diff --git a/Gemfile b/Gemfile
index 06ffa43e883..69f36605578 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,6 +1,6 @@
 source "https://rubygems.org"
 
-gem "rails", "~> 7.0.0"
+gem "rails", "~> 7.1.0"
 gem "rails-i18n", "~> 7.0"
 
 gem "aws-sdk-s3", "~> 1.119"
@@ -32,7 +32,7 @@ gem "rack", "~> 2.2"
 gem "rack-utf8_sanitizer", "~> 1.8"
 gem "rbtrace", "~> 0.4.8"
 gem "rdoc", "~> 6.5"
-gem "roadie-rails", "~> 3.0"
+gem "roadie-rails", "~> 3.0", git: "https://github.com/Mange/roadie-rails.git", ref: "a13712c32f68aacf425c8dbe552abc5ddd74b4e5"
 gem "ruby-magic", "~> 0.6"
 gem "shoryuken", "~> 4.0", require: false
 gem "statsd-instrument", "~> 3.5"
@@ -63,7 +63,7 @@ gem "groupdate", "~> 6.2"
 
 # Logging
 gem "amazing_print", "~> 1.4"
-gem "rails_semantic_logger", "~> 4.11"
+gem "rails_semantic_logger", "~> 4.11", git: "https://github.com/reidmorrison/rails_semantic_logger", ref: "2473acbf10a5e3a2d53c940715b9e2215f4ec179"
 
 group :assets do
   gem "dartsass-sprockets", "~> 3.0"
@@ -108,6 +108,5 @@ group :test do
   gem "simplecov-cobertura", "~> 2.1", require: false
   gem "aggregate_assertions", "~> 0.2.0"
   gem "minitest-gcstats", "~> 1.3"
-  gem "minitest-profile", "~> 0.0.2"
   gem "minitest-reporters", "~> 1.6"
 end
diff --git a/Gemfile.lock b/Gemfile.lock
index fada5b1f8b4..f547d557b79 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,73 +1,100 @@
+GIT
+  remote: https://github.com/Mange/roadie-rails.git
+  revision: a13712c32f68aacf425c8dbe552abc5ddd74b4e5
+  ref: a13712c32f68aacf425c8dbe552abc5ddd74b4e5
+  specs:
+    roadie-rails (3.0.0)
+      railties (>= 5.1)
+      roadie (~> 5.0)
+
+GIT
+  remote: https://github.com/reidmorrison/rails_semantic_logger
+  revision: 2473acbf10a5e3a2d53c940715b9e2215f4ec179
+  ref: 2473acbf10a5e3a2d53c940715b9e2215f4ec179
+  specs:
+    rails_semantic_logger (4.12.0)
+      rack
+      railties (>= 5.1)
+      semantic_logger (~> 4.13)
+
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (7.0.8)
-      actionpack (= 7.0.8)
-      activesupport (= 7.0.8)
+    actioncable (7.1.0)
+      actionpack (= 7.1.0)
+      activesupport (= 7.1.0)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (7.0.8)
-      actionpack (= 7.0.8)
-      activejob (= 7.0.8)
-      activerecord (= 7.0.8)
-      activestorage (= 7.0.8)
-      activesupport (= 7.0.8)
+      zeitwerk (~> 2.6)
+    actionmailbox (7.1.0)
+      actionpack (= 7.1.0)
+      activejob (= 7.1.0)
+      activerecord (= 7.1.0)
+      activestorage (= 7.1.0)
+      activesupport (= 7.1.0)
       mail (>= 2.7.1)
       net-imap
       net-pop
       net-smtp
-    actionmailer (7.0.8)
-      actionpack (= 7.0.8)
-      actionview (= 7.0.8)
-      activejob (= 7.0.8)
-      activesupport (= 7.0.8)
+    actionmailer (7.1.0)
+      actionpack (= 7.1.0)
+      actionview (= 7.1.0)
+      activejob (= 7.1.0)
+      activesupport (= 7.1.0)
       mail (~> 2.5, >= 2.5.4)
       net-imap
       net-pop
       net-smtp
-      rails-dom-testing (~> 2.0)
-    actionpack (7.0.8)
-      actionview (= 7.0.8)
-      activesupport (= 7.0.8)
-      rack (~> 2.0, >= 2.2.4)
+      rails-dom-testing (~> 2.2)
+    actionpack (7.1.0)
+      actionview (= 7.1.0)
+      activesupport (= 7.1.0)
+      nokogiri (>= 1.8.5)
+      rack (>= 2.2.4)
+      rack-session (>= 1.0.1)
       rack-test (>= 0.6.3)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (7.0.8)
-      actionpack (= 7.0.8)
-      activerecord (= 7.0.8)
-      activestorage (= 7.0.8)
-      activesupport (= 7.0.8)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+    actiontext (7.1.0)
+      actionpack (= 7.1.0)
+      activerecord (= 7.1.0)
+      activestorage (= 7.1.0)
+      activesupport (= 7.1.0)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (7.0.8)
-      activesupport (= 7.0.8)
+    actionview (7.1.0)
+      activesupport (= 7.1.0)
       builder (~> 3.1)
-      erubi (~> 1.4)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.1, >= 1.2.0)
+      erubi (~> 1.11)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
     active_link_to (1.0.5)
       actionpack
       addressable
-    activejob (7.0.8)
-      activesupport (= 7.0.8)
+    activejob (7.1.0)
+      activesupport (= 7.1.0)
       globalid (>= 0.3.6)
-    activemodel (7.0.8)
-      activesupport (= 7.0.8)
-    activerecord (7.0.8)
-      activemodel (= 7.0.8)
-      activesupport (= 7.0.8)
-    activestorage (7.0.8)
-      actionpack (= 7.0.8)
-      activejob (= 7.0.8)
-      activerecord (= 7.0.8)
-      activesupport (= 7.0.8)
+    activemodel (7.1.0)
+      activesupport (= 7.1.0)
+    activerecord (7.1.0)
+      activemodel (= 7.1.0)
+      activesupport (= 7.1.0)
+      timeout (>= 0.4.0)
+    activestorage (7.1.0)
+      actionpack (= 7.1.0)
+      activejob (= 7.1.0)
+      activerecord (= 7.1.0)
+      activesupport (= 7.1.0)
       marcel (~> 1.0)
-      mini_mime (>= 1.1.0)
-    activesupport (7.0.8)
+    activesupport (7.1.0)
+      base64
+      bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
+      connection_pool (>= 2.2.5)
+      drb
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
+      mutex_m
       tzinfo (~> 2.0)
     addressable (2.8.5)
       public_suffix (>= 2.0.2, < 6.0)
@@ -118,8 +145,10 @@ GEM
       aws-sigv4 (~> 1.1)
     aws-sigv4 (1.6.0)
       aws-eventstream (~> 1, >= 1.0.2)
+    base64 (0.1.1)
     bcrypt (3.1.19)
     benchmark-ips (2.12.0)
+    bigdecimal (3.1.4)
     bindata (2.4.15)
     bitarray (1.2.0)
     bloomer (1.0.0)
@@ -155,13 +184,14 @@ GEM
     coderay (1.1.3)
     compact_index (0.14.0)
     concurrent-ruby (1.2.2)
+    connection_pool (2.4.1)
     cose (1.3.0)
       cbor (~> 0.5.9)
       openssl-signature_algorithm (~> 1.0)
     crack (0.4.5)
       rexml
     crass (1.0.6)
-    css_parser (1.11.0)
+    css_parser (1.16.0)
       addressable
     dalli (3.2.6)
     dartsass-ruby (3.0.1)
@@ -203,6 +233,8 @@ GEM
     dotenv-rails (2.8.1)
       dotenv (= 2.8.1)
       railties (>= 3.2)
+    drb (2.1.1)
+      ruby2_keywords
     dry-initializer (3.1.1)
     email_validator (2.2.3)
       activemodel
@@ -287,6 +319,10 @@ GEM
     inline_svg (1.9.0)
       activesupport (>= 3.0)
       nokogiri (>= 1.6)
+    io-console (0.6.0)
+    irb (1.8.1)
+      rdoc
+      reline (>= 0.3.8)
     jmespath (1.6.2)
     job-iteration (1.4.1)
       activejob (>= 5.2)
@@ -357,8 +393,8 @@ GEM
     marcel (1.0.2)
     matrix (0.4.2)
     memory_profiler (1.0.1)
-    meta-tags (2.18.0)
-      actionpack (>= 3.2.0, < 7.1)
+    meta-tags (2.19.0)
+      actionpack (>= 3.2.0, < 7.2)
     method_source (1.0.0)
     mini_histogram (0.3.1)
     mini_mime (1.1.5)
@@ -366,7 +402,6 @@ GEM
     minitest (5.20.0)
     minitest-gcstats (1.3.0)
       minitest (~> 5.0)
-    minitest-profile (0.0.2)
     minitest-reporters (1.6.1)
       ansi
       builder
@@ -378,14 +413,15 @@ GEM
     multi_json (1.15.0)
     multi_xml (0.6.0)
     multipart-post (2.3.0)
-    net-imap (0.3.7)
+    mutex_m (0.1.2)
+    net-imap (0.4.1)
       date
       net-protocol
     net-pop (0.1.2)
       net-protocol
     net-protocol (0.2.1)
       timeout
-    net-smtp (0.3.3)
+    net-smtp (0.4.0)
       net-protocol
     nio4r (2.5.9)
     nokogiri (1.15.4)
@@ -470,24 +506,29 @@ GEM
       rack (>= 2.1.0)
     rack-protection (3.0.5)
       rack
+    rack-session (1.0.1)
+      rack (< 3)
     rack-test (2.1.0)
       rack (>= 1.3)
     rack-utf8_sanitizer (1.9.1)
       rack (>= 1.0, < 4.0)
-    rails (7.0.8)
-      actioncable (= 7.0.8)
-      actionmailbox (= 7.0.8)
-      actionmailer (= 7.0.8)
-      actionpack (= 7.0.8)
-      actiontext (= 7.0.8)
-      actionview (= 7.0.8)
-      activejob (= 7.0.8)
-      activemodel (= 7.0.8)
-      activerecord (= 7.0.8)
-      activestorage (= 7.0.8)
-      activesupport (= 7.0.8)
+    rackup (1.0.0)
+      rack (< 3)
+      webrick
+    rails (7.1.0)
+      actioncable (= 7.1.0)
+      actionmailbox (= 7.1.0)
+      actionmailer (= 7.1.0)
+      actionpack (= 7.1.0)
+      actiontext (= 7.1.0)
+      actionview (= 7.1.0)
+      activejob (= 7.1.0)
+      activemodel (= 7.1.0)
+      activerecord (= 7.1.0)
+      activestorage (= 7.1.0)
+      activesupport (= 7.1.0)
       bundler (>= 1.15.0)
-      railties (= 7.0.8)
+      railties (= 7.1.0)
     rails-controller-testing (1.0.5)
       actionpack (>= 5.0.1.rc1)
       actionview (>= 5.0.1.rc1)
@@ -507,17 +548,14 @@ GEM
     rails-i18n (7.0.8)
       i18n (>= 0.7, < 2)
       railties (>= 6.0.0, < 8)
-    rails_semantic_logger (4.12.0)
-      rack
-      railties (>= 5.1)
-      semantic_logger (~> 4.13)
-    railties (7.0.8)
-      actionpack (= 7.0.8)
-      activesupport (= 7.0.8)
-      method_source
+    railties (7.1.0)
+      actionpack (= 7.1.0)
+      activesupport (= 7.1.0)
+      irb
+      rackup (>= 1.0.0)
       rake (>= 12.2)
-      thor (~> 1.0)
-      zeitwerk (~> 2.5)
+      thor (~> 1.0, >= 1.2.2)
+      zeitwerk (~> 2.6)
     rainbow (3.1.1)
     rake (13.0.6)
     rb-fsevent (0.11.2)
@@ -530,13 +568,12 @@ GEM
     rdoc (6.5.0)
       psych (>= 4.0.0)
     regexp_parser (2.8.1)
+    reline (0.3.9)
+      io-console (~> 0.5)
     rexml (3.2.6)
-    roadie (5.0.0)
+    roadie (5.2.0)
       css_parser (~> 1.4)
-      nokogiri (~> 1.8)
-    roadie-rails (3.0.0)
-      railties (>= 5.1, < 7.1)
-      roadie (~> 5.0)
+      nokogiri (~> 1.15)
     rotp (6.3.0)
     rqrcode (2.2.0)
       chunky_png (~> 1.0)
@@ -589,7 +626,7 @@ GEM
       rubyzip (>= 1.2.2, < 3.0)
       websocket (~> 1.0)
     semantic (1.6.1)
-    semantic_logger (4.13.0)
+    semantic_logger (4.14.0)
       concurrent-ruby (~> 1.0)
     shoryuken (4.0.3)
       aws-sdk-core (>= 2)
@@ -680,6 +717,7 @@ GEM
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
+    webrick (1.8.1)
     websocket (1.2.10)
     websocket-driver (0.7.6)
       websocket-extensions (>= 0.1.0)
@@ -736,7 +774,6 @@ DEPENDENCIES
   memory_profiler (~> 1.0)
   minitest (~> 5.18)
   minitest-gcstats (~> 1.3)
-  minitest-profile (~> 0.0.2)
   minitest-reporters (~> 1.6)
   mocha (~> 2.0)
   octokit (~> 6.1)
@@ -754,14 +791,14 @@ DEPENDENCIES
   rack-attack (~> 6.6)
   rack-test (~> 2.1)
   rack-utf8_sanitizer (~> 1.8)
-  rails (~> 7.0.0)
+  rails (~> 7.1.0)
   rails-controller-testing (~> 1.0)
   rails-erd (~> 1.7)
   rails-i18n (~> 7.0)
-  rails_semantic_logger (~> 4.11)
+  rails_semantic_logger (~> 4.11)!
   rbtrace (~> 0.4.8)
   rdoc (~> 6.5)
-  roadie-rails (~> 3.0)
+  roadie-rails (~> 3.0)!
   rotp (~> 6.2)
   rqrcode (~> 2.1)
   rubocop (~> 1.48)
diff --git a/app/jobs/application_job.rb b/app/jobs/application_job.rb
index dbc38ffe735..49707c8946a 100644
--- a/app/jobs/application_job.rb
+++ b/app/jobs/application_job.rb
@@ -11,7 +11,7 @@ class ApplicationJob < ActiveJob::Base
 
   # Default to retrying errors a few times, so we don't get an alert for
   # spurious errors
-  retry_on StandardError, wait: :exponentially_longer, attempts: 5
+  retry_on StandardError, wait: :polynomially_longer, attempts: 5
 
   # Automatically retry jobs that encountered a deadlock
   retry_on ActiveRecord::Deadlocked
diff --git a/app/jobs/store_version_contents_job.rb b/app/jobs/store_version_contents_job.rb
index ff968ce2b91..f86e84b723a 100644
--- a/app/jobs/store_version_contents_job.rb
+++ b/app/jobs/store_version_contents_job.rb
@@ -9,8 +9,8 @@ class GemNotFound < RuntimeError; end
   discard_on ActiveJob::DeserializationError
   discard_on Gem::Package::FormatError, Gem::Security::Exception
 
-  retry_on VersionNotIndexed, wait: :exponentially_longer, attempts: 5
-  retry_on GemNotFound, wait: :exponentially_longer, attempts: 5
+  retry_on VersionNotIndexed, wait: :polynomially_longer, attempts: 5
+  retry_on GemNotFound, wait: :polynomially_longer, attempts: 5
 
   rescue_from(GemNotFound, Gem::Package::FormatError, Gem::Security::Exception) do |error|
     version = version_arg.full_name
diff --git a/app/jobs/yank_version_contents_job.rb b/app/jobs/yank_version_contents_job.rb
index ec5e5ba09be..c7e5372dc8a 100644
--- a/app/jobs/yank_version_contents_job.rb
+++ b/app/jobs/yank_version_contents_job.rb
@@ -7,7 +7,7 @@ class VersionNotYanked < RuntimeError; end
 
   discard_on ActiveJob::DeserializationError
 
-  retry_on VersionNotYanked, wait: :exponentially_longer, attempts: 5
+  retry_on VersionNotYanked, wait: :polynomially_longer, attempts: 5
 
   def version_arg
     arguments.first[:version]
diff --git a/app/models/audit.rb b/app/models/audit.rb
index 4784d308c9b..f806bcf94bc 100644
--- a/app/models/audit.rb
+++ b/app/models/audit.rb
@@ -2,7 +2,7 @@ class Audit < ApplicationRecord
   belongs_to :auditable, polymorphic: true
   belongs_to :admin_github_user, class_name: "Admin::GitHubUser"
 
-  serialize :audited_changes, JSON
+  serialize :audited_changes, coder: JSON
 
   validates :action, presence: true
   validates :auditable, presence: false
diff --git a/app/models/version.rb b/app/models/version.rb
index 0ceb040aa19..e74ff0fbe2b 100644
--- a/app/models/version.rb
+++ b/app/models/version.rb
@@ -25,7 +25,7 @@ class Version < ApplicationRecord # rubocop:disable Metrics/ClassLength
 
   serialize :licenses
   serialize :requirements
-  serialize :cert_chain, CertificateChainSerializer
+  serialize :cert_chain, coder: CertificateChainSerializer
 
   validates :number, length: { maximum: Gemcutter::MAX_FIELD_LENGTH }, format: { with: Patterns::VERSION_PATTERN }
   validates :platform, length: { maximum: Gemcutter::MAX_FIELD_LENGTH }, format: { with: Rubygem::NAME_PATTERN }
diff --git a/bin/setup b/bin/setup
index 53b4538415d..027dd2344b0 100755
--- a/bin/setup
+++ b/bin/setup
@@ -5,7 +5,7 @@ require "fileutils"
 APP_ROOT = File.expand_path("..", __dir__)
 
 def system!(*args)
-  system(*args) || abort("\n== Command #{args} failed ==")
+  system(*args, exception: true)
 end
 
 FileUtils.chdir APP_ROOT do
diff --git a/config/application.rb b/config/application.rb
index d5b82eef852..e38b27f5760 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -2,7 +2,7 @@
 
 require "rails"
 # Pick the frameworks you want:
-# require "active_model/railtie"
+require "active_model/railtie"
 require "active_job/railtie"
 require "active_record/railtie"
 # require "active_storage/engine"
@@ -14,6 +14,7 @@
 # require "action_cable/engine"
 require "sprockets/railtie"
 require "rails/test_unit/railtie"
+
 # Require the gems listed in Gemfile, including any gems
 # you've limited to :test, :development, or :production.
 Bundler.require(*Rails.groups)
@@ -23,6 +24,11 @@ class Application < Rails::Application
     # Initialize configuration defaults for originally generated Rails version.
     config.load_defaults 6.1
 
+    # Please, add to the `ignore` list any other `lib` subdirectories that do
+    # not contain `.rb` files, or that should not be reloaded or eager loaded.
+    # Common ones are `templates`, `generators`, or `middleware`, for example.
+    config.autoload_lib(ignore: %w[assets tasks cops shoryuken])
+
     # Settings in config/environments/* take precedence over those specified here.
     # Application configuration can go into files in config/initializers
     # -- all .rb files in that directory are automatically loaded after loading
@@ -51,7 +57,6 @@ class Application < Rails::Application
       RubygemFs.s3! ENV["S3_PROXY"] if ENV["S3_PROXY"]
     end
 
-    config.eager_load_paths << Rails.root.join("lib")
     config.toxic_domains_filepath = Rails.root.join("vendor", "toxic_domains_whole.txt")
 
     config.active_job.queue_adapter = :good_job
diff --git a/config/environments/development.rb b/config/environments/development.rb
index f8dfb707135..612f62b9c2c 100644
--- a/config/environments/development.rb
+++ b/config/environments/development.rb
@@ -7,7 +7,7 @@
   # In the development environment your application's code is reloaded any time
   # it changes. This slows down response time but is perfect for development
   # since you don't have to restart the web server when you make code changes.
-  config.cache_classes = false
+  config.enable_reloading = true
 
   # Do not eager load code on boot.
   config.eager_load = false
@@ -61,6 +61,9 @@
   # Highlight code that triggered database queries in logs.
   config.active_record.verbose_query_logs = true
 
+  # Highlight code that enqueued background job in logs.
+  config.active_job.verbose_enqueue_logs = true
+
   # Debug mode disables concatenation and preprocessing of assets.
   # This option may cause significant delays in view rendering with a large
   # number of complex assets.
@@ -76,6 +79,9 @@
   # Annotate rendered view with file names.
   # config.action_view.annotate_rendered_view_with_filenames = true
 
+  # Raise error when a before_action's only/except options reference missing actions
+  config.action_controller.raise_on_missing_callback_actions = true
+
   # Use an evented file watcher to asynchronously detect changes in source code,
   # routes, locales, etc. This feature depends on the listen gem.
   config.file_watcher = ActiveSupport::EventedFileUpdateChecker
@@ -123,7 +129,4 @@
     config.active_record.verbose_query_logs = false
     config.action_view.cache_template_loading = true
   end
-
-  # Uncomment if you wish to allow Action Cable access from any origin.
-  # config.action_cable.disable_request_forgery_protection = true
 end
diff --git a/config/environments/production.rb b/config/environments/production.rb
index c3af35cbad5..80b38130b49 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -6,7 +6,7 @@
   # Settings specified here will take precedence over those in config/application.rb.
 
   # Code is not reloaded between requests.
-  config.cache_classes = true
+  config.enable_reloading = false
 
   # Eager load code on boot. This eager loads most of Rails and
   # your application in memory, allowing both threaded web servers
@@ -18,8 +18,8 @@
   config.consider_all_requests_local       = false
   config.action_controller.perform_caching = true
 
-  # Ensures that a master key has been made available in either ENV["RAILS_MASTER_KEY"]
-  # or in config/master.key. This key is used to decrypt credentials (and other encrypted files).
+  # Ensures that a master key has been made available in ENV["RAILS_MASTER_KEY"], config/master.key, or an environment
+  # key such as config/credentials/production.key. This key is used to decrypt credentials (and other encrypted files).
   # config.require_master_key = true
 
   # Disable serving static files from the `/public` folder by default since
@@ -46,6 +46,10 @@
   # config.action_dispatch.x_sendfile_header = "X-Sendfile" # for Apache
   # config.action_dispatch.x_sendfile_header = "X-Accel-Redirect" # for NGINX
 
+  # Assume all access to the app is happening through a SSL-terminating reverse proxy.
+  # Can be used together with config.force_ssl for Strict-Transport-Security and secure cookies.
+  # config.assume_ssl = true
+
   # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
   config.force_ssl = true
   config.ssl_options = {
@@ -100,6 +104,14 @@
   # Do not dump schema after migrations.
   config.active_record.dump_schema_after_migration = false
 
+  # Enable DNS rebinding protection and other `Host` header attacks.
+  # config.hosts = [
+  #   "example.com",     # Allow requests from example.com
+  #   /.*\.example\.com/ # Allow requests from subdomains like `www.example.com`
+  # ]
+  # Skip DNS rebinding protection for the default health check endpoint.
+  # config.host_authorization = { exclude: ->(request) { request.path == "/up" } }
+
   config.cache_store = :mem_cache_store, ENV['MEMCACHED_ENDPOINT'], {
     failover: true,
     socket_timeout: 1.5,
diff --git a/config/environments/test.rb b/config/environments/test.rb
index a795e0e13af..73358c44122 100644
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -9,25 +9,28 @@
 Rails.application.configure do
   # Settings specified here will take precedence over those in config/application.rb.
 
-  config.cache_classes = true
+  # While tests run files are not watched, reloading is not necessary.
+  config.enable_reloading = false
 
-  # Do not eager load code on boot. This avoids loading your whole application
-  # just for the purpose of running a single test. If you are using a tool that
-  # preloads Rails for running tests, you may have to set it to true.
-  config.eager_load = false
+  # Eager loading loads your entire application. When running a single test locally,
+  # this is usually not necessary, and can slow down your test suite. However, it's
+  # recommended that you enable it in continuous integration systems to ensure eager
+  # loading is working properly before deploying your code.
+  config.eager_load = ENV["CI"].present?
 
   # Configure public file server for tests with Cache-Control for performance.
   config.public_file_server.enabled = true
   config.public_file_server.headers = {
-    'Cache-Control' => "public, max-age=#{1.hour.to_i}"
+    "Cache-Control" => "public, max-age=#{1.hour.to_i}"
   }
 
   # Show full error reports and disable caching.
   config.consider_all_requests_local       = true
   config.action_controller.perform_caching = false
+  config.cache_store = :mem_cache_store
 
   # Raise exceptions instead of rendering exception templates.
-  config.action_dispatch.show_exceptions = false
+  config.action_dispatch.show_exceptions = :none
 
   # Disable request forgery protection in test environment.
   config.action_controller.allow_forgery_protection = false
@@ -55,7 +58,6 @@
   # Tell Active Support which deprecation messages to disallow.
   config.active_support.disallowed_deprecation_warnings = []
 
-  config.cache_store = :mem_cache_store
   # Raises error for missing translations.
   config.i18n.raise_on_missing_translations = true
 
@@ -63,6 +65,9 @@
   # Annotate rendered view with file names.
   # config.action_view.annotate_rendered_view_with_filenames = true
 
+  # Raise error when a before_action's only/except options reference missing actions
+  config.action_controller.raise_on_missing_callback_actions = true
+
   BCrypt::Engine.cost = BCrypt::Engine::MIN_COST
 
   if ENV["CI"] && !ENV["RAILS_ENABLE_TEST_LOG"]
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index 7192151be9e..6537637532e 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -44,9 +44,9 @@
   }
 end
 
-# Generate session nonces for permitted importmap and inline scripts
+# Generate session nonces for permitted importmap, inline scripts, and inline styles.
 Rails.application.config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
-Rails.application.config.content_security_policy_nonce_directives = %w[script-src]
+Rails.application.config.content_security_policy_nonce_directives = %w[script-src style-src]
 
 # Report CSP violations to a specified URI. See:
 # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only
diff --git a/config/initializers/filter_parameter_logging.rb b/config/initializers/filter_parameter_logging.rb
index bd215540566..d997f9aa485 100644
--- a/config/initializers/filter_parameter_logging.rb
+++ b/config/initializers/filter_parameter_logging.rb
@@ -1,6 +1,8 @@
 # Be sure to restart your server when you modify this file.
 
-# Configure sensitive parameters which will be filtered from the log file.
+# Configure parameters to be partially matched (e.g. passw matches password) and filtered from the log file.
+# Use this to limit dissemination of sensitive information.
+# See the ActiveSupport::ParameterFilter documentation for supported notations and behaviors.
 Rails.application.config.filter_parameters += %I[
   password passw secret token _key crypt salt certificate otp ssn api_key recovery_codes seed
   jwt
diff --git a/config/initializers/launchdarkly.rb b/config/initializers/launchdarkly.rb
index c8931d06abf..033c3079911 100644
--- a/config/initializers/launchdarkly.rb
+++ b/config/initializers/launchdarkly.rb
@@ -1,3 +1,4 @@
+# DEPRECATION WARNING: `Rails.application.secrets` is deprecated in favor of `Rails.application.credentials` and will be removed in Rails 7.2. (called from block in <top (required)> at /Users/segiddins/Development/github.com/rubygems/rubygems.org/config/initializers/launchdarkly.rb:4)
 Rails.application.configure do
   ld_config = LaunchDarkly::Config.new(
     logger: SemanticLogger[LaunchDarkly],
diff --git a/config/initializers/permissions_policy.rb b/config/initializers/permissions_policy.rb
index 00f64d71b03..7db3b9577e6 100644
--- a/config/initializers/permissions_policy.rb
+++ b/config/initializers/permissions_policy.rb
@@ -1,11 +1,13 @@
+# Be sure to restart your server when you modify this file.
+
 # Define an application-wide HTTP permissions policy. For further
-# information see https://developers.google.com/web/updates/2018/06/feature-policy
-#
-# Rails.application.config.permissions_policy do |f|
-#   f.camera      :none
-#   f.gyroscope   :none
-#   f.microphone  :none
-#   f.usb         :none
-#   f.fullscreen  :self
-#   f.payment     :self, "https://secure.example.com"
+# information see: https://developers.google.com/web/updates/2018/06/feature-policy
+
+# Rails.application.config.permissions_policy do |policy|
+#   policy.camera      :none
+#   policy.gyroscope   :none
+#   policy.microphone  :none
+#   policy.usb         :none
+#   policy.fullscreen  :self
+#   policy.payment     :self, "https://secure.example.com"
 # end
diff --git a/config/initializers/semantic_logger.rb b/config/initializers/semantic_logger.rb
index 44ddc2ab5c4..af5861d7f11 100644
--- a/config/initializers/semantic_logger.rb
+++ b/config/initializers/semantic_logger.rb
@@ -1,5 +1,23 @@
 SemanticLogger.application = "rubygems.org"
 
+module SemanticLoggerFix
+  def silenced?(event)
+    case logger
+    when nil
+      true
+    when SemanticLogger::Logger
+      logger.send(:level_index) - 1 > @event_levels.fetch(event, Float::INFINITY)
+    when ActiveSupport::BroadcastLogger
+      level = logger.broadcasts.map { |b| b.send(:level_index) }.min - 1
+      level > @event_levels.fetch(event, Float::INFINITY)
+    else
+      super
+    end
+  end
+end
+
+ActiveSupport::LogSubscriber.prepend(SemanticLoggerFix)
+
 ActiveSupport.on_load(:action_controller) do
   def append_info_to_payload(payload)
     payload.merge!(
diff --git a/test/integration/session_test.rb b/test/integration/session_test.rb
index 13e425639e4..e9cf8f161ff 100644
--- a/test/integration/session_test.rb
+++ b/test/integration/session_test.rb
@@ -3,6 +3,8 @@
 class SessionTest < ActionDispatch::IntegrationTest
   def retrive_authenticity_token(path)
     get path
+
+    assert_response :success
     request.session[:_csrf_token]
   end
 
@@ -10,7 +12,7 @@ def retrive_authenticity_token(path)
     create(:user, handle: "johndoe", password: PasswordHelpers::SECURE_TEST_PASSWORD)
     @last_session_token = retrive_authenticity_token sign_in_path
     post session_path(session: { who: "johndoe", password: PasswordHelpers::SECURE_TEST_PASSWORD })
-    ActionController::Base.allow_forgery_protection = true # default is false
+    ActionController::Base.allow_forgery_protection = true # default is false in test env
   end
 
   teardown do
@@ -31,12 +33,18 @@ def retrive_authenticity_token(path)
     @last_session_token = retrive_authenticity_token edit_profile_path
     delete sign_out_path(authenticity_token: request.session[:_csrf_token])
 
+    assert_response :redirect
+    assert_redirected_to sign_in_path
+
     create(:user, handle: "bob", password: PasswordHelpers::SECURE_TEST_PASSWORD)
     post session_path(
       session: { who: "bob", password: PasswordHelpers::SECURE_TEST_PASSWORD },
       authenticity_token: request.session[:_csrf_token]
     )
 
+    assert_response :redirect
+    assert_redirected_to dashboard_path
+
     patch "/profile", params: { user: { handle: "alice" }, authenticity_token: @last_session_token }
 
     assert_response :forbidden