From d14e72b4440e7721dd8bf0706155d8c6cb8bda34 Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sat, 27 Jan 2024 11:50:22 -0500
Subject: [PATCH 01/22] Initial migration (gem update, script)

---
 Gemfile                                       |   3 +-
 Gemfile.lock                                  | 508 +++++++++---------
 bin/rails                                     |   2 +-
 bin/setup                                     |  18 +-
 config/environments/development.rb            |  18 +-
 config/environments/production.rb             |  54 +-
 config/environments/test.rb                   |   4 +-
 config/initializers/assets.rb                 |   2 +-
 .../initializers/content_security_policy.rb   |  45 +-
 config/initializers/cors.rb                   |   4 +-
 .../initializers/filter_parameter_logging.rb  |   8 +-
 config/initializers/inflections.rb            |   8 +-
 .../new_framework_defaults_7_0.rb             | 128 +++++
 db/schema.rb                                  |   2 +-
 14 files changed, 454 insertions(+), 350 deletions(-)
 create mode 100644 config/initializers/new_framework_defaults_7_0.rb

diff --git a/Gemfile b/Gemfile
index f8280b5d433..e97158fb196 100644
--- a/Gemfile
+++ b/Gemfile
@@ -6,7 +6,7 @@ gem 'test-unit', '~> 3.2'
 
 gem 'bundler'
 
-gem "rails", "~> 6.1.7"
+gem "rails", "~> 7.0.8"
 gem "rails-i18n"
 gem "rack", "~> 2.2"
 gem "sprockets", "< 4"
@@ -147,7 +147,6 @@ group :test, :development do
   gem 'whiny_validation'
   gem "factory_bot_rails"
   gem 'minitest'
-  gem "listen", "~> 3.3"
   gem "i18n-tasks", require: false
 end
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 413b9392b37..b1d2dfd5fd2 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,10 +1,10 @@
 GIT
   remote: https://github.com/globalize/globalize
-  revision: 76b808b13d15c2b7158c0f61ff000b05de47afe6
+  revision: 278b9f95feef3838d434226c8a3836cb4e7880ec
   specs:
-    globalize (6.0.1)
-      activemodel (>= 4.2, < 7.0)
-      activerecord (>= 4.2, < 7.0)
+    globalize (6.3.0)
+      activemodel (>= 4.2, < 7.2)
+      activerecord (>= 4.2, < 7.2)
       request_store (~> 1.0)
 
 GIT
@@ -24,121 +24,128 @@ GEM
   remote: https://rubygems.org/
   specs:
     aaronh-chronic (0.3.9)
-    actioncable (6.1.7.4)
-      actionpack (= 6.1.7.4)
-      activesupport (= 6.1.7.4)
+    actioncable (7.0.8)
+      actionpack (= 7.0.8)
+      activesupport (= 7.0.8)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (6.1.7.4)
-      actionpack (= 6.1.7.4)
-      activejob (= 6.1.7.4)
-      activerecord (= 6.1.7.4)
-      activestorage (= 6.1.7.4)
-      activesupport (= 6.1.7.4)
+    actionmailbox (7.0.8)
+      actionpack (= 7.0.8)
+      activejob (= 7.0.8)
+      activerecord (= 7.0.8)
+      activestorage (= 7.0.8)
+      activesupport (= 7.0.8)
       mail (>= 2.7.1)
-    actionmailer (6.1.7.4)
-      actionpack (= 6.1.7.4)
-      actionview (= 6.1.7.4)
-      activejob (= 6.1.7.4)
-      activesupport (= 6.1.7.4)
+      net-imap
+      net-pop
+      net-smtp
+    actionmailer (7.0.8)
+      actionpack (= 7.0.8)
+      actionview (= 7.0.8)
+      activejob (= 7.0.8)
+      activesupport (= 7.0.8)
       mail (~> 2.5, >= 2.5.4)
+      net-imap
+      net-pop
+      net-smtp
       rails-dom-testing (~> 2.0)
-    actionpack (6.1.7.4)
-      actionview (= 6.1.7.4)
-      activesupport (= 6.1.7.4)
-      rack (~> 2.0, >= 2.0.9)
+    actionpack (7.0.8)
+      actionview (= 7.0.8)
+      activesupport (= 7.0.8)
+      rack (~> 2.0, >= 2.2.4)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
     actionpack-page_caching (1.2.4)
       actionpack (>= 4.0.0)
-    actiontext (6.1.7.4)
-      actionpack (= 6.1.7.4)
-      activerecord (= 6.1.7.4)
-      activestorage (= 6.1.7.4)
-      activesupport (= 6.1.7.4)
+    actiontext (7.0.8)
+      actionpack (= 7.0.8)
+      activerecord (= 7.0.8)
+      activestorage (= 7.0.8)
+      activesupport (= 7.0.8)
+      globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (6.1.7.4)
-      activesupport (= 6.1.7.4)
+    actionview (7.0.8)
+      activesupport (= 7.0.8)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    active_record_query_trace (1.8)
-    activejob (6.1.7.4)
-      activesupport (= 6.1.7.4)
+    active_record_query_trace (1.8.2)
+      activerecord (>= 6.0.0)
+    activejob (7.0.8)
+      activesupport (= 7.0.8)
       globalid (>= 0.3.6)
-    activemodel (6.1.7.4)
-      activesupport (= 6.1.7.4)
+    activemodel (7.0.8)
+      activesupport (= 7.0.8)
     activemodel-serializers-xml (1.0.2)
       activemodel (> 5.x)
       activesupport (> 5.x)
       builder (~> 3.1)
-    activerecord (6.1.7.4)
-      activemodel (= 6.1.7.4)
-      activesupport (= 6.1.7.4)
-    activestorage (6.1.7.4)
-      actionpack (= 6.1.7.4)
-      activejob (= 6.1.7.4)
-      activerecord (= 6.1.7.4)
-      activesupport (= 6.1.7.4)
+    activerecord (7.0.8)
+      activemodel (= 7.0.8)
+      activesupport (= 7.0.8)
+    activestorage (7.0.8)
+      actionpack (= 7.0.8)
+      activejob (= 7.0.8)
+      activerecord (= 7.0.8)
+      activesupport (= 7.0.8)
       marcel (~> 1.0)
       mini_mime (>= 1.1.0)
-    activesupport (6.1.7.4)
+    activesupport (7.0.8)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
       tzinfo (~> 2.0)
-      zeitwerk (~> 2.3)
     acts_as_list (0.9.19)
       activerecord (>= 3.0)
-    addressable (2.8.0)
-      public_suffix (>= 2.0.2, < 5.0)
-    after_commit_everywhere (1.1.0)
+    addressable (2.8.6)
+      public_suffix (>= 2.0.2, < 6.0)
+    after_commit_everywhere (1.3.1)
       activerecord (>= 4.2)
       activesupport
     akismetor (1.0.0)
     ast (2.4.2)
-    audited (5.3.3)
-      activerecord (>= 5.0, < 7.1)
+    audited (5.4.3)
+      activerecord (>= 5.0, < 7.2)
       request_store (~> 1.2)
     awesome_print (1.9.2)
-    aws-eventstream (1.2.0)
-    aws-partitions (1.553.0)
-    aws-sdk-core (3.126.0)
-      aws-eventstream (~> 1, >= 1.0.2)
-      aws-partitions (~> 1, >= 1.525.0)
-      aws-sigv4 (~> 1.1)
-      jmespath (~> 1.0)
-    aws-sdk-kms (1.54.0)
-      aws-sdk-core (~> 3, >= 3.126.0)
+    aws-eventstream (1.3.0)
+    aws-partitions (1.883.0)
+    aws-sdk-core (3.191.0)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.651.0)
+      aws-sigv4 (~> 1.8)
+      jmespath (~> 1, >= 1.6.1)
+    aws-sdk-kms (1.77.0)
+      aws-sdk-core (~> 3, >= 3.191.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.112.0)
-      aws-sdk-core (~> 3, >= 3.126.0)
+    aws-sdk-s3 (1.143.0)
+      aws-sdk-core (~> 3, >= 3.191.0)
       aws-sdk-kms (~> 1)
-      aws-sigv4 (~> 1.4)
-    aws-sigv4 (1.4.0)
+      aws-sigv4 (~> 1.8)
+    aws-sigv4 (1.8.0)
       aws-eventstream (~> 1, >= 1.0.2)
-    backports (3.23.0)
     base64 (0.2.0)
-    bcrypt (3.1.16)
-    better_html (2.0.1)
+    bcrypt (3.1.20)
+    better_html (2.0.2)
       actionview (>= 6.0)
       activesupport (>= 6.0)
       ast (~> 2.0)
       erubi (~> 1.4)
       parser (>= 2.4)
       smart_properties
-    brakeman (5.2.1)
+    brakeman (6.1.1)
+      racc
     builder (3.2.4)
-    bullet (7.0.1)
+    bullet (7.1.6)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.11)
-    bundler-audit (0.9.0.1)
+    bundler-audit (0.9.1)
       bundler (>= 1.2.0, < 3)
       thor (~> 1.0)
     byebug (11.1.3)
-    capistrano (2.15.9)
+    capistrano (2.15.11)
       highline
       net-scp (>= 1.0.0)
       net-sftp (>= 2.0.0)
@@ -149,11 +156,11 @@ GEM
     capistrano-gitflow_version (0.0.3.1)
       capistrano-ext (>= 1.2.1)
       stringex
-    capybara (3.37.1)
+    capybara (3.40.0)
       addressable
       matrix
       mini_mime (>= 0.1.3)
-      nokogiri (~> 1.8)
+      nokogiri (~> 1.11)
       rack (>= 1.6.0)
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
@@ -162,55 +169,62 @@ GEM
       capybara (>= 1.0, < 4)
       launchy
     chronic (0.10.2)
-    climate_control (0.2.0)
+    climate_control (1.2.0)
     coderay (1.1.3)
     concurrent-ruby (1.2.3)
-    connection_pool (2.2.5)
+    connection_pool (2.4.1)
     crack (0.4.5)
       rexml
     crass (1.0.6)
-    css_parser (1.11.0)
+    css_parser (1.16.0)
       addressable
-    cucumber (3.2.0)
-      builder (>= 2.1.2)
-      cucumber-core (~> 3.2.0)
-      cucumber-expressions (~> 6.0.1)
-      cucumber-wire (~> 0.0.1)
-      diff-lcs (~> 1.3)
-      gherkin (~> 5.1.0)
-      multi_json (>= 1.7.5, < 2.0)
-      multi_test (>= 0.1.2)
-    cucumber-core (3.2.1)
-      backports (>= 3.8.0)
-      cucumber-tag_expressions (~> 1.1.0)
-      gherkin (~> 5.0)
-    cucumber-expressions (6.0.1)
-    cucumber-rails (2.1.0)
-      capybara (>= 2.12, < 4)
-      cucumber (>= 3.0.2, < 5)
-      mime-types (>= 2.0, < 4)
-      nokogiri (~> 1.8)
-      rails (>= 4.2, < 7)
-    cucumber-tag_expressions (1.1.1)
+    cucumber (9.1.2)
+      builder (~> 3.2, >= 3.2.4)
+      cucumber-ci-environment (~> 9.2, >= 9.2.0)
+      cucumber-core (~> 12.0)
+      cucumber-cucumber-expressions (~> 17.0)
+      cucumber-gherkin (> 24, < 27)
+      cucumber-html-formatter (> 20.3, < 22)
+      cucumber-messages (> 19, < 25)
+      diff-lcs (~> 1.5)
+      mini_mime (~> 1.1, >= 1.1.5)
+      multi_test (~> 1.1, >= 1.1.0)
+      sys-uname (~> 1.2, >= 1.2.3)
+    cucumber-ci-environment (9.2.0)
+    cucumber-core (12.0.0)
+      cucumber-gherkin (>= 25, < 27)
+      cucumber-messages (>= 20, < 23)
+      cucumber-tag-expressions (~> 5.0, >= 5.0.4)
+    cucumber-cucumber-expressions (17.0.1)
+    cucumber-gherkin (26.2.0)
+      cucumber-messages (>= 19.1.4, < 22.1)
+    cucumber-html-formatter (21.2.0)
+      cucumber-messages (> 19, < 25)
+    cucumber-messages (22.0.0)
+    cucumber-rails (3.0.0)
+      capybara (>= 3.11, < 4)
+      cucumber (>= 5, < 10)
+      railties (>= 5.2, < 8)
+    cucumber-tag-expressions (5.0.6)
     cucumber-timecop (0.0.6)
       chronic
       cucumber
       timecop
-    cucumber-wire (0.0.1)
-    dalli (3.2.3)
-    database_cleaner (2.0.1)
-      database_cleaner-active_record (~> 2.0.0)
-    database_cleaner-active_record (2.0.1)
+    dalli (3.2.6)
+    database_cleaner (2.0.2)
+      database_cleaner-active_record (>= 2, < 3)
+    database_cleaner-active_record (2.1.0)
       activerecord (>= 5.a)
       database_cleaner-core (~> 2.0.0)
     database_cleaner-core (2.0.1)
+    date (3.3.4)
     delorean (2.1.0)
       chronic
-    departure (6.5.0)
-      activerecord (>= 5.2.0, < 7.1, != 7.0.0)
+    departure (6.6.0)
+      activerecord (>= 5.2.0, < 7.2.0, != 7.0.0)
       mysql2 (>= 0.4.0, <= 0.5.5)
-      railties (>= 5.2.0, < 7.1, != 7.0.0)
-    devise (4.8.1)
+      railties (>= 5.2.0, < 7.2.0, != 7.0.0)
+    devise (4.9.3)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
       railties (>= 4.1.0)
@@ -221,8 +235,7 @@ GEM
       devise (>= 4.0)
     diff-lcs (1.5.0)
     docile (1.4.0)
-    domain_name (0.5.20190701)
-      unf (>= 0.0.5, < 1.0.0)
+    domain_name (0.6.20240107)
     elasticsearch (7.17.1)
       elasticsearch-api (= 7.17.1)
       elasticsearch-transport (= 7.17.1)
@@ -245,14 +258,14 @@ GEM
     escape_utils (1.2.1)
     et-orbi (1.2.7)
       tzinfo
-    factory_bot (6.2.1)
+    factory_bot (6.4.5)
       activesupport (>= 5.0.0)
-    factory_bot_rails (6.2.0)
-      factory_bot (~> 6.2.0)
+    factory_bot_rails (6.4.3)
+      factory_bot (~> 6.4)
       railties (>= 5.0.0)
-    faker (2.19.0)
-      i18n (>= 1.6, < 2)
-    faraday (1.9.3)
+    faker (3.2.3)
+      i18n (>= 1.8.11, < 2)
+    faraday (1.10.3)
       faraday-em_http (~> 1.0)
       faraday-em_synchrony (~> 1.0)
       faraday-excon (~> 1.1)
@@ -268,24 +281,23 @@ GEM
     faraday-em_synchrony (1.0.0)
     faraday-excon (1.1.0)
     faraday-httpclient (1.0.1)
-    faraday-multipart (1.0.3)
-      multipart-post (>= 1.2, < 3)
+    faraday-multipart (1.0.4)
+      multipart-post (~> 2)
     faraday-net_http (1.0.1)
     faraday-net_http_persistent (1.2.0)
     faraday-patron (1.0.0)
     faraday-rack (1.0.0)
     faraday-retry (1.0.3)
-    fastimage (2.2.6)
+    fastimage (2.3.0)
     ffi (1.16.3)
     fugit (1.9.0)
       et-orbi (~> 1, >= 1.2.7)
       raabro (~> 1.4)
-    gherkin (5.1.0)
-    globalid (1.0.1)
-      activesupport (>= 5.0)
+    globalid (1.2.1)
+      activesupport (>= 6.1)
     god (0.13.7)
-    hashdiff (1.0.1)
-    highline (2.0.3)
+    hashdiff (1.1.0)
+    highline (3.0.1)
     htmlentities (4.3.4)
     http-accept (1.7.0)
     http-cookie (1.0.5)
@@ -293,95 +305,108 @@ GEM
     httparty (0.21.0)
       mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
-    i18n (1.13.0)
+    i18n (1.14.1)
       concurrent-ruby (~> 1.0)
-    i18n-tasks (1.0.12)
+    i18n-tasks (1.0.13)
       activesupport (>= 4.0.2)
       ast (>= 2.1.0)
       better_html (>= 1.0, < 3.0)
       erubi
       highline (>= 2.0.0)
       i18n
-      parser (>= 2.2.3.0)
+      parser (>= 3.2.2.1)
       rails-i18n
       rainbow (>= 2.2.2, < 4.0)
       terminal-table (>= 1.5.1)
-    jmespath (1.6.1)
-    json (2.6.1)
+    jmespath (1.6.2)
+    json (2.7.1)
     kgio (2.10.0)
-    kt-paperclip (7.1.0)
+    kt-paperclip (7.2.2)
       activemodel (>= 4.2.0)
       activesupport (>= 4.2.0)
       marcel (~> 1.0.1)
       mime-types
-      terrapin (~> 0.6.0)
-    launchy (2.5.0)
-      addressable (~> 2.7)
-    listen (3.8.0)
-      rb-fsevent (~> 0.10, >= 0.10.3)
-      rb-inotify (~> 0.9, >= 0.9.10)
-    lograge (0.11.2)
+      terrapin (>= 0.6.0, < 2.0)
+    launchy (2.5.2)
+      addressable (~> 2.8)
+    lograge (0.14.0)
       actionpack (>= 4)
       activesupport (>= 4)
       railties (>= 4)
       request_store (~> 1.0)
-    loofah (2.19.1)
+    loofah (2.22.0)
       crass (~> 1.0.2)
-      nokogiri (>= 1.5.9)
-    mail (2.7.1)
+      nokogiri (>= 1.12.0)
+    mail (2.8.1)
       mini_mime (>= 0.1.1)
+      net-imap
+      net-pop
+      net-smtp
     marcel (1.0.2)
     matrix (0.4.2)
-    mechanize (2.8.5)
+    mechanize (2.10.0)
       addressable (~> 2.8)
+      base64
       domain_name (~> 0.5, >= 0.5.20190701)
       http-cookie (~> 1.0, >= 1.0.3)
       mime-types (~> 3.0)
       net-http-digest_auth (~> 1.4, >= 1.4.1)
       net-http-persistent (>= 2.5.2, < 5.0.dev)
+      nkf
       nokogiri (~> 1.11, >= 1.11.2)
       rubyntlm (~> 0.6, >= 0.6.3)
       webrick (~> 1.7)
       webrobots (~> 0.1.2)
     method_source (1.0.0)
-    mime-types (3.4.1)
+    mime-types (3.5.2)
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2022.0105)
+    mime-types-data (3.2023.1205)
     mimemagic (0.3.10)
       nokogiri (~> 1)
       rake
-    mini_mime (1.1.2)
-    mini_portile2 (2.8.2)
-    minitest (5.17.0)
+    mini_mime (1.1.5)
+    mini_portile2 (2.8.5)
+    minitest (5.21.2)
     mono_logger (1.1.2)
     multi_json (1.15.0)
-    multi_test (0.1.2)
+    multi_test (1.1.0)
     multi_xml (0.6.0)
-    multipart-post (2.1.1)
+    multipart-post (2.3.0)
     mustermann (3.0.0)
       ruby2_keywords (~> 0.0.1)
-    mysql2 (0.5.4)
-    n_plus_one_control (0.6.2)
+    mysql2 (0.5.5)
+    n_plus_one_control (0.7.1)
     net-http-digest_auth (1.4.1)
-    net-http-persistent (4.0.1)
+    net-http-persistent (4.0.2)
       connection_pool (~> 2.2)
-    net-scp (3.0.0)
-      net-ssh (>= 2.6.5, < 7.0.0)
-    net-sftp (3.0.0)
-      net-ssh (>= 5.0.0, < 7.0.0)
-    net-ssh (6.1.0)
+    net-imap (0.4.9.1)
+      date
+      net-protocol
+    net-pop (0.1.2)
+      net-protocol
+    net-protocol (0.2.2)
+      timeout
+    net-scp (4.0.0)
+      net-ssh (>= 2.6.5, < 8.0.0)
+    net-sftp (4.0.0)
+      net-ssh (>= 5.0.0, < 8.0.0)
+    net-smtp (0.4.0.1)
+      net-protocol
+    net-ssh (7.2.1)
     net-ssh-gateway (2.0.0)
       net-ssh (>= 4.0.0)
     netrc (0.11.0)
-    newrelic_rpm (8.16.0)
-    nio4r (2.5.8)
-    nokogiri (1.14.3)
-      mini_portile2 (~> 2.8.0)
+    newrelic_rpm (9.7.1)
+    nio4r (2.7.0)
+    nkf (0.2.0)
+    nokogiri (1.16.0)
+      mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     orm_adapter (0.5.0)
-    parallel (1.23.0)
-    parser (3.1.0.0)
+    parallel (1.24.0)
+    parser (3.3.0.5)
       ast (~> 2.4.1)
+      racc
     permit_yo (2.1.3)
     phraseapp-in-context-editor-ruby (1.4.0)
       i18n (>= 0.6)
@@ -389,79 +414,78 @@ GEM
       phraseapp-ruby (~> 1.3)
       request_store (~> 1.3)
     phraseapp-ruby (1.6.0)
-    pickle (0.6.2)
-      cucumber (>= 3.0, < 8.0)
+    pickle (0.9.0)
+      cucumber (>= 3.0, < 10.0)
       rake
-    power_assert (2.0.1)
-    pry (0.13.1)
+    power_assert (2.0.3)
+    pry (0.14.2)
       coderay (~> 1.1)
       method_source (~> 1.0)
-    pry-byebug (3.9.0)
+    pry-byebug (3.10.1)
       byebug (~> 11.0)
-      pry (~> 0.13.0)
-    public_suffix (4.0.7)
-    pundit (2.1.1)
+      pry (>= 0.13, < 0.15)
+    public_suffix (5.0.4)
+    pundit (2.3.1)
       activesupport (>= 3.0.0)
     raabro (1.4.0)
-    racc (1.7.1)
-    rack (2.2.6.4)
-    rack-attack (6.6.0)
-      rack (>= 1.0, < 3)
-    rack-dev-mark (0.7.9)
-      rack (>= 1.1, < 2.3)
+    racc (1.7.3)
+    rack (2.2.8)
+    rack-attack (6.7.0)
+      rack (>= 1.0, < 4)
+    rack-dev-mark (0.8.0)
+      rack (>= 1.1, < 4.0)
     rack-protection (3.2.0)
       base64 (>= 0.1.0)
       rack (~> 2.2, >= 2.2.4)
-    rack-test (2.0.2)
+    rack-test (2.1.0)
       rack (>= 1.3)
-    rails (6.1.7.4)
-      actioncable (= 6.1.7.4)
-      actionmailbox (= 6.1.7.4)
-      actionmailer (= 6.1.7.4)
-      actionpack (= 6.1.7.4)
-      actiontext (= 6.1.7.4)
-      actionview (= 6.1.7.4)
-      activejob (= 6.1.7.4)
-      activemodel (= 6.1.7.4)
-      activerecord (= 6.1.7.4)
-      activestorage (= 6.1.7.4)
-      activesupport (= 6.1.7.4)
+    rails (7.0.8)
+      actioncable (= 7.0.8)
+      actionmailbox (= 7.0.8)
+      actionmailer (= 7.0.8)
+      actionpack (= 7.0.8)
+      actiontext (= 7.0.8)
+      actionview (= 7.0.8)
+      activejob (= 7.0.8)
+      activemodel (= 7.0.8)
+      activerecord (= 7.0.8)
+      activestorage (= 7.0.8)
+      activesupport (= 7.0.8)
       bundler (>= 1.15.0)
-      railties (= 6.1.7.4)
-      sprockets-rails (>= 2.0.0)
+      railties (= 7.0.8)
     rails-controller-testing (1.0.5)
       actionpack (>= 5.0.1.rc1)
       actionview (>= 5.0.1.rc1)
       activesupport (>= 5.0.1.rc1)
-    rails-dom-testing (2.0.3)
-      activesupport (>= 4.2.0)
+    rails-dom-testing (2.2.0)
+      activesupport (>= 5.0.0)
+      minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.5.0)
-      loofah (~> 2.19, >= 2.19.1)
-    rails-i18n (7.0.3)
+    rails-html-sanitizer (1.6.0)
+      loofah (~> 2.21)
+      nokogiri (~> 1.14)
+    rails-i18n (7.0.8)
       i18n (>= 0.7, < 2)
       railties (>= 6.0.0, < 8)
-    railties (6.1.7.4)
-      actionpack (= 6.1.7.4)
-      activesupport (= 6.1.7.4)
+    railties (7.0.8)
+      actionpack (= 7.0.8)
+      activesupport (= 7.0.8)
       method_source
       rake (>= 12.2)
       thor (~> 1.0)
+      zeitwerk (~> 2.5)
     rainbow (3.1.1)
-    raindrops (0.20.0)
-    rake (13.0.6)
-    rb-fsevent (0.11.2)
-    rb-inotify (0.10.1)
-      ffi (~> 1.0)
+    raindrops (0.20.1)
+    rake (13.1.0)
     redis (3.3.5)
-    redis-namespace (1.8.1)
+    redis-namespace (1.8.2)
       redis (>= 3.0.4)
-    regexp_parser (2.5.0)
+    regexp_parser (2.9.0)
     request_store (1.5.1)
       rack (>= 1.4)
-    responders (3.0.1)
-      actionpack (>= 5.0)
-      railties (>= 5.0)
+    responders (3.1.1)
+      actionpack (>= 5.2)
+      railties (>= 5.2)
     resque (2.6.0)
       mono_logger (~> 1.0)
       multi_json (~> 1.0)
@@ -477,16 +501,16 @@ GEM
       http-cookie (>= 1.0.2, < 2.0)
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
-    rexml (3.2.5)
+    rexml (3.2.6)
     rollout (2.4.3)
-    rspec-core (3.10.2)
-      rspec-support (~> 3.10.0)
-    rspec-expectations (3.10.2)
+    rspec-core (3.12.2)
+      rspec-support (~> 3.12.0)
+    rspec-expectations (3.12.3)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.10.0)
-    rspec-mocks (3.10.3)
+      rspec-support (~> 3.12.0)
+    rspec-mocks (3.12.6)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.10.0)
+      rspec-support (~> 3.12.0)
     rspec-rails (4.0.2)
       actionpack (>= 4.2)
       activesupport (>= 4.2)
@@ -495,7 +519,7 @@ GEM
       rspec-expectations (~> 3.10)
       rspec-mocks (~> 3.10)
       rspec-support (~> 3.10)
-    rspec-support (3.10.3)
+    rspec-support (3.12.1)
     rubocop (1.22.1)
       parallel (~> 1.10)
       parser (>= 3.0.0.0)
@@ -505,8 +529,8 @@ GEM
       rubocop-ast (>= 1.12.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.15.2)
-      parser (>= 3.0.1.1)
+    rubocop-ast (1.30.0)
+      parser (>= 3.2.1.0)
     rubocop-rails (2.12.4)
       activesupport (>= 4.2.0)
       rack (>= 1.1)
@@ -521,10 +545,11 @@ GEM
       fugit (~> 1.1, >= 1.1.6)
     rvm-capistrano (1.5.6)
       capistrano (~> 2.15.4)
-    sanitize (6.0.2)
+    sanitize (6.1.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    selenium-webdriver (4.8.1)
+    selenium-webdriver (4.17.0)
+      base64 (~> 0.2)
       rexml (~> 3.2, >= 3.2.5)
       rubyzip (>= 1.2.2, < 3.0)
       websocket (~> 1.0)
@@ -534,7 +559,7 @@ GEM
     shoulda-context (2.0.0)
     shoulda-matchers (4.5.1)
       activesupport (>= 4.2.0)
-    simplecov (0.21.2)
+    simplecov (0.22.0)
       docile (~> 1.1)
       simplecov-html (~> 0.11)
       simplecov_json_formatter (~> 0.1)
@@ -542,7 +567,7 @@ GEM
       rexml
       simplecov (~> 0.19)
     simplecov-html (0.12.3)
-    simplecov_json_formatter (0.1.3)
+    simplecov_json_formatter (0.1.4)
     sinatra (3.2.0)
       mustermann (~> 3.0)
       rack (~> 2.2, >= 2.2.4)
@@ -552,57 +577,53 @@ GEM
     sprockets (3.7.2)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-rails (3.4.2)
-      actionpack (>= 5.2)
-      activesupport (>= 5.2)
-      sprockets (>= 3.0.0)
-    stringex (2.8.5)
+    stringex (2.8.6)
+    sys-uname (1.2.3)
+      ffi (~> 1.1)
     terminal-table (3.0.2)
       unicode-display_width (>= 1.1.1, < 3)
-    terrapin (0.6.0)
-      climate_control (>= 0.0.3, < 1.0)
-    test-unit (3.5.3)
+    terrapin (1.0.1)
+      climate_control
+    test-unit (3.6.1)
       power_assert
-    thor (1.2.1)
+    thor (1.3.0)
     tilt (2.3.0)
-    timecop (0.9.4)
-    timeliness (0.4.4)
+    timecop (0.9.8)
+    timeliness (0.4.5)
+    timeout (0.4.1)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    unf (0.1.4)
-      unf_ext
-    unf_ext (0.0.8.2)
     unicode (0.4.4.4)
-    unicode-display_width (1.8.0)
+    unicode-display_width (2.5.0)
     unicode_utils (1.4.0)
     unicorn (5.8.0)
       kgio (~> 2.6)
       raindrops (~> 0.7)
     unidecoder (1.1.2)
-    uniform_notifier (1.14.2)
+    uniform_notifier (1.16.0)
     vcr (3.0.3)
     warden (1.2.9)
       rack (>= 2.0.9)
-    webmock (3.18.1)
+    webmock (3.19.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
-    webrick (1.7.0)
+    webrick (1.8.1)
     webrobots (0.1.2)
-    websocket (1.2.9)
-    websocket-driver (0.7.5)
+    websocket (1.2.10)
+    websocket-driver (0.7.6)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
     whenever (0.6.8)
       aaronh-chronic (>= 0.3.9)
       activesupport (>= 2.3.4)
-    whiny_validation (1.0)
+    whiny_validation (1.1)
       activemodel
       activesupport
-    will_paginate (3.3.1)
+    will_paginate (4.0.0)
     xpath (3.2.0)
       nokogiri (~> 1.8)
-    zeitwerk (2.6.8)
+    zeitwerk (2.6.12)
 
 PLATFORMS
   ruby
@@ -654,7 +675,6 @@ DEPENDENCIES
   kgio (= 2.10.0)
   kt-paperclip (>= 5.2.0)
   launchy
-  listen (~> 3.3)
   lograge
   mechanize
   mimemagic (= 0.3.10)
@@ -671,7 +691,7 @@ DEPENDENCIES
   rack (~> 2.2)
   rack-attack
   rack-dev-mark (>= 0.7.8)
-  rails (~> 6.1.7)
+  rails (~> 7.0.8)
   rails-controller-testing
   rails-i18n
   rails-observers!
diff --git a/bin/rails b/bin/rails
index 6fb4e4051c4..efc0377492f 100755
--- a/bin/rails
+++ b/bin/rails
@@ -1,4 +1,4 @@
 #!/usr/bin/env ruby
-APP_PATH = File.expand_path('../config/application', __dir__)
+APP_PATH = File.expand_path("../config/application", __dir__)
 require_relative "../config/boot"
 require "rails/commands"
diff --git a/bin/setup b/bin/setup
index 57923026c41..ec47b79b3b3 100755
--- a/bin/setup
+++ b/bin/setup
@@ -2,7 +2,7 @@
 require "fileutils"
 
 # path to your application root.
-APP_ROOT = File.expand_path('..', __dir__)
+APP_ROOT = File.expand_path("..", __dir__)
 
 def system!(*args)
   system(*args) || abort("\n== Command #{args} failed ==")
@@ -13,21 +13,21 @@ FileUtils.chdir APP_ROOT do
   # This script is idempotent, so that you can run it at any time and get an expectable outcome.
   # Add necessary setup steps to this file.
 
-  puts '== Installing dependencies =='
-  system! 'gem install bundler --conservative'
-  system('bundle check') || system!('bundle install')
+  puts "== Installing dependencies =="
+  system! "gem install bundler --conservative"
+  system("bundle check") || system!("bundle install")
 
   # puts "\n== Copying sample files =="
-  # unless File.exist?('config/database.yml')
-  #   FileUtils.cp 'config/database.yml.sample', 'config/database.yml'
+  # unless File.exist?("config/database.yml")
+  #   FileUtils.cp "config/database.yml.sample", "config/database.yml"
   # end
 
   puts "\n== Preparing database =="
-  system! 'bin/rails db:prepare'
+  system! "bin/rails db:prepare"
 
   puts "\n== Removing old logs and tempfiles =="
-  system! 'bin/rails log:clear tmp:clear'
+  system! "bin/rails log:clear tmp:clear"
 
   puts "\n== Restarting application server =="
-  system! 'bin/rails restart'
+  system! "bin/rails restart"
 end
diff --git a/config/environments/development.rb b/config/environments/development.rb
index e0abce56047..cd68be1d8a8 100644
--- a/config/environments/development.rb
+++ b/config/environments/development.rb
@@ -12,6 +12,9 @@
   # Show full error reports.
   config.consider_all_requests_local = true
 
+  # Enable server timing
+  config.server_timing = true
+
   # Enable/disable caching. By default caching is disabled.
   # Run rails dev:cache to toggle caching.
   if Rails.root.join("tmp/caching-dev.txt").exist?
@@ -22,6 +25,9 @@
     memcached_servers = YAML.load_file(Rails.root.join("config/local.yml")).fetch("MEMCACHED_SERVERS", memcached_servers) if File.file?(Rails.root.join("config/local.yml"))
     config.cache_store = :mem_cache_store, memcached_servers,
                          { namespace: "ao3-v2-dev", compress: true, pool_size: 10 }
+    config.public_file_server.headers = {
+      "Cache-Control" => "public, max-age=#{2.days.to_i}"
+    }
   else
     config.action_controller.perform_caching = false
 
@@ -54,24 +60,12 @@
   # Highlight code that triggered database queries in logs.
   config.active_record.verbose_query_logs = true
 
-  # Debug mode disables concatenation and preprocessing of assets.
-  # This option may cause significant delays in view rendering with a large
-  # number of complex assets.
-  config.assets.debug = true
-
-  # Suppress logger output for asset requests.
-  config.assets.quiet = true
-
   # Raises error for missing translations.
   config.i18n.raise_on_missing_translations = true
 
   # Annotate rendered view with file names.
   # config.action_view.annotate_rendered_view_with_filenames = true
 
-  # Use an evented file watcher to asynchronously detect changes in source code,
-  # routes, locales, etc. This feature depends on the listen gem.
-  config.file_watcher = ActiveSupport::EventedFileUpdateChecker
-
   # Uncomment if you wish to allow Action Cable access from any origin.
   # config.action_cable.disable_request_forgery_protection = true
 
diff --git a/config/environments/production.rb b/config/environments/production.rb
index 3e29fe4d98d..9aa280fdc0f 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -18,9 +18,6 @@
   config.consider_all_requests_local       = false
   config.action_controller.perform_caching = true
 
-  # Disable IP spoofing protection
-  config.action_dispatch.ip_spoofing_check = false
-
   # Ensures that a master key has been made available in either ENV["RAILS_MASTER_KEY"]
   # or in config/master.key. This key is used to decrypt credentials (and other encrypted files).
   # config.require_master_key = true
@@ -29,18 +26,12 @@
   # Apache or NGINX already handles this.
   config.public_file_server.enabled = ENV["RAILS_SERVE_STATIC_FILES"].present?
 
-  # Compress CSS using a preprocessor.
-  # config.assets.css_compressor = :sass
-
-  # Do not fallback to assets pipeline if a precompiled asset is missed.
-  config.assets.compile = false
-
   # Enable serving of images, stylesheets, and JavaScripts from an asset server.
-  # config.asset_host = 'http://assets.example.com'
+  # config.asset_host = "http://assets.example.com"
 
   # Specifies the header that your server uses for sending files.
-  # config.action_dispatch.x_sendfile_header = 'X-Sendfile' # for Apache
-  # config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect' # for NGINX
+  # config.action_dispatch.x_sendfile_header = "X-Sendfile" # for Apache
+  # config.action_dispatch.x_sendfile_header = "X-Accel-Redirect" # for NGINX
 
   # Store uploaded files on the local file system (see config/storage.yml for options).
   config.active_storage.service = :local
@@ -51,8 +42,8 @@
 
   # Mount Action Cable outside main process or domain.
   # config.action_cable.mount_path = nil
-  # config.action_cable.url = 'wss://example.com/cable'
-  # config.action_cable.allowed_request_origins = [ 'http://example.com', /http:\/\/example.*/ ]
+  # config.action_cable.url = "wss://example.com/cable"
+  # config.action_cable.allowed_request_origins = [ "http://example.com", /http:\/\/example.*/ ]
 
   # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
   # config.force_ssl = true
@@ -82,51 +73,24 @@
   # the I18n.default_locale when a translation cannot be found).
   config.i18n.fallbacks = true
 
-  # Send deprecation notices to registered listeners.
-  config.active_support.deprecation = :notify
+  # Don't log any deprecations.
+  config.active_support.report_deprecations = false
 
   config.middleware.use Rack::Attack
 
-  # Log disallowed deprecations.
-  config.active_support.disallowed_deprecation = :log
-
-  # Tell Active Support which deprecation messages to disallow.
-  config.active_support.disallowed_deprecation_warnings = []
-
   # Use default logging formatter so that PID and timestamp are not suppressed.
   config.log_formatter = ::Logger::Formatter.new
 
   # Use a different logger for distributed setups.
   # require "syslog/logger"
-  # config.logger = ActiveSupport::TaggedLogging.new(Syslog::Logger.new 'app-name')
+  # config.logger = ActiveSupport::TaggedLogging.new(Syslog::Logger.new "app-name")
 
   if ENV["RAILS_LOG_TO_STDOUT"].present?
-    logger           = ActiveSupport::Logger.new($stdout)
+    logger           = ActiveSupport::Logger.new(STDOUT)
     logger.formatter = config.log_formatter
     config.logger    = ActiveSupport::TaggedLogging.new(logger)
   end
 
   # Do not dump schema after migrations.
   config.active_record.dump_schema_after_migration = false
-
-  # Inserts middleware to perform automatic connection switching.
-  # The `database_selector` hash is used to pass options to the DatabaseSelector
-  # middleware. The `delay` is used to determine how long to wait after a write
-  # to send a subsequent read to the primary.
-  #
-  # The `database_resolver` class is used by the middleware to determine which
-  # database is appropriate to use based on the time delay.
-  #
-  # The `database_resolver_context` class is used by the middleware to set
-  # timestamps for the last write to the primary. The resolver uses the context
-  # class timestamps to determine how long to wait before reading from the
-  # replica.
-  #
-  # By default Rails will store a last write timestamp in the session. The
-  # DatabaseSelector middleware is designed as such you can define your own
-  # strategy for connection switching and pass that into the middleware through
-  # these configuration options.
-  # config.active_record.database_selector = { delay: 2.seconds }
-  # config.active_record.database_resolver = ActiveRecord::Middleware::DatabaseSelector::Resolver
-  # config.active_record.database_resolver_context = ActiveRecord::Middleware::DatabaseSelector::Resolver::Session
 end
diff --git a/config/environments/test.rb b/config/environments/test.rb
index f5e791a061f..ab3fa19c3dd 100644
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -8,6 +8,7 @@
 Rails.application.configure do
   # Settings specified here will take precedence over those in config/application.rb.
 
+  # Turn false under Spring and add config.action_view.cache_template_loading = true.
   config.cache_classes = true
 
   # Do not eager load code on boot, except in CI. This avoids loading your whole application
@@ -54,9 +55,6 @@
   # Configure strong parameters to raise an exception if an unpermitted attribute is used
   config.action_controller.action_on_unpermitted_parameters = :raise
 
-  config.serve_static_files = true
-  config.assets.enabled = false
-
   # Make sure that we don't have a host mismatch:
   config.action_controller.default_url_options = { host: "http://www.example.com", port: nil }
   config.action_mailer.default_url_options = config.action_controller.default_url_options
diff --git a/config/initializers/assets.rb b/config/initializers/assets.rb
index fe48fc34ee2..d6156df0120 100644
--- a/config/initializers/assets.rb
+++ b/config/initializers/assets.rb
@@ -1,7 +1,7 @@
 # Be sure to restart your server when you modify this file.
 
 # Version of your assets, change this if you want to expire all your assets.
-Rails.application.config.assets.version = '1.0'
+# Rails.application.config.assets.version = "1.0"
 
 # Add additional assets to the asset load path.
 # Rails.application.config.assets.paths << Emoji.images_path
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index 41c43016f1d..54f47cf15fe 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -1,28 +1,25 @@
 # Be sure to restart your server when you modify this file.
 
-# Define an application-wide content security policy
-# For further information see the following documentation
-# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+# Define an application-wide content security policy.
+# See the Securing Rails Applications Guide for more information:
+# https://guides.rubyonrails.org/security.html#content-security-policy-header
 
-# Rails.application.config.content_security_policy do |policy|
-#   policy.default_src :self, :https
-#   policy.font_src    :self, :https, :data
-#   policy.img_src     :self, :https, :data
-#   policy.object_src  :none
-#   policy.script_src  :self, :https
-#   policy.style_src   :self, :https
-
-#   # Specify URI for violation reports
-#   # policy.report_uri "/csp-violation-report-endpoint"
+# Rails.application.configure do
+#   config.content_security_policy do |policy|
+#     policy.default_src :self, :https
+#     policy.font_src    :self, :https, :data
+#     policy.img_src     :self, :https, :data
+#     policy.object_src  :none
+#     policy.script_src  :self, :https
+#     policy.style_src   :self, :https
+#     # Specify URI for violation reports
+#     # policy.report_uri "/csp-violation-report-endpoint"
+#   end
+#
+#   # Generate session nonces for permitted importmap and inline scripts
+#   config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
+#   config.content_security_policy_nonce_directives = %w(script-src)
+#
+#   # Report violations without enforcing the policy.
+#   # config.content_security_policy_report_only = true
 # end
-
-# If you are using UJS then enable automatic nonce generation
-# Rails.application.config.content_security_policy_nonce_generator = -> request { SecureRandom.base64(16) }
-
-# Set the nonce only to specific directives
-# Rails.application.config.content_security_policy_nonce_directives = %w(script-src)
-
-# Report CSP violations to a specified URI
-# For further information see the following documentation:
-# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only
-# Rails.application.config.content_security_policy_report_only = true
diff --git a/config/initializers/cors.rb b/config/initializers/cors.rb
index 3b1c1b5ed14..e5a82f162c4 100644
--- a/config/initializers/cors.rb
+++ b/config/initializers/cors.rb
@@ -7,9 +7,9 @@
 
 # Rails.application.config.middleware.insert_before 0, Rack::Cors do
 #   allow do
-#     origins 'example.com'
+#     origins "example.com"
 #
-#     resource '*',
+#     resource "*",
 #       headers: :any,
 #       methods: [:get, :post, :put, :patch, :delete, :options, :head]
 #   end
diff --git a/config/initializers/filter_parameter_logging.rb b/config/initializers/filter_parameter_logging.rb
index 4a994e1e7bb..adc6568ce83 100644
--- a/config/initializers/filter_parameter_logging.rb
+++ b/config/initializers/filter_parameter_logging.rb
@@ -1,4 +1,8 @@
 # Be sure to restart your server when you modify this file.
 
-# Configure sensitive parameters which will be filtered from the log file.
-Rails.application.config.filter_parameters += [:password]
+# Configure parameters to be filtered from the log file. Use this to limit dissemination of
+# sensitive information. See the ActiveSupport::ParameterFilter documentation for supported
+# notations and behaviors.
+Rails.application.config.filter_parameters += [
+  :passw, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn
+]
diff --git a/config/initializers/inflections.rb b/config/initializers/inflections.rb
index ac033bf9dc8..3860f659ead 100644
--- a/config/initializers/inflections.rb
+++ b/config/initializers/inflections.rb
@@ -4,13 +4,13 @@
 # are locale specific, and you may define rules for as many different
 # locales as you wish. All of these examples are active by default:
 # ActiveSupport::Inflector.inflections(:en) do |inflect|
-#   inflect.plural /^(ox)$/i, '\1en'
-#   inflect.singular /^(ox)en/i, '\1'
-#   inflect.irregular 'person', 'people'
+#   inflect.plural /^(ox)$/i, "\\1en"
+#   inflect.singular /^(ox)en/i, "\\1"
+#   inflect.irregular "person", "people"
 #   inflect.uncountable %w( fish sheep )
 # end
 
 # These inflection rules are supported but not enabled by default:
 # ActiveSupport::Inflector.inflections(:en) do |inflect|
-#   inflect.acronym 'RESTful'
+#   inflect.acronym "RESTful"
 # end
diff --git a/config/initializers/new_framework_defaults_7_0.rb b/config/initializers/new_framework_defaults_7_0.rb
new file mode 100644
index 00000000000..927e3119531
--- /dev/null
+++ b/config/initializers/new_framework_defaults_7_0.rb
@@ -0,0 +1,128 @@
+# Be sure to restart your server when you modify this file.
+#
+# This file eases your Rails 7.0 framework defaults upgrade.
+#
+# Uncomment each configuration one by one to switch to the new default.
+# Once your application is ready to run with all new defaults, you can remove
+# this file and set the `config.load_defaults` to `7.0`.
+#
+# Read the Guide for Upgrading Ruby on Rails for more info on each option.
+# https://guides.rubyonrails.org/upgrading_ruby_on_rails.html
+
+# `button_to` view helper will render `<button>` element, regardless of whether
+# or not the content is passed as the first argument or as a block.
+# Rails.application.config.action_view.button_to_generates_button_tag = true
+
+# `stylesheet_link_tag` view helper will not render the media attribute by default.
+# Rails.application.config.action_view.apply_stylesheet_media_default = false
+
+# Change the digest class for the key generators to `OpenSSL::Digest::SHA256`.
+# Changing this default means invalidate all encrypted messages generated by
+# your application and, all the encrypted cookies. Only change this after you
+# rotated all the messages using the key rotator.
+#
+# See upgrading guide for more information on how to build a rotator.
+# https://guides.rubyonrails.org/v7.0/upgrading_ruby_on_rails.html
+# Rails.application.config.active_support.key_generator_hash_digest_class = OpenSSL::Digest::SHA256
+
+# Change the digest class for ActiveSupport::Digest.
+# Changing this default means that for example Etags change and
+# various cache keys leading to cache invalidation.
+# Rails.application.config.active_support.hash_digest_class = OpenSSL::Digest::SHA256
+
+# Don't override ActiveSupport::TimeWithZone.name and use the default Ruby
+# implementation.
+# Rails.application.config.active_support.remove_deprecated_time_with_zone_name = true
+
+# Calls `Rails.application.executor.wrap` around test cases.
+# This makes test cases behave closer to an actual request or job.
+# Several features that are normally disabled in test, such as Active Record query cache
+# and asynchronous queries will then be enabled.
+# Rails.application.config.active_support.executor_around_test_case = true
+
+# Set both the `:open_timeout` and `:read_timeout` values for `:smtp` delivery method.
+# Rails.application.config.action_mailer.smtp_timeout = 5
+
+# The ActiveStorage video previewer will now use scene change detection to generate
+# better preview images (rather than the previous default of using the first frame
+# of the video).
+# Rails.application.config.active_storage.video_preview_arguments =
+#   "-vf 'select=eq(n\\,0)+eq(key\\,1)+gt(scene\\,0.015),loop=loop=-1:size=2,trim=start_frame=1' -frames:v 1 -f image2"
+
+# Automatically infer `inverse_of` for associations with a scope.
+# Rails.application.config.active_record.automatic_scope_inversing = true
+
+# Raise when running tests if fixtures contained foreign key violations
+# Rails.application.config.active_record.verify_foreign_keys_for_fixtures = true
+
+# Disable partial inserts.
+# This default means that all columns will be referenced in INSERT queries
+# regardless of whether they have a default or not.
+# Rails.application.config.active_record.partial_inserts = false
+
+# Protect from open redirect attacks in `redirect_back_or_to` and `redirect_to`.
+# Rails.application.config.action_controller.raise_on_open_redirects = true
+
+# Change the variant processor for Active Storage.
+# Changing this default means updating all places in your code that
+# generate variants to use image processing macros and ruby-vips
+# operations. See the upgrading guide for detail on the changes required.
+# The `:mini_magick` option is not deprecated; it's fine to keep using it.
+# Rails.application.config.active_storage.variant_processor = :vips
+
+# Enable parameter wrapping for JSON.
+# Previously this was set in an initializer. It's fine to keep using that initializer if you've customized it.
+# To disable parameter wrapping entirely, set this config to `false`.
+# Rails.application.config.action_controller.wrap_parameters_by_default = true
+
+# Specifies whether generated namespaced UUIDs follow the RFC 4122 standard for namespace IDs provided as a
+# `String` to `Digest::UUID.uuid_v3` or `Digest::UUID.uuid_v5` method calls.
+#
+# See https://guides.rubyonrails.org/configuring.html#config-active-support-use-rfc4122-namespaced-uuids for
+# more information.
+# Rails.application.config.active_support.use_rfc4122_namespaced_uuids = true
+
+# Change the default headers to disable browsers' flawed legacy XSS protection.
+# Rails.application.config.action_dispatch.default_headers = {
+#   "X-Frame-Options" => "SAMEORIGIN",
+#   "X-XSS-Protection" => "0",
+#   "X-Content-Type-Options" => "nosniff",
+#   "X-Download-Options" => "noopen",
+#   "X-Permitted-Cross-Domain-Policies" => "none",
+#   "Referrer-Policy" => "strict-origin-when-cross-origin"
+# }
+
+
+# ** Please read carefully, this must be configured in config/application.rb **
+# Change the format of the cache entry.
+# Changing this default means that all new cache entries added to the cache
+# will have a different format that is not supported by Rails 6.1 applications.
+# Only change this value after your application is fully deployed to Rails 7.0
+# and you have no plans to rollback.
+# When you're ready to change format, add this to `config/application.rb` (NOT this file):
+#  config.active_support.cache_format_version = 7.0
+
+
+# Cookie serializer: 2 options
+#
+# If you're upgrading and haven't set `cookies_serializer` previously, your cookie serializer
+# is `:marshal`. The default for new apps is `:json`.
+#
+# Rails.application.config.action_dispatch.cookies_serializer = :json
+#
+#
+# NOTE: as of https://github.com/otwcode/otwarchive/pull/4651, we are using :hybrid, which is the first step to migate.
+# After some time, we can update to use :json instead.
+
+# Change the return value of `ActionDispatch::Request#content_type` to the Content-Type header without modification.
+# Rails.application.config.action_dispatch.return_only_request_media_type_on_content_type = false
+
+# Active Storage `has_many_attached` relationships will default to replacing the current collection instead of appending to it.
+# Thus, to support submitting an empty collection, the `file_field` helper will render an hidden field `include_hidden` by default when `multiple_file_field_include_hidden` is set to `true`.
+# See https://guides.rubyonrails.org/configuring.html#config-active-storage-multiple-file-field-include-hidden for more information.
+# Rails.application.config.active_storage.multiple_file_field_include_hidden = true
+
+# ** Please read carefully, this must be configured in config/application.rb (NOT this file) **
+# Disables the deprecated #to_s override in some Ruby core classes
+# See https://guides.rubyonrails.org/configuring.html#config-active-support-disable-to-s-conversion for more information.
+# config.active_support.disable_to_s_conversion = true
diff --git a/db/schema.rb b/db/schema.rb
index d8e5cbf6ff5..2009e32a175 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2023_09_20_094945) do
+ActiveRecord::Schema[6.1].define(version: 2023_09_20_094945) do
 
   create_table "abuse_reports", id: :integer, charset: "utf8mb4", collation: "utf8mb4_unicode_ci", options: "ENGINE=InnoDB ROW_FORMAT=DYNAMIC", force: :cascade do |t|
     t.string "email"

From 047762667dbf07ab5f74949e46f8777a50f41f4c Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sat, 27 Jan 2024 12:08:46 -0500
Subject: [PATCH 02/22] Fix bugs/deprecation warnings

---
 app/controllers/application_controller.rb | 2 +-
 app/helpers/application_helper.rb         | 8 --------
 2 files changed, 1 insertion(+), 9 deletions(-)

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 556e2bcf8eb..b7339d36e23 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -1,5 +1,5 @@
 class ApplicationController < ActionController::Base
-  include Pundit
+  include Pundit::Authorization
   protect_from_forgery with: :exception, prepend: true
   rescue_from ActionController::InvalidAuthenticityToken, with: :display_auth_error
 
diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 8f5054c9782..ae2aafabe0b 100755
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -343,14 +343,6 @@ def name_to_id(name)
     name.to_s.gsub(/\]\[|[^-a-zA-Z0-9:.]/, "_").sub(/_$/, "")
   end
 
-  def field_id(form, attribute)
-    name_to_id(field_name(form, attribute))
-  end
-
-  def field_name(form, attribute)
-    "#{form.object_name}[#{field_attribute(attribute)}]"
-  end
-
   # toggle an checkboxes (scrollable checkboxes) section of a form to show all of the checkboxes
   def checkbox_section_toggle(checkboxes_id, checkboxes_size, options = {})
     toggle_show = content_tag(:a, ts("Expand %{checkboxes_size} Checkboxes", checkboxes_size: checkboxes_size),

From 1067cebf513afcef0514f853ce83ad0c1ca09a76 Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sat, 27 Jan 2024 12:20:46 -0500
Subject: [PATCH 03/22] Enable some safer new defaults

---
 config/application.rb                         |  2 +
 .../new_framework_defaults_7_0.rb             | 52 ++++++++-----------
 2 files changed, 25 insertions(+), 29 deletions(-)

diff --git a/config/application.rb b/config/application.rb
index 92614ab0e08..f22907bd602 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -128,5 +128,7 @@ class Application < Rails::Application
                                                   authentication: ArchiveConfig.SMTP_AUTHENTICATION
                                                 })
     end
+
+    config.active_support.disable_to_s_conversion = true
   end
 end
diff --git a/config/initializers/new_framework_defaults_7_0.rb b/config/initializers/new_framework_defaults_7_0.rb
index 927e3119531..65e9222e3e0 100644
--- a/config/initializers/new_framework_defaults_7_0.rb
+++ b/config/initializers/new_framework_defaults_7_0.rb
@@ -14,7 +14,7 @@
 # Rails.application.config.action_view.button_to_generates_button_tag = true
 
 # `stylesheet_link_tag` view helper will not render the media attribute by default.
-# Rails.application.config.action_view.apply_stylesheet_media_default = false
+Rails.application.config.action_view.apply_stylesheet_media_default = false
 
 # Change the digest class for the key generators to `OpenSSL::Digest::SHA256`.
 # Changing this default means invalidate all encrypted messages generated by
@@ -28,69 +28,68 @@
 # Change the digest class for ActiveSupport::Digest.
 # Changing this default means that for example Etags change and
 # various cache keys leading to cache invalidation.
-# Rails.application.config.active_support.hash_digest_class = OpenSSL::Digest::SHA256
+Rails.application.config.active_support.hash_digest_class = OpenSSL::Digest::SHA256
 
 # Don't override ActiveSupport::TimeWithZone.name and use the default Ruby
 # implementation.
-# Rails.application.config.active_support.remove_deprecated_time_with_zone_name = true
+Rails.application.config.active_support.remove_deprecated_time_with_zone_name = true
 
 # Calls `Rails.application.executor.wrap` around test cases.
 # This makes test cases behave closer to an actual request or job.
 # Several features that are normally disabled in test, such as Active Record query cache
 # and asynchronous queries will then be enabled.
-# Rails.application.config.active_support.executor_around_test_case = true
+Rails.application.config.active_support.executor_around_test_case = true
 
 # Set both the `:open_timeout` and `:read_timeout` values for `:smtp` delivery method.
-# Rails.application.config.action_mailer.smtp_timeout = 5
+Rails.application.config.action_mailer.smtp_timeout = 5
 
 # The ActiveStorage video previewer will now use scene change detection to generate
 # better preview images (rather than the previous default of using the first frame
 # of the video).
-# Rails.application.config.active_storage.video_preview_arguments =
-#   "-vf 'select=eq(n\\,0)+eq(key\\,1)+gt(scene\\,0.015),loop=loop=-1:size=2,trim=start_frame=1' -frames:v 1 -f image2"
+Rails.application.config.active_storage.video_preview_arguments = "-vf 'select=eq(n\\,0)+eq(key\\,1)+gt(scene\\,0.015),loop=loop=-1:size=2,trim=start_frame=1' -frames:v 1 -f image2"
 
 # Automatically infer `inverse_of` for associations with a scope.
-# Rails.application.config.active_record.automatic_scope_inversing = true
+Rails.application.config.active_record.automatic_scope_inversing = true
 
 # Raise when running tests if fixtures contained foreign key violations
-# Rails.application.config.active_record.verify_foreign_keys_for_fixtures = true
+Rails.application.config.active_record.verify_foreign_keys_for_fixtures = true
 
 # Disable partial inserts.
 # This default means that all columns will be referenced in INSERT queries
 # regardless of whether they have a default or not.
-# Rails.application.config.active_record.partial_inserts = false
+Rails.application.config.active_record.partial_inserts = false
 
 # Protect from open redirect attacks in `redirect_back_or_to` and `redirect_to`.
-# Rails.application.config.action_controller.raise_on_open_redirects = true
+Rails.application.config.action_controller.raise_on_open_redirects = true
 
 # Change the variant processor for Active Storage.
 # Changing this default means updating all places in your code that
 # generate variants to use image processing macros and ruby-vips
 # operations. See the upgrading guide for detail on the changes required.
 # The `:mini_magick` option is not deprecated; it's fine to keep using it.
-# Rails.application.config.active_storage.variant_processor = :vips
+Rails.application.config.active_storage.variant_processor = :vips
 
 # Enable parameter wrapping for JSON.
 # Previously this was set in an initializer. It's fine to keep using that initializer if you've customized it.
 # To disable parameter wrapping entirely, set this config to `false`.
-# Rails.application.config.action_controller.wrap_parameters_by_default = true
+Rails.application.config.action_controller.wrap_parameters_by_default = true
 
 # Specifies whether generated namespaced UUIDs follow the RFC 4122 standard for namespace IDs provided as a
 # `String` to `Digest::UUID.uuid_v3` or `Digest::UUID.uuid_v5` method calls.
 #
 # See https://guides.rubyonrails.org/configuring.html#config-active-support-use-rfc4122-namespaced-uuids for
 # more information.
-# Rails.application.config.active_support.use_rfc4122_namespaced_uuids = true
+Rails.application.config.active_support.use_rfc4122_namespaced_uuids = true
 
 # Change the default headers to disable browsers' flawed legacy XSS protection.
-# Rails.application.config.action_dispatch.default_headers = {
-#   "X-Frame-Options" => "SAMEORIGIN",
-#   "X-XSS-Protection" => "0",
-#   "X-Content-Type-Options" => "nosniff",
-#   "X-Download-Options" => "noopen",
-#   "X-Permitted-Cross-Domain-Policies" => "none",
-#   "Referrer-Policy" => "strict-origin-when-cross-origin"
-# }
+Rails.application.config.action_dispatch.default_headers = {
+  "X-Frame-Options" => "SAMEORIGIN",
+  "X-XSS-Protection" => "0",
+  "X-Content-Type-Options" => "nosniff",
+  "X-Download-Options" => "noopen",
+  "X-Permitted-Cross-Domain-Policies" => "none",
+  "Referrer-Policy" => "strict-origin-when-cross-origin"
+}
 
 
 # ** Please read carefully, this must be configured in config/application.rb **
@@ -115,14 +114,9 @@
 # After some time, we can update to use :json instead.
 
 # Change the return value of `ActionDispatch::Request#content_type` to the Content-Type header without modification.
-# Rails.application.config.action_dispatch.return_only_request_media_type_on_content_type = false
+Rails.application.config.action_dispatch.return_only_request_media_type_on_content_type = false
 
 # Active Storage `has_many_attached` relationships will default to replacing the current collection instead of appending to it.
 # Thus, to support submitting an empty collection, the `file_field` helper will render an hidden field `include_hidden` by default when `multiple_file_field_include_hidden` is set to `true`.
 # See https://guides.rubyonrails.org/configuring.html#config-active-storage-multiple-file-field-include-hidden for more information.
-# Rails.application.config.active_storage.multiple_file_field_include_hidden = true
-
-# ** Please read carefully, this must be configured in config/application.rb (NOT this file) **
-# Disables the deprecated #to_s override in some Ruby core classes
-# See https://guides.rubyonrails.org/configuring.html#config-active-support-disable-to-s-conversion for more information.
-# config.active_support.disable_to_s_conversion = true
+Rails.application.config.active_storage.multiple_file_field_include_hidden = true

From dc3a40f7013bb9db465213552517e34faadab72e Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sat, 27 Jan 2024 12:21:28 -0500
Subject: [PATCH 04/22] Cookie rotator

---
 config/initializers/cookie_rotator.rb | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 config/initializers/cookie_rotator.rb

diff --git a/config/initializers/cookie_rotator.rb b/config/initializers/cookie_rotator.rb
new file mode 100644
index 00000000000..1ca6f61d529
--- /dev/null
+++ b/config/initializers/cookie_rotator.rb
@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+# As part of the Rails 7 upgrade, we need to convert legacy (SHA1) cookies to SHA256.
+# This can be removed after it has been in production for a little bit.
+# Ref: https://guides.rubyonrails.org/upgrading_ruby_on_rails.html#key-generator-digest-class-change-requires-a-cookie-rotator
+Rails.application.config.after_initialize do
+  Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies|
+    authenticated_encrypted_cookie_salt = Rails.application.config.action_dispatch.authenticated_encrypted_cookie_salt
+    signed_cookie_salt = Rails.application.config.action_dispatch.signed_cookie_salt
+
+    secret_key_base = Rails.application.secret_key_base
+
+    key_generator = ActiveSupport::KeyGenerator.new(
+      secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA1
+    )
+    key_len = ActiveSupport::MessageEncryptor.key_len
+
+    old_encrypted_secret = key_generator.generate_key(authenticated_encrypted_cookie_salt, key_len)
+    old_signed_secret = key_generator.generate_key(signed_cookie_salt)
+
+    cookies.rotate :encrypted, old_encrypted_secret
+    cookies.rotate :signed, old_signed_secret
+  end
+end

From b33bbec5429ceaf987b7e80a93406a28beb32f56 Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sat, 27 Jan 2024 18:36:17 -0500
Subject: [PATCH 05/22] Fix tests

---
 config/environments/production.rb                 | 2 +-
 config/initializers/new_framework_defaults_7_0.rb | 2 --
 features/support/formatter.rb                     | 5 +++--
 3 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/config/environments/production.rb b/config/environments/production.rb
index 9aa280fdc0f..198ed05b204 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -86,7 +86,7 @@
   # config.logger = ActiveSupport::TaggedLogging.new(Syslog::Logger.new "app-name")
 
   if ENV["RAILS_LOG_TO_STDOUT"].present?
-    logger           = ActiveSupport::Logger.new(STDOUT)
+    logger           = ActiveSupport::Logger.new($stdout)
     logger.formatter = config.log_formatter
     config.logger    = ActiveSupport::TaggedLogging.new(logger)
   end
diff --git a/config/initializers/new_framework_defaults_7_0.rb b/config/initializers/new_framework_defaults_7_0.rb
index 65e9222e3e0..4b190650147 100644
--- a/config/initializers/new_framework_defaults_7_0.rb
+++ b/config/initializers/new_framework_defaults_7_0.rb
@@ -91,7 +91,6 @@
   "Referrer-Policy" => "strict-origin-when-cross-origin"
 }
 
-
 # ** Please read carefully, this must be configured in config/application.rb **
 # Change the format of the cache entry.
 # Changing this default means that all new cache entries added to the cache
@@ -101,7 +100,6 @@
 # When you're ready to change format, add this to `config/application.rb` (NOT this file):
 #  config.active_support.cache_format_version = 7.0
 
-
 # Cookie serializer: 2 options
 #
 # If you're upgrading and haven't set `cookies_serializer` previously, your cookie serializer
diff --git a/features/support/formatter.rb b/features/support/formatter.rb
index 1eb60fa33f5..cfb17d9bed1 100644
--- a/features/support/formatter.rb
+++ b/features/support/formatter.rb
@@ -1,9 +1,10 @@
 # Adapted from https://github.com/tpope/fivemat
 require "cucumber/formatter/progress"
+require_relative "./elapsed_time"
 
 module Ao3Cucumber
   class Formatter < ::Cucumber::Formatter::Progress
-    include ElapsedTime
+    include ::ElapsedTime
 
     def on_test_case_started(event)
       super
@@ -27,7 +28,7 @@ def before_feature(feature)
       @io.puts feature.location.file
       @io.flush
       @current_feature = feature
-      @start_time = Time.now
+      @start_time = Time.current
     end
 
     def after_feature

From 599bac6e45dffad9719d8e348407cbd1e0a3f05d Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sat, 27 Jan 2024 20:05:21 -0500
Subject: [PATCH 06/22] Fix tests try 2

---
 Gemfile                                       |  2 +-
 Gemfile.lock                                  |  4 +-
 app/controllers/external_works_controller.rb  | 16 ++--
 app/helpers/skin_cache_helper.rb              |  2 +-
 app/views/downloads/show.html.erb             |  2 +-
 .../new_framework_defaults_7_0.rb             | 10 ---
 lib/tasks/after_tasks.rake                    | 38 ---------
 .../external_works_controller_spec.rb         | 10 ---
 spec/helpers/share_helper_spec.rb             |  6 +-
 spec/lib/tasks/after_tasks.rake_spec.rb       | 82 -------------------
 10 files changed, 16 insertions(+), 156 deletions(-)

diff --git a/Gemfile b/Gemfile
index e97158fb196..2f5428aa5a2 100644
--- a/Gemfile
+++ b/Gemfile
@@ -129,7 +129,7 @@ group :test do
   gem 'launchy'    # So you can do Then show me the page
   gem 'delorean'
   # Record and replay data from external URLs
-  gem 'vcr', '~> 3.0', '>= 3.0.1'
+  gem "vcr", "~> 6.2"
   gem "webmock"
   gem 'timecop'
   gem 'cucumber-timecop', require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index b1d2dfd5fd2..ede9743b1ba 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -601,7 +601,7 @@ GEM
       raindrops (~> 0.7)
     unidecoder (1.1.2)
     uniform_notifier (1.16.0)
-    vcr (3.0.3)
+    vcr (6.2.0)
     warden (1.2.9)
       rack (>= 2.0.9)
     webmock (3.19.1)
@@ -720,7 +720,7 @@ DEPENDENCIES
   unicode_utils (>= 1.4.0)
   unicorn (~> 5.5)
   unidecoder
-  vcr (~> 3.0, >= 3.0.1)
+  vcr (~> 6.2)
   webmock
   whenever (~> 0.6.2)
   whiny_validation
diff --git a/app/controllers/external_works_controller.rb b/app/controllers/external_works_controller.rb
index b4870f252a1..81a1c0e2c5d 100644
--- a/app/controllers/external_works_controller.rb
+++ b/app/controllers/external_works_controller.rb
@@ -10,13 +10,13 @@ def new
 
   # Used with bookmark form to get an existing external work and return it via ajax
   def fetch
-   if params[:external_work_url]
-     url = ExternalWork.new.reformat_url(params[:external_work_url])
-     @external_work = ExternalWork.where(url: url).first
-   end
-   respond_to do |format|
-    format.json { render 'fetch.js.erb' }
-   end
+    if params[:external_work_url]
+      url = ExternalWork.new.reformat_url(params[:external_work_url])
+      @external_work = ExternalWork.where(url: url).first
+    end
+    respond_to do |format|
+      format.js
+    end
   end
 
   def index
@@ -45,7 +45,7 @@ def update
     @external_work = authorize ExternalWork.find(params[:id])
     @external_work.attributes = work_params
     if @external_work.update(external_work_params)
-      flash[:notice] = t('successfully_updated', default: 'External work was successfully updated.')
+      flash[:notice] = t("successfully_updated", default: "External work was successfully updated.")
       redirect_to(@external_work)
     else
       render action: "edit"
diff --git a/app/helpers/skin_cache_helper.rb b/app/helpers/skin_cache_helper.rb
index 9e6bbfefbd3..7a9c4829085 100644
--- a/app/helpers/skin_cache_helper.rb
+++ b/app/helpers/skin_cache_helper.rb
@@ -1,6 +1,6 @@
 module SkinCacheHelper
   def cache_timestamp
-    Time.now.utc.to_s(:usec)
+    Time.now.utc.to_fs(:usec)
   end
 
   def skin_cache_version_key(skin_id)
diff --git a/app/views/downloads/show.html.erb b/app/views/downloads/show.html.erb
index d709dd8ecd7..743413ad503 100644
--- a/app/views/downloads/show.html.erb
+++ b/app/views/downloads/show.html.erb
@@ -3,7 +3,7 @@
 <div id="chapters" class="userstuff">
   <% if @chapters.size > 1 %>
     <% for chapter in @chapters %>
-      <%= render 'downloads/download_chapter.html', :chapter => chapter %>
+      <%= render "downloads/download_chapter", chapter: chapter %>
     <% end %>
   <% # Use elsif so we don't error when there are no chapters. %>
   <% elsif @chapters.size == 1 %>
diff --git a/config/initializers/new_framework_defaults_7_0.rb b/config/initializers/new_framework_defaults_7_0.rb
index 4b190650147..9864ceff649 100644
--- a/config/initializers/new_framework_defaults_7_0.rb
+++ b/config/initializers/new_framework_defaults_7_0.rb
@@ -81,16 +81,6 @@
 # more information.
 Rails.application.config.active_support.use_rfc4122_namespaced_uuids = true
 
-# Change the default headers to disable browsers' flawed legacy XSS protection.
-Rails.application.config.action_dispatch.default_headers = {
-  "X-Frame-Options" => "SAMEORIGIN",
-  "X-XSS-Protection" => "0",
-  "X-Content-Type-Options" => "nosniff",
-  "X-Download-Options" => "noopen",
-  "X-Permitted-Cross-Domain-Policies" => "none",
-  "Referrer-Policy" => "strict-origin-when-cross-origin"
-}
-
 # ** Please read carefully, this must be configured in config/application.rb **
 # Change the format of the cache entry.
 # Changing this default means that all new cache entries added to the cache
diff --git a/lib/tasks/after_tasks.rake b/lib/tasks/after_tasks.rake
index 6dd58f2de59..a260666aab3 100644
--- a/lib/tasks/after_tasks.rake
+++ b/lib/tasks/after_tasks.rake
@@ -223,44 +223,6 @@ namespace :After do
     end
   end
 
-  desc "Convert remaining chapter kudos into work kudos"
-  task(clean_up_chapter_kudos: :environment) do
-    kudos = Kudo.where(commentable_type: "Chapter")
-    kudos_count = kudos.count
-
-    puts("Updating #{kudos_count} chapter kudos") && STDOUT.flush
-
-    indestructible_kudo_ids = []
-    unupdatable_kudo_ids = []
-
-    kudos.find_each do |kudo|
-      if kudo.commentable.nil? || kudo.commentable.work.nil?
-        indestructible_kudo_ids << kudo.id unless kudo.destroy
-        print(".") && STDOUT.flush
-        next
-      end
-
-      kudo.commentable = kudo.commentable.work
-      unless kudo.save
-        if kudo.errors.keys == [:ip_address] || kudo.errors.keys == [:user_id]
-          # If it's a uniqueness problem, orphan the kudo and re-save.
-          kudo.ip_address = nil
-          kudo.user_id = nil
-          unupdatable_kudo_ids << kudo.id unless kudo.save
-        else
-          # In other cases, let's be cautious and only log.
-          unupdatable_kudo_ids << kudo.id
-        end
-      end
-      print(".") && STDOUT.flush
-    end
-
-    puts
-    puts("Couldn't destroy #{indestructible_kudo_ids.size} kudo(s): #{indestructible_kudo_ids.join(',')}") if indestructible_kudo_ids.any?
-    puts("Couldn't update #{unupdatable_kudo_ids.size} kudo(s): #{unupdatable_kudo_ids.join(',')}") if unupdatable_kudo_ids.any?
-    STDOUT.flush
-  end
-
   desc "Remove translation_admin role"
   task(remove_translation_admin_role: :environment) do
     r = Role.find_by(name: "translation_admin")
diff --git a/spec/controllers/external_works_controller_spec.rb b/spec/controllers/external_works_controller_spec.rb
index 805fbcfd615..21288617683 100644
--- a/spec/controllers/external_works_controller_spec.rb
+++ b/spec/controllers/external_works_controller_spec.rb
@@ -12,11 +12,6 @@
     context "when the URL has an external work" do
       let!(:external_work) { create(:external_work, url: url) }
 
-      it "responds with json" do
-        get :fetch, params: { external_work_url: url, format: :json }
-        expect(response.content_type).to match("application/json")
-      end
-
       it "responds with the matching work" do
         get :fetch, params: { external_work_url: url, format: :json }
         expect(assigns(:external_work)).to eq(external_work)
@@ -34,11 +29,6 @@
     end
 
     context "when the URL doesn't have an exteral work" do
-      it "responds with json" do
-        get :fetch, params: { external_work_url: url, format: :json }
-        expect(response.content_type).to match("application/json")
-      end
-
       it "responds with blank" do
         get :fetch, params: { external_work_url: url, format: :json }
         expect(assigns(:external_work)).to be_nil
diff --git a/spec/helpers/share_helper_spec.rb b/spec/helpers/share_helper_spec.rb
index 317cb4749d7..3f20a5d0ec0 100644
--- a/spec/helpers/share_helper_spec.rb
+++ b/spec/helpers/share_helper_spec.rb
@@ -78,14 +78,14 @@
     context "with valid site" do
       context "when site is tumblr" do
         it "returns HTML for a Tumblr button" do
-          share_button = '<a href="https://tumblr.com" class="resp-sharing-button__link" aria-label="Share on Tumblr"><div class="resp-sharing-button resp-sharing-button--tumblr resp-sharing-button--medium"><div class="resp-sharing-button__icon resp-sharing-button__icon--solid" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13.5.5v5h5v4h-5V15c0 5 3.5 4.4 6 2.8v4.4c-6.7 3.2-12 0-12-4.2V9.5h-3V6.7c1-.3 2.2-.7 3-1.3.5-.5 1-1.2 1.4-2 .3-.7.6-1.7.7-3h3.8z"></path></svg></div>Share on Tumblr</div></a>'
+          share_button = '<a href="https://tumblr.com" class="resp-sharing-button__link" aria-label="Share on Tumblr"><div class="resp-sharing-button resp-sharing-button--tumblr resp-sharing-button--medium"><div class="resp-sharing-button__icon resp-sharing-button__icon--solid" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13.5.5v5h5v4h-5V15c0 5 3.5 4.4 6 2.8v4.4c-6.7 3.2-12 0-12-4.2V9.5h-3V6.7c1-.3 2.2-.7 3-1.3.5-.5 1-1.2 1.4-2 .3-.7.6-1.7.7-3h3.8z" /></svg></div>Share on Tumblr</div></a>'
           expect(helper.sharing_button("tumblr", "https://tumblr.com", "Share on Tumblr")).to eq(share_button)
         end
       end
 
       context "when site is twitter" do
         it "returns HTML for a Twitter button" do
-          share_button = '<a href="https://twitter.com" class="resp-sharing-button__link" aria-label="Share on Twitter"><div class="resp-sharing-button resp-sharing-button--twitter resp-sharing-button--medium"><div class="resp-sharing-button__icon resp-sharing-button__icon--solid" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M23.44 4.83c-.8.37-1.5.38-2.22.02.93-.56.98-.96 1.32-2.02-.88.52-1.86.9-2.9 1.1-.82-.88-2-1.43-3.3-1.43-2.5 0-4.55 2.04-4.55 4.54 0 .36.03.7.1 1.04-3.77-.2-7.12-2-9.36-4.75-.4.67-.6 1.45-.6 2.3 0 1.56.8 2.95 2 3.77-.74-.03-1.44-.23-2.05-.57v.06c0 2.2 1.56 4.03 3.64 4.44-.67.2-1.37.2-2.06.08.58 1.8 2.26 3.12 4.25 3.16C5.78 18.1 3.37 18.74 1 18.46c2 1.3 4.4 2.04 6.97 2.04 8.35 0 12.92-6.92 12.92-12.93 0-.2 0-.4-.02-.6.9-.63 1.96-1.22 2.56-2.14z"></path></svg></div>Share on Twitter</div></a>'
+          share_button = '<a href="https://twitter.com" class="resp-sharing-button__link" aria-label="Share on Twitter"><div class="resp-sharing-button resp-sharing-button--twitter resp-sharing-button--medium"><div class="resp-sharing-button__icon resp-sharing-button__icon--solid" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M23.44 4.83c-.8.37-1.5.38-2.22.02.93-.56.98-.96 1.32-2.02-.88.52-1.86.9-2.9 1.1-.82-.88-2-1.43-3.3-1.43-2.5 0-4.55 2.04-4.55 4.54 0 .36.03.7.1 1.04-3.77-.2-7.12-2-9.36-4.75-.4.67-.6 1.45-.6 2.3 0 1.56.8 2.95 2 3.77-.74-.03-1.44-.23-2.05-.57v.06c0 2.2 1.56 4.03 3.64 4.44-.67.2-1.37.2-2.06.08.58 1.8 2.26 3.12 4.25 3.16C5.78 18.1 3.37 18.74 1 18.46c2 1.3 4.4 2.04 6.97 2.04 8.35 0 12.92-6.92 12.92-12.93 0-.2 0-.4-.02-.6.9-.63 1.96-1.22 2.56-2.14z" /></svg></div>Share on Twitter</div></a>'
           expect(helper.sharing_button("twitter", "https://twitter.com", "Share on Twitter")).to eq(share_button)
         end
       end
@@ -93,7 +93,7 @@
 
     context "with target argument" do
       it "returns button with target attribute for link" do
-        share_button = '<a href="https://twitter.com" target="_blank" class="resp-sharing-button__link" aria-label="Share on Twitter"><div class="resp-sharing-button resp-sharing-button--twitter resp-sharing-button--medium"><div class="resp-sharing-button__icon resp-sharing-button__icon--solid" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M23.44 4.83c-.8.37-1.5.38-2.22.02.93-.56.98-.96 1.32-2.02-.88.52-1.86.9-2.9 1.1-.82-.88-2-1.43-3.3-1.43-2.5 0-4.55 2.04-4.55 4.54 0 .36.03.7.1 1.04-3.77-.2-7.12-2-9.36-4.75-.4.67-.6 1.45-.6 2.3 0 1.56.8 2.95 2 3.77-.74-.03-1.44-.23-2.05-.57v.06c0 2.2 1.56 4.03 3.64 4.44-.67.2-1.37.2-2.06.08.58 1.8 2.26 3.12 4.25 3.16C5.78 18.1 3.37 18.74 1 18.46c2 1.3 4.4 2.04 6.97 2.04 8.35 0 12.92-6.92 12.92-12.93 0-.2 0-.4-.02-.6.9-.63 1.96-1.22 2.56-2.14z"></path></svg></div>Share on Twitter</div></a>'
+        share_button = '<a href="https://twitter.com" target="_blank" class="resp-sharing-button__link" aria-label="Share on Twitter"><div class="resp-sharing-button resp-sharing-button--twitter resp-sharing-button--medium"><div class="resp-sharing-button__icon resp-sharing-button__icon--solid" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M23.44 4.83c-.8.37-1.5.38-2.22.02.93-.56.98-.96 1.32-2.02-.88.52-1.86.9-2.9 1.1-.82-.88-2-1.43-3.3-1.43-2.5 0-4.55 2.04-4.55 4.54 0 .36.03.7.1 1.04-3.77-.2-7.12-2-9.36-4.75-.4.67-.6 1.45-.6 2.3 0 1.56.8 2.95 2 3.77-.74-.03-1.44-.23-2.05-.57v.06c0 2.2 1.56 4.03 3.64 4.44-.67.2-1.37.2-2.06.08.58 1.8 2.26 3.12 4.25 3.16C5.78 18.1 3.37 18.74 1 18.46c2 1.3 4.4 2.04 6.97 2.04 8.35 0 12.92-6.92 12.92-12.93 0-.2 0-.4-.02-.6.9-.63 1.96-1.22 2.56-2.14z" /></svg></div>Share on Twitter</div></a>'
         expect(helper.sharing_button("twitter", "https://twitter.com", "Share on Twitter", target: "_blank")).to eq(share_button)
       end
     end
diff --git a/spec/lib/tasks/after_tasks.rake_spec.rb b/spec/lib/tasks/after_tasks.rake_spec.rb
index 1c27454160a..64fddc00405 100644
--- a/spec/lib/tasks/after_tasks.rake_spec.rb
+++ b/spec/lib/tasks/after_tasks.rake_spec.rb
@@ -288,88 +288,6 @@
   end
 end
 
-describe "rake After:clean_up_chapter_kudos" do
-  let(:work) { create(:work) }
-  let!(:work_kudo) { create(:kudo, commentable: work) }
-  let!(:chapter_kudo) do
-    kudo = create(:kudo, commentable: work)
-    kudo.update_columns(commentable_type: "Chapter", commentable_id: work.first_chapter.id)
-    kudo
-  end
-
-  it "destroys chapter kudos if the chapter does not exist" do
-    work.first_chapter.delete
-
-    expect do
-      subject.invoke
-    end.to avoid_changing { work_kudo.reload.updated_at }
-    expect { chapter_kudo.reload }.to raise_exception(ActiveRecord::RecordNotFound)
-  end
-
-  it "destroys chapter kudos if the work does not exist" do
-    work.delete
-    subject.invoke
-    expect { chapter_kudo.reload }.to raise_exception(ActiveRecord::RecordNotFound)
-  end
-
-  it "prints chapter kudos that cannot be destroyed when the work does not exist" do
-    work.delete
-    allow_any_instance_of(Kudo).to receive(:destroy).and_return(false)
-
-    expect do
-      subject.invoke
-    end.to output("Updating 1 chapter kudos\n.\nCouldn't destroy 1 kudo(s): #{chapter_kudo.id}\n").to_stdout
-  end
-
-  it "transfers chapter kudos to the chapter's work" do
-    expect do
-      subject.invoke
-    end.to change { chapter_kudo.reload.commentable }.from(work.first_chapter).to(work)
-      .and change { work.all_kudos_count }.from(1).to(2)
-      .and change { work.guest_kudos_count }.from(1).to(2)
-  end
-
-  it "prints chapter kudos that cannot be transferred to the work" do
-    allow_any_instance_of(Kudo).to receive(:save).and_return(false)
-
-    expect do
-      subject.invoke
-    end.to output("Updating 1 chapter kudos\n.\nCouldn't update 1 kudo(s): #{chapter_kudo.id}\n").to_stdout
-  end
-
-  it "transfers guest chapter kudos to the chapter's restricted work" do
-    work.update!(restricted: true)
-
-    expect do
-      subject.invoke
-    end.to change { chapter_kudo.reload.commentable }.from(work.first_chapter).to(work)
-      .and avoid_changing { chapter_kudo.reload.ip_address }
-      .and avoid_changing { work_kudo.reload.updated_at }
-  end
-
-  it "orphan chapter kudos if there is already a work kudo from the same IP address" do
-    chapter_kudo.update_column(:ip_address, work_kudo.ip_address)
-
-    expect do
-      subject.invoke
-    end.to change { chapter_kudo.reload.commentable }.from(work.first_chapter).to(work)
-      .and change { chapter_kudo.reload.ip_address }.from(work_kudo.ip_address).to(nil)
-      .and avoid_changing { work_kudo.reload.updated_at }
-  end
-
-  it "orphan chapter kudos if there is already a work kudo from the same user ID" do
-    user_id = create(:user).id
-    work_kudo.update(ip_address: nil, user_id: user_id)
-    chapter_kudo.update_columns(ip_address: nil, user_id: user_id)
-
-    expect do
-      subject.invoke
-    end.to change { chapter_kudo.reload.commentable }.from(work.first_chapter).to(work)
-      .and change { chapter_kudo.reload.user_id }.from(user_id).to(nil)
-      .and avoid_changing { work_kudo.reload.updated_at }
-  end
-end
-
 describe "rake After:remove_translation_admin_role" do
   it "remove translation admin role" do
     user = create(:user)

From 244089791d056d7b5fe2ba2e6fe7a958b356c362 Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sat, 27 Jan 2024 20:24:14 -0500
Subject: [PATCH 07/22] Fix tests try 3

---
 Gemfile                       | 2 +-
 Gemfile.lock                  | 4 ++--
 features/support/formatter.rb | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Gemfile b/Gemfile
index 2f5428aa5a2..e97158fb196 100644
--- a/Gemfile
+++ b/Gemfile
@@ -129,7 +129,7 @@ group :test do
   gem 'launchy'    # So you can do Then show me the page
   gem 'delorean'
   # Record and replay data from external URLs
-  gem "vcr", "~> 6.2"
+  gem 'vcr', '~> 3.0', '>= 3.0.1'
   gem "webmock"
   gem 'timecop'
   gem 'cucumber-timecop', require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index ede9743b1ba..b1d2dfd5fd2 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -601,7 +601,7 @@ GEM
       raindrops (~> 0.7)
     unidecoder (1.1.2)
     uniform_notifier (1.16.0)
-    vcr (6.2.0)
+    vcr (3.0.3)
     warden (1.2.9)
       rack (>= 2.0.9)
     webmock (3.19.1)
@@ -720,7 +720,7 @@ DEPENDENCIES
   unicode_utils (>= 1.4.0)
   unicorn (~> 5.5)
   unidecoder
-  vcr (~> 6.2)
+  vcr (~> 3.0, >= 3.0.1)
   webmock
   whenever (~> 0.6.2)
   whiny_validation
diff --git a/features/support/formatter.rb b/features/support/formatter.rb
index cfb17d9bed1..68c5b84f9ab 100644
--- a/features/support/formatter.rb
+++ b/features/support/formatter.rb
@@ -8,7 +8,7 @@ class Formatter < ::Cucumber::Formatter::Progress
 
     def on_test_case_started(event)
       super
-      feature = event.test_case.feature
+      feature = gherkin_document.feature
 
       return if same_feature_as_previous_test_case?(feature)
 

From 5efe404607dce28ea424638850f1940a8062cd38 Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sat, 27 Jan 2024 20:33:41 -0500
Subject: [PATCH 08/22] Fix tests try 4

---
 features/support/formatter.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/support/formatter.rb b/features/support/formatter.rb
index 68c5b84f9ab..5bcfa91cd49 100644
--- a/features/support/formatter.rb
+++ b/features/support/formatter.rb
@@ -25,7 +25,7 @@ def on_test_run_finished(_event)
 
     def before_feature(feature)
       # Print the feature's file name.
-      @io.puts feature.location.file
+      @io.puts current_feature_uri
       @io.flush
       @current_feature = feature
       @start_time = Time.current

From edd8ae1d003908b270f7b29308915acfa5ba8039 Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sun, 28 Jan 2024 11:10:23 -0500
Subject: [PATCH 09/22] Fix email test issue

---
 .github/workflows/automated-tests.yml    | 1 +
 config/environments/test.rb              | 2 ++
 features/step_definitions/email_steps.rb | 3 ++-
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/automated-tests.yml b/.github/workflows/automated-tests.yml
index fb420ed21e6..b4f0d118ad0 100644
--- a/.github/workflows/automated-tests.yml
+++ b/.github/workflows/automated-tests.yml
@@ -21,6 +21,7 @@ jobs:
       TEST_GROUP: ${{ matrix.tests.command }} ${{ matrix.tests.arguments }}
       CUCUMBER_RETRY: 1
       CUCUMBER_FORMAT: Ao3Cucumber::Formatter
+      CUCUMBER_PUBLISH_QUIET: true
       SPEC_OPTS: --force-color
 
     services:
diff --git a/config/environments/test.rb b/config/environments/test.rb
index ab3fa19c3dd..e328a9eb5d1 100644
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -70,4 +70,6 @@
 
   # Annotate rendered view with file names.
   # config.action_view.annotate_rendered_view_with_filenames = true
+
+  config.raise_on_open_redirects = false
 end
diff --git a/features/step_definitions/email_steps.rb b/features/step_definitions/email_steps.rb
index b289aad4128..eb77a3acd80 100644
--- a/features/step_definitions/email_steps.rb
+++ b/features/step_definitions/email_steps.rb
@@ -30,7 +30,8 @@
 end
 
 When(/^(?:I|they) follow "([^"]*?)" in #{capture_email}$/) do |link, email_ref|
-  visit_in_email(email(email_ref).html_part, link)
+  open_last_email
+  visit_in_email(link)
 end
 
 When(/^(?:I|they) click the first link in #{capture_email}$/) do |email_ref|

From 58a00e12c9aa7b692c875b3675b2012dcc46dbcb Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sun, 28 Jan 2024 14:43:29 -0500
Subject: [PATCH 10/22] Fix some form IDs/names

---
 app/helpers/application_helper.rb | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index ae2aafabe0b..8d31cecf5e0 100755
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -343,6 +343,19 @@ def name_to_id(name)
     name.to_s.gsub(/\]\[|[^-a-zA-Z0-9:.]/, "_").sub(/_$/, "")
   end
 
+  def field_id(form_or_object_name, attribute, **kwargs)
+    name_to_id(field_name(form_or_object_name, attribute))
+  end
+
+  def field_name(form_or_object_name, attribute, *method_names, multiple: false, index: nil)
+    object_name = if form_or_object_name.respond_to?(:object_name)
+                    form_or_object_name.object_name
+                  else
+                    form_or_object_name
+                  end
+    "#{object_name}[#{field_attribute(attribute)}]#{multiple ? "[]" : ""}"
+  end
+
   # toggle an checkboxes (scrollable checkboxes) section of a form to show all of the checkboxes
   def checkbox_section_toggle(checkboxes_id, checkboxes_size, options = {})
     toggle_show = content_tag(:a, ts("Expand %{checkboxes_size} Checkboxes", checkboxes_size: checkboxes_size),

From fa0002f8bc47b6f70eea1fbce1ab4ae63e6d038c Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sun, 28 Jan 2024 16:03:33 -0500
Subject: [PATCH 11/22] More fixes (not everything though)

---
 Gemfile                                        |  2 +-
 Gemfile.lock                                   |  4 ++--
 app/helpers/application_helper.rb              |  8 +++++---
 config/environments/test.rb                    |  2 --
 .../initializers/new_framework_defaults_7_0.rb |  2 +-
 .../challenge_promptmeme_posting_fills.feature |  2 +-
 .../challenge_promptmeme_claims.feature        |  6 +++---
 features/tag_sets/tag_set_associations.feature |  3 ++-
 features/works/work_related.feature            | 18 ++++++++++++------
 lib/challenge_core.rb                          |  2 +-
 10 files changed, 28 insertions(+), 21 deletions(-)

diff --git a/Gemfile b/Gemfile
index e97158fb196..2f5428aa5a2 100644
--- a/Gemfile
+++ b/Gemfile
@@ -129,7 +129,7 @@ group :test do
   gem 'launchy'    # So you can do Then show me the page
   gem 'delorean'
   # Record and replay data from external URLs
-  gem 'vcr', '~> 3.0', '>= 3.0.1'
+  gem "vcr", "~> 6.2"
   gem "webmock"
   gem 'timecop'
   gem 'cucumber-timecop', require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index b1d2dfd5fd2..ede9743b1ba 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -601,7 +601,7 @@ GEM
       raindrops (~> 0.7)
     unidecoder (1.1.2)
     uniform_notifier (1.16.0)
-    vcr (3.0.3)
+    vcr (6.2.0)
     warden (1.2.9)
       rack (>= 2.0.9)
     webmock (3.19.1)
@@ -720,7 +720,7 @@ DEPENDENCIES
   unicode_utils (>= 1.4.0)
   unicorn (~> 5.5)
   unidecoder
-  vcr (~> 3.0, >= 3.0.1)
+  vcr (~> 6.2)
   webmock
   whenever (~> 0.6.2)
   whiny_validation
diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 8d31cecf5e0..24773456126 100755
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -343,17 +343,19 @@ def name_to_id(name)
     name.to_s.gsub(/\]\[|[^-a-zA-Z0-9:.]/, "_").sub(/_$/, "")
   end
 
-  def field_id(form_or_object_name, attribute, **kwargs)
+  def field_id(form_or_object_name, attribute, **_kwargs)
     name_to_id(field_name(form_or_object_name, attribute))
   end
 
-  def field_name(form_or_object_name, attribute, *method_names, multiple: false, index: nil)
+  def field_name(form_or_object_name, attribute, *_method_names, multiple: false, **kwargs)
     object_name = if form_or_object_name.respond_to?(:object_name)
                     form_or_object_name.object_name
                   else
                     form_or_object_name
                   end
-    "#{object_name}[#{field_attribute(attribute)}]#{multiple ? "[]" : ""}"
+    return "#{field_attribute(attribute)}#{multiple ? '[]' : ''}" if object_name.blank?
+
+    "#{object_name}[#{field_attribute(attribute)}]#{multiple ? '[]' : ''}"
   end
 
   # toggle an checkboxes (scrollable checkboxes) section of a form to show all of the checkboxes
diff --git a/config/environments/test.rb b/config/environments/test.rb
index e328a9eb5d1..ab3fa19c3dd 100644
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -70,6 +70,4 @@
 
   # Annotate rendered view with file names.
   # config.action_view.annotate_rendered_view_with_filenames = true
-
-  config.raise_on_open_redirects = false
 end
diff --git a/config/initializers/new_framework_defaults_7_0.rb b/config/initializers/new_framework_defaults_7_0.rb
index 9864ceff649..65b1ae68d63 100644
--- a/config/initializers/new_framework_defaults_7_0.rb
+++ b/config/initializers/new_framework_defaults_7_0.rb
@@ -60,7 +60,7 @@
 Rails.application.config.active_record.partial_inserts = false
 
 # Protect from open redirect attacks in `redirect_back_or_to` and `redirect_to`.
-Rails.application.config.action_controller.raise_on_open_redirects = true
+# Rails.application.config.action_controller.raise_on_open_redirects = true
 
 # Change the variant processor for Active Storage.
 # Changing this default means updating all places in your code that
diff --git a/features/prompt_memes_b/challenge_promptmeme_posting_fills.feature b/features/prompt_memes_b/challenge_promptmeme_posting_fills.feature
index 38691a84848..f4ee47dfdf0 100755
--- a/features/prompt_memes_b/challenge_promptmeme_posting_fills.feature
+++ b/features/prompt_memes_b/challenge_promptmeme_posting_fills.feature
@@ -120,7 +120,7 @@ Feature: Prompt Meme Challenge
   Then I should see "Fulfilled By"
     And I should see "Mystery Work"
 
-  Scenario: Fulfilled claims are shown to mod
+  # Scenario: Fulfilled claims are shown to mod
  # TODO: We need to figure out if we want to hide claims from mods in 100% anonymous prompt memes
 #  Given I have Battle 12 prompt meme fully set up
 #  Given everyone has signed up for Battle 12
diff --git a/features/prompt_memes_c/challenge_promptmeme_claims.feature b/features/prompt_memes_c/challenge_promptmeme_claims.feature
index ad1159bb2dd..91b63114259 100644
--- a/features/prompt_memes_c/challenge_promptmeme_claims.feature
+++ b/features/prompt_memes_c/challenge_promptmeme_claims.feature
@@ -96,7 +96,7 @@ Feature: Prompt Meme Challenge
   Then I should see "In response to a prompt by Anonymous"
     And I should see "In response to a prompt by myname2"
 
-  Scenario: User claims two prompts in different challenges and fulfills both of them at once
+  # Scenario: User claims two prompts in different challenges and fulfills both of them at once
   # TODO
 
   Scenario: Sign up for several challenges and see Sign-ups are sorted
@@ -184,7 +184,7 @@ Feature: Prompt Meme Challenge
     And I should see "by myname4"
     And I should see "Stargate Atlantis"
 
-  Scenario: check that claims can't be viewed even after challenge is revealed
+  # Scenario: check that claims can't be viewed even after challenge is revealed
   # TODO: Find a way to construct the link to a claim show page for someone who shouldn't be able to see it
 
   Scenario: Mod can reveal challenge
@@ -348,7 +348,7 @@ Feature: Prompt Meme Challenge
   Then I should not see "myname4"
     And I should see "Anonymous"
 
-  Scenario: check that anon prompts are still anon on the fulfilling work
+  # Scenario: check that anon prompts are still anon on the fulfilling work
   # TODO
 
   Scenario: work left in draft so claim is not yet totally fulfilled
diff --git a/features/tag_sets/tag_set_associations.feature b/features/tag_sets/tag_set_associations.feature
index f1d15ca90ff..6543ea65e0c 100644
--- a/features/tag_sets/tag_set_associations.feature
+++ b/features/tag_sets/tag_set_associations.feature
@@ -52,4 +52,5 @@ Feature: Reviewing tag set associations
   Then I should see "What tag set did you want to look at?"
     And I should be on the tagsets page
 
-  Scenario: Tags with brackets should work in associations
+  # TODO
+  # Scenario: Tags with brackets should work in associations
diff --git a/features/works/work_related.feature b/features/works/work_related.feature
index fe74dec069d..2ed29ef13b3 100644
--- a/features/works/work_related.feature
+++ b/features/works/work_related.feature
@@ -185,7 +185,8 @@ Scenario: Translator receives comments on translation, creator of original work
   Then "translator" should be emailed
     And "inspiration" should not be emailed
 
-Scenario: Creator of original work chooses to receive comments on translation
+# TODO
+# Scenario: Creator of original work chooses to receive comments on translation
 
   #Given I have related works setup
   #  And a translation has been posted
@@ -198,7 +199,8 @@ Scenario: Creator of original work chooses to receive comments on translation
   #Then "translator" should be emailed
   #  And "inspiration" should be emailed
 
-Scenario: Creator of original work doesn't receive comments if they haven't approved the translation
+# TODO
+# Scenario: Creator of original work doesn't receive comments if they haven't approved the translation
 
   #Given I have related works setup
   #  And a translation has been posted
@@ -209,13 +211,17 @@ Scenario: Creator of original work doesn't receive comments if they haven't appr
   #When I post the comment "Blah" on the work "Worldbuilding Translated"
   #Then "inspiration" should not be emailed
 
-Scenario: Can post a translation of a mystery work
+# TODO
+# Scenario: Can post a translation of a mystery work
 
-Scenario: Posting a translation of a mystery work should not allow you to see the work
+# TODO
+# Scenario: Posting a translation of a mystery work should not allow you to see the work
 
-Scenario: Can post a translation of an anonymous work
+# TODO
+# Scenario: Can post a translation of an anonymous work
 
-Scenario: Posting a translation of an anonymous work should not allow you to see the author
+# TODO
+# Scenario: Posting a translation of an anonymous work should not allow you to see the author
 
 Scenario: Translate your own work
 
diff --git a/lib/challenge_core.rb b/lib/challenge_core.rb
index 5d4bf610fd6..05674e65a9e 100644
--- a/lib/challenge_core.rb
+++ b/lib/challenge_core.rb
@@ -22,7 +22,7 @@ def validate_signup_dates
       if open_date && open_date.future?
         error_message << ts("If sign-ups are open, sign-up open date cannot be in the future.")
       end
-      if close_date && open_date && close_date.to_s(:number) < open_date.to_s(:number)
+      if close_date && open_date && close_date.to_fs(:number) < open_date.to_fs(:number)
         error_message << ts("Close date cannot be before open date.")
       end
     end

From 285f321dac09287493970cc6c6f5ea02f2d94d4c Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sun, 28 Jan 2024 21:17:21 -0500
Subject: [PATCH 12/22] Neither field IDs nor emails are my friend

---
 app/helpers/application_helper.rb        | 20 ++++++++++++++------
 features/other_a/languages.feature       |  2 +-
 features/step_definitions/email_steps.rb |  4 ++--
 3 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 24773456126..ae683b42946 100755
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -343,19 +343,27 @@ def name_to_id(name)
     name.to_s.gsub(/\]\[|[^-a-zA-Z0-9:.]/, "_").sub(/_$/, "")
   end
 
-  def field_id(form_or_object_name, attribute, **_kwargs)
-    name_to_id(field_name(form_or_object_name, attribute))
+  def field_id(form_or_object_name, attribute, index: nil, **_kwargs)
+    name_to_id(field_name(form_or_object_name, attribute, index: index))
   end
 
-  def field_name(form_or_object_name, attribute, *_method_names, multiple: false, **kwargs)
+  # This is a partial re-implementation of ActionView::Helpers::FormTagHelper#field_name.
+  # The method contract changed in Rails 7.0, but we can't use the default because it sometimes
+  # includes other information that -- at a minimum -- wrecks havoc on the Cucumber feature tests.
+  # It is used in when constructing forms, like in app/views/tags/new.html.erb.
+  def field_name(form_or_object_name, attribute, *_method_names, multiple: false, index: nil)
     object_name = if form_or_object_name.respond_to?(:object_name)
                     form_or_object_name.object_name
                   else
                     form_or_object_name
                   end
-    return "#{field_attribute(attribute)}#{multiple ? '[]' : ''}" if object_name.blank?
-
-    "#{object_name}[#{field_attribute(attribute)}]#{multiple ? '[]' : ''}"
+    if object_name.blank?
+      "#{field_attribute(attribute)}#{multiple ? '[]' : ''}"
+    elsif index
+      "#{object_name}[#{index}][#{field_attribute(attribute)}]#{multiple ? '[]' : ''}"
+    else
+      "#{object_name}[#{field_attribute(attribute)}]#{multiple ? '[]' : ''}"
+    end
   end
 
   # toggle an checkboxes (scrollable checkboxes) section of a form to show all of the checkboxes
diff --git a/features/other_a/languages.feature b/features/other_a/languages.feature
index 37a7f1537af..8df8d395eaa 100644
--- a/features/other_a/languages.feature
+++ b/features/other_a/languages.feature
@@ -1,7 +1,7 @@
 @works
 Feature: Languages
     
-  Scenario: Browse works by language
+  # Scenario: Browse works by language
   
   # Admin set up the language
   
diff --git a/features/step_definitions/email_steps.rb b/features/step_definitions/email_steps.rb
index eb77a3acd80..d2a0bf78ca2 100644
--- a/features/step_definitions/email_steps.rb
+++ b/features/step_definitions/email_steps.rb
@@ -30,8 +30,8 @@
 end
 
 When(/^(?:I|they) follow "([^"]*?)" in #{capture_email}$/) do |link, email_ref|
-  open_last_email
-  visit_in_email(link)
+  address = email(email_ref).to.first
+  visit_in_email(link, address)
 end
 
 When(/^(?:I|they) click the first link in #{capture_email}$/) do |email_ref|

From f0063eaa69586af8cf29b640edd4be022e43829b Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Mon, 29 Jan 2024 18:24:18 -0500
Subject: [PATCH 13/22] I disagree with Rubocop here

---
 lib/challenge_core.rb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/challenge_core.rb b/lib/challenge_core.rb
index 05674e65a9e..c9e811d0c18 100644
--- a/lib/challenge_core.rb
+++ b/lib/challenge_core.rb
@@ -22,9 +22,11 @@ def validate_signup_dates
       if open_date && open_date.future?
         error_message << ts("If sign-ups are open, sign-up open date cannot be in the future.")
       end
+      # rubocop:disable Style/IfUnlessModifier
       if close_date && open_date && close_date.to_fs(:number) < open_date.to_fs(:number)
         error_message << ts("Close date cannot be before open date.")
       end
+      # rubocop:enable Style/IfUnlessModifier
     end
     unless error_message.empty?
       error_message.each do |errors|

From 615e0827e3291f41e5c0435cf975ebca7cddeb4f Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sat, 24 Feb 2024 11:01:03 -0500
Subject: [PATCH 14/22] Add back tests for JS thing

---
 config/initializers/new_framework_defaults_7_0.rb  |  2 +-
 spec/controllers/external_works_controller_spec.rb | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/config/initializers/new_framework_defaults_7_0.rb b/config/initializers/new_framework_defaults_7_0.rb
index 65b1ae68d63..aa327f1102f 100644
--- a/config/initializers/new_framework_defaults_7_0.rb
+++ b/config/initializers/new_framework_defaults_7_0.rb
@@ -98,7 +98,7 @@
 # Rails.application.config.action_dispatch.cookies_serializer = :json
 #
 #
-# NOTE: as of https://github.com/otwcode/otwarchive/pull/4651, we are using :hybrid, which is the first step to migate.
+# NOTE: as of https://github.com/otwcode/otwarchive/pull/4651, we are using :hybrid, which is the first step to migrate.
 # After some time, we can update to use :json instead.
 
 # Change the return value of `ActionDispatch::Request#content_type` to the Content-Type header without modification.
diff --git a/spec/controllers/external_works_controller_spec.rb b/spec/controllers/external_works_controller_spec.rb
index 21288617683..6f7684c1bb7 100644
--- a/spec/controllers/external_works_controller_spec.rb
+++ b/spec/controllers/external_works_controller_spec.rb
@@ -12,6 +12,11 @@
     context "when the URL has an external work" do
       let!(:external_work) { create(:external_work, url: url) }
 
+      it "responds with javascript" do
+        get :fetch, xhr: true, params: { external_work_url: url, format: :js }
+        expect(response.content_type).to match("text/javascript")
+      end
+
       it "responds with the matching work" do
         get :fetch, params: { external_work_url: url, format: :json }
         expect(assigns(:external_work)).to eq(external_work)
@@ -29,6 +34,11 @@
     end
 
     context "when the URL doesn't have an exteral work" do
+      it "responds with javascript" do
+        get :fetch, xhr: true, params: { external_work_url: url, format: :js }
+        expect(response.content_type).to match("text/javascript")
+      end
+
       it "responds with blank" do
         get :fetch, params: { external_work_url: url, format: :json }
         expect(assigns(:external_work)).to be_nil

From c19d59a4e9a4190fcb913693b6d3ac237a0b9f59 Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Mon, 4 Mar 2024 21:40:10 -0500
Subject: [PATCH 15/22] Fix tests by i18n-ing

---
 app/controllers/challenge_assignments_controller.rb   | 2 +-
 app/controllers/collection_participants_controller.rb | 4 ++--
 config/locales/controllers/en.yml                     | 8 ++++++++
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/app/controllers/challenge_assignments_controller.rb b/app/controllers/challenge_assignments_controller.rb
index f8e18062b60..7b7741463ae 100644
--- a/app/controllers/challenge_assignments_controller.rb
+++ b/app/controllers/challenge_assignments_controller.rb
@@ -33,7 +33,7 @@ def load_assignment_from_id
   def owner_only
     return if current_user == @challenge_assignment.offering_pseud.user
 
-    flash[:error] = t("challenge_assignments.not_owner", default: "You aren't the owner of that assignment.")
+    flash[:error] = t(".validations.not_owner", default: "You aren't the owner of that assignment.")
     redirect_to root_path
   end
 
diff --git a/app/controllers/collection_participants_controller.rb b/app/controllers/collection_participants_controller.rb
index c99443ec09c..ed80b86952b 100644
--- a/app/controllers/collection_participants_controller.rb
+++ b/app/controllers/collection_participants_controller.rb
@@ -10,7 +10,7 @@ class CollectionParticipantsController < ApplicationController
   cache_sweeper :collection_sweeper
 
   def owners_required
-    flash[:error] = t('collection_participants.owners_required', default: "You can't remove the only owner!")
+    flash[:error] = t(".validation.owners_required", default: "You can't remove the only owner!")
     redirect_to collection_participants_path(@collection)
     false
   end
@@ -75,7 +75,7 @@ def update
     if @participant.update(collection_participant_params)
       flash[:notice] = t('collection_participants.update_success', default: "Updated %{participant}.", participant: @participant.pseud.name)
     else
-      flash[:error] = t('collection_participants.update_failure', default: "Couldn't update %{participant}.", participant: @participant.pseud.name)
+      flash[:error] = t(".failure", default: "Couldn't update %{participant}.", participant: @participant.pseud.name)
     end
     redirect_to collection_participants_path(@collection)
   end
diff --git a/config/locales/controllers/en.yml b/config/locales/controllers/en.yml
index 9b92f55418f..91ace826c8b 100644
--- a/config/locales/controllers/en.yml
+++ b/config/locales/controllers/en.yml
@@ -14,6 +14,9 @@ en:
         blocked: You have blocked the user %{name}.
       destroy:
         unblocked: You have unblocked the user %{name}.
+  challenge_assignments:
+    validations:
+      not_owner: You aren't the owner of that assignment.
   chapters:
     destroy:
       only_chapter: You can't delete the only chapter in your work. If you want to delete the work, choose "Delete Work".
@@ -30,6 +33,11 @@ en:
     create:
       invited: invited
       invited_to_collections_html: This work has been %{invited_link} to your collection (%{collection_title}).
+  collection_participants:
+    update:
+      failure: Couldn't update %{participant}.
+    validation:
+      owners_required: You can't remove the only owner!
   comments:
     check_blocked:
       parent: Sorry, you have been blocked by one or more of this work's creators.

From 08dae9fd2f00513c89558d6916e6473dc4dae79a Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Mon, 25 Mar 2024 20:53:27 -0400
Subject: [PATCH 16/22] Change cache key with version bumps

---
 config/environments/production.rb | 3 ++-
 config/environments/staging.rb    | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/config/environments/production.rb b/config/environments/production.rb
index 01ff41a1afd..7ea3ed1808e 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -38,7 +38,8 @@
 
   # Use a different cache store in production
   config.cache_store = :mem_cache_store, ArchiveConfig.MEMCACHED_SERVERS,
-                       { namespace: "ao3-v2", compress: true, pool_size: 10 }
+                       { namespace: "ao3-v#{Rails::VERSION::MAJOR}.#{Rails::VERSION::MINOR}",
+                         compress: true, pool_size: 10 }
 
   # Mount Action Cable outside main process or domain.
   # config.action_cable.mount_path = nil
diff --git a/config/environments/staging.rb b/config/environments/staging.rb
index 89fb19bde17..a5f126d1062 100644
--- a/config/environments/staging.rb
+++ b/config/environments/staging.rb
@@ -34,7 +34,8 @@
 
   # Use a different cache store in production
   config.cache_store = :mem_cache_store, ArchiveConfig.MEMCACHED_SERVERS,
-                       { namespace: "ao3-v2", compress: true, pool_size: 5 }
+                       { namespace: "ao3-v#{Rails::VERSION::MAJOR}.#{Rails::VERSION::MINOR}",
+                         compress: true, pool_size: 5 }
 
   # Disable Rails's static asset server
   # In production, Apache or nginx will already do this

From adb55a101115881ae068847c6e514db2840a27cf Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Fri, 29 Mar 2024 10:59:35 -0400
Subject: [PATCH 17/22] Remove default from t helper

---
 app/controllers/challenge_assignments_controller.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/controllers/challenge_assignments_controller.rb b/app/controllers/challenge_assignments_controller.rb
index 7b7741463ae..01b31678704 100644
--- a/app/controllers/challenge_assignments_controller.rb
+++ b/app/controllers/challenge_assignments_controller.rb
@@ -33,7 +33,7 @@ def load_assignment_from_id
   def owner_only
     return if current_user == @challenge_assignment.offering_pseud.user
 
-    flash[:error] = t(".validations.not_owner", default: "You aren't the owner of that assignment.")
+    flash[:error] = t(".validations.not_owner")
     redirect_to root_path
   end
 

From fa19da68b1347e997392646bf40703a1472a7b67 Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Fri, 29 Mar 2024 11:04:09 -0400
Subject: [PATCH 18/22] More cleanup

---
 app/controllers/collection_participants_controller.rb | 4 ++--
 config/i18n-tasks.yml                                 | 3 ---
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/app/controllers/collection_participants_controller.rb b/app/controllers/collection_participants_controller.rb
index ed80b86952b..c2c359b029d 100644
--- a/app/controllers/collection_participants_controller.rb
+++ b/app/controllers/collection_participants_controller.rb
@@ -10,7 +10,7 @@ class CollectionParticipantsController < ApplicationController
   cache_sweeper :collection_sweeper
 
   def owners_required
-    flash[:error] = t(".validation.owners_required", default: "You can't remove the only owner!")
+    flash[:error] = t(".validation.owners_required")
     redirect_to collection_participants_path(@collection)
     false
   end
@@ -75,7 +75,7 @@ def update
     if @participant.update(collection_participant_params)
       flash[:notice] = t('collection_participants.update_success', default: "Updated %{participant}.", participant: @participant.pseud.name)
     else
-      flash[:error] = t(".failure", default: "Couldn't update %{participant}.", participant: @participant.pseud.name)
+      flash[:error] = t(".failure", participant: @participant.pseud.name)
     end
     redirect_to collection_participants_path(@collection)
   end
diff --git a/config/i18n-tasks.yml b/config/i18n-tasks.yml
index 23acbf623c4..b0a82fc5008 100644
--- a/config/i18n-tasks.yml
+++ b/config/i18n-tasks.yml
@@ -128,7 +128,6 @@ ignore_missing:
   - challenge_assignments.assignments_not_sent
   - challenge_assignments.assignments_sent
   - challenge_assignments.no_challenge
-  - challenge_assignments.not_owner
   - challenge_assignments.signup_open
   # File: app/controllers/challenges_controller.rb
   - challenge.no_collection # should be challenges.no_collection
@@ -141,8 +140,6 @@ ignore_missing:
   - collection_participants.accepted_invite
   - collection_participants.destroy
   - collection_participants.no_invitation
-  - collection_participants.owners_required
-  - collection_participants.update_failure
   - collection_participants.update_success
   # File: app/controllers/external_authors_controller.rb
   - external_author_claimed # should be external_authors.complete_claim.external_author_claimed

From 127a4afc71f03a4f997037dfb93fa58acfd9cc37 Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sun, 7 Apr 2024 21:47:35 -0400
Subject: [PATCH 19/22] I rather dislike Gemfile.lock merges...

---
 Gemfile.lock | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index afe986d9a22..9bd481f3879 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -181,35 +181,35 @@ GEM
     crass (1.0.6)
     css_parser (1.16.0)
       addressable
-    cucumber (9.1.2)
-      builder (~> 3.2, >= 3.2.4)
-      cucumber-ci-environment (~> 9.2, >= 9.2.0)
-      cucumber-core (~> 12.0)
+    cucumber (9.2.0)
+      builder (~> 3.2)
+      cucumber-ci-environment (> 9, < 11)
+      cucumber-core (> 13, < 14)
       cucumber-cucumber-expressions (~> 17.0)
-      cucumber-gherkin (> 24, < 27)
+      cucumber-gherkin (> 24, < 28)
       cucumber-html-formatter (> 20.3, < 22)
       cucumber-messages (> 19, < 25)
       diff-lcs (~> 1.5)
-      mini_mime (~> 1.1, >= 1.1.5)
-      multi_test (~> 1.1, >= 1.1.0)
-      sys-uname (~> 1.2, >= 1.2.3)
-    cucumber-ci-environment (9.2.0)
-    cucumber-core (12.0.0)
-      cucumber-gherkin (>= 25, < 27)
+      mini_mime (~> 1.1)
+      multi_test (~> 1.1)
+      sys-uname (~> 1.2)
+    cucumber-ci-environment (10.0.1)
+    cucumber-core (13.0.2)
+      cucumber-gherkin (>= 27, < 28)
       cucumber-messages (>= 20, < 23)
-      cucumber-tag-expressions (~> 5.0, >= 5.0.4)
-    cucumber-cucumber-expressions (17.0.2)
+      cucumber-tag-expressions (> 5, < 7)
+    cucumber-cucumber-expressions (17.1.0)
       bigdecimal
-    cucumber-gherkin (26.2.0)
-      cucumber-messages (>= 19.1.4, < 22.1)
-    cucumber-html-formatter (21.2.0)
+    cucumber-gherkin (27.0.0)
+      cucumber-messages (>= 19.1.4, < 23)
+    cucumber-html-formatter (21.3.1)
       cucumber-messages (> 19, < 25)
     cucumber-messages (22.0.0)
     cucumber-rails (3.0.0)
       capybara (>= 3.11, < 4)
       cucumber (>= 5, < 10)
       railties (>= 5.2, < 8)
-    cucumber-tag-expressions (5.0.6)
+    cucumber-tag-expressions (6.1.0)
     cucumber-timecop (0.0.6)
       chronic
       cucumber
@@ -345,7 +345,7 @@ GEM
       net-imap
       net-pop
       net-smtp
-    marcel (1.0.4)
+    marcel (1.0.2)
     matrix (0.4.2)
     mechanize (2.10.0)
       addressable (~> 2.8)
@@ -390,7 +390,7 @@ GEM
       net-ssh (>= 2.6.5, < 8.0.0)
     net-sftp (4.0.0)
       net-ssh (>= 5.0.0, < 8.0.0)
-    net-smtp (0.5.0.1)
+    net-smtp (0.5.0)
       net-protocol
     net-ssh (7.2.1)
     net-ssh-gateway (2.0.0)

From f644b294f5608d9ea42a4563f5c4d44f32544b38 Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sun, 7 Apr 2024 22:47:33 -0400
Subject: [PATCH 20/22] Remove another duplicate key

---
 app/controllers/external_works_controller.rb | 2 +-
 config/i18n-tasks.yml                        | 2 +-
 config/locales/controllers/en.yml            | 3 +++
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/app/controllers/external_works_controller.rb b/app/controllers/external_works_controller.rb
index c09d89a59ec..d40b6dbe45f 100644
--- a/app/controllers/external_works_controller.rb
+++ b/app/controllers/external_works_controller.rb
@@ -45,7 +45,7 @@ def update
     @external_work = authorize ExternalWork.find(params[:id])
     @external_work.attributes = work_params
     if @external_work.update(external_work_params)
-      flash[:notice] = t("successfully_updated", default: "External work was successfully updated.")
+      flash[:notice] = t(".successfully_updated")
       redirect_to(@external_work)
     else
       render action: "edit"
diff --git a/config/i18n-tasks.yml b/config/i18n-tasks.yml
index b0a82fc5008..1e1bbfdbe13 100644
--- a/config/i18n-tasks.yml
+++ b/config/i18n-tasks.yml
@@ -144,7 +144,7 @@ ignore_missing:
   # File: app/controllers/external_authors_controller.rb
   - external_author_claimed # should be external_authors.complete_claim.external_author_claimed
   # Files: app/controllers/external_works_controller.rb and app/controllers/languages_controller.rb
-  - successfully_updated # should be external_works.update.successfully_updated and languages.update.successfully_updated
+  - successfully_updated # should be languages.update.successfully_updated
   # File: app/controllers/feedbacks_controller.rb
   - failure_send # should be feedbacks.create.failure_send
   - successfully_sent # should be feedbacks.create.successfully_sent
diff --git a/config/locales/controllers/en.yml b/config/locales/controllers/en.yml
index 91ace826c8b..8f9199138d7 100644
--- a/config/locales/controllers/en.yml
+++ b/config/locales/controllers/en.yml
@@ -69,6 +69,9 @@ en:
       error: Sorry, that comment could not be unhidden.
       permission_denied: Sorry, you don't have permission to unhide that comment.
       success: Comment successfully unhidden!
+  external_works:
+    update:
+      successfully_updated: External work was successfully updated.
   kudos:
     create:
       success: Thank you for leaving kudos!

From 43313b1bb2b70fabbaed3a09c0c733fa08920d8a Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Mon, 8 Apr 2024 21:15:25 -0400
Subject: [PATCH 21/22] Use full i18n keys due to flash weirdness

---
 app/controllers/challenge_assignments_controller.rb   | 2 +-
 app/controllers/collection_participants_controller.rb | 2 +-
 config/locales/controllers/en.yml                     | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/controllers/challenge_assignments_controller.rb b/app/controllers/challenge_assignments_controller.rb
index 01b31678704..55555e4705e 100644
--- a/app/controllers/challenge_assignments_controller.rb
+++ b/app/controllers/challenge_assignments_controller.rb
@@ -33,7 +33,7 @@ def load_assignment_from_id
   def owner_only
     return if current_user == @challenge_assignment.offering_pseud.user
 
-    flash[:error] = t(".validations.not_owner")
+    flash[:error] = t("challenge_assignments.validation.not_owner")
     redirect_to root_path
   end
 
diff --git a/app/controllers/collection_participants_controller.rb b/app/controllers/collection_participants_controller.rb
index c2c359b029d..ed336ee4f31 100644
--- a/app/controllers/collection_participants_controller.rb
+++ b/app/controllers/collection_participants_controller.rb
@@ -10,7 +10,7 @@ class CollectionParticipantsController < ApplicationController
   cache_sweeper :collection_sweeper
 
   def owners_required
-    flash[:error] = t(".validation.owners_required")
+    flash[:error] = t("collection_participants.validation.owners_required")
     redirect_to collection_participants_path(@collection)
     false
   end
diff --git a/config/locales/controllers/en.yml b/config/locales/controllers/en.yml
index 8f9199138d7..3876113fb30 100644
--- a/config/locales/controllers/en.yml
+++ b/config/locales/controllers/en.yml
@@ -15,7 +15,7 @@ en:
       destroy:
         unblocked: You have unblocked the user %{name}.
   challenge_assignments:
-    validations:
+    validation:
       not_owner: You aren't the owner of that assignment.
   chapters:
     destroy:

From e026a097440151ca960d7ee479eba783672c73b0 Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sat, 20 Apr 2024 15:19:01 -0400
Subject: [PATCH 22/22] Fix typo

---
 app/helpers/application_helper.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index e1b33b02a70..01cfe944a73 100755
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -349,7 +349,7 @@ def field_id(form_or_object_name, attribute, index: nil, **_kwargs)
 
   # This is a partial re-implementation of ActionView::Helpers::FormTagHelper#field_name.
   # The method contract changed in Rails 7.0, but we can't use the default because it sometimes
-  # includes other information that -- at a minimum -- wrecks havoc on the Cucumber feature tests.
+  # includes other information that -- at a minimum -- wreaks havoc on the Cucumber feature tests.
   # It is used in when constructing forms, like in app/views/tags/new.html.erb.
   def field_name(form_or_object_name, attribute, *_method_names, multiple: false, index: nil)
     object_name = if form_or_object_name.respond_to?(:object_name)