diff --git a/Gemfile b/Gemfile
index 863cad6f8c..c98c583e6b 100644
--- a/Gemfile
+++ b/Gemfile
@@ -118,7 +118,7 @@ gem 'unicorn'
 # Gems we don't depend directly on, but specify here to make sure we don't use a vulnerable
 # version. Please add a link to a security advisory when adding a Gem here.
 
-gem 'i18n', '>=0.6.8'
+gem 'i18n', '~> 0.6.8'
 # see https://groups.google.com/forum/#!topic/ruby-security-ann/pLrh6DUw998
 
 gem 'nokogiri', '>=1.5.11'
@@ -130,7 +130,7 @@ group :test do
   gem 'object-daddy', '~> 1.1.0'
   gem "launchy", "~> 2.3.0"
   gem "factory_girl_rails", "~> 4.0"
-  gem 'cucumber-rails', :require => false
+  gem 'cucumber-rails', "~> 1.4.2", :require => false
   gem 'rack_session_access'
   # restrict because in version 1.3 a lot of tests using acts as journalized
   # fail stating: "Column 'user_id' cannot be null". I don't understand the
diff --git a/Gemfile.lock b/Gemfile.lock
index 04ccdcd071..e7f6af8447 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -132,17 +132,18 @@ GEM
       descendants_tracker (~> 0.0.1)
     color-tools (1.3.0)
     columnize (0.8.9)
-    cucumber (1.3.8)
+    cucumber (1.3.18)
       builder (>= 2.1.2)
       diff-lcs (>= 1.1.3)
-      gherkin (~> 2.12.1)
+      gherkin (~> 2.12)
       multi_json (>= 1.7.5, < 2.0)
-      multi_test (>= 0.0.2)
-    cucumber-rails (1.3.1)
-      capybara (>= 1.1.2)
-      cucumber (>= 1.2.0)
-      nokogiri (>= 1.5.0)
-      rails (~> 3.0)
+      multi_test (>= 0.1.1)
+    cucumber-rails (1.4.2)
+      capybara (>= 1.1.2, < 3)
+      cucumber (>= 1.3.8, < 2)
+      mime-types (>= 1.16, < 3)
+      nokogiri (~> 1.5)
+      rails (>= 3, < 5)
     cucumber-rails-training-wheels (1.0.0)
       cucumber-rails (>= 1.1.1)
     daemons (1.1.9)
@@ -207,7 +208,7 @@ GEM
     interception (0.3)
     iso8601 (0.8.2)
     journey (1.0.4)
-    json (1.8.1)
+    json (1.8.2)
     json_spec (1.1.1)
       multi_json (~> 1.0)
       rspec (~> 2.0)
@@ -229,17 +230,17 @@ GEM
     metaclass (0.0.1)
     method_source (0.8.2)
     mime-types (1.25.1)
-    mini_portile (0.6.0)
+    mini_portile (0.6.2)
     minisyntax (0.2.3)
     mocha (0.13.3)
       metaclass (~> 0.0.1)
     multi_json (1.10.1)
-    multi_test (0.0.2)
+    multi_test (0.1.1)
     multi_xml (0.5.5)
     mysql2 (0.3.17)
     net-ldap (0.8.0)
-    nokogiri (1.6.2.1)
-      mini_portile (= 0.6.0)
+    nokogiri (1.6.6.2)
+      mini_portile (~> 0.6.0)
     non-stupid-digest-assets (1.0.4)
     object-daddy (1.1.1)
     oj (2.1.6)
@@ -310,7 +311,7 @@ GEM
       rdoc (~> 3.4)
       thor (>= 0.14.6, < 2.0)
     raindrops (0.13.0)
-    rake (10.3.2)
+    rake (10.4.2)
     rb-readline (0.5.1)
     rdoc (3.12.2)
       json (~> 1.4)
@@ -394,7 +395,7 @@ GEM
     treetop (1.4.15)
       polyglot
       polyglot (>= 0.3.1)
-    tzinfo (0.3.42)
+    tzinfo (0.3.43)
     uber (0.0.10)
     uglifier (2.1.1)
       execjs (>= 0.3.0)
@@ -431,7 +432,7 @@ DEPENDENCIES
   codeclimate-test-reporter
   coderay (~> 1.0.5)
   color-tools (~> 1.3.0)
-  cucumber-rails
+  cucumber-rails (~> 1.4.2)
   cucumber-rails-training-wheels
   daemons
   dalli
@@ -445,7 +446,7 @@ DEPENDENCIES
   grape (~> 0.7.0)
   gravatar_image_tag (~> 1.2.0)
   htmldiff
-  i18n (>= 0.6.8)
+  i18n (~> 0.6.8)
   i18n-js (~> 3.0.0.rc6)
   jruby-openssl
   json_spec