chore(3p): gerrit: 3.4.0 -> 3.6.1 r/4817

This change cannot be deployed OOTB: you must upgrade
by 3.5.2+ first, and run copy-approvals.

Change-Id: Ia2e49da4d801a21a3db59e2d5b054eeb46d7dc79
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6505
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>

12 files changed, 125 insertions, 282 deletions

diff --git a/third_party/gerrit/0001-Syntax-highlight-nix.patch b/third_party/gerrit/0001-Syntax-highlight-nix.patch
new file mode 100644
index 000000000000..64eb38343225
--- /dev/null
+++ b/third_party/gerrit/0001-Syntax-highlight-nix.patch
@@ -0,0 +1,37 @@
+From fea4416001e5dd097d70166778fa55c6b20fae39 Mon Sep 17 00:00:00 2001
+From: Luke Granger-Brown <git@lukegb.com>
+Date: Thu, 2 Jul 2020 23:02:32 +0100
+Subject: [PATCH 1/3] Syntax highlight nix
+
+---
+ .../app/embed/diff/gr-syntax-layer/gr-syntax-layer-worker.ts     | 1 +
+ resources/com/google/gerrit/server/mime/mime-types.properties    | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/polygerrit-ui/app/embed/diff/gr-syntax-layer/gr-syntax-layer-worker.ts b/polygerrit-ui/app/embed/diff/gr-syntax-layer/gr-syntax-layer-worker.ts
+index 9938d3408d..f6f634ad31 100644
+--- a/polygerrit-ui/app/embed/diff/gr-syntax-layer/gr-syntax-layer-worker.ts
++++ b/polygerrit-ui/app/embed/diff/gr-syntax-layer/gr-syntax-layer-worker.ts
+@@ -93,6 +93,7 @@ const LANGUAGE_MAP = new Map<string, string>([
+   ['text/x-vhdl', 'vhdl'],
+   ['text/x-yaml', 'yaml'],
+   ['text/vbscript', 'vbscript'],
++  ['text/x-nix', 'nix'],
+ ]);
+ 
+ const CLASS_PREFIX = 'gr-diff gr-syntax gr-syntax-';
+diff --git a/resources/com/google/gerrit/server/mime/mime-types.properties b/resources/com/google/gerrit/server/mime/mime-types.properties
+index 5a08e66067..c0c092c712 100644
+--- a/resources/com/google/gerrit/server/mime/mime-types.properties
++++ b/resources/com/google/gerrit/server/mime/mime-types.properties
+@@ -149,6 +149,7 @@ mscin = text/x-mscgen
+ msgenny = text/x-msgenny
+ nb = text/x-mathematica
+ nginx.conf = text/x-nginx-conf
++nix = text/x-nix
+ nsh = text/x-nsis
+ nsi = text/x-nsis
+ nt = text/n-triples
+-- 
+2.36.0
+
diff --git a/third_party/gerrit/0001-Use-detzip-in-download_bower.py.patch b/third_party/gerrit/0001-Use-detzip-in-download_bower.py.patch
deleted file mode 100644
index 7d197795b725..000000000000
--- a/third_party/gerrit/0001-Use-detzip-in-download_bower.py.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 621cadcc1dd71e9397c21cf8cf0f1aae4f6f7057 Mon Sep 17 00:00:00 2001
-From: Luke Granger-Brown <git@lukegb.com>
-Date: Thu, 2 Jul 2020 23:02:09 +0100
-Subject: [PATCH 1/7] Use detzip in download_bower.py
-
----
- tools/js/download_bower.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tools/js/download_bower.py b/tools/js/download_bower.py
-index d541b565a9..ffdae60f95 100755
---- a/tools/js/download_bower.py
-+++ b/tools/js/download_bower.py
-@@ -110,7 +110,7 @@ def main():
-                 args.b, '--quiet', 'install', '%s#%s' % (args.p, args.v)))
-         bc = os.path.join(cwd, 'bower_components')
-         subprocess.check_call(
--            ['zip', '-q', '--exclude', '.bower.json', '-r', cached, args.n],
-+            ['detzip', '--exclude', '.bower.json', cached, args.n],
-             cwd=bc)
- 
-         if args.s:
--- 
-2.32.0
-
diff --git a/third_party/gerrit/0002-Syntax-highlight-nix.patch b/third_party/gerrit/0002-Syntax-highlight-nix.patch
deleted file mode 100644
index 256da0a3c930..000000000000
--- a/third_party/gerrit/0002-Syntax-highlight-nix.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 924647c354576ade0dc46fdf30596967f58bb4c6 Mon Sep 17 00:00:00 2001
-From: Luke Granger-Brown <git@lukegb.com>
-Date: Thu, 2 Jul 2020 23:02:32 +0100
-Subject: [PATCH 2/7] Syntax highlight nix
-
----
- .../app/elements/diff/gr-syntax-layer/gr-syntax-layer.ts         | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/polygerrit-ui/app/elements/diff/gr-syntax-layer/gr-syntax-layer.ts b/polygerrit-ui/app/elements/diff/gr-syntax-layer/gr-syntax-layer.ts
-index 081d28d749..2762ccc625 100644
---- a/polygerrit-ui/app/elements/diff/gr-syntax-layer/gr-syntax-layer.ts
-+++ b/polygerrit-ui/app/elements/diff/gr-syntax-layer/gr-syntax-layer.ts
-@@ -99,6 +99,7 @@ const LANGUAGE_MAP = new Map<string, string>([
-   ['text/x-vhdl', 'vhdl'],
-   ['text/x-yaml', 'yaml'],
-   ['text/vbscript', 'vbscript'],
-+  ['application/x-mix-transfer', 'nix'],
- ]);
- const ASYNC_DELAY = 10;
- 
--- 
-2.32.0
-
diff --git a/third_party/gerrit/0002-Syntax-highlight-rules.pl.patch b/third_party/gerrit/0002-Syntax-highlight-rules.pl.patch
new file mode 100644
index 000000000000..4cb859d1bd33
--- /dev/null
+++ b/third_party/gerrit/0002-Syntax-highlight-rules.pl.patch
@@ -0,0 +1,37 @@
+From ad3f389c20815f21ad932c0b295e861c6a21011c Mon Sep 17 00:00:00 2001
+From: Luke Granger-Brown <git@lukegb.com>
+Date: Thu, 2 Jul 2020 23:02:43 +0100
+Subject: [PATCH 2/3] Syntax highlight rules.pl
+
+---
+ .../app/embed/diff/gr-syntax-layer/gr-syntax-layer-worker.ts     | 1 +
+ resources/com/google/gerrit/server/mime/mime-types.properties    | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/polygerrit-ui/app/embed/diff/gr-syntax-layer/gr-syntax-layer-worker.ts b/polygerrit-ui/app/embed/diff/gr-syntax-layer/gr-syntax-layer-worker.ts
+index f6f634ad31..36fd6090b4 100644
+--- a/polygerrit-ui/app/embed/diff/gr-syntax-layer/gr-syntax-layer-worker.ts
++++ b/polygerrit-ui/app/embed/diff/gr-syntax-layer/gr-syntax-layer-worker.ts
+@@ -68,6 +68,7 @@ const LANGUAGE_MAP = new Map<string, string>([
+   ['text/x-perl', 'perl'],
+   ['text/x-pgsql', 'pgsql'], // postgresql
+   ['text/x-php', 'php'],
++  ['text/x-prolog', 'prolog'],
+   ['text/x-properties', 'properties'],
+   ['text/x-protobuf', 'protobuf'],
+   ['text/x-puppet', 'puppet'],
+diff --git a/resources/com/google/gerrit/server/mime/mime-types.properties b/resources/com/google/gerrit/server/mime/mime-types.properties
+index c0c092c712..ee815b689d 100644
+--- a/resources/com/google/gerrit/server/mime/mime-types.properties
++++ b/resources/com/google/gerrit/server/mime/mime-types.properties
+@@ -200,6 +200,7 @@ rq = application/sparql-query
+ rs = text/x-rustsrc
+ rss = application/xml
+ rst = text/x-rst
++rules.pl = text/x-prolog
+ README.md = text/x-gfm
+ s = text/x-gas
+ sas = text/x-sas
+-- 
+2.36.0
+
diff --git a/third_party/gerrit/0004-Add-titles-to-CLs-over-HTTP.patch b/third_party/gerrit/0003-Add-titles-to-CLs-over-HTTP.patch
index 8e78e5f535e3..d2b3e3541f5e 100644
--- a/third_party/gerrit/0004-Add-titles-to-CLs-over-HTTP.patch
+++ b/third_party/gerrit/0003-Add-titles-to-CLs-over-HTTP.patch
@@ -1,22 +1,22 @@
-From 32bf13d8316f93828d2ff47ccfca38d4e7a634b1 Mon Sep 17 00:00:00 2001
+From 585077e751107729b7a2dd495a3b17c677a3f528 Mon Sep 17 00:00:00 2001
 From: Luke Granger-Brown <git@lukegb.com>
 Date: Thu, 2 Jul 2020 23:03:02 +0100
-Subject: [PATCH 4/7] Add titles to CLs over HTTP
+Subject: [PATCH 3/3] Add titles to CLs over HTTP
 
 ---
  .../gerrit/httpd/raw/IndexHtmlUtil.java       | 13 +++-
  .../google/gerrit/httpd/raw/IndexServlet.java |  8 ++-
- .../google/gerrit/httpd/raw/StaticModule.java |  6 +-
+ .../google/gerrit/httpd/raw/StaticModule.java |  5 +-
  .../gerrit/httpd/raw/TitleComputer.java       | 67 +++++++++++++++++++
  .../gerrit/httpd/raw/PolyGerritIndexHtml.soy  |  4 +-
- 5 files changed, 90 insertions(+), 8 deletions(-)
+ 5 files changed, 89 insertions(+), 8 deletions(-)
  create mode 100644 java/com/google/gerrit/httpd/raw/TitleComputer.java
 
 diff --git a/java/com/google/gerrit/httpd/raw/IndexHtmlUtil.java b/java/com/google/gerrit/httpd/raw/IndexHtmlUtil.java
-index 8d52f5ad50..a9cfceb3b6 100644
+index ce22ae8e59..952ba1fef4 100644
 --- a/java/com/google/gerrit/httpd/raw/IndexHtmlUtil.java
 +++ b/java/com/google/gerrit/httpd/raw/IndexHtmlUtil.java
-@@ -39,6 +39,7 @@ import java.util.Arrays;
+@@ -40,6 +40,7 @@ import java.util.Arrays;
  import java.util.Collections;
  import java.util.HashMap;
  import java.util.Map;
@@ -24,7 +24,7 @@ index 8d52f5ad50..a9cfceb3b6 100644
  import java.util.Set;
  import java.util.function.Function;
  
-@@ -60,13 +61,14 @@ public class IndexHtmlUtil {
+@@ -61,13 +62,14 @@ public class IndexHtmlUtil {
        String faviconPath,
        Map<String, String[]> urlParameterMap,
        Function<String, SanitizedContent> urlInScriptTagOrdainer,
@@ -41,32 +41,32 @@ index 8d52f5ad50..a9cfceb3b6 100644
      Set<String> enabledExperiments = experimentFeatures.getEnabledExperimentFeatures();
  
      if (!enabledExperiments.isEmpty()) {
-@@ -77,7 +79,9 @@ public class IndexHtmlUtil {
+@@ -78,7 +80,8 @@ public class IndexHtmlUtil {
  
    /** Returns dynamic parameters of {@code index.html}. */
    public static ImmutableMap<String, Object> dynamicTemplateData(
 -      GerritApi gerritApi, String requestedURL) throws RestApiException, URISyntaxException {
-+      GerritApi gerritApi,
-+      String requestedURL,
-+      TitleComputer titleComputer) throws RestApiException, URISyntaxException {
++      GerritApi gerritApi, String requestedURL, TitleComputer titleComputer)
++		  throws RestApiException, URISyntaxException {
      ImmutableMap.Builder<String, Object> data = ImmutableMap.builder();
      Map<String, SanitizedContent> initialData = new HashMap<>();
      Server serverApi = gerritApi.config().server();
-@@ -128,6 +132,9 @@ public class IndexHtmlUtil {
-       // Don't render data
+@@ -131,6 +134,10 @@ public class IndexHtmlUtil {
      }
  
+     data.put("gerritInitialData", initialData);
++
 +    Optional<String> title = titleComputer.computeTitle(requestedURL);
 +    title.ifPresent(s -> data.put("title", s));
 +
-     data.put("gerritInitialData", initialData);
      return data.build();
    }
+ 
 diff --git a/java/com/google/gerrit/httpd/raw/IndexServlet.java b/java/com/google/gerrit/httpd/raw/IndexServlet.java
-index 3f2c2028ae..7861c007df 100644
+index fcb821e5ae..36eb0c990c 100644
 --- a/java/com/google/gerrit/httpd/raw/IndexServlet.java
 +++ b/java/com/google/gerrit/httpd/raw/IndexServlet.java
-@@ -46,13 +46,15 @@ public class IndexServlet extends HttpServlet {
+@@ -48,13 +48,15 @@ public class IndexServlet extends HttpServlet {
    private final ExperimentFeatures experimentFeatures;
    private final SoySauce soySauce;
    private final Function<String, SanitizedContent> urlOrdainer;
@@ -83,7 +83,7 @@ index 3f2c2028ae..7861c007df 100644
      this.canonicalUrl = canonicalUrl;
      this.cdnPath = cdnPath;
      this.faviconPath = faviconPath;
-@@ -67,6 +69,7 @@ public class IndexServlet extends HttpServlet {
+@@ -69,6 +71,7 @@ public class IndexServlet extends HttpServlet {
          (s) ->
              UnsafeSanitizedContentOrdainer.ordainAsSafe(
                  s, SanitizedContent.ContentKind.TRUSTED_RESOURCE_URI);
@@ -91,33 +91,31 @@ index 3f2c2028ae..7861c007df 100644
    }
  
    @Override
-@@ -85,7 +88,8 @@ public class IndexServlet extends HttpServlet {
+@@ -86,7 +89,8 @@ public class IndexServlet extends HttpServlet {
                faviconPath,
                parameterMap,
                urlOrdainer,
--              requestUrl);
-+              requestUrl,
-+              titleComputer);
+-              getRequestUrl(req));
++              getRequestUrl(req),
++	      titleComputer);
        renderer = soySauce.renderTemplate("com.google.gerrit.httpd.raw.Index").setData(templateData);
      } catch (URISyntaxException | RestApiException e) {
        throw new IOException(e);
 diff --git a/java/com/google/gerrit/httpd/raw/StaticModule.java b/java/com/google/gerrit/httpd/raw/StaticModule.java
-index bb1eb92525..6b20c504d2 100644
+index 8e8a9d27f0..a0fb168554 100644
 --- a/java/com/google/gerrit/httpd/raw/StaticModule.java
 +++ b/java/com/google/gerrit/httpd/raw/StaticModule.java
-@@ -224,11 +224,13 @@ public class StaticModule extends ServletModule {
+@@ -226,10 +226,11 @@ public class StaticModule extends ServletModule {
          @CanonicalWebUrl @Nullable String canonicalUrl,
          @GerritServerConfig Config cfg,
          GerritApi gerritApi,
 -        ExperimentFeatures experimentFeatures) {
 +        ExperimentFeatures experimentFeatures,
-+        TitleComputer titleComputer) {
-       String cdnPath =
-           options.useDevCdn() ? options.devCdn() : cfg.getString("gerrit", null, "cdnPath");
++	TitleComputer titleComputer) {
+       String cdnPath = options.devCdn().orElse(cfg.getString("gerrit", null, "cdnPath"));
        String faviconPath = cfg.getString("gerrit", null, "faviconPath");
 -      return new IndexServlet(canonicalUrl, cdnPath, faviconPath, gerritApi, experimentFeatures);
-+      return new IndexServlet(canonicalUrl, cdnPath, faviconPath, gerritApi,
-+          experimentFeatures, titleComputer);
++      return new IndexServlet(canonicalUrl, cdnPath, faviconPath, gerritApi, experimentFeatures, titleComputer);
      }
  
      @Provides
@@ -195,10 +193,10 @@ index 0000000000..8fd2053ad0
 +  }
 +}
 diff --git a/resources/com/google/gerrit/httpd/raw/PolyGerritIndexHtml.soy b/resources/com/google/gerrit/httpd/raw/PolyGerritIndexHtml.soy
-index 11717fb8a4..1ae9046360 100644
+index 8c97a49e81..129092dc7e 100644
 --- a/resources/com/google/gerrit/httpd/raw/PolyGerritIndexHtml.soy
 +++ b/resources/com/google/gerrit/httpd/raw/PolyGerritIndexHtml.soy
-@@ -33,10 +33,12 @@
+@@ -32,10 +32,12 @@
    {@param? defaultDashboardHex: ?}
    {@param? dashboardQuery: ?}
    {@param? userIsAuthenticated: ?}
@@ -213,5 +211,5 @@ index 11717fb8a4..1ae9046360 100644
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0">{\n}
  
 -- 
-2.32.0
+2.36.0
 
diff --git a/third_party/gerrit/0003-Syntax-highlight-rules.pl.patch b/third_party/gerrit/0003-Syntax-highlight-rules.pl.patch
deleted file mode 100644
index 02bb3397eabb..000000000000
--- a/third_party/gerrit/0003-Syntax-highlight-rules.pl.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From be348f64eda257ae0af1f89552548d3e8eca3688 Mon Sep 17 00:00:00 2001
-From: Luke Granger-Brown <git@lukegb.com>
-Date: Thu, 2 Jul 2020 23:02:43 +0100
-Subject: [PATCH 3/7] Syntax highlight rules.pl
-
----
- .../diff/gr-syntax-layer/gr-syntax-layer.ts         | 13 ++++++++++++-
- 1 file changed, 12 insertions(+), 1 deletion(-)
-
-diff --git a/polygerrit-ui/app/elements/diff/gr-syntax-layer/gr-syntax-layer.ts b/polygerrit-ui/app/elements/diff/gr-syntax-layer/gr-syntax-layer.ts
-index 2762ccc625..598e14589f 100644
---- a/polygerrit-ui/app/elements/diff/gr-syntax-layer/gr-syntax-layer.ts
-+++ b/polygerrit-ui/app/elements/diff/gr-syntax-layer/gr-syntax-layer.ts
-@@ -103,6 +103,10 @@ const LANGUAGE_MAP = new Map<string, string>([
- ]);
- const ASYNC_DELAY = 10;
- 
-+const FILENAME_OVERRIDES = new Map<string, string>([
-+  ['rules.pl', 'prolog'],
-+]);
-+
- const CLASS_SAFELIST = new Set<string>([
-   'gr-diff gr-syntax gr-syntax-attr',
-   'gr-diff gr-syntax gr-syntax-attribute',
-@@ -241,10 +245,17 @@ export class GrSyntaxLayer implements DiffLayer {
-     }
-   }
- 
-+  _basename(filename: string): string {
-+    const pieces = filename.split(/\//);
-+    return pieces[pieces.length-1];
-+  }
-+
-   _getLanguage(metaInfo: DiffFileMetaInfo) {
-     // The Gerrit API provides only content-type, but for other users of
-     // gr-diff it may be more convenient to specify the language directly.
--    return metaInfo.language ?? LANGUAGE_MAP.get(metaInfo.content_type);
-+    return metaInfo.language ??
-+        FILENAME_OVERRIDES.get(this._basename(metaInfo.name)) ??
-+        LANGUAGE_MAP.get(metaInfo.content_type);
-   }
- 
-   /**
--- 
-2.32.0
-
diff --git a/third_party/gerrit/0005-When-using-local-fonts-always-assume-Gerrit-is-mount.patch b/third_party/gerrit/0005-When-using-local-fonts-always-assume-Gerrit-is-mount.patch
deleted file mode 100644
index b664ea0ea6b2..000000000000
--- a/third_party/gerrit/0005-When-using-local-fonts-always-assume-Gerrit-is-mount.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From bd7db44cabb6de64f03adbaf5e24c73e022a8932 Mon Sep 17 00:00:00 2001
-From: Luke Granger-Brown <git@lukegb.com>
-Date: Sat, 11 Jul 2020 00:45:57 +0000
-Subject: [PATCH 5/7] When using local fonts, always assume Gerrit is mounted
- at the root.
-
----
- polygerrit-ui/app/rollup.config.js | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/polygerrit-ui/app/rollup.config.js b/polygerrit-ui/app/rollup.config.js
-index d93b5eab39..c862c9bbae 100644
---- a/polygerrit-ui/app/rollup.config.js
-+++ b/polygerrit-ui/app/rollup.config.js
-@@ -50,7 +50,7 @@ const importLocalFontMetaUrlResolver = function() {
-     name: 'import-meta-url-resolver',
-     resolveImportMeta: function (property, data) {
-       if(property === 'url' && data.moduleId.endsWith('/@polymer/font-roboto-local/roboto.js')) {
--        return 'new URL("..", document.baseURI).href';
-+        return 'new URL("/", document.baseURI).href';
-       }
-       return null;
-     }
--- 
-2.32.0
-
diff --git a/third_party/gerrit/0006-Always-use-Google-Fonts.patch b/third_party/gerrit/0006-Always-use-Google-Fonts.patch
deleted file mode 100644
index 5b817d0b55a3..000000000000
--- a/third_party/gerrit/0006-Always-use-Google-Fonts.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From d71f51afe12a280b92831070a583b15c8b6bc2f4 Mon Sep 17 00:00:00 2001
-From: Luke Granger-Brown <git@lukegb.com>
-Date: Sat, 11 Jul 2020 00:46:13 +0000
-Subject: [PATCH 6/7] Always use Google Fonts.
-
-We're not a corporate, and we're not behind the GFW. Always use Google Fonts,
-because even though we no longer get the caching benefits (boo, browsers),
-it is still a better geographically-distributed CDN.
----
- java/com/google/gerrit/httpd/raw/IndexHtmlUtil.java | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/java/com/google/gerrit/httpd/raw/IndexHtmlUtil.java b/java/com/google/gerrit/httpd/raw/IndexHtmlUtil.java
-index a9cfceb3b6..9c287c6e45 100644
---- a/java/com/google/gerrit/httpd/raw/IndexHtmlUtil.java
-+++ b/java/com/google/gerrit/httpd/raw/IndexHtmlUtil.java
-@@ -184,7 +184,7 @@ public class IndexHtmlUtil {
-     if (urlParameterMap.containsKey("ce")) {
-       data.put("polyfillCE", "true");
-     }
--    if (urlParameterMap.containsKey("gf")) {
-+    if (/* urlParameterMap.containsKey("gf") || */ true) {
-       data.put("useGoogleFonts", "true");
-     }
- 
--- 
-2.32.0
-
diff --git a/third_party/gerrit/default.nix b/third_party/gerrit/default.nix
index 4873cf09b900..606d7e9abf40 100644
--- a/third_party/gerrit/default.nix
+++ b/third_party/gerrit/default.nix
@@ -1,10 +1,6 @@
 { depot, pkgs, ... }:
 
 let
-  detzip = depot.nix.buildGo.program {
-    name = "detzip";
-    srcs = [ ./detzip.go ];
-  };
   bazelRunScript = pkgs.writeShellScriptBin "bazel-run" ''
     yarn config set cache-folder "$bazelOut/external/yarn_cache"
     export HOME="$bazelOut/external/home"
@@ -14,8 +10,7 @@ let
   bazelTop = pkgs.buildFHSUserEnv {
     name = "bazel";
     targetPkgs = pkgs: [
-      (pkgs.bazel.override { enableNixHacks = true; })
-      detzip
+      (pkgs.bazel_5.override { enableNixHacks = true; })
       pkgs.jdk11_headless
       pkgs.zlib
       pkgs.python
@@ -28,7 +23,7 @@ let
     runScript = "/bin/bazel-run";
   };
   bazel = bazelTop // { override = x: bazelTop; };
-  version = "3.4.0";
+  version = "3.6.1";
 in
 pkgs.lib.makeOverridable pkgs.buildBazelPackage {
   pname = "gerrit";
@@ -36,19 +31,16 @@ pkgs.lib.makeOverridable pkgs.buildBazelPackage {
 
   src = pkgs.fetchgit {
     url = "https://gerrit.googlesource.com/gerrit";
-    rev = "471c1c15a7bc294d10e246df43812942b5ac8a13";
+    rev = "028b90fc362051cc7005e540030e497320b83c92";
     branchName = "v${version}";
-    sha256 = "sha256:0ayj0bcsxjln8qydkj9j7yiqibmjgd3bcpqvgsdzdx072wzx01c0";
+    sha256 = "sha256:0rwmrix4h9jvgxr1gzp5f090g3xz3qlss3l1xvs2s6f3ynbxixa7";
     fetchSubmodules = true;
   };
 
   patches = [
-    ./0001-Use-detzip-in-download_bower.py.patch
-    ./0002-Syntax-highlight-nix.patch
-    ./0003-Syntax-highlight-rules.pl.patch
-    ./0004-Add-titles-to-CLs-over-HTTP.patch
-    ./0005-When-using-local-fonts-always-assume-Gerrit-is-mount.patch
-    ./0006-Always-use-Google-Fonts.patch
+    ./0001-Syntax-highlight-nix.patch
+    ./0002-Syntax-highlight-rules.pl.patch
+    ./0003-Add-titles-to-CLs-over-HTTP.patch
   ];
 
   bazelTarget = "release api-skip-javadoc";
@@ -58,11 +50,12 @@ pkgs.lib.makeOverridable pkgs.buildBazelPackage {
     "--repository_cache="
     "--disk_cache="
   ];
+
   removeRulesCC = false;
   fetchConfigured = true;
 
   fetchAttrs = {
-    sha256 = "sha256:1q4sclf18zzh8hsnccg1y7vqnhgavq62mqp4xx50zxfcnixfkpbx";
+    sha256 = "sha256:1ggp5zrj25g5jc6ny9y333q0g76a7s1544j1ps9j3xhra9vbc1vq";
     preBuild = ''
       rm .bazelversion
     '';
@@ -103,9 +96,6 @@ pkgs.lib.makeOverridable pkgs.buildBazelPackage {
       echo '${bazel.name}' > $bazelOut/external/.nix-bazel-version
 
       # Gerrit fixups:
-      # Remove polymer-bridges and ba-linkify, they're in-repo
-      rm -rf $bazelOut/external/yarn_cache/v6/npm-polymer-bridges-*
-      rm -rf $bazelOut/external/yarn_cache/v6/npm-ba-linkify-*
       # Normalize permissions on .yarn-{tarball,metadata} files
       find $bazelOut/external/yarn_cache \( -name .yarn-tarball.tgz -or -name .yarn-metadata.json \) -exec chmod 644 {} +
 
@@ -119,6 +109,13 @@ pkgs.lib.makeOverridable pkgs.buildBazelPackage {
     preConfigure = ''
       rm .bazelversion
     '';
+    postPatch = ''
+      # Disable all errorprone checks, since we might be using a different version.
+      sed -i \
+        -e '/-Xep:/d' \
+        -e '/-XepExcludedPaths:/a "-XepDisableAllChecks",' \
+        tools/BUILD
+    '';
     installPhase = ''
       mkdir -p "$out"/webapps/ "$out"/share/api/
       cp bazel-bin/release.war "$out"/webapps/gerrit-${version}.war
diff --git a/third_party/gerrit_plugins/default.nix b/third_party/gerrit_plugins/default.nix
index c08afb0f77b8..0415b73914cb 100644
--- a/third_party/gerrit_plugins/default.nix
+++ b/third_party/gerrit_plugins/default.nix
@@ -7,11 +7,11 @@ depot.nix.readTree.drvTargets {
   # https://gerrit.googlesource.com/plugins/owners
   owners = buildGerritBazelPlugin rec {
     name = "owners";
-    depsOutputHash = "sha256:00nbqwr83wsqa6l67bv4ywv9795l1ibl0yv1kq5q811syrvk2xiz";
+    depsOutputHash = "sha256:129k0jz2pxfl3yvdd95wvvkcjjmmw6jy4g45ss1pgvb9dan0ca6j";
     src = pkgs.fetchgit {
       url = "https://gerrit.googlesource.com/plugins/owners";
-      rev = "99a9ab585532d172d141b4641dfc70081513dfc2";
-      sha256 = "sha256:1xn9qb7q94jxfx7yq0zjqjm16gfyzzif13sak9x6j4f9r68frcd4";
+      rev = "070820d2df4f253c7c470f2cbe68da8043e163d0";
+      sha256 = "sha256:0mw2fff3dca1xv2cvg9hsy5zw1h5gjidb5fh95x6yaj9g9lp0mxq";
     };
     overlayPluginCmd = ''
       chmod +w "$out" "$out/plugins/external_plugin_deps.bzl"
diff --git a/third_party/gerrit_plugins/oauth/cas-6x.patch b/third_party/gerrit_plugins/oauth/cas-6x.patch
deleted file mode 100644
index 7494298b3f26..000000000000
--- a/third_party/gerrit_plugins/oauth/cas-6x.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-diff --git a/src/main/java/com/googlesource/gerrit/plugins/oauth/CasApi.java b/src/main/java/com/googlesource/gerrit/plugins/oauth/CasApi.java
-index 450549f..27310cd 100644
---- a/src/main/java/com/googlesource/gerrit/plugins/oauth/CasApi.java
-+++ b/src/main/java/com/googlesource/gerrit/plugins/oauth/CasApi.java
-@@ -15,7 +15,7 @@
- package com.googlesource.gerrit.plugins.oauth;
- 
- import com.github.scribejava.core.builder.api.DefaultApi20;
--import com.github.scribejava.core.extractors.OAuth2AccessTokenExtractor;
-+import com.github.scribejava.core.extractors.OAuth2AccessTokenJsonExtractor;
- import com.github.scribejava.core.extractors.TokenExtractor;
- import com.github.scribejava.core.model.OAuth2AccessToken;
- import com.github.scribejava.core.oauth2.bearersignature.BearerSignature;
-@@ -47,6 +47,6 @@ public class CasApi extends DefaultApi20 {
- 
-   @Override
-   public TokenExtractor<OAuth2AccessToken> getAccessTokenExtractor() {
--    return OAuth2AccessTokenExtractor.instance();
-+    return OAuth2AccessTokenJsonExtractor.instance();
-   }
- }
-diff --git a/src/main/java/com/googlesource/gerrit/plugins/oauth/CasOAuthService.java b/src/main/java/com/googlesource/gerrit/plugins/oauth/CasOAuthService.java
-index 5f3e4a1..fc5bc50 100644
---- a/src/main/java/com/googlesource/gerrit/plugins/oauth/CasOAuthService.java
-+++ b/src/main/java/com/googlesource/gerrit/plugins/oauth/CasOAuthService.java
-@@ -106,36 +106,14 @@ class CasOAuthService implements OAuthServiceProvider {
-         throw new IOException(String.format("CAS response missing id: %s", response.getBody()));
-       }
- 
--      JsonElement attrListJson = jsonObject.get("attributes");
--      if (attrListJson == null) {
--        throw new IOException(
--            String.format("CAS response missing attributes: %s", response.getBody()));
--      }
--
-       String email = null, name = null, login = null;
--      if (attrListJson.isJsonArray()) {
--        // It is possible for CAS to be configured to not return any attributes (email, name,
--        // login),
--        // in which case,
--        // CAS returns an empty JSON object "attributes":{}, rather than "null" or an empty JSON
--        // array
--        // "attributes": []
--
--        JsonArray attrJson = attrListJson.getAsJsonArray();
--        for (JsonElement elem : attrJson) {
--          if (elem == null || !elem.isJsonObject()) {
--            throw new IOException(String.format("Invalid JSON '%s': not a JSON Object", elem));
--          }
--          JsonObject obj = elem.getAsJsonObject();
--
--          String property = getStringElement(obj, "email");
--          if (property != null) email = property;
--          property = getStringElement(obj, "name");
--          if (property != null) name = property;
--          property = getStringElement(obj, "login");
--          if (property != null) login = property;
--        }
--      }
-+
-+      String property = getStringElement(jsonObject, "mail");
-+      if (property != null) email = property;
-+      property = getStringElement(jsonObject, "displayName");
-+      if (property != null) name = property;
-+      property = getStringElement(jsonObject, "uid");
-+      if (property != null) login = property;
- 
-       return new OAuthUserInfo(
-           CAS_PROVIDER_PREFIX + id.getAsString(),
diff --git a/third_party/gerrit_plugins/oauth/default.nix b/third_party/gerrit_plugins/oauth/default.nix
index 01748ba84220..04d4244f4d17 100644
--- a/third_party/gerrit_plugins/oauth/default.nix
+++ b/third_party/gerrit_plugins/oauth/default.nix
@@ -5,23 +5,15 @@ let
 in
 buildGerritBazelPlugin rec {
   name = "oauth";
-  depsOutputHash = "sha256:0j86amkw54y177s522hc988hqg034fsrkywbsb9a7h14zwcqbran";
+  depsOutputHash = "sha256:14xw282ianq52y5cbcpxrlkfjjakcvh7igpkvs49hcgcb7v4rds8";
   src = pkgs.fetchgit {
     url = "https://gerrit.googlesource.com/plugins/oauth";
-    rev = "4aa7322db5ec221b2419e12a9ec7af5b8c66659c";
-    sha256 = "1szra3pjl0axf4a7k96flpk7rhfvp37rdxay4gbglh939gzbba88";
+    rev = "f9bef7476bc99f7b1dc3fe2d52ec95cd7ac571dc";
+    sha256 = "08wf50bz7ash37mzlrxfy7hvmjsf6s4ncpcw5969hs9hjvjfj4dz";
   };
   overlayPluginCmd = ''
     chmod +w "$out" "$out/plugins/external_plugin_deps.bzl"
     cp -R "${src}" "$out/plugins/${name}"
     cp "${src}/external_plugin_deps.bzl" "$out/plugins/external_plugin_deps.bzl"
   '';
-
-  # The code in the OAuth repo expects CAS to return oauth2 access tokens as urlencoded.
-  # Our version of CAS returns them as JSON instead.
-  postPatch = ''
-    pushd plugins/oauth
-    patch -p1 <${./cas-6x.patch}
-    popd
-  '';
 }