Merge pull request #5800 from chef/tduffield/un-f-the-world

Numerious minor tweaks to unblock the build

16 files changed, 144 insertions, 128 deletions

diff --git a/Gemfile b/Gemfile
index c09d8fca35..b3fa6b01a3 100644
--- a/Gemfile
+++ b/Gemfile
@@ -12,10 +12,9 @@ source "https://rubygems.org"
 gem "chef", path: "."
 
 gem "chef-config", path: File.expand_path("../chef-config", __FILE__) if File.exist?(File.expand_path("../chef-config", __FILE__))
-# Ensure that we can always install rake, regardless of gem groups
-gem "rake", group: [ :default, :omnibus_package, :development ]
+gem "rake"
 gem "bundler"
-gem "cheffish"
+gem "cheffish" # required for rspec tests
 
 group(:omnibus_package) do
   gem "appbundler"
@@ -29,6 +28,7 @@ group(:omnibus_package, :pry) do
   gem "pry-remote"
   gem "pry-stack_explorer"
 end
+
 # These are used for external tests
 group(:integration) do
   gem "chef-provisioning"
@@ -63,6 +63,7 @@ group(:linux, :bsd, :mac_os_x, :solaris, :windows) do
   # may need to disable this in insolation on fussy builds like AIX, RHEL4, etc
   gem "ruby-prof"
 end
+
 # Everything except AIX and Windows
 group(:linux, :bsd, :mac_os_x, :solaris) do
   gem "ruby-shadow", platforms: :ruby
@@ -77,7 +78,7 @@ group(:development, :test) do
 end
 
 group(:changelog) do
-  gem "github_changelog_generator", git: "https://github.com/tduffield/github-changelog-generator", branch: "adjust-tag-section-mapping"
+  gem "github_changelog_generator", git: "https://github.com/chef/github-changelog-generator"
   gem "mixlib-install"
 end
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 13e06ff82e..a7d067732e 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,6 +1,6 @@
 GIT
   remote: https://github.com/chef/chef-server
-  revision: e5b2c917b7d06d4e09e27bdb09e4e1ad7648e437
+  revision: 53b28425d56005a92b0e3bb153f95b505168354a
   specs:
     oc-chef-pedant (2.2.0)
       activesupport (>= 4.2.7.1, < 6.0)
@@ -16,24 +16,15 @@ GIT
 
 GIT
   remote: https://github.com/chef/chefstyle.git
-  revision: ba0cfca677c8dc66de471cbd3da37d000a93dce0
+  revision: 7e47afd6141d3c44a11322916e3fc85c89aa9b59
   branch: master
   specs:
-    chefstyle (0.4.0)
-      rubocop (= 0.45.0)
+    chefstyle (0.5.0)
+      rubocop (= 0.47.1)
 
 GIT
-  remote: https://github.com/rubysec/bundler-audit.git
-  revision: 6eb5a81e9b184fbb8db03f3e57dc758c65dd7383
-  specs:
-    bundler-audit (0.5.0)
-      bundler (~> 1.2)
-      thor (~> 0.18)
-
-GIT
-  remote: https://github.com/tduffield/github-changelog-generator
-  revision: c6245b58b91b863464ca88e02aa752a0658b5f30
-  branch: adjust-tag-section-mapping
+  remote: https://github.com/chef/github-changelog-generator
+  revision: 7ab4953b47598dccf10e106058673c1592b8f9bf
   specs:
     github_changelog_generator (1.14.2)
       activesupport
@@ -44,6 +35,14 @@ GIT
       rake (>= 10.0)
       retriable (>= 1.4)
 
+GIT
+  remote: https://github.com/rubysec/bundler-audit.git
+  revision: 6eb5a81e9b184fbb8db03f3e57dc758c65dd7383
+  specs:
+    bundler-audit (0.5.0)
+      bundler (~> 1.2)
+      thor (~> 0.18)
+
 PATH
   remote: .
   specs:
@@ -139,13 +138,13 @@ GEM
       mixlib-cli (~> 1.4)
     artifactory (2.6.0)
     ast (2.3.0)
-    aws-sdk (2.7.3)
-      aws-sdk-resources (= 2.7.3)
-    aws-sdk-core (2.7.3)
+    aws-sdk (2.7.5)
+      aws-sdk-resources (= 2.7.5)
+    aws-sdk-core (2.7.5)
       aws-sigv4 (~> 1.0)
       jmespath (~> 1.0)
-    aws-sdk-resources (2.7.3)
-      aws-sdk-core (= 2.7.3)
+    aws-sdk-resources (2.7.5)
+      aws-sdk-core (= 2.7.5)
     aws-sigv4 (1.0.0)
     backports (3.6.8)
     binding_of_caller (0.7.2)
@@ -170,7 +169,7 @@ GEM
       mixlib-log (~> 1.3)
       rack (~> 2.0)
       uuidtools (~> 2.1)
-    cheffish (4.1.0)
+    cheffish (4.1.1)
       chef-zero (~> 5.0)
       net-ssh
     chefspec (5.3.0)
@@ -204,7 +203,7 @@ GEM
     erubis (2.7.0)
     ethon (0.10.1)
       ffi (>= 1.3.0)
-    excon (0.54.0)
+    excon (0.55.0)
     faraday (0.11.0)
       multipart-post (>= 1.2, < 3)
     faraday-http-cache (2.0.0)
@@ -344,7 +343,7 @@ GEM
       plist (~> 3.1)
       systemu (~> 2.6.4)
       wmi-lite (~> 1.0)
-    parser (2.3.3.1)
+    parser (2.4.0.0)
       ast (~> 2.2)
     plist (3.2.0)
     poise (2.7.2)
@@ -401,7 +400,7 @@ GEM
     rack (2.0.1)
     rainbow (2.2.1)
     rake (11.3.0)
-    rb-readline (0.5.3)
+    rb-readline (0.5.4)
     rest-client (2.0.0)
       http-cookie (>= 1.0.2, < 2.0)
       mime-types (>= 1.16, < 4.0)
@@ -434,8 +433,8 @@ GEM
     rspec_junit_formatter (0.2.3)
       builder (< 4)
       rspec-core (>= 2, < 4, != 2.12.0)
-    rubocop (0.45.0)
-      parser (>= 2.3.1.1, < 3.0)
+    rubocop (0.47.1)
+      parser (>= 2.3.3.1, < 3.0)
       powerpack (~> 0.1)
       rainbow (>= 1.99.1, < 3.0)
       ruby-progressbar (~> 1.7)
@@ -444,7 +443,7 @@ GEM
     ruby-progressbar (1.8.1)
     ruby-shadow (2.5.0)
     rubyntlm (0.6.1)
-    rubyzip (1.2.0)
+    rubyzip (1.2.1)
     rufus-lru (1.1.0)
     safe_yaml (1.0.4)
     sawyer (0.8.1)
@@ -462,7 +461,7 @@ GEM
       simplecov-html (~> 0.10.0)
     simplecov-html (0.10.0)
     slop (3.6.0)
-    specinfra (2.66.8)
+    specinfra (2.66.9)
       net-scp
       net-ssh (>= 2.7, < 5.0)
       net-telnet
@@ -591,4 +590,4 @@ DEPENDENCIES
   yard
 
 BUNDLED WITH
-   1.13.7
+   1.12.5
diff --git a/acceptance/Gemfile b/acceptance/Gemfile
index 77b45e733d..41a18c9914 100644
--- a/acceptance/Gemfile
+++ b/acceptance/Gemfile
@@ -1,21 +1,16 @@
 source "https://rubygems.org"
 
+gem "rake" # required to build some native extensions
 gem "chef-acceptance", github: "chef/chef-acceptance"
 gem "kitchen-ec2"
 gem "inspec"
-# Pinning to github for kitchen-vagrant because 0.19.0 incorrectly
-# puts in a box_url for bento when a vagrant box in atlas is specified
 gem "kitchen-vagrant"
 gem "windows_chef_zero"
 gem "kitchen-inspec"
 gem "test-kitchen"
 gem "winrm-elevated"
-gem "berkshelf", "4.3.5"
+gem "berkshelf"
 
-# until 2.0.0 is fixed for unstable packages
+# Pin to 1.2.3 because current mixlib-install has a problem where unstable
+# packages are not always immediately available via the omnitruck API.
 gem "mixlib-install", "1.2.3"
-
-# nio4r 2.x was throwing a "could not install" error because of a Ruby version
-# conflict (that didn't actually exist). Since the only gem that really needs
-# it is celluloid, let's just pin it until it becomes a bigger problem.
-gem "nio4r", ">= 1.1.0", "< 2.0.0"
diff --git a/acceptance/Gemfile.lock b/acceptance/Gemfile.lock
index e33389f135..8dfb2ec217 100644
--- a/acceptance/Gemfile.lock
+++ b/acceptance/Gemfile.lock
@@ -12,44 +12,42 @@ GEM
     addressable (2.5.0)
       public_suffix (~> 2.0, >= 2.0.2)
     artifactory (2.6.0)
-    aws-sdk (2.7.3)
-      aws-sdk-resources (= 2.7.3)
-    aws-sdk-core (2.7.3)
+    aws-sdk (2.7.5)
+      aws-sdk-resources (= 2.7.5)
+    aws-sdk-core (2.7.5)
       aws-sigv4 (~> 1.0)
       jmespath (~> 1.0)
-    aws-sdk-resources (2.7.3)
-      aws-sdk-core (= 2.7.3)
+    aws-sdk-resources (2.7.5)
+      aws-sdk-core (= 2.7.5)
     aws-sigv4 (1.0.0)
-    berkshelf (4.3.5)
+    berkshelf (5.6.2)
       addressable (~> 2.3, >= 2.3.4)
-      berkshelf-api-client (~> 2.0, >= 2.0.2)
-      buff-config (~> 1.0)
-      buff-extensions (~> 1.0)
-      buff-shell_out (~> 0.1)
-      celluloid (= 0.16.0)
-      celluloid-io (~> 0.16.1)
+      berkshelf-api-client (>= 2.0.2, < 4.0)
+      buff-config (~> 2.0)
+      buff-extensions (~> 2.0)
+      buff-shell_out (~> 1.0)
       cleanroom (~> 1.0)
       faraday (~> 0.9)
       httpclient (~> 2.7)
       minitar (~> 0.5, >= 0.5.4)
-      mixlib-archive (~> 0.1)
+      mixlib-archive (~> 0.4)
       octokit (~> 4.0)
       retryable (~> 2.0)
-      ridley (~> 4.5)
-      solve (~> 2.0)
-      thor (~> 0.19)
-    berkshelf-api-client (2.0.2)
-      faraday (~> 0.9.1)
-      httpclient (~> 2.7.0)
-      ridley (~> 4.5)
-    buff-config (1.0.1)
-      buff-extensions (~> 1.0)
-      varia_model (~> 0.4)
-    buff-extensions (1.0.0)
-    buff-ignore (1.1.1)
-    buff-ruby_engine (0.1.0)
-    buff-shell_out (0.2.0)
-      buff-ruby_engine (~> 0.1.0)
+      ridley (~> 5.0)
+      solve (> 2.0, < 4.0)
+      thor (~> 0.19, < 0.19.2)
+    berkshelf-api-client (3.0.0)
+      faraday (~> 0.9)
+      httpclient (~> 2.7)
+      ridley (>= 4.5, < 6.0)
+    buff-config (2.0.0)
+      buff-extensions (~> 2.0)
+      varia_model (~> 0.6)
+    buff-extensions (2.0.0)
+    buff-ignore (1.2.0)
+    buff-ruby_engine (1.0.0)
+    buff-shell_out (1.1.0)
+      buff-ruby_engine (~> 1.0)
     builder (3.2.3)
     celluloid (0.16.0)
       timers (~> 4.0.0)
@@ -68,7 +66,7 @@ GEM
       excon (>= 0.38.0)
       json
     erubis (2.7.0)
-    excon (0.54.0)
+    excon (0.55.0)
     faraday (0.9.2)
       multipart-post (>= 1.2, < 3)
     ffi (1.9.17)
@@ -79,8 +77,8 @@ GEM
       builder (>= 2.1.2)
     hashie (3.5.1)
     hitimes (1.2.4)
-    httpclient (2.7.2)
-    inspec (1.12.0)
+    httpclient (2.8.3)
+    inspec (1.14.1)
       faraday (>= 0.9.0)
       hashie (~> 3.4)
       json (>= 1.8, < 3.0)
@@ -115,7 +113,7 @@ GEM
       little-plugger (~> 1.1)
       multi_json (~> 1.10)
     method_source (0.8.2)
-    minitar (0.5.4)
+    minitar (0.6.1)
     mixlib-archive (0.4.1)
       mixlib-log
     mixlib-authentication (1.4.1)
@@ -128,7 +126,7 @@ GEM
     mixlib-log (1.7.1)
     mixlib-shellout (2.2.7)
     mixlib-versioning (1.1.0)
-    molinillo (0.4.5)
+    molinillo (0.5.6)
     multi_json (1.12.1)
     multipart-post (2.0.0)
     net-scp (1.2.1)
@@ -136,7 +134,7 @@ GEM
     net-ssh (4.0.1)
     net-ssh-gateway (1.3.0)
       net-ssh (>= 2.6.5)
-    nio4r (1.2.1)
+    nio4r (2.0.0)
     nori (2.6.0)
     octokit (4.6.2)
       sawyer (~> 0.8.0, >= 0.5.3)
@@ -147,13 +145,14 @@ GEM
       slop (~> 3.4)
     public_suffix (2.0.5)
     rainbow (2.2.1)
+    rake (12.0.0)
     retryable (2.0.4)
-    ridley (4.6.1)
+    ridley (5.1.0)
       addressable
-      buff-config (~> 1.0)
-      buff-extensions (~> 1.0)
-      buff-ignore (~> 1.1.1)
-      buff-shell_out (~> 0.1)
+      buff-config (~> 2.0)
+      buff-extensions (~> 2.0)
+      buff-ignore (~> 1.2)
+      buff-shell_out (~> 1.0)
       celluloid (~> 0.16.0)
       celluloid-io (~> 0.16.1)
       chef-config (>= 12.5.0)
@@ -164,8 +163,8 @@ GEM
       json (>= 1.7.7)
       mixlib-authentication (>= 1.3.0)
       retryable (~> 2.0)
-      semverse (~> 1.1)
-      varia_model (~> 0.4.0)
+      semverse (~> 2.0)
+      varia_model (~> 0.6)
     rspec (3.5.0)
       rspec-core (~> 3.5.0)
       rspec-expectations (~> 3.5.0)
@@ -186,16 +185,16 @@ GEM
       builder (< 4)
       rspec-core (>= 2, < 4, != 2.12.0)
     rubyntlm (0.6.1)
-    rubyzip (1.2.0)
+    rubyzip (1.2.1)
     safe_yaml (1.0.4)
     sawyer (0.8.1)
       addressable (>= 2.3.5, < 2.6)
       faraday (~> 0.8, < 1.0)
-    semverse (1.2.1)
+    semverse (2.0.0)
     slop (3.6.0)
-    solve (2.0.3)
-      molinillo (~> 0.4.2)
-      semverse (~> 1.1)
+    solve (3.1.0)
+      molinillo (>= 0.5)
+      semverse (>= 1.1, < 3.0)
     sslshake (1.0.13)
     test-kitchen (1.15.0)
       mixlib-install (>= 1.2, < 3.0)
@@ -205,7 +204,7 @@ GEM
       net-ssh-gateway (~> 1.2)
       safe_yaml (~> 1.0)
       thor (~> 0.18)
-    thor (0.19.4)
+    thor (0.19.1)
     timers (4.0.4)
       hitimes
     train (0.22.1)
@@ -216,8 +215,8 @@ GEM
       net-ssh (>= 2.9, < 5.0)
       winrm (~> 2.0)
       winrm-fs (~> 1.0)
-    varia_model (0.4.1)
-      buff-extensions (~> 1.0)
+    varia_model (0.6.0)
+      buff-extensions (~> 2.0)
       hashie (>= 2.0.2, < 4.0.0)
     windows_chef_zero (2.0.0)
       test-kitchen (>= 1.2.1)
@@ -243,14 +242,14 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
-  berkshelf (= 4.3.5)
+  berkshelf
   chef-acceptance!
   inspec
   kitchen-ec2
   kitchen-inspec
   kitchen-vagrant
   mixlib-install (= 1.2.3)
-  nio4r (>= 1.1.0, < 2.0.0)
+  rake
   test-kitchen
   windows_chef_zero
   winrm-elevated
diff --git a/chef-universal-mingw32.gemspec b/chef-universal-mingw32.gemspec
index a4f086cfaf..449f909bb2 100644
--- a/chef-universal-mingw32.gemspec
+++ b/chef-universal-mingw32.gemspec
@@ -6,9 +6,8 @@ gemspec.add_dependency "ffi", "~> 1.9"
 gemspec.add_dependency "win32-api", "~> 1.5.3"
 gemspec.add_dependency "win32-dir", "~> 0.5.0"
 gemspec.add_dependency "win32-event", "~> 0.6.1"
-# Hard pin on win32-eventlog until djberg96/win32-eventlog#20 is resolved.
-# win32-eventlog was stomping over the CreateEvent FFI bindings that
-# win32-service needed, causing the chef service to not run.
+# TODO: Relax this pin and make the necessary updaets. The issue originally
+# leading to this pin has been fixed in 0.6.5.
 gemspec.add_dependency "win32-eventlog", "0.6.3"
 gemspec.add_dependency "win32-mmap", "~> 0.4.1"
 gemspec.add_dependency "win32-mutex", "~> 0.4.2"
diff --git a/ci/bundle_install.sh b/ci/bundle_install.sh
index 7f90f74964..973fcd48cc 100755
--- a/ci/bundle_install.sh
+++ b/ci/bundle_install.sh
@@ -5,5 +5,5 @@ set -evx
 gem environment
 bundler_version=$(grep bundler omnibus_overrides.rb | cut -d'"' -f2)
 gem install bundler -v $bundler_version --user-install --conservative
-export BUNDLE_WITHOUT=default:omnibus_package:test:pry:integration:docgen:maintenance:travis:aix:bsd:linux:mac_os_x:solaris:windows
+export BUNDLE_WITHOUT=omnibus_package:test:pry:integration:docgen:maintenance:travis:aix:bsd:linux:mac_os_x:solaris:windows:development:changelog:travis
 bundle _${bundler_version}_ install
diff --git a/ci/dependency_update.sh b/ci/dependency_update.sh
index 9588652143..65b67be526 100755
--- a/ci/dependency_update.sh
+++ b/ci/dependency_update.sh
@@ -4,6 +4,6 @@ set -evx
 
 . ci/bundle_install.sh
 
-bundle exec rake dependencies
+bundle exec rake dependencies_ci
 
 git checkout .bundle/config
diff --git a/kitchen-tests/Gemfile b/kitchen-tests/Gemfile
index 4432394008..707a38a7f6 100644
--- a/kitchen-tests/Gemfile
+++ b/kitchen-tests/Gemfile
@@ -1,5 +1,6 @@
 source "https://rubygems.org"
 
+gem "rake" # required to build some native extensions
 gem "berkshelf"
 gem "kitchen-appbundle-updater"
 gem "kitchen-dokken", "< 2.0" # 2.x fails atm: https://travis-ci.org/chef/chef/jobs/199125787
@@ -9,4 +10,3 @@ gem "kitchen-vagrant"
 gem "ridley"
 gem "test-kitchen"
 gem "vagrant-wrapper"
-gem "rainbow", ">= 2.1.0", "< 2.2"
diff --git a/kitchen-tests/Gemfile.lock b/kitchen-tests/Gemfile.lock
index 2274469443..b9d14397f1 100644
--- a/kitchen-tests/Gemfile.lock
+++ b/kitchen-tests/Gemfile.lock
@@ -4,13 +4,13 @@ GEM
     addressable (2.5.0)
       public_suffix (~> 2.0, >= 2.0.2)
     artifactory (2.6.0)
-    aws-sdk (2.7.3)
-      aws-sdk-resources (= 2.7.3)
-    aws-sdk-core (2.7.3)
+    aws-sdk (2.7.5)
+      aws-sdk-resources (= 2.7.5)
+    aws-sdk-core (2.7.5)
       aws-sigv4 (~> 1.0)
       jmespath (~> 1.0)
-    aws-sdk-resources (2.7.3)
-      aws-sdk-core (= 2.7.3)
+    aws-sdk-resources (2.7.5)
+      aws-sdk-core (= 2.7.5)
     aws-sigv4 (1.0.0)
     berkshelf (5.6.2)
       addressable (~> 2.3, >= 2.3.4)
@@ -58,7 +58,7 @@ GEM
       excon (>= 0.38.0)
       json
     erubis (2.7.0)
-    excon (0.54.0)
+    excon (0.55.0)
     faraday (0.9.2)
       multipart-post (>= 1.2, < 3)
     ffi (1.9.17)
@@ -72,7 +72,7 @@ GEM
     hitimes (1.2.4)
     hitimes (1.2.4-x86-mingw32)
     httpclient (2.8.3)
-    inspec (1.12.0)
+    inspec (1.14.1)
       faraday (>= 0.9.0)
       hashie (~> 3.4)
       json (>= 1.8, < 3.0)
@@ -111,7 +111,7 @@ GEM
       little-plugger (~> 1.1)
       multi_json (~> 1.10)
     method_source (0.8.2)
-    minitar (0.5.4)
+    minitar (0.6.1)
     mixlib-archive (0.4.1)
       mixlib-log
     mixlib-authentication (1.4.1)
@@ -128,7 +128,7 @@ GEM
       win32-process (~> 0.8.2)
       wmi-lite (~> 1.0)
     mixlib-versioning (1.1.0)
-    molinillo (0.5.5)
+    molinillo (0.5.6)
     multi_json (1.12.1)
     multipart-post (2.0.0)
     net-scp (1.2.1)
@@ -146,7 +146,8 @@ GEM
       method_source (~> 0.8.1)
       slop (~> 3.4)
     public_suffix (2.0.5)
-    rainbow (2.1.0)
+    rainbow (2.2.1)
+    rake (12.0.0)
     retryable (2.0.4)
     ridley (5.1.0)
       addressable
@@ -186,7 +187,7 @@ GEM
       builder (< 4)
       rspec-core (>= 2, < 4, != 2.12.0)
     rubyntlm (0.6.1)
-    rubyzip (1.2.0)
+    rubyzip (1.2.1)
     safe_yaml (1.0.4)
     sawyer (0.8.1)
       addressable (>= 2.3.5, < 2.6)
@@ -249,7 +250,7 @@ DEPENDENCIES
   kitchen-ec2
   kitchen-inspec
   kitchen-vagrant
-  rainbow (>= 2.1.0, < 2.2)
+  rake
   ridley
   test-kitchen
   vagrant-wrapper
diff --git a/kitchen-tests/cookbooks/audit_test/Berksfile b/kitchen-tests/cookbooks/audit_test/Berksfile
index 0ac9b78cf7..967b9a78b6 100644
--- a/kitchen-tests/cookbooks/audit_test/Berksfile
+++ b/kitchen-tests/cookbooks/audit_test/Berksfile
@@ -1,3 +1,3 @@
-source "https://supermarket.getchef.com"
+source "https://supermarket.chef.io"
 
 metadata
diff --git a/kitchen-tests/cookbooks/webapp/Berksfile b/kitchen-tests/cookbooks/webapp/Berksfile
index 4b6079016e..ba11c46c1d 100644
--- a/kitchen-tests/cookbooks/webapp/Berksfile
+++ b/kitchen-tests/cookbooks/webapp/Berksfile
@@ -1,4 +1,4 @@
-source "https://api.berkshelf.com"
+source "https://supermarket.chef.io"
 
 metadata
 
diff --git a/omnibus/Gemfile.lock b/omnibus/Gemfile.lock
index d52a70b5de..ceb322bf20 100644
--- a/omnibus/Gemfile.lock
+++ b/omnibus/Gemfile.lock
@@ -1,6 +1,6 @@
 GIT
   remote: git://github.com/chef/license_scout.git
-  revision: ae7f2412751dcb411d2bb60abe2086d8ae7ae86f
+  revision: f90293a9753652fb64994a14de4108e503c06632
   specs:
     license_scout (0.1.2)
       ffi-yajl (~> 2.2)
@@ -39,13 +39,13 @@ GEM
       public_suffix (~> 2.0, >= 2.0.2)
     artifactory (2.6.0)
     awesome_print (1.7.0)
-    aws-sdk (2.7.3)
-      aws-sdk-resources (= 2.7.3)
-    aws-sdk-core (2.7.3)
+    aws-sdk (2.7.5)
+      aws-sdk-resources (= 2.7.5)
+    aws-sdk-core (2.7.5)
       aws-sigv4 (~> 1.0)
       jmespath (~> 1.0)
-    aws-sdk-resources (2.7.3)
-      aws-sdk-core (= 2.7.3)
+    aws-sdk-resources (2.7.5)
+      aws-sdk-core (= 2.7.5)
     aws-sigv4 (1.0.0)
     berkshelf (4.3.5)
       addressable (~> 2.3, >= 2.3.4)
@@ -123,7 +123,7 @@ GEM
       little-plugger (~> 1.1)
       multi_json (~> 1.10)
     method_source (0.8.2)
-    minitar (0.5.4)
+    minitar (0.6.1)
     mixlib-archive (0.4.1)
       mixlib-log
     mixlib-authentication (1.4.1)
@@ -205,7 +205,7 @@ GEM
       varia_model (~> 0.4.0)
     ruby-progressbar (1.8.1)
     rubyntlm (0.6.1)
-    rubyzip (1.2.0)
+    rubyzip (1.2.1)
     safe_yaml (1.0.4)
     sawyer (0.8.1)
       addressable (>= 2.3.5, < 2.6)
diff --git a/omnibus_overrides.rb b/omnibus_overrides.rb
index 69af8dbd44..69a5a7af05 100644
--- a/omnibus_overrides.rb
+++ b/omnibus_overrides.rb
@@ -1,7 +1,6 @@
 # DO NOT EDIT. Generated by "rake dependencies". Edit version_policy.rb instead.
 override :rubygems, version: "2.6.10"
 override :bundler, version: "1.12.5"
-override :rainbow, version: "2.1.0"
 override "libffi", version: "3.2.1"
 override "libiconv", version: "1.14"
 override "liblzma", version: "5.2.2"
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 2456d3d890..50ad2a3fb6 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -152,7 +152,10 @@ RSpec.configure do |config|
   config.filter_run_excluding :windows_powershell_no_dsc_only => true unless ! windows_powershell_dsc?
   config.filter_run_excluding :windows_domain_joined_only => true unless windows_domain_joined?
   config.filter_run_excluding :windows_not_domain_joined_only => true if windows_domain_joined?
-  config.filter_run_excluding :windows_service_requires_assign_token => true if !STDOUT.isatty && !windows_user_right?("SeAssignPrimaryTokenPrivilege")
+  # We think this line was causing rspec tests to not run on the Jenkins windows
+  # testers. If we ever fix it we should restore it.
+  # config.filter_run_excluding :windows_service_requires_assign_token => true if !STDOUT.isatty && !windows_user_right?("SeAssignPrimaryTokenPrivilege")
+  config.filter_run_excluding :windows_service_requires_assign_token => true
   config.filter_run_excluding :solaris_only => true unless solaris?
   config.filter_run_excluding :system_windows_service_gem_only => true unless system_windows_service_gem?
   config.filter_run_excluding :unix_only => true unless unix?
diff --git a/tasks/dependencies.rb b/tasks/dependencies.rb
index 0b216f8e52..b37c351d12 100644
--- a/tasks/dependencies.rb
+++ b/tasks/dependencies.rb
@@ -21,9 +21,23 @@ require_relative "../version_policy"
 
 desc "Tasks to update and check dependencies"
 namespace :dependencies do
-  # Update all dependencies to the latest constraint-matching version
+
+  # Running update_ci on your local system wont' work. The best way to update
+  # dependencies locally is by running the dependency update script.
   desc "Update all dependencies. dependencies:update to update as little as possible."
-  task :update => %w{
+  task :update do |t, rake_args|
+    system("#{File.join(Dir.pwd, "ci", "dependency_update.sh")}")
+  end
+
+  desc "Force update (when adding new gems to Gemfiles)"
+  task :force_update do |t, rake_args|
+    FileUtils.rm_f(File.join(Dir.pwd, ".bundle", "config"))
+    system("#{File.join(Dir.pwd, "ci", "dependency_update.sh")}")
+  end
+
+  # Update all dependencies to the latest constraint-matching version
+  desc "Update all dependencies. dependencies:update to update as little as possible (CI-only)."
+  task :update_ci => %w{
                     dependencies:update_gemfile_lock
                     dependencies:update_omnibus_overrides
                     dependencies:update_omnibus_gemfile_lock
@@ -130,6 +144,8 @@ namespace :dependencies do
     end
   end
 end
+
 desc "Update all dependencies and check for outdated gems."
-task :dependencies => [ "dependencies:update", "bundle:outdated" ]
-task :update => [ "dependencies:update", "bundle:outdated"]
+task :dependencies_ci => [ "dependencies:update_ci", "bundle:outdated" ]
+task :dependencies => [ "dependencies:update" ]
+task :update => [ "dependencies:update" ]
diff --git a/version_policy.rb b/version_policy.rb
index a16e7ad500..85c29a760b 100644
--- a/version_policy.rb
+++ b/version_policy.rb
@@ -21,7 +21,6 @@ OMNIBUS_OVERRIDES = {
   ## according to comment in omnibus-sw, latest versions don't work on solaris
   # https://github.com/chef/omnibus-software/blob/aefb7e79d29ca746c3f843673ef5e317fa3cba54/config/software/libtool.rb#L23
   :bundler => "1.12.5", # until we figure out how to work with 1.13.0
-  :rainbow => "2.1.0", # Currently pinned until rubygems is updated
   "libffi" => "3.2.1",
   "libiconv" => "1.14",
   "liblzma" => "5.2.2",
@@ -82,6 +81,11 @@ ACCEPTABLE_OUTDATED_GEMS = [
   "slop",       # expected to disappear with pry 0.11
   "typhoeus",   # Until the travis gem updates to 1.0.
   "cucumber-core", # Until cucumber 2.0
+  "addressable",   # gh (via travis) wants this ~> 2.4.0
+  "rake", # poise limits this to < 12
+  "github_changelog_generator", # we manage this independent of the rubygem
+  "cheffish", # 5.0.0 breaks chef-provisioning
+  "net-ssh-gateway", # chef-provisiong and test-kitchen have ~> 1.2 constraint
 ]
 
 #