diff --git a/2.10.7.tar.gz b/2.10.7.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..762cb9a2e3112640bdc6a0dd8ba5d99290ae8099
Binary files /dev/null and b/2.10.7.tar.gz differ
diff --git a/Gemfile.lock b/Gemfile.lock
new file mode 100644
index 0000000000000000000000000000000000000000..c8cce144181c8d55e40437e85f7d37e9b8767e7c
--- /dev/null
+++ b/Gemfile.lock
@@ -0,0 +1,582 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    actioncable (5.2.3)
+      actionpack (= 5.2.3)
+      nio4r (~> 2.0)
+      websocket-driver (>= 0.6.1)
+    actionmailer (5.2.3)
+      actionpack (= 5.2.3)
+      actionview (= 5.2.3)
+      activejob (= 5.2.3)
+      mail (~> 2.5, >= 2.5.4)
+      rails-dom-testing (~> 2.0)
+    actionpack (5.2.3)
+      actionview (= 5.2.3)
+      activesupport (= 5.2.3)
+      rack (~> 2.0)
+      rack-test (>= 0.6.3)
+      rails-dom-testing (~> 2.0)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    actionview (5.2.3)
+      activesupport (= 5.2.3)
+      builder (~> 3.1)
+      erubi (~> 1.4)
+      rails-dom-testing (~> 2.0)
+      rails-html-sanitizer (~> 1.0, >= 1.0.3)
+    activejob (5.2.3)
+      activesupport (= 5.2.3)
+      globalid (>= 0.3.6)
+    activemodel (5.2.3)
+      activesupport (= 5.2.3)
+    activemodel-serializers-xml (1.0.2)
+      activemodel (> 5.x)
+      activesupport (> 5.x)
+      builder (~> 3.1)
+    activerecord (5.2.3)
+      activemodel (= 5.2.3)
+      activesupport (= 5.2.3)
+      arel (>= 9.0)
+    activestorage (5.2.3)
+      actionpack (= 5.2.3)
+      activerecord (= 5.2.3)
+      marcel (~> 0.3.1)
+    activesupport (5.2.3)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (>= 0.7, < 2)
+      minitest (~> 5.1)
+      tzinfo (~> 1.1)
+    acts_as_list (0.9.19)
+      activerecord (>= 3.0)
+    acts_as_tree (2.9.0)
+      activerecord (>= 3.0.0)
+    addressable (2.6.0)
+      public_suffix (>= 2.0.2, < 4.0)
+    airbrake (8.0.1)
+      airbrake-ruby (~> 3.0)
+    airbrake-ruby (3.1.0)
+      tdigest (= 0.1.1)
+    ajax-datatables-rails (1.0.0)
+      railties (>= 4.2)
+    amq-protocol (2.3.0)
+    ansi (1.5.0)
+    arel (9.0.0)
+    ast (2.4.0)
+    autoprefixer-rails (9.6.0)
+      execjs
+    bcrypt (3.1.13)
+    bootstrap (4.3.1)
+      autoprefixer-rails (>= 9.1.0)
+      popper_js (>= 1.14.3, < 2)
+      sassc-rails (>= 2.0.0)
+    builder (3.2.3)
+    bullet (6.0.1)
+      activesupport (>= 3.0.0)
+      uniform_notifier (~> 1.11)
+    bunny (2.14.2)
+      amq-protocol (~> 2.3, >= 2.3.0)
+    bunny-mock (1.7.0)
+      bunny (>= 1.7)
+    byebug (11.0.1)
+    capybara (3.24.0)
+      addressable
+      mini_mime (>= 0.1.3)
+      nokogiri (~> 1.8)
+      rack (>= 1.6.0)
+      rack-test (>= 0.6.3)
+      regexp_parser (~> 1.5)
+      xpath (~> 3.2)
+    capybara_minitest_spec (1.0.7)
+      capybara (>= 2)
+      minitest (>= 4)
+    childprocess (3.0.0)
+    chunky_png (1.3.11)
+    clockwork (2.0.3)
+      tzinfo
+    cocoon (1.2.14)
+    codecov (0.1.14)
+      json
+      simplecov
+      url
+    codemirror-rails (5.16.0)
+      railties (>= 3.0, < 6.0)
+    coderay (1.1.2)
+    coffee-rails (5.0.0)
+      coffee-script (>= 2.2.0)
+      railties (>= 5.2.0)
+    coffee-script (2.4.1)
+      coffee-script-source
+      execjs
+    coffee-script-source (1.12.2)
+    colorize (0.8.1)
+    concurrent-ruby (1.1.5)
+    concurrent-ruby-ext (1.1.5)
+      concurrent-ruby (= 1.1.5)
+    coveralls (0.8.23)
+      json (>= 1.8, < 3)
+      simplecov (~> 0.16.1)
+      term-ansicolor (~> 1.3)
+      thor (>= 0.19.4, < 2.0)
+      tins (~> 1.6)
+    crack (0.4.3)
+      safe_yaml (~> 1.0.0)
+    crass (1.0.5)
+    cssmin (1.0.3)
+    daemons (1.3.1)
+    dalli (2.7.10)
+    data_migrate (5.3.2)
+      rails (>= 4.2)
+    database_cleaner (1.7.0)
+    deep_cloneable (2.4.0)
+      activerecord (>= 3.1.0, < 6)
+    delayed_job (4.1.7)
+      activesupport (>= 3.0, < 5.3)
+    delayed_job_active_record (4.1.3)
+      activerecord (>= 3.0, < 5.3)
+      delayed_job (>= 3.0, < 5)
+    diff-lcs (1.3)
+    docile (1.3.2)
+    equatable (0.6.1)
+    erubi (1.8.0)
+    erubis (2.7.0)
+    escape_utils (1.2.1)
+    execjs (2.7.0)
+    experimental-influxdb-rails (1.0.0.beta5)
+      influxdb (~> 0.6, >= 0.6.4)
+      railties (>= 4.2)
+    factory_bot (5.0.2)
+      activesupport (>= 4.2.0)
+    factory_bot_rails (5.0.2)
+      factory_bot (~> 5.0.2)
+      railties (>= 4.2.0)
+    faker (1.9.4)
+      i18n (>= 0.7)
+      pastel (~> 0.7.2)
+      thor (~> 0.20.0)
+      tty-pager (~> 0.12.0)
+      tty-screen (~> 0.6.5)
+      tty-tree (~> 0.3.0)
+    feature (1.4.0)
+    ffi (1.11.1)
+    flot-rails (0.0.7)
+      jquery-rails
+    font-awesome-sass (5.8.1)
+      sassc (>= 1.11)
+    globalid (0.4.2)
+      activesupport (>= 4.2.0)
+    gssapi (1.3.0)
+      ffi (>= 1.0.1)
+    haml (5.1.1)
+      temple (>= 0.8.0)
+      tilt
+    haml-rails (2.0.1)
+      actionpack (>= 5.1)
+      activesupport (>= 5.1)
+      haml (>= 4.0.6, < 6.0)
+      html2haml (>= 1.0.1)
+      railties (>= 5.1)
+    haml_lint (0.32.0)
+      haml (>= 4.0, < 5.2)
+      rainbow
+      rake (>= 10, < 13)
+      rubocop (>= 0.50.0)
+      sysexits (~> 1.1)
+    hashdiff (0.4.0)
+    html2haml (2.2.0)
+      erubis (~> 2.7.0)
+      haml (>= 4.0, < 6)
+      nokogiri (>= 1.6.0)
+      ruby_parser (~> 3.5)
+    i18n (1.6.0)
+      concurrent-ruby (~> 1.0)
+    influxdb (0.7.0)
+    innertube (1.1.0)
+    jaro_winkler (1.5.3)
+    joiner (0.4.2)
+      activerecord (>= 5.2.beta1)
+    jquery-datatables (1.10.19.1)
+    jquery-rails (4.3.5)
+      rails-dom-testing (>= 1, < 3)
+      railties (>= 4.2.0)
+      thor (>= 0.14, < 2.0)
+    jquery-ui-rails (4.2.1)
+      railties (>= 3.2.16)
+    json (2.2.0)
+    kaminari (1.1.1)
+      activesupport (>= 4.1.0)
+      kaminari-actionview (= 1.1.1)
+      kaminari-activerecord (= 1.1.1)
+      kaminari-core (= 1.1.1)
+    kaminari-actionview (1.1.1)
+      actionview
+      kaminari-core (= 1.1.1)
+    kaminari-activerecord (1.1.1)
+      activerecord
+      kaminari-core (= 1.1.1)
+    kaminari-core (1.1.1)
+    launchy (2.4.3)
+      addressable (~> 2.3)
+    lograge (0.11.2)
+      actionpack (>= 4)
+      activesupport (>= 4)
+      railties (>= 4)
+      request_store (~> 1.0)
+    loofah (2.3.1)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.5.9)
+    mail (2.7.1)
+      mini_mime (>= 0.1.1)
+    marcel (0.3.3)
+      mimemagic (~> 0.3.2)
+    metaclass (0.0.4)
+    method_source (0.9.2)
+    middleware (0.1.0)
+    mimemagic (0.3.3)
+    mini_mime (1.0.1)
+    mini_portile2 (2.4.0)
+    minitest (5.11.3)
+    minitest-ci (3.4.0)
+      minitest (>= 5.0.6)
+    minitest-fail-fast (0.1.0)
+      minitest (~> 5)
+    minitest-reporters (1.3.6)
+      ansi
+      builder
+      minitest (>= 5.0)
+      ruby-progressbar
+    mocha (1.9.0)
+      metaclass (~> 0.0.1)
+    momentjs-rails (2.20.1)
+      railties (>= 3.1)
+    mousetrap-rails (1.4.6)
+    mysql2 (0.5.2)
+    nio4r (2.5.2)
+    nokogiri (1.10.5)
+      mini_portile2 (~> 2.4.0)
+    nokogumbo (2.0.1)
+      nokogiri (~> 1.8, >= 1.8.4)
+    parallel (1.17.0)
+    parser (2.6.3.0)
+      ast (~> 2.4.0)
+    pastel (0.7.3)
+      equatable (~> 0.6)
+      tty-color (~> 0.5)
+    peek (1.0.1)
+      concurrent-ruby (>= 0.9.0)
+      concurrent-ruby-ext (>= 0.9.0)
+      railties (>= 4.0.0)
+    peek-dalli (1.2.0)
+      concurrent-ruby
+      concurrent-ruby-ext
+      dalli
+      peek
+    peek-host (1.0.0)
+      peek
+    peek-mysql2 (1.2.0)
+      concurrent-ruby
+      concurrent-ruby-ext
+      mysql2
+      peek
+    pkg-config (1.3.7)
+    popper_js (1.14.5)
+    power_assert (1.1.4)
+    pry (0.12.2)
+      coderay (~> 1.1.0)
+      method_source (~> 0.9.0)
+    pry-byebug (3.7.0)
+      byebug (~> 11.0)
+      pry (~> 0.10)
+    public_suffix (3.1.0)
+    puma (4.3.1)
+      nio4r (~> 2.0)
+    pundit (2.0.1)
+      activesupport (>= 3.0.0)
+    rack (2.0.8)
+    rack-test (1.1.0)
+      rack (>= 1.0, < 3)
+    rails (5.2.3)
+      actioncable (= 5.2.3)
+      actionmailer (= 5.2.3)
+      actionpack (= 5.2.3)
+      actionview (= 5.2.3)
+      activejob (= 5.2.3)
+      activemodel (= 5.2.3)
+      activerecord (= 5.2.3)
+      activestorage (= 5.2.3)
+      activesupport (= 5.2.3)
+      bundler (>= 1.3.0)
+      railties (= 5.2.3)
+      sprockets-rails (>= 2.0.0)
+    rails-controller-testing (1.0.4)
+      actionpack (>= 5.0.1.x)
+      actionview (>= 5.0.1.x)
+      activesupport (>= 5.0.1.x)
+    rails-dom-testing (2.0.3)
+      activesupport (>= 4.2.0)
+      nokogiri (>= 1.6)
+    rails-html-sanitizer (1.0.4)
+      loofah (~> 2.2, >= 2.2.2)
+    rails-timeago (2.17.1)
+      actionpack (>= 3.1)
+      activesupport (>= 3.1)
+    rails_tokeninput (1.7.0)
+      railties (>= 3.1.0)
+    railties (5.2.3)
+      actionpack (= 5.2.3)
+      activesupport (= 5.2.3)
+      method_source
+      rake (>= 0.8.7)
+      thor (>= 0.19.0, < 2.0)
+    rainbow (3.0.0)
+    rake (12.3.3)
+    rantly (2.0.0)
+    rbtree (0.4.2)
+    rdoc (6.1.1)
+    redcarpet (3.4.0)
+    regexp_parser (1.5.1)
+    request_store (1.4.1)
+      rack (>= 1.4)
+    responders (3.0.0)
+      actionpack (>= 5.0)
+      railties (>= 5.0)
+    riddle (2.3.2)
+    rspec (3.8.0)
+      rspec-core (~> 3.8.0)
+      rspec-expectations (~> 3.8.0)
+      rspec-mocks (~> 3.8.0)
+    rspec-core (3.8.2)
+      rspec-support (~> 3.8.0)
+    rspec-expectations (3.8.4)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.8.0)
+    rspec-mocks (3.8.1)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.8.0)
+    rspec-rails (3.8.2)
+      actionpack (>= 3.0)
+      activesupport (>= 3.0)
+      railties (>= 3.0)
+      rspec-core (~> 3.8.0)
+      rspec-expectations (~> 3.8.0)
+      rspec-mocks (~> 3.8.0)
+      rspec-support (~> 3.8.0)
+    rspec-support (3.8.2)
+    rspec_junit_formatter (0.4.1)
+      rspec-core (>= 2, < 4, != 2.12.0)
+    rubocop (0.72.0)
+      jaro_winkler (~> 1.5.1)
+      parallel (~> 1.10)
+      parser (>= 2.6)
+      rainbow (>= 2.2.2, < 4.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (>= 1.4.0, < 1.7)
+    rubocop-performance (1.4.0)
+      rubocop (>= 0.71.0)
+    rubocop-rails (2.1.0)
+      rack (>= 1.1)
+      rubocop (>= 0.72.0)
+    rubocop-rspec (1.33.0)
+      rubocop (>= 0.60.0)
+    ruby-ldap (0.9.20)
+    ruby-progressbar (1.10.1)
+    ruby_parser (3.13.1)
+      sexp_processor (~> 4.9)
+    rubyzip (2.0.0)
+    safe_yaml (1.0.5)
+    sanitize (5.0.0)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.8.0)
+      nokogumbo (~> 2.0)
+    sassc (2.0.1)
+      ffi (~> 1.9)
+      rake
+    sassc-rails (2.1.2)
+      railties (>= 4.0.0)
+      sassc (>= 2.0)
+      sprockets (> 3.0)
+      sprockets-rails
+      tilt
+    selenium-webdriver (3.142.6)
+      childprocess (>= 0.5, < 4.0)
+      rubyzip (>= 1.2.2)
+    sexp_processor (4.12.1)
+    shoulda-matchers (4.1.0)
+      activesupport (>= 4.2.0)
+    simplecov (0.16.1)
+      docile (~> 1.1)
+      json (>= 1.8, < 3)
+      simplecov-html (~> 0.10.0)
+    simplecov-html (0.10.2)
+    single_test (0.6.0)
+      rake
+    sprite-factory (1.7.1)
+    sprockets (3.7.2)
+      concurrent-ruby (~> 1.0)
+      rack (> 1, < 3)
+    sprockets-rails (3.2.1)
+      actionpack (>= 4.0)
+      activesupport (>= 4.0)
+      sprockets (>= 3.0.0)
+    strings (0.1.5)
+      strings-ansi (~> 0.1)
+      unicode-display_width (~> 1.5)
+      unicode_utils (~> 1.4)
+    strings-ansi (0.1.0)
+    sysexits (1.2.0)
+    tdigest (0.1.1)
+      rbtree (~> 0.4.2)
+    temple (0.8.1)
+    term-ansicolor (1.7.1)
+      tins (~> 1.0)
+    test-unit (3.3.3)
+      power_assert
+    thinking-sphinx (4.3.0)
+      activerecord (>= 3.1.0)
+      builder (>= 2.1.2)
+      innertube (>= 1.0.2)
+      joiner (>= 0.2.0)
+      middleware (>= 0.1.0)
+      riddle (~> 2.3)
+    thor (0.20.3)
+    thread_safe (0.3.6)
+    tilt (2.0.9)
+    timecop (0.9.1)
+    tins (1.20.3)
+    tty-color (0.5.0)
+    tty-pager (0.12.1)
+      strings (~> 0.1.4)
+      tty-screen (~> 0.6)
+      tty-which (~> 0.4)
+    tty-screen (0.6.5)
+    tty-tree (0.3.0)
+    tty-which (0.4.1)
+    tzinfo (1.2.5)
+      thread_safe (~> 0.1)
+    uglifier (4.1.20)
+      execjs (>= 0.3.0, < 3)
+    unicode-display_width (1.6.0)
+    unicode_utils (1.4.0)
+    uniform_notifier (1.12.1)
+    url (0.3.2)
+    vcr (5.0.0)
+    voight_kampff (1.1.3)
+      rack (>= 1.4, < 3.0)
+    webmock (3.6.0)
+      addressable (>= 2.3.6)
+      crack (>= 0.3.2)
+      hashdiff (>= 0.4.0, < 2.0.0)
+    websocket-driver (0.7.1)
+      websocket-extensions (>= 0.1.0)
+    websocket-extensions (0.1.4)
+    xmlhash (1.3.7)
+      pkg-config
+    xmlrpc (0.3.0)
+    xpath (3.2.0)
+      nokogiri (~> 1.8)
+    yajl-ruby (1.4.1)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  activemodel-serializers-xml
+  acts_as_list
+  acts_as_tree
+  addressable
+  airbrake
+  airbrake-ruby
+  ajax-datatables-rails
+  bcrypt
+  bootstrap
+  builder
+  bullet
+  bunny
+  bunny-mock
+  capybara
+  capybara_minitest_spec
+  chunky_png
+  clockwork (>= 0.7)
+  cocoon
+  codecov
+  codemirror-rails
+  coffee-rails
+  colorize
+  coveralls
+  cssmin (>= 1.0.2)
+  daemons
+  dalli
+  data_migrate
+  database_cleaner (>= 1.0.1)
+  deep_cloneable (~> 2.4.0)
+  delayed_job_active_record (>= 4.0.0)
+  escape_utils
+  experimental-influxdb-rails (>= 1.0.0.beta5)
+  factory_bot_rails
+  faker
+  feature
+  flot-rails
+  font-awesome-sass
+  gssapi
+  haml
+  haml-rails
+  haml_lint
+  jquery-datatables
+  jquery-rails
+  jquery-ui-rails (~> 4.2.1)
+  kaminari
+  launchy
+  lograge
+  minitest
+  minitest-ci
+  minitest-fail-fast
+  minitest-reporters
+  mocha (> 0.13.0)
+  momentjs-rails
+  mousetrap-rails
+  mysql2
+  nokogiri
+  peek
+  peek-dalli
+  peek-host
+  peek-mysql2
+  pry (>= 0.9.12)
+  pry-byebug
+  puma (~> 4.0)
+  pundit
+  rails (~> 5.2)
+  rails-controller-testing
+  rails-timeago (~> 2.0)
+  rails_tokeninput (>= 1.6.1.rc1)
+  rantly
+  rdoc
+  redcarpet
+  responders (~> 3.0)
+  rspec
+  rspec-rails
+  rspec_junit_formatter
+  rubocop
+  rubocop-performance
+  rubocop-rails
+  rubocop-rspec
+  ruby-ldap
+  sanitize
+  sassc-rails
+  selenium-webdriver
+  shoulda-matchers (~> 4.0)
+  simplecov
+  single_test
+  sprite-factory (>= 1.5.2)
+  test-unit
+  thinking-sphinx (> 3.1)
+  tilt (>= 1.4.1)
+  timecop
+  uglifier (>= 1.2.2)
+  vcr
+  voight_kampff
+  webmock (>= 2.3.0)
+  xmlhash (>= 1.3.6)
+  xmlrpc
+  yajl-ruby
+
+BUNDLED WITH
+   1.17.1
diff --git a/obs-server.spec b/obs-server.spec
index 735a396452889e5772518a83ff1900039bcc93fc..60c31d3cc77859016746ab0a620e201e94cb2ff7 100644
--- a/obs-server.spec
+++ b/obs-server.spec
@@ -5,14 +5,14 @@
 
 
 Name:           obs-server
-Version:        2.10.1
-Release:        lp151.23.6
+Version:        2.10.7
+Release:        1
 Summary:        The Open Build Service -- Server Component
 License:        GPL-2.0-only OR GPL-3.0-only
 URL:            http://www.openbuildservice.org
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
-Source0:        open-build-service-%version.tar.xz
-
+Source0:        https://github.com/openSUSE/open-build-service/archive/2.10.7.tar.gz
+Source1:        Gemfile.lock
 Patch1:         0001-obs_server-fix-usage-info.patch
 
 BuildArch:      noarch
@@ -60,8 +60,8 @@ This is a package providing basic configuration files.
 %package -n obs-api
 Summary:        The Open Build Service -- The API and WEBUI
 Requires:       httpd, apache2-mod_xforward, rubygem-passenger, mod_passenger >= 6.0.4
-Requires:       ruby, nodejs, urw-base35-fonts-legacy, obs-api-deps = %{version}
-Requires:       obs-bundled-gems = %{version}
+Requires:       ruby, nodejs, urw-base35-fonts-legacy, obs-api-deps = 2.10.1
+Requires:       obs-bundled-gems = 2.10.1
 Conflicts:      memcached < 1.4
 
 %description -n obs-api
@@ -73,6 +73,9 @@ This is the API server instance, and the web client for the OBS.
 rm -rf src/{api,backend}/docker-files
 rm -rf src/api/Dockerfile.frontend-base
 rm -rf src/backend/build
+#adpate to obs-bundled-gema-2.10.1 because of updating to obs-server-2.10.7
+rm -rf src/api/config/brakeman.ignore
+cp %{SOURCE1} src/api/
 
 find -name .keep -o -name .gitignore | xargs rm -rf
 for file in `grep -Fnr "#!/usr/bin/ruby.ruby2.5" | awk -F':' '{print $1}'`;do sed -i 's:#!/usr/bin/ruby.ruby2.5:#!/usr/bin/ruby:g' $file;done
@@ -479,6 +482,9 @@ usermod -a -G docker obsservicerun
 %{_sbindir}/rcobsstoragesetup
 
 %changelog
+* Mon Oct 19 2020 wutao <wutao61@huawei.com> - 2.10.7-1
+- upgrade to 2.10.7
+
 * Sun Sep 20 2020 yanan li <liyanan032@huawei.com> - 2.10.1-lp151.23.6
 - delete %insserv_cleanup