diff --git a/Gemfile b/Gemfile
index 19e7bc73d010..23d54885a3ad 100644
--- a/Gemfile
+++ b/Gemfile
@@ -8,7 +8,7 @@ end
 
 if rails_master?
   gem 'arel', git: 'https://github.com/rails/arel.git'
-  gem 'rails', git: 'https://github.com/rails/rails.git'
+  gem 'rails', '>= 4.2.7', git: 'https://github.com/rails/rails.git'
   gem 'rails-observers', git: 'https://github.com/rails/rails-observers.git'
   gem 'seed-fu', git: 'https://github.com/SamSaffron/seed-fu.git', branch: 'discourse'
 else
@@ -28,7 +28,7 @@ else
   # gem 'activejob'
   # gem 'railties'
   # gem 'sprockets-rails'
-  gem 'rails', '~> 4.2'
+  gem 'rails', '~> 4.2', '>= 4.2.7'
 
   gem 'rails-observers'
   gem 'seed-fu', '~> 2.3.5'
@@ -44,7 +44,7 @@ gem 'redis-namespace'
 
 gem 'active_model_serializers', '~> 0.8.3'
 
-gem 'onebox'
+gem 'onebox', '>= 1.8.3'
 
 gem 'http_accept_language', '~>2.0.5', require: false
 
@@ -75,7 +75,7 @@ gem 'email_reply_trimmer', '0.1.3'
 gem 'image_optim', '0.20.2'
 gem 'multi_json'
 gem 'mustache'
-gem 'nokogiri'
+gem 'nokogiri', '>= 1.13.4'
 gem 'omniauth'
 gem 'omniauth-openid'
 gem 'openid-redis-store'
diff --git a/Gemfile.lock b/Gemfile.lock
index 9be879488bd1..a42b14c58312 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,47 +1,48 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actionmailer (4.2.7)
-      actionpack (= 4.2.7)
-      actionview (= 4.2.7)
-      activejob (= 4.2.7)
+    actionmailer (4.2.11.3)
+      actionpack (= 4.2.11.3)
+      actionview (= 4.2.11.3)
+      activejob (= 4.2.11.3)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.7)
-      actionview (= 4.2.7)
-      activesupport (= 4.2.7)
+    actionpack (4.2.11.3)
+      actionview (= 4.2.11.3)
+      activesupport (= 4.2.11.3)
       rack (~> 1.6)
       rack-test (~> 0.6.2)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.7)
-      activesupport (= 4.2.7)
+    actionview (4.2.11.3)
+      activesupport (= 4.2.11.3)
       builder (~> 3.1)
       erubis (~> 2.7.0)
       rails-dom-testing (~> 1.0, >= 1.0.5)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    active_model_serializers (0.8.3)
+      rails-html-sanitizer (~> 1.0, >= 1.0.3)
+    active_model_serializers (0.8.4)
       activemodel (>= 3.0)
-    activejob (4.2.7)
-      activesupport (= 4.2.7)
+    activejob (4.2.11.3)
+      activesupport (= 4.2.11.3)
       globalid (>= 0.3.0)
-    activemodel (4.2.7)
-      activesupport (= 4.2.7)
+    activemodel (4.2.11.3)
+      activesupport (= 4.2.11.3)
       builder (~> 3.1)
-    activerecord (4.2.7)
-      activemodel (= 4.2.7)
-      activesupport (= 4.2.7)
+    activerecord (4.2.11.3)
+      activemodel (= 4.2.11.3)
+      activesupport (= 4.2.11.3)
       arel (~> 6.0)
-    activesupport (4.2.7)
+    activesupport (4.2.11.3)
       i18n (~> 0.7)
-      json (~> 1.7, >= 1.7.7)
       minitest (~> 5.1)
       thread_safe (~> 0.3, >= 0.3.4)
       tzinfo (~> 1.1)
+    addressable (2.8.0)
+      public_suffix (>= 2.0.2, < 5.0)
     annotate (2.7.1)
       activerecord (>= 3.2, < 6.0)
       rake (>= 10.4, < 12.0)
-    arel (6.0.3)
+    arel (6.0.4)
     aws-sdk (2.3.22)
       aws-sdk-resources (= 2.3.22)
     aws-sdk-core (2.3.22)
@@ -52,8 +53,8 @@ GEM
     babel-transpiler (0.7.0)
       babel-source (>= 4.0, < 6)
       execjs (~> 2.0)
-    barber (0.11.1)
-      ember-source (>= 1.0, < 3)
+    barber (0.12.2)
+      ember-source (>= 1.0, < 3.1)
       execjs (>= 1.2, < 3)
     better_errors (2.1.1)
       coderay (>= 1.0.0)
@@ -61,31 +62,31 @@ GEM
       rack (>= 0.9.0)
     binding_of_caller (0.7.2)
       debug_inspector (>= 0.0.1)
-    builder (3.2.2)
+    builder (3.2.4)
     bullet (5.0.0)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.9.0)
     byebug (8.2.1)
     certified (1.0.0)
     coderay (1.1.0)
-    concurrent-ruby (1.0.2)
+    concurrent-ruby (1.1.10)
     connection_pool (2.2.0)
-    crass (1.0.2)
+    crass (1.0.6)
     daemons (1.2.3)
     debug_inspector (0.0.2)
-    diff-lcs (1.2.5)
-    discourse-qunit-rails (0.0.9)
+    diff-lcs (1.5.0)
+    discourse-qunit-rails (0.0.11)
       railties
     discourse_fastimage (2.0.3)
     docile (1.1.5)
     domain_name (0.5.25)
       unf (>= 0.0.5, < 1.0.0)
     email_reply_trimmer (0.1.3)
-    ember-data-source (1.0.0.beta.16.1)
-      ember-source (~> 1.8)
-    ember-handlebars-template (0.7.3)
+    ember-data-source (2.2.1)
+      ember-source (>= 1.8, < 3.0)
+    ember-handlebars-template (0.8.0)
       barber (>= 0.11.0)
-      sprockets (>= 3.3, < 4)
+      sprockets (>= 3.3, < 4.1)
     ember-rails (0.18.5)
       active_model_serializers
       ember-data-source (>= 1.0.0.beta.5)
@@ -97,7 +98,7 @@ GEM
     erubis (2.7.0)
     eventmachine (1.2.0.1)
     excon (0.45.4)
-    execjs (2.7.0)
+    execjs (2.8.1)
     exifr (1.2.4)
     fabrication (2.9.8)
     fakeweb (1.3.0)
@@ -117,8 +118,8 @@ GEM
     gctools (0.2.3)
     given_core (3.7.1)
       sorcerer (>= 0.3.7)
-    globalid (0.3.6)
-      activesupport (>= 4.1.0)
+    globalid (0.4.2)
+      activesupport (>= 4.2.0)
     guess_html_encoding (0.0.11)
     hashie (3.4.4)
     highline (1.7.8)
@@ -127,7 +128,8 @@ GEM
     http-cookie (1.0.2)
       domain_name (~> 0.5)
     http_accept_language (2.0.5)
-    i18n (0.7.0)
+    i18n (0.9.5)
+      concurrent-ruby (~> 1.0)
     image_optim (0.20.2)
       exifr (~> 1.1, >= 1.1.3)
       fspath (~> 2.1)
@@ -137,11 +139,11 @@ GEM
     image_size (1.4.1)
     in_threads (1.3.1)
     jmespath (1.3.0)
-    jquery-rails (4.0.5)
-      rails-dom-testing (~> 1.0)
+    jquery-rails (4.4.0)
+      rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
-    json (1.8.3)
+    json (1.8.6)
     jwt (1.5.2)
     kgio (2.10.0)
     librarian (0.1.2)
@@ -150,36 +152,35 @@ GEM
     libv8 (5.3.332.38.1)
     listen (0.7.3)
     logster (1.2.5)
-    loofah (2.0.3)
+    loofah (2.16.0)
+      crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     lru_redux (1.1.0)
-    mail (2.6.4)
-      mime-types (>= 1.16, < 4)
+    mail (2.7.1)
+      mini_mime (>= 0.1.1)
     memory_profiler (0.9.6)
     message_bus (2.0.1)
       rack (>= 1.1.3)
     metaclass (0.0.4)
     method_source (0.8.2)
-    mime-types (2.99.2)
-    mini_portile2 (2.1.0)
+    mime-types (2.99.3)
+    mini_mime (1.1.2)
+    mini_portile2 (2.8.0)
     mini_racer (0.1.7)
       libv8 (~> 5.3)
-    minitest (5.9.0)
+    minitest (5.15.0)
     mocha (1.1.0)
       metaclass (~> 0.0.1)
     mock_redis (0.15.4)
-    moneta (0.8.0)
     msgpack (0.7.6)
-    multi_json (1.12.1)
+    multi_json (1.15.0)
     multi_xml (0.5.5)
     multipart-post (2.0.0)
-    mustache (1.0.3)
+    mustache (1.1.1)
     netrc (0.11.0)
-    nokogiri (1.6.8)
-      mini_portile2 (~> 2.1.0)
-      pkg-config (~> 1.1.7)
-    nokogumbo (1.4.7)
-      nokogiri
+    nokogiri (1.13.4)
+      mini_portile2 (~> 2.8.0)
+      racc (~> 1.4)
     oauth (0.4.7)
     oauth2 (1.0.0)
       faraday (>= 0.8, < 0.10)
@@ -216,17 +217,17 @@ GEM
     omniauth-twitter (1.2.1)
       json (~> 1.3)
       omniauth-oauth (~> 1.1)
-    onebox (1.5.44)
-      htmlentities (~> 4.3.4)
-      moneta (~> 0.8)
+    onebox (2.2.19)
+      addressable (~> 2.8.0)
+      htmlentities (~> 4.3)
       multi_json (~> 1.11)
       mustache
-      nokogiri (~> 1.6.6)
+      nokogiri (~> 1.7)
+      sanitize
     openid-redis-store (0.0.2)
       redis
       ruby-openid
     pg (0.18.4)
-    pkg-config (1.1.7)
     progress (3.1.1)
     pry (0.10.3)
       coderay (~> 1.1.0)
@@ -236,9 +237,11 @@ GEM
       pry (>= 0.9.10, < 0.11.0)
     pry-rails (0.3.4)
       pry (>= 0.9.10)
+    public_suffix (4.0.7)
     puma (3.2.0)
     r2 (0.2.6)
-    rack (1.6.4)
+    racc (1.6.0)
+    rack (1.6.13)
     rack-mini-profiler (0.10.1)
       rack (>= 1.2.0)
     rack-openid (1.3.1)
@@ -248,35 +251,35 @@ GEM
       rack
     rack-test (0.6.3)
       rack (>= 1.0)
-    rails (4.2.7)
-      actionmailer (= 4.2.7)
-      actionpack (= 4.2.7)
-      actionview (= 4.2.7)
-      activejob (= 4.2.7)
-      activemodel (= 4.2.7)
-      activerecord (= 4.2.7)
-      activesupport (= 4.2.7)
+    rails (4.2.11.3)
+      actionmailer (= 4.2.11.3)
+      actionpack (= 4.2.11.3)
+      actionview (= 4.2.11.3)
+      activejob (= 4.2.11.3)
+      activemodel (= 4.2.11.3)
+      activerecord (= 4.2.11.3)
+      activesupport (= 4.2.11.3)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.7)
+      railties (= 4.2.11.3)
       sprockets-rails
-    rails-deprecated_sanitizer (1.0.3)
+    rails-deprecated_sanitizer (1.0.4)
       activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.7)
-      activesupport (>= 4.2.0.beta, < 5.0)
-      nokogiri (~> 1.6.0)
+    rails-dom-testing (1.0.9)
+      activesupport (>= 4.2.0, < 5.0)
+      nokogiri (~> 1.6)
       rails-deprecated_sanitizer (>= 1.0.1)
-    rails-html-sanitizer (1.0.3)
-      loofah (~> 2.0)
+    rails-html-sanitizer (1.4.2)
+      loofah (~> 2.3)
     rails-observers (0.1.2)
       activemodel (~> 4.0)
     rails_multisite (1.0.4)
-    railties (4.2.7)
-      actionpack (= 4.2.7)
-      activesupport (= 4.2.7)
+    railties (4.2.11.3)
+      actionpack (= 4.2.11.3)
+      activesupport (= 4.2.11.3)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
     raindrops (0.16.0)
-    rake (11.2.2)
+    rake (11.3.0)
     rake-compiler (0.9.9)
       rake
     rb-fsevent (0.9.7)
@@ -295,49 +298,56 @@ GEM
       netrc (~> 0.7)
     rinku (2.0.0)
     rmmseg-cpp (0.2.9)
-    rspec (3.4.0)
-      rspec-core (~> 3.4.0)
-      rspec-expectations (~> 3.4.0)
-      rspec-mocks (~> 3.4.0)
-    rspec-core (3.4.4)
-      rspec-support (~> 3.4.0)
-    rspec-expectations (3.4.0)
+    rspec (3.11.0)
+      rspec-core (~> 3.11.0)
+      rspec-expectations (~> 3.11.0)
+      rspec-mocks (~> 3.11.0)
+    rspec-core (3.11.0)
+      rspec-support (~> 3.11.0)
+    rspec-expectations (3.11.0)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.4.0)
+      rspec-support (~> 3.11.0)
     rspec-given (3.7.1)
       given_core (= 3.7.1)
       rspec (>= 2.14.0)
-    rspec-html-matchers (0.7.0)
+    rspec-html-matchers (0.9.4)
       nokogiri (~> 1)
-      rspec (~> 3)
-    rspec-mocks (3.4.1)
+      rspec (>= 3.0.0.a, < 4)
+    rspec-mocks (3.11.1)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.4.0)
-    rspec-rails (3.4.2)
-      actionpack (>= 3.0, < 4.3)
-      activesupport (>= 3.0, < 4.3)
-      railties (>= 3.0, < 4.3)
-      rspec-core (~> 3.4.0)
-      rspec-expectations (~> 3.4.0)
-      rspec-mocks (~> 3.4.0)
-      rspec-support (~> 3.4.0)
-    rspec-support (3.4.1)
+      rspec-support (~> 3.11.0)
+    rspec-rails (4.1.2)
+      actionpack (>= 4.2)
+      activesupport (>= 4.2)
+      railties (>= 4.2)
+      rspec-core (~> 3.10)
+      rspec-expectations (~> 3.10)
+      rspec-mocks (~> 3.10)
+      rspec-support (~> 3.10)
+    rspec-support (3.11.0)
     rtlit (0.0.5)
     ruby-openid (2.7.0)
     ruby-readability (0.7.0)
       guess_html_encoding (>= 0.0.4)
       nokogiri (>= 1.6.0)
-    sanitize (4.0.1)
+    sanitize (6.0.0)
       crass (~> 1.0.2)
-      nokogiri (>= 1.4.4)
-      nokogumbo (~> 1.4.1)
-    sass (3.2.19)
-    sass-rails (5.0.4)
-      railties (>= 4.0.0, < 5.0)
-      sass (~> 3.1)
-      sprockets (>= 2.8, < 4.0)
-      sprockets-rails (>= 2.0, < 4.0)
-      tilt (>= 1.1, < 3)
+      nokogiri (>= 1.12.0)
+    sass (3.7.4)
+      sass-listen (~> 4.0.0)
+    sass-listen (4.0.0)
+      rb-fsevent (~> 0.9, >= 0.9.4)
+      rb-inotify (~> 0.9, >= 0.9.7)
+    sass-rails (6.0.0)
+      sassc-rails (~> 2.1, >= 2.1.1)
+    sassc (2.4.0)
+      ffi (~> 1.9)
+    sassc-rails (2.1.2)
+      railties (>= 4.0.0)
+      sassc (>= 2.0)
+      sprockets (> 3.0)
+      sprockets-rails
+      tilt
     seed-fu (2.3.5)
       activerecord (>= 3.1, < 4.3)
       activesupport (>= 3.1, < 4.3)
@@ -369,10 +379,10 @@ GEM
     spork-rails (4.0.0)
       rails (>= 3.0.0, < 5)
       spork (>= 1.0rc0)
-    sprockets (3.6.3)
+    sprockets (4.0.3)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-rails (3.1.1)
+    sprockets-rails (3.2.2)
       actionpack (>= 4.0)
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
@@ -381,12 +391,12 @@ GEM
       daemons (~> 1.0, >= 1.0.9)
       eventmachine (~> 1.0, >= 1.0.4)
       rack (~> 1.0)
-    thor (0.19.1)
-    thread_safe (0.3.5)
-    tilt (2.0.2)
+    thor (0.19.4)
+    thread_safe (0.3.6)
+    tilt (2.0.10)
     timecop (0.8.0)
     trollop (2.1.2)
-    tzinfo (1.2.2)
+    tzinfo (1.2.9)
       thread_safe (~> 0.1)
     uglifier (3.0.0)
       execjs (>= 0.3.0, < 3)
@@ -447,7 +457,7 @@ DEPENDENCIES
   mock_redis
   multi_json
   mustache
-  nokogiri
+  nokogiri (>= 1.13.4)
   oj
   omniauth
   omniauth-facebook
@@ -457,7 +467,7 @@ DEPENDENCIES
   omniauth-oauth2
   omniauth-openid
   omniauth-twitter
-  onebox
+  onebox (>= 1.8.3)
   openid-redis-store
   pg
   pry-nav
@@ -466,7 +476,7 @@ DEPENDENCIES
   r2 (~> 0.2.5)
   rack-mini-profiler
   rack-protection
-  rails (~> 4.2)
+  rails (~> 4.2, >= 4.2.7)
   rails-observers
   rails_multisite
   rake
@@ -503,4 +513,4 @@ DEPENDENCIES
   unicorn
 
 BUNDLED WITH
-   1.13.6
+   1.17.3