diff --git a/WORKSPACE b/WORKSPACE
index f4726a7..5255a9a 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -16,7 +16,7 @@
 load("//tools:bazlets.bzl", "load_bazlets")
 
 load_bazlets(
-    commit = "bd5e7bafb2bd72a4f84e06f07490b41d2921a65b",
+    commit = "2c9d995f712f6531e45756f80431b460c6183f8d",
     # local_path = "/home/<user>/projects/bazlets",
 )
 
@@ -117,8 +117,8 @@
 
 maven_jar(
     name = "truth",
-    artifact = "com.google.truth:truth:0.43",
-    sha1 = "0cb9105957368f68d5fd771045bfa27d4a534836",
+    artifact = "com.google.truth:truth:0.44",
+    sha1 = "11eff954c0c14da7d43276d7b3bcf71463105368",
 )
 
 # Indirect dependency of truth
@@ -136,8 +136,8 @@
 
 maven_jar(
     name = "html-types",
-    artifact = "com.google.common.html.types:types:1.0.4",
-    sha1 = "2adf4c8bfccc0ff7346f9186ac5aa57d829ad065",
+    artifact = "com.google.common.html.types:types:1.0.8",
+    sha1 = "9e9cf7bc4b2a60efeb5f5581fe46d17c068e0777",
 )
 
 maven_jar(
diff --git a/java/com/google/gitiles/ReadmeHelper.java b/java/com/google/gitiles/ReadmeHelper.java
index 911c4ef..a01c7f0 100644
--- a/java/com/google/gitiles/ReadmeHelper.java
+++ b/java/com/google/gitiles/ReadmeHelper.java
@@ -14,10 +14,10 @@
 
 package com.google.gitiles;
 
+import com.google.common.html.types.SafeHtml;
 import com.google.gitiles.doc.GitilesMarkdown;
 import com.google.gitiles.doc.MarkdownConfig;
 import com.google.gitiles.doc.MarkdownToHtml;
-import com.google.template.soy.data.SanitizedContent;
 import java.io.IOException;
 import org.eclipse.jgit.errors.CorruptObjectException;
 import org.eclipse.jgit.errors.IncorrectObjectTypeException;
@@ -87,7 +87,7 @@
     return readmePath;
   }
 
-  SanitizedContent render() {
+  SafeHtml render() {
     try {
       byte[] raw = reader.open(readmeId, Constants.OBJ_BLOB).getCachedBytes(config.inputLimit);
       return MarkdownToHtml.builder()
diff --git a/java/com/google/gitiles/RepositoryIndexServlet.java b/java/com/google/gitiles/RepositoryIndexServlet.java
index 334f6fe..d057512 100644
--- a/java/com/google/gitiles/RepositoryIndexServlet.java
+++ b/java/com/google/gitiles/RepositoryIndexServlet.java
@@ -20,11 +20,11 @@
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.Maps;
+import com.google.common.html.types.SafeHtml;
 import com.google.gitiles.DateFormatter.Format;
 import com.google.gitiles.GitilesRequestFailureException.FailureReason;
 import com.google.gitiles.doc.MarkdownConfig;
 import com.google.gson.reflect.TypeToken;
-import com.google.template.soy.data.SanitizedContent;
 import java.io.IOException;
 import java.io.OutputStream;
 import java.io.Writer;
@@ -172,7 +172,7 @@
             req.getRequestURI());
     readme.scanTree(rootTree);
     if (readme.isPresent()) {
-      SanitizedContent html = readme.render();
+      SafeHtml html = readme.render();
       if (html != null) {
         return ImmutableMap.<String, Object>of("readmeHtml", html);
       }
diff --git a/java/com/google/gitiles/VisibilityCache.java b/java/com/google/gitiles/VisibilityCache.java
index 75b5e9f..fbb3a45 100644
--- a/java/com/google/gitiles/VisibilityCache.java
+++ b/java/com/google/gitiles/VisibilityCache.java
@@ -37,6 +37,7 @@
 import org.eclipse.jgit.errors.MissingObjectException;
 import org.eclipse.jgit.lib.ObjectId;
 import org.eclipse.jgit.lib.Ref;
+import org.eclipse.jgit.lib.RefDatabase;
 import org.eclipse.jgit.lib.Repository;
 import org.eclipse.jgit.revwalk.RevCommit;
 import org.eclipse.jgit.revwalk.RevSort;
@@ -135,10 +136,11 @@
       return false;
     }
 
+    RefDatabase refDb = repo.getRefDatabase();
+
     // If any reference directly points at the requested object, permit display. Common for displays
     // of pending patch sets in Gerrit Code Review, or bookmarks to the commit a tag points at.
-    Collection<Ref> all = repo.getRefDatabase().getRefs();
-    for (Ref ref : all) {
+    for (Ref ref : repo.getRefDatabase().getRefs()) {
       ref = repo.getRefDatabase().peel(ref);
       if (id.equals(ref.getObjectId()) || id.equals(ref.getPeeledObjectId())) {
         return true;
@@ -149,9 +151,9 @@
     // tend to be much further back in history and just clutter up the priority queue in the common
     // case.
     return isReachableFrom(walk, commit, knownReachable)
-        || isReachableFromRefs(walk, commit, all.stream().filter(r -> refStartsWith(r, R_HEADS)))
-        || isReachableFromRefs(walk, commit, all.stream().filter(r -> refStartsWith(r, R_TAGS)))
-        || isReachableFromRefs(walk, commit, all.stream().filter(r -> otherRefs(r)));
+        || isReachableFromRefs(walk, commit, refDb.getRefsByPrefix(R_HEADS).stream())
+        || isReachableFromRefs(walk, commit, refDb.getRefsByPrefix(R_TAGS).stream())
+        || isReachableFromRefs(walk, commit, refDb.getRefs().stream().filter(r -> otherRefs(r)));
   }
 
   private static boolean refStartsWith(Ref ref, String prefix) {
diff --git a/java/com/google/gitiles/doc/MarkdownToHtml.java b/java/com/google/gitiles/doc/MarkdownToHtml.java
index 64758b2..e45503d 100644
--- a/java/com/google/gitiles/doc/MarkdownToHtml.java
+++ b/java/com/google/gitiles/doc/MarkdownToHtml.java
@@ -19,11 +19,11 @@
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.MoreObjects;
 import com.google.common.base.Strings;
+import com.google.common.html.types.SafeHtml;
 import com.google.gitiles.GitilesView;
 import com.google.gitiles.ThreadSafePrettifyParser;
 import com.google.gitiles.doc.html.HtmlBuilder;
 import com.google.gitiles.doc.html.SoyHtmlBuilder;
-import com.google.template.soy.data.SanitizedContent;
 import java.util.List;
 import javax.annotation.Nullable;
 import org.commonmark.ext.gfm.strikethrough.Strikethrough;
@@ -168,7 +168,7 @@
   }
 
   /** Render the document AST to sanitized HTML. */
-  public SanitizedContent toSoyHtml(Node node) {
+  public SafeHtml toSoyHtml(Node node) {
     if (node != null) {
       SoyHtmlBuilder out = new SoyHtmlBuilder();
       renderToHtml(out, node);
diff --git a/java/com/google/gitiles/doc/html/SoyHtmlBuilder.java b/java/com/google/gitiles/doc/html/SoyHtmlBuilder.java
index 23e6ee6..a130ce4 100644
--- a/java/com/google/gitiles/doc/html/SoyHtmlBuilder.java
+++ b/java/com/google/gitiles/doc/html/SoyHtmlBuilder.java
@@ -14,9 +14,8 @@
 
 package com.google.gitiles.doc.html;
 
-import com.google.template.soy.data.SanitizedContent;
-import com.google.template.soy.data.SanitizedContent.ContentKind;
-import com.google.template.soy.data.UnsafeSanitizedContentOrdainer;
+import com.google.common.html.types.LegacyConversions;
+import com.google.common.html.types.SafeHtml;
 
 /** Builds a document fragment using a restricted subset of HTML. */
 public final class SoyHtmlBuilder extends HtmlBuilder {
@@ -32,8 +31,8 @@
   }
 
   /** Bless the current content as HTML. */
-  public SanitizedContent toSoy() {
+  public SafeHtml toSoy() {
     finish();
-    return UnsafeSanitizedContentOrdainer.ordainAsSafe(buf.toString(), ContentKind.HTML);
+    return LegacyConversions.riskilyAssumeSafeHtml(buf.toString());
   }
 }
diff --git a/javatests/com/google/gitiles/VisibilityCacheTest.java b/javatests/com/google/gitiles/VisibilityCacheTest.java
new file mode 100644
index 0000000..e2e3248
--- /dev/null
+++ b/javatests/com/google/gitiles/VisibilityCacheTest.java
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) 2019, Google LLC.
+ * and other copyright owners as documented in the project's IP log.
+ *
+ * This program and the accompanying materials are made available
+ * under the terms of the Eclipse Distribution License v1.0 which
+ * accompanies this distribution, is reproduced below, and is
+ * available at http://www.eclipse.org/org/documents/edl-v10.php
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or
+ * without modification, are permitted provided that the following
+ * conditions are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above
+ *   copyright notice, this list of conditions and the following
+ *   disclaimer in the documentation and/or other materials provided
+ *   with the distribution.
+ *
+ * - Neither the name of the Eclipse Foundation, Inc. nor the
+ *   names of its contributors may be used to endorse or promote
+ *   products derived from this software without specific prior
+ *   written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
+ * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */ package com.google.gitiles;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import java.io.IOException;
+import java.util.Map;
+import java.util.Set;
+import org.eclipse.jgit.internal.storage.dfs.DfsRepositoryDescription;
+import org.eclipse.jgit.internal.storage.dfs.InMemoryRepository;
+import org.eclipse.jgit.junit.TestRepository;
+import org.eclipse.jgit.lib.Config;
+import org.eclipse.jgit.lib.ObjectId;
+import org.eclipse.jgit.revwalk.RevCommit;
+import org.eclipse.jgit.revwalk.RevWalk;
+import org.eclipse.jgit.transport.resolver.ServiceNotAuthorizedException;
+import org.eclipse.jgit.transport.resolver.ServiceNotEnabledException;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+@RunWith(JUnit4.class)
+public class VisibilityCacheTest {
+
+  private InMemoryRepository repo;
+  private GitilesAccess access = new FakeGitilesAccess();
+
+  private RevCommit baseCommit;
+  private RevCommit commit1;
+  private RevCommit commit2;
+  private RevCommit commitA;
+  private RevCommit commitB;
+  private RevCommit commitC;
+
+  private VisibilityCache visibilityCache;
+  private RevWalk walk;
+
+  @Before
+  public void setUp() throws Exception {
+    /**
+     * master (branch not visible)
+     *
+     * <p>commitC | commit2 commitB | | commit1 commitA <--- refs/tags/v0.1 \ / \ / baseCommit
+     */
+    repo = new InMemoryRepository(new DfsRepositoryDescription());
+    TestRepository<InMemoryRepository> git = new TestRepository<>(repo);
+    baseCommit = git.commit().message("baseCommit").create();
+    commit1 = git.commit().parent(baseCommit).message("commit1").create();
+    commit2 = git.commit().parent(commit1).message("commit2").create();
+
+    commitA = git.commit().parent(baseCommit).message("commitA").create();
+    commitB = git.commit().parent(commitA).message("commitB").create();
+    commitC = git.commit().parent(commitB).message("commitC").create();
+
+    git.update("master", commit2);
+    git.update("refs/tags/v0.1", commitA);
+
+    visibilityCache = new VisibilityCache(true);
+    walk = new RevWalk(repo);
+    walk.setRetainBody(false);
+  }
+
+  @After
+  public void tearDown() {
+    repo.close();
+  }
+
+  @Test
+  public void isTip() throws IOException {
+    ObjectId[] known = new ObjectId[0];
+    assertThat(visibilityCache.isVisible(repo, walk, access, commit2.getId(), known)).isTrue();
+  }
+
+  @Test
+  public void reachableFromHeads() throws Exception {
+    ObjectId[] known = new ObjectId[0];
+    assertThat(visibilityCache.isVisible(repo, walk, access, commit1.getId(), known)).isTrue();
+  }
+
+  @Test
+  public void reachableFromTags() throws Exception {
+    ObjectId[] known = new ObjectId[0];
+    assertThat(visibilityCache.isVisible(repo, walk, access, commitA.getId(), known)).isTrue();
+  }
+
+  @Test
+  public void unreachableFromAnyTip() throws Exception {
+    ObjectId[] known = new ObjectId[0];
+    assertThat(visibilityCache.isVisible(repo, walk, access, commitB.getId(), known)).isFalse();
+  }
+
+  @Test
+  public void reachableFromAnotherId() throws Exception {
+    ObjectId[] known = new ObjectId[] {commitC.getId()};
+    assertThat(visibilityCache.isVisible(repo, walk, access, commitB.getId(), known)).isTrue();
+  }
+
+  private static class FakeGitilesAccess implements GitilesAccess {
+    @Override
+    public Map<String, RepositoryDescription> listRepositories(String prefix, Set<String> branches)
+        throws ServiceNotEnabledException, ServiceNotAuthorizedException, IOException {
+      throw new UnsupportedOperationException();
+    }
+
+    @Override
+    public Object getUserKey() {
+      return "Test";
+    }
+
+    @Override
+    public String getRepositoryName() {
+      return "VisibilityCache-Test";
+    }
+
+    @Override
+    public RepositoryDescription getRepositoryDescription() throws IOException {
+      throw new UnsupportedOperationException();
+    }
+
+    @Override
+    public Config getConfig() throws IOException {
+      throw new UnsupportedOperationException();
+    }
+  }
+}
diff --git a/version.bzl b/version.bzl
index bfaafb4..f0d771c 100644
--- a/version.bzl
+++ b/version.bzl
@@ -4,4 +4,4 @@
 # we currently have no stable releases, we use the "build number" scheme
 # described at:
 # https://www.mojohaus.org/versions-maven-plugin/version-rules.html
-GITILES_VERSION = "0.2-7"
+GITILES_VERSION = "0.2-8"