diff --git a/Documentation/config-accounts.txt b/Documentation/config-accounts.txt
index 6378632..51d8cec 100644
--- a/Documentation/config-accounts.txt
+++ b/Documentation/config-accounts.txt
@@ -296,6 +296,11 @@
 an external ID is used only once (e.g. an external ID can never be
 assigned to multiple accounts at a point in time).
 
+[IMPORTANT]
+If the external ID key is changed manually you must adapt the note key
+to the new SHA1. Otherwise the external ID becomes inconsistent and is
+ignored by Gerrit.
+
 The note content is a Git config file:
 
 ----
diff --git a/Documentation/config-gerrit.txt b/Documentation/config-gerrit.txt
index 0108a04..4e43ca7 100644
--- a/Documentation/config-gerrit.txt
+++ b/Documentation/config-gerrit.txt
@@ -616,7 +616,10 @@
 existing accounts this username is already in lower case. It is not
 possible to convert the usernames of the existing accounts to lower
 case because this would break the access to existing per-user
-branches.
+branches and Gerrit provides no tool to do such a conversion.
++
+Setting this parameter to `true` will prevent all users from login that
+have a non-lower-case username.
 +
 This parameter only affects git over http and git over SSH traffic.
 +
diff --git a/Documentation/intro-how-gerrit-works.txt b/Documentation/intro-how-gerrit-works.txt
index 2df42d4..5f5deed 100644
--- a/Documentation/intro-how-gerrit-works.txt
+++ b/Documentation/intro-how-gerrit-works.txt
@@ -1,32 +1,33 @@
 = How Gerrit Works
 
-To learn how Gerrit fits into and complements the developer workflow, consider a
-typical project. The following project contains a central source repository
+To learn how Gerrit fits into and complements the developer workflow, consider
+a typical project. The following project contains a central source repository
 (_Authoritative Repository_) that serves as the authoritative version of the
 project's contents.
 
-.Central Source Repository image::images/intro-quick-central-
-repo.png[Authoritative Source Repository]
+.Central Source Repository
+image::images/intro-quick-central-repo.png[Authoritative Source Repository]
 
-When implemented, Gerrit becomes the central source repository and introduces an
-additional concept: a store of _Pending Changes_.
+When implemented, Gerrit becomes the central source repository and introduces
+an additional concept: a store of _Pending Changes_.
 
-.Gerrit as the Central Repository image::images/intro-quick-central-
-gerrit.png[Gerrit in place of Central Repository]
+.Gerrit as the Central Repository
+image::images/intro-quick-central-gerrit.png[Gerrit as the Central Repository]
 
-When Gerrit is configured as the central source repository, all code changes are
-sent to Pending Changes for others to review and discuss. When enough reviewers
-have approved a code change, you can submit the change to the code base.
+When Gerrit is configured as the central source repository, all code changes
+are sent to Pending Changes for others to review and discuss. When enough
+reviewers have approved a code change, you can submit the change to the code
+base.
 
 In addition to the store of Pending Changes, Gerrit captures notes and comments
 made about each change. This enables you to review changes at your convenience
-or when a conversation about a change can't happen in person. In addition, notes
-and comments provide a history of each change (what was changed and why and who
-reviewed the change).
+or when a conversation about a change can't happen in person. In addition,
+notes and comments provide a history of each change (what was changed and why and
+who reviewed the change).
 
-Like any repository hosting product, Gerrit provides a powerful link:access-
-control.html[access control model], which enables you to fine-tune access to
-your repository.
+Like any repository hosting product, Gerrit provides a powerful
+link:access-control.html[access control model], which enables you to
+fine-tune access to your repository.
 
 GERRIT
 ------
diff --git a/Documentation/pgm-LocalUsernamesToLowerCase.txt b/Documentation/pgm-LocalUsernamesToLowerCase.txt
index 03aaabf..4b50961 100644
--- a/Documentation/pgm-LocalUsernamesToLowerCase.txt
+++ b/Documentation/pgm-LocalUsernamesToLowerCase.txt
@@ -14,7 +14,11 @@
 == DESCRIPTION
 Converts the local username for every account to lower case. The
 local username is the username that is used to login into the Gerrit
-Web UI.
+Web UI. The local username is stored a external ID with scheme
+`gerrit`.
+
+[IMPORTANT]
+This program does not modify usernames in the `username` scheme.
 
 This task is only intended to be run if the configuration parameter
 link:config-gerrit.html#ldap.localUsernameToLowerCase[ldap.localUsernameToLowerCase]
diff --git a/WORKSPACE b/WORKSPACE
index dca68d3..7d7b9b1 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -30,7 +30,7 @@
 
 load("@bazel_skylib//:lib.bzl", "versions")
 
-versions.check(minimum_bazel_version = "0.14.0")
+versions.check(minimum_bazel_version = "0.17.1")
 
 load("@io_bazel_rules_closure//closure:defs.bzl", "closure_repositories")
 
@@ -1038,8 +1038,8 @@
 
 maven_jar(
     name = "elasticsearch-rest-client",
-    artifact = "org.elasticsearch.client:elasticsearch-rest-client:6.4.0",
-    sha1 = "0eaa13decb9796eb671c5841d0770ae68b348da5",
+    artifact = "org.elasticsearch.client:elasticsearch-rest-client:6.4.1",
+    sha1 = "b5b52703e8d798a71e1269c2eda585dff720436f",
 )
 
 JACKSON_VERSION = "2.8.9"
diff --git a/java/com/google/gerrit/acceptance/ProjectResetter.java b/java/com/google/gerrit/acceptance/ProjectResetter.java
index 1fed8f8..76ae4b0 100644
--- a/java/com/google/gerrit/acceptance/ProjectResetter.java
+++ b/java/com/google/gerrit/acceptance/ProjectResetter.java
@@ -214,7 +214,7 @@
     for (Map.Entry<Project.NameKey, Collection<String>> e :
         refsPatternByProject.asMap().entrySet()) {
       try (Repository repo = repoManager.openRepository(e.getKey())) {
-        Collection<Ref> refs = repo.getAllRefs().values();
+        Collection<Ref> refs = repo.getRefDatabase().getRefs();
         for (String refPattern : e.getValue()) {
           RefPatternMatcher matcher = RefPatternMatcher.getMatcher(refPattern);
           for (Ref ref : refs) {
diff --git a/java/com/google/gerrit/common/data/GlobalCapability.java b/java/com/google/gerrit/common/data/GlobalCapability.java
index e613d21..3e11256 100644
--- a/java/com/google/gerrit/common/data/GlobalCapability.java
+++ b/java/com/google/gerrit/common/data/GlobalCapability.java
@@ -90,6 +90,9 @@
   /** Default result limit per executed query. */
   public static final int DEFAULT_MAX_QUERY_LIMIT = 500;
 
+  /** Can impersonate any user to see which refs they can read. */
+  public static final String READ_AS = "readAs";
+
   /** Ability to impersonate another user. */
   public static final String RUN_AS = "runAs";
 
@@ -138,6 +141,7 @@
     NAMES_ALL.add(MODIFY_ACCOUNT);
     NAMES_ALL.add(PRIORITY);
     NAMES_ALL.add(QUERY_LIMIT);
+    NAMES_ALL.add(READ_AS);
     NAMES_ALL.add(RUN_AS);
     NAMES_ALL.add(RUN_GC);
     NAMES_ALL.add(STREAM_EVENTS);
diff --git a/java/com/google/gerrit/httpd/raw/IndexServlet.java b/java/com/google/gerrit/httpd/raw/IndexServlet.java
index 90b25d9..a414e84 100644
--- a/java/com/google/gerrit/httpd/raw/IndexServlet.java
+++ b/java/com/google/gerrit/httpd/raw/IndexServlet.java
@@ -37,7 +37,8 @@
   private static final long serialVersionUID = 1L;
   protected final byte[] indexSource;
 
-  IndexServlet(String canonicalURL, @Nullable String cdnPath, @Nullable String faviconPath)
+  IndexServlet(
+      @Nullable String canonicalURL, @Nullable String cdnPath, @Nullable String faviconPath)
       throws URISyntaxException {
     String resourcePath = "com/google/gerrit/httpd/raw/PolyGerritIndexHtml.soy";
     SoyFileSet.Builder builder = SoyFileSet.builder();
@@ -62,7 +63,7 @@
     }
   }
 
-  static String computeCanonicalPath(String canonicalURL) throws URISyntaxException {
+  static String computeCanonicalPath(@Nullable String canonicalURL) throws URISyntaxException {
     if (Strings.isNullOrEmpty(canonicalURL)) {
       return "";
     }
diff --git a/java/com/google/gerrit/server/account/CapabilityCollection.java b/java/com/google/gerrit/server/account/CapabilityCollection.java
index ee74f47..1abc33f 100644
--- a/java/com/google/gerrit/server/account/CapabilityCollection.java
+++ b/java/com/google/gerrit/server/account/CapabilityCollection.java
@@ -48,6 +48,7 @@
   public final ImmutableList<PermissionRule> batchChangesLimit;
   public final ImmutableList<PermissionRule> emailReviewers;
   public final ImmutableList<PermissionRule> priority;
+  public final ImmutableList<PermissionRule> readAs;
   public final ImmutableList<PermissionRule> queryLimit;
   public final ImmutableList<PermissionRule> createGroup;
 
@@ -97,6 +98,7 @@
     batchChangesLimit = getPermission(GlobalCapability.BATCH_CHANGES_LIMIT);
     emailReviewers = getPermission(GlobalCapability.EMAIL_REVIEWERS);
     priority = getPermission(GlobalCapability.PRIORITY);
+    readAs = getPermission(GlobalCapability.READ_AS);
     queryLimit = getPermission(GlobalCapability.QUERY_LIMIT);
     createGroup = getPermission(GlobalCapability.CREATE_GROUP);
   }
diff --git a/java/com/google/gerrit/server/config/CapabilityConstants.java b/java/com/google/gerrit/server/config/CapabilityConstants.java
index 961dbbd..4ab97f8 100644
--- a/java/com/google/gerrit/server/config/CapabilityConstants.java
+++ b/java/com/google/gerrit/server/config/CapabilityConstants.java
@@ -34,6 +34,7 @@
   public String maintainServer;
   public String modifyAccount;
   public String priority;
+  public String readAs;
   public String queryLimit;
   public String runAs;
   public String runGC;
diff --git a/java/com/google/gerrit/server/patch/PatchListEntry.java b/java/com/google/gerrit/server/patch/PatchListEntry.java
index 325f78d..6b1a153 100644
--- a/java/com/google/gerrit/server/patch/PatchListEntry.java
+++ b/java/com/google/gerrit/server/patch/PatchListEntry.java
@@ -26,6 +26,7 @@
 import static com.google.gerrit.server.ioutil.BasicSerialization.writeFixInt64;
 import static com.google.gerrit.server.ioutil.BasicSerialization.writeString;
 import static com.google.gerrit.server.ioutil.BasicSerialization.writeVarInt32;
+import static java.nio.charset.StandardCharsets.UTF_8;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
@@ -41,7 +42,6 @@
 import java.util.List;
 import java.util.Set;
 import org.eclipse.jgit.diff.Edit;
-import org.eclipse.jgit.lib.Constants;
 import org.eclipse.jgit.patch.CombinedFileHeader;
 import org.eclipse.jgit.patch.FileHeader;
 import org.eclipse.jgit.util.IntList;
@@ -223,7 +223,7 @@
       if (header[e - 1] == '\n') {
         e--;
       }
-      headerLines.add(RawParseUtils.decode(Constants.CHARSET, header, b, e));
+      headerLines.add(RawParseUtils.decode(UTF_8, header, b, e));
     }
     return headerLines;
   }
diff --git a/java/com/google/gerrit/server/permissions/DefaultPermissionBackend.java b/java/com/google/gerrit/server/permissions/DefaultPermissionBackend.java
index 51a0f95..8cf9444 100644
--- a/java/com/google/gerrit/server/permissions/DefaultPermissionBackend.java
+++ b/java/com/google/gerrit/server/permissions/DefaultPermissionBackend.java
@@ -172,6 +172,7 @@
         case CREATE_PROJECT:
         case MAINTAIN_SERVER:
         case MODIFY_ACCOUNT:
+        case READ_AS:
         case STREAM_EVENTS:
         case VIEW_ALL_ACCOUNTS:
         case VIEW_CONNECTIONS:
diff --git a/java/com/google/gerrit/server/permissions/DefaultPermissionMappings.java b/java/com/google/gerrit/server/permissions/DefaultPermissionMappings.java
index 9593521..cee42ad 100644
--- a/java/com/google/gerrit/server/permissions/DefaultPermissionMappings.java
+++ b/java/com/google/gerrit/server/permissions/DefaultPermissionMappings.java
@@ -50,6 +50,7 @@
           .put(GlobalPermission.KILL_TASK, GlobalCapability.KILL_TASK)
           .put(GlobalPermission.MAINTAIN_SERVER, GlobalCapability.MAINTAIN_SERVER)
           .put(GlobalPermission.MODIFY_ACCOUNT, GlobalCapability.MODIFY_ACCOUNT)
+          .put(GlobalPermission.READ_AS, GlobalCapability.READ_AS)
           .put(GlobalPermission.RUN_AS, GlobalCapability.RUN_AS)
           .put(GlobalPermission.RUN_GC, GlobalCapability.RUN_GC)
           .put(GlobalPermission.STREAM_EVENTS, GlobalCapability.STREAM_EVENTS)
diff --git a/java/com/google/gerrit/server/permissions/GlobalPermission.java b/java/com/google/gerrit/server/permissions/GlobalPermission.java
index 01ef725..07c9e84 100644
--- a/java/com/google/gerrit/server/permissions/GlobalPermission.java
+++ b/java/com/google/gerrit/server/permissions/GlobalPermission.java
@@ -43,6 +43,7 @@
   KILL_TASK,
   MAINTAIN_SERVER,
   MODIFY_ACCOUNT,
+  READ_AS,
   RUN_AS,
   RUN_GC,
   STREAM_EVENTS,
diff --git a/java/com/google/gerrit/server/permissions/ProjectControl.java b/java/com/google/gerrit/server/permissions/ProjectControl.java
index 46bf45f..787bee4 100644
--- a/java/com/google/gerrit/server/permissions/ProjectControl.java
+++ b/java/com/google/gerrit/server/permissions/ProjectControl.java
@@ -29,7 +29,6 @@
 import com.google.gerrit.reviewdb.client.RefNames;
 import com.google.gerrit.reviewdb.server.ReviewDb;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.account.GroupMembership;
 import com.google.gerrit.server.config.GitReceivePackGroups;
 import com.google.gerrit.server.config.GitUploadPackGroups;
@@ -70,7 +69,6 @@
   private final ChangeControl.Factory changeControlFactory;
   private final PermissionCollection.Factory permissionFilter;
   private final DefaultRefFilter.Factory refFilterFactory;
-  private final IdentifiedUser.GenericFactory identifiedUserFactory;
 
   private List<SectionMatcher> allSections;
   private Map<String, RefControl> refControls;
@@ -84,7 +82,6 @@
       ChangeControl.Factory changeControlFactory,
       PermissionBackend permissionBackend,
       DefaultRefFilter.Factory refFilterFactory,
-      IdentifiedUser.GenericFactory identifiedUserFactory,
       @Assisted CurrentUser who,
       @Assisted ProjectState ps) {
     this.changeControlFactory = changeControlFactory;
@@ -93,7 +90,6 @@
     this.permissionFilter = permissionFilter;
     this.permissionBackend = permissionBackend;
     this.refFilterFactory = refFilterFactory;
-    this.identifiedUserFactory = identifiedUserFactory;
     user = who;
     state = ps;
   }
@@ -122,7 +118,7 @@
     RefControl ctl = refControls.get(refName);
     if (ctl == null) {
       PermissionCollection relevant = permissionFilter.filter(access(), refName, user);
-      ctl = new RefControl(identifiedUserFactory, this, refName, relevant);
+      ctl = new RefControl(this, refName, relevant);
       refControls.put(refName, ctl);
     }
     return ctl;
diff --git a/java/com/google/gerrit/server/permissions/RefControl.java b/java/com/google/gerrit/server/permissions/RefControl.java
index b324e77..a3c8de5 100644
--- a/java/com/google/gerrit/server/permissions/RefControl.java
+++ b/java/com/google/gerrit/server/permissions/RefControl.java
@@ -27,7 +27,6 @@
 import com.google.gerrit.reviewdb.client.Project;
 import com.google.gerrit.reviewdb.client.RefNames;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.notedb.ChangeNotes;
 import com.google.gerrit.server.permissions.PermissionBackend.ForChange;
 import com.google.gerrit.server.permissions.PermissionBackend.ForRef;
@@ -44,7 +43,6 @@
 class RefControl {
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
-  private final IdentifiedUser.GenericFactory identifiedUserFactory;
   private final ProjectControl projectControl;
   private final String refName;
 
@@ -58,12 +56,7 @@
   private Boolean canForgeCommitter;
   private Boolean isVisible;
 
-  RefControl(
-      IdentifiedUser.GenericFactory identifiedUserFactory,
-      ProjectControl projectControl,
-      String ref,
-      PermissionCollection relevant) {
-    this.identifiedUserFactory = identifiedUserFactory;
+  RefControl(ProjectControl projectControl, String ref, PermissionCollection relevant) {
     this.projectControl = projectControl;
     this.refName = ref;
     this.relevant = relevant;
diff --git a/java/com/google/gerrit/server/submit/GitModules.java b/java/com/google/gerrit/server/submit/GitModules.java
index 1fccbdd..f616e92 100644
--- a/java/com/google/gerrit/server/submit/GitModules.java
+++ b/java/com/google/gerrit/server/submit/GitModules.java
@@ -77,14 +77,15 @@
           return;
         }
       }
-      BlobBasedConfig bbc;
+      BlobBasedConfig config;
       try {
-        bbc = new BlobBasedConfig(null, or.repo, commit, GIT_MODULES);
+        config = new BlobBasedConfig(null, or.repo, commit, GIT_MODULES);
       } catch (ConfigInvalidException e) {
         throw new IOException(
             "Could not read .gitmodules of super project: " + branch.getParentKey(), e);
       }
-      subscriptions = new SubmoduleSectionParser(bbc, canonicalWebUrl, branch).parseAllSections();
+      subscriptions =
+          new SubmoduleSectionParser(config, canonicalWebUrl, branch).parseAllSections();
     } catch (NoSuchProjectException e) {
       throw new IOException(e);
     }
diff --git a/java/com/google/gerrit/server/util/git/SubmoduleSectionParser.java b/java/com/google/gerrit/server/util/git/SubmoduleSectionParser.java
index a92b7fd..f05d1d7 100644
--- a/java/com/google/gerrit/server/util/git/SubmoduleSectionParser.java
+++ b/java/com/google/gerrit/server/util/git/SubmoduleSectionParser.java
@@ -43,20 +43,20 @@
  */
 public class SubmoduleSectionParser {
 
-  private final Config bbc;
+  private final Config config;
   private final String canonicalWebUrl;
   private final Branch.NameKey superProjectBranch;
 
   public SubmoduleSectionParser(
-      Config bbc, String canonicalWebUrl, Branch.NameKey superProjectBranch) {
-    this.bbc = bbc;
+      Config config, String canonicalWebUrl, Branch.NameKey superProjectBranch) {
+    this.config = config;
     this.canonicalWebUrl = canonicalWebUrl;
     this.superProjectBranch = superProjectBranch;
   }
 
   public Set<SubmoduleSubscription> parseAllSections() {
     Set<SubmoduleSubscription> parsedSubscriptions = new HashSet<>();
-    for (String id : bbc.getSubsections("submodule")) {
+    for (String id : config.getSubsections("submodule")) {
       final SubmoduleSubscription subscription = parse(id);
       if (subscription != null) {
         parsedSubscriptions.add(subscription);
@@ -66,9 +66,9 @@
   }
 
   private SubmoduleSubscription parse(String id) {
-    final String url = bbc.getString("submodule", id, "url");
-    final String path = bbc.getString("submodule", id, "path");
-    String branch = bbc.getString("submodule", id, "branch");
+    final String url = config.getString("submodule", id, "url");
+    final String path = config.getString("submodule", id, "path");
+    String branch = config.getString("submodule", id, "branch");
 
     try {
       if (url != null
diff --git a/java/com/google/gerrit/sshd/commands/LsUserRefs.java b/java/com/google/gerrit/sshd/commands/LsUserRefs.java
index 781679d..2c15e78 100644
--- a/java/com/google/gerrit/sshd/commands/LsUserRefs.java
+++ b/java/com/google/gerrit/sshd/commands/LsUserRefs.java
@@ -42,7 +42,7 @@
 import org.eclipse.jgit.lib.Repository;
 import org.kohsuke.args4j.Option;
 
-@RequiresCapability(GlobalCapability.ADMINISTRATE_SERVER)
+@RequiresCapability(GlobalCapability.READ_AS)
 @CommandMetaData(
     name = "ls-user-refs",
     description = "List refs visible to a specific user",
diff --git a/javatests/com/google/gerrit/acceptance/rest/account/CapabilityInfo.java b/javatests/com/google/gerrit/acceptance/rest/account/CapabilityInfo.java
index 5404fdd..1ca019e 100644
--- a/javatests/com/google/gerrit/acceptance/rest/account/CapabilityInfo.java
+++ b/javatests/com/google/gerrit/acceptance/rest/account/CapabilityInfo.java
@@ -28,6 +28,7 @@
   public boolean modifyAccount;
   public boolean priority;
   public QueryLimit queryLimit;
+  public boolean readAs;
   public boolean runAs;
   public boolean runGC;
   public boolean streamEvents;
diff --git a/javatests/com/google/gerrit/elasticsearch/ElasticContainer.java b/javatests/com/google/gerrit/elasticsearch/ElasticContainer.java
index 8b3c08f..b95a910 100644
--- a/javatests/com/google/gerrit/elasticsearch/ElasticContainer.java
+++ b/javatests/com/google/gerrit/elasticsearch/ElasticContainer.java
@@ -51,7 +51,7 @@
       case V6_3:
         return "docker.elastic.co/elasticsearch/elasticsearch-oss:6.3.2";
       case V6_4:
-        return "docker.elastic.co/elasticsearch/elasticsearch-oss:6.4.0";
+        return "docker.elastic.co/elasticsearch/elasticsearch-oss:6.4.1";
     }
     throw new IllegalStateException("No tests for version: " + version.name());
   }
diff --git a/javatests/com/google/gerrit/server/permissions/RefControlTest.java b/javatests/com/google/gerrit/server/permissions/RefControlTest.java
index 39896ed..31eee9f 100644
--- a/javatests/com/google/gerrit/server/permissions/RefControlTest.java
+++ b/javatests/com/google/gerrit/server/permissions/RefControlTest.java
@@ -47,7 +47,6 @@
 import com.google.gerrit.reviewdb.client.Project;
 import com.google.gerrit.reviewdb.server.ReviewDb;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.account.CapabilityCollection;
 import com.google.gerrit.server.account.GroupMembership;
 import com.google.gerrit.server.account.ListGroupMembership;
@@ -204,7 +203,6 @@
   @Inject private InMemoryDatabase schemaFactory;
   @Inject private ThreadLocalRequestContext requestContext;
   @Inject private DefaultRefFilter.Factory refFilterFactory;
-  @Inject private IdentifiedUser.GenericFactory identifiedUserFactory;
   @Inject private TransferConfig transferConfig;
 
   @Before
@@ -991,7 +989,6 @@
         changeControlFactory,
         permissionBackend,
         refFilterFactory,
-        identifiedUserFactory,
         new MockUser(name, memberOf),
         newProjectState(local));
   }
diff --git a/lib/jgit/jgit.bzl b/lib/jgit/jgit.bzl
index 7191901..816c3a3 100644
--- a/lib/jgit/jgit.bzl
+++ b/lib/jgit/jgit.bzl
@@ -1,6 +1,6 @@
 load("//tools/bzl:maven_jar.bzl", "GERRIT", "MAVEN_CENTRAL", "MAVEN_LOCAL", "maven_jar")
 
-_JGIT_VERS = "5.0.3.201809091024-r"
+_JGIT_VERS = "5.1.1.201809181055-r"
 
 _DOC_VERS = _JGIT_VERS  # Set to _JGIT_VERS unless using a snapshot
 
@@ -40,28 +40,28 @@
         name = "jgit-lib",
         artifact = "org.eclipse.jgit:org.eclipse.jgit:" + _JGIT_VERS,
         repository = _JGIT_REPO,
-        sha1 = "0afec2df3ff8835bc4d5c279d14fad0daae6dd93",
-        src_sha1 = "e2c978064e2a46b260bbda0d8c393ed741046420",
+        sha1 = "64dfe41b3c152bb9b7158b214e28467cb1217153",
+        src_sha1 = "ff6ab018897cf4213b905e156ac5930bad2bdff1",
         unsign = True,
     )
     maven_jar(
         name = "jgit-servlet",
         artifact = "org.eclipse.jgit:org.eclipse.jgit.http.server:" + _JGIT_VERS,
         repository = _JGIT_REPO,
-        sha1 = "8fb0f9b6c38ac6fce60f2ead740e03dd79c3c288",
+        sha1 = "22fd6827fbb6135efd813271185a91f8615538eb",
         unsign = True,
     )
     maven_jar(
         name = "jgit-archive",
         artifact = "org.eclipse.jgit:org.eclipse.jgit.archive:" + _JGIT_VERS,
         repository = _JGIT_REPO,
-        sha1 = "72a157ce261f3eb938d9e0ee83d7c9700aa7d736",
+        sha1 = "bfbbdd6aa1893db14f346913aad3f9898b2fe01d",
     )
     maven_jar(
         name = "jgit-junit",
         artifact = "org.eclipse.jgit:org.eclipse.jgit.junit:" + _JGIT_VERS,
         repository = _JGIT_REPO,
-        sha1 = "eb430358d96dedd923e4075cd54a7db4cab51ca2",
+        sha1 = "6de6de74053d7c28100fe128255d7382a939fe99",
         unsign = True,
     )
 
diff --git a/plugins/reviewnotes b/plugins/reviewnotes
index 920f28b..54525ff 160000
--- a/plugins/reviewnotes
+++ b/plugins/reviewnotes
@@ -1 +1 @@
-Subproject commit 920f28b46021d9c49fac09d869aa4040d13796e7
+Subproject commit 54525ffaed5e8925d97657a622532a00a0006347
diff --git a/polygerrit-ui/app/elements/change-list/gr-dashboard-view/gr-dashboard-view.js b/polygerrit-ui/app/elements/change-list/gr-dashboard-view/gr-dashboard-view.js
index aa87e0f..72ef0e5 100644
--- a/polygerrit-ui/app/elements/change-list/gr-dashboard-view/gr-dashboard-view.js
+++ b/polygerrit-ui/app/elements/change-list/gr-dashboard-view/gr-dashboard-view.js
@@ -27,10 +27,11 @@
     {
       // Changes with unpublished draft comments. This section is omitted when
       // viewing other users, so we don't need to filter anything out.
-      name: 'Has unpublished drafts',
+      name: 'Has draft comments',
       query: 'has:draft',
       selfOnly: true,
       hideIfEmpty: true,
+      suffixForDashboard: 'limit:10',
     },
     {
       // Changes that are assigned to the viewed user.
diff --git a/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header.html b/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header.html
index 5a4aaac..89b3548 100644
--- a/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header.html
+++ b/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header.html
@@ -53,6 +53,7 @@
         content: "";
         display: inline-block;
         height: var(--header-icon-size);
+        margin-right: calc(var(--header-icon-size) / 4);
         vertical-align: text-bottom;
         width: var(--header-icon-size);
       }
diff --git a/polygerrit-ui/app/elements/core/gr-reporting/gr-reporting.js b/polygerrit-ui/app/elements/core/gr-reporting/gr-reporting.js
index 3e886d5..36126e4 100644
--- a/polygerrit-ui/app/elements/core/gr-reporting/gr-reporting.js
+++ b/polygerrit-ui/app/elements/core/gr-reporting/gr-reporting.js
@@ -135,7 +135,9 @@
 
   GrJankDetector.start();
 
-  const GrReporting = Polymer({
+  // The Polymer pass of JSCompiler requires this to be reassignable
+  // eslint-disable-next-line prefer-const
+  let GrReporting = Polymer({
     is: 'gr-reporting',
 
     properties: {
diff --git a/polygerrit-ui/app/elements/diff/gr-ranged-comment-layer/gr-ranged-comment-layer.js b/polygerrit-ui/app/elements/diff/gr-ranged-comment-layer/gr-ranged-comment-layer.js
index 6c7903d..db14fc8 100644
--- a/polygerrit-ui/app/elements/diff/gr-ranged-comment-layer/gr-ranged-comment-layer.js
+++ b/polygerrit-ui/app/elements/diff/gr-ranged-comment-layer/gr-ranged-comment-layer.js
@@ -72,7 +72,7 @@
 
     /**
      * Register a listener for layer updates.
-     * @param {Function<Number, Number, String>} fn The update handler function.
+     * @param {function(number, number, string)} fn The update handler function.
      *     Should accept as arguments the line numbers for the start and end of
      *     the update and the side as a string.
      */
diff --git a/polygerrit-ui/app/elements/gr-app.html b/polygerrit-ui/app/elements/gr-app.html
index e7bd965..787a1c6 100644
--- a/polygerrit-ui/app/elements/gr-app.html
+++ b/polygerrit-ui/app/elements/gr-app.html
@@ -26,6 +26,10 @@
       passiveTouchGestures: true,
     };
   }
+  // Needed for JSCompiler to understand it's global.
+  // eslint-disable-next-line no-unused-vars, prefer-const
+  let Gerrit = window.Gerrit || {};
+  window.Gerrit = Gerrit;
 </script>
 
 <link rel="import" href="../bower_components/polymer/polymer.html">
diff --git a/polygerrit-ui/app/elements/shared/gr-js-api-interface/gr-annotation-actions-js-api.js b/polygerrit-ui/app/elements/shared/gr-js-api-interface/gr-annotation-actions-js-api.js
index cb8409e..47281c2 100644
--- a/polygerrit-ui/app/elements/shared/gr-js-api-interface/gr-annotation-actions-js-api.js
+++ b/polygerrit-ui/app/elements/shared/gr-js-api-interface/gr-annotation-actions-js-api.js
@@ -34,7 +34,7 @@
    * Register a function to call to apply annotations. Plugins should use
    * GrAnnotationActionsContext.annotateRange to apply a CSS class to a range
    * within a line.
-   * @param {Function<GrAnnotationActionsContext>} addLayerFunc The function
+   * @param {function(GrAnnotationActionsContext)} addLayerFunc The function
    *     that will be called when the AnnotationLayer is ready to annotate.
    */
   GrAnnotationActionsInterface.prototype.addLayer = function(addLayerFunc) {
@@ -45,7 +45,7 @@
   /**
    * The specified function will be called with a notify function for the plugin
    * to call when it has all required data for annotation. Optional.
-   * @param {Function<Function<String, Number, Number, String>>} notifyFunc See
+   * @param {function(function(String, Number, Number, String))} notifyFunc See
    *     doc of the notify function below to see what it does.
    */
   GrAnnotationActionsInterface.prototype.addNotifier = function(notifyFunc) {
@@ -68,7 +68,7 @@
    *
    * @param {String} checkboxLabel Will be used as the label for the checkbox.
    *     Optional. "Enable" is used if this is not specified.
-   * @param {Function<HTMLElement>} onAttached The function that will be called
+   * @param {function(HTMLElement)} onAttached The function that will be called
    *     when the checkbox is attached to the page.
    */
   GrAnnotationActionsInterface.prototype.enableToggleCheckbox = function(
@@ -134,7 +134,7 @@
    * @param {String} path The file path (eg: /COMMIT_MSG').
    * @param {String} changeNum The Gerrit change number.
    * @param {String} patchNum The Gerrit patch number.
-   * @param {Function<GrAnnotationActionsContext>} addLayerFunc The function
+   * @param {function(GrAnnotationActionsContext)} addLayerFunc The function
    *     that will be called when the AnnotationLayer is ready to annotate.
    */
   function AnnotationLayer(path, changeNum, patchNum, addLayerFunc) {
@@ -148,7 +148,7 @@
 
   /**
    * Register a listener for layer updates.
-   * @param {Function<Number, Number, String>} fn The update handler function.
+   * @param {function(Number, Number, String)} fn The update handler function.
    *     Should accept as arguments the line numbers for the start and end of
    *     the update and the side as a string.
    */
diff --git a/polygerrit-ui/app/embed/embed.html b/polygerrit-ui/app/embed/embed.html
index 9fb5c23..be4e2f3 100644
--- a/polygerrit-ui/app/embed/embed.html
+++ b/polygerrit-ui/app/embed/embed.html
@@ -14,6 +14,12 @@
 See the License for the specific language governing permissions and
 limitations under the License.
 -->
+<script>
+  // Needed for JSCompiler to understand it's global.
+  // eslint-disable-next-line no-unused-vars, prefer-const
+  let Gerrit = window.Gerrit || {};
+  window.Gerrit = Gerrit;
+</script>
 <link rel="import" href="../bower_components/polymer/polymer.html">
 <link rel="import" href="../elements/change/gr-change-view/gr-change-view.html">
 <link rel="import" href="../elements/core/gr-search-bar/gr-search-bar.html">
diff --git a/polygerrit-ui/app/gr-diff/gr-diff-root.html b/polygerrit-ui/app/gr-diff/gr-diff-root.html
new file mode 100644
index 0000000..132654c
--- /dev/null
+++ b/polygerrit-ui/app/gr-diff/gr-diff-root.html
@@ -0,0 +1,7 @@
+<script>
+  // Needed for JSCompiler to understand it's global.
+  // eslint-disable-next-line no-unused-vars, prefer-const
+  let Gerrit = window.Gerrit || {};
+  window.Gerrit = Gerrit;
+</script>
+<link rel="import" href="../elements/diff/gr-diff/gr-diff.html">
diff --git a/resources/com/google/gerrit/server/config/CapabilityConstants.properties b/resources/com/google/gerrit/server/config/CapabilityConstants.properties
index 6654837..ba590ee 100644
--- a/resources/com/google/gerrit/server/config/CapabilityConstants.properties
+++ b/resources/com/google/gerrit/server/config/CapabilityConstants.properties
@@ -10,6 +10,7 @@
 maintainServer = Maintain Server
 modifyAccount = Modify Account
 priority = Priority
+readAs = Read As
 queryLimit = Query Limit
 runAs = Run As
 runGC = Run Garbage Collection
diff --git a/tools/BUILD b/tools/BUILD
index 73ecfb9..c368eed 100644
--- a/tools/BUILD
+++ b/tools/BUILD
@@ -1,4 +1,8 @@
-load("@bazel_tools//tools/jdk:default_java_toolchain.bzl", "default_java_toolchain")
+load(
+    "@bazel_tools//tools/jdk:default_java_toolchain.bzl",
+    "JDK9_JVM_OPTS",
+    "default_java_toolchain",
+)
 
 py_binary(
     name = "merge_jars",
@@ -7,44 +11,10 @@
     visibility = ["//visibility:public"],
 )
 
-# TODO(davido): remove this when minimum suported Bazel version >= 0.17
-# Copied from tools/jdk/default_java_toolchain.bzl to make Bazel 0.16
-# and later Bazel released to work as expected. See this issue for context:
-# https://github.com/bazelbuild/bazel/issues/6009
-JDK9_JVM_OPTS = [
-    # Allow JavaBuilder to access internal javac APIs.
-    "--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED",
-    "--add-exports=jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED",
-    "--add-exports=jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED",
-    "--add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED",
-    "--add-exports=jdk.compiler/com.sun.tools.javac.main=ALL-UNNAMED",
-    "--add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED",
-    "--add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED",
-    "--add-opens=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED",
-
-    # override the javac in the JDK.
-    "--patch-module=java.compiler=$(location @bazel_tools//third_party/java/jdk/langtools:java_compiler_jar)",
-    "--patch-module=jdk.compiler=$(location @bazel_tools//third_party/java/jdk/langtools:jdk_compiler_jar)",
-
-    # quiet warnings from com.google.protobuf.UnsafeUtil,
-    # see: https://github.com/google/protobuf/issues/3781
-    "--add-opens=java.base/java.nio=ALL-UNNAMED",
-]
-
-# See https://github.com/bazelbuild/bazel/issues/3427 for more context
-default_java_toolchain(
-    name = "error_prone_warnings_toolchain_bazel_0.16",
-    bootclasspath = ["@bazel_tools//tools/jdk:platformclasspath.jar"],
-    jvm_opts = JDK9_JVM_OPTS,
-    package_configuration = [
-        ":error_prone",
-    ],
-    visibility = ["//visibility:public"],
-)
-
 default_java_toolchain(
     name = "error_prone_warnings_toolchain",
-    bootclasspath = ["@bazel_tools//tools/jdk:platformclasspath.jar"],
+    bootclasspath = ["@bazel_tools//tools/jdk:platformclasspath9.jar"],
+    jvm_opts = JDK9_JVM_OPTS,
     package_configuration = [
         ":error_prone",
     ],