diff --git a/.gitignore b/.gitignore
index 75a1bdc6..ce3e7f0f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,3 +38,5 @@ pickle-email-*.html
 .env.local
 docker-compose.env
 docker-compose.yml
+.DS_Store
+.byebug_history
diff --git a/Gemfile b/Gemfile
index 7f25aa46..22dc5f6e 100644
--- a/Gemfile
+++ b/Gemfile
@@ -200,6 +200,11 @@ gem 'sprockets-rails'
 # for multiple speakers select on proposal/event forms
 gem 'selectize-rails'
 
+# Nokogiri < 1.8.1 is subject to:
+# CVE-2017-0663, CVE-2017-7375, CVE-2017-7376, CVE-2017-9047, CVE-2017-9048,
+# CVE-2017-9049, CVE-2017-9050
+gem 'nokogiri', '>= 1.8.1'
+
 # Use guard and spring for testing in development
 group :development do
   # to launch specs when files are modified
diff --git a/Gemfile.lock b/Gemfile.lock
index c6b4faa8..dc730e82 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -270,7 +270,7 @@ GEM
       open4 (~> 1.3.4)
       rake
     mini_magick (4.5.1)
-    mini_portile2 (2.2.0)
+    mini_portile2 (2.3.0)
     minitest (5.10.2)
     momentjs-rails (2.8.1)
       railties (>= 3.1)
@@ -290,8 +290,8 @@ GEM
     mysql2 (0.4.9)
     nenv (0.3.0)
     netrc (0.11.0)
-    nokogiri (1.8.0)
-      mini_portile2 (~> 2.2.0)
+    nokogiri (1.8.1)
+      mini_portile2 (~> 2.3.0)
     notiffany (0.1.1)
       nenv (~> 0.1)
       shellany (~> 0.0)
@@ -609,6 +609,7 @@ DEPENDENCIES
   mini_magick
   money-rails
   mysql2
+  nokogiri (>= 1.8.1)
   omniauth
   omniauth-facebook
   omniauth-github
@@ -662,4 +663,4 @@ DEPENDENCIES
   whenever
 
 BUNDLED WITH
-   1.15.1
+   1.15.4
diff --git a/spec/features/sponsor_spec.rb b/spec/features/sponsor_spec.rb
index c6b5009e..b12ee90d 100644
--- a/spec/features/sponsor_spec.rb
+++ b/spec/features/sponsor_spec.rb
@@ -36,7 +36,14 @@ feature Sponsor do
       end
 
       # Remove sponsor
-      click_link 'Delete'
+      visit admin_conference_sponsors_path(
+        conference_id: conference.short_title
+      )
+      within('table#sponsors') do
+        page.accept_confirm do
+          click_link 'Delete'
+        end
+      end
       expect(flash).to eq('Sponsor successfully deleted.')
       expect(page).to_not have_selector('table#sponsors')
     end