diff --git a/Gemfile b/Gemfile
index cfc1fd7df..6ae1fbda0 100644
--- a/Gemfile
+++ b/Gemfile
@@ -2,7 +2,7 @@
 
 source "https://rubygems.org"
 
-gem "rails", "5.2.5"
+gem "rails", "5.2.6"
 
 # Legacy Rails features, remove me!
 # responders (class level)
@@ -27,10 +27,10 @@ gem "yajl-ruby",   "1.4.1"
 
 # Authentication
 
-gem "devise", "4.7.3"
-gem "devise-two-factor", "4.0.0"
+gem "devise", "4.8.0"
 gem "devise_lastseenable", "0.0.6"
-gem "rqrcode", "1.1.2"
+gem "devise-two-factor", "4.0.0"
+gem "rqrcode", "2.0.0"
 
 # Captcha
 
@@ -38,7 +38,7 @@ gem "simple_captcha2", "0.5.0", require: "simple_captcha"
 
 # Background processing
 
-gem "redis", "4.2.5"
+gem "redis", "4.3.1"
 gem "sidekiq", "6.2.1"
 
 # Scheduled processing
@@ -60,12 +60,12 @@ gem "rack-cors", "1.1.1", require: "rack/cors"
 
 # CSS
 
-gem "autoprefixer-rails",     "10.2.4.0"
+gem "autoprefixer-rails",     "10.2.5.1"
 gem "bootstrap-sass",         "3.4.1"
 gem "bootstrap-switch-rails", "3.3.3" # 3.3.4 and 3.3.5 is broken, see https://github.com/Bttstrp/bootstrap-switch/issues/691
 gem "compass-rails",          "3.1.0"
 gem "sass-rails",             "5.0.7"
-gem "sprockets-rails",        "3.2.1"
+gem "sprockets-rails",        "3.2.2"
 
 # Database
 
@@ -76,14 +76,13 @@ group :postgresql, optional: true do
   gem "pg",     "1.2.3"
 end
 
-
-gem "activerecord-import", "1.0.4"
+gem "activerecord-import", "1.1.0"
 
 # File uploading
 
-gem "carrierwave", "1.3.2"
-gem "fog-aws",     "3.5.2"
-gem "mini_magick", "4.10.1"
+gem "carrierwave", "2.2.2"
+gem "fog-aws",     "3.10.0"
+gem "mini_magick", "4.11.0"
 
 # GUID generation
 gem "uuid", "2.3.9"
@@ -94,10 +93,10 @@ gem "entypo-rails", "3.0.0"
 
 # JavaScript
 
-gem "handlebars_assets", "0.23.8"
+gem "handlebars_assets", "0.23.9"
 gem "jquery-rails",      "4.4.0"
 gem "jquery-ui-rails",   "5.0.5"
-gem "js-routes",         "1.4.9"
+gem "js-routes",         "1.4.14"
 gem "js_image_paths",    "0.1.1"
 gem "sprockets-es6",     "0.9.2"
 
@@ -143,14 +142,14 @@ gem "rails-i18n",           "5.1.3"
 gem "markerb",             "1.1.0"
 
 # Map
-gem "leaflet-rails",       "1.6.0"
+gem "leaflet-rails",       "1.7.0"
 
 # Parsing
 
-gem "nokogiri",          "1.11.3"
+gem "nokogiri",          "1.11.7"
 gem "open_graph_reader", "0.7.1" # also update User-Agent in features/support/webmock.rb and open_graph_cache_spec.rb
 gem "redcarpet",         "3.5.1"
-gem "ruby-oembed",       "0.12.0"
+gem "ruby-oembed",       "0.15.0"
 gem "twitter-text",      "3.1.0"
 
 # RTL support
@@ -170,7 +169,7 @@ gem "omniauth-wordpress", "0.2.2"
 gem "twitter",            "7.0.0"
 
 # OpenID Connect
-gem "openid_connect", "1.1.8"
+gem "openid_connect", "1.2.0"
 
 # Serializers
 
@@ -178,7 +177,7 @@ gem "active_model_serializers", "0.9.7"
 
 # Tags
 
-gem "acts-as-taggable-on", "6.5.0"
+gem "acts-as-taggable-on", "8.1.0"
 
 # URIs and HTTP
 
@@ -190,10 +189,10 @@ gem "typhoeus",           "1.4.0"
 
 # Views
 
-gem "gon",                     "6.3.2"
-gem "hamlit",                  "2.14.6"
+gem "gon",                     "6.4.0"
+gem "hamlit",                  "2.15.0"
 gem "mobile-fu",               "1.4.0"
-gem "rails-timeago",           "2.18.0"
+gem "rails-timeago",           "2.19.1"
 gem "will_paginate",           "3.3.0"
 
 # Logging
@@ -237,12 +236,12 @@ group :production do # we don"t install these on travis to speed up test runs
 
   # Third party asset hosting
 
-  gem "asset_sync", "2.11.0", require: false
+  gem "asset_sync", "2.14.2", require: false
 end
 
 group :development do
   # Linters
-  gem "haml_lint",      "0.37.0", require: false
+  gem "haml_lint",      "0.37.1", require: false
   gem "pronto",         "0.11.0", require: false
   gem "pronto-eslint",  "0.11.0", require: false
   gem "pronto-haml",    "0.11.0", require: false
@@ -284,7 +283,7 @@ group :test do
   gem "factory_bot_rails", "6.1.0"
   gem "shoulda-matchers",  "4.5.1"
   gem "timecop",           "0.9.4"
-  gem "webmock",           "3.12.2", require: false
+  gem "webmock",           "3.13.0", require: false
 
   gem "diaspora_federation-test", "0.2.6"
 end
@@ -304,5 +303,5 @@ group :development, :test do
   gem "sinon-rails",               "1.15.0"
 
   # For `assigns` in controller specs
-  gem "rails-controller-testing", "1.0.4"
+  gem "rails-controller-testing", "1.0.5"
 end
diff --git a/Gemfile.lock b/Gemfile.lock
index 06caa0084..dd3455bfe 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -2,25 +2,25 @@ GEM
   remote: https://rubygems.org/
   remote: https://gems.diasporafoundation.org/
   specs:
-    actioncable (5.2.5)
-      actionpack (= 5.2.5)
+    actioncable (5.2.6)
+      actionpack (= 5.2.6)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailer (5.2.5)
-      actionpack (= 5.2.5)
-      actionview (= 5.2.5)
-      activejob (= 5.2.5)
+    actionmailer (5.2.6)
+      actionpack (= 5.2.6)
+      actionview (= 5.2.6)
+      activejob (= 5.2.6)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (5.2.5)
-      actionview (= 5.2.5)
-      activesupport (= 5.2.5)
+    actionpack (5.2.6)
+      actionview (= 5.2.6)
+      activesupport (= 5.2.6)
       rack (~> 2.0, >= 2.0.8)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.2.5)
-      activesupport (= 5.2.5)
+    actionview (5.2.6)
+      activesupport (= 5.2.6)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
@@ -28,28 +28,28 @@ GEM
     active_model_serializers (0.9.7)
       activemodel (>= 3.2)
       concurrent-ruby (~> 1.0)
-    activejob (5.2.5)
-      activesupport (= 5.2.5)
+    activejob (5.2.6)
+      activesupport (= 5.2.6)
       globalid (>= 0.3.6)
-    activemodel (5.2.5)
-      activesupport (= 5.2.5)
-    activerecord (5.2.5)
-      activemodel (= 5.2.5)
-      activesupport (= 5.2.5)
+    activemodel (5.2.6)
+      activesupport (= 5.2.6)
+    activerecord (5.2.6)
+      activemodel (= 5.2.6)
+      activesupport (= 5.2.6)
       arel (>= 9.0)
-    activerecord-import (1.0.4)
+    activerecord-import (1.1.0)
       activerecord (>= 3.2)
-    activestorage (5.2.5)
-      actionpack (= 5.2.5)
-      activerecord (= 5.2.5)
+    activestorage (5.2.6)
+      actionpack (= 5.2.6)
+      activerecord (= 5.2.6)
       marcel (~> 1.0.0)
-    activesupport (5.2.5)
+    activesupport (5.2.6)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
       tzinfo (~> 1.1)
-    acts-as-taggable-on (6.5.0)
-      activerecord (>= 5.0, < 6.1)
+    acts-as-taggable-on (8.1.0)
+      activerecord (>= 5.0, < 6.2)
     acts_as_api (1.0.1)
       activemodel (>= 3.0.0)
       activesupport (>= 3.0.0)
@@ -61,7 +61,7 @@ GEM
       capybara (~> 3.13, < 4)
       websocket-driver (>= 0.6.5)
     arel (9.0.0)
-    asset_sync (2.11.0)
+    asset_sync (2.14.2)
       activemodel (>= 4.1.0)
       fog-core
       mime-types (>= 2.99)
@@ -70,14 +70,14 @@ GEM
     attr_encrypted (3.1.0)
       encryptor (~> 3.0.0)
     attr_required (1.0.1)
-    autoprefixer-rails (10.2.4.0)
-      execjs
+    autoprefixer-rails (10.2.5.1)
+      execjs (> 0)
     babel-source (5.8.35)
     babel-transpiler (0.7.0)
       babel-source (>= 4.0, < 6)
       execjs (~> 2.0)
     bcrypt (3.1.16)
-    bindata (2.4.8)
+    bindata (2.4.10)
     bootstrap-sass (3.4.1)
       autoprefixer-rails (>= 5.2.1)
       sassc (>= 2.0.0)
@@ -93,10 +93,13 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
-    carrierwave (1.3.2)
-      activemodel (>= 4.0.0)
-      activesupport (>= 4.0.0)
-      mime-types (>= 1.16)
+    carrierwave (2.2.2)
+      activemodel (>= 5.0.0)
+      activesupport (>= 5.0.0)
+      addressable (~> 2.6)
+      image_processing (~> 1.1)
+      marcel (~> 1.0.0)
+      mini_mime (>= 0.1.3)
       ssrf_filter (~> 1.0)
     celluloid (0.17.4)
       celluloid-essentials
@@ -140,9 +143,9 @@ GEM
       compass (~> 1.0.0)
       sass-rails (< 5.1)
       sprockets (< 4.0)
-    concurrent-ruby (1.1.8)
+    concurrent-ruby (1.1.9)
     configurate (0.5.0)
-    connection_pool (2.2.3)
+    connection_pool (2.2.5)
     crack (0.4.5)
       rexml
     crass (1.0.6)
@@ -190,7 +193,7 @@ GEM
     database_cleaner-active_record (1.8.0)
       activerecord
       database_cleaner (~> 1.8.0)
-    devise (4.7.3)
+    devise (4.8.0)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
       railties (>= 4.1.0)
@@ -220,7 +223,7 @@ GEM
       fabrication (~> 2.16)
       uuid (~> 2.3, >= 2.3.8)
     diff-lcs (1.4.4)
-    docile (1.3.5)
+    docile (1.4.0)
     domain_name (0.5.20190701)
       unf (>= 0.0.5, < 1.0.0)
     encryptor (3.0.0)
@@ -234,10 +237,10 @@ GEM
       rake
     et-orbi (1.2.4)
       tzinfo
-    ethon (0.12.0)
-      ffi (>= 1.3.0)
-    excon (0.79.0)
-    execjs (2.7.0)
+    ethon (0.14.0)
+      ffi (>= 1.15.0)
+    excon (0.82.0)
+    execjs (2.8.1)
     eye (0.10.0)
       celluloid (~> 0.17.3)
       celluloid-io (~> 0.17.0)
@@ -257,7 +260,7 @@ GEM
       http-cookie (~> 1.0.0)
     faraday_middleware (0.13.1)
       faraday (>= 0.7.4, < 1.0)
-    ffi (1.15.0)
+    ffi (1.15.3)
     ffi-compiler (1.0.1)
       ffi (>= 1.0.0)
       rake
@@ -265,12 +268,12 @@ GEM
       activerecord (>= 2)
       activesupport (>= 2)
       hashdiff
-    fog-aws (3.5.2)
+    fog-aws (3.10.0)
       fog-core (~> 2.1)
       fog-json (~> 1.1)
       fog-xml (~> 0.1)
       ipaddress (~> 0.8)
-    fog-core (2.2.3)
+    fog-core (2.2.4)
       builder
       excon (~> 0.71)
       formatador (~> 0.2)
@@ -281,8 +284,8 @@ GEM
     fog-xml (0.1.3)
       fog-core
       nokogiri (>= 1.5.11, < 2.0.0)
-    formatador (0.2.5)
-    fugit (1.4.4)
+    formatador (0.3.0)
+    fugit (1.5.0)
       et-orbi (~> 1.1, >= 1.1.8)
       raabro (~> 1.4)
     fuubar (2.5.1)
@@ -295,7 +298,7 @@ GEM
       terminal-table (~> 1.5, >= 1.5.1)
     globalid (0.4.2)
       activesupport (>= 4.2.0)
-    gon (6.3.2)
+    gon (6.4.0)
       actionpack (>= 3.0.20)
       i18n (>= 0.7)
       multi_json
@@ -303,17 +306,17 @@ GEM
     haml (5.2.1)
       temple (>= 0.8.0)
       tilt
-    haml_lint (0.37.0)
+    haml_lint (0.37.1)
       haml (>= 4.0, < 5.3)
       parallel (~> 1.10)
       rainbow
       rubocop (>= 0.50.0)
       sysexits (~> 1.1)
-    hamlit (2.14.6)
+    hamlit (2.15.0)
       temple (>= 0.8.2)
       thor
       tilt
-    handlebars_assets (0.23.8)
+    handlebars_assets (0.23.9)
       execjs (~> 2.0)
       sprockets (>= 2.0.0)
       tilt (>= 1.2)
@@ -324,7 +327,7 @@ GEM
       http-cookie (~> 1.0)
       http-form_data (~> 2.2)
       http-parser (~> 1.2.0)
-    http-cookie (1.0.3)
+    http-cookie (1.0.4)
       domain_name (~> 0.5)
     http-form_data (2.3.0)
     http-parser (1.2.3)
@@ -344,6 +347,9 @@ GEM
       i18n-inflector (~> 2.6)
       railties (>= 3.0.0)
     idn-ruby (0.1.0)
+    image_processing (1.12.1)
+      mini_magick (>= 4.9.5, < 5)
+      ruby-vips (>= 2.0.17, < 3)
     ipaddress (0.8.3)
     jasmine (3.7.0)
       jasmine-core (~> 3.7.0)
@@ -358,9 +364,8 @@ GEM
       thor (>= 0.14, < 2.0)
     jquery-ui-rails (5.0.5)
       railties (>= 3.2.16)
-    js-routes (1.4.9)
+    js-routes (1.4.14)
       railties (>= 4)
-      sprockets-rails
     js_image_paths (0.1.1)
       rails (>= 4.0, < 6.0)
       sprockets (>= 3.0.0)
@@ -376,10 +381,10 @@ GEM
       rspec
     jsonpath (1.1.0)
       multi_json
-    jwt (2.2.2)
-    kgio (2.11.3)
+    jwt (2.2.3)
+    kgio (2.11.4)
     kostya-sigar (2.0.8)
-    leaflet-rails (1.6.0)
+    leaflet-rails (1.7.0)
       rails (>= 4.2.0)
     listen (3.5.1)
       rb-fsevent (~> 0.10, >= 0.10.3)
@@ -390,7 +395,7 @@ GEM
       multi_json (~> 1.14)
     logging-rails (0.6.0)
       logging (>= 1.8)
-    loofah (2.9.1)
+    loofah (2.10.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     macaddr (1.7.2)
@@ -407,9 +412,9 @@ GEM
     mime-types (3.3.1)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2021.0225)
-    mini_magick (4.10.1)
+    mini_magick (4.11.0)
     mini_mime (1.1.0)
-    mini_portile2 (2.5.0)
+    mini_portile2 (2.5.3)
     minitest (5.14.4)
     mobile-fu (1.4.0)
       rack-mobile-detect
@@ -421,7 +426,7 @@ GEM
     mysql2 (0.5.3)
     naught (1.1.0)
     nio4r (2.5.7)
-    nokogiri (1.11.3)
+    nokogiri (1.11.7)
       mini_portile2 (~> 2.5.0)
       racc (~> 1.4)
     oauth (0.5.6)
@@ -431,7 +436,7 @@ GEM
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 3)
-    octokit (4.20.0)
+    octokit (4.21.0)
       faraday (>= 0.9)
       sawyer (~> 0.8.0, >= 0.5.3)
     omniauth (1.9.1)
@@ -454,7 +459,7 @@ GEM
     open_graph_reader (0.7.1)
       faraday (>= 0.9.0)
       nokogiri (~> 1.6)
-    openid_connect (1.1.8)
+    openid_connect (1.2.0)
       activemodel
       attr_required (>= 1.0.0)
       json-jwt (>= 1.5.0)
@@ -466,7 +471,7 @@ GEM
       webfinger (>= 1.0.1)
     orm_adapter (0.5.0)
     parallel (1.20.1)
-    parser (3.0.1.0)
+    parser (3.0.1.1)
       ast (~> 2.4.1)
     pg (1.2.3)
     phantomjs (2.1.1.0)
@@ -496,12 +501,12 @@ GEM
       middleware
       thor
       thread_safe
-    pry (0.13.1)
+    pry (0.14.1)
       coderay (~> 1.1)
       method_source (~> 1.0)
-    pry-byebug (3.9.0)
+    pry-byebug (3.8.0)
       byebug (~> 11.0)
-      pry (~> 0.13.0)
+      pry (~> 0.10)
     public_suffix (4.0.6)
     raabro (1.4.0)
     racc (1.5.2)
@@ -513,7 +518,7 @@ GEM
       activesupport
     rack-mobile-detect (0.4.0)
       rack
-    rack-oauth2 (1.16.0)
+    rack-oauth2 (1.17.0)
       activesupport
       attr_required
       httpclient
@@ -525,18 +530,18 @@ GEM
       rack
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
-    rails (5.2.5)
-      actioncable (= 5.2.5)
-      actionmailer (= 5.2.5)
-      actionpack (= 5.2.5)
-      actionview (= 5.2.5)
-      activejob (= 5.2.5)
-      activemodel (= 5.2.5)
-      activerecord (= 5.2.5)
-      activestorage (= 5.2.5)
-      activesupport (= 5.2.5)
+    rails (5.2.6)
+      actioncable (= 5.2.6)
+      actionmailer (= 5.2.6)
+      actionpack (= 5.2.6)
+      actionview (= 5.2.6)
+      activejob (= 5.2.6)
+      activemodel (= 5.2.6)
+      activerecord (= 5.2.6)
+      activestorage (= 5.2.6)
+      activesupport (= 5.2.6)
       bundler (>= 1.3.0)
-      railties (= 5.2.5)
+      railties (= 5.2.6)
       sprockets-rails (>= 2.0.0)
     rails-assets-autosize (4.0.2)
     rails-assets-backbone (1.3.3)
@@ -571,10 +576,10 @@ GEM
     rails-assets-pica (5.0.0)
     rails-assets-underscore (1.9.1)
     rails-assets-utatti-perfect-scrollbar (1.4.0)
-    rails-controller-testing (1.0.4)
-      actionpack (>= 5.0.1.x)
-      actionview (>= 5.0.1.x)
-      activesupport (>= 5.0.1.x)
+    rails-controller-testing (1.0.5)
+      actionpack (>= 5.0.1.rc1)
+      actionview (>= 5.0.1.rc1)
+      activesupport (>= 5.0.1.rc1)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
@@ -583,23 +588,23 @@ GEM
     rails-i18n (5.1.3)
       i18n (>= 0.7, < 2)
       railties (>= 5.0, < 6)
-    rails-timeago (2.18.0)
+    rails-timeago (2.19.1)
       actionpack (>= 3.1)
       activesupport (>= 3.1)
-    railties (5.2.5)
-      actionpack (= 5.2.5)
-      activesupport (= 5.2.5)
+    railties (5.2.6)
+      actionpack (= 5.2.6)
+      activesupport (= 5.2.6)
       method_source
       rake (>= 0.8.7)
       thor (>= 0.19.0, < 2.0)
     rainbow (3.0.0)
-    raindrops (0.19.1)
+    raindrops (0.19.2)
     rake (12.3.3)
     rb-fsevent (0.10.4)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
     redcarpet (3.5.1)
-    redis (4.2.5)
+    redis (4.3.1)
     regexp_parser (2.1.1)
     request_store (1.5.0)
       rack (>= 1.4)
@@ -608,10 +613,10 @@ GEM
       railties (>= 5.0)
     rexml (3.2.5)
     rotp (6.2.0)
-    rqrcode (1.1.2)
+    rqrcode (2.0.0)
       chunky_png (~> 1.0)
-      rqrcode_core (~> 0.1)
-    rqrcode_core (0.2.0)
+      rqrcode_core (~> 1.0)
+    rqrcode_core (1.0.0)
     rspec (3.10.0)
       rspec-core (~> 3.10.0)
       rspec-expectations (~> 3.10.0)
@@ -643,14 +648,16 @@ GEM
       rubocop-ast (>= 0.6.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 2.0)
-    rubocop-ast (1.4.1)
-      parser (>= 2.7.1.5)
+    rubocop-ast (1.7.0)
+      parser (>= 3.0.1.1)
     rubocop-rails (2.9.1)
       activesupport (>= 4.2.0)
       rack (>= 1.1)
       rubocop (>= 0.90.0, < 2.0)
-    ruby-oembed (0.12.0)
+    ruby-oembed (0.15.0)
     ruby-progressbar (1.11.0)
+    ruby-vips (2.1.2)
+      ffi (~> 1.12)
     rubyzip (2.3.0)
     rugged (1.0.1)
     sass (3.4.25)
@@ -686,7 +693,7 @@ GEM
       simplecov-html (~> 0.11)
       simplecov_json_formatter (~> 0.1)
     simplecov-html (0.12.3)
-    simplecov_json_formatter (0.1.2)
+    simplecov_json_formatter (0.1.3)
     sinon-rails (1.15.0)
       railties (>= 3.1)
     sprockets (3.7.2)
@@ -696,7 +703,7 @@ GEM
       babel-source (>= 5.8.11)
       babel-transpiler
       sprockets (>= 3.0.0)
-    sprockets-rails (3.2.1)
+    sprockets-rails (3.2.2)
       actionpack (>= 4.0)
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
@@ -770,11 +777,11 @@ GEM
     webfinger (1.1.0)
       activesupport
       httpclient (>= 2.4)
-    webmock (3.12.2)
+    webmock (3.13.0)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
-    websocket-driver (0.7.3)
+    websocket-driver (0.7.5)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
     will_paginate (3.3.0)
@@ -788,24 +795,24 @@ PLATFORMS
 
 DEPENDENCIES
   active_model_serializers (= 0.9.7)
-  activerecord-import (= 1.0.4)
-  acts-as-taggable-on (= 6.5.0)
+  activerecord-import (= 1.1.0)
+  acts-as-taggable-on (= 8.1.0)
   acts_as_api (= 1.0.1)
   addressable (= 2.7.0)
   apparition (= 0.6.0)
-  asset_sync (= 2.11.0)
-  autoprefixer-rails (= 10.2.4.0)
+  asset_sync (= 2.14.2)
+  autoprefixer-rails (= 10.2.5.1)
   bootstrap-sass (= 3.4.1)
   bootstrap-switch-rails (= 3.3.3)
   capybara (= 3.35.3)
-  carrierwave (= 1.3.2)
+  carrierwave (= 2.2.2)
   chrome_remote (= 0.3.0)
   compass-rails (= 3.1.0)
   configurate (= 0.5.0)
   cucumber-api-steps (= 0.14)
   cucumber-rails (= 2.3.0)
   database_cleaner-active_record (= 1.8.0)
-  devise (= 4.7.3)
+  devise (= 4.8.0)
   devise-two-factor (= 4.0.0)
   devise_lastseenable (= 0.0.6)
   diaspora_federation-json_schema (= 0.2.6)
@@ -818,39 +825,39 @@ DEPENDENCIES
   faraday-cookie_jar (= 0.0.6)
   faraday_middleware (= 0.13.1)
   fixture_builder (= 0.5.2)
-  fog-aws (= 3.5.2)
+  fog-aws (= 3.10.0)
   fuubar (= 2.5.1)
-  gon (= 6.3.2)
-  haml_lint (= 0.37.0)
-  hamlit (= 2.14.6)
-  handlebars_assets (= 0.23.8)
+  gon (= 6.4.0)
+  haml_lint (= 0.37.1)
+  hamlit (= 2.15.0)
+  handlebars_assets (= 0.23.9)
   http_accept_language (= 2.1.1)
   i18n-inflector-rails (= 1.0.7)
   jasmine (= 3.7.0)
   jasmine-jquery-rails (= 2.0.3)
   jquery-rails (= 4.4.0)
   jquery-ui-rails (= 5.0.5)
-  js-routes (= 1.4.9)
+  js-routes (= 1.4.14)
   js_image_paths (= 0.1.1)
   json (= 2.3.0)
   json-schema (= 2.8.1)
   json-schema-rspec (= 0.0.4)
-  leaflet-rails (= 1.6.0)
+  leaflet-rails (= 1.7.0)
   listen (= 3.5.1)
   logging-rails (= 0.6.0)
   markdown-it-html5-embed (= 1.0.0)
   markerb (= 1.1.0)
-  mini_magick (= 4.10.1)
+  mini_magick (= 4.11.0)
   minitest
   mobile-fu (= 1.4.0)
   mysql2 (= 0.5.3)
-  nokogiri (= 1.11.3)
+  nokogiri (= 1.11.7)
   omniauth (= 1.9.1)
   omniauth-tumblr (= 1.2)
   omniauth-twitter (= 1.4.0)
   omniauth-wordpress (= 0.2.2)
   open_graph_reader (= 0.7.1)
-  openid_connect (= 1.1.8)
+  openid_connect (= 1.2.0)
   pg (= 1.2.3)
   pronto (= 0.11.0)
   pronto-eslint (= 0.11.0)
@@ -864,7 +871,7 @@ DEPENDENCIES
   rack-piwik (= 0.3.0)
   rack-rewrite (= 1.5.1)
   rack-ssl (= 1.4.1)
-  rails (= 5.2.5)
+  rails (= 5.2.6)
   rails-assets-autosize (= 4.0.2)!
   rails-assets-backbone (= 1.3.3)!
   rails-assets-blueimp-gallery (= 2.33.0)!
@@ -887,18 +894,18 @@ DEPENDENCIES
   rails-assets-markdown-it-sup (= 1.0.0)!
   rails-assets-pica (= 5.0.0)!
   rails-assets-utatti-perfect-scrollbar (= 1.4.0)!
-  rails-controller-testing (= 1.0.4)
+  rails-controller-testing (= 1.0.5)
   rails-i18n (= 5.1.3)
-  rails-timeago (= 2.18.0)
+  rails-timeago (= 2.19.1)
   redcarpet (= 3.5.1)
-  redis (= 4.2.5)
+  redis (= 4.3.1)
   responders (= 3.0.1)
-  rqrcode (= 1.1.2)
+  rqrcode (= 2.0.0)
   rspec-json_expectations (~> 2.1)
   rspec-rails (= 5.0.1)
   rubocop (= 0.93.1)
   rubocop-rails (= 2.9.1)
-  ruby-oembed (= 0.12.0)
+  ruby-oembed (= 0.15.0)
   rubyzip (= 2.3.0)
   sass-rails (= 5.0.7)
   secure_headers (= 6.3.2)
@@ -909,7 +916,7 @@ DEPENDENCIES
   simplecov (= 0.21.2)
   sinon-rails (= 1.15.0)
   sprockets-es6 (= 0.9.2)
-  sprockets-rails (= 3.2.1)
+  sprockets-rails (= 3.2.2)
   string-direction (= 1.2.2)
   timecop (= 0.9.4)
   toml-rb (= 2.0.1)
@@ -922,7 +929,7 @@ DEPENDENCIES
   unicorn-worker-killer (= 0.4.5)
   uuid (= 2.3.9)
   versionist (= 2.0.1)
-  webmock (= 3.12.2)
+  webmock (= 3.13.0)
   will_paginate (= 3.3.0)
   yajl-ruby (= 1.4.1)
 
diff --git a/app/helpers/interim_stream_hackiness_helper.rb b/app/helpers/interim_stream_hackiness_helper.rb
index b2c7056c7..cf5f547f9 100644
--- a/app/helpers/interim_stream_hackiness_helper.rb
+++ b/app/helpers/interim_stream_hackiness_helper.rb
@@ -1,17 +1,6 @@
 # frozen_string_literal: true
 
 module InterimStreamHackinessHelper
-  def commenting_disabled?(post)
-    return true unless user_signed_in?
-    if defined?(@commenting_disabled)
-      @commenting_disabled
-    elsif defined?(@stream)
-      !@stream.can_comment?(post)
-    else
-      false
-    end
-  end
-
   ##### These methods need to go away once we pass publisher object into the partial ######
   def publisher_formatted_text
     if params[:prefill].present?
diff --git a/app/uploaders/exported_user.rb b/app/uploaders/exported_user.rb
index 53201d918..3fc0172e6 100644
--- a/app/uploaders/exported_user.rb
+++ b/app/uploaders/exported_user.rb
@@ -9,7 +9,7 @@ class ExportedUser < SecureUploader
     "uploads/users"
   end
 
-  def extension_whitelist
+  def extension_allowlist
     %w[gz]
   end
 
diff --git a/app/uploaders/processed_image.rb b/app/uploaders/processed_image.rb
index 9d614f466..79b61b9c7 100644
--- a/app/uploaders/processed_image.rb
+++ b/app/uploaders/processed_image.rb
@@ -11,7 +11,7 @@ class ProcessedImage < CarrierWave::Uploader::Base
     "uploads/images"
   end
 
-  def extension_whitelist
+  def extension_allowlist
     %w[jpg jpeg png gif]
   end
 
diff --git a/app/uploaders/unprocessed_image.rb b/app/uploaders/unprocessed_image.rb
index b662f3b40..6dad5f602 100644
--- a/app/uploaders/unprocessed_image.rb
+++ b/app/uploaders/unprocessed_image.rb
@@ -17,7 +17,7 @@ class UnprocessedImage < CarrierWave::Uploader::Base
     "uploads/images"
   end
 
-  def extension_whitelist
+  def extension_allowlist
     %w[jpg jpeg png gif]
   end
 
diff --git a/app/views/posts/show.mobile.haml b/app/views/posts/show.mobile.haml
index 61d8556e8..186105560 100644
--- a/app/views/posts/show.mobile.haml
+++ b/app/views/posts/show.mobile.haml
@@ -4,5 +4,5 @@
 
 .stream
   = render partial: "shared/stream_element",
-    locals: {post: post, commenting_disabled: commenting_disabled?(post), expanded_info: true}
+    locals: {post: post, expanded_info: true}
 
diff --git a/config/initializers/carrierwave.rb b/config/initializers/carrierwave.rb
index 3b0119590..4a212ad11 100644
--- a/config/initializers/carrierwave.rb
+++ b/config/initializers/carrierwave.rb
@@ -8,9 +8,9 @@
 ENV['SSL_CERT_FILE'] = AppConfig.environment.certificate_authorities.get
 CarrierWave.configure do |config|
   if !Rails.env.test? && AppConfig.environment.s3.enable?
-    config.fog_provider = "fog/aws"
     require "carrierwave/storage/fog"
     config.storage = :fog
+    config.cache_storage = :file
     config.cache_dir = Rails.root.join('tmp', 'uploads').to_s
     config.fog_credentials = {
         provider:              'AWS',
diff --git a/lib/stream/aspect.rb b/lib/stream/aspect.rb
index af6972775..071854bf0 100644
--- a/lib/stream/aspect.rb
+++ b/lib/stream/aspect.rb
@@ -80,15 +80,6 @@ class Stream::Aspect < Stream::Base
     @all_aspects ||= aspects.size == user.aspects.size
   end
 
-  # This is perfomance optimization, as everyone in your aspect stream you have
-  # a contact.
-  #
-  # @param post [Post]
-  # @return [Boolean]
-  def can_comment?(post)
-    true
-  end
-
   private
 
   def aspect_ids
diff --git a/lib/stream/base.rb b/lib/stream/base.rb
index 30ac2f92c..1e94b6441 100644
--- a/lib/stream/base.rb
+++ b/lib/stream/base.rb
@@ -17,12 +17,6 @@ class Stream::Base
     'change me in lib/base_stream.rb!'
   end
 
-  # @return [Boolean]
-  def can_comment?(post)
-    return true if post.author.local?
-    post_is_from_contact?(post)
-  end
-
   def post_from_group(post)
     []
   end
@@ -105,13 +99,4 @@ class Stream::Base
   def contacts_in_stream
     @contacts_in_stream ||= Contact.where(:user_id => user.id, :person_id => people.map(&:id)).load
   end
-
-  # @param post [Post]
-  # @return [Boolean]
-  def post_is_from_contact?(post)
-    @can_comment_cache ||= {}
-    @can_comment_cache[post.id] ||= contacts_in_stream.find{|contact| contact.person_id == post.author.id}.present?
-    @can_comment_cache[post.id] ||= (user.person_id == post.author_id)
-    @can_comment_cache[post.id]
-  end
 end
diff --git a/lib/stream/local_public.rb b/lib/stream/local_public.rb
index bb25f359b..ecbb02133 100644
--- a/lib/stream/local_public.rb
+++ b/lib/stream/local_public.rb
@@ -15,10 +15,6 @@ class Stream::LocalPublic < Stream::Base
     @posts ||= Post.all_local_public
   end
 
-  def can_comment?(post)
-    post.author.local?
-  end
-
   # Override base class method
   def aspects
     ["public"]
diff --git a/lib/stream/public.rb b/lib/stream/public.rb
index de6484b0e..a60fcb9d8 100644
--- a/lib/stream/public.rb
+++ b/lib/stream/public.rb
@@ -18,10 +18,6 @@ class Stream::Public < Stream::Base
     @posts ||= Post.all_public
   end
 
-  def can_comment?(post)
-    post.author.local?
-  end
-
   # Override base class method
   def aspects
     ["public"]
diff --git a/spec/controllers/jasmine_fixtures/aspects_spec.rb b/spec/controllers/jasmine_fixtures/aspects_spec.rb
index 47e5ec8ca..42d346900 100644
--- a/spec/controllers/jasmine_fixtures/aspects_spec.rb
+++ b/spec/controllers/jasmine_fixtures/aspects_spec.rb
@@ -86,19 +86,23 @@ describe StreamsController, :type => :controller do
         save_fixture(html_for("body"), "aspects_index_with_one_followed_tag")
       end
 
-      it "generates a jasmine fixture with a post containing a video", :fixture => true do
+      it "generates a jasmine fixture with a post containing a video", fixture: true do
         stub_request(
           :get,
-          "https://www.youtube.com/oembed?format=json&frame=1&iframe=1&maxheight=420&maxwidth=420&scheme=https&url=http://www.youtube.com/watch?v=UYrkQL1bX4A"
+          "https://www.youtube.com/oembed/?format=json&frame=1&iframe=1&maxheight=420&maxwidth=420&scheme=https&url=https://www.youtube.com/watch?v=UYrkQL1bX4A"
         ).with(
-          :headers => {'Accept'=>'*/*'}
+          headers: {
+            "Accept"          => "*/*",
+            "Accept-Encoding" => "gzip;q=1.0,deflate;q=0.6,identity;q=0.3",
+            "User-Agent"      => "Mozilla/5.0 (compatible; ruby-oembed/#{OEmbed::VERSION})"
+          }
         ).to_return(
-          :status  => 200,
-          :body    => '{ "title": "LazyTown song - Cooking By The Boo" }',
-          :headers => {}
+          status:  200,
+          body:    '{ "title": "LazyTown song - Cooking By The Boo" }',
+          headers: {}
         )
 
-        alice.post(:status_message, :text => "http://www.youtube.com/watch?v=UYrkQL1bX4A", :to => @alices_aspect_2.id)
+        alice.post(:status_message, text: "https://www.youtube.com/watch?v=UYrkQL1bX4A", to: @alices_aspect_2.id)
         get :aspects
         save_fixture(html_for("body"), "aspects_index_with_video_post")
       end
diff --git a/spec/helpers/interim_stream_hackiness_helper_spec.rb b/spec/helpers/interim_stream_hackiness_helper_spec.rb
index 69bb04509..4230518bf 100644
--- a/spec/helpers/interim_stream_hackiness_helper_spec.rb
+++ b/spec/helpers/interim_stream_hackiness_helper_spec.rb
@@ -1,41 +1,6 @@
 # frozen_string_literal: true
 
 describe InterimStreamHackinessHelper, type: :helper do
-  describe "commenting_disabled?" do
-    include Devise::Test::ControllerHelpers
-
-    before do
-      sign_in alice
-      def user_signed_in?
-        true
-      end
-    end
-
-    it 'returns true if no user is signed in' do
-      def user_signed_in?
-        false
-      end
-      expect(commenting_disabled?(double)).to eq(true)
-    end
-
-    it 'returns true if @commenting_disabled is set' do
-      @commenting_disabled = true
-      expect(commenting_disabled?(double)).to eq(true)
-      @commenting_disabled = false
-      expect(commenting_disabled?(double)).to eq(false)
-    end
-
-    it 'returns @stream.can_comment? if @stream is set' do
-      post = double
-      @stream = double
-      expect(@stream).to receive(:can_comment?).with(post).and_return(true)
-      expect(commenting_disabled?(post)).to eq(false)
-
-      expect(@stream).to receive(:can_comment?).with(post).and_return(false)
-      expect(commenting_disabled?(post)).to eq(true)
-    end
-  end
-
   describe "#publisher_formatted_text" do
     it "returns the prefill text from the stream" do
       @stream = double(publisher: Publisher.new(alice, prefill: "hello world"))
diff --git a/spec/lib/stream/base_spec.rb b/spec/lib/stream/base_spec.rb
index a99c48bbb..716715ef0 100644
--- a/spec/lib/stream/base_spec.rb
+++ b/spec/lib/stream/base_spec.rb
@@ -30,39 +30,6 @@ describe Stream::Base do
     end
   end
 
-  describe ".can_comment?" do
-    before do
-      @person = FactoryBot.create(:person)
-      allow(@stream).to receive(:people).and_return([bob.person, eve.person, @person])
-    end
-
-    it "allows me to comment on my local contacts post" do
-      post = FactoryBot.create(:status_message, author: bob.person)
-      expect(@stream.can_comment?(post)).to be true
-    end
-
-    it "allows me to comment on my own post" do
-      post = FactoryBot.create(:status_message, author: alice.person)
-      expect(@stream.can_comment?(post)).to be true
-    end
-
-    it "allows me to comment on any local public post" do
-      post = FactoryBot.create(:status_message, author: eve.person)
-      expect(@stream.can_comment?(post)).to be true
-    end
-
-    it "allows me to comment on a remote contacts post" do
-      Contact.create!(user: @stream.user, person: @person)
-      post = FactoryBot.create(:status_message, author: @person)
-      expect(@stream.can_comment?(post)).to be true
-    end
-
-    it "returns false if person is remote and not a contact" do
-      post = FactoryBot.create(:status_message, author: @person)
-      expect(@stream.can_comment?(post)).to be false
-    end
-  end
-
   describe "#people" do
     it "excludes blocked people" do
       expect(@stream).to receive(:stream_posts).and_return(double.as_null_object)