Merge "Clear up syntax for command reference files"
diff --git a/BUILD b/BUILD
index 4bba5a5..d924417 100644
--- a/BUILD
+++ b/BUILD
@@ -2,6 +2,10 @@
 
 load("//tools/bzl:genrule2.bzl", "genrule2")
 load("//tools/bzl:pkg_war.bzl", "pkg_war")
+load(
+    "@bazel_tools//tools/jdk:default_java_toolchain.bzl",
+    "default_java_toolchain",
+)
 
 config_setting(
     name = "java9",
@@ -10,6 +14,43 @@
     },
 )
 
+config_setting(
+    name = "java10",
+    values = {
+        "java_toolchain": ":toolchain_vanilla",
+    },
+)
+
+# TODO(davido): Switch to consuming it from @bazel_tool//tools/jdk:absolute_javabase
+# when new Bazel version is released with this change included:
+# https://github.com/bazelbuild/bazel/issues/6012
+# https://github.com/bazelbuild/bazel/commit/0173bdbf7bdd1874379d4dd3eb70d5321e0f1816
+# As the interim use a hack that works around it by putting the variable reference
+# behind a select
+config_setting(
+    name = "use_absolute_javabase",
+    values = {"define": "USE_ABSOLUTE_JAVABASE=true"},
+)
+
+java_runtime(
+    name = "absolute_javabase",
+    java_home = select({
+        ":use_absolute_javabase": "$(ABSOLUTE_JAVABASE)",
+        "//conditions:default": "",
+    }),
+    visibility = ["//visibility:public"],
+)
+
+# TODO(davido): Switch to consuming it from @bazel_tool//tools/jdk:toolchain_vanilla
+# when my change is included in released Bazel version:
+# https://github.com/bazelbuild/bazel/commit/0bef68e054eccecd690e5d9f46db8a0c4b2d887a
+default_java_toolchain(
+    name = "toolchain_vanilla",
+    forcibly_disable_header_compilation = True,
+    javabuilder = ["@bazel_tools//tools/jdk:VanillaJavaBuilder_deploy.jar"],
+    jvm_opts = [],
+)
+
 genrule(
     name = "gen_version",
     outs = ["version.txt"],
diff --git a/Documentation/config-gerrit.txt b/Documentation/config-gerrit.txt
index 734397e..f27434e 100644
--- a/Documentation/config-gerrit.txt
+++ b/Documentation/config-gerrit.txt
@@ -3684,6 +3684,9 @@
 BLOCK rules).
 +
 Default is false.
++
+This value supports configuration reloads:
+link:cmd-reload-config.html[reload-config]
 
 [[receive.checkReferencedObjectsAreReachable]]receive.checkReferencedObjectsAreReachable::
 +
diff --git a/Documentation/dev-bazel.txt b/Documentation/dev-bazel.txt
index 6331581..0ecc820 100644
--- a/Documentation/dev-bazel.txt
+++ b/Documentation/dev-bazel.txt
@@ -6,7 +6,7 @@
 To build Gerrit from source, you need:
 
 * A Linux or macOS system (Windows is not supported at this time)
-* A JDK for Java 8
+* A JDK for Java 8|9|10
 * Python 2 or 3
 * Node.js
 * link:https://www.bazel.io/versions/master/docs/install.html[Bazel]
@@ -14,6 +14,30 @@
 * zip, unzip
 * gcc
 
+[[Java 10 support]]
+Java 10 is supported through vanilla java toolchain
+link:https://docs.bazel.build/versions/master/toolchains.html[Bazel option].
+To build Gerrit with Java 10, specify vanilla java toolchain and provide
+path to Java 10 home:
+
+```
+  $ bazel build --host_javabase=:absolute_javabase \
+    --define=ABSOLUTE_JAVABASE=<path-to-java-10> \
+    --define=USE_ABSOLUTE_JAVABASE=true \
+    --host_java_toolchain=//:toolchain_vanilla \
+    --java_toolchain=//:toolchain_vanilla \
+    :release
+```
+
+Note that the following options must be added to `container.javaOptions`
+in `$gerrit_site/etc/gerrit.config` to run Gerrit with Java 10:
+
+```
+[container]
+  javaOptions = --add-modules java.activation
+  javaOptions = --add-opens=jdk.management/com.sun.management.internal=ALL-UNNAMED
+```
+
 [[Java 9 support]]
 Java 9 is supported through alternative java toolchain
 link:https://docs.bazel.build/versions/master/toolchains.html[Bazel option].
diff --git a/Documentation/metrics.txt b/Documentation/metrics.txt
index 19d3b41..2647b35 100644
--- a/Documentation/metrics.txt
+++ b/Documentation/metrics.txt
@@ -138,6 +138,13 @@
 * `notedb/read_all_external_ids_latency`: Latency for reading all
 external ID's from NoteDb.
 
+=== Permissions
+
+* `permissions/project_state/computation_latency`: Latency to compute current access
+sections on a project by traversing it's parents.
+* `permissions/permission_collection/filter_latency`: Latency to filter access sections
+by user and ref.
+
 === Reviewer Suggestion
 
 * `reviewer_suggestion/query_accounts`: Latency for querying accounts for
diff --git a/WORKSPACE b/WORKSPACE
index ebd501b..22dffd5 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -329,8 +329,8 @@
 
 maven_jar(
     name = "args4j-intern",
-    artifact = "args4j:args4j:2.0.29",
-    sha1 = "55ca4ddc4e906ffbaec043113b36bb410a3d909e",
+    artifact = "args4j:args4j:2.33",
+    sha1 = "bd87a75374a6d6523de82fef51fc3cfe9baf9fc9",
 )
 
 maven_jar(
@@ -636,36 +636,36 @@
     sha1 = "05b6f921f1810bdf90e25471968f741f87168b64",
 )
 
-LUCENE_VERS = "5.5.4"
+LUCENE_VERS = "6.6.5"
 
 maven_jar(
     name = "lucene-core",
     artifact = "org.apache.lucene:lucene-core:" + LUCENE_VERS,
-    sha1 = "ab9c77e75cf142aa6e284b310c8395617bd9b19b",
+    sha1 = "2983f80b1037e098209657b0ca9176827892d0c0",
 )
 
 maven_jar(
     name = "lucene-analyzers-common",
     artifact = "org.apache.lucene:lucene-analyzers-common:" + LUCENE_VERS,
-    sha1 = "08ce9d34c8124c80e176e8332ee947480bbb9576",
+    sha1 = "6094f91071d90570b7f5f8ce481d5de7d2d2e9d5",
 )
 
 maven_jar(
     name = "backward-codecs",
     artifact = "org.apache.lucene:lucene-backward-codecs:" + LUCENE_VERS,
-    sha1 = "a933f42e758c54c43083398127ea7342b54d8212",
+    sha1 = "460a19e8d1aa7d31e9614cf528a6cb508c9e823d",
 )
 
 maven_jar(
     name = "lucene-misc",
     artifact = "org.apache.lucene:lucene-misc:" + LUCENE_VERS,
-    sha1 = "a74388857f73614e528ae44d742c60187cb55a5a",
+    sha1 = "ce3a1b7b6a92b9af30791356a4bd46d1cea6cc1e",
 )
 
 maven_jar(
     name = "lucene-queryparser",
     artifact = "org.apache.lucene:lucene-queryparser:" + LUCENE_VERS,
-    sha1 = "8a06fad4675473d98d93b61fea529e3f464bf69e",
+    sha1 = "2db9ca0086a4b8e0b9bc9f08a9b420303168e37c",
 )
 
 maven_jar(
@@ -777,13 +777,10 @@
     sha1 = "d0c46320fbc07be3a24eb13a56cee4e3d38e0c75",
 )
 
-# TODO(davido): Remove exlusion of file system provider, when this issue is fixed:
-# https://issues.apache.org/jira/browse/SSHD-736
 maven_jar(
     name = "sshd",
-    artifact = "org.apache.sshd:sshd-core:1.7.0",
-    exclude = ["META-INF/services/java.nio.file.spi.FileSystemProvider"],
-    sha1 = "2e8b14f6d841b098e46bf407b6fdccab4c19fa41",
+    artifact = "org.apache.sshd:sshd-core:2.0.0",
+    sha1 = "f4275079a2463cfd2bf1548a80e1683288a8e86b",
 )
 
 maven_jar(
@@ -794,8 +791,14 @@
 
 maven_jar(
     name = "mina-core",
-    artifact = "org.apache.mina:mina-core:2.0.16",
-    sha1 = "f720f17643eaa7b0fec07c1d7f6272972c02bba4",
+    artifact = "org.apache.mina:mina-core:2.0.17",
+    sha1 = "7e10ec974760436d931f3e58be507d1957bcc8db",
+)
+
+maven_jar(
+    name = "sshd-mina",
+    artifact = "org.apache.sshd:sshd-mina:2.0.0",
+    sha1 = "50f2669312494f6c1996d8bd0d266c1fca7be6f6",
 )
 
 maven_jar(
diff --git a/java/com/google/gerrit/acceptance/AbstractDaemonTest.java b/java/com/google/gerrit/acceptance/AbstractDaemonTest.java
index 69d603f..bd7d65d 100644
--- a/java/com/google/gerrit/acceptance/AbstractDaemonTest.java
+++ b/java/com/google/gerrit/acceptance/AbstractDaemonTest.java
@@ -714,7 +714,7 @@
       throws Exception {
     assertThat(topic).isNotEmpty();
     return createCommitAndPush(
-        repo, "refs/for/master/" + name(topic), commitMsg, fileName, content);
+        repo, "refs/for/master%topic=" + name(topic), commitMsg, fileName, content);
   }
 
   protected PushOneCommit.Result createChange(String subject, String fileName, String content)
@@ -733,7 +733,7 @@
       String topic)
       throws Exception {
     PushOneCommit push = pushFactory.create(db, admin.getIdent(), repo, subject, fileName, content);
-    return push.to("refs/for/" + branch + "/" + name(topic));
+    return push.to("refs/for/" + branch + "%topic=" + name(topic));
   }
 
   protected BranchApi createBranch(Branch.NameKey branch) throws Exception {
diff --git a/java/com/google/gerrit/acceptance/InMemoryTestingDatabaseModule.java b/java/com/google/gerrit/acceptance/InMemoryTestingDatabaseModule.java
index 83a3874..b23b6e6 100644
--- a/java/com/google/gerrit/acceptance/InMemoryTestingDatabaseModule.java
+++ b/java/com/google/gerrit/acceptance/InMemoryTestingDatabaseModule.java
@@ -44,16 +44,12 @@
 import com.google.gwtorm.server.SchemaFactory;
 import com.google.inject.Inject;
 import com.google.inject.Key;
-import com.google.inject.Provides;
 import com.google.inject.ProvisionException;
-import com.google.inject.Singleton;
 import com.google.inject.TypeLiteral;
 import com.google.inject.util.Providers;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import org.apache.sshd.common.keyprovider.KeyPairProvider;
-import org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider;
 import org.eclipse.jgit.lib.Config;
 
 class InMemoryTestingDatabaseModule extends LifecycleModule {
@@ -107,23 +103,8 @@
 
     install(new SchemaModule());
     bind(SchemaVersion.class).to(SchemaVersion.C);
-  }
 
-  @Provides
-  @Singleton
-  KeyPairProvider createHostKey() {
-    return getHostKeys();
-  }
-
-  private static SimpleGeneratorHostKeyProvider keys;
-
-  private static synchronized KeyPairProvider getHostKeys() {
-    if (keys == null) {
-      keys = new SimpleGeneratorHostKeyProvider();
-      keys.setAlgorithm("RSA");
-      keys.loadKeys();
-    }
-    return keys;
+    install(new SshdModule());
   }
 
   static class CreateDatabase implements LifecycleListener {
diff --git a/java/com/google/gerrit/acceptance/SshdModule.java b/java/com/google/gerrit/acceptance/SshdModule.java
new file mode 100644
index 0000000..185d6e2
--- /dev/null
+++ b/java/com/google/gerrit/acceptance/SshdModule.java
@@ -0,0 +1,41 @@
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.acceptance;
+
+import com.google.inject.AbstractModule;
+import com.google.inject.Provides;
+import com.google.inject.Singleton;
+import org.apache.sshd.common.keyprovider.KeyPairProvider;
+import org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider;
+
+public class SshdModule extends AbstractModule {
+
+  @Provides
+  @Singleton
+  KeyPairProvider createHostKey() {
+    return getHostKeys();
+  }
+
+  private static SimpleGeneratorHostKeyProvider keys;
+
+  private static synchronized KeyPairProvider getHostKeys() {
+    if (keys == null) {
+      keys = new SimpleGeneratorHostKeyProvider();
+      keys.setAlgorithm("RSA");
+      keys.loadKeys();
+    }
+    return keys;
+  }
+}
diff --git a/java/com/google/gerrit/asciidoctor/DocIndexer.java b/java/com/google/gerrit/asciidoctor/DocIndexer.java
index ef3ea3f..9517811 100644
--- a/java/com/google/gerrit/asciidoctor/DocIndexer.java
+++ b/java/com/google/gerrit/asciidoctor/DocIndexer.java
@@ -33,8 +33,8 @@
 import java.util.regex.Pattern;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
+import org.apache.lucene.analysis.CharArraySet;
 import org.apache.lucene.analysis.standard.StandardAnalyzer;
-import org.apache.lucene.analysis.util.CharArraySet;
 import org.apache.lucene.document.Document;
 import org.apache.lucene.document.Field;
 import org.apache.lucene.document.StringField;
diff --git a/java/com/google/gerrit/index/project/ProjectSchemaDefinitions.java b/java/com/google/gerrit/index/project/ProjectSchemaDefinitions.java
index 07b5adb..6229041 100644
--- a/java/com/google/gerrit/index/project/ProjectSchemaDefinitions.java
+++ b/java/com/google/gerrit/index/project/ProjectSchemaDefinitions.java
@@ -30,8 +30,12 @@
           ProjectField.NAME_PART,
           ProjectField.ANCESTOR_NAME);
 
+  @Deprecated
   static final Schema<ProjectData> V2 = schema(V1, ProjectField.STATE, ProjectField.REF_STATE);
 
+  // Bump Lucene version requires reindexing
+  static final Schema<ProjectData> V3 = schema(V2);
+
   public static final ProjectSchemaDefinitions INSTANCE = new ProjectSchemaDefinitions();
 
   private ProjectSchemaDefinitions() {
diff --git a/java/com/google/gerrit/lucene/AbstractLuceneIndex.java b/java/com/google/gerrit/lucene/AbstractLuceneIndex.java
index dc293cd..40acf80 100644
--- a/java/com/google/gerrit/lucene/AbstractLuceneIndex.java
+++ b/java/com/google/gerrit/lucene/AbstractLuceneIndex.java
@@ -64,15 +64,14 @@
 import org.apache.lucene.document.Document;
 import org.apache.lucene.document.Field;
 import org.apache.lucene.document.Field.Store;
-import org.apache.lucene.document.IntField;
-import org.apache.lucene.document.LongField;
+import org.apache.lucene.document.LegacyIntField;
+import org.apache.lucene.document.LegacyLongField;
 import org.apache.lucene.document.StoredField;
 import org.apache.lucene.document.StringField;
 import org.apache.lucene.document.TextField;
 import org.apache.lucene.index.IndexWriter;
 import org.apache.lucene.index.IndexableField;
 import org.apache.lucene.index.Term;
-import org.apache.lucene.index.TrackingIndexWriter;
 import org.apache.lucene.search.ControlledRealTimeReopenThread;
 import org.apache.lucene.search.IndexSearcher;
 import org.apache.lucene.search.Query;
@@ -86,6 +85,7 @@
 import org.apache.lucene.store.Directory;
 
 /** Basic Lucene index implementation. */
+@SuppressWarnings("deprecation")
 public abstract class AbstractLuceneIndex<K, V> implements Index<K, V> {
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
@@ -98,7 +98,7 @@
   private final Directory dir;
   private final String name;
   private final ListeningExecutorService writerThread;
-  private final TrackingIndexWriter writer;
+  private final IndexWriter writer;
   private final ReferenceManager<IndexSearcher> searcherManager;
   private final ControlledRealTimeReopenThread<IndexSearcher> reopenThread;
   private final Set<NrtFuture> notDoneNrtFutures;
@@ -118,17 +118,16 @@
     this.dir = dir;
     this.name = name;
     String index = Joiner.on('_').skipNulls().join(name, subIndex);
-    IndexWriter delegateWriter;
     long commitPeriod = writerConfig.getCommitWithinMs();
 
     if (commitPeriod < 0) {
-      delegateWriter = new AutoCommitWriter(dir, writerConfig.getLuceneConfig());
+      writer = new AutoCommitWriter(dir, writerConfig.getLuceneConfig());
     } else if (commitPeriod == 0) {
-      delegateWriter = new AutoCommitWriter(dir, writerConfig.getLuceneConfig(), true);
+      writer = new AutoCommitWriter(dir, writerConfig.getLuceneConfig(), true);
     } else {
       final AutoCommitWriter autoCommitWriter =
           new AutoCommitWriter(dir, writerConfig.getLuceneConfig());
-      delegateWriter = autoCommitWriter;
+      writer = autoCommitWriter;
 
       autoCommitExecutor =
           new LoggingContextAwareScheduledExecutorService(
@@ -165,8 +164,7 @@
               commitPeriod,
               MILLISECONDS);
     }
-    writer = new TrackingIndexWriter(delegateWriter);
-    searcherManager = new WrappableSearcherManager(writer.getIndexWriter(), true, searcherFactory);
+    searcherManager = new WrappableSearcherManager(writer, true, searcherFactory);
 
     notDoneNrtFutures = Sets.newConcurrentHashSet();
 
@@ -251,7 +249,7 @@
     }
 
     try {
-      writer.getIndexWriter().close();
+      writer.close();
     } catch (AlreadyClosedException e) {
       // Ignore.
     } catch (IOException e) {
@@ -294,7 +292,7 @@
     writer.deleteAll();
   }
 
-  public TrackingIndexWriter getWriter() {
+  public IndexWriter getWriter() {
     return writer;
   }
 
@@ -325,15 +323,15 @@
 
     if (type == FieldType.INTEGER || type == FieldType.INTEGER_RANGE) {
       for (Object value : values.getValues()) {
-        doc.add(new IntField(name, (Integer) value, store));
+        doc.add(new LegacyIntField(name, (Integer) value, store));
       }
     } else if (type == FieldType.LONG) {
       for (Object value : values.getValues()) {
-        doc.add(new LongField(name, (Long) value, store));
+        doc.add(new LegacyLongField(name, (Long) value, store));
       }
     } else if (type == FieldType.TIMESTAMP) {
       for (Object value : values.getValues()) {
-        doc.add(new LongField(name, ((Timestamp) value).getTime(), store));
+        doc.add(new LegacyLongField(name, ((Timestamp) value).getTime(), store));
       }
     } else if (type == FieldType.EXACT || type == FieldType.PREFIX) {
       for (Object value : values.getValues()) {
diff --git a/java/com/google/gerrit/lucene/AutoCommitWriter.java b/java/com/google/gerrit/lucene/AutoCommitWriter.java
index 7a418aa..2cc7563 100644
--- a/java/com/google/gerrit/lucene/AutoCommitWriter.java
+++ b/java/com/google/gerrit/lucene/AutoCommitWriter.java
@@ -47,58 +47,64 @@
   }
 
   @Override
-  public void addDocument(Iterable<? extends IndexableField> doc) throws IOException {
-    super.addDocument(doc);
+  public long addDocument(Iterable<? extends IndexableField> doc) throws IOException {
+    long ret = super.addDocument(doc);
     autoFlush();
+    return ret;
   }
 
   @Override
-  public void addDocuments(Iterable<? extends Iterable<? extends IndexableField>> docs)
+  public long addDocuments(Iterable<? extends Iterable<? extends IndexableField>> docs)
       throws IOException {
-    super.addDocuments(docs);
+    long ret = super.addDocuments(docs);
     autoFlush();
+    return ret;
   }
 
   @Override
-  public void updateDocuments(
+  public long updateDocuments(
       Term delTerm, Iterable<? extends Iterable<? extends IndexableField>> docs)
       throws IOException {
-    super.updateDocuments(delTerm, docs);
+    long ret = super.updateDocuments(delTerm, docs);
     autoFlush();
+    return ret;
   }
 
   @Override
-  public void deleteDocuments(Term... term) throws IOException {
-    super.deleteDocuments(term);
+  public long deleteDocuments(Term... term) throws IOException {
+    long ret = super.deleteDocuments(term);
     autoFlush();
+    return ret;
   }
 
   @Override
-  public synchronized boolean tryDeleteDocument(IndexReader readerIn, int docID)
-      throws IOException {
-    boolean ret = super.tryDeleteDocument(readerIn, docID);
-    if (ret) {
+  public synchronized long tryDeleteDocument(IndexReader readerIn, int docID) throws IOException {
+    long ret = super.tryDeleteDocument(readerIn, docID);
+    if (ret != -1) {
       autoFlush();
     }
     return ret;
   }
 
   @Override
-  public void deleteDocuments(Query... queries) throws IOException {
-    super.deleteDocuments(queries);
+  public long deleteDocuments(Query... queries) throws IOException {
+    long ret = super.deleteDocuments(queries);
     autoFlush();
+    return ret;
   }
 
   @Override
-  public void updateDocument(Term term, Iterable<? extends IndexableField> doc) throws IOException {
-    super.updateDocument(term, doc);
+  public long updateDocument(Term term, Iterable<? extends IndexableField> doc) throws IOException {
+    long ret = super.updateDocument(term, doc);
     autoFlush();
+    return ret;
   }
 
   @Override
-  public void deleteAll() throws IOException {
-    super.deleteAll();
+  public long deleteAll() throws IOException {
+    long ret = super.deleteAll();
     autoFlush();
+    return ret;
   }
 
   void manualFlush() throws IOException {
diff --git a/java/com/google/gerrit/lucene/GerritIndexWriterConfig.java b/java/com/google/gerrit/lucene/GerritIndexWriterConfig.java
index ada3220..75e03e3 100644
--- a/java/com/google/gerrit/lucene/GerritIndexWriterConfig.java
+++ b/java/com/google/gerrit/lucene/GerritIndexWriterConfig.java
@@ -19,8 +19,8 @@
 
 import com.google.common.collect.ImmutableMap;
 import com.google.gerrit.server.config.ConfigUtil;
+import org.apache.lucene.analysis.CharArraySet;
 import org.apache.lucene.analysis.standard.StandardAnalyzer;
-import org.apache.lucene.analysis.util.CharArraySet;
 import org.apache.lucene.index.IndexWriterConfig;
 import org.apache.lucene.index.IndexWriterConfig.OpenMode;
 import org.eclipse.jgit.lib.Config;
diff --git a/java/com/google/gerrit/lucene/QueryBuilder.java b/java/com/google/gerrit/lucene/QueryBuilder.java
index 6aab7c7..ce5ba98 100644
--- a/java/com/google/gerrit/lucene/QueryBuilder.java
+++ b/java/com/google/gerrit/lucene/QueryBuilder.java
@@ -38,19 +38,20 @@
 import org.apache.lucene.analysis.Analyzer;
 import org.apache.lucene.index.Term;
 import org.apache.lucene.search.BooleanQuery;
+import org.apache.lucene.search.LegacyNumericRangeQuery;
 import org.apache.lucene.search.MatchAllDocsQuery;
-import org.apache.lucene.search.NumericRangeQuery;
 import org.apache.lucene.search.PrefixQuery;
 import org.apache.lucene.search.Query;
 import org.apache.lucene.search.RegexpQuery;
 import org.apache.lucene.search.TermQuery;
 import org.apache.lucene.util.BytesRefBuilder;
-import org.apache.lucene.util.NumericUtils;
+import org.apache.lucene.util.LegacyNumericUtils;
 
+@SuppressWarnings("deprecation")
 public class QueryBuilder<V> {
   static Term intTerm(String name, int value) {
     BytesRefBuilder builder = new BytesRefBuilder();
-    NumericUtils.intToPrefixCoded(value, 0, builder);
+    LegacyNumericUtils.intToPrefixCoded(value, 0, builder);
     return new Term(name, builder.get());
   }
 
@@ -180,7 +181,8 @@
         // Just fall back to a standard integer query.
         return new TermQuery(intTerm(p.getField().getName(), minimum));
       }
-      return NumericRangeQuery.newIntRange(r.getField().getName(), minimum, maximum, true, true);
+      return LegacyNumericRangeQuery.newIntRange(
+          r.getField().getName(), minimum, maximum, true, true);
     }
     throw new QueryParseException("not an integer range: " + p);
   }
@@ -188,7 +190,7 @@
   private Query timestampQuery(IndexPredicate<V> p) throws QueryParseException {
     if (p instanceof TimestampRangePredicate) {
       TimestampRangePredicate<V> r = (TimestampRangePredicate<V>) p;
-      return NumericRangeQuery.newLongRange(
+      return LegacyNumericRangeQuery.newLongRange(
           r.getField().getName(),
           r.getMinTimestamp().getTime(),
           r.getMaxTimestamp().getTime(),
@@ -200,7 +202,7 @@
 
   private Query notTimestamp(TimestampRangePredicate<V> r) throws QueryParseException {
     if (r.getMinTimestamp().getTime() == 0) {
-      return NumericRangeQuery.newLongRange(
+      return LegacyNumericRangeQuery.newLongRange(
           r.getField().getName(), r.getMaxTimestamp().getTime(), null, true, true);
     }
     throw new QueryParseException("cannot negate: " + r);
diff --git a/java/com/google/gerrit/lucene/WrappableSearcherManager.java b/java/com/google/gerrit/lucene/WrappableSearcherManager.java
index f9ecac3..ba8d7da 100644
--- a/java/com/google/gerrit/lucene/WrappableSearcherManager.java
+++ b/java/com/google/gerrit/lucene/WrappableSearcherManager.java
@@ -81,11 +81,17 @@
   WrappableSearcherManager(
       IndexWriter writer, boolean applyAllDeletes, SearcherFactory searcherFactory)
       throws IOException {
+    // TODO(davido): Make it configurable
+    // If true, new deletes will be written down to index files instead of carried over from writer
+    // to reader directly in heap
+    boolean writeAllDeletes = false;
     if (searcherFactory == null) {
       searcherFactory = new SearcherFactory();
     }
     this.searcherFactory = searcherFactory;
-    current = getSearcher(searcherFactory, DirectoryReader.open(writer, applyAllDeletes));
+    current =
+        getSearcher(
+            searcherFactory, DirectoryReader.open(writer, applyAllDeletes, writeAllDeletes));
   }
 
   /**
diff --git a/java/com/google/gerrit/server/config/ConfigUpdatedEvent.java b/java/com/google/gerrit/server/config/ConfigUpdatedEvent.java
index 9bd4533..66d6555 100644
--- a/java/com/google/gerrit/server/config/ConfigUpdatedEvent.java
+++ b/java/com/google/gerrit/server/config/ConfigUpdatedEvent.java
@@ -66,6 +66,10 @@
     return createUpdate(entries, UpdateResult.APPLIED);
   }
 
+  public Update reject(ConfigKey entry) {
+    return reject(Collections.singleton(entry));
+  }
+
   public Update reject(Set<ConfigKey> entries) {
     return createUpdate(entries, UpdateResult.REJECTED);
   }
diff --git a/java/com/google/gerrit/server/documentation/QueryDocumentationExecutor.java b/java/com/google/gerrit/server/documentation/QueryDocumentationExecutor.java
index c606919..66cb380 100644
--- a/java/com/google/gerrit/server/documentation/QueryDocumentationExecutor.java
+++ b/java/com/google/gerrit/server/documentation/QueryDocumentationExecutor.java
@@ -15,12 +15,12 @@
 package com.google.gerrit.server.documentation;
 
 import com.google.common.collect.ImmutableMap;
-import com.google.common.collect.Lists;
 import com.google.common.flogger.FluentLogger;
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 import java.io.IOException;
 import java.io.InputStream;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 import java.util.zip.ZipEntry;
@@ -85,9 +85,9 @@
       // and skipped paging. Maybe add paging later.
       TopDocs results = searcher.search(query, Integer.MAX_VALUE);
       ScoreDoc[] hits = results.scoreDocs;
-      int totalHits = results.totalHits;
+      long totalHits = results.totalHits;
 
-      List<DocResult> out = Lists.newArrayListWithCapacity(totalHits);
+      List<DocResult> out = new ArrayList<>();
       for (int i = 0; i < totalHits; i++) {
         DocResult result = new DocResult();
         Document doc = searcher.doc(hits[i].doc);
diff --git a/java/com/google/gerrit/server/git/receive/ReceiveCommits.java b/java/com/google/gerrit/server/git/receive/ReceiveCommits.java
index ee751d7..7566b55 100644
--- a/java/com/google/gerrit/server/git/receive/ReceiveCommits.java
+++ b/java/com/google/gerrit/server/git/receive/ReceiveCommits.java
@@ -1325,6 +1325,7 @@
   static class MagicBranchInput {
     private static final Splitter COMMAS = Splitter.on(',').omitEmptyStrings();
 
+    boolean deprecatedTopicSeen;
     final ReceiveCommand cmd;
     final LabelTypes labelTypes;
     final NotesMigration notesMigration;
@@ -1482,6 +1483,7 @@
         ReceiveCommand cmd,
         LabelTypes labelTypes,
         NotesMigration notesMigration) {
+      this.deprecatedTopicSeen = false;
       this.cmd = cmd;
       this.draft = cmd.getRefName().startsWith(MagicBranch.NEW_DRAFT_CHANGE);
       this.publish = cmd.getRefName().startsWith(MagicBranch.NEW_PUBLISH_CHANGE);
@@ -1545,8 +1547,7 @@
 
       // We accept refs/for/BRANCHNAME/TOPIC. Since we don't know
       // for sure where the branch ends and the topic starts, look
-      // backward for a split that works. This behavior has not been
-      // documented and should probably be deprecated.
+      // backward for a split that works. This behavior is deprecated.
       String head = readHEAD(repo);
       int split = ref.length();
       for (; ; ) {
@@ -1562,6 +1563,7 @@
       }
       if (split < ref.length()) {
         topic = Strings.emptyToNull(ref.substring(split + 1));
+        deprecatedTopicSeen = true;
       }
       return ref.substring(0, split);
     }
@@ -1767,6 +1769,13 @@
       return;
     }
 
+    if (magicBranch.deprecatedTopicSeen) {
+      messages.add(
+          new ValidationMessage(
+              "WARNING: deprecated topic syntax. Use %topic=TOPIC instead", false));
+      logger.atInfo().log("deprecated topic push seen for project %s", project.getName());
+    }
+
     if (validateConnected(magicBranch.cmd, magicBranch.dest, tip)) {
       this.magicBranch = magicBranch;
     }
diff --git a/java/com/google/gerrit/server/index/account/AccountSchemaDefinitions.java b/java/com/google/gerrit/server/index/account/AccountSchemaDefinitions.java
index 3e702f2..6b7fe62 100644
--- a/java/com/google/gerrit/server/index/account/AccountSchemaDefinitions.java
+++ b/java/com/google/gerrit/server/index/account/AccountSchemaDefinitions.java
@@ -42,8 +42,12 @@
 
   @Deprecated static final Schema<AccountState> V7 = schema(V6, AccountField.PREFERRED_EMAIL_EXACT);
 
+  @Deprecated
   static final Schema<AccountState> V8 = schema(V7, AccountField.NAME_PART_NO_SECONDARY_EMAIL);
 
+  // Bump Lucene version requires reindexing
+  static final Schema<AccountState> V9 = schema(V8);
+
   public static final String NAME = "accounts";
   public static final AccountSchemaDefinitions INSTANCE = new AccountSchemaDefinitions();
 
diff --git a/java/com/google/gerrit/server/index/change/ChangeSchemaDefinitions.java b/java/com/google/gerrit/server/index/change/ChangeSchemaDefinitions.java
index 5e7e4dd..2000cd1 100644
--- a/java/com/google/gerrit/server/index/change/ChangeSchemaDefinitions.java
+++ b/java/com/google/gerrit/server/index/change/ChangeSchemaDefinitions.java
@@ -96,7 +96,10 @@
   // Rename of star label 'mute' to 'reviewed' requires reindexing
   @Deprecated static final Schema<ChangeData> V48 = schema(V47);
 
-  static final Schema<ChangeData> V49 = schema(V48);
+  @Deprecated static final Schema<ChangeData> V49 = schema(V48);
+
+  // Bump Lucene version requires reindexing
+  static final Schema<ChangeData> V50 = schema(V49);
 
   public static final String NAME = "changes";
   public static final ChangeSchemaDefinitions INSTANCE = new ChangeSchemaDefinitions();
diff --git a/java/com/google/gerrit/server/index/group/GroupSchemaDefinitions.java b/java/com/google/gerrit/server/index/group/GroupSchemaDefinitions.java
index 912524f..c175434 100644
--- a/java/com/google/gerrit/server/index/group/GroupSchemaDefinitions.java
+++ b/java/com/google/gerrit/server/index/group/GroupSchemaDefinitions.java
@@ -37,7 +37,10 @@
   @Deprecated
   static final Schema<InternalGroup> V4 = schema(V3, GroupField.MEMBER, GroupField.SUBGROUP);
 
-  static final Schema<InternalGroup> V5 = schema(V4, GroupField.REF_STATE);
+  @Deprecated static final Schema<InternalGroup> V5 = schema(V4, GroupField.REF_STATE);
+
+  // Bump Lucene version requires reindexing
+  static final Schema<InternalGroup> V6 = schema(V5);
 
   public static final GroupSchemaDefinitions INSTANCE = new GroupSchemaDefinitions();
 
diff --git a/java/com/google/gerrit/server/permissions/PermissionCollection.java b/java/com/google/gerrit/server/permissions/PermissionCollection.java
index 81e8d24..b419698 100644
--- a/java/com/google/gerrit/server/permissions/PermissionCollection.java
+++ b/java/com/google/gerrit/server/permissions/PermissionCollection.java
@@ -26,6 +26,10 @@
 import com.google.gerrit.common.data.Permission;
 import com.google.gerrit.common.data.PermissionRule;
 import com.google.gerrit.common.data.PermissionRule.Action;
+import com.google.gerrit.metrics.Description;
+import com.google.gerrit.metrics.Description.Units;
+import com.google.gerrit.metrics.MetricMaker;
+import com.google.gerrit.metrics.Timer0;
 import com.google.gerrit.reviewdb.client.AccountGroup;
 import com.google.gerrit.reviewdb.client.Project;
 import com.google.gerrit.server.CurrentUser;
@@ -54,10 +58,18 @@
   @Singleton
   public static class Factory {
     private final SectionSortCache sorter;
+    // TODO(hiesel): Remove this once we got production data
+    private final Timer0 filterLatency;
 
     @Inject
-    Factory(SectionSortCache sorter) {
+    Factory(SectionSortCache sorter, MetricMaker metricMaker) {
       this.sorter = sorter;
+      this.filterLatency =
+          metricMaker.newTimer(
+              "permissions/permission_collection/filter_latency",
+              new Description("Latency for access filter computations in PermissionCollection")
+                  .setCumulative()
+                  .setUnit(Units.NANOSECONDS));
     }
 
     /**
@@ -117,41 +129,43 @@
      */
     PermissionCollection filter(
         Iterable<SectionMatcher> matcherList, String ref, CurrentUser user) {
-      if (isRE(ref)) {
-        ref = RefPattern.shortestExample(ref);
-      } else if (ref.endsWith("/*")) {
-        ref = ref.substring(0, ref.length() - 1);
+      try (Timer0.Context ignored = filterLatency.start()) {
+        if (isRE(ref)) {
+          ref = RefPattern.shortestExample(ref);
+        } else if (ref.endsWith("/*")) {
+          ref = ref.substring(0, ref.length() - 1);
+        }
+
+        // LinkedHashMap to maintain input ordering.
+        Map<AccessSection, Project.NameKey> sectionToProject = new LinkedHashMap<>();
+        boolean perUser = filterRefMatchingSections(matcherList, ref, user, sectionToProject);
+        List<AccessSection> sections = Lists.newArrayList(sectionToProject.keySet());
+
+        // Sort by ref pattern specificity. For equally specific patterns, the sections from the
+        // project closer to the current one come first.
+        sorter.sort(ref, sections);
+
+        // For block permissions, we want a different order: first, we want to go from parent to
+        // child.
+        List<Map.Entry<AccessSection, Project.NameKey>> accessDescending =
+            Lists.reverse(Lists.newArrayList(sectionToProject.entrySet()));
+
+        Map<Project.NameKey, List<AccessSection>> accessByProject =
+            accessDescending
+                .stream()
+                .collect(
+                    Collectors.groupingBy(
+                        Map.Entry::getValue,
+                        LinkedHashMap::new,
+                        mapping(Map.Entry::getKey, toList())));
+        // Within each project, sort by ref specificity.
+        for (List<AccessSection> secs : accessByProject.values()) {
+          sorter.sort(ref, secs);
+        }
+
+        return new PermissionCollection(
+            Lists.newArrayList(accessByProject.values()), sections, perUser);
       }
-
-      // LinkedHashMap to maintain input ordering.
-      Map<AccessSection, Project.NameKey> sectionToProject = new LinkedHashMap<>();
-      boolean perUser = filterRefMatchingSections(matcherList, ref, user, sectionToProject);
-      List<AccessSection> sections = Lists.newArrayList(sectionToProject.keySet());
-
-      // Sort by ref pattern specificity. For equally specific patterns, the sections from the
-      // project closer to the current one come first.
-      sorter.sort(ref, sections);
-
-      // For block permissions, we want a different order: first, we want to go from parent to
-      // child.
-      List<Map.Entry<AccessSection, Project.NameKey>> accessDescending =
-          Lists.reverse(Lists.newArrayList(sectionToProject.entrySet()));
-
-      Map<Project.NameKey, List<AccessSection>> accessByProject =
-          accessDescending
-              .stream()
-              .collect(
-                  Collectors.groupingBy(
-                      Map.Entry::getValue,
-                      LinkedHashMap::new,
-                      mapping(Map.Entry::getKey, toList())));
-      // Within each project, sort by ref specificity.
-      for (List<AccessSection> secs : accessByProject.values()) {
-        sorter.sort(ref, secs);
-      }
-
-      return new PermissionCollection(
-          Lists.newArrayList(accessByProject.values()), sections, perUser);
     }
   }
 
diff --git a/java/com/google/gerrit/server/project/ProjectState.java b/java/com/google/gerrit/server/project/ProjectState.java
index a9b19d9..8355625 100644
--- a/java/com/google/gerrit/server/project/ProjectState.java
+++ b/java/com/google/gerrit/server/project/ProjectState.java
@@ -36,6 +36,11 @@
 import com.google.gerrit.extensions.client.SubmitType;
 import com.google.gerrit.extensions.restapi.ResourceConflictException;
 import com.google.gerrit.index.project.ProjectData;
+import com.google.gerrit.metrics.Description;
+import com.google.gerrit.metrics.Description.Units;
+import com.google.gerrit.metrics.Field;
+import com.google.gerrit.metrics.MetricMaker;
+import com.google.gerrit.metrics.Timer1;
 import com.google.gerrit.reviewdb.client.AccountGroup;
 import com.google.gerrit.reviewdb.client.BooleanProjectConfig;
 import com.google.gerrit.reviewdb.client.Branch;
@@ -92,6 +97,9 @@
   private final long globalMaxObjectSizeLimit;
   private final boolean inheritProjectMaxObjectSizeLimit;
 
+  // TODO(hiesel): Remove this once we got production data
+  private final Timer1<String> computationLatency;
+
   /** Last system time the configuration's revision was examined. */
   private volatile long lastCheckGeneration;
 
@@ -119,6 +127,7 @@
       List<CommentLinkInfo> commentLinks,
       CapabilityCollection.Factory limitsFactory,
       TransferConfig transferConfig,
+      MetricMaker metricMaker,
       @Assisted ProjectConfig config) {
     this.sitePaths = sitePaths;
     this.projectCache = projectCache;
@@ -136,6 +145,14 @@
     this.globalMaxObjectSizeLimit = transferConfig.getMaxObjectSizeLimit();
     this.inheritProjectMaxObjectSizeLimit = transferConfig.getInheritProjectMaxObjectSizeLimit();
 
+    this.computationLatency =
+        metricMaker.newTimer(
+            "permissions/project_state/computation_latency",
+            new Description("Latency for access computations in ProjectState")
+                .setCumulative()
+                .setUnit(Units.NANOSECONDS),
+            Field.ofString("method"));
+
     if (isAllProjects && !Permission.canBeOnAllProjects(AccessSection.ALL, Permission.OWNER)) {
       localOwners = Collections.emptySet();
     } else {
@@ -354,15 +371,20 @@
    * cached. Callers should try to cache this result per-request as much as possible.
    */
   public List<SectionMatcher> getAllSections() {
-    if (isAllProjects) {
-      return getLocalAccessSections();
-    }
+    try (Timer1.Context ignored = computationLatency.start("getAllSections")) {
+      if (isAllProjects) {
+        return getLocalAccessSections();
+      }
 
-    List<SectionMatcher> all = new ArrayList<>();
-    for (ProjectState s : tree()) {
-      all.addAll(s.getLocalAccessSections());
+      List<SectionMatcher> all = new ArrayList<>();
+      Iterable<ProjectState> tree = tree();
+      try (Timer1.Context ignored2 = computationLatency.start("getAllSections-parsing-only")) {
+        for (ProjectState s : tree) {
+          all.addAll(s.getLocalAccessSections());
+        }
+      }
+      return all;
     }
-    return all;
   }
 
   /**
diff --git a/java/com/google/gerrit/server/restapi/config/GetServerInfo.java b/java/com/google/gerrit/server/restapi/config/GetServerInfo.java
index 66e9f90..d6071d5 100644
--- a/java/com/google/gerrit/server/restapi/config/GetServerInfo.java
+++ b/java/com/google/gerrit/server/restapi/config/GetServerInfo.java
@@ -157,9 +157,7 @@
     info.gerrit = getGerritInfo();
     info.noteDbEnabled = toBoolean(isNoteDbEnabled());
     info.plugin = getPluginInfo();
-    if (Files.exists(sitePaths.site_theme)) {
-      info.defaultTheme = "/static/" + SitePaths.THEME_FILENAME;
-    }
+    info.defaultTheme = getDefaultTheme();
     info.sshd = getSshdInfo();
     info.suggest = getSuggestInfo();
 
@@ -342,6 +340,22 @@
     return info;
   }
 
+  private static final String DEFAULT_THEME = "/static/" + SitePaths.THEME_FILENAME;
+
+  private String getDefaultTheme() {
+    if (config.getString("theme", null, "enableDefault") == null) {
+      // If not explicitly enabled or disabled, check for the existence of the theme file.
+      return Files.exists(sitePaths.site_theme) ? DEFAULT_THEME : null;
+    }
+    if (config.getBoolean("theme", null, "enableDefault", true)) {
+      // Return non-null theme path without checking for file existence. Even if the file doesn't
+      // exist under the site path, it may be served from a CDN (in which case it's up to the admin
+      // to also pass a proper asset path to the index Soy template).
+      return DEFAULT_THEME;
+    }
+    return null;
+  }
+
   private Map<String, String> getUrlAliasesInfo() {
     Map<String, String> urlAliases = new HashMap<>();
     for (String subsection : config.getSubsections(URL_ALIAS)) {
diff --git a/java/com/google/gerrit/server/restapi/project/Module.java b/java/com/google/gerrit/server/restapi/project/Module.java
index 0497787..8c8ab49 100644
--- a/java/com/google/gerrit/server/restapi/project/Module.java
+++ b/java/com/google/gerrit/server/restapi/project/Module.java
@@ -23,7 +23,9 @@
 import static com.google.gerrit.server.project.TagResource.TAG_KIND;
 
 import com.google.gerrit.extensions.registration.DynamicMap;
+import com.google.gerrit.extensions.registration.DynamicSet;
 import com.google.gerrit.extensions.restapi.RestApiModule;
+import com.google.gerrit.server.config.GerritConfigListener;
 import com.google.gerrit.server.project.RefValidationHelper;
 import com.google.gerrit.server.restapi.change.CherryPickCommit;
 
@@ -41,6 +43,8 @@
     DynamicMap.mapOf(binder(), COMMIT_KIND);
     DynamicMap.mapOf(binder(), TAG_KIND);
 
+    DynamicSet.bind(binder(), GerritConfigListener.class).to(SetParent.class);
+
     create(PROJECT_KIND).to(CreateProject.class);
     put(PROJECT_KIND).to(PutProject.class);
     get(PROJECT_KIND).to(GetProject.class);
diff --git a/java/com/google/gerrit/server/restapi/project/SetParent.java b/java/com/google/gerrit/server/restapi/project/SetParent.java
index b38619b..d4e67b1 100644
--- a/java/com/google/gerrit/server/restapi/project/SetParent.java
+++ b/java/com/google/gerrit/server/restapi/project/SetParent.java
@@ -30,6 +30,9 @@
 import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.config.AllProjectsName;
 import com.google.gerrit.server.config.AllUsersName;
+import com.google.gerrit.server.config.ConfigKey;
+import com.google.gerrit.server.config.ConfigUpdatedEvent;
+import com.google.gerrit.server.config.GerritConfigListener;
 import com.google.gerrit.server.config.GerritServerConfig;
 import com.google.gerrit.server.git.meta.MetaDataUpdate;
 import com.google.gerrit.server.permissions.GlobalPermission;
@@ -43,18 +46,21 @@
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 import java.io.IOException;
+import java.util.Collections;
+import java.util.List;
 import org.eclipse.jgit.errors.ConfigInvalidException;
 import org.eclipse.jgit.errors.RepositoryNotFoundException;
 import org.eclipse.jgit.lib.Config;
 
 @Singleton
-public class SetParent implements RestModifyView<ProjectResource, ParentInput> {
+public class SetParent
+    implements RestModifyView<ProjectResource, ParentInput>, GerritConfigListener {
   private final ProjectCache cache;
   private final PermissionBackend permissionBackend;
   private final MetaDataUpdate.Server updateFactory;
   private final AllProjectsName allProjects;
   private final AllUsersName allUsers;
-  private final boolean allowProjectOwnersToChangeParent;
+  private volatile boolean allowProjectOwnersToChangeParent;
 
   @Inject
   SetParent(
@@ -164,4 +170,20 @@
       }
     }
   }
+
+  @Override
+  public List<ConfigUpdatedEvent.Update> configUpdated(ConfigUpdatedEvent event) {
+    ConfigKey receiveSetParent = ConfigKey.create("receive", "allowProjectOwnersToChangeParent");
+    if (!event.isValueUpdated(receiveSetParent)) {
+      return Collections.emptyList();
+    }
+    try {
+      boolean enabled =
+          event.getNewConfig().getBoolean("receive", "allowProjectOwnersToChangeParent", false);
+      this.allowProjectOwnersToChangeParent = enabled;
+      return Collections.singletonList(event.accept(receiveSetParent));
+    } catch (IllegalArgumentException iae) {
+      return Collections.singletonList(event.reject(receiveSetParent));
+    }
+  }
 }
diff --git a/java/com/google/gerrit/sshd/AliasCommand.java b/java/com/google/gerrit/sshd/AliasCommand.java
index cb61651..567cf00 100644
--- a/java/com/google/gerrit/sshd/AliasCommand.java
+++ b/java/com/google/gerrit/sshd/AliasCommand.java
@@ -26,8 +26,8 @@
 import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.atomic.AtomicReference;
-import org.apache.sshd.server.Command;
 import org.apache.sshd.server.Environment;
+import org.apache.sshd.server.command.Command;
 
 /** Command that executes some other command. */
 public class AliasCommand extends BaseCommand {
diff --git a/java/com/google/gerrit/sshd/AliasCommandProvider.java b/java/com/google/gerrit/sshd/AliasCommandProvider.java
index 085b6d6..58e2559 100644
--- a/java/com/google/gerrit/sshd/AliasCommandProvider.java
+++ b/java/com/google/gerrit/sshd/AliasCommandProvider.java
@@ -17,7 +17,7 @@
 import com.google.gerrit.server.permissions.PermissionBackend;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
-import org.apache.sshd.server.Command;
+import org.apache.sshd.server.command.Command;
 
 /** Resolves an alias to another command. */
 public class AliasCommandProvider implements Provider<Command> {
diff --git a/java/com/google/gerrit/sshd/BaseCommand.java b/java/com/google/gerrit/sshd/BaseCommand.java
index 942a571..1d19a8a 100644
--- a/java/com/google/gerrit/sshd/BaseCommand.java
+++ b/java/com/google/gerrit/sshd/BaseCommand.java
@@ -54,9 +54,9 @@
 import java.util.concurrent.ScheduledThreadPoolExecutor;
 import java.util.concurrent.atomic.AtomicReference;
 import org.apache.sshd.common.SshException;
-import org.apache.sshd.server.Command;
 import org.apache.sshd.server.Environment;
 import org.apache.sshd.server.ExitCallback;
+import org.apache.sshd.server.command.Command;
 import org.kohsuke.args4j.Argument;
 import org.kohsuke.args4j.CmdLineException;
 import org.kohsuke.args4j.Option;
diff --git a/java/com/google/gerrit/sshd/CommandFactoryProvider.java b/java/com/google/gerrit/sshd/CommandFactoryProvider.java
index 1fdf7d8..3fb2ed4 100644
--- a/java/com/google/gerrit/sshd/CommandFactoryProvider.java
+++ b/java/com/google/gerrit/sshd/CommandFactoryProvider.java
@@ -39,11 +39,11 @@
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicReference;
-import org.apache.sshd.server.Command;
-import org.apache.sshd.server.CommandFactory;
 import org.apache.sshd.server.Environment;
 import org.apache.sshd.server.ExitCallback;
 import org.apache.sshd.server.SessionAware;
+import org.apache.sshd.server.command.Command;
+import org.apache.sshd.server.command.CommandFactory;
 import org.apache.sshd.server.session.ServerSession;
 import org.eclipse.jgit.lib.Config;
 
diff --git a/java/com/google/gerrit/sshd/CommandModule.java b/java/com/google/gerrit/sshd/CommandModule.java
index 93aab0b..ac07056 100644
--- a/java/com/google/gerrit/sshd/CommandModule.java
+++ b/java/com/google/gerrit/sshd/CommandModule.java
@@ -16,7 +16,7 @@
 
 import com.google.gerrit.lifecycle.LifecycleModule;
 import com.google.inject.binder.LinkedBindingBuilder;
-import org.apache.sshd.server.Command;
+import org.apache.sshd.server.command.Command;
 
 /** Module to register commands in the SSH daemon. */
 public abstract class CommandModule extends LifecycleModule {
diff --git a/java/com/google/gerrit/sshd/CommandProvider.java b/java/com/google/gerrit/sshd/CommandProvider.java
index 61c36cb..cf2e84c 100644
--- a/java/com/google/gerrit/sshd/CommandProvider.java
+++ b/java/com/google/gerrit/sshd/CommandProvider.java
@@ -15,7 +15,7 @@
 package com.google.gerrit.sshd;
 
 import com.google.inject.Provider;
-import org.apache.sshd.server.Command;
+import org.apache.sshd.server.command.Command;
 
 final class CommandProvider {
 
diff --git a/java/com/google/gerrit/sshd/Commands.java b/java/com/google/gerrit/sshd/Commands.java
index 43d2c50..b6d3401 100644
--- a/java/com/google/gerrit/sshd/Commands.java
+++ b/java/com/google/gerrit/sshd/Commands.java
@@ -17,7 +17,7 @@
 import com.google.auto.value.AutoAnnotation;
 import com.google.inject.Key;
 import java.lang.annotation.Annotation;
-import org.apache.sshd.server.Command;
+import org.apache.sshd.server.command.Command;
 
 /** Utilities to support {@link CommandName} construction. */
 public class Commands {
diff --git a/java/com/google/gerrit/sshd/DispatchCommand.java b/java/com/google/gerrit/sshd/DispatchCommand.java
index 490dd52..4c9ca91 100644
--- a/java/com/google/gerrit/sshd/DispatchCommand.java
+++ b/java/com/google/gerrit/sshd/DispatchCommand.java
@@ -31,8 +31,8 @@
 import java.util.List;
 import java.util.Map;
 import java.util.concurrent.atomic.AtomicReference;
-import org.apache.sshd.server.Command;
 import org.apache.sshd.server.Environment;
+import org.apache.sshd.server.command.Command;
 import org.kohsuke.args4j.Argument;
 
 /** Command that dispatches to a subcommand from its command table. */
diff --git a/java/com/google/gerrit/sshd/DispatchCommandProvider.java b/java/com/google/gerrit/sshd/DispatchCommandProvider.java
index c782d2f..7ff7224 100644
--- a/java/com/google/gerrit/sshd/DispatchCommandProvider.java
+++ b/java/com/google/gerrit/sshd/DispatchCommandProvider.java
@@ -24,7 +24,7 @@
 import java.lang.annotation.Annotation;
 import java.util.List;
 import java.util.concurrent.ConcurrentMap;
-import org.apache.sshd.server.Command;
+import org.apache.sshd.server.command.Command;
 
 /** Creates DispatchCommand using commands registered by {@link CommandModule}. */
 public class DispatchCommandProvider implements Provider<DispatchCommand> {
diff --git a/java/com/google/gerrit/sshd/NoShell.java b/java/com/google/gerrit/sshd/NoShell.java
index ba0dcba..0235554 100644
--- a/java/com/google/gerrit/sshd/NoShell.java
+++ b/java/com/google/gerrit/sshd/NoShell.java
@@ -30,10 +30,10 @@
 import java.net.MalformedURLException;
 import java.net.URL;
 import org.apache.sshd.common.Factory;
-import org.apache.sshd.server.Command;
 import org.apache.sshd.server.Environment;
 import org.apache.sshd.server.ExitCallback;
 import org.apache.sshd.server.SessionAware;
+import org.apache.sshd.server.command.Command;
 import org.apache.sshd.server.session.ServerSession;
 import org.eclipse.jgit.lib.Constants;
 import org.eclipse.jgit.util.SystemReader;
diff --git a/java/com/google/gerrit/sshd/PluginCommandModule.java b/java/com/google/gerrit/sshd/PluginCommandModule.java
index b0116e4..984c8a6 100644
--- a/java/com/google/gerrit/sshd/PluginCommandModule.java
+++ b/java/com/google/gerrit/sshd/PluginCommandModule.java
@@ -18,7 +18,7 @@
 import com.google.gerrit.extensions.annotations.PluginName;
 import com.google.inject.Inject;
 import com.google.inject.binder.LinkedBindingBuilder;
-import org.apache.sshd.server.Command;
+import org.apache.sshd.server.command.Command;
 
 public abstract class PluginCommandModule extends CommandModule {
   private CommandName command;
diff --git a/java/com/google/gerrit/sshd/SingleCommandPluginModule.java b/java/com/google/gerrit/sshd/SingleCommandPluginModule.java
index 079661a..5b602f4 100644
--- a/java/com/google/gerrit/sshd/SingleCommandPluginModule.java
+++ b/java/com/google/gerrit/sshd/SingleCommandPluginModule.java
@@ -18,7 +18,7 @@
 import com.google.gerrit.extensions.annotations.PluginName;
 import com.google.inject.Inject;
 import com.google.inject.binder.LinkedBindingBuilder;
-import org.apache.sshd.server.Command;
+import org.apache.sshd.server.command.Command;
 
 /**
  * Binds one SSH command to the plugin name itself.
diff --git a/java/com/google/gerrit/sshd/SshAutoRegisterModuleGenerator.java b/java/com/google/gerrit/sshd/SshAutoRegisterModuleGenerator.java
index 0fdde81..830dba7 100644
--- a/java/com/google/gerrit/sshd/SshAutoRegisterModuleGenerator.java
+++ b/java/com/google/gerrit/sshd/SshAutoRegisterModuleGenerator.java
@@ -28,7 +28,7 @@
 import java.lang.annotation.Annotation;
 import java.util.HashMap;
 import java.util.Map;
-import org.apache.sshd.server.Command;
+import org.apache.sshd.server.command.Command;
 
 class SshAutoRegisterModuleGenerator extends AbstractModule implements ModuleGenerator {
   private final Map<String, Class<Command>> commands = new HashMap<>();
diff --git a/java/com/google/gerrit/sshd/SshDaemon.java b/java/com/google/gerrit/sshd/SshDaemon.java
index 688c573..ef356f1 100644
--- a/java/com/google/gerrit/sshd/SshDaemon.java
+++ b/java/com/google/gerrit/sshd/SshDaemon.java
@@ -93,8 +93,6 @@
 import org.apache.sshd.common.util.buffer.ByteArrayBuffer;
 import org.apache.sshd.common.util.net.SshdSocketAddress;
 import org.apache.sshd.common.util.security.SecurityUtils;
-import org.apache.sshd.server.Command;
-import org.apache.sshd.server.CommandFactory;
 import org.apache.sshd.server.ServerBuilder;
 import org.apache.sshd.server.SshServer;
 import org.apache.sshd.server.auth.UserAuth;
@@ -102,6 +100,8 @@
 import org.apache.sshd.server.auth.gss.UserAuthGSSFactory;
 import org.apache.sshd.server.auth.pubkey.PublickeyAuthenticator;
 import org.apache.sshd.server.auth.pubkey.UserAuthPublicKeyFactory;
+import org.apache.sshd.server.command.Command;
+import org.apache.sshd.server.command.CommandFactory;
 import org.apache.sshd.server.forward.ForwardingFilter;
 import org.apache.sshd.server.global.CancelTcpipForwardHandler;
 import org.apache.sshd.server.global.KeepAliveHandler;
diff --git a/java/com/google/gerrit/sshd/SshLog.java b/java/com/google/gerrit/sshd/SshLog.java
index bd8a3ee..0e34889 100644
--- a/java/com/google/gerrit/sshd/SshLog.java
+++ b/java/com/google/gerrit/sshd/SshLog.java
@@ -323,16 +323,20 @@
     if (!event.isValueUpdated(sshdRequestLog)) {
       return Collections.emptyList();
     }
-
-    boolean enabled = event.getNewConfig().getBoolean("sshd", "requestLog", true);
     boolean stateUpdated;
-    if (enabled) {
-      stateUpdated = enableLogging();
-    } else {
-      stateUpdated = disableLogging();
+    try {
+      boolean enabled = event.getNewConfig().getBoolean("sshd", "requestLog", true);
+
+      if (enabled) {
+        stateUpdated = enableLogging();
+      } else {
+        stateUpdated = disableLogging();
+      }
+      return stateUpdated
+          ? Collections.singletonList(event.accept(sshdRequestLog))
+          : Collections.emptyList();
+    } catch (IllegalArgumentException iae) {
+      return Collections.singletonList(event.reject(sshdRequestLog));
     }
-    return stateUpdated
-        ? Collections.singletonList(event.accept(sshdRequestLog))
-        : Collections.emptyList();
   }
 }
diff --git a/java/com/google/gerrit/sshd/SshModule.java b/java/com/google/gerrit/sshd/SshModule.java
index f047017..acdc958 100644
--- a/java/com/google/gerrit/sshd/SshModule.java
+++ b/java/com/google/gerrit/sshd/SshModule.java
@@ -45,9 +45,9 @@
 import java.util.List;
 import java.util.Map;
 import java.util.concurrent.ScheduledThreadPoolExecutor;
-import org.apache.sshd.server.CommandFactory;
 import org.apache.sshd.server.auth.gss.GSSAuthenticator;
 import org.apache.sshd.server.auth.pubkey.PublickeyAuthenticator;
+import org.apache.sshd.server.command.CommandFactory;
 import org.eclipse.jgit.lib.Config;
 
 /** Configures standard dependencies for {@link SshDaemon}. */
diff --git a/java/com/google/gerrit/sshd/SshPluginStarterCallback.java b/java/com/google/gerrit/sshd/SshPluginStarterCallback.java
index e9a095f..6e8590c 100644
--- a/java/com/google/gerrit/sshd/SshPluginStarterCallback.java
+++ b/java/com/google/gerrit/sshd/SshPluginStarterCallback.java
@@ -24,7 +24,7 @@
 import com.google.inject.Key;
 import com.google.inject.Provider;
 import com.google.inject.Singleton;
-import org.apache.sshd.server.Command;
+import org.apache.sshd.server.command.Command;
 
 @Singleton
 class SshPluginStarterCallback implements StartPluginListener, ReloadPluginListener {
diff --git a/java/com/google/gerrit/sshd/SuExec.java b/java/com/google/gerrit/sshd/SuExec.java
index 54371c1..7053a0d 100644
--- a/java/com/google/gerrit/sshd/SuExec.java
+++ b/java/com/google/gerrit/sshd/SuExec.java
@@ -34,8 +34,8 @@
 import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.atomic.AtomicReference;
-import org.apache.sshd.server.Command;
 import org.apache.sshd.server.Environment;
+import org.apache.sshd.server.command.Command;
 import org.kohsuke.args4j.Argument;
 import org.kohsuke.args4j.Option;
 
diff --git a/java/com/google/gerrit/sshd/commands/CloseConnection.java b/java/com/google/gerrit/sshd/commands/CloseConnection.java
index a38461d..60a878a 100644
--- a/java/com/google/gerrit/sshd/commands/CloseConnection.java
+++ b/java/com/google/gerrit/sshd/commands/CloseConnection.java
@@ -53,7 +53,7 @@
       required = true,
       metaVar = "SESSION_ID",
       usage = "List of SSH session IDs to be closed")
-  private final List<String> sessionIds = new ArrayList<>();
+  private List<String> sessionIds = new ArrayList<>();
 
   @Option(name = "--wait", usage = "wait for connection to close before exiting")
   private boolean wait;
diff --git a/javatests/com/google/gerrit/acceptance/git/AbstractPushForReview.java b/javatests/com/google/gerrit/acceptance/git/AbstractPushForReview.java
index b74fc16..d581c1e 100644
--- a/javatests/com/google/gerrit/acceptance/git/AbstractPushForReview.java
+++ b/javatests/com/google/gerrit/acceptance/git/AbstractPushForReview.java
@@ -405,6 +405,7 @@
     PushOneCommit.Result r = pushTo("refs/for/master/" + topic);
     r.assertOkStatus();
     r.assertChange(Change.Status.NEW, topic);
+    r.assertMessage("deprecated topic syntax");
 
     // specify topic as option
     r = pushTo("refs/for/master%topic=" + topic);
diff --git a/javatests/com/google/gerrit/server/permissions/RefControlTest.java b/javatests/com/google/gerrit/server/permissions/RefControlTest.java
index 31eee9f..a3f9f93 100644
--- a/javatests/com/google/gerrit/server/permissions/RefControlTest.java
+++ b/javatests/com/google/gerrit/server/permissions/RefControlTest.java
@@ -43,6 +43,7 @@
 import com.google.gerrit.common.data.PermissionRule;
 import com.google.gerrit.common.errors.InvalidNameException;
 import com.google.gerrit.extensions.api.projects.CommentLinkInfo;
+import com.google.gerrit.metrics.MetricMaker;
 import com.google.gerrit.reviewdb.client.AccountGroup;
 import com.google.gerrit.reviewdb.client.Project;
 import com.google.gerrit.reviewdb.server.ReviewDb;
@@ -204,6 +205,7 @@
   @Inject private ThreadLocalRequestContext requestContext;
   @Inject private DefaultRefFilter.Factory refFilterFactory;
   @Inject private TransferConfig transferConfig;
+  @Inject private MetricMaker metricMaker;
 
   @Before
   public void setUp() throws Exception {
@@ -291,7 +293,7 @@
 
     Cache<SectionSortCache.EntryKey, SectionSortCache.EntryVal> c =
         CacheBuilder.newBuilder().build();
-    sectionSorter = new PermissionCollection.Factory(new SectionSortCache(c));
+    sectionSorter = new PermissionCollection.Factory(new SectionSortCache(c), metricMaker);
 
     parent = new ProjectConfig(parentKey);
     parent.load(newRepository(parentKey));
@@ -972,6 +974,7 @@
             commentLinks,
             capabilityCollectionFactory,
             transferConfig,
+            metricMaker,
             pc));
     return repo;
   }
diff --git a/javatests/com/google/gerrit/server/query/change/AbstractQueryChangesTest.java b/javatests/com/google/gerrit/server/query/change/AbstractQueryChangesTest.java
index 41f60bb..f3275d1 100644
--- a/javatests/com/google/gerrit/server/query/change/AbstractQueryChangesTest.java
+++ b/javatests/com/google/gerrit/server/query/change/AbstractQueryChangesTest.java
@@ -201,7 +201,7 @@
 
   protected static final String DASHBOARD_HAS_UNPUBLISHED_DRAFTS_QUERY = "has:draft";
   protected static final String DASHBOARD_ASSIGNED_QUERY =
-      "assignee:${user} (-is:wip OR " + "owner:self OR assignee:self)";
+      "assignee:${user} (-is:wip OR " + "owner:self OR assignee:self) is:open -is:ignored";
   protected static final String DASHBOARD_WORK_IN_PROGRESS_QUERY = "is:open owner:${user} is:wip";
   protected static final String DASHBOARD_OUTGOING_QUERY =
       "is:open owner:${user} -is:wip -is:ignored";
@@ -2746,6 +2746,14 @@
             .create(repo);
 
     // Create changes that should not be returned by query.
+    new DashboardChangeState(user.getAccountId()).assignTo(user.getAccountId()).abandon();
+    new DashboardChangeState(user.getAccountId())
+        .assignTo(user.getAccountId())
+        .ignoreBy(user.getAccountId());
+    new DashboardChangeState(user.getAccountId())
+        .assignTo(user.getAccountId())
+        .mergeBy(user.getAccountId());
+
     assertDashboardQuery("self", DASHBOARD_ASSIGNED_QUERY, selfOpenWip, otherOpenWip);
 
     // Viewing another user's dashboard.
diff --git a/lib/mina/BUILD b/lib/mina/BUILD
index 8595bb5..6ee7e41 100644
--- a/lib/mina/BUILD
+++ b/lib/mina/BUILD
@@ -4,6 +4,7 @@
     visibility = ["//visibility:public"],
     exports = [
         ":eddsa",
+        "@sshd-mina//jar",
         "@sshd//jar",
     ],
     runtime_deps = [":core"],
diff --git a/polygerrit-ui/app/elements/change-list/gr-dashboard-view/gr-dashboard-view.html b/polygerrit-ui/app/elements/change-list/gr-dashboard-view/gr-dashboard-view.html
index 7e56deb..af320e2 100644
--- a/polygerrit-ui/app/elements/change-list/gr-dashboard-view/gr-dashboard-view.html
+++ b/polygerrit-ui/app/elements/change-list/gr-dashboard-view/gr-dashboard-view.html
@@ -68,6 +68,7 @@
     <div class$="banner [[_computeBannerClass(_showDraftsBanner)]]">
       <div>
         You have draft comments on closed changes.
+        <a href$="[[_computeDraftsLink(_showDraftsBanner)]]" target="_blank">(view all)</a>
       </div>
       <div>
         <gr-button
diff --git a/polygerrit-ui/app/elements/change-list/gr-dashboard-view/gr-dashboard-view.js b/polygerrit-ui/app/elements/change-list/gr-dashboard-view/gr-dashboard-view.js
index 73669db..8aa7084 100644
--- a/polygerrit-ui/app/elements/change-list/gr-dashboard-view/gr-dashboard-view.js
+++ b/polygerrit-ui/app/elements/change-list/gr-dashboard-view/gr-dashboard-view.js
@@ -244,5 +244,9 @@
     _closeConfirmDeleteOverlay() {
       this.$.confirmDeleteOverlay.close();
     },
+
+    _computeDraftsLink() {
+      return Gerrit.Nav.getUrlForSearchQuery('has:draft -is:open');
+    },
   });
 })();
diff --git a/polygerrit-ui/app/elements/change/gr-change-actions/gr-change-actions.js b/polygerrit-ui/app/elements/change/gr-change-actions/gr-change-actions.js
index 6af94a1..60479e8 100644
--- a/polygerrit-ui/app/elements/change/gr-change-actions/gr-change-actions.js
+++ b/polygerrit-ui/app/elements/change/gr-change-actions/gr-change-actions.js
@@ -241,6 +241,10 @@
           ];
         },
       },
+      disableEdit: {
+        type: Boolean,
+        value: false,
+      },
       _hasKnownChainState: {
         type: Boolean,
         value: false,
@@ -397,7 +401,7 @@
       '_actionsChanged(actions.*, revisionActions.*, _additionalActions.*)',
       '_changeChanged(change)',
       '_editStatusChanged(editMode, editPatchsetLoaded, ' +
-          'editBasedOnCurrentPatchSet, actions.*, change.*)',
+          'editBasedOnCurrentPatchSet, disableEdit, actions.*, change.*)',
     ],
 
     listeners: {
@@ -575,7 +579,15 @@
     },
 
     _editStatusChanged(editMode, editPatchsetLoaded,
-        editBasedOnCurrentPatchSet) {
+        editBasedOnCurrentPatchSet, disableEdit) {
+      if (disableEdit) {
+        this._deleteAndNotify('publishEdit');
+        this._deleteAndNotify('rebaseEdit');
+        this._deleteAndNotify('deleteEdit');
+        this._deleteAndNotify('stopEdit');
+        this._deleteAndNotify('edit');
+        return;
+      }
       if (editPatchsetLoaded) {
         // Only show actions that mutate an edit if an actual edit patch set
         // is loaded.
diff --git a/polygerrit-ui/app/elements/change/gr-change-actions/gr-change-actions_test.html b/polygerrit-ui/app/elements/change/gr-change-actions/gr-change-actions_test.html
index 91b39de..89d4f1f 100644
--- a/polygerrit-ui/app/elements/change/gr-change-actions/gr-change-actions_test.html
+++ b/polygerrit-ui/app/elements/change/gr-change-actions/gr-change-actions_test.html
@@ -439,6 +439,20 @@
     });
 
     suite('change edits', () => {
+      test('disableEdit', () => {
+        element.set('editMode', false);
+        element.set('editPatchsetLoaded', false);
+        element.change = {status: 'NEW'};
+        element.set('disableEdit', true);
+        flushAsynchronousOperations();
+
+        assert.isNotOk(element.$$('gr-button[data-action-key="publishEdit"]'));
+        assert.isNotOk(element.$$('gr-button[data-action-key="rebaseEdit"]'));
+        assert.isNotOk(element.$$('gr-button[data-action-key="deleteEdit"]'));
+        assert.isNotOk(element.$$('gr-button[data-action-key="edit"]'));
+        assert.isNotOk(element.$$('gr-button[data-action-key="stopEdit"]'));
+      });
+
       test('shows confirm dialog for delete edit', () => {
         element.set('editMode', true);
         element.set('editPatchsetLoaded', true);
diff --git a/polygerrit-ui/app/elements/change/gr-change-metadata/gr-change-metadata-it_test.html b/polygerrit-ui/app/elements/change/gr-change-metadata/gr-change-metadata-it_test.html
index b056233..5b36221 100644
--- a/polygerrit-ui/app/elements/change/gr-change-metadata/gr-change-metadata-it_test.html
+++ b/polygerrit-ui/app/elements/change/gr-change-metadata/gr-change-metadata-it_test.html
@@ -136,43 +136,42 @@
 
     suite('label updates', () => {
       let plugin;
-      let labelChangeStub;
 
-      setup(done => {
+      setup(() => {
         Gerrit.install(p => plugin = p, '0.1',
             new URL('test/plugin.html?' + Math.random(),
                     window.location.href).toString());
         sandbox.stub(Gerrit, '_arePluginsLoaded').returns(true);
         Gerrit._setPluginsPending([]);
         element = createElement();
-
-        labelChangeStub = sandbox.stub();
-        plugin.changeMetadata().onLabelsChanged(labelChangeStub);
-        flush(done);
       });
 
       test('labels changed callback', done => {
-        assert.equal(labelChangeStub.callCount, 1);
-        assert.isTrue(labelChangeStub.calledWithExactly(labels));
-        assert.equal(labelChangeStub.args[0][0]['CI'].all.length, 2);
-        element.set(['change', 'labels'], {
-          CI: {
-            all: [
-              {value: 1, name: 'user 2', _account_id: 1},
-            ],
-            values: {
-              ' 0': 'Don\'t submit as-is',
-              '+1': 'No score',
-              '+2': 'Looks good to me',
-            },
-          },
+        let callCount = 0;
+        const labelChangeSpy = sandbox.spy(arg => {
+          callCount++;
+          if (callCount === 1) {
+            assert.deepEqual(arg, labels);
+            assert.equal(arg.CI.all.length, 2);
+            element.set(['change', 'labels'], {
+              CI: {
+                all: [
+                  {value: 1, name: 'user 2', _account_id: 1},
+                ],
+                values: {
+                  ' 0': 'Don\'t submit as-is',
+                  '+1': 'No score',
+                  '+2': 'Looks good to me',
+                },
+              },
+            });
+          } else if (callCount === 2) {
+            assert.equal(arg.CI.all.length, 1);
+            done();
+          }
         });
-        // Wait for fake rest API response.
-        flush(() => {
-          assert.equal(labelChangeStub.callCount, 2);
-          assert.equal(labelChangeStub.args[1][0]['CI'].all.length, 1);
-          done();
-        });
+
+        plugin.changeMetadata().onLabelsChanged(labelChangeSpy);
       });
     });
   });
diff --git a/polygerrit-ui/app/elements/change/gr-change-view/gr-change-view.html b/polygerrit-ui/app/elements/change/gr-change-view/gr-change-view.html
index 461bfc4..8885a6f 100644
--- a/polygerrit-ui/app/elements/change/gr-change-view/gr-change-view.html
+++ b/polygerrit-ui/app/elements/change/gr-change-view/gr-change-view.html
@@ -394,8 +394,10 @@
           <span class="headerSubject">[[_change.subject]]</span>
         </div><!-- end headerTitle -->
         <div class="commitActions" hidden$="[[!_loggedIn]]">
-          <gr-change-actions id="actions"
+          <gr-change-actions
+              id="actions"
               change="[[_change]]"
+              disable-edit="[[disableEdit]]"
               has-parent="[[hasParent]]"
               actions="[[_change.actions]]"
               revision-actions="[[_currentRevisionActions]]"
diff --git a/polygerrit-ui/app/elements/change/gr-change-view/gr-change-view.js b/polygerrit-ui/app/elements/change/gr-change-view/gr-change-view.js
index ebd72ad..4d54161 100644
--- a/polygerrit-ui/app/elements/change/gr-change-view/gr-change-view.js
+++ b/polygerrit-ui/app/elements/change/gr-change-view/gr-change-view.js
@@ -102,6 +102,10 @@
         type: Object,
         value() { return document.body; },
       },
+      disableEdit: {
+        type: Boolean,
+        value: false,
+      },
       _commentThreads: Array,
       /** @type {?} */
       _serverConfig: {
diff --git a/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header.html b/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header.html
index 89b3548..9822860 100644
--- a/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header.html
+++ b/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header.html
@@ -112,12 +112,14 @@
         margin: 5px 4px;
         text-decoration: none;
       }
+      .invisible,
       .settingsButton,
       gr-account-dropdown {
         display: none;
       }
       :host([loading]) .accountContainer,
-      :host([logged-in]) .loginButton {
+      :host([logged-in]) .loginButton,
+      :host([logged-in]) .registerButton {
         display: none;
       }
       :host([logged-in]) .settingsButton,
@@ -135,7 +137,7 @@
         text-overflow: ellipsis;
         white-space: nowrap;
       }
-      .loginButton {
+      .loginButton, .registerButton {
         color: var(--header-text-color);
         padding: .5em 1em;
       }
@@ -194,6 +196,13 @@
             class="hideOnMobile"
             name="header-browse-source"></gr-endpoint-decorator>
         <div class="accountContainer" id="accountContainer">
+          <div class$="[[_computeIsInvisible(_registerURL)]]">
+            <a
+                class="registerButton"
+                href$="[[_registerURL]]">
+              [[_registerText]]
+            </a>
+          </div>
           <a class="loginButton" href$="[[_loginURL]]">Sign in</a>
           <a
               class="settingsButton"
diff --git a/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header.js b/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header.js
index dad7b7c..738d29e 100644
--- a/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header.js
+++ b/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header.js
@@ -62,6 +62,13 @@
     },
   ];
 
+  // Set of authentication methods that can provide custom registration page.
+  const AUTH_TYPES_WITH_REGISTER_URL = new Set([
+    'LDAP',
+    'LDAP_BIND',
+    'CUSTOM_EXTENSION',
+  ]);
+
   Polymer({
     is: 'gr-main-header',
 
@@ -102,7 +109,7 @@
       _links: {
         type: Array,
         computed: '_computeLinks(_defaultLinks, _userLinks, _adminLinks, ' +
-            '_docBaseUrl)',
+            '_topMenus, _docBaseUrl)',
       },
       _loginURL: {
         type: String,
@@ -112,6 +119,18 @@
         type: Array,
         value() { return []; },
       },
+      _topMenus: {
+        type: Array,
+        value() { return []; },
+      },
+      _registerText: {
+        type: String,
+        value: 'Sign up',
+      },
+      _registerURL: {
+        type: String,
+        value: null,
+      },
     },
 
     behaviors: [
@@ -159,7 +178,7 @@
       return '//' + window.location.host + this.getBaseUrl() + path;
     },
 
-    _computeLinks(defaultLinks, userLinks, adminLinks, docBaseUrl) {
+    _computeLinks(defaultLinks, userLinks, adminLinks, topMenus, docBaseUrl) {
       const links = defaultLinks.slice();
       if (userLinks && userLinks.length > 0) {
         links.push({
@@ -179,6 +198,12 @@
         title: 'Browse',
         links: adminLinks,
       });
+      for (const m of topMenus) {
+        links.push({
+          title: m.name,
+          links: m.items.map(this._fixCustomMenuItem),
+        });
+      }
       return links;
     },
 
@@ -203,6 +228,7 @@
       this.loading = true;
       const promises = [
         this.$.restAPI.getAccount(),
+        this.$.restAPI.getTopMenus(),
         Gerrit.awaitPluginsLoaded(),
       ];
 
@@ -211,6 +237,7 @@
         this._account = account;
         this.loggedIn = !!account;
         this.loading = false;
+        this._topMenus = result[1];
 
         return this.getAdminLinks(account,
             this.$.restAPI.getAccountCapabilities.bind(this.$.restAPI),
@@ -223,7 +250,10 @@
 
     _loadConfig() {
       this.$.restAPI.getConfig()
-          .then(config => this.getDocsBaseUrl(config, this.$.restAPI))
+          .then(config => {
+            this._retrieveRegisterURL(config);
+            return this.getDocsBaseUrl(config, this.$.restAPI);
+          })
           .then(docBaseUrl => { this._docBaseUrl = docBaseUrl; });
     },
 
@@ -232,11 +262,24 @@
 
       this.$.restAPI.getPreferences().then(prefs => {
         this._userLinks =
-            prefs.my.map(this._fixMyMenuItem).filter(this._isSupportedLink);
+            prefs.my.map(this._fixCustomMenuItem).filter(this._isSupportedLink);
       });
     },
 
-    _fixMyMenuItem(linkObj) {
+    _retrieveRegisterURL(config) {
+      if (AUTH_TYPES_WITH_REGISTER_URL.has(config.auth.auth_type)) {
+        this._registerURL = config.auth.register_url;
+        if (config.auth.register_text) {
+          this._registerText = config.auth.register_text;
+        }
+      }
+    },
+
+    _computeIsInvisible(registerURL) {
+      return registerURL ? '' : 'invisible';
+    },
+
+    _fixCustomMenuItem(linkObj) {
       // Normalize all urls to PolyGerrit style.
       if (linkObj.url.startsWith('#')) {
         linkObj.url = linkObj.url.slice(1);
@@ -251,7 +294,7 @@
       // so we'll just disable it altogether for now.
       delete linkObj.target;
 
-      // Becasue the "my menu" links may be arbitrary URLs, we don't know
+      // Because the user provided links may be arbitrary URLs, we don't know
       // whether they correspond to any client routes. Mark all such links as
       // external.
       linkObj.external = true;
diff --git a/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header_test.html b/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header_test.html
index 30e8e1f..b6e64ec 100644
--- a/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header_test.html
+++ b/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header_test.html
@@ -63,6 +63,8 @@
           'none');
       assert.notEqual(getComputedStyle(element.$$('.loginButton')).display,
           'none');
+      assert.notEqual(getComputedStyle(element.$$('.registerButton')).display,
+          'none');
       assert.equal(getComputedStyle(element.$$('gr-account-dropdown')).display,
           'none');
       assert.equal(getComputedStyle(element.$$('.settingsButton')).display,
@@ -70,6 +72,8 @@
       element.loggedIn = true;
       assert.equal(getComputedStyle(element.$$('.loginButton')).display,
           'none');
+      assert.equal(getComputedStyle(element.$$('.registerButton')).display,
+          'none');
       assert.notEqual(getComputedStyle(element.$$('gr-account-dropdown'))
           .display,
           'none');
@@ -81,7 +85,7 @@
       assert.deepEqual([
         {url: 'https://awesometown.com/#hashyhash'},
         {url: 'url', target: '_blank'},
-      ].map(element._fixMyMenuItem), [
+      ].map(element._fixCustomMenuItem), [
         {url: 'https://awesometown.com/#hashyhash', external: true},
         {url: 'url', external: true},
       ]);
@@ -98,7 +102,6 @@
       ]);
     });
 
-
     test('user links', () => {
       const defaultLinks = [{
         title: 'Faves',
@@ -117,13 +120,13 @@
       }];
 
       // When no admin links are passed, it should use the default.
-      assert.deepEqual(element._computeLinks(defaultLinks, [], adminLinks),
+      assert.deepEqual(element._computeLinks(defaultLinks, [], adminLinks, []),
           defaultLinks.concat({
             title: 'Browse',
             links: adminLinks,
           }));
       assert.deepEqual(
-          element._computeLinks(defaultLinks, userLinks, adminLinks),
+          element._computeLinks(defaultLinks, userLinks, adminLinks, []),
           defaultLinks.concat([
             {
               title: 'Your',
@@ -160,5 +163,61 @@
         url: 'base/index.html',
       }]);
     });
+
+    test('top menus', () => {
+      const adminLinks = [{
+        name: 'Repos',
+        url: '/repos',
+      }];
+      const topMenus = [{
+        name: 'Plugins',
+        items: [{
+          name: 'Manage',
+          target: '_blank',
+          url: 'https://gerrit/plugins/plugin-manager/static/index.html',
+        }],
+      }];
+      assert.deepEqual(element._computeLinks([], [], adminLinks, topMenus), [{
+        title: 'Browse',
+        links: adminLinks,
+      },
+      {
+        title: 'Plugins',
+        links: [{
+          name: 'Manage',
+          external: true,
+          url: 'https://gerrit/plugins/plugin-manager/static/index.html',
+        }],
+      }]);
+    });
+
+    test('register URL', () => {
+      const config = {
+        auth: {
+          auth_type: 'LDAP',
+          register_url: 'https//gerrit.example.com/register',
+        },
+      };
+      element._retrieveRegisterURL(config);
+      assert.equal(element._registerURL, config.auth.register_url);
+      assert.equal(element._registerText, 'Sign up');
+
+      config.auth.register_text = 'Create account';
+      element._retrieveRegisterURL(config);
+      assert.equal(element._registerURL, config.auth.register_url);
+      assert.equal(element._registerText, config.auth.register_text);
+    });
+
+    test('register URL ignored for wrong auth type', () => {
+      const config = {
+        auth: {
+          auth_type: 'OPENID',
+          register_url: 'https//gerrit.example.com/register',
+        },
+      };
+      element._retrieveRegisterURL(config);
+      assert.equal(element._registerURL, null);
+      assert.equal(element._registerText, 'Sign up');
+    });
   });
 </script>
diff --git a/polygerrit-ui/app/elements/core/gr-navigation/gr-navigation.html b/polygerrit-ui/app/elements/core/gr-navigation/gr-navigation.html
index f1dd55b..05cda9b 100644
--- a/polygerrit-ui/app/elements/core/gr-navigation/gr-navigation.html
+++ b/polygerrit-ui/app/elements/core/gr-navigation/gr-navigation.html
@@ -110,7 +110,8 @@
       {
         // Changes that are assigned to the viewed user.
         name: 'Assigned reviews',
-        query: 'assignee:${user} (-is:wip OR owner:self OR assignee:self)',
+        query: 'assignee:${user} (-is:wip OR owner:self OR assignee:self) ' +
+            'is:open -is:ignored',
         hideIfEmpty: true,
       },
       {
diff --git a/polygerrit-ui/app/elements/shared/gr-dropdown/gr-dropdown.html b/polygerrit-ui/app/elements/shared/gr-dropdown/gr-dropdown.html
index f527aa3..58e3125 100644
--- a/polygerrit-ui/app/elements/shared/gr-dropdown/gr-dropdown.html
+++ b/polygerrit-ui/app/elements/shared/gr-dropdown/gr-dropdown.html
@@ -102,7 +102,7 @@
         class="dropdown-trigger" id="trigger"
         down-arrow="[[downArrow]]"
         on-tap="_dropdownTriggerTapHandler">
-      <content></content>
+      <slot></slot>
     </gr-button>
     <iron-dropdown id="dropdown"
         vertical-align="top"
diff --git a/polygerrit-ui/app/elements/shared/gr-rest-api-interface/gr-rest-api-interface.js b/polygerrit-ui/app/elements/shared/gr-rest-api-interface/gr-rest-api-interface.js
index b4f8d8d..0b90cdf 100644
--- a/polygerrit-ui/app/elements/shared/gr-rest-api-interface/gr-rest-api-interface.js
+++ b/polygerrit-ui/app/elements/shared/gr-rest-api-interface/gr-rest-api-interface.js
@@ -2640,6 +2640,14 @@
       });
     },
 
+    getTopMenus(opt_errFn) {
+      return this._fetchJSON({
+        url: '/config/server/top-menus',
+        errFn: opt_errFn,
+        reportUrlAsIs: true,
+      });
+    },
+
     setAssignee(changeNum, assignee) {
       return this._getChangeURLAndSend({
         changeNum,
@@ -2930,7 +2938,7 @@
       return this._send({
         method: 'POST',
         url: '/accounts/self/drafts:delete',
-        query,
+        body: {query},
       });
     },
   });
diff --git a/polygerrit-ui/app/styles/themes/dark-theme.html b/polygerrit-ui/app/styles/themes/dark-theme.html
index 8ade9ba..6037a88 100644
--- a/polygerrit-ui/app/styles/themes/dark-theme.html
+++ b/polygerrit-ui/app/styles/themes/dark-theme.html
@@ -5,7 +5,7 @@
       --view-background-color: #212121;
       --border-color: #555555;
       --table-header-background-color: #353637;
-      --table-subheader-background-color: rgb(23, 27, 31);
+      --table-subheader-background-color: rgb(19, 20, 22);
       --header-background-color: #5487E5;
       --header-text-color: var(--primary-text-color);
       --deemphasized-text-color: #9a9a9a;
@@ -83,4 +83,4 @@
       background-color: var(--view-background-color);
     }
   </style>
-</dom-module>
\ No newline at end of file
+</dom-module>
diff --git a/tools/bzl/junit.bzl b/tools/bzl/junit.bzl
index d711356..08d5045 100644
--- a/tools/bzl/junit.bzl
+++ b/tools/bzl/junit.bzl
@@ -64,6 +64,14 @@
     implementation = _impl,
 )
 
+POST_JDK8_OPTS = [
+    # Enforce JDK 8 compatibility on Java 9, see
+    # https://docs.oracle.com/javase/9/intl/internationalization-enhancements-jdk-9.htm#JSINT-GUID-AF5AECA7-07C1-4E7D-BC10-BC7E73DC6C7F
+    "-Djava.locale.providers=COMPAT,CLDR,SPI",
+    "--add-modules java.activation",
+    "--add-opens=jdk.management/com.sun.management.internal=ALL-UNNAMED",
+]
+
 def junit_tests(name, srcs, **kwargs):
     s_name = name + "TestSuite"
     _GenSuite(
@@ -73,13 +81,8 @@
     )
     jvm_flags = kwargs.get("jvm_flags", [])
     jvm_flags = jvm_flags + select({
-        "//:java9": [
-            # Enforce JDK 8 compatibility on Java 9, see
-            # https://docs.oracle.com/javase/9/intl/internationalization-enhancements-jdk-9.htm#JSINT-GUID-AF5AECA7-07C1-4E7D-BC10-BC7E73DC6C7F
-            "-Djava.locale.providers=COMPAT,CLDR,SPI",
-            "--add-modules java.activation",
-            "--add-opens=jdk.management/com.sun.management.internal=ALL-UNNAMED",
-        ],
+        "//:java9": POST_JDK8_OPTS,
+        "//:java10": POST_JDK8_OPTS,
         "//conditions:default": [],
     })
     native.java_test(
diff --git a/tools/eclipse/project.py b/tools/eclipse/project.py
index 64d837a..e515a3a 100755
--- a/tools/eclipse/project.py
+++ b/tools/eclipse/project.py
@@ -53,21 +53,29 @@
 opts.add_option('-b', '--batch', action='store_true',
                 dest='batch', help='Bazel batch option')
 opts.add_option('-j', '--java', action='store',
-                dest='java', help='Post Java 8 support (9|10|11|...)')
+                dest='java', help='Post Java 8 support (9)')
+opts.add_option('-e', '--edge_java', action='store',
+                dest='edge_java', help='Post Java 9 support (10|11|...)')
 args, _ = opts.parse_args()
 
 batch_option = '--batch' if args.batch else None
 custom_java = args.java
+edge_java = args.edge_java
 
 def _build_bazel_cmd(*args):
+    build = False
     cmd = ['bazel']
     if batch_option:
         cmd.append('--batch')
     for arg in args:
+        if arg == "build":
+            build = True
         cmd.append(arg)
-    if custom_java:
+    if custom_java and not edge_java:
         cmd.append('--host_java_toolchain=@bazel_tools//tools/jdk:toolchain_java%s' % custom_java)
         cmd.append('--java_toolchain=@bazel_tools//tools/jdk:toolchain_java%s' % custom_java)
+        if edge_java and build:
+            cmd.append(edge_java)
     return cmd