diff --git a/.rubocop.yml b/.rubocop.yml
index 0647b5e48..28f9edea4 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -1,3 +1,5 @@
+require: rubocop-rails
+
 AllCops:
   TargetRubyVersion: 2.3
   Exclude:
@@ -5,9 +7,6 @@ AllCops:
     - "db/schema.rb"
     - "config/locales/cldr/plurals.rb"
 
-Rails:
-  Enabled: true
-
 # Disable for rails 4
 Rails/HttpPositionalArguments:
   Enabled: false
diff --git a/Changelog.md b/Changelog.md
index 57b4966e4..34fd969de 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -20,6 +20,7 @@
 ## Bug fixes
 
 ## Features
+* Add cronjob to cleanup pending photos which were never posted [#8041](https://github.com/diaspora/diaspora/pull/8041)
 
 # 0.7.12.0
 
diff --git a/Gemfile b/Gemfile
index f20886f8c..e4a1445d1 100644
--- a/Gemfile
+++ b/Gemfile
@@ -2,7 +2,7 @@
 
 source "https://rubygems.org"
 
-gem "rails", "5.1.6.2"
+gem "rails", "5.1.7"
 
 # Legacy Rails features, remove me!
 # responders (class level)
@@ -10,7 +10,7 @@ gem "responders", "2.4.1"
 
 # Appserver
 
-gem "unicorn", "5.5.0", require: false
+gem "unicorn", "5.5.1", require: false
 gem "unicorn-worker-killer", "0.4.4"
 
 # Federation
@@ -39,7 +39,7 @@ gem "simple_captcha2", "0.4.3", require: "simple_captcha"
 # Background processing
 
 gem "redis", "3.3.5" # Pinned to 3.3.x because of https://github.com/antirez/redis/issues/4272
-gem "sidekiq", "5.2.5"
+gem "sidekiq", "5.2.7"
 
 # Scheduled processing
 
@@ -55,7 +55,7 @@ gem "configurate", "0.3.1"
 
 # Cross-origin resource sharing
 
-gem "rack-cors", "1.0.2", require: "rack/cors"
+gem "rack-cors", "1.0.3", require: "rack/cors"
 
 # CSS
 
@@ -76,12 +76,12 @@ group :postgresql, optional: true do
 end
 
 
-gem "activerecord-import", "1.0.1"
+gem "activerecord-import", "1.0.2"
 
 # File uploading
 
 gem "carrierwave", "1.3.1"
-gem "fog-aws",     "3.4.0"
+gem "fog-aws",     "3.5.1"
 gem "mini_magick", "4.9.3"
 
 # GUID generation
@@ -93,14 +93,14 @@ gem "entypo-rails", "3.0.0"
 
 # JavaScript
 
-gem "handlebars_assets", "0.23.3"
-gem "jquery-rails",      "4.3.3"
-gem "js-routes",         "1.4.4"
+gem "handlebars_assets", "0.23.4"
+gem "jquery-rails",      "4.3.5"
+gem "js-routes",         "1.4.7"
 gem "js_image_paths",    "0.1.1"
 gem "sprockets-es6",     "0.9.2"
 
 source "https://rails-assets.org" do
-  gem "rails-assets-jquery",                              "3.3.1" # Should be kept in sync with jquery-rails
+  gem "rails-assets-jquery",                              "3.4.1" # Should be kept in sync with jquery-rails
   gem "rails-assets-jquery.ui",                           "1.11.4"
 
   gem "rails-assets-highlightjs",                         "9.12.0"
@@ -142,11 +142,11 @@ gem "rails-i18n",           "5.1.3"
 gem "markerb",             "1.1.0"
 
 # Map
-gem "leaflet-rails",       "1.3.1"
+gem "leaflet-rails",       "1.5.1"
 
 # Parsing
 
-gem "nokogiri",          "1.10.1"
+gem "nokogiri",          "1.10.3"
 gem "open_graph_reader", "0.6.2" # also update User-Agent in features/support/webmock.rb
 gem "redcarpet",         "3.4.0"
 gem "ruby-oembed",       "0.12.0"
@@ -158,7 +158,7 @@ gem "string-direction", "1.2.1"
 
 # Security Headers
 
-gem "secure_headers", "6.1.0"
+gem "secure_headers", "6.1.1"
 
 # Services
 
@@ -169,7 +169,7 @@ gem "omniauth-wordpress", "0.2.2"
 gem "twitter",            "6.2.0"
 
 # OpenID Connect
-gem "openid_connect", "1.1.6"
+gem "openid_connect", "1.1.8"
 
 # Serializers
 
@@ -185,16 +185,16 @@ gem "acts-as-taggable-on", "6.0.0"
 
 # URIs and HTTP
 
-gem "addressable",        "2.5.2", require: "addressable/uri"
+gem "addressable",        "2.6.0", require: "addressable/uri"
 gem "faraday",            "0.15.4"
-gem "faraday_middleware", "0.12.2"
+gem "faraday_middleware", "0.13.1"
 gem "faraday-cookie_jar", "0.0.6"
 gem "typhoeus",           "1.3.1"
 
 # Views
 
 gem "gon",                     "6.2.1"
-gem "hamlit",                  "2.9.2"
+gem "hamlit",                  "2.9.3"
 gem "mobile-fu",               "1.4.0"
 gem "rails-timeago",           "2.17.1"
 gem "will_paginate",           "3.1.7"
@@ -214,7 +214,7 @@ gem "rubyzip", "1.2.2", require: "zip"
 # https://github.com/discourse/discourse/pull/238
 gem "minitest"
 
-gem "versionist", "1.7.0"
+gem "versionist", "2.0.0"
 
 # Windows and OSX have an execjs compatible runtime built-in, Linux users should
 # install Node.js or use "therubyracer".
@@ -253,12 +253,13 @@ group :development do
 
   # Linters
   gem "haml_lint",      "0.28.0", require: false
-  gem "pronto",         "0.9.5", require: false
-  gem "pronto-eslint",  "0.9.1", require: false
-  gem "pronto-haml",    "0.9.0", require: false
-  gem "pronto-rubocop", "0.9.1", require: false
-  gem "pronto-scss",    "0.9.1", require: false
-  gem "rubocop",        "0.66.0", require: false
+  gem "pronto",         "0.10.0", require: false
+  gem "pronto-eslint",  "0.10.0", require: false
+  gem "pronto-haml",    "0.10.0", require: false
+  gem "pronto-rubocop", "0.10.0", require: false
+  gem "pronto-scss",    "0.10.0", require: false
+  gem "rubocop",        "0.72.0", require: false
+  gem "rubocop-rails",  "2.1.0", require: false
 
   # Preloading environment
 
@@ -280,7 +281,7 @@ group :test do
   # RSpec (unit tests, some integration tests)
 
   gem "fixture_builder",   "0.5.2.rc3"
-  gem "fuubar",            "2.3.2"
+  gem "fuubar",            "2.4.0"
   gem "json-schema-rspec", "0.0.4"
   gem "rspec-json_expectations", "~> 2.1"
 
@@ -297,12 +298,12 @@ group :test do
   gem "factory_girl_rails", "4.8.0"
   gem "shoulda-matchers",   "4.0.1"
   gem "timecop",            "0.9.1"
-  gem "webmock",            "3.5.1", require: false
+  gem "webmock",            "3.6.0", require: false
 
   gem "diaspora_federation-test", "0.2.6"
 
   # Coverage
-  gem "coveralls", "0.8.22", require: false
+  gem "coveralls", "0.8.23", require: false
 end
 
 group :development, :test do
@@ -310,12 +311,12 @@ group :development, :test do
   gem "rspec-rails", "3.8.2"
 
   # Cucumber (integration tests)
-  gem "cucumber-rails", "1.6.0", require: false
+  gem "cucumber-rails", "1.7.0", require: false
 
   # Jasmine (client side application tests (JS))
-  gem "jasmine",                   "3.3.0"
+  gem "jasmine",                   "3.4.0"
   gem "jasmine-jquery-rails",      "2.0.3"
-  gem "rails-assets-jasmine-ajax", "3.4.0", source: "https://rails-assets.org"
+  gem "rails-assets-jasmine-ajax", "4.0.0", source: "https://rails-assets.org"
   gem "sinon-rails",               "1.15.0"
 
   # For `assigns` in controller specs
diff --git a/Gemfile.lock b/Gemfile.lock
index 0780e7b3f..2a645ab3e 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -2,25 +2,25 @@ GEM
   remote: https://rubygems.org/
   remote: https://rails-assets.org/
   specs:
-    actioncable (5.1.6.2)
-      actionpack (= 5.1.6.2)
+    actioncable (5.1.7)
+      actionpack (= 5.1.7)
       nio4r (~> 2.0)
       websocket-driver (~> 0.6.1)
-    actionmailer (5.1.6.2)
-      actionpack (= 5.1.6.2)
-      actionview (= 5.1.6.2)
-      activejob (= 5.1.6.2)
+    actionmailer (5.1.7)
+      actionpack (= 5.1.7)
+      actionview (= 5.1.7)
+      activejob (= 5.1.7)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (5.1.6.2)
-      actionview (= 5.1.6.2)
-      activesupport (= 5.1.6.2)
+    actionpack (5.1.7)
+      actionview (= 5.1.7)
+      activesupport (= 5.1.7)
       rack (~> 2.0)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.1.6.2)
-      activesupport (= 5.1.6.2)
+    actionview (5.1.7)
+      activesupport (= 5.1.7)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
@@ -28,18 +28,18 @@ GEM
     active_model_serializers (0.9.7)
       activemodel (>= 3.2)
       concurrent-ruby (~> 1.0)
-    activejob (5.1.6.2)
-      activesupport (= 5.1.6.2)
+    activejob (5.1.7)
+      activesupport (= 5.1.7)
       globalid (>= 0.3.6)
-    activemodel (5.1.6.2)
-      activesupport (= 5.1.6.2)
-    activerecord (5.1.6.2)
-      activemodel (= 5.1.6.2)
-      activesupport (= 5.1.6.2)
+    activemodel (5.1.7)
+      activesupport (= 5.1.7)
+    activerecord (5.1.7)
+      activemodel (= 5.1.7)
+      activesupport (= 5.1.7)
       arel (~> 8.0)
-    activerecord-import (1.0.1)
+    activerecord-import (1.0.2)
       activerecord (>= 3.2)
-    activesupport (5.1.6.2)
+    activesupport (5.1.7)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
@@ -50,7 +50,7 @@ GEM
       activemodel (>= 3.0.0)
       activesupport (>= 3.0.0)
       rack (>= 1.1.0)
-    addressable (2.5.2)
+    addressable (2.6.0)
       public_suffix (>= 2.0.2, < 4.0)
     aes_key_wrap (1.0.1)
     arel (8.0.0)
@@ -69,8 +69,8 @@ GEM
     babel-transpiler (0.7.0)
       babel-source (>= 4.0, < 6)
       execjs (~> 2.0)
-    backports (3.12.0)
-    bcrypt (3.1.12)
+    backports (3.15.0)
+    bcrypt (3.1.13)
     bindata (2.4.4)
     bootstrap-sass (3.4.1)
       autoprefixer-rails (>= 5.2.1)
@@ -134,11 +134,11 @@ GEM
     concurrent-ruby (1.1.5)
     configurate (0.3.1)
     connection_pool (2.2.2)
-    coveralls (0.8.22)
+    coveralls (0.8.23)
       json (>= 1.8, < 3)
       simplecov (~> 0.16.1)
       term-ansicolor (~> 1.3)
-      thor (~> 0.19.4)
+      thor (>= 0.19.4, < 2.0)
       tins (~> 1.6)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
@@ -160,12 +160,12 @@ GEM
       cucumber-tag_expressions (~> 1.1.0)
       gherkin (~> 5.0)
     cucumber-expressions (6.0.1)
-    cucumber-rails (1.6.0)
-      capybara (>= 1.1.2, < 4)
+    cucumber-rails (1.7.0)
+      capybara (>= 2.3.0, < 4)
       cucumber (>= 3.0.2, < 4)
       mime-types (>= 1.17, < 4)
       nokogiri (~> 1.8)
-      railties (>= 4, < 6)
+      railties (>= 4.2, < 7)
     cucumber-tag_expressions (1.1.1)
     cucumber-wire (0.0.1)
     database_cleaner (1.7.0)
@@ -200,7 +200,7 @@ GEM
       fabrication (~> 2.16)
       uuid (~> 2.3, >= 2.3.8)
     diff-lcs (1.3)
-    docile (1.3.1)
+    docile (1.3.2)
     domain_name (0.5.20180417)
       unf (>= 0.0.5, < 1.0.0)
     encryptor (3.0.0)
@@ -212,11 +212,11 @@ GEM
       execjs
       multi_json (>= 1.3)
       rake
-    et-orbi (1.1.7)
+    et-orbi (1.2.1)
       tzinfo
     ethon (0.12.0)
       ffi (>= 1.3.0)
-    excon (0.62.0)
+    excon (0.64.0)
     execjs (2.7.0)
     eye (0.10.0)
       celluloid (~> 0.17.3)
@@ -224,7 +224,7 @@ GEM
       kostya-sigar (~> 2.0.0)
       state_machines
       thor
-    fabrication (2.20.1)
+    fabrication (2.20.2)
     factory_girl (4.8.0)
       activesupport (>= 3.0.0)
     factory_girl_rails (4.8.0)
@@ -235,14 +235,14 @@ GEM
     faraday-cookie_jar (0.0.6)
       faraday (>= 0.7.4)
       http-cookie (~> 1.0.0)
-    faraday_middleware (0.12.2)
+    faraday_middleware (0.13.1)
       faraday (>= 0.7.4, < 1.0)
-    ffi (1.10.0)
+    ffi (1.11.1)
     fixture_builder (0.5.2.rc3)
       activerecord (>= 2)
       activesupport (>= 2)
       hashdiff
-    fog-aws (3.4.0)
+    fog-aws (3.5.1)
       fog-core (~> 2.1)
       fog-json (~> 1.1)
       fog-xml (~> 0.1)
@@ -259,15 +259,15 @@ GEM
       fog-core
       nokogiri (>= 1.5.11, < 2.0.0)
     formatador (0.2.5)
-    fugit (1.1.8)
-      et-orbi (~> 1.1, >= 1.1.7)
+    fugit (1.2.2)
+      et-orbi (~> 1.1, >= 1.1.8)
       raabro (~> 1.1)
-    fuubar (2.3.2)
+    fuubar (2.4.0)
       rspec-core (~> 3.0)
       ruby-progressbar (~> 1.4)
     get_process_mem (0.2.3)
     gherkin (5.1.0)
-    gitlab (4.10.0)
+    gitlab (4.11.0)
       httparty (~> 0.14, >= 0.14.0)
       terminal-table (~> 1.5, >= 1.5.1)
     globalid (0.4.2)
@@ -302,15 +302,15 @@ GEM
       rake (>= 10, < 13)
       rubocop (>= 0.50.0)
       sysexits (~> 1.1)
-    hamlit (2.9.2)
+    hamlit (2.9.3)
       temple (>= 0.8.0)
       thor
       tilt
-    handlebars_assets (0.23.3)
+    handlebars_assets (0.23.4)
       execjs (~> 2.0)
       sprockets (>= 2.0.0)
       tilt (>= 1.2)
-    hashdiff (0.3.8)
+    hashdiff (0.4.0)
     hashie (3.6.0)
     http (3.3.0)
       addressable (~> 2.3)
@@ -322,7 +322,7 @@ GEM
     http-form_data (2.1.1)
     http_accept_language (2.1.1)
     http_parser.rb (0.6.0)
-    httparty (0.16.4)
+    httparty (0.17.0)
       mime-types (~> 3.0)
       multi_xml (>= 0.5.2)
     httpclient (2.8.3)
@@ -336,26 +336,26 @@ GEM
       railties (>= 3.0.0)
     idn-ruby (0.1.0)
     ipaddress (0.8.3)
-    jaro_winkler (1.5.2)
-    jasmine (3.3.0)
-      jasmine-core (~> 3.3.0)
+    jaro_winkler (1.5.3)
+    jasmine (3.4.0)
+      jasmine-core (~> 3.4.0)
       phantomjs
       rack (>= 1.2.1)
       rake
-    jasmine-core (3.3.0)
+    jasmine-core (3.4.0)
     jasmine-jquery-rails (2.0.3)
-    jquery-rails (4.3.3)
+    jquery-rails (4.3.5)
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
-    js-routes (1.4.4)
-      railties (>= 3.2)
+    js-routes (1.4.7)
+      railties (>= 4)
       sprockets-rails
     js_image_paths (0.1.1)
       rails (>= 4.0, < 6.0)
       sprockets (>= 3.0.0)
     json (2.2.0)
-    json-jwt (1.10.0)
+    json-jwt (1.10.2)
       activesupport (>= 4.2)
       aes_key_wrap
       bindata
@@ -364,13 +364,13 @@ GEM
     json-schema-rspec (0.0.4)
       json-schema (~> 2.5)
       rspec
-    jsonpath (1.0.1)
+    jsonpath (1.0.4)
       multi_json
       to_regexp (~> 0.2.1)
-    jwt (2.1.0)
+    jwt (2.2.1)
     kgio (2.11.2)
     kostya-sigar (2.0.6)
-    leaflet-rails (1.3.1)
+    leaflet-rails (1.5.1)
       rails (>= 4.2.0)
     listen (3.1.5)
       rb-fsevent (~> 0.9, >= 0.9.4)
@@ -386,8 +386,8 @@ GEM
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     lumberjack (1.0.13)
-    macaddr (1.7.1)
-      systemu (~> 2.6.2)
+    macaddr (1.7.2)
+      systemu (~> 2.6.5)
     mail (2.7.1)
       mini_mime (>= 0.1.1)
     markdown-it-html5-embed (1.0.0)
@@ -397,7 +397,7 @@ GEM
     method_source (0.9.2)
     mime-types (3.2.2)
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2018.0812)
+    mime-types-data (3.2019.0331)
     mini_magick (4.9.3)
     mini_mime (1.0.1)
     mini_portile2 (2.4.0)
@@ -408,12 +408,12 @@ GEM
     multi_json (1.13.1)
     multi_test (0.1.2)
     multi_xml (0.6.0)
-    multipart-post (2.0.0)
+    multipart-post (2.1.1)
     mysql2 (0.5.2)
     naught (1.1.0)
     nenv (0.3.0)
     nio4r (2.3.1)
-    nokogiri (1.10.1)
+    nokogiri (1.10.3)
       mini_portile2 (~> 2.4.0)
     notiffany (0.1.1)
       nenv (~> 0.1)
@@ -425,7 +425,7 @@ GEM
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 3)
-    octokit (4.13.0)
+    octokit (4.14.0)
       sawyer (~> 0.8.0, >= 0.5.3)
     omniauth (1.9.0)
       hashie (>= 3.4.6, < 3.7.0)
@@ -447,7 +447,7 @@ GEM
     open_graph_reader (0.6.2)
       faraday (>= 0.9.0)
       nokogiri (~> 1.6)
-    openid_connect (1.1.6)
+    openid_connect (1.1.8)
       activemodel
       attr_required (>= 1.0.0)
       json-jwt (>= 1.5.0)
@@ -458,8 +458,8 @@ GEM
       validate_url
       webfinger (>= 1.0.1)
     orm_adapter (0.5.0)
-    parallel (1.14.0)
-    parser (2.6.2.0)
+    parallel (1.17.0)
+    parser (2.6.3.0)
       ast (~> 2.4.0)
     pg (1.1.4)
     phantomjs (2.1.1.0)
@@ -467,24 +467,24 @@ GEM
       capybara (>= 2.1, < 4)
       cliver (~> 0.3.1)
       websocket-driver (>= 0.2.0)
-    pronto (0.9.5)
+    pronto (0.10.0)
       gitlab (~> 4.0, >= 4.0.0)
       httparty (>= 0.13.7)
       octokit (~> 4.7, >= 4.7.0)
-      rainbow (~> 2.1)
+      rainbow (>= 2.2, < 4.0)
       rugged (~> 0.24, >= 0.23.0)
-      thor (~> 0.19.0)
-    pronto-eslint (0.9.1)
+      thor (~> 0.20.0)
+    pronto-eslint (0.10.0)
       eslintrb (~> 2.0, >= 2.0.0)
-      pronto (~> 0.9.0)
-    pronto-haml (0.9.0)
+      pronto (~> 0.10.0)
+    pronto-haml (0.10.0)
       haml_lint (~> 0.23)
-      pronto (~> 0.9.0)
-    pronto-rubocop (0.9.1)
-      pronto (~> 0.9.0)
+      pronto (~> 0.10.0)
+    pronto-rubocop (0.10.0)
+      pronto (~> 0.10.0)
       rubocop (~> 0.50, >= 0.49.1)
-    pronto-scss (0.9.1)
-      pronto (~> 0.9.0)
+    pronto-scss (0.10.0)
+      pronto (~> 0.10.0)
       scss_lint (~> 0.43, >= 0.43.0)
     pry (0.12.2)
       coderay (~> 1.1.0)
@@ -492,17 +492,16 @@ GEM
     pry-byebug (3.7.0)
       byebug (~> 11.0)
       pry (~> 0.10)
-    psych (3.1.0)
-    public_suffix (3.0.3)
+    public_suffix (3.1.1)
     raabro (1.1.6)
-    rack (2.0.6)
-    rack-cors (1.0.2)
+    rack (2.0.7)
+    rack-cors (1.0.3)
     rack-google-analytics (1.2.0)
       actionpack
       activesupport
     rack-mobile-detect (0.4.0)
       rack
-    rack-oauth2 (1.9.3)
+    rack-oauth2 (1.10.0)
       activesupport
       attr_required
       httpclient
@@ -516,23 +515,23 @@ GEM
       rack
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
-    rails (5.1.6.2)
-      actioncable (= 5.1.6.2)
-      actionmailer (= 5.1.6.2)
-      actionpack (= 5.1.6.2)
-      actionview (= 5.1.6.2)
-      activejob (= 5.1.6.2)
-      activemodel (= 5.1.6.2)
-      activerecord (= 5.1.6.2)
-      activesupport (= 5.1.6.2)
+    rails (5.1.7)
+      actioncable (= 5.1.7)
+      actionmailer (= 5.1.7)
+      actionpack (= 5.1.7)
+      actionview (= 5.1.7)
+      activejob (= 5.1.7)
+      activemodel (= 5.1.7)
+      activerecord (= 5.1.7)
+      activesupport (= 5.1.7)
       bundler (>= 1.3.0)
-      railties (= 5.1.6.2)
+      railties (= 5.1.7)
       sprockets-rails (>= 2.0.0)
     rails-assets-autosize (4.0.2)
     rails-assets-backbone (1.3.3)
       rails-assets-underscore (>= 1.8.3)
     rails-assets-blueimp-gallery (2.33.0)
-    rails-assets-bootstrap (3.3.7)
+    rails-assets-bootstrap (3.4.1)
       rails-assets-jquery (>= 1.9.1, < 4)
     rails-assets-bootstrap-markdown (2.10.0)
       rails-assets-bootstrap (~> 3)
@@ -550,10 +549,10 @@ GEM
     rails-assets-favico.js (0.3.10)
     rails-assets-fine-uploader (5.13.0)
     rails-assets-highlightjs (9.12.0)
-    rails-assets-jasmine (3.3.0)
-    rails-assets-jasmine-ajax (3.4.0)
+    rails-assets-jasmine (3.4.0)
+    rails-assets-jasmine-ajax (4.0.0)
       rails-assets-jasmine (~> 3)
-    rails-assets-jquery (3.3.1)
+    rails-assets-jquery (3.4.1)
     rails-assets-jquery-colorbox (1.6.4)
       rails-assets-jquery (>= 1.3.2)
     rails-assets-jquery-fullscreen-plugin (0.5.0)
@@ -591,14 +590,13 @@ GEM
     rails-timeago (2.17.1)
       actionpack (>= 3.1)
       activesupport (>= 3.1)
-    railties (5.1.6.2)
-      actionpack (= 5.1.6.2)
-      activesupport (= 5.1.6.2)
+    railties (5.1.7)
+      actionpack (= 5.1.7)
+      activesupport (= 5.1.7)
       method_source
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
-    rainbow (2.2.2)
-      rake
+    rainbow (3.0.0)
     raindrops (0.19.0)
     rake (12.3.2)
     rb-fsevent (0.10.3)
@@ -606,7 +604,7 @@ GEM
       ffi (~> 1.0)
     redcarpet (3.4.0)
     redis (3.3.5)
-    regexp_parser (1.3.0)
+    regexp_parser (1.5.1)
     request_store (1.4.1)
       rack (>= 1.4)
     responders (2.4.1)
@@ -619,13 +617,13 @@ GEM
       rspec-core (~> 3.8.0)
       rspec-expectations (~> 3.8.0)
       rspec-mocks (~> 3.8.0)
-    rspec-core (3.8.0)
+    rspec-core (3.8.2)
       rspec-support (~> 3.8.0)
-    rspec-expectations (3.8.2)
+    rspec-expectations (3.8.4)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.8.0)
-    rspec-json_expectations (2.1.0)
-    rspec-mocks (3.8.0)
+    rspec-json_expectations (2.2.0)
+    rspec-mocks (3.8.1)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.8.0)
     rspec-rails (3.8.2)
@@ -636,20 +634,22 @@ GEM
       rspec-expectations (~> 3.8.0)
       rspec-mocks (~> 3.8.0)
       rspec-support (~> 3.8.0)
-    rspec-support (3.8.0)
-    rubocop (0.66.0)
+    rspec-support (3.8.2)
+    rubocop (0.72.0)
       jaro_winkler (~> 1.5.1)
       parallel (~> 1.10)
-      parser (>= 2.5, != 2.5.1.1)
-      psych (>= 3.1.0)
+      parser (>= 2.6)
       rainbow (>= 2.2.2, < 4.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 1.6)
+      unicode-display_width (>= 1.4.0, < 1.7)
+    rubocop-rails (2.1.0)
+      rack (>= 1.1)
+      rubocop (>= 0.72.0)
     ruby-oembed (0.12.0)
-    ruby-progressbar (1.10.0)
+    ruby-progressbar (1.10.1)
     ruby_dep (1.5.0)
     rubyzip (1.2.2)
-    rugged (0.28.1)
+    rugged (0.28.2)
     safe_yaml (1.0.5)
     sass (3.4.25)
     sass-rails (5.0.7)
@@ -661,17 +661,17 @@ GEM
     sassc (2.0.1)
       ffi (~> 1.9)
       rake
-    sawyer (0.8.1)
-      addressable (>= 2.3.5, < 2.6)
-      faraday (~> 0.8, < 1.0)
+    sawyer (0.8.2)
+      addressable (>= 2.3.5)
+      faraday (> 0.8, < 2.0)
     scss_lint (0.55.0)
       rake (>= 0.9, < 13)
       sass (~> 3.4.20)
-    secure_headers (6.1.0)
+    secure_headers (6.1.1)
     shellany (0.0.1)
     shoulda-matchers (4.0.1)
       activesupport (>= 4.2.0)
-    sidekiq (5.2.5)
+    sidekiq (5.2.7)
       connection_pool (~> 2.2, >= 2.2.2)
       rack (>= 1.5.0)
       rack-protection (>= 1.5.0)
@@ -719,12 +719,12 @@ GEM
       tins (~> 1.0)
     terminal-table (1.8.0)
       unicode-display_width (~> 1.1, >= 1.1.1)
-    thor (0.19.4)
+    thor (0.20.3)
     thread_safe (0.3.6)
     tilt (2.0.9)
     timecop (0.9.1)
     timers (4.3.0)
-    tins (1.20.2)
+    tins (1.20.3)
     to_regexp (0.2.1)
     turbo_dev_assets (0.0.2)
     twitter (6.2.0)
@@ -749,9 +749,9 @@ GEM
       execjs (>= 0.3.0, < 3)
     unf (0.1.4)
       unf_ext
-    unf_ext (0.0.7.5)
-    unicode-display_width (1.5.0)
-    unicorn (5.5.0)
+    unf_ext (0.0.7.6)
+    unicode-display_width (1.6.0)
+    unicorn (5.5.1)
       kgio (~> 2.6)
       raindrops (~> 0.7)
     unicorn-worker-killer (0.4.4)
@@ -763,10 +763,10 @@ GEM
     validate_email (0.1.6)
       activemodel (>= 3.0)
       mail (>= 2.2.5)
-    validate_url (1.0.6)
+    validate_url (1.0.8)
       activemodel (>= 3.0.0)
       public_suffix
-    versionist (1.7.0)
+    versionist (2.0.0)
       activesupport (>= 3)
       railties (>= 3)
       yard (~> 0.9.11)
@@ -775,28 +775,28 @@ GEM
     webfinger (1.1.0)
       activesupport
       httpclient (>= 2.4)
-    webmock (3.5.1)
+    webmock (3.6.0)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
-      hashdiff
+      hashdiff (>= 0.4.0, < 2.0.0)
     websocket-driver (0.6.5)
       websocket-extensions (>= 0.1.0)
-    websocket-extensions (0.1.3)
+    websocket-extensions (0.1.4)
     will_paginate (3.1.7)
     xpath (3.2.0)
       nokogiri (~> 1.8)
     yajl-ruby (1.4.1)
-    yard (0.9.18)
+    yard (0.9.20)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
   active_model_serializers (= 0.9.7)
-  activerecord-import (= 1.0.1)
+  activerecord-import (= 1.0.2)
   acts-as-taggable-on (= 6.0.0)
   acts_as_api (= 1.0.1)
-  addressable (= 2.5.2)
+  addressable (= 2.6.0)
   asset_sync (= 2.7.0)
   autoprefixer-rails (= 8.6.5)
   bootstrap-sass (= 3.4.1)
@@ -805,9 +805,9 @@ DEPENDENCIES
   carrierwave (= 1.3.1)
   compass-rails (= 3.1.0)
   configurate (= 0.3.1)
-  coveralls (= 0.8.22)
+  coveralls (= 0.8.23)
   cucumber-api-steps (= 0.14)
-  cucumber-rails (= 1.6.0)
+  cucumber-rails (= 1.7.0)
   database_cleaner (= 1.7.0)
   devise (= 4.6.1)
   devise-two-factor (= 3.0.3)
@@ -821,28 +821,28 @@ DEPENDENCIES
   factory_girl_rails (= 4.8.0)
   faraday (= 0.15.4)
   faraday-cookie_jar (= 0.0.6)
-  faraday_middleware (= 0.12.2)
+  faraday_middleware (= 0.13.1)
   fixture_builder (= 0.5.2.rc3)
-  fog-aws (= 3.4.0)
-  fuubar (= 2.3.2)
+  fog-aws (= 3.5.1)
+  fuubar (= 2.4.0)
   gon (= 6.2.1)
   guard (= 2.15.0)
   guard-rspec (= 4.7.3)
   guard-rubocop (= 1.3.0)
   haml_lint (= 0.28.0)
-  hamlit (= 2.9.2)
-  handlebars_assets (= 0.23.3)
+  hamlit (= 2.9.3)
+  handlebars_assets (= 0.23.4)
   http_accept_language (= 2.1.1)
   i18n-inflector-rails (= 1.0.7)
-  jasmine (= 3.3.0)
+  jasmine (= 3.4.0)
   jasmine-jquery-rails (= 2.0.3)
-  jquery-rails (= 4.3.3)
-  js-routes (= 1.4.4)
+  jquery-rails (= 4.3.5)
+  js-routes (= 1.4.7)
   js_image_paths (= 0.1.1)
   json (= 2.2.0)
   json-schema (= 2.8.1)
   json-schema-rspec (= 0.0.4)
-  leaflet-rails (= 1.3.1)
+  leaflet-rails (= 1.5.1)
   logging-rails (= 0.6.0)
   markdown-it-html5-embed (= 1.0.0)
   markerb (= 1.1.0)
@@ -850,28 +850,28 @@ DEPENDENCIES
   minitest
   mobile-fu (= 1.4.0)
   mysql2 (= 0.5.2)
-  nokogiri (= 1.10.1)
+  nokogiri (= 1.10.3)
   omniauth (= 1.9.0)
   omniauth-tumblr (= 1.2)
   omniauth-twitter (= 1.4.0)
   omniauth-wordpress (= 0.2.2)
   open_graph_reader (= 0.6.2)
-  openid_connect (= 1.1.6)
+  openid_connect (= 1.1.8)
   pg (= 1.1.4)
   poltergeist (= 1.18.1)
-  pronto (= 0.9.5)
-  pronto-eslint (= 0.9.1)
-  pronto-haml (= 0.9.0)
-  pronto-rubocop (= 0.9.1)
-  pronto-scss (= 0.9.1)
+  pronto (= 0.10.0)
+  pronto-eslint (= 0.10.0)
+  pronto-haml (= 0.10.0)
+  pronto-rubocop (= 0.10.0)
+  pronto-scss (= 0.10.0)
   pry
   pry-byebug
-  rack-cors (= 1.0.2)
+  rack-cors (= 1.0.3)
   rack-google-analytics (= 1.2.0)
   rack-piwik (= 0.3.0)
   rack-rewrite (= 1.5.1)
   rack-ssl (= 1.4.1)
-  rails (= 5.1.6.2)
+  rails (= 5.1.7)
   rails-assets-autosize (= 4.0.2)!
   rails-assets-backbone (= 1.3.3)!
   rails-assets-blueimp-gallery (= 2.33.0)!
@@ -881,8 +881,8 @@ DEPENDENCIES
   rails-assets-diaspora_jsxc (= 0.1.5.develop.7)!
   rails-assets-fine-uploader (= 5.13.0)!
   rails-assets-highlightjs (= 9.12.0)!
-  rails-assets-jasmine-ajax (= 3.4.0)!
-  rails-assets-jquery (= 3.3.1)!
+  rails-assets-jasmine-ajax (= 4.0.0)!
+  rails-assets-jquery (= 3.4.1)!
   rails-assets-jquery-placeholder (= 2.3.1)!
   rails-assets-jquery-textchange (= 0.2.3)!
   rails-assets-jquery.are-you-sure (= 1.9.0)!
@@ -907,13 +907,14 @@ DEPENDENCIES
   rqrcode (= 0.10.1)
   rspec-json_expectations (~> 2.1)
   rspec-rails (= 3.8.2)
-  rubocop (= 0.66.0)
+  rubocop (= 0.72.0)
+  rubocop-rails (= 2.1.0)
   ruby-oembed (= 0.12.0)
   rubyzip (= 1.2.2)
   sass-rails (= 5.0.7)
-  secure_headers (= 6.1.0)
+  secure_headers (= 6.1.1)
   shoulda-matchers (= 4.0.1)
-  sidekiq (= 5.2.5)
+  sidekiq (= 5.2.7)
   sidekiq-cron (= 1.1.0)
   simple_captcha2 (= 0.4.3)
   simplecov (= 0.16.1)
@@ -930,11 +931,11 @@ DEPENDENCIES
   twitter-text (= 3.0.0)
   typhoeus (= 1.3.1)
   uglifier (= 4.1.20)
-  unicorn (= 5.5.0)
+  unicorn (= 5.5.1)
   unicorn-worker-killer (= 0.4.4)
   uuid (= 2.3.9)
-  versionist (= 1.7.0)
-  webmock (= 3.5.1)
+  versionist (= 2.0.0)
+  webmock (= 3.6.0)
   will_paginate (= 3.1.7)
   yajl-ruby (= 1.4.1)
 
diff --git a/app/workers/cleanup_pending_photos.rb b/app/workers/cleanup_pending_photos.rb
new file mode 100644
index 000000000..e7cabf54b
--- /dev/null
+++ b/app/workers/cleanup_pending_photos.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Workers
+  class CleanupPendingPhotos < Base
+    sidekiq_options queue: :low
+
+    def perform
+      Photo.where(pending: true).where("created_at < ?", 1.day.ago).destroy_all
+    end
+  end
+end
diff --git a/config/initializers/sidekiq_scheduled.rb b/config/initializers/sidekiq_scheduled.rb
index ac9140e38..46fc92adb 100644
--- a/config/initializers/sidekiq_scheduled.rb
+++ b/config/initializers/sidekiq_scheduled.rb
@@ -29,6 +29,11 @@ def default_job_config
       "class": "Workers::CleanupOldExports"
     },
 
+    cleanup_pending_photos:  {
+      "cron":  "#{random_minute.call} #{random_hour.call} * * *",
+      "class": "Workers::CleanupPendingPhotos"
+    },
+
     queue_users_for_removal: {
       "cron":  "#{random_minute.call} #{random_hour.call} * * *",
       "class": "Workers::QueueUsersForRemoval"
diff --git a/spec/workers/cleanup_pending_photos_spec.rb b/spec/workers/cleanup_pending_photos_spec.rb
new file mode 100644
index 000000000..1a92cac96
--- /dev/null
+++ b/spec/workers/cleanup_pending_photos_spec.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+describe Workers::CleanupPendingPhotos do
+  let!(:photo) { FactoryGirl.create(:photo, author: alice.person, pending: true) }
+
+  it "removes pending photos" do
+    Timecop.travel(25.hours) do
+      Workers::CleanupPendingPhotos.new.perform
+      expect(Photo).not_to exist(photo.id)
+    end
+  end
+
+  it "does not remove pending photos newer than one day" do
+    Timecop.travel(1.hour) do
+      Workers::CleanupPendingPhotos.new.perform
+      expect(Photo).to exist(photo.id)
+    end
+  end
+
+  it "does not remove posted photos" do
+    StatusMessageCreationService.new(alice).create(
+      status_message: {text: "Post with photo"},
+      public:         true,
+      photos:         [photo.id]
+    )
+    Timecop.travel(25.hours) do
+      Workers::CleanupPendingPhotos.new.perform
+      expect(Photo).to exist(photo.id)
+    end
+  end
+end