diff --git a/Gemfile b/Gemfile
index 31310600a7..350ed39290 100644
--- a/Gemfile
+++ b/Gemfile
@@ -9,8 +9,6 @@ gem 'rails-i18n', '~> 3.0.0'
 gem 'rails_safe_tasks', '~> 1.0'
 
 gem "activerecord-import"
-# Patched version. See http://rubysec.com/advisories/CVE-2015-5312/.
-gem 'nokogiri', '>= 1.6.7.1'
 
 gem "catalog", path: "./engines/catalog"
 gem "order_management", path: "./engines/order_management"
@@ -69,7 +67,6 @@ gem 'angularjs-file-upload-rails', '~> 2.4.1'
 gem 'blockenspiel'
 gem 'custom_error_message', github: 'jeremydurham/custom-err-msg'
 gem 'dalli'
-gem 'deface', '1.0.2'
 gem 'diffy'
 gem 'figaro'
 gem 'geocoder'
@@ -124,7 +121,7 @@ group :test, :development do
   # Pretty printed test output
   gem 'atomic'
   gem 'awesome_print'
-  gem 'capybara', '>= 2.18.0' # 3.0 requires nokogiri 1.8
+  gem 'capybara', '>= 2.18.0' # 3.0 requires rack 1.6 that only works with Rails 4.2
   gem 'database_cleaner', '0.7.1', require: false
   gem "factory_bot_rails", require: false
   gem 'fuubar', '~> 2.5.0'
diff --git a/Gemfile.lock b/Gemfile.lock
index b129b0cc5e..9b94b0bd72 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -23,7 +23,7 @@ GIT
 
 GIT
   remote: https://github.com/openfoodfoundation/spree.git
-  revision: 8a8585a43cd04d1a50dc65227f337a91b18d66d5
+  revision: e10ca1f689b1658040b081939b7523f6fb68895a
   branch: 2-0-4-stable
   specs:
     spree_core (2.0.4)
@@ -32,14 +32,13 @@ GIT
       awesome_nested_set (= 2.1.5)
       aws-sdk (~> 1.11.1)
       cancan (~> 1.6.10)
-      deface (>= 0.9.1)
       ffaker (~> 1.16)
       highline (= 1.6.18)
       httparty (~> 0.11)
       json (>= 1.7.7)
       kaminari (~> 0.14.1)
       money (= 5.1.1)
-      paperclip (~> 3.0)
+      paperclip (~> 3.4.1)
       paranoia (~> 1.3)
       rails (~> 3.2.14)
       ransack (= 0.7.2)
@@ -167,7 +166,6 @@ GEM
       coffee-script-source
       execjs
     coffee-script-source (1.10.0)
-    colorize (0.8.1)
     combine_pdf (1.0.16)
       ruby-rc4 (>= 0.1.5)
     compass (1.0.3)
@@ -201,11 +199,6 @@ GEM
     ddtrace (0.34.2)
       msgpack
     debugger-linecache (1.2.0)
-    deface (1.0.2)
-      colorize (>= 0.5.8)
-      nokogiri (~> 1.6.0)
-      polyglot
-      rails (>= 3.1)
     delayed_job (4.1.8)
       activesupport (>= 3.0, < 6.1)
     delayed_job_active_record (4.1.4)
@@ -238,7 +231,7 @@ GEM
       railties (>= 3.0.0)
     faraday (1.0.0)
       multipart-post (>= 1.2, < 3)
-    ffaker (1.22.1)
+    ffaker (1.32.1)
     ffi (1.12.2)
     figaro (1.1.1)
       thor (~> 0.14)
@@ -449,7 +442,7 @@ GEM
     method_source (0.9.2)
     mime-types (1.25.1)
     mini_mime (1.0.1)
-    mini_portile2 (2.1.0)
+    mini_portile2 (2.4.0)
     mini_racer (0.2.9)
       libv8 (>= 6.9.411)
     momentjs-rails (2.20.1)
@@ -461,8 +454,8 @@ GEM
     multi_xml (0.6.0)
     multipart-post (2.1.1)
     newrelic_rpm (3.18.1.330)
-    nokogiri (1.6.8.1)
-      mini_portile2 (~> 2.1.0)
+    nokogiri (1.10.9)
+      mini_portile2 (~> 2.4.0)
     oauth2 (1.4.4)
       faraday (>= 0.8, < 2.0)
       jwt (>= 1.0, < 3.0)
@@ -713,7 +706,6 @@ DEPENDENCIES
   db2fog
   ddtrace
   debugger-linecache
-  deface (= 1.0.2)
   delayed_job_active_record
   delayed_job_web
   devise (~> 2.2.5)
@@ -743,7 +735,6 @@ DEPENDENCIES
   mini_racer (= 0.2.9)
   momentjs-rails
   newrelic_rpm (~> 3.0)
-  nokogiri (>= 1.6.7.1)
   oauth2 (~> 1.4.4)
   ofn-qz!
   oj