diff --git a/Gemfile b/Gemfile
index 35b9ee91db3d8b..30edc2cd445f9c 100644
--- a/Gemfile
+++ b/Gemfile
@@ -4,18 +4,18 @@ source 'https://rubygems.org'
 ruby '>= 3.0.0'
 
 gem 'puma', '~> 6.3'
-gem 'rails', '~> 7.1.1'
-gem 'propshaft'
+gem 'rails', '~> 7.1.3', '>= 7.1.3.3'
+gem 'propshaft', '>= 0.9.0'
 gem 'thor', '~> 1.2'
-gem 'rack', '~> 2.2.7'
+gem 'rack', '~> 2.2.20'
 
 # For why irb is in the Gemfile, see: https://ruby.social/@st0012/111444685161478182
 gem 'irb', '~> 1.8'
 
-gem 'haml-rails', '~>2.0'
+gem 'haml-rails', '~> 3.0', '>= 3.0.0'
 gem 'pg', '~> 1.5'
 gem 'pghero'
-gem 'dotenv-rails', '~> 2.8'
+gem 'dotenv-rails', '~> 3.0', '>= 3.0.0'
 
 gem 'aws-sdk-s3', '~> 1.123', require: false
 gem 'fog-core', '<= 2.4.0'
@@ -24,14 +24,14 @@ gem 'kt-paperclip', '~> 7.2'
 gem 'md-paperclip-azure', '~> 2.2', require: false
 gem 'blurhash', '~> 0.1'
 
-gem 'active_model_serializers', '~> 0.10'
+gem 'active_model_serializers', '~> 0.10', '>= 0.10.15'
 gem 'addressable', '~> 2.8'
 gem 'bootsnap', '~> 1.18.0', require: false
 gem 'browser'
 gem 'charlock_holmes', '~> 0.7.7'
 gem 'chewy', '~> 7.3'
-gem 'devise', '~> 4.9'
-gem 'devise-two-factor', '~> 4.1'
+gem 'devise', '~> 4.9', '>= 4.9.4'
+gem 'devise-two-factor', '~> 5.0', '>= 5.0.0'
 
 group :pam_authentication, optional: true do
   gem 'devise_pam_authenticatable2', '~> 9.2'
@@ -39,16 +39,16 @@ end
 
 gem 'net-ldap', '~> 0.18'
 
-gem 'omniauth-cas', '~> 3.0.0.beta.1'
-gem 'omniauth-saml', '~> 2.0'
-gem 'omniauth_openid_connect', '~> 0.6.1'
-gem 'omniauth', '~> 2.0'
-gem 'omniauth-rails_csrf_protection', '~> 1.0'
+gem 'omniauth-cas', '~> 3.0.1.0.0'
+gem 'omniauth-saml', '~> 2.1', '>= 2.1.1'
+gem 'omniauth_openid_connect', '~> 0.7.0'
+gem 'omniauth', '~> 2.1', '>= 2.1.3'
+gem 'omniauth-rails_csrf_protection', '~> 1.0', '>= 1.0.2'
 
 gem 'color_diff', '~> 0.1'
 gem 'csv', '~> 3.2'
 gem 'discard', '~> 1.2'
-gem 'doorkeeper', '~> 5.6'
+gem 'doorkeeper', '~> 5.7', '>= 5.7.0'
 gem 'ed25519', '~> 1.3'
 gem 'fast_blank', '~> 1.0'
 gem 'fastimage'
@@ -57,7 +57,7 @@ gem 'redis-namespace', '~> 1.10'
 gem 'htmlentities', '~> 4.3'
 gem 'http', '~> 5.1'
 gem 'http_accept_language', '~> 2.1'
-gem 'httplog', '~> 1.6.2'
+gem 'httplog', '~> 1.7.0'
 gem 'i18n', '1.14.1' # TODO: Remove version when resolved: https://github.com/glebm/i18n-tasks/issues/552 / https://github.com/ruby-i18n/i18n/pull/688
 gem 'idn-ruby', require: 'idn'
 gem 'inline_svg'
@@ -73,22 +73,22 @@ gem 'posix-spawn'
 gem 'public_suffix', '~> 5.0'
 gem 'pundit', '~> 2.3'
 gem 'premailer-rails'
-gem 'rack-attack', '~> 6.6'
-gem 'rack-cors', '~> 2.0', require: 'rack/cors'
-gem 'rails-i18n', '~> 7.0'
+gem 'rack-attack', '~> 6.8', '>= 6.8.0'
+gem 'rack-cors', '~> 3.0', '>= 3.0.0', require: 'rack/cors'
+gem 'rails-i18n', '~> 7.0', '>= 7.0.10'
 gem 'redcarpet', '~> 3.6'
 gem 'redis', '~> 4.5', require: ['redis', 'redis/connection/hiredis']
 gem 'mario-redis-lock', '~> 1.2', require: 'redis_lock'
 gem 'rqrcode', '~> 2.2'
 gem 'ruby-progressbar', '~> 1.13'
 gem 'sanitize', '~> 6.0'
-gem 'scenic', '~> 1.7'
-gem 'sidekiq', '~> 6.5'
-gem 'sidekiq-scheduler', '~> 5.0'
-gem 'sidekiq-unique-jobs', '~> 7.1'
+gem 'scenic', '~> 1.8', '>= 1.8.0'
+gem 'sidekiq', '~> 7.0', '>= 7.0.0'
+gem 'sidekiq-scheduler', '~> 5.0', '>= 5.0.4'
+gem 'sidekiq-unique-jobs', '~> 8.0', '>= 8.0.0'
 gem 'sidekiq-bulk', '~> 0.2.0'
 gem 'simple-navigation', '~> 4.4'
-gem 'simple_form', '~> 5.2'
+gem 'simple_form', '~> 5.3', '>= 5.3.1'
 gem 'stoplight', '~> 3.0.1'
 gem 'strong_migrations', '1.8.0'
 gem 'tty-prompt', '~> 0.23', require: false
@@ -98,8 +98,8 @@ gem 'webpacker', '~> 5.4'
 gem 'webpush', github: 'ClearlyClaire/webpush', ref: 'f14a4d52e201128b1b00245d11b6de80d6cfdcd9'
 gem 'webauthn', '~> 3.0'
 
-gem 'json-ld'
-gem 'json-ld-preloaded', '~> 3.2'
+gem 'json-ld', '>= 3.3.2'
+gem 'json-ld-preloaded', '~> 3.3', '>= 3.3.1'
 gem 'rdf-normalize', '~> 0.5'
 
 gem 'private_address_check', '~> 0.5'
@@ -115,7 +115,7 @@ group :test do
   gem 'email_spec'
 
   # Extra RSpec extension methods and helpers for sidekiq
-  gem 'rspec-sidekiq', '~> 4.0'
+  gem 'rspec-sidekiq', '~> 4.2', '>= 4.2.0'
 
   # Browser integration testing
   gem 'capybara', '~> 3.39'
@@ -134,7 +134,7 @@ group :test do
   gem 'json-schema', '~> 4.0'
 
   # Test harness fo rack components
-  gem 'rack-test', '~> 2.1'
+  gem 'rack-test', '~> 2.2', '>= 2.2.0'
 
   # Coverage formatter for RSpec test if DISABLE_SIMPLECOV is false
   gem 'simplecov', '~> 0.22', require: false
@@ -149,7 +149,7 @@ group :development do
   gem 'rubocop', require: false
   gem 'rubocop-capybara', require: false
   gem 'rubocop-performance', require: false
-  gem 'rubocop-rails', require: false
+  gem 'rubocop-rails', '>= 2.25.0', require: false
   gem 'rubocop-rspec', require: false
 
   # Annotates modules with schema
@@ -161,7 +161,7 @@ group :development do
 
   # Preview mail in the browser
   gem 'letter_opener', '~> 1.8'
-  gem 'letter_opener_web', '~> 2.0'
+  gem 'letter_opener_web', '~> 3.0', '>= 3.0.0'
 
   # Security analysis CLI tools
   gem 'brakeman', '~> 6.0', require: false
@@ -171,7 +171,7 @@ group :development do
   gem 'haml_lint', require: false
 
   # Validate missing i18n keys
-  gem 'i18n-tasks', '~> 1.0', require: false
+  gem 'i18n-tasks', '~> 1.0', '>= 1.0.14', require: false
 end
 
 group :development, :test do
@@ -191,7 +191,7 @@ group :development, :test do
   gem 'test-prof'
 
   # RSpec runner for rails
-  gem 'rspec-rails', '~> 6.0'
+  gem 'rspec-rails', '~> 6.1', '>= 6.1.3'
 end
 
 group :production do