diff --git a/Gemfile b/Gemfile
index 43b091ed2..c23bdbcc2 100644
--- a/Gemfile
+++ b/Gemfile
@@ -3,7 +3,7 @@ source 'https://rubygems.org'
 ruby '2.4.2'
 gem 'rails', '~> 4.2', '>= 4.2.7.1'
 gem 'pg', '0.20' # locked to 0.20 due to https://github.com/rails/rails/issues/29521
-gem 'devise', '~> 3.5', '>= 3.5.10'
+gem 'devise', '~> 4.7'
 gem 'devise_invitable', '~> 1.6', '>= 1.6.1'
 gem 'heroku-api'
 gem 'sprockets', '~> 2.11', '>= 2.11.3'
diff --git a/Gemfile.lock b/Gemfile.lock
index ec3f708d6..89f6a441b 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -58,14 +58,14 @@ GEM
       thor (~> 0.19)
     ast (2.3.0)
     backports (3.10.3)
-    bcrypt (3.1.11)
+    bcrypt (3.1.16)
     binding_of_caller (0.7.3)
       debug_inspector (>= 0.0.1)
     bootstrap-datepicker-rails (1.7.1.1)
       railties (>= 3.0)
     bootstrap_sortable_rails (0.1.3)
     breadcrumbs_on_rails (3.0.1)
-    builder (3.2.3)
+    builder (3.2.4)
     byebug (9.1.0)
     capybara (2.4.1)
       mime-types (>= 1.16)
@@ -99,7 +99,7 @@ GEM
       tins (~> 1.6)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
-    crass (1.0.3)
+    crass (1.0.6)
     cucumber (3.1.0)
       builder (>= 2.1.2)
       cucumber-core (~> 3.1.0)
@@ -126,12 +126,11 @@ GEM
     cucumber-wire (0.0.1)
     database_cleaner (1.0.1)
     debug_inspector (0.0.3)
-    devise (3.5.10)
+    devise (4.7.1)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
-      railties (>= 3.2.6, < 5)
+      railties (>= 4.1.0)
       responders
-      thread_safe (~> 0.1)
       warden (~> 1.2.3)
     devise_invitable (1.6.1)
       actionmailer (>= 3.2.6)
@@ -185,7 +184,7 @@ GEM
     http_parser.rb (0.6.0)
     httparty (0.15.6)
       multi_xml (>= 0.5.2)
-    i18n (0.9.1)
+    i18n (0.9.5)
       concurrent-ruby (~> 1.0)
     jar_wrapper (0.1.8)
       zip
@@ -217,7 +216,7 @@ GEM
     letter_opener (1.4.1)
       launchy (~> 2.2)
     libv8 (3.16.14.19)
-    loofah (2.1.1)
+    loofah (2.8.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     mail (2.7.0)
@@ -229,7 +228,7 @@ GEM
     mime-types-data (3.2016.0521)
     mini_mime (1.0.0)
     mini_portile2 (2.1.0)
-    minitest (5.10.3)
+    minitest (5.14.2)
     momentjs-rails (2.17.1)
       railties (>= 3.1)
     multi_json (1.12.2)
@@ -262,7 +261,7 @@ GEM
       multi_json
     quiet_assets (1.1.0)
       railties (>= 3.1, < 5.0)
-    rack (1.6.8)
+    rack (1.6.13)
     rack-protection (1.5.3)
       rack
     rack-test (0.6.3)
@@ -284,12 +283,12 @@ GEM
       sprockets-rails
     rails-deprecated_sanitizer (1.0.3)
       activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.8)
-      activesupport (>= 4.2.0.beta, < 5.0)
+    rails-dom-testing (1.0.9)
+      activesupport (>= 4.2.0, < 5.0)
       nokogiri (~> 1.6)
       rails-deprecated_sanitizer (>= 1.0.1)
-    rails-html-sanitizer (1.0.3)
-      loofah (~> 2.0)
+    rails-html-sanitizer (1.3.0)
+      loofah (~> 2.3)
     rails_12factor (0.0.3)
       rails_serve_static_assets
       rails_stdout_logging
@@ -305,12 +304,12 @@ GEM
     rainbow (2.2.2)
       rake
     raindrops (0.19.0)
-    rake (12.3.0)
+    rake (13.0.3)
     redcarpet (3.4.0)
     ref (2.0.0)
-    responders (2.4.0)
-      actionpack (>= 4.2.0, < 5.3)
-      railties (>= 4.2.0, < 5.3)
+    responders (2.4.1)
+      actionpack (>= 4.2.0, < 6.0)
+      railties (>= 4.2.0, < 6.0)
     rspec-activemodel-mocks (1.0.3)
       activemodel (>= 3.0)
       activesupport (>= 3.0)
@@ -395,7 +394,7 @@ GEM
       execjs (~> 2.2)
       rails (~> 4.1)
       railties (~> 4.1)
-    tzinfo (1.2.4)
+    tzinfo (1.2.9)
       thread_safe (~> 0.1)
     uglifier (3.2.0)
       execjs (>= 0.3.0, < 3)
@@ -438,7 +437,7 @@ DEPENDENCIES
   cucumber-rails
   cucumber-rails-training-wheels
   database_cleaner (= 1.0.1)
-  devise (~> 3.5, >= 3.5.10)
+  devise (~> 4.7)
   devise_invitable (~> 1.6, >= 1.6.1)
   dotenv-rails
   execjs