8<1.0:net/rubygem-fog-local \
 	rubygem-fog-aliyun>=0.4<1.0:net/rubygem-fog-aliyun \
-	rubygem-gitlab-fog-azure-rm>=1.9.1<1.10:net/rubygem-gitlab-fog-azure-rm \
+	rubygem-gitlab-fog-azure-rm>=2.0.1<2.1:net/rubygem-gitlab-fog-azure-rm \
 	rubygem-google-apis-storage_v1>=0.29<1:devel/rubygem-google-apis-storage_v1 \
 	rubygem-google-cloud-storage145>=1.45.0<1.46:net/rubygem-google-cloud-storage145 \
 	rubygem-google-apis-core>=0.11.2<2:devel/rubygem-google-apis-core \
 	rubygem-google-apis-compute_v1_057>=0.57.0<0.58:devel/rubygem-google-apis-compute_v1_057 \
 	rubygem-google-apis-container_v1>=0.43.0<0.44:devel/rubygem-google-apis-container_v1 \
 	rubygem-google-apis-container_v1beta1>=0.43.0<0.44:devel/rubygem-google-apis-container_v1beta1 \
 	rubygem-google-apis-cloudbilling_v1>=0.21.0<0.22:devel/rubygem-google-apis-cloudbilling_v1 \
 	rubygem-google-apis-cloudresourcemanager_v1>=0.31.0<0.32:devel/rubygem-google-apis-cloudresourcemanager_v1 \
 	rubygem-google-apis-iam_v1>=0.36.0<0.37:devel/rubygem-google-apis-iam_v1 \
 	rubygem-google-apis-serviceusage_v1>=0.28.0<0.29:devel/rubygem-google-apis-serviceusage_v1 \
 	rubygem-google-apis-sqladmin_v1beta4_041>=0.41.0<0.42:devel/rubygem-google-apis-sqladmin_v1beta4_041 \
 	rubygem-google-apis-androidpublisher_v3034>=0.34.0<0.35:devel/rubygem-google-apis-androidpublisher_v3034 \
 	rubygem-googleauth>=1.8.1<2:security/rubygem-googleauth \
 	rubygem-google-cloud-artifact_registry-v1>=0.11.0<0.12:textproc/rubygem-google-cloud-artifact_registry-v1 \
 	rubygem-google-cloud-compute-v1>=2.6.0<2.7:net/rubygem-google-cloud-compute-v1 \
 	rubygem-seed-fu>=2.3.7<2.4.0:databases/rubygem-seed-fu \
 	rubygem-elasticsearch-model713>=7.2<8:textproc/rubygem-elasticsearch-model713 \
 	rubygem-elasticsearch-rails7>=7.2<8:textproc/rubygem-elasticsearch-rails7 \
-	rubygem-elasticsearch-api713>=7.13.3<7.13.4:textproc/rubygem-elasticsearch-api713 \
-	rubygem-aws-sdk-core>=3.197.0<4:devel/rubygem-aws-sdk-core \
+	rubygem-elasticsearch-api7>=7.17.11<7.18:textproc/rubygem-elasticsearch-api7 \
+	rubygem-aws-sdk-core>=3.201.0<4:devel/rubygem-aws-sdk-core \
 	rubygem-aws-sdk-cloudformation>=1<2:devel/rubygem-aws-sdk-cloudformation \
-	rubygem-aws-sdk-s3>=1.151.0<2:devel/rubygem-aws-sdk-s3 \
-	rubygem-faraday_middleware-aws-sigv403>=0.3.0<0.4:devel/rubygem-faraday_middleware-aws-sigv403 \
+	rubygem-aws-sdk-s3>=1.157.0<2:devel/rubygem-aws-sdk-s3 \
+	rubygem-faraday-typhoeus>=1.1<2:www/rubygem-faraday-typhoeus \
+	rubygem-faraday_middleware-aws-sigv4>=1.0.1<1.1:devel/rubygem-faraday_middleware-aws-sigv4 \
 	rubygem-typhoeus>=1.4.0<1.5:www/rubygem-typhoeus \
 	rubygem-html-pipeline>=2.14.3<2.15:textproc/rubygem-html-pipeline \
 	rubygem-deckar01-task_list>=2.3.4<2.4:www/rubygem-deckar01-task_list \
 	rubygem-gitlab-markup>=1.9.0<1.10.0:textproc/rubygem-gitlab-markup \
 	rubygem-commonmarker0>=0.23.10<0.24:textproc/rubygem-commonmarker0 \
 	rubygem-kramdown23>=2.3.1<2.4:textproc/rubygem-kramdown23 \
 	rubygem-redcloth>=4.3.3<4.4.0:www/rubygem-redcloth \
 	rubygem-org-ruby>=0.9.12<0.10.0:textproc/rubygem-org-ruby \
 	rubygem-creole>=0.5.0<0.6.0:textproc/rubygem-creole \
 	rubygem-wikicloth081>=0.8.1<0.8.2:textproc/rubygem-wikicloth081 \
 	rubygem-asciidoctor>=2.0.18<2.1.0:textproc/rubygem-asciidoctor \
 	rubygem-asciidoctor-include-ext>=0.4.0<0.5.0:textproc/rubygem-asciidoctor-include-ext \
 	rubygem-asciidoctor-plantuml00>=0.0.16<0.1:textproc/rubygem-asciidoctor-plantuml00 \
-	rubygem-asciidoctor-kroki>=0.8.0<0.9:textproc/rubygem-asciidoctor-kroki \
-	rubygem-rouge42>=4.2.0<4.3:textproc/rubygem-rouge42 \
+	rubygem-asciidoctor-kroki>=0.10.0<0.11:textproc/rubygem-asciidoctor-kroki \
+	rubygem-rouge>=4.3.0<4.4:textproc/rubygem-rouge \
 	rubygem-truncato>=0.7.12<0.8.0:textproc/rubygem-truncato \
 	rubygem-tty-prompt>=0.23<1:devel/rubygem-tty-prompt \
 	rubygem-nokogiri>=1.16<2:textproc/rubygem-nokogiri \
 	rubygem-gitlab-glfm-markdown>=0.0.17<0.1:textproc/rubygem-gitlab-glfm-markdown \
-	rubygem-icalendar>=0:devel/rubygem-icalendar \
+	rubygem-icalendar>=2.10.1<2.11:devel/rubygem-icalendar \
 	rubygem-diffy>=3.4<4:textproc/rubygem-diffy \
-	rubygem-rack22>=2.2.8.1,3<2.3,3:www/rubygem-rack22 \
-	rubygem-rack-timeout>=0.6.3<0.7:www/rubygem-rack-timeout \
+	rubygem-rack22>=2.2.9,3<2.3,3:www/rubygem-rack22 \
+	rubygem-rack-timeout>=0.7.0<0.8:www/rubygem-rack-timeout \
 	rubygem-puma>=6.4<7:www/rubygem-puma \
 	rubygem-sd_notify>=0.1.1<0.2:devel/rubygem-sd_notify \
 	rubygem-state_machines-activerecord08>=0.8.0<0.9.0:databases/rubygem-state_machines-activerecord08 \
-	rubygem-acts-as-taggable-on>=10.0<11:www/rubygem-acts-as-taggable-on \
 	rubygem-sidekiq71>=7.1.6<7.2:devel/rubygem-sidekiq71 \
 	rubygem-sidekiq-cron-rails70>=1.12.0<1.13:devel/rubygem-sidekiq-cron-rails70 \
 	rubygem-fugit18>=1.8.1<1.9:devel/rubygem-fugit18 \
 	rubygem-httparty021>=0.21.0<0.22:www/rubygem-httparty021 \
 	rubygem-rainbow>=3.1.1<4.0:devel/rubygem-rainbow \
 	rubygem-ruby-progressbar>=1.11<2:devel/rubygem-ruby-progressbar \
 	rubygem-re2>=2.7.0<2.8:devel/rubygem-re2 \
 	rubygem-semver_dialects>=3.0<4:devel/rubygem-semver_dialects \
 	rubygem-version_sorter>=2.3<3:textproc/rubygem-version_sorter \
 	rubygem-js_regex>=3.8<4.0:textproc/rubygem-js_regex \
 	rubygem-device_detector>=0:devel/rubygem-device_detector \
 	rubygem-redis-namespace>=1.11.0<1.12:databases/rubygem-redis-namespace \
 	rubygem-redis>=5.2.0<5.3:databases/rubygem-redis \
 	rubygem-redis-clustering>=5.2.0<5.3:databases/rubygem-redis-clustering \
 	rubygem-connection_pool>=2.4.1<3.0:net/rubygem-connection_pool \
 	rubygem-redis-actionpack-rails70>=5.4.0<5.5:databases/rubygem-redis-actionpack-rails70 \
 	rubygem-discordrb-webhooks>=3.5<4.0:net-im/rubygem-discordrb-webhooks \
 	rubygem-jira-ruby>=2.3.0<2.4:devel/rubygem-jira-ruby \
 	rubygem-atlassian-jwt>=0.2.1<0.3.0:www/rubygem-atlassian-jwt \
 	rubygem-slack-messenger>=2.3.5<2.4.0:devel/rubygem-slack-messenger \
 	rubygem-ruby-fogbugz>=0.3.0<0.4.0:devel/rubygem-ruby-fogbugz \
 	rubygem-kubeclient>=4.11.0<4.12.0:www/rubygem-kubeclient \
 	rubygem-ruby-openai37>=3.7<4:www/rubygem-ruby-openai37 \
 	rubygem-circuitbox>=2.0.0<2.1:www/rubygem-circuitbox \
 	rubygem-sanitize60>=6.0.2<6.1:textproc/rubygem-sanitize60 \
 	rubygem-babosa>=2.0<3:textproc/rubygem-babosa \
 	rubygem-loofah>=2.22.0<2.23:textproc/rubygem-loofah \
 	rubygem-licensee>=9.16<10:devel/rubygem-licensee \
-	rubygem-static_holmes>=0.7.7:textproc/rubygem-static_holmes \
+	rubygem-charlock_holmes>=0.7.9<0.8:textproc/rubygem-charlock_holmes \
 	rubygem-ruby-magic>=0.6<1:devel/rubygem-ruby-magic \
 	rubygem-fast_blank>=1.0.1<1.1:devel/rubygem-fast_blank \
 	rubygem-gitlab-chronic>=0.10.5<0.11.0:devel/rubygem-gitlab-chronic \
 	rubygem-gitlab_chronic_duration>=0.12<1:devel/rubygem-gitlab_chronic_duration \
 	rubygem-rack-proxy>=0.7.7<0.8.0:www/rubygem-rack-proxy \
-	rubygem-cssbundling-rails-rails70>=1.4.0<1.5:www/rubygem-cssbundling-rails-rails70 \
+	rubygem-cssbundling-rails-rails70>=1.4.1<1.5:www/rubygem-cssbundling-rails-rails70 \
 	rubygem-terser>=1.0.2<1.0.3:textproc/rubygem-terser \
 	rubygem-addressable>=2.8<3:www/rubygem-addressable \
 	rubygem-tanuki_emoji>=0.9<1:graphics/rubygem-tanuki_emoji \
 	rubygem-gon-rails70>=6.4.0<6.5:www/rubygem-gon-rails70 \
 	rubygem-request_store15>=1.5.1<1.6:devel/rubygem-request_store15 \
 	rubygem-base32>=0.3.0<0.4.0:converters/rubygem-base32 \
 	rubygem-gitlab-license>=2.5<3:devel/rubygem-gitlab-license \
 	rubygem-rack-attack>=6.7.0<6.8:www/rubygem-rack-attack \
-	rubygem-sentry-ruby>=5.17.3<5.18:devel/rubygem-sentry-ruby \
-	rubygem-sentry-rails>=5.17.3<5.18:devel/rubygem-sentry-rails \
-	rubygem-sentry-sidekiq>=5.17.3<5.18:devel/rubygem-sentry-sidekiq \
+	rubygem-sentry-ruby>=5.18.0<5.19:devel/rubygem-sentry-ruby \
+	rubygem-sentry-rails>=5.18.0<5.19:devel/rubygem-sentry-rails \
+	rubygem-sentry-sidekiq>=5.18.0<5.19:devel/rubygem-sentry-sidekiq \
 	rubygem-pg_query>=5.1.0<5.2:databases/rubygem-pg_query \
-	rubygem-premailer-rails110-rails70>=1.10.3<1.11:mail/rubygem-premailer-rails110-rails70 \
+	rubygem-premailer-rails-rails70>=1.12.0<1.13:mail/rubygem-premailer-rails-rails70 \
 	rubygem-gitlab-labkit>=0.36.0<0.37:devel/rubygem-gitlab-labkit \
 	rubygem-thrift>=0.16.0:devel/rubygem-thrift \
 	rubygem-rails-i18n-rails70>=7.0.9<8:devel/rubygem-rails-i18n-rails70 \
 	rubygem-gettext_i18n_rails>=1.12.0<1.13:devel/rubygem-gettext_i18n_rails \
 	rubygem-gettext>=3.4<4:devel/rubygem-gettext \
 	rubygem-batch-loader>=2.0.5<2.1:devel/rubygem-batch-loader \
+	rubygem-tty-prompt>=0.23<1:devel/rubygem-tty-prompt \
 	rubygem-peek-rails70>=1.1<2.0:devel/rubygem-peek-rails70 \
 	rubygem-snowplow-tracker>=0.8.0<1:devel/rubygem-snowplow-tracker \
 	rubygem-webrick>=1.8.1<1.9:www/rubygem-webrick \
 	rubygem-prometheus-client-mmap>=1.1.1<2:devel/rubygem-prometheus-client-mmap \
+	rubygem-async212>=2.12.1<2.13:devel/rubygem-async212 \
 	rubygem-opentelemetry-sdk>=1.4.0:devel/rubygem-opentelemetry-sdk \
 	rubygem-opentelemetry-exporter-otlp>=0.26.3:devel/rubygem-opentelemetry-exporter-otlp \
 	rubygem-opentelemetry-instrumentation-active_support>=0.5.1:devel/rubygem-opentelemetry-instrumentation-active_support \
 	rubygem-opentelemetry-instrumentation-action_pack>=0.9.0:devel/rubygem-opentelemetry-instrumentation-action_pack \
 	rubygem-opentelemetry-instrumentation-active_job>=0.7.1:devel/rubygem-opentelemetry-instrumentation-active_job \
 	rubygem-opentelemetry-instrumentation-active_record>=0.7.0:devel/rubygem-opentelemetry-instrumentation-active_record \
 	rubygem-opentelemetry-instrumentation-action_view>=0.7.0:devel/rubygem-opentelemetry-instrumentation-action_view \
 	rubygem-opentelemetry-instrumentation-aws_sdk>=0.5.1:devel/rubygem-opentelemetry-instrumentation-aws_sdk \
 	rubygem-opentelemetry-instrumentation-http>=0.23.2:devel/rubygem-opentelemetry-instrumentation-http \
 	rubygem-opentelemetry-instrumentation-concurrent_ruby>=0.21.2:devel/rubygem-opentelemetry-instrumentation-concurrent_ruby \
 	rubygem-opentelemetry-instrumentation-ethon>=0.21.3:devel/rubygem-opentelemetry-instrumentation-ethon \
 	rubygem-opentelemetry-instrumentation-excon>=0.22.0:devel/rubygem-opentelemetry-instrumentation-excon \
 	rubygem-opentelemetry-instrumentation-faraday>=0.24.0:devel/rubygem-opentelemetry-instrumentation-faraday \
 	rubygem-opentelemetry-instrumentation-grape>=0.1.6:devel/rubygem-opentelemetry-instrumentation-grape \
 	rubygem-opentelemetry-instrumentation-graphql>=0.28.0:devel/rubygem-opentelemetry-instrumentation-graphql \
 	rubygem-opentelemetry-instrumentation-http_client>=0.22.3:devel/rubygem-opentelemetry-instrumentation-http_client \
 	rubygem-opentelemetry-instrumentation-net_http>=0.22.4:devel/rubygem-opentelemetry-instrumentation-net_http \
 	rubygem-opentelemetry-instrumentation-pg>=0.27.1:devel/rubygem-opentelemetry-instrumentation-pg \
 	rubygem-opentelemetry-instrumentation-rack>=0.24.0:devel/rubygem-opentelemetry-instrumentation-rack \
 	rubygem-opentelemetry-instrumentation-rails>=0.30.0:devel/rubygem-opentelemetry-instrumentation-rails \
 	rubygem-opentelemetry-instrumentation-rake>=0.2.1:devel/rubygem-opentelemetry-instrumentation-rake \
 	rubygem-opentelemetry-instrumentation-redis>=0.25.3:devel/rubygem-opentelemetry-instrumentation-redis \
 	rubygem-opentelemetry-instrumentation-sidekiq>=0.25.2:devel/rubygem-opentelemetry-instrumentation-sidekiq \
 	rubygem-warning>=1.3.0<1.4:devel/rubygem-warning \
-	rubygem-gitlab-dangerfiles>=4.7.0<4.8:devel/rubygem-gitlab-dangerfiles \
+	rubygem-gitlab-dangerfiles>=4.8.0<4.9:devel/rubygem-gitlab-dangerfiles \
 	rubygem-license_finder>=7.0.0<8:devel/rubygem-license_finder \
 	rubygem-rspec>=3.0<4:devel/rubygem-rspec \
-	rubygem-octokit8>=8.1<9:net/rubygem-octokit8 \
+	rubygem-octokit>=9.0<10:net/rubygem-octokit \
+	rubygem-faraday-multipart>=1.0<2:www/rubygem-faraday-multipart \
 	rubygem-gitlab-mail_room>=0.0.24<0.1.0:mail/rubygem-gitlab-mail_room \
 	rubygem-email_reply_trimmer>=0.1<1.0:mail/rubygem-email_reply_trimmer \
 	rubygem-html2text>=0:textproc/rubygem-html2text \
-	rubygem-stackprof>=0.2.25<0.3:devel/rubygem-stackprof \
+	rubygem-stackprof>=0.2.26<0.3:devel/rubygem-stackprof \
 	rubygem-rbtrace>=0.4.14<1.0:devel/rubygem-rbtrace \
 	rubygem-memory_profiler>=1.0<2.0:devel/rubygem-memory_profiler \
 	rubygem-activerecord-explain-analyze>=0.1<1.0:databases/rubygem-activerecord-explain-analyze \
 	rubygem-oauth2>=2.0<3:net/rubygem-oauth2 \
 	rubygem-health_check-rails70>=3.0<4:devel/rubygem-health_check-rails70 \
 	rubygem-vmstat>=2.3.0<2.4.0:sysutils/rubygem-vmstat \
 	rubygem-sys-filesystem>=1.4.3<1.5:sysutils/rubygem-sys-filesystem \
 	rubygem-net-ntp>0:net/rubygem-net-ntp \
 	rubygem-ssh_data>=1.3<2:security/rubygem-ssh_data \
 	rubygem-spamcheck>=1.3.0<1.4:net/rubygem-spamcheck \
-	rubygem-gitaly>=17.0.1:net/rubygem-gitaly \
-	rubygem-kas-grpc>=0.5.0,1<0.6.0,1:net/rubygem-kas-grpc \
+	rubygem-gitaly>=17.2.0:net/rubygem-gitaly \
+	rubygem-kas-grpc>=0.6.0,1<0.7.0,1:net/rubygem-kas-grpc \
 	rubygem-grpc>=1.63.0<2:net/rubygem-grpc \
 	rubygem-google-protobuf>=3.25.3<4:devel/rubygem-google-protobuf \
 	rubygem-toml-rb>=2.2.0<3:www/rubygem-toml-rb \
 	rubygem-flipper026>=0.26.2<0.27:devel/rubygem-flipper026 \
 	rubygem-flipper-active_record-rails70>=0.26.2<0.27:databases/rubygem-flipper-active_record-rails70 \
 	rubygem-flipper-active_support_cache_store-rails70>=0.26.2<0.27:devel/rubygem-flipper-active_support_cache_store-rails70 \
 	rubygem-unleash>=3.2.2<3.3:devel/rubygem-unleash \
 	rubygem-gitlab-experiment>=0.9.1<0.10:devel/rubygem-gitlab-experiment \
 	rubygem-lograge-rails70>=0.11.2<1.0:www/rubygem-lograge-rails70 \
 	rubygem-grape_logging>=1.8.4<2.0:devel/rubygem-grape_logging \
 	rubygem-gitlab-net-dns>=0.9.2<0.10:dns/rubygem-gitlab-net-dns \
 	rubygem-countries>=4.1.3<4.2.0:devel/rubygem-countries \
 	rubygem-retriable>=3.1.2<3.2.0:devel/rubygem-retriable \
 	rubygem-lru_redux>0:devel/rubygem-lru_redux \
 	rubygem-mail>=2.8.1<2.8.2,2:mail/rubygem-mail \
 	rubygem-lockbox>=1.3.0<1.4:security/rubygem-lockbox \
 	rubygem-valid_email>=0.1<1:mail/rubygem-valid_email \
 	rubygem-jsonb_accessor>=1.3.10<1.4:www/rubygem-jsonb_accessor \
-	rubygem-json26>=2.6.3<2.7:devel/rubygem-json26 \
-	rubygem-json_schemer>=0.2.18<0.3:devel/rubygem-json_schemer \
+	rubygem-json>=2.7.2<2.8:devel/rubygem-json \
+	rubygem-json_schemer>=2.3.0<2.4:devel/rubygem-json_schemer \
 	rubygem-oj313>=3.13.21<3.14:devel/rubygem-oj313 \
 	rubygem-oj-introspect>=0.7<1:devel/rubygem-oj-introspect \
 	rubygem-multi_json114>=1.14.1<1.15:devel/rubygem-multi_json114 \
 	rubygem-yajl-ruby>=1.4.3<1.5:devel/rubygem-yajl-ruby \
 	rubygem-webauthn>=3.0<4:security/rubygem-webauthn \
 	rubygem-ipaddress>=0.8.3<0.9:net/rubygem-ipaddress \
 	rubygem-parslet1>=1.8<2:textproc/rubygem-parslet1 \
 	rubygem-ed25519>=1.3.0<1.4:security/rubygem-ed25519 \
 	rubygem-parser>=3.3.0.5:devel/rubygem-parser \
 	rubygem-cvss-suite>=3.0.1<3.1:security/rubygem-cvss-suite \
 	rubygem-arr-pm>=0.0.12<0.1:devel/rubygem-arr-pm \
 	rubygem-devfile>=0.0.26.p.a1<0.0.27:net/rubygem-devfile \
 	rubygem-CFPropertyList>=3.0.0<3.1:devel/rubygem-CFPropertyList \
 	rubygem-app_store_connect>=0:net/rubygem-app_store_connect \
 	rubygem-telesignenterprise>=2.2<3:devel/rubygem-telesignenterprise \
 	rubygem-net-protocol01>=0.1.3<0.2:net/rubygem-net-protocol01 \
 	rubygem-net-http>=0.4.1<0.4.2:www/rubygem-net-http \
 	rubygem-duo_api>=1.3<2:security/rubygem-duo_api \
 	rubygem-gitlab-sdk>=0.3.0<0.4:devel/rubygem-gitlab-sdk \
 	rubygem-google-cloud-profiler-v2>=0.3<1:textproc/rubygem-google-cloud-profiler-v2 \
-	rubygem-parallel>=1.22<2:sysutils/rubygem-parallel
+	rubygem-parallel>=1.22<2:sysutils/rubygem-parallel \
+	rubygem-google-cloud-storage_transfer>=1.2.0<1.3:net/rubygem-google-cloud-storage_transfer
 
 BUILD_DEPENDS=	gem:devel/ruby-gems \
 	${MY_DEPENDS}
 
 RUN_DEPENDS=	gmake>=4.4.1:devel/gmake \
 	${MY_DEPENDS}
 
 FLAVORS=	ce ee
 FLAVOR?=	${FLAVORS:[1]}
 
 USES=		nodejs:env python:run ruby shebangfix
 
 USE_GITLAB=	yes
 GL_ACCOUNT=	gitlab-org
 .if ${FLAVOR:U} == ee
 GL_PROJECT=	gitlab
 .else # ce
 GL_PROJECT=	gitlab-foss
 .endif
 
 USE_RC_SUBR=	gitlab
 
 SHEBANG_FILES=	scripts/build_qa_image \
 		scripts/build_gdk_image \
 		scripts/db_tasks \
 		scripts/rails-update-bisect \
 		scripts/generate-e2e-pipeline \
 		scripts/frontend/execute-on-staged-files.sh \
 		scripts/frontend/start_storybook.sh \
 		scripts/frontend/vite \
 		scripts/partitioning/generate-fk \
 		scripts/validate-monorepo-gem \
 		.lefthook/pre-push/merge_conflicts \
 		qa/gdk/entrypoint \
-		qa/bin/test
+		qa/bin/test \
+		vendor/gems/bundler-checksum/test/project_with_checksum_lock/scripts/test
 
 CONFLICTS_INSTALL=	gitolite \
 			gitolite2 \
 			gogs \
 			gitea \
 			gitosis
 
 # We install the CE and EE flavor in the same directory
 WWWDIR=		${PREFIX}/www/gitlab
 NO_ARCH=	yes
 NO_BUILD=	yes
 
 USERS=	git
 GROUPS=	git
 
 OPTIONS_DEFINE=			KERBEROS
 OPTIONS_DEFAULT=		KERBEROS
 
 KERBEROS_BUILD_DEPENDS=		rubygem-timfel-krb5-auth>=0.8<1:security/rubygem-timfel-krb5
 KERBEROS_RUN_DEPENDS=		rubygem-timfel-krb5-auth>=0.8<1:security/rubygem-timfel-krb5
 KERBEROS_EXTRA_PATCHES_OFF=	${FILESDIR}/extra-patch-Gemfile-kerberos-off
 
 post-patch:
 	${REINPLACE_CMD} -e "s|%%PREFIX%%|${PREFIX}|" -e "s|%%WWWDIR%%|${WWWDIR}|" ${WRKSRC}/config/gitlab.yml.example \
 		${WRKSRC}/config/puma.rb.example \
 		${WRKSRC}/lib/support/nginx/gitlab \
 		${WRKSRC}/lib/support/nginx/gitlab-ssl
 	# Remove symlink a create a file with content
 	${RM} ${WRKSRC}/GITLAB_WORKHORSE_VERSION
 	${ECHO} ${PORTVERSION} > ${WRKSRC}/GITLAB_WORKHORSE_VERSION
 
 do-install:
 	${CP} ${WRKSRC}/config/database.yml.postgresql ${WRKSRC}/config/database.yml.sample
 	# TODO: Vendored gems are installing binaries not into STAGEDIR, this needs to be fixed.
 	# As intermediate solution, the binaries are not disabled by patches
 	#(cd ${WRKSRC} && ${RM} Gemfile.lock && bundle config set path ${STAGEDIR}${PREFIX}/lib/ruby/gems/${RUBY_VER} && ${WRK_ENV} ${GEM_ENV} bundle install --local)
 	(cd ${WRKSRC} && bundle config set --local bin .bin)
+	# should skip development and test, but does not work
+	#(cd ${WRKSRC} && bundle config set --local without development test)
+	#(cd ${WRKSRC} && cat .bundle/config)
 	(cd ${WRKSRC} && ${RM} Gemfile.lock && ${WRK_ENV} ${GEM_ENV} bundle install --local)
 	(cd ${WRKSRC} && bundle binstubs --all --path .bin)
 	${RM} -R ${WRKSRC}/workhorse
 	# remove vendored sidekiq gem as it breaks gitlab 17.1.0 for FreeBSD
 	# See also: https://gitlab.com/gitlab-org/gitlab/-/issues/468435
 	#${RM} -R ${WRKSRC}/vendor/gems/sidekiq-7.1.6
 	${FIND} ${WRKSRC} -name '*.orig' -delete
 	${FIND} ${WRKSRC} -name '*.bak' -delete
 	${FIND} ${WRKSRC} -name '*.gitkeep' -delete
 	${FIND} ${WRKSRC} -name '*.gitignore' -delete
 	${FIND} ${WRKSRC} -name "Gemfile.lock" -delete
 	${MV} ${WRKSRC}/config/initializers/relative_url.rb.sample ${WRKSRC}/config/initializers/relative_url.rb.example
 	# get files for workdir with: find . -name "*.example" | sort
 	${MV} ${WRKSRC}/config/cable.yml.example ${WRKSRC}/config/cable.yml.sample
 	${MV} ${WRKSRC}/config/gitlab.yml.example ${WRKSRC}/config/gitlab.yml.sample
 	${MV} ${WRKSRC}/config/initializers/devise_password_length.rb.example ${WRKSRC}/config/initializers/devise_password_length.rb.sample
 	${MV} ${WRKSRC}/config/puma.rb.example ${WRKSRC}/config/puma.rb.sample
 	${MV} ${WRKSRC}/config/redis.yml.example ${WRKSRC}/config/redis.yml.sample
 	${MV} ${WRKSRC}/config/resque.yml.example ${WRKSRC}/config/resque.yml.sample
 	${MV} ${WRKSRC}/config/secrets.yml.example ${WRKSRC}/config/secrets.yml.sample
 	${MV} ${WRKSRC}/config/session_store.yml.example ${WRKSRC}/config/session_store.yml.sample
 	${MV} ${WRKSRC}/config/sidekiq.yml.example ${WRKSRC}/config/sidekiq.yml.sample
 	${MV} ${WRKSRC}/lib/support/nginx/gitlab ${WRKSRC}/lib/support/nginx/gitlab.sample
 	${MV} ${WRKSRC}/lib/support/nginx/gitlab-ssl ${WRKSRC}/lib/support/nginx/gitlab-ssl.sample
 	${MV} ${WRKSRC}/public/robots.txt ${WRKSRC}/public/robots.txt.sample
 	${MKDIR} ${STAGEDIR}${WWWDIR}/app/assets/builds
 	${MKDIR} ${STAGEDIR}${WWWDIR}/config/helpers/tailwind
 	${MKDIR} ${STAGEDIR}${WWWDIR}/public/assets
 	${MKDIR} ${STAGEDIR}${WWWDIR}/public/uploads
 	${MKDIR} ${STAGEDIR}${WWWDIR}/tmp/cache
 	${MKDIR} ${STAGEDIR}${WWWDIR}/tmp/sessions
 	${MKDIR} ${STAGEDIR}${WWWDIR}/tmp/backups
 	${MKDIR} ${STAGEDIR}${WWWDIR}/tmp/sockets/private/internal
 	${MKDIR} ${STAGEDIR}${WWWDIR}/shared/tmp
 	${MKDIR} ${STAGEDIR}${WWWDIR}/shared/artifacts/tmp/work
 	${MKDIR} ${STAGEDIR}${WWWDIR}/vendor/assets/stylesheets
 	${MKDIR} ${STAGEDIR}${WWWDIR}/workhorse/changelogs/unreleased
 	# Skip file having an executable bit
 	(cd ${WRKSRC} && ${COPYTREE_SHARE} . ${STAGEDIR}${WWWDIR} "-not ( -type f -perm -a=x )")
 	# now copy all files having an execution bit and preserve to x bit (this fixes some issues we saw)
 	(cd ${WRKSRC} && ${COPYTREE_BIN} . ${STAGEDIR}${WWWDIR} "-type f -perm -a=x")
 
 post-install:
 	${FIND} -s ${STAGEDIR}${WWWDIR} -not -type d | ${SORT} | \
 		${SED} -e 's#^${STAGEDIR}${PREFIX}/##' | \
 		${SED} -E -e '/sample$$/ s#^#@sample #; \
 		/secrets.yml.sample$$/ s#^@sample #@sample(git,www,0600) #; \
 		s#${WWWDIR_REL}/bin#@(git,,544) ${WWWDIR_REL}/bin#; \
 		/db\/schema.rb$$|gitlab.po$$|gitlab.pot$$|gitlab.po.time_stamp$$|locale\/index.js$$/ s#^#@(git,,) #;' >> ${TMPPLIST}
 	@${ECHO_CMD} "@owner git" >> ${TMPPLIST}
 	@${ECHO_CMD} "@group www" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(git,git) ${WWWDIR_REL}/" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/app/assets/builds/" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/app/assets/images/auth_buttons/" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/app/assets/javascripts/locale/" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/app/assets/javascripts/pipeline_wizard/templates/" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(git,git,554) ${WWWDIR_REL}/bin" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/config" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(git,git,755) ${WWWDIR_REL}/config/helpers/tailwind" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,700) ${WWWDIR_REL}/builds" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/lib/assets" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/bg" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/de" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/eo" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/es" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/fil_PH" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/fr" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/id_ID" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/it" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/ja" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/ko" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/nl_NL" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/pl_PL" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/pt_BR" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/ru" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/tr_TR" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/uk" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/zh_CN" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/zh_HK" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/locale/zh_TW" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/log" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/public" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/public/assets" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,700) ${WWWDIR_REL}/public/uploads" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/qa/qa/specs/features/api/2_plan" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/qa/qa/specs/features/api/4_verify" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/qa/qa/specs/features/api/5_package" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/qa/qa/specs/features/api/6_release" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/qa/qa/specs/features/api/7_configure" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/qa/qa/specs/features/api/8_monitor" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/qa/qa/specs/features/browser_ui/5_package" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/qa/qa/specs/features/browser_ui/8_monitor" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/qa/tmp" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/spec/support/gitlab-git-test.git/refs/heads" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir ${WWWDIR_REL}/spec/support/gitlab-git-test.git/refs/tags" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,755) ${WWWDIR_REL}/shared" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,700) ${WWWDIR_REL}/shared/artifacts" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,700) ${WWWDIR_REL}/shared/artifacts/tmp" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,700) ${WWWDIR_REL}/shared/artifacts/tmp/cache" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,700) ${WWWDIR_REL}/shared/artifacts/tmp/uploads" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,700) ${WWWDIR_REL}/shared/artifacts/tmp/work" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,700) ${WWWDIR_REL}/shared/ci_secure_files" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/shared/packages" >> ${TMPPLIST}
 	@${ECHO_CMD} "@group gitlab-pages" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/shared/pages" >> ${TMPPLIST}
 	@${ECHO_CMD} "@group www" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,700) ${WWWDIR_REL}/shared/terraform_state" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,700) ${WWWDIR_REL}/shared/tmp" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,700) ${WWWDIR_REL}/shared/lfs-objects" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,700) ${WWWDIR_REL}/shared/registry" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/tmp" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/tmp/backups" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/tmp/cache" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/tmp/feature_flags" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/tmp/pids" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/tmp/prometheus_multiproc_dir" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/tmp/prometheus_multiproc_dir/puma" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/tmp/prometheus_multiproc_dir/sidekiq" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/tmp/prometheus_multiproc_dir/unicorn" >> ${TMPPLIST}
 	#@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/tmp/run" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/tmp/sessions" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/tmp/sockets" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/tmp/sockets/private" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/tmp/sockets/private/internal" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/vendor" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/vendor/assets" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/vendor/assets/stylesheets" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,770) ${WWWDIR_REL}/workhorse/changelogs/unreleased" >> ${TMPPLIST}
 .if ${FLAVOR:U} == ee
 	# Gitlab-ee version
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/gems/gitlab-backup-cli/tmp" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/qa/qa/specs/features/ee/api/4_verify" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/qa/qa/specs/features/ee/api/5_package" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/qa/qa/specs/features/ee/api/6_release" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/qa/qa/specs/features/ee/api/8_monitor" >> ${TMPPLIST}
 	@${ECHO_CMD} "@dir(,,744) ${WWWDIR_REL}/qa/qa/specs/features/ee/browser_ui/7_configure" >> ${TMPPLIST}
 .endif
 
 .if !defined(_GITLAB_MAKESUM_GUARD)
 makesum:
 	${MAKE} -D_GITLAB_MAKESUM_GUARD makesum DISTINFO_FILE=${.CURDIR}/distinfo FLAVOR=ce
 	${MAKE} -D_GITLAB_MAKESUM_GUARD makesum DISTINFO_FILE=${.CURDIR}/distinfo.ee FLAVOR=ee
 	${CAT} ${.CURDIR}/distinfo.ee >> ${.CURDIR}/distinfo
 	${RM} ${.CURDIR}/distinfo.ee
+	(cd ../../devel/gitaly && ${MAKE} makesum)
+	(cd ../../net/gitlab-agent && ${MAKE} makesum)
+	(cd ../../www/gitlab-pages && ${MAKE} makesum)
+	(cd ../../www/gitlab-workhorse && ${MAKE} makesum)
+
 .endif
 
+.include "${.CURDIR}/Makefile.common"
 .include <bsd.port.mk>
diff --git a/www/gitlab/Makefile.common b/www/gitlab/Makefile.common
new file mode 100644
index 000000000000..52a5bb13b9e1
--- /dev/null
+++ b/www/gitlab/Makefile.common
@@ -0,0 +1,9 @@
+GITLAB_VERSION=	17.3.1
+
+# Git version gitaly should use (from gitlab mirror)
+# Find current tag from Makefile and .gitlab-ci.yaml
+# and from https://gitlab.com/gitlab-org/git/-/tags
+GITLAB_GIT_VERSION=	2.45.2
+# return something like x.yy
+GITLAB_GIT_VERSION_SHORT=	${GITLAB_GIT_VERSION:C/^([0-9]*\.[0-9]*)\..*/\1/}
+
diff --git a/www/gitlab/distinfo b/www/gitlab/distinfo
index 60b16b6e8376..a3b46d64860e 100644
--- a/www/gitlab/distinfo
+++ b/www/gitlab/distinfo
@@ -1,6 +1,6 @@
-TIMESTAMP = 1724572859
-SHA256 (gitlab-foss-v17.1.6.tar.bz2) = 256be185af59a1d148af2567cbfd2657bdb33bf19ba38939f54eee2f38990eca
-SIZE (gitlab-foss-v17.1.6.tar.bz2) = 106430228
-TIMESTAMP = 1724572914
-SHA256 (gitlab-v17.1.6-ee.tar.bz2) = 7fa4b05706397134666e548be0c8285f063eb28b711e159b9d28100030aac5cb
-SIZE (gitlab-v17.1.6-ee.tar.bz2) = 114957586
+TIMESTAMP = 1724590347
+SHA256 (gitlab-foss-v17.3.1.tar.bz2) = a4b7f5f8d7ef54652e6dec83bd7d160e5b066580571e123684cfb91b155aac9d
+SIZE (gitlab-foss-v17.3.1.tar.bz2) = 104061075
+TIMESTAMP = 1724590397
+SHA256 (gitlab-v17.3.1-ee.tar.bz2) = bb3374fe3ce4c0ac8e040df55cb9145b6416b1dcaf059fb208c42d72f344e53c
+SIZE (gitlab-v17.3.1-ee.tar.bz2) = 112997925
diff --git a/www/gitlab/files/gitlab.in b/www/gitlab/files/gitlab.in
index 7887262e0240..0d22bbc45081 100644
--- a/www/gitlab/files/gitlab.in
+++ b/www/gitlab/files/gitlab.in
@@ -1,571 +1,572 @@
 #! /bin/sh
 
 ### BEGIN INIT INFO
 # Provides:          gitlab
 # Required-Start:    $local_fs $remote_fs $network $syslog redis-server
 # Required-Stop:     $local_fs $remote_fs $network $syslog
 # Default-Start:     2 3 4 5
 # Default-Stop:      0 1 6
 # Short-Description: GitLab git repository management
 # Description:       GitLab git repository management
 # chkconfig: - 85 14
 ### END INIT INFO
 
 # Maintainer: Matthias Fechner <mfechner@FreeBSD.org>
 # Based on work of: @charlienewey, rovanion.luckey@gmail.com, @randx, @tz
 
 # PROVIDE: gitlab
 # REQUIRE: LOGIN redis
 # KEYWORD: shutdown
 #
 # Add the following line to /etc/rc.conf to enable GitLab:
 #
 #  gitlab_enable="YES"
 
 PATH="/sbin:/bin:/usr/sbin:/usr/bin:%%LOCALBASE%%/sbin:%%LOCALBASE%%/bin"
 
 . /etc/rc.subr
 
 name=gitlab
 rcvar=gitlab_enable
 extra_commands=status
 
 status_cmd="print_status"
 start_cmd="start_gitlab"
 stop_cmd="stop_gitlab"
 restart_cmd="restart_gitlab"
 service_args="$@"
 restart_precmd=${name}_init
 start_precmd=${name}_init
 stop_precmd=${name}_init
 
 : ${gitlab_enable:="NO"}
 : ${gitlab_authBackend:="http://127.0.0.1:8080"}
 : ${gitlab_workhorse_tcp:="NO"}
 : ${gitlab_workhorse_addr:="127.0.0.1:8181"}
 : ${gitlab_mail_room_enable:="NO"}
 : ${gitlab_allow_conflicts:="NO"}
 : ${gitlab_wait:="120"}
 : ${gitlab_svcj_options:="net_basic"}
 
 load_rc_config $name
 
 ### Environment variables
 RAILS_ENV=${RAILS_ENV:-'production'}
 SIDEKIQ_WORKERS=${SIDEKIQ_WORKERS:-1}
 USE_WEB_SERVER=${USE_WEB_SERVER:-'puma'}
 
 case "${USE_WEB_SERVER}" in
   puma|unicorn)
     use_web_server="$USE_WEB_SERVER"
     ;;
   *)
     echo "Unsupported web server '${USE_WEB_SERVER}' (Allowed: 'puma', 'unicorn')" 1>&2
     exit 1
     ;;
 esac
 
 
 # Script variable names should be lower-case not to conflict with
 # internal /bin/sh variables such as PATH, EDITOR or SHELL.
 app_user="git"
 app_root="%%WWWDIR%%"
 pid_path="$app_root/tmp/pids"
 socket_path="$app_root/tmp/sockets"
 rails_socket="$socket_path/gitlab.socket"
 web_server_pid_path="$pid_path/$use_web_server.pid"
 if checkyesno gitlab_mail_room_enable; then
   mail_room_enabled=true
 else
   mail_room_enabled=false
 fi
 mail_room_pid_path="$pid_path/mail_room.pid"
 gitlab_workhorse_dir=$(cd $app_root/../gitlab-workhorse 2> /dev/null && pwd)
 gitlab_workhorse_pid_path="$pid_path/gitlab-workhorse.pid"
 if checkyesno gitlab_workhorse_tcp; then
   gitlab_workhorse_listen="-listenNetwork tcp -listenAddr $gitlab_workhorse_addr"
 else
   gitlab_workhorse_listen="-listenNetwork unix -listenAddr $socket_path/gitlab-workhorse.socket"
 fi
 gitlab_workhorse_options="-listenUmask 0 $gitlab_workhorse_listen -authBackend $gitlab_authBackend -authSocket $rails_socket -documentRoot $app_root/public"
 gitlab_workhorse_log="$app_root/log/gitlab-workhorse.log"
 gitlab_pages_enabled=false
 gitlab_pages_dir=$(cd $app_root/../gitlab-pages 2> /dev/null && pwd)
 gitlab_pages_pid_path="$pid_path/gitlab-pages.pid"
 gitlab_pages_options="-pages-domain example.com -pages-root $app_root/shared/pages -listen-proxy 127.0.0.1:8090"
 gitlab_pages_log="$app_root/log/gitlab-pages.log"
 shell_path="/usr/local/bin/bash"
 gitaly_enabled=true
 gitaly_dir="%%PREFIX%%/share/gitaly"
 gitaly_pid_path="$pid_path/gitaly.pid"
 gitaly_log="$app_root/log/gitaly.log"
 sidekiq_pid_path="$pid_path/sidekiq-cluster.pid"
 
 ### Init Script functions
 ## Gets the pids from the files
 check_pids(){
   if ! mkdir -p "$pid_path"; then
     echo "Could not create the path $pid_path needed to store the pids."
     exit 1
   fi
   # If there exists a file which should hold the value of the web server pid: read it.
   if [ -f "$web_server_pid_path" ]; then
     wpid=$(cat "$web_server_pid_path")
   else
     wpid=0
   fi
   if [ -f "$sidekiq_pid_path" ]; then
     spid=$(cat "$sidekiq_pid_path")
   else
     spid=0
   fi
   if [ -f "$gitlab_workhorse_pid_path" ]; then
     hpid=$(cat "$gitlab_workhorse_pid_path")
   else
     hpid=0
   fi
   if [ "$mail_room_enabled" = true ]; then
     if [ -f "$mail_room_pid_path" ]; then
       mpid=$(cat "$mail_room_pid_path")
     else
       mpid=0
     fi
   fi
   if [ "$gitlab_pages_enabled" = true ]; then
     if [ -f "$gitlab_pages_pid_path" ]; then
       gppid=$(cat "$gitlab_pages_pid_path")
     else
       gppid=0
     fi
   fi
   if [ "$gitaly_enabled" = true ]; then
     if [ -f "$gitaly_pid_path" ]; then
       gapid=$(cat "$gitaly_pid_path")
     else
       gapid=0
     fi
   fi
 }
 
 
 gitlab_init(){
   # Read configuration variable file if it is present
   test -f /etc/default/gitlab && . /etc/default/gitlab
 
   # Check if other colliding packages are installed
   if `/usr/sbin/pkg -N info -e gogs` && [ $? -eq 0 ]; then
     echo "WARNING: Gitlab cannot run together with gogs as both of them modify .ssh/authorized_keys"
     if checkyesno gitlab_allow_conflicts; then
       echo "but start as overwritten"
     else
       echo "you can overwrite this with: sysrc gitlab_allow_conflicts=YES"
       exit 1
     fi
   fi
   if `/usr/sbin/pkg -N info -e "gitolite*"` && [ $? -eq 0 ]; then
     echo "WARNING: Gitlab cannot run together with gitolite as both of them modify .ssh/authorized_keys"
     if checkyesno gitlab_allow_conflicts; then
       echo "but start as overwritten"
     else
       echo "you can overwrite this with: sysrc gitlab_allow_conflicts=YES"
       exit 1
     fi
   fi
   if `/usr/sbin/pkg -N info -e "*gitosis*"` && [ $? -eq 0 ]; then
     echo "WARNING: Gitlab cannot run together with py-gitosis as both of them modify .ssh/authorized_keys"
     if checkyesno gitlab_allow_conflicts; then
       echo "but start as overwritten"
     else
       echo "you can overwrite this with: sysrc gitlab_allow_conflicts=YES"
       exit 1
     fi
   fi
   if `/usr/sbin/pkg -N info -e gitea` && [ $? -eq 0 ]; then
     echo "WARNING: Gitlab cannot run together with gitea as both of them modify .ssh/authorized_keys"
     if checkyesno gitlab_allow_conflicts; then
       echo "but start as overwritten"
     else
       echo "you can overwrite this with: sysrc gitlab_allow_conflicts=YES"
       exit 1
     fi
   fi
 
   # Switch to the app_user if it is not he/she who is running the script.
   if [ "$USER" != "$app_user" ]; then
     # Regenerate the Gemfile.lock for all related products
     # echo "Regenerate Gitlab Gemfile.lock"
     rm -f "${app_root}"/Gemfile.lock
+    #su -l root -c "cd ${app_root} && %%LOCALBASE%%/bin/bundle config set --local without development test"
     if ! su -l root -c "cd ${app_root} && %%LOCALBASE%%/bin/bundle install --local --quiet"; then
       echo "Could not create Gemfile.lock for gitlab, please report this using FreeBSD Bugtracker, https://bugs.freebsd.org/"
       exit 1
     fi
     chown git "${app_root}"/Gemfile.lock
 
     eval su - "$app_user" -c $(echo \")%%LOCALBASE%%/etc/rc.d/gitlab "${service_args}"$(echo \"); exit;
   fi
 
   # Switch to the gitlab path, exit on failure.
   if ! cd "$app_root" ; then
     echo "Failed to cd into $app_root, exiting!";  exit 1
   fi
 
   # We use the pids in so many parts of the script it makes sense to always check them.
   # Only after start() is run should the pids change. Sidekiq sets its own pid.
   check_pids
 }
 
 ## Called when we have started the two processes and are waiting for their pid files.
 wait_for_pids(){
   # We are sleeping a bit here mostly because sidekiq is slow at writing its pid
   i=0
   while [ ! -f $web_server_pid_path ] || [ ! -f $sidekiq_pid_path ] || [ ! -f $gitlab_workhorse_pid_path ] || { [ "$mail_room_enabled" = true ] && [ ! -f $mail_room_pid_path ]; } || { [ "$gitlab_pages_enabled" = true ] && [ ! -f $gitlab_pages_pid_path ]; } || { [ "$gitaly_enabled" = true ] && [ ! -f $gitaly_pid_path ]; }; do
     echo -n "."
     if [ $((i)) = "$gitlab_wait" ]; then
       echo
       echo "Waited ${i}s for the processes to write their pids, something probably went wrong."
 	  exit 1;
 	fi
 	sleep 1
 	i=$((i+1))
   done
   echo
   echo "Started in ${i}s."
 }
 
 ## Checks whether the different parts of the service are already running or not.
 check_status(){
   check_pids
   # If the web server is running kill -0 $wpid returns true, or rather 0.
   # Checks of *_status should only check for == 0 or != 0, never anything else.
   if [ $wpid -ne 0 ]; then
     kill -0 "$wpid" 2>/dev/null
     web_status="$?"
   else
     web_status="-1"
   fi
   if [ $spid -ne 0 ]; then
     kill -0 "$spid" 2>/dev/null
     sidekiq_status="$?"
   else
     sidekiq_status="-1"
   fi
   if [ $hpid -ne 0 ]; then
     kill -0 "$hpid" 2>/dev/null
     gitlab_workhorse_status="$?"
   else
     gitlab_workhorse_status="-1"
   fi
   if [ "$mail_room_enabled" = true ]; then
     if [ $mpid -ne 0 ]; then
       kill -0 "$mpid" 2>/dev/null
       mail_room_status="$?"
     else
       mail_room_status="-1"
     fi
   fi
   if [ "$gitlab_pages_enabled" = true ]; then
     if [ $gppid -ne 0 ]; then
       kill -0 "$gppid" 2>/dev/null
       gitlab_pages_status="$?"
     else
       gitlab_pages_status="-1"
     fi
   fi
   if [ "$gitaly_enabled" = true ]; then
     if [ $gapid -ne 0 ]; then
       kill -0 "$gapid" 2>/dev/null
       gitaly_status="$?"
     else
       gitaly_status="-1"
     fi
   fi
   if [ $web_status = 0 ] && [ $sidekiq_status = 0 ] && [ $gitlab_workhorse_status = 0 ] && { [ "$mail_room_enabled" != true ] || [ $mail_room_status = 0 ]; } && { [ "$gitlab_pages_enabled" != true ] || [ $gitlab_pages_status = 0 ]; } && { [ "$gitaly_enabled" != true ] || [ $gitaly_status = 0 ]; }; then
     gitlab_status=0
   else
     # http://refspecs.linuxbase.org/LSB_4.1.0/LSB-Core-generic/LSB-Core-generic/iniscrptact.html
     # code 3 means 'program is not running'
     gitlab_status=3
   fi
 }
 
 ## Check for stale pids and remove them if necessary.
 check_stale_pids(){
   check_status
   # If there is a pid it is something else than 0, the service is running if
   # *_status is == 0.
   if [ "$wpid" != "0" ] && [ "$web_status" != "0" ]; then
     echo "Removing stale web server pid. This is most likely caused by the web server crashing the last time it ran."
     if ! rm "$web_server_pid_path"; then
       echo "Unable to remove stale pid, exiting."
       exit 1
     fi
   fi
   if [ "$spid" != "0" ] && [ "$sidekiq_status" != "0" ]; then
     echo "Removing stale Sidekiq job dispatcher pid. This is most likely caused by Sidekiq crashing the last time it ran."
     if ! rm "$sidekiq_pid_path"; then
       echo "Unable to remove stale pid, exiting"
       exit 1
     fi
   fi
   if [ "$hpid" != "0" ] && [ "$gitlab_workhorse_status" != "0" ]; then
     echo "Removing stale GitLab Workhorse pid. This is most likely caused by GitLab Workhorse crashing the last time it ran."
     if ! rm "$gitlab_workhorse_pid_path"; then
        echo "Unable to remove stale pid, exiting"
       exit 1
     fi
   fi
   if [ "$mail_room_enabled" = true ] && [ "$mpid" != "0" ] && [ "$mail_room_status" != "0" ]; then
     echo "Removing stale MailRoom job dispatcher pid. This is most likely caused by MailRoom crashing the last time it ran."
     if ! rm "$mail_room_pid_path"; then
       echo "Unable to remove stale pid, exiting"
       exit 1
     fi
   fi
   if [ "$gitlab_pages_enabled" = true ] && [ "$gppid" != "0" ] && [ "$gitlab_pages_status" != "0" ]; then
     echo "Removing stale GitLab Pages job dispatcher pid. This is most likely caused by GitLab Pages crashing the last time it ran."
     if ! rm "$gitlab_pages_pid_path"; then
       echo "Unable to remove stale pid, exiting"
       exit 1
     fi
   fi
   if [ "$gitaly_enabled" = true ] && [ "$gapid" != "0" ] && [ "$gitaly_status" != "0" ]; then
     echo "Removing stale Gitaly pid. This is most likely caused by Gitaly crashing the last time it ran."
     if ! rm "$gitaly_pid_path"; then
       echo "Unable to remove stale pid, exiting"
       exit 1
     fi
   fi
 }
 
 ## If no parts of the service is running, bail out.
 exit_if_not_running(){
   check_stale_pids
   if [ "$web_status" != "0" ] && [ "$sidekiq_status" != "0" ] && [ "$gitlab_workhorse_status" != "0" ] && { [ "$mail_room_enabled" != true ] || [ "$mail_room_status" != "0" ]; } && { [ "$gitlab_pages_enabled" != true ] || [ "$gitlab_pages_status" != "0" ]; } && { [ "$gitaly_enabled" != true ] || [ "$gitaly_status" != "0" ]; }; then
     echo "GitLab is not running."
     exit
   fi
 }
 
 ## Starts web server and Sidekiq if they're not running.
 start_gitlab() {
   check_stale_pids
 
   if [ "$web_status" != "0" ]; then
     echo "Starting GitLab web server ($use_web_server)"
   fi
   if [ "$sidekiq_status" != "0" ]; then
     echo "Starting GitLab Sidekiq"
   fi
   if [ "$gitlab_workhorse_status" != "0" ]; then
     echo "Starting GitLab Workhorse"
   fi
   if [ "$mail_room_enabled" = true ] && [ "$mail_room_status" != "0" ]; then
     echo "Starting GitLab MailRoom"
   fi
   if [ "$gitlab_pages_enabled" = true ] && [ "$gitlab_pages_status" != "0" ]; then
     echo "Starting GitLab Pages"
   fi
   if [ "$gitaly_enabled" = true ] && [ "$gitaly_status" != "0" ]; then
     echo "Starting Gitaly"
   fi
 
   # Then check if the service is running. If it is: don't start again.
   if [ "$web_status" = "0" ]; then
     echo "The web server already running with pid $wpid, not restarting."
   else
     # Remove old socket if it exists
     rm -f "$rails_socket" 2>/dev/null
     # Start the web server
     RAILS_ENV=$RAILS_ENV USE_WEB_SERVER=$use_web_server bin/web start
   fi
 
   # If sidekiq is already running, don't start it again.
   if [ "$sidekiq_status" = "0" ]; then
     echo "The Sidekiq job dispatcher is already running with pid $spid, not restarting"
   else
     RAILS_ENV=$RAILS_ENV SIDEKIQ_WORKERS=$SIDEKIQ_WORKERS bin/background_jobs start > /dev/null &
   fi
 
   if [ "$gitlab_workhorse_status" = "0" ]; then
     echo "The GitLab Workhorse is already running with pid $hpid, not restarting"
   else
     # No need to remove a socket, gitlab-workhorse does this itself.
     # Because gitlab-workhorse has multiple executables we need to fix
     # the PATH.
     $app_root/bin/daemon_with_pidfile $gitlab_workhorse_pid_path  \
       /usr/bin/env PATH=$gitlab_workhorse_dir:$PATH \
       gitlab-workhorse $gitlab_workhorse_options \
       >> $gitlab_workhorse_log 2>&1 &
   fi
 
   if [ "$mail_room_enabled" = true ]; then
     # If MailRoom is already running, don't start it again.
     if [ "$mail_room_status" = "0" ]; then
       echo "The MailRoom email processor is already running with pid $mpid, not restarting"
     else
       RAILS_ENV=$RAILS_ENV bin/mail_room start &
     fi
   fi
 
   if [ "$gitlab_pages_enabled" = true ]; then
     if [ "$gitlab_pages_status" = "0" ]; then
       echo "The GitLab Pages is already running with pid $gppid, not restarting"
     else
       $app_root/bin/daemon_with_pidfile $gitlab_pages_pid_path  \
         $gitlab_pages_dir/gitlab-pages $gitlab_pages_options \
         >> $gitlab_pages_log 2>&1 &
     fi
   fi
 
   if [ "$gitaly_enabled" = true ]; then
     if [ "$gitaly_status" = "0" ]; then
       echo "Gitaly is already running with pid $gapid, not restarting"
     else
       $app_root/bin/daemon_with_pidfile $gitaly_pid_path \
         $gitaly_dir/bin/gitaly $gitaly_dir/config.toml >> $gitaly_log 2>&1 &
     fi
   fi
 
   # Wait for the pids to be planted
   wait_for_pids
   # Finally check the status to tell wether or not GitLab is running
   print_status
 }
 
 ## Asks web server, Sidekiq and MailRoom if they would be so kind as to stop, if not kills them.
 stop_gitlab() {
   exit_if_not_running
 
   if [ "$web_status" = "0" ]; then
     echo "Shutting down GitLab web server"
     RAILS_ENV=$RAILS_ENV USE_WEB_SERVER=$use_web_server bin/web stop
   fi
   if [ "$sidekiq_status" = "0" ]; then
     echo "Shutting down GitLab Sidekiq"
     RAILS_ENV=$RAILS_ENV SIDEKIQ_WORKERS=$SIDEKIQ_WORKERS bin/background_jobs stop
   fi
   if [ "$gitlab_workhorse_status" = "0" ]; then
     echo "Shutting down GitLab Workhorse"
     kill -- $(cat $gitlab_workhorse_pid_path)
   fi
   if [ "$mail_room_enabled" = true ] && [ "$mail_room_status" = "0" ]; then
     echo "Shutting down GitLab MailRoom"
     RAILS_ENV=$RAILS_ENV bin/mail_room stop
   fi
   if [ "$gitlab_pages_status" = "0" ]; then
     echo "Shutting down gitlab-pages"
     kill -- $(cat $gitlab_pages_pid_path)
   fi
   if [ "$gitaly_status" = "0" ]; then
     echo "Shutting down Gitaly"
     kill -- $(cat $gitaly_pid_path)
   fi
 
   # If something needs to be stopped, lets wait for it to stop. Never use SIGKILL in a script.
   while [ "$web_status" = "0" ] || [ "$sidekiq_status" = "0" ] || [ "$gitlab_workhorse_status" = "0" ] || { [ "$mail_room_enabled" = true ] && [ "$mail_room_status" = "0" ]; } || { [ "$gitlab_pages_enabled" = true ] && [ "$gitlab_pages_status" = "0" ]; } || { [ "$gitaly_enabled" = true ] && [ "$gitaly_status" = "0" ]; }; do
     sleep 1
     check_status
     printf "."
     if [ "$web_status" != "0" ] && [ "$sidekiq_status" != "0" ] && [ "$gitlab_workhorse_status" != "0" ] && { [ "$mail_room_enabled" != true ] || [ "$mail_room_status" != "0" ]; } && { [ "$gitlab_pages_enabled" != true ] || [ "$gitlab_pages_status" != "0" ]; } && { [ "$gitaly_enabled" != true ] || [ "$gitaly_status" != "0" ]; }; then
       printf "\n"
       break
     fi
   done
 
   sleep 1
   # Cleaning up unused pids
   rm "$web_server_pid_path" 2>/dev/null
   # rm "$sidekiq_pid_path" 2>/dev/null # Sidekiq seems to be cleaning up its own pid.
   rm -f "$gitlab_workhorse_pid_path"
   if [ "$mail_room_enabled" = true ]; then
     rm "$mail_room_pid_path" 2>/dev/null
   fi
   rm -f "$gitlab_pages_pid_path"
   rm -f "$gitaly_pid_path"
 
   print_status
 }
 
 ## Prints the status of GitLab and its components.
 print_status() {
   check_status
   if [ "$web_status" != "0" ] && [ "$sidekiq_status" != "0" ] && [ "$gitlab_workhorse_status" != "0" ] && { [ "$mail_room_enabled" != true ] || [ "$mail_room_status" != "0" ]; } && { [ "$gitlab_pages_enabled" != true ] || [ "$gitlab_pages_status" != "0" ]; } && { [ "$gitaly_enabled" != true ] || [ "$gitaly_status" != "0" ]; }; then
     echo "GitLab is not running."
     return
   fi
   if [ "$web_status" = "0" ]; then
     echo "The GitLab web server with pid $wpid is running."
   else
     printf "The GitLab web server is \033[31mnot running\033[0m.\n"
   fi
   if [ "$sidekiq_status" = "0" ]; then
     echo "The GitLab Sidekiq job dispatcher with pid $spid is running."
   else
     printf "The GitLab Sidekiq job dispatcher is \033[31mnot running\033[0m.\n"
   fi
   if [ "$gitlab_workhorse_status" = "0" ]; then
     echo "The GitLab Workhorse with pid $hpid is running."
   else
     printf "The GitLab Workhorse is \033[31mnot running\033[0m.\n"
   fi
   if [ "$mail_room_enabled" = true ]; then
     if [ "$mail_room_status" = "0" ]; then
       echo "The GitLab MailRoom email processor with pid $mpid is running."
     else
       printf "The GitLab MailRoom email processor is \033[31mnot running\033[0m.\n"
     fi
   fi
   if [ "$gitlab_pages_enabled" = true ]; then
     if [ "$gitlab_pages_status" = "0" ]; then
       echo "The GitLab Pages with pid $gppid is running."
     else
       printf "The GitLab Pages is \033[31mnot running\033[0m.\n"
     fi
   fi
   if [ "$gitaly_enabled" = true ]; then
     if [ "$gitaly_status" = "0" ]; then
       echo "Gitaly with pid $gapid is running."
     else
       printf "Gitaly is \033[31mnot running\033[0m.\n"
     fi
   fi
   if [ "$web_status" = "0" ] && [ "$sidekiq_status" = "0" ] && [ "$gitlab_workhorse_status" = "0" ] && { [ "$mail_room_enabled" != true ] || [ "$mail_room_status" = "0" ]; } && { [ "$gitlab_pages_enabled" != true ] || [ "$gitlab_pages_status" = "0" ]; } && { [ "$gitaly_enabled" != true ] || [ "$gitaly_status" = "0" ]; }; then
     printf "GitLab and all its components are \033[32mup and running\033[0m.\n"
   fi
 }
 
 ## Tells web server to reload its config and Sidekiq to restart
 reload_gitlab(){
   exit_if_not_running
   if [ "$wpid" = "0" ];then
     echo "The GitLab web server Web server is not running thus its configuration can't be reloaded."
     exit 1
   fi
   printf "Reloading GitLab web server configuration... "
   RAILS_ENV=$RAILS_ENV USE_WEB_SERVER=$use_web_server bin/web reload
   echo "Done."
 
   echo "Restarting GitLab Sidekiq since it isn't capable of reloading its config..."
   RAILS_ENV=$RAILS_ENV SIDEKIQ_WORKERS=$SIDEKIQ_WORKERS bin/background_jobs restart & /dev/null &
 
   if [ "$mail_room_enabled" != true ]; then
     echo "Restarting GitLab MailRoom since it isn't capable of reloading its config..."
     RAILS_ENV=$RAILS_ENV bin/mail_room restart
   fi
 
   wait_for_pids
   print_status
 }
 
 ## Restarts Sidekiq and web server.
 restart_gitlab(){
   check_status
   if [ "$web_status" = "0" ] || [ "$sidekiq_status" = "0" ] || [ "$gitlab_workhorse" = "0" ] || { [ "$mail_room_enabled" = true ] && [ "$mail_room_status" = "0" ]; } || { [ "$gitlab_pages_enabled" = true ] && [ "$gitlab_pages_status" = "0" ]; } || { [ "$gitaly_enabled" = true ] && [ "$gitaly_status" = "0" ]; }; then
     stop_gitlab
   fi
   start_gitlab
 }
 
 run_rc_command "$1"
 
 exit
diff --git a/www/gitlab/files/patch-Gemfile b/www/gitlab/files/patch-Gemfile
index dd9d6e0337c8..6c38a9e1aee7 100644
--- a/www/gitlab/files/patch-Gemfile
+++ b/www/gitlab/files/patch-Gemfile
@@ -1,255 +1,221 @@
---- Gemfile.orig	2024-06-25 20:33:28 UTC
+--- Gemfile.orig	2024-08-20 19:36:17 UTC
 +++ Gemfile
-@@ -58,7 +58,7 @@ gem 'rugged', '~> 1.6' # rubocop:todo Gemfile/MissingF
- 
- gem 'rugged', '~> 1.6' # rubocop:todo Gemfile/MissingFeatureCategory
- 
--gem 'faraday', '~> 1.0' # rubocop:todo Gemfile/MissingFeatureCategory
-+gem 'faraday', '>= 1.0' # rubocop:todo Gemfile/MissingFeatureCategory
- gem 'marginalia', '~> 1.11.1' # rubocop:todo Gemfile/MissingFeatureCategory
- 
- # Authorization
-@@ -79,7 +79,7 @@ gem 'omniauth-alicloud', '~> 3.0.0' # rubocop:todo Gem
- gem 'omniauth-auth0', '~> 3.1' # rubocop:todo Gemfile/MissingFeatureCategory
- gem 'omniauth-azure-activedirectory-v2', '~> 2.0' # rubocop:todo Gemfile/MissingFeatureCategory
- gem 'omniauth-alicloud', '~> 3.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
--gem 'omniauth-github', '2.0.1' # rubocop:todo Gemfile/MissingFeatureCategory
-+gem 'omniauth-github', '~> 2.0.1' # rubocop:todo Gemfile/MissingFeatureCategory
- gem 'omniauth-gitlab', '~> 4.0.0', path: 'vendor/gems/omniauth-gitlab' # See vendor/gems/omniauth-gitlab/README.md # rubocop:todo Gemfile/MissingFeatureCategory
- gem 'omniauth-google-oauth2', '~> 1.1' # rubocop:todo Gemfile/MissingFeatureCategory
- gem 'omniauth-oauth2-generic', '~> 0.2.2' # rubocop:todo Gemfile/MissingFeatureCategory
-@@ -89,7 +89,7 @@ gem 'omniauth_openid_connect', '~> 0.6.1' # rubocop:to
- gem 'omniauth_openid_connect', '~> 0.6.1' # rubocop:todo Gemfile/MissingFeatureCategory
- # Locked until Ruby 3.0 upgrade since upgrading will pull in an updated net-smtp gem.
- # See https://docs.gitlab.com/ee/development/emails.html#rationale.
--gem 'openid_connect', '= 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
-+gem 'openid_connect', '= 1.3.1' # rubocop:todo Gemfile/MissingFeatureCategory
- gem 'omniauth-salesforce', '~> 1.0.5', path: 'vendor/gems/omniauth-salesforce' # See gem README.md # rubocop:todo Gemfile/MissingFeatureCategory
- gem 'omniauth-atlassian-oauth2', '~> 0.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
- gem 'rack-oauth2', '~> 1.21.3' # rubocop:todo Gemfile/MissingFeatureCategory
-@@ -184,7 +184,7 @@ gem 'google-cloud-storage', '~> 1.45.0' # rubocop:todo
+@@ -156,7 +156,6 @@ gem 'graphql', '~> 2.3.5', feature_category: :api
+ 
+ # GraphQL API
+ gem 'graphql', '~> 2.3.5', feature_category: :api
+-gem 'graphql-docs', '~> 5.0.0', group: [:development, :test], feature_category: :api
+ gem 'graphiql-rails', '~> 1.10', feature_category: :api
+ gem 'apollo_upload_server', '~> 2.1.6', feature_category: :api
+ gem 'graphlient', '~> 0.8.0', feature_category: :importers # Used by BulkImport feature (group::import)
+@@ -209,7 +208,7 @@ gem 'google-cloud-storage', '~> 1.45.0' # rubocop:todo
  gem 'google-apis-storage_v1', '~> 0.29' # rubocop:todo Gemfile/MissingFeatureCategory
  gem 'google-cloud-storage', '~> 1.45.0' # rubocop:todo Gemfile/MissingFeatureCategory
  # We need >= 0.11.1 because that's when match_glob support is added to list_objects
 -gem 'google-apis-core', '~> 0.11.0', '>= 0.11.1' # rubocop:todo Gemfile/MissingFeatureCategory
 +gem 'google-apis-core', '~> 0.11', '>= 0.11.1' # rubocop:todo Gemfile/MissingFeatureCategory
  gem 'google-apis-compute_v1', '~> 0.57.0' # rubocop:todo Gemfile/MissingFeatureCategory
  gem 'google-apis-container_v1', '~> 0.43.0' # rubocop:todo Gemfile/MissingFeatureCategory
  gem 'google-apis-container_v1beta1', '~> 0.43.0' # rubocop:todo Gemfile/MissingFeatureCategory
-@@ -195,7 +195,7 @@ gem 'google-apis-androidpublisher_v3', '~> 0.34.0' # r
+@@ -220,7 +219,7 @@ gem 'google-apis-androidpublisher_v3', '~> 0.34.0' # r
  gem 'google-apis-sqladmin_v1beta4', '~> 0.41.0' # rubocop:todo Gemfile/MissingFeatureCategory
  gem 'google-apis-androidpublisher_v3', '~> 0.34.0' # rubocop:todo Gemfile/MissingFeatureCategory
  
 -gem 'googleauth', '~> 1.8.1', feature_category: :shared
 +gem 'googleauth', '~> 1.8', feature_category: :shared
  gem 'google-cloud-artifact_registry-v1', '~> 0.11.0', feature_category: :shared
  gem 'google-cloud-compute-v1', '~> 2.6.0', feature_category: :shared
  
-@@ -206,9 +206,9 @@ gem 'elasticsearch-api',   '7.13.3' # rubocop:todo Gem
- gem 'elasticsearch-model', '~> 7.2' # rubocop:todo Gemfile/MissingFeatureCategory
- gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation' # rubocop:todo Gemfile/MissingFeatureCategory
- gem 'elasticsearch-api',   '7.13.3' # rubocop:todo Gemfile/MissingFeatureCategory
--gem 'aws-sdk-core', '~> 3.197.0' # rubocop:todo Gemfile/MissingFeatureCategory
-+gem 'aws-sdk-core', '~> 3.197' # rubocop:todo Gemfile/MissingFeatureCategory
+@@ -231,9 +230,9 @@ gem 'elasticsearch-api', '7.17.11', feature_category: 
+ gem 'elasticsearch-model', '~> 7.2', feature_category: :global_search
+ gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation', feature_category: :global_search
+ gem 'elasticsearch-api', '7.17.11', feature_category: :global_search
+-gem 'aws-sdk-core', '~> 3.201.0' # rubocop:todo Gemfile/MissingFeatureCategory
++gem 'aws-sdk-core', '~> 3.201' # rubocop:todo Gemfile/MissingFeatureCategory
  gem 'aws-sdk-cloudformation', '~> 1' # rubocop:todo Gemfile/MissingFeatureCategory
--gem 'aws-sdk-s3', '~> 1.151.0' # rubocop:todo Gemfile/MissingFeatureCategory
-+gem 'aws-sdk-s3', '~> 1.151' # rubocop:todo Gemfile/MissingFeatureCategory
- gem 'faraday_middleware-aws-sigv4', '~>0.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
- gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive connections # rubocop:todo Gemfile/MissingFeatureCategory
- 
-@@ -239,12 +239,12 @@ gem 'diff_match_patch', '~> 0.1.0', path: 'vendor/gems
- gem 'diff_match_patch', '~> 0.1.0', path: 'vendor/gems/diff_match_patch', feature_category: :team_planning
- 
- # Application server
--gem 'rack', '~> 2.2.8.1' # rubocop:todo Gemfile/MissingFeatureCategory
-+gem 'rack', '~> 2.2.8', '>= 2.2.8.1' # rubocop:todo Gemfile/MissingFeatureCategory
- # https://github.com/zombocom/rack-timeout/blob/master/README.md#rails-apps-manually
- gem 'rack-timeout', '~> 0.6.3', require: 'rack/timeout/base' # rubocop:todo Gemfile/MissingFeatureCategory
+-gem 'aws-sdk-s3', '~> 1.157.0' # rubocop:todo Gemfile/MissingFeatureCategory
++gem 'aws-sdk-s3', '~> 1.157' # rubocop:todo Gemfile/MissingFeatureCategory
+ gem 'faraday-typhoeus', '~> 1.1', feature_category: :global_search
+ gem 'faraday_middleware-aws-sigv4', '~> 1.0.1', feature_category: :global_search
+ # Used with Elasticsearch to support http keep-alive connections
+@@ -271,7 +270,7 @@ group :puma do
+ gem 'rack-timeout', '~> 0.7.0', require: 'rack/timeout/base' # rubocop:todo Gemfile/MissingFeatureCategory
  
  group :puma do
 -  gem 'puma', '= 6.4.0', require: false, feature_category: :shared
 +  gem 'puma', '~> 6.4.0', require: false, feature_category: :shared
    gem 'sd_notify', '~> 0.1.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
  end
  
-@@ -255,7 +255,7 @@ gem 'acts-as-taggable-on', '~> 10.0' # rubocop:todo Ge
- gem 'acts-as-taggable-on', '~> 10.0' # rubocop:todo Gemfile/MissingFeatureCategory
+@@ -279,7 +278,7 @@ gem 'state_machines-activerecord', '~> 0.8.0' # ruboco
+ gem 'state_machines-activerecord', '~> 0.8.0' # rubocop:todo Gemfile/MissingFeatureCategory
  
  # Background jobs
 -gem 'sidekiq', path: 'vendor/gems/sidekiq-7.1.6', require: 'sidekiq', feature_category: :scalability
-+gem 'sidekiq', '~>7.1.6', feature_category: :scalability
++gem 'sidekiq', '~> 7.1.6', require: 'sidekiq', feature_category: :scalability
  gem 'sidekiq-cron', '~> 1.12.0', feature_category: :scalability
  gem 'gitlab-sidekiq-fetcher',
    path: 'vendor/gems/sidekiq-reliable-fetch',
-@@ -431,96 +431,10 @@ gem 'warning', '~> 1.3.0' # rubocop:todo Gemfile/Missi
+@@ -459,95 +458,10 @@ gem 'warning', '~> 1.3.0' # rubocop:todo Gemfile/Missi
  
  gem 'warning', '~> 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
  
 -group :development do
 -  gem 'lefthook', '~> 1.6.8', require: false, feature_category: :tooling
 -  gem 'rubocop', feature_category: :tooling
 -  gem 'solargraph', '~> 0.47.2', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 -
--  gem 'letter_opener_web', '~> 2.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
+-  gem 'letter_opener_web', '~> 3.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
 -  gem 'lookbook', '~> 2.3' # rubocop:todo Gemfile/MissingFeatureCategory
 -
 -  # Better errors handler
 -  gem 'better_errors', '~> 2.10.1' # rubocop:todo Gemfile/MissingFeatureCategory
 -
 -  gem 'sprite-factory', '~> 1.7' # rubocop:todo Gemfile/MissingFeatureCategory
 -
 -  gem 'listen', '~> 3.7' # rubocop:todo Gemfile/MissingFeatureCategory
 -
--  gem 'ruby-lsp', "~> 0.16.7", require: false, feature_category: :tooling
+-  gem 'ruby-lsp', "~> 0.17.0", require: false, feature_category: :tooling
 -
 -  gem 'ruby-lsp-rails', "~> 0.3.6", feature_category: :tooling
 -
 -  gem 'ruby-lsp-rspec', "~> 0.1.10", require: false, feature_category: :tooling
 -
 -  gem 'gdk-toogle', '~> 0.9', '>= 0.9.5', require: 'toogle', feature_category: :tooling
 -end
 -
 -group :development, :test do
 -  gem 'deprecation_toolkit', '~> 1.5.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 -  gem 'bullet', '~> 7.1.2' # rubocop:todo Gemfile/MissingFeatureCategory
--  # Locked on 3.3.0.5 until inspec-core is updated in Omnibus: https://github.com/inspec/inspec/pull/7030
--  gem 'parser', '= 3.3.0.5', feature_category: :shared
+-  gem 'parser', '= 3.3.3.0', feature_category: :shared
 -  gem 'pry-byebug' # rubocop:todo Gemfile/MissingFeatureCategory
 -  gem 'pry-rails', '~> 0.3.9' # rubocop:todo Gemfile/MissingFeatureCategory
 -  gem 'pry-shell', '~> 0.6.4' # rubocop:todo Gemfile/MissingFeatureCategory
 -
 -  gem 'awesome_print', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 -
--  gem 'database_cleaner-active_record', '~> 2.1.0', feature_category: :database
+-  gem 'database_cleaner-active_record', '~> 2.2.0', feature_category: :database
 -  gem 'rspec-rails', '~> 6.1.1', feature_category: :shared
 -  gem 'factory_bot_rails', '~> 6.4.3', feature_category: :tooling
 -
 -  # Prevent occasions where minitest is not bundled in packaged versions of ruby (see #3826)
 -  gem 'minitest', '~> 5.11.0' # rubocop:todo Gemfile/MissingFeatureCategory
 -
 -  gem 'spring', '~> 4.1.0' # rubocop:todo Gemfile/MissingFeatureCategory
 -  gem 'spring-commands-rspec', '~> 1.0.4' # rubocop:todo Gemfile/MissingFeatureCategory
 -
 -  gem 'gitlab-styles', '~> 12.0.1', feature_category: :tooling
 -  gem 'haml_lint', '~> 0.58', feature_category: :tooling
 -
 -  gem 'bundler-audit', '~> 0.9.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 -
 -  # Benchmarking & profiling
 -  gem 'benchmark-ips', '~> 2.11.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 -  gem 'benchmark-memory', '~> 0.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 -
 -  # Profiling data from CI/CD pipelines
 -  gem 'influxdb-client', '~> 3.1', require: false, feature_category: :tooling
 -
--  gem 'knapsack', '~> 1.22.0', feature_category: :tooling
+-  gem 'knapsack', '~> 4.0.0', feature_category: :tooling
 -  gem 'crystalball', '~> 0.7.0', require: false, feature_category: :tooling
 -  gem 'test_file_finder', '~> 0.3.1', feature_category: :tooling
 -
 -  gem 'simple_po_parser', '~> 1.1.6', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 -
 -  gem 'png_quantizator', '~> 0.2.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 -
 -  gem 'parallel', '~> 1.19', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 -
 -  gem 'sigdump', '~> 0.2.4', require: 'sigdump/setup' # rubocop:todo Gemfile/MissingFeatureCategory
 -
 -  gem 'pact', '~> 1.64' # rubocop:todo Gemfile/MissingFeatureCategory
 -
 -  # For now we only use vite in development / test, and not for production builds
 -  # See: https://gitlab.com/gitlab-org/frontend/rfcs/-/issues/106
 -  gem 'vite_rails', '~> 3.0.17', feature_category: :shared
--  gem 'vite_ruby', '~> 3.5.0', feature_category: :shared
+-  gem 'vite_ruby', '~> 3.7.0', feature_category: :shared
 -
 -  gem 'gitlab-housekeeper', path: 'gems/gitlab-housekeeper', feature_category: :tooling
 -end
 -
  group :development, :test, :danger do
-   gem 'gitlab-dangerfiles', '~> 4.7.0', require: false, feature_category: :tooling
+   gem 'gitlab-dangerfiles', '~> 4.8.0', require: false, feature_category: :tooling
  end
  
 -group :development, :test, :coverage do
 -  gem 'simplecov', '~> 0.22', require: false, feature_category: :tooling
 -  gem 'simplecov-lcov', '~> 0.8.0', require: false, feature_category: :tooling
 -  gem 'simplecov-cobertura', '~> 2.1.0', require: false, feature_category: :tooling
--  gem 'undercover', '~> 0.4.4', require: false, feature_category: :tooling
+-  gem 'undercover', '~> 0.5.0', require: false, feature_category: :tooling
 -end
 -
  # Gems required in omnibus-gitlab pipeline
  group :development, :test, :omnibus do
    gem 'license_finder', '~> 7.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
-@@ -532,36 +446,6 @@ end
+@@ -559,36 +473,6 @@ end
    gem 'gitlab-rspec_flaky', path: 'gems/gitlab-rspec_flaky', feature_category: :tooling
  end
  
 -group :test do
 -  gem 'fuubar', '~> 2.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
 -  gem 'rspec-retry', '~> 0.6.2', feature_category: :tooling
 -  gem 'rspec_profiling', '~> 0.0.9', feature_category: :tooling
 -  gem 'rspec-benchmark', '~> 0.6.0', feature_category: :tooling
 -  gem 'rspec-parameterized', '~> 1.0', '>= 1.0.2', require: false, feature_category: :tooling
 -  gem 'os', '~> 1.1', '>= 1.1.4', feature_category: :tooling
 -
 -  gem 'capybara', '~> 3.40' # rubocop:todo Gemfile/MissingFeatureCategory
 -  gem 'capybara-screenshot', '~> 1.0.26' # rubocop:todo Gemfile/MissingFeatureCategory
 -  gem 'selenium-webdriver', '~> 4.21', '>= 4.21.1' # rubocop:todo Gemfile/MissingFeatureCategory
 -
 -  gem 'graphlyte', '~> 1.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
 -
 -  gem 'shoulda-matchers', '~> 5.1.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 -  gem 'email_spec', '~> 2.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
 -  gem 'webmock', '~> 3.23.0', feature_category: :shared
 -  gem 'rails-controller-testing' # rubocop:todo Gemfile/MissingFeatureCategory
 -  gem 'concurrent-ruby', '~> 1.1' # rubocop:todo Gemfile/MissingFeatureCategory
 -  gem 'test-prof', '~> 1.3.3', feature_category: :tooling
 -  gem 'rspec_junit_formatter' # rubocop:todo Gemfile/MissingFeatureCategory
 -  gem 'guard-rspec' # rubocop:todo Gemfile/MissingFeatureCategory
 -  gem 'axe-core-rspec', '~> 4.9.0', feature_category: :tooling
 -
 -  # Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
 -  gem 'derailed_benchmarks', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 -
--  gem 'gitlab_quality-test_tooling', '~> 1.28.0', require: false, feature_category: :tooling
+-  gem 'gitlab_quality-test_tooling', '~> 1.33.0', require: false, feature_category: :tooling
 -end
 -
- gem 'octokit', '~> 8.1', feature_category: :importers
+ gem 'octokit', '~> 9.0', feature_category: :importers
+ # Needed by octokit: https://github.com/octokit/octokit.rb/pull/1688
+ gem 'faraday-multipart', '~> 1.0', feature_category: :importers
+@@ -632,7 +516,7 @@ gem 'kas-grpc', '~> 0.6.0', feature_category: :deploym
+ # https://gitlab.com/gitlab-org/gitlab/-/issues/473169#note_2028352939
+ # Or we can upgrade to a more recent version as long as we can confirm
+ # that it doesn't have the same issues.
+-gem 'grpc', '= 1.63.0', feature_category: :shared
++gem 'grpc', '~> 1.63', feature_category: :shared
  
- gem 'gitlab-mail_room', '~> 0.0.24', require: 'mail_room', feature_category: :shared
-@@ -594,7 +478,7 @@ gem 'spamcheck', '~> 1.3.0' # rubocop:todo Gemfile/Mis
- gem 'spamcheck', '~> 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
+ gem 'google-protobuf', '~> 3.25', '>= 3.25.3' # rubocop:todo Gemfile/MissingFeatureCategory
  
- # Gitaly GRPC protocol definitions
--gem 'gitaly', '~> 17.0.1', feature_category: :gitaly
-+gem 'gitaly', '~> 17.1', feature_category: :gitaly
- 
- # KAS GRPC protocol definitions
- gem 'kas-grpc', '~> 0.5.0', feature_category: :deployment_management
-@@ -620,7 +504,7 @@ gem 'gitlab-net-dns', '~> 0.9.2' # rubocop:todo Gemfil
+@@ -653,7 +537,7 @@ gem 'gitlab-net-dns', '~> 0.9.2' # rubocop:todo Gemfil
  gem 'gitlab-net-dns', '~> 0.9.2' # rubocop:todo Gemfile/MissingFeatureCategory
  
  # Countries list
 -gem 'countries', '~> 4.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
 +gem 'countries', '~> 4.0' # rubocop:todo Gemfile/MissingFeatureCategory
  
  gem 'retriable', '~> 3.1.2' # rubocop:todo Gemfile/MissingFeatureCategory
  
-@@ -686,6 +570,7 @@ gem 'telesignenterprise', '~> 2.2' # rubocop:todo Gemf
- gem 'telesignenterprise', '~> 2.2' # rubocop:todo Gemfile/MissingFeatureCategory
- 
- # BufferedIO patch
-+
- # Updating this version will require updating scripts/allowed_warnings.txt
- gem 'net-protocol', '~> 0.1.3' # rubocop:todo Gemfile/MissingFeatureCategory
- 
-@@ -694,5 +579,11 @@ gem 'duo_api', '~> 1.3' # rubocop:todo Gemfile/Missing
+@@ -727,6 +611,11 @@ gem 'duo_api', '~> 1.3' # rubocop:todo Gemfile/Missing
  gem 'net-http', '= 0.4.1', feature_category: :shared
  
  gem 'duo_api', '~> 1.3' # rubocop:todo Gemfile/MissingFeatureCategory
 +
 +gem 'parser'
 +gem 'net-smtp'
 +gem 'net-pop'
 +gem 'psych', '~> 3.1'
-+
  
  gem 'gitlab-sdk', '~> 0.3.0', feature_category: :application_instrumentation
+ 
diff --git a/www/gitlab/files/patch-config_gitlab.yml.example b/www/gitlab/files/patch-config_gitlab.yml.example
index 12cde10c5a15..703bd471d6d0 100644
--- a/www/gitlab/files/patch-config_gitlab.yml.example
+++ b/www/gitlab/files/patch-config_gitlab.yml.example
@@ -1,132 +1,132 @@
---- config/gitlab.yml.example.orig	2024-06-19 08:46:16 UTC
+--- config/gitlab.yml.example.orig	2024-08-20 19:36:17 UTC
 +++ config/gitlab.yml.example
-@@ -472,7 +472,7 @@ production: &base
+@@ -473,7 +473,7 @@ production: &base
    ## GitLab Pages
    pages:
      enabled: false
 -    access_control: false
 +    access_control: true
      # The location where pages are stored (default: shared/pages).
      # path: shared/pages
  
-@@ -482,9 +482,9 @@ production: &base
+@@ -483,9 +483,9 @@ production: &base
      host: example.com
      port: 80 # Set to 443 if you serve the pages with HTTPS
      https: false # Set to true if you serve the pages with HTTPS
 -    artifacts_server: true # Set to false if you want to disable online view of HTML artifacts
 -    # external_http: ["1.1.1.1:80", "[2001::1]:80"] # If defined, enables custom domain support in GitLab Pages
 -    # external_https: ["1.1.1.1:443", "[2001::1]:443"] # If defined, enables custom domain and certificate support in GitLab Pages
 +    artifacts_server: false # Set to false if you want to disable online view of HTML artifacts
 +    external_http: ["127.0.0.1:8090"] # If defined, enables custom domain support in GitLab Pages
 +    # external_https: ["127.0.0.1:8090"] # If defined, enables custom domain and certificate support in GitLab Pages
  
      # File that contains the shared secret key for verifying access for gitlab-pages.
      # Default is '.gitlab_pages_secret' relative to Rails.root (i.e. root of the GitLab app).
-@@ -1209,13 +1209,13 @@ production: &base
+@@ -1214,13 +1214,13 @@ production: &base
    repositories:
      storages: # You must have at least a `default` storage path.
        default:
 -        gitaly_address: unix:/home/git/gitlab/tmp/sockets/private/gitaly.socket # TCP connections are supported too (e.g. tcp://host:port). TLS connections are also supported using the system certificate pool (eg: tls://host:port).
 +        gitaly_address: unix:%%WWWDIR%%/tmp/sockets/private/gitaly.socket # TCP connections are supported too (e.g. tcp://host:port). TLS connections are also supported using the system certificate pool (eg: tls://host:port).
          # gitaly_token: 'special token' # Optional: override global gitaly.token for this storage.
  
    ## Backup settings
    backup:
      path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
 -    # gitaly_backup_path: /home/git/gitaly/_build/bin/gitaly-backup # Path of the gitaly-backup binary (default: searches $PATH)
 +    gitaly_backup_path: %%PREFIX%%/share/gitaly/bin/gitaly-backup # Path of the gitaly-backup binary (default: searches $PATH)
      # archive_permissions: 0640 # Permissions for the resulting backup.tar file (default: 0600)
      # keep_time: 604800   # default: 0 (forever) (in seconds)
      # pg_schema: public     # default: nil, it means that all schemas will be backed up
-@@ -1250,12 +1250,12 @@ production: &base
+@@ -1255,12 +1255,12 @@ production: &base
  
    ## GitLab Shell settings
    gitlab_shell:
 -    path: /home/git/gitlab-shell/
 -    authorized_keys_file: /home/git/.ssh/authorized_keys
 +    path: %%PREFIX%%/share/gitlab-shell/
 +    authorized_keys_file: %%PREFIX%%/git/.ssh/authorized_keys
  
      # File that contains the secret key for verifying access for gitlab-shell.
      # Default is '.gitlab_shell_secret' relative to Rails.root (i.e. root of the GitLab app).
 -    # secret_file: /home/git/gitlab/.gitlab_shell_secret
 +    # secret_file: %%WWWDIR%%/.gitlab_shell_secret
  
      # Git over HTTP
      upload_pack: true
-@@ -1270,7 +1270,7 @@ production: &base
+@@ -1275,7 +1275,7 @@ production: &base
    workhorse:
      # File that contains the secret key for verifying access for gitlab-workhorse.
      # Default is '.gitlab_workhorse_secret' relative to Rails.root (i.e. root of the GitLab app).
 -    # secret_file: /home/git/gitlab/.gitlab_workhorse_secret
 +    # secret_file: %%WWWDIR%%/.gitlab_workhorse_secret
  
    topology_service:
      # enabled: false
-@@ -1286,7 +1286,7 @@ production: &base
+@@ -1291,7 +1291,7 @@ production: &base
      # enabled: true
      # File that contains the secret key for verifying access for gitlab-kas.
      # Default is '.gitlab_kas_secret' relative to Rails.root (i.e. root of the GitLab app).
 -    # secret_file: /home/git/gitlab/.gitlab_kas_secret
 +    # secret_file: %%WWWDIR%%/.gitlab_kas_secret
  
      # The URL to the external KAS API (used by the Kubernetes agents)
      # external_url: wss://kas.example.com
-@@ -1310,13 +1310,13 @@ production: &base
+@@ -1315,13 +1315,13 @@ production: &base
  
    ## GitLab Elasticsearch settings
    elasticsearch:
 -    indexer_path: /home/git/gitlab-elasticsearch-indexer/
 +    indexer_path: %%PREFIX%%/bin/
  
    ## Git settings
    # CAUTION!
    # Use the default values unless you really know what you are doing
    git:
 -    bin_path: /usr/bin/git
 +    bin_path: %%PREFIX%%/bin/git
  
    ## Webpack settings
    # If enabled, this will tell rails to serve frontend assets from the webpack-dev-server running
-@@ -1337,18 +1337,18 @@ production: &base
+@@ -1342,18 +1342,18 @@ production: &base
  
      # Sidekiq exporter is a dedicated Prometheus metrics server optionally running alongside Sidekiq.
      sidekiq_exporter:
 -    #  enabled: true
 -    #  log_enabled: false
 -    #  address: localhost
 -    #  port: 8082
 +      enabled: true
 +      log_enabled: false
 +      address: localhost
 +      port: 8082
      #  tls_enabled: false
      #  tls_cert_path: /path/to/cert.pem
      #  tls_key_path: /path/to/key.pem
  
      sidekiq_health_checks:
 -    #  enabled: true
 -    #  address: localhost
 -    #  port: 8092
 +      enabled: true
 +      address: localhost
 +      port: 8092
  
      # Web exporter is a dedicated Prometheus metrics server optionally running alongside Puma.
      web_exporter:
-@@ -1575,13 +1575,13 @@ test:
+@@ -1580,13 +1580,13 @@ test:
          gitaly_address: unix:tmp/tests/gitaly/praefect.socket
  
    gitaly:
 -    client_path: tmp/tests/gitaly/_build/bin
 +    client_path: %%PREFIX%%/share/gitaly/bin
      token: secret
    workhorse:
      secret_file: tmp/gitlab_workhorse_test_secret
    backup:
      path: tmp/tests/backups
 -    gitaly_backup_path: tmp/tests/gitaly/_build/bin/gitaly-backup
 +    gitaly_backup_path: %%PREFIX%%/share/gitaly/bin/gitaly-backup
    gitlab_shell:
      path: tmp/tests/gitlab-shell/
      authorized_keys_file: tmp/tests/authorized_keys
diff --git a/www/gitlab/files/patch-config_initializers_1__settings.rb b/www/gitlab/files/patch-config_initializers_1__settings.rb
index 34b11f279c55..67d12e5c5767 100644
--- a/www/gitlab/files/patch-config_initializers_1__settings.rb
+++ b/www/gitlab/files/patch-config_initializers_1__settings.rb
@@ -1,15 +1,15 @@
---- config/initializers/1_settings.rb.orig	2024-06-19 08:46:16 UTC
+--- config/initializers/1_settings.rb.orig	2024-08-20 19:36:17 UTC
 +++ config/initializers/1_settings.rb
-@@ -209,11 +209,7 @@ Settings.gitlab['ssh_user'] ||= Settings.gitlab.user
+@@ -210,11 +210,7 @@ Settings.gitlab['ssh_user'] ||= Settings.gitlab.user
  Settings.gitlab['user'] ||= 'git'
  # External configuration may cause the ssh user to differ from the GitLab user
  Settings.gitlab['ssh_user'] ||= Settings.gitlab.user
 -Settings.gitlab['user_home'] ||= begin
 -  Etc.getpwnam(Settings.gitlab['user']).dir
 -rescue ArgumentError # no user configured
 -  '/home/' + Settings.gitlab['user']
 -end
 +Settings.gitlab['user_home'] ||= '/usr/local/git'
  Settings.gitlab['time_zone'] ||= nil
  Settings.gitlab['signup_enabled'] ||= true if Settings.gitlab['signup_enabled'].nil?
  Settings.gitlab['signin_enabled'] ||= true if Settings.gitlab['signin_enabled'].nil?
diff --git a/www/gitlab/files/patch-gems_gitlab-backup-cli_gitlab-backup-cli.gemspec b/www/gitlab/files/patch-gems_gitlab-backup-cli_gitlab-backup-cli.gemspec
new file mode 100644
index 000000000000..fdb8c56e19ee
--- /dev/null
+++ b/www/gitlab/files/patch-gems_gitlab-backup-cli_gitlab-backup-cli.gemspec
@@ -0,0 +1,11 @@
+--- gems/gitlab-backup-cli/gitlab-backup-cli.gemspec.orig	2024-08-27 06:12:18 UTC
++++ gems/gitlab-backup-cli/gitlab-backup-cli.gemspec
+@@ -25,7 +25,7 @@ Gem::Specification.new do |spec|
+   spec.require_paths = ["lib"]
+ 
+   spec.add_dependency "activesupport", "< 7.2"
+-  spec.add_dependency "googleauth", "~> 1.8.1" # https://gitlab.com/gitlab-org/gitlab/-/issues/449019
++  spec.add_dependency "googleauth", "~> 1.8" # https://gitlab.com/gitlab-org/gitlab/-/issues/449019
+   spec.add_dependency "google-cloud-storage_transfer", "~> 1.2.0"
+   spec.add_dependency "rainbow", "~> 3.0"
+   spec.add_dependency "thor", "~> 1.3"
diff --git a/www/gitlab/pkg-message b/www/gitlab/pkg-message
index ebc8c580b627..ff008ee4e4fa 100644
--- a/www/gitlab/pkg-message
+++ b/www/gitlab/pkg-message
@@ -1,33 +1,33 @@
 [
 {
   message: <<EOM
 Gitlab was installed successfully.
 
 You now need to set up the various components of Gitlab, so please
 follow the instructions in the guide at:
 
-https://gitlab.com/mfechner/freebsd-gitlab-docu/blob/master/install/17.1-freebsd.md
+https://gitlab.com/mfechner/freebsd-gitlab-docu/blob/master/install/17.3-freebsd.md
 EOM
   type: install
 }
 {
   message: "!! WARNING: Please make sure you read in UPDATING entry 20190423 !!"
   maximum_version: "11.9.7"
   type: upgrade
 }
 {
   message: <<EOM
 If you just installed an major upgrade of GitLab, for example you
 switched from 14.5.x to 14.6.x, please follow the instructions in the guide at:
 
-https://gitlab.com/mfechner/freebsd-gitlab-docu/blob/master/update/17.0-17.1-freebsd.md
+https://gitlab.com/mfechner/freebsd-gitlab-docu/blob/master/update/17.1-17.3-freebsd.md
 
 If you just installed an minor upgrade of GitLab please follow
 the instructions in the guide at:
 
 https://gitlab.com/mfechner/freebsd-gitlab-docu/blob/master/update/freebsd_patch_versions.md
 EOM
   type: upgrade
 }
 ]