diff --git a/Jenkinsfile b/Jenkinsfile
index a3e573e3f2c..3abf6cc4b22 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -121,7 +121,7 @@ pipeline {
 
         stage('Analytics') {
             steps {
-                sh './gradlew --console=plain check -x test'
+                sh './gradlew --console=plain check -x test -x pmdMain -x pmdTest -x pmdJmh' // TODO: Probably more cleanly remove PMD overall if no use?
             }
             post {
                 always {
@@ -140,8 +140,7 @@ pipeline {
 
                     recordIssues(skipBlames: true, enabledForFailure: true,
                         tools: [
-                            spotBugs(pattern: '**/build/reports/spotbugs/*.xml', useRankAsPriority: true),
-                            pmdParser(pattern: '**/build/reports/pmd/*.xml')
+                            spotBugs(pattern: '**/build/reports/spotbugs/*.xml', useRankAsPriority: true)
                         ])
 
                     recordIssues(skipBlames: true, enabledForFailure: true,
diff --git a/build-logic/build.gradle.kts b/build-logic/build.gradle.kts
index fb432bf51c1..89af65d3e1c 100644
--- a/build-logic/build.gradle.kts
+++ b/build-logic/build.gradle.kts
@@ -7,6 +7,10 @@ plugins {
     `kotlin-dsl`
 }
 
+kotlin {
+    jvmToolchain(11)
+}
+
 repositories {
     mavenCentral()
     google()  // gestalt uses an annotation package by Google
@@ -14,18 +18,14 @@ repositories {
 
     maven {
         name = "Terasology Artifactory"
-        url = URI("http://artifactory.terasology.org/artifactory/virtual-repo-live")
-        @Suppress("UnstableApiUsage")
-        isAllowInsecureProtocol = true  // 😱
+        url = URI("https://artifactory.terasology.io/artifactory/virtual-repo-live")
     }
 
-    // TODO MYSTERY: As of November 7th 2011 virtual-repo-live could no longer be relied on for latest snapshots - Pro feature?
+    // TODO MYSTERY: As of November 7th 2021 virtual-repo-live could no longer be relied on for latest snapshots - Pro feature?
     // We've been using it that way for *years* and nothing likewise changed in the area for years as well. This seems to work ....
     maven {
         name = "Terasology snapshot locals"
-        url = URI("http://artifactory.terasology.org/artifactory/terasology-snapshot-local")
-        @Suppress("UnstableApiUsage")
-        isAllowInsecureProtocol = true  // 😱
+        url = URI("https://artifactory.terasology.io/artifactory/terasology-snapshot-local")
     }
 }
 
@@ -46,7 +46,7 @@ dependencies {
     implementation("org.terasology.gestalt:gestalt-module:7.1.0")
 
     // plugins we configure
-    implementation("com.github.spotbugs.snom:spotbugs-gradle-plugin:4.8.0")  // TODO: upgrade with gradle 7.x
+    implementation("com.github.spotbugs.snom:spotbugs-gradle-plugin:5.1.3")
     implementation("org.sonarsource.scanner.gradle:sonarqube-gradle-plugin:3.3")
 
     api(kotlin("test"))
diff --git a/build-logic/src/main/kotlin/terasology-metrics.gradle.kts b/build-logic/src/main/kotlin/terasology-metrics.gradle.kts
index 2c57d92a194..e80c14ad19a 100644
--- a/build-logic/src/main/kotlin/terasology-metrics.gradle.kts
+++ b/build-logic/src/main/kotlin/terasology-metrics.gradle.kts
@@ -50,7 +50,7 @@ tasks.withType<Test> {
     // If false, the outputs are still collected and visible in the test report, but they don't spam the console.
     testLogging.showStandardStreams = false
     reports {
-        junitXml.isEnabled = true
+        junitXml.required.set(true)
     }
     jvmArgs("-Xms512m", "-Xmx1024m")
 
@@ -60,6 +60,30 @@ tasks.withType<Test> {
     }
 }
 
+ tasks.withType<Checkstyle> {
+    //FIXME: This is a workaround for module harness builds, where the config 
+    //       files are part of the harness but the task is not defined.
+    if (rootProject.name == "Terasology") {
+        dependsOn(tasks.getByPath(":extractConfig"))
+    }
+ }
+
+tasks.withType<Pmd> {
+    //FIXME: This is a workaround for module harness builds, where the config 
+    //       files are part of the harness but the task is not defined.
+    if (rootProject.name == "Terasology") {
+        dependsOn(tasks.getByPath(":extractConfig"))
+    }
+}
+
+tasks.withType<SpotBugsTask> {
+    //FIXME: This is a workaround for module harness builds, where the config 
+    //       files are part of the harness but the task is not defined.
+    if (rootProject.name == "Terasology") {
+        dependsOn(tasks.getByPath(":extractConfig"))
+    }
+}
+
 // The config files here work in both a multi-project workspace (IDEs, running from source) and for solo module builds
 // Solo module builds in Jenkins get a copy of the config dir from the engine harness so it still lives at root/config
 // TODO: Maybe update other projects like modules to pull the zipped dependency so fewer quirks are needed in Jenkins
@@ -81,9 +105,6 @@ configure<PmdExtension> {
 }
 
 configure<SpotBugsExtension> {
-    // The version of the spotbugs tool https://github.com/spotbugs/spotbugs
-    // not necessarily the same as the version of spotbugs-gradle-plugin
-    toolVersion.set("4.7.0")
     ignoreFailures.set(true)
     excludeFilter.set(file(rootDir.resolve("config/metrics/findbugs/findbugs-exclude.xml")))
 }
diff --git a/build-logic/src/main/kotlin/terasology-module.gradle.kts b/build-logic/src/main/kotlin/terasology-module.gradle.kts
index 9c48409bea9..dbb7aa58886 100644
--- a/build-logic/src/main/kotlin/terasology-module.gradle.kts
+++ b/build-logic/src/main/kotlin/terasology-module.gradle.kts
@@ -29,10 +29,10 @@ apply(from = "$rootDir/config/gradle/publish.gradle")
 // Handle some logic related to where what is
 configure<SourceSetContainer> {
     main {
-        java.outputDir = buildDir.resolve("classes")
+        java.destinationDirectory.set(buildDir.resolve("classes"))
     }
     test {
-        java.outputDir = buildDir.resolve("testClasses")
+        java.destinationDirectory.set(buildDir.resolve("testClasses"))
     }
 }
 
@@ -144,6 +144,10 @@ tasks.named("processResources") {
     dependsOn("syncAssets", "syncOverrides", "syncDeltas", "syncModuleInfo")
 }
 
+tasks.named("compileJava") {
+    dependsOn("processResources")
+}
+
 tasks.named<Test>("test") {
     description = "Runs all tests (slow)"
     useJUnitPlatform ()
diff --git a/build-logic/src/main/kotlin/terasology-repositories.gradle.kts b/build-logic/src/main/kotlin/terasology-repositories.gradle.kts
index 4c68a6a8863..105a1c79d81 100644
--- a/build-logic/src/main/kotlin/terasology-repositories.gradle.kts
+++ b/build-logic/src/main/kotlin/terasology-repositories.gradle.kts
@@ -44,8 +44,7 @@ repositories {
         } else {
             // Our default is the main virtual repo containing everything except repos for testing Artifactory itself
             name = "Terasology Artifactory"
-            url = URI("http://artifactory.terasology.org/artifactory/virtual-repo-live")
-            isAllowInsecureProtocol = true  // 😱
+            url = URI("https://artifactory.terasology.io/artifactory/virtual-repo-live")
         }
     }
 
@@ -53,7 +52,6 @@ repositories {
     // We've been using it that way for *years* and nothing likewise changed in the area for years as well. This seems to work ....
     maven {
         name = "Terasology snapshot locals"
-        url = URI("http://artifactory.terasology.org/artifactory/terasology-snapshot-local")
-        isAllowInsecureProtocol = true  // 😱
+        url = URI("https://artifactory.terasology.io/artifactory/terasology-snapshot-local")
     }
 }
diff --git a/build.gradle b/build.gradle
index 6c4da8f63fc..a32fc232606 100644
--- a/build.gradle
+++ b/build.gradle
@@ -11,16 +11,14 @@ buildscript {
         maven {
             // required to provide runtime dependencies to build-logic.
             name = "Terasology Artifactory"
-            url = "http://artifactory.terasology.org/artifactory/virtual-repo-live"
-            allowInsecureProtocol = true  // 😱
+            url = "https://artifactory.terasology.io/artifactory/virtual-repo-live"
         }
 
         // TODO MYSTERY: As of November 7th 2011 virtual-repo-live could no longer be relied on for latest snapshots - Pro feature?
         // We've been using it that way for *years* and nothing likewise changed in the area for years as well. This seems to work ....
         maven {
             name = "Terasology snapshot locals"
-            url = "http://artifactory.terasology.org/artifactory/terasology-snapshot-local"
-            allowInsecureProtocol = true  // 😱
+            url = "https://artifactory.terasology.io/artifactory/terasology-snapshot-local"
         }
     }
 
@@ -56,7 +54,7 @@ import static org.gradle.internal.logging.text.StyledTextOutput.Style
 
 // Test for right version of Java in use for running this script
 assert org.gradle.api.JavaVersion.current().isJava11Compatible()
-if(!(JavaVersion.current() == JavaVersion.VERSION_11)) {
+if (!(JavaVersion.current() == JavaVersion.VERSION_11)) {
     def out = services.get(StyledTextOutputFactory).create("an-ouput")
     out.withStyle(Style.FailureHeader).println("""
 WARNING: Compiling with a JDK of not version 11. While some other Javas may be
@@ -64,7 +62,7 @@ safe to use, any newer than 11 may cause issues.
 If you encounter oddities try Java 11.
 See https://github.com/MovingBlocks/Terasology/issues/3976.
 Current detected Java version is ${JavaVersion.current()}
- from vendor ${System.getProperty("java.vendor")} 
+ from vendor ${System.getProperty("java.vendor")}
 located at ${System.getProperty("java.home")}
 """)
 }
@@ -95,7 +93,7 @@ configurations {
 dependencies {
     // For the "natives" configuration make it depend on the native files from LWJGL
     natives platform("org.lwjgl:lwjgl-bom:$LwjglVersion")
-    ["natives-linux","natives-windows","natives-macos"].forEach {
+    ["natives-linux", "natives-windows", "natives-macos"].forEach {
         natives "org.lwjgl:lwjgl::$it"
         natives "org.lwjgl:lwjgl-assimp::$it"
         natives "org.lwjgl:lwjgl-glfw::$it"
@@ -151,12 +149,12 @@ task extractJNLuaNatives(type: Copy) {
     into("$dirNatives")
 }
 
-task extractNativeBulletNatives(type:Copy) {
+task extractNativeBulletNatives(type: Copy) {
     description = "Extracts the JNBullet natives from the downloaded zip"
     from {
         configurations.natives.collect { it.getName().contains('JNBullet') ? zipTree(it) : [] }
     }
-    into ("$dirNatives")
+    into("$dirNatives")
 }
 
 
@@ -195,8 +193,8 @@ clean.doLast {
 allprojects {
     configurations.all {
         resolutionStrategy.dependencySubstitution {
-            substitute module("org.terasology.engine:engine") because "we have sources!" with project(":engine")
-            substitute module("org.terasology.engine:engine-tests") because "we have sources!" with project(":engine-tests")
+            substitute module("org.terasology.engine:engine") using project(":engine") because "we have sources!"
+            substitute module("org.terasology.engine:engine-tests") using project(":engine-tests") because "we have sources!"
         }
     }
 }
@@ -207,7 +205,7 @@ project(":modules").subprojects.forEach { proj ->
     project(":modules").subprojects {
         configurations.all {
             resolutionStrategy.dependencySubstitution {
-                substitute module("org.terasology.modules:${proj.name}") because "we have sources!" with project(":modules:${proj.name}")
+                substitute module("org.terasology.modules:${proj.name}") using project(":modules:${proj.name}") because "we have sources!"
             }
         }
     }
@@ -282,3 +280,53 @@ idea {
 cleanIdea.doLast {
     new File('Terasology.iws').delete()
 }
+
+// A task to assemble various files into a single zip for distribution as 'build-harness.zip' for module builds
+task assembleBuildHarness(type: Zip) {
+    description 'Assembles a zip of files useful for module development'
+
+    dependsOn extractNatives
+    from('natives'){
+        include '**/*'
+        // TODO: use output of extractNatives?
+        // TODO: which module needs natives to build?
+        into 'natives'
+    }
+
+    dependsOn extractConfig
+    from('config'){
+        //include 'gradle/**/*', 'metrics/**/*'
+        include '**/*'
+        // TODO: depend on output of extractConfig?
+        into 'config'
+    }
+
+    from('gradle'){
+        include '**/*' // include all files in 'gradle'
+        // TODO: exclude groovy jar?
+        into 'gradle'
+    }
+
+    from('build-logic'){
+        include 'src/**', '*.kts'
+        into 'build-logic'
+    }
+
+    from('templates') {
+        include 'build.gradle'
+    }
+
+    from('.') {
+        include 'gradlew'
+    }
+
+    // include file 'templates/module.logback-test.xml' as 'src/test/resources/logback-test.xml'
+    from('templates'){
+        include 'module.logback-test.xml'
+        rename 'module.logback-test.xml', 'logback-test.xml'
+        into 'src/test/resources'
+    }
+
+    // set the archive name
+    archiveFileName.set('build-harness.zip')
+}
diff --git a/config/gradle/common.gradle b/config/gradle/common.gradle
index 0bb76c48bbf..c4b305836ae 100644
--- a/config/gradle/common.gradle
+++ b/config/gradle/common.gradle
@@ -10,14 +10,11 @@ apply plugin: 'idea'
 
 apply plugin: 'terasology-repositories'
 
-java {
-    sourceCompatibility = JavaVersion.VERSION_11
-}
-
 javadoc.options.encoding = 'UTF-8'
 
 tasks.withType(JavaCompile) {
     options.encoding = 'UTF-8'
+    options.release.set(11)
 }
 
 task sourceJar(type: Jar) {
diff --git a/config/gradle/publish.gradle b/config/gradle/publish.gradle
index 31aeb166936..786b081afec 100644
--- a/config/gradle/publish.gradle
+++ b/config/gradle/publish.gradle
@@ -14,8 +14,7 @@ publishing {
 
             if (rootProject.hasProperty("publishRepo")) {
                 // This first option is good for local testing, you can set a full explicit target repo in gradle.properties
-                url = "http://artifactory.terasology.org/artifactory/$publishRepo"
-                allowInsecureProtocol true // 😱
+                url = "https://artifactory.terasology.io/artifactory/$publishRepo"
                 logger.info("Changing PUBLISH repoKey set via Gradle property to {}", publishRepo)
             } else {
                 // Support override from the environment to use a different target publish org
@@ -38,8 +37,7 @@ publishing {
                     }
 
                     logger.info("The final deduced publish repo is {}", deducedPublishRepo)
-                    url = "http://artifactory.terasology.org/artifactory/$deducedPublishRepo"
-                    allowInsecureProtocol true
+                    url = "https://artifactory.terasology.io/artifactory/$deducedPublishRepo"
                 }
             }
 
diff --git a/engine-tests/build.gradle b/engine-tests/build.gradle
index cea4bf94360..fab04533599 100644
--- a/engine-tests/build.gradle
+++ b/engine-tests/build.gradle
@@ -45,8 +45,8 @@ println "Version for $project.name loaded as $version for group $group"
 
 sourceSets {
     // Adjust output path (changed with the Gradle 6 upgrade, this puts it back)
-    main.java.outputDir = new File("$buildDir/classes")
-    test.java.outputDir = new File("$buildDir/testClasses")
+    main.java.destinationDirectory = new File("$buildDir/classes")
+    test.java.destinationDirectory = new File("$buildDir/testClasses")
 }
 
 // Primary dependencies definition
@@ -88,14 +88,21 @@ dependencies {
     // See terasology-metrics for other test-only internal dependencies
 }
 
+//TODO: Remove it  when gestalt will can to handle ProtectionDomain without classes (Resources)
 task copyResourcesToClasses(type:Copy) {
-    from sourceSets.main.output.resourcesDir
+    from tasks.named("processResources")
     into sourceSets.main.output.classesDirs.first()
 }
 
+tasks.named("compileJava"){
+    dependsOn(copyResourcesToClasses)
+}
+
+jar { // Workaround about previous copy to classes. idk why engine-tests:jar called before :engine ...
+    duplicatesStrategy = "EXCLUDE"
+}
+
 test {
-    //TODO: Remove it  when gestalt will can to handle ProtectionDomain without classes (Resources)
-    dependsOn copyResourcesToClasses
     dependsOn rootProject.extractNatives
 
     description("Runs all tests (slow)")
@@ -104,8 +111,6 @@ test {
 }
 
 task unitTest(type: Test) {
-    //TODO: Remove it  when gestalt will can to handle ProtectionDomain without classes (Resources)
-    dependsOn copyResourcesToClasses
     dependsOn rootProject.extractNatives
 
     group "Verification"
@@ -118,8 +123,6 @@ task unitTest(type: Test) {
 }
 
 task integrationTest(type: Test) {
-    //TODO: Remove it  when gestalt will can to handle ProtectionDomain without classes (Resources)
-    dependsOn copyResourcesToClasses
     dependsOn rootProject.extractNatives
 
     group "Verification"
diff --git a/engine/build.gradle b/engine/build.gradle
index 2695afd67c6..e10ec9d3b40 100644
--- a/engine/build.gradle
+++ b/engine/build.gradle
@@ -45,8 +45,9 @@ sourceSets {
         }
         java {
             // Adjust output path (changed with the Gradle 6 upgrade, this puts it back)
-            outputDir = new File("$buildDir/classes")
+            destinationDirectory = new File("$buildDir/classes")
         }
+        test.java.destinationDirectory = new File("$buildDir/testClasses")
     }
 }
 
@@ -154,7 +155,7 @@ dependencies {
     api fileTree(dir: 'libs', include: '*.jar')
 
     // TODO: Consider moving this back to the PC Facade instead of having the engine rely on it?
-    implementation group: 'org.terasology.crashreporter', name: 'cr-terasology', version: '4.2.0'
+    implementation group: 'org.terasology.crashreporter', name: 'cr-terasology', version: '5.0.0'
 
     api(project(":subsystems:TypeHandlerLibrary"))
 }
@@ -189,6 +190,7 @@ sourceSets {
         java.srcDirs = ['src/jmh/java']
         resources.srcDirs = ['src/jmh/resources']
         compileClasspath += sourceSets.main.runtimeClasspath
+        java.destinationDirectory = new File("$buildDir/jmhClasses")
     }
 }
 
@@ -263,14 +265,12 @@ tasks.named("processResources", Copy) {
 
 //TODO: Remove this when gestalt can handle ProtectionDomain without classes (Resources)
 task copyResourcesToClasses(type: Copy) {
-    from sourceSets.main.output.resourcesDir
+    from processResources
     into sourceSets.main.output.classesDirs.first()
 
-    dependsOn processResources
-    mustRunAfter compileJava
 }
 
-tasks.named("classes") {
+tasks.named("compileJava") {
     dependsOn(tasks.named("copyResourcesToClasses"))
 }
 
diff --git a/engine/src/main/java/org/terasology/engine/core/module/ModuleManager.java b/engine/src/main/java/org/terasology/engine/core/module/ModuleManager.java
index 7adedf161f9..5538bb2057c 100644
--- a/engine/src/main/java/org/terasology/engine/core/module/ModuleManager.java
+++ b/engine/src/main/java/org/terasology/engine/core/module/ModuleManager.java
@@ -272,8 +272,13 @@ private void setupSandbox() {
             permissionSet.grantPermission(new PropertyPermission("reactor.schedulers.defaultBoundedElasticQueueSize", "read"));
         }
 
-        Policy.setPolicy(new ModuleSecurityPolicy());
-        System.setSecurityManager(new ModuleSecurityManager());
+        if (Runtime.version().feature() < 18 || "allow".equals(System.getProperty("java.security.manager"))) {
+            Policy.setPolicy(new ModuleSecurityPolicy());
+            System.setSecurityManager(new ModuleSecurityManager());
+        } else {
+            logger.warn("SecurityManager is disabled starting with Java 18 - module sandbox functionality is limited!");
+            logger.warn("To enable SecurityManager, use the \"-Djava.security.manager=allow\" JVM option.");
+        }
     }
 
     /**
diff --git a/engine/src/main/java/org/terasology/engine/world/chunks/pipeline/ChunkExecutorCompletionService.java b/engine/src/main/java/org/terasology/engine/world/chunks/pipeline/ChunkExecutorCompletionService.java
new file mode 100644
index 00000000000..01a6ef7357c
--- /dev/null
+++ b/engine/src/main/java/org/terasology/engine/world/chunks/pipeline/ChunkExecutorCompletionService.java
@@ -0,0 +1,126 @@
+// Copyright 2023 The Terasology Foundation
+// SPDX-License-Identifier: Apache-2.0
+
+package org.terasology.engine.world.chunks.pipeline;
+
+import org.joml.Vector3i;
+import org.joml.Vector3ic;
+import org.terasology.engine.world.chunks.Chunk;
+
+import java.util.concurrent.BlockingQueue;
+import java.util.concurrent.Callable;
+import java.util.concurrent.CompletionService;
+import java.util.concurrent.Future;
+import java.util.concurrent.RunnableFuture;
+import java.util.concurrent.ThreadPoolExecutor;
+import java.util.concurrent.TimeUnit;
+
+/**
+ * A specialised alternative to {@link java.util.concurrent.ExecutorCompletionService},
+ * used for submitting chunk tasks and queuing their results.
+ *
+ * Whilst this class adheres to the {@link CompletionService} interface, use of the class's
+ * {@link #submit(Callable, Vector3ic)} overload is preferred over those inherited from the interface.
+ */
+public class ChunkExecutorCompletionService implements CompletionService<Chunk> {
+    private static final Vector3ic EMPTY_VECTOR3I = new Vector3i();
+    private final ThreadPoolExecutor threadPoolExecutor;
+    private final BlockingQueue<Future<Chunk>> completionQueue;
+
+    private final class ChunkFutureWithCompletion extends PositionFuture<Chunk> {
+        ChunkFutureWithCompletion(Callable callable, Vector3ic position) {
+            super(callable, position);
+        }
+
+        ChunkFutureWithCompletion(Runnable runnable, Chunk result, Vector3ic position) {
+            super(runnable, result, position);
+        }
+
+        @Override
+        protected void done() {
+            super.done();
+            try {
+                completionQueue.put(this);
+            } catch (InterruptedException e) {
+                throw new RuntimeException(e);
+            }
+        }
+    }
+
+    public ChunkExecutorCompletionService(ThreadPoolExecutor threadPoolExecutor, BlockingQueue<Future<Chunk>> completionQueue) {
+        this.threadPoolExecutor = threadPoolExecutor;
+        this.completionQueue = completionQueue;
+    }
+
+    /**
+     * Submits a task to be executed.
+     * @param callable the task to submit
+     *
+     * @deprecated Use {@link #submit(Callable, Vector3ic)} instead
+     */
+    @Override
+    @Deprecated
+    public Future<Chunk> submit(Callable<Chunk> callable) {
+        RunnableFuture<Chunk> task = new ChunkFutureWithCompletion(callable, EMPTY_VECTOR3I);
+        threadPoolExecutor.execute(task);
+        return task;
+    }
+
+    /**
+     * Submits a chunk task to be executed.
+     * @param callable the chunk task to execute.
+     * @param position the position of the chunk.
+     * @return the submitted task.
+     */
+    public Future<Chunk> submit(Callable<Chunk> callable, Vector3ic position) {
+        RunnableFuture<Chunk> task = new ChunkFutureWithCompletion(callable, position);
+        threadPoolExecutor.execute(task);
+        return task;
+    }
+
+    /**
+     * Submits a task to be executed.
+     * @param runnable the task to run.
+     * @param value the value to return upon task completion.
+     *
+     * @deprecated Use {@link #submit(Callable, Vector3ic)} instead
+     */
+    @Override
+    @Deprecated
+    public Future<Chunk> submit(Runnable runnable, Chunk value) {
+        RunnableFuture<Chunk> task = new ChunkFutureWithCompletion(runnable, value, EMPTY_VECTOR3I);
+        threadPoolExecutor.execute(task);
+        return task;
+    }
+
+    /**
+     * Retrieves a completed task from the queue.
+     * @return a completed task.
+     * @throws InterruptedException if interrupted whilst waiting on the queue.
+     */
+    @Override
+    public Future<Chunk> take() throws InterruptedException {
+        return completionQueue.take();
+    }
+
+    /**
+     * Retrieves a completed task from the queue if not empty.
+     * @return a completed task, or null if there are no tasks in the queue.
+     */
+    @Override
+    public Future<Chunk> poll() {
+        return completionQueue.poll();
+    }
+
+    /**
+     * Retrieves a completed task from the queue if not empty.
+     * @param l the timeout duration before returning null.
+     * @param timeUnit the time units of the timeout duration.
+     *
+     * @return a completed task, or null if there are no tasks in the queue.
+     */
+    @Override
+    public Future<Chunk> poll(long l, TimeUnit timeUnit) throws InterruptedException {
+        return completionQueue.poll(l, timeUnit);
+    }
+}
diff --git a/engine/src/main/java/org/terasology/engine/world/chunks/pipeline/ChunkProcessingPipeline.java b/engine/src/main/java/org/terasology/engine/world/chunks/pipeline/ChunkProcessingPipeline.java
index 5323ec245c5..15fce52938f 100644
--- a/engine/src/main/java/org/terasology/engine/world/chunks/pipeline/ChunkProcessingPipeline.java
+++ b/engine/src/main/java/org/terasology/engine/world/chunks/pipeline/ChunkProcessingPipeline.java
@@ -13,7 +13,6 @@
 import org.slf4j.LoggerFactory;
 import org.terasology.engine.monitoring.ThreadActivity;
 import org.terasology.engine.monitoring.ThreadMonitor;
-import org.terasology.engine.utilities.ReflectionUtil;
 import org.terasology.engine.world.chunks.Chunk;
 import org.terasology.engine.world.chunks.pipeline.stages.ChunkTask;
 import org.terasology.engine.world.chunks.pipeline.stages.ChunkTaskProvider;
@@ -21,14 +20,10 @@
 import java.util.Comparator;
 import java.util.List;
 import java.util.Map;
-import java.util.concurrent.Callable;
 import java.util.concurrent.CancellationException;
-import java.util.concurrent.CompletionService;
 import java.util.concurrent.ExecutionException;
-import java.util.concurrent.ExecutorCompletionService;
 import java.util.concurrent.Future;
 import java.util.concurrent.PriorityBlockingQueue;
-import java.util.concurrent.RunnableFuture;
 import java.util.concurrent.ThreadPoolExecutor;
 import java.util.concurrent.TimeUnit;
 import java.util.function.Function;
@@ -50,7 +45,7 @@ public class ChunkProcessingPipeline {
 
     private final List<ChunkTaskProvider> stages = Lists.newArrayList();
     private final Thread reactor;
-    private final CompletionService<Chunk> chunkProcessor;
+    private final ChunkExecutorCompletionService chunkProcessor;
     private final ThreadPoolExecutor executor;
     private final Function<Vector3ic, Chunk> chunkProvider;
     private final Map<Vector3ic, ChunkProcessingInfo> chunkProcessingInfoMap = Maps.newConcurrentMap();
@@ -66,17 +61,11 @@ public ChunkProcessingPipeline(Function<Vector3ic, Chunk> chunkProvider, Compara
                 NUM_TASK_THREADS,
                 NUM_TASK_THREADS, 0L,
                 TimeUnit.MILLISECONDS,
-                new PriorityBlockingQueue(800, unwrappingComporator(comparable)),
+                new PriorityBlockingQueue(800, comparable),
                 this::threadFactory,
-                this::rejectQueueHandler) {
-            @Override
-            protected <T> RunnableFuture<T> newTaskFor(Callable<T> callable) {
-                RunnableFuture<T> newTaskFor = super.newTaskFor(callable);
-                return new PositionFuture<>(newTaskFor, ((PositionalCallable) callable).getPosition());
-            }
-        };
+                this::rejectQueueHandler);
         logger.debug("allocated {} threads", NUM_TASK_THREADS);
-        chunkProcessor = new ExecutorCompletionService<>(executor,
+        chunkProcessor = new ChunkExecutorCompletionService(executor,
                 new PriorityBlockingQueue<>(800, comparable));
         reactor = new Thread(this::chunkTaskHandler);
         reactor.setDaemon(true);
@@ -84,18 +73,6 @@ protected <T> RunnableFuture<T> newTaskFor(Callable<T> callable) {
         reactor.start();
     }
 
-    /**
-     * BlackMagic method: {@link ExecutorCompletionService} wraps task with QueueingFuture (private access)
-     * there takes wrapped task for comparing in {@link ThreadPoolExecutor}
-     */
-    private Comparator unwrappingComporator(Comparator<Future<Chunk>> comparable) {
-        return (o1, o2) -> {
-                Object unwrapped1 = ReflectionUtil.readField(o1, "task");
-                Object unwrapped2 = ReflectionUtil.readField(o2, "task");
-                return comparable.compare((Future<Chunk>) unwrapped1, (Future<Chunk>) unwrapped2);
-        };
-    }
-
     /**
      * Reactor thread. Handles all ChunkTask dependency logic and running.
      */
@@ -190,11 +167,11 @@ private Chunk getChunkBy(ChunkTaskProvider requiredStage, Vector3ic position) {
     }
 
     private Future<Chunk> runTask(ChunkTask task, List<Chunk> chunks) {
-        return chunkProcessor.submit(new PositionalCallable(() -> {
+        return chunkProcessor.submit(() -> {
             try (ThreadActivity ignored = ThreadMonitor.startThreadActivity(task.getName())) {
                 return task.apply(chunks);
             }
-        }, task.getPosition()));
+        }, task.getPosition());
     }
 
     private Thread threadFactory(Runnable runnable) {
@@ -236,8 +213,7 @@ public ListenableFuture<Chunk> invokeGeneratorTask(Vector3ic position, Supplier<
             SettableFuture<Chunk> exitFuture = SettableFuture.create();
             chunkProcessingInfo = new ChunkProcessingInfo(position, exitFuture);
             chunkProcessingInfoMap.put(position, chunkProcessingInfo);
-            chunkProcessingInfo.setCurrentFuture(chunkProcessor.submit(new PositionalCallable(generatorTask::get,
-                    position)));
+            chunkProcessingInfo.setCurrentFuture(chunkProcessor.submit(generatorTask::get, position));
             return exitFuture;
         }
     }
@@ -317,26 +293,4 @@ public boolean isPositionProcessing(Vector3ic pos) {
     public Iterable<Vector3ic> getProcessingPosition() {
         return chunkProcessingInfoMap.keySet();
     }
-
-    /**
-     * Dummy callable for passthru position for {@link java.util.concurrent.ThreadPoolExecutor}#newTaskFor
-     */
-    private static final class PositionalCallable implements Callable<Chunk> {
-        private final Callable<Chunk> callable;
-        private final Vector3ic position;
-
-        private PositionalCallable(Callable<Chunk> callable, Vector3ic position) {
-            this.callable = callable;
-            this.position = position;
-        }
-
-        public Vector3ic getPosition() {
-            return position;
-        }
-
-        @Override
-        public Chunk call() throws Exception {
-            return callable.call();
-        }
-    }
 }
diff --git a/engine/src/main/java/org/terasology/engine/world/chunks/pipeline/PositionFuture.java b/engine/src/main/java/org/terasology/engine/world/chunks/pipeline/PositionFuture.java
index 5ce0e3452a4..51791bc741c 100644
--- a/engine/src/main/java/org/terasology/engine/world/chunks/pipeline/PositionFuture.java
+++ b/engine/src/main/java/org/terasology/engine/world/chunks/pipeline/PositionFuture.java
@@ -5,53 +5,23 @@
 
 import org.joml.Vector3ic;
 
-import java.util.concurrent.ExecutionException;
-import java.util.concurrent.RunnableFuture;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.TimeoutException;
+import java.util.concurrent.Callable;
+import java.util.concurrent.FutureTask;
 
-public class PositionFuture<T> implements RunnableFuture<T> {
-
-    private final RunnableFuture<T> delegate;
+public class PositionFuture<T> extends FutureTask<T> {
     private final Vector3ic position;
 
-    public PositionFuture(RunnableFuture<T> delegate, Vector3ic position) {
-        this.delegate = delegate;
+    public PositionFuture(Callable callable, Vector3ic position) {
+        super(callable);
         this.position = position;
     }
 
-    public Vector3ic getPosition() {
-        return position;
-    }
-
-    @Override
-    public void run() {
-        delegate.run();
-    }
-
-    @Override
-    public boolean cancel(boolean mayInterruptIfRunning) {
-        return delegate.cancel(mayInterruptIfRunning);
-    }
-
-    @Override
-    public boolean isCancelled() {
-        return delegate.isCancelled();
-    }
-
-    @Override
-    public boolean isDone() {
-        return delegate.isDone();
-    }
-
-    @Override
-    public T get() throws InterruptedException, ExecutionException {
-        return delegate.get();
+    public PositionFuture(Runnable runnable, T result, Vector3ic position) {
+        super(runnable, result);
+        this.position = position;
     }
 
-    @Override
-    public T get(long timeout, TimeUnit unit) throws InterruptedException, ExecutionException,
-            TimeoutException {
-        return delegate.get(timeout, unit);
+    public Vector3ic getPosition() {
+        return position;
     }
 }
diff --git a/facades/PC/build.gradle.kts b/facades/PC/build.gradle.kts
index 2c95561ad69..2d4e02fac18 100644
--- a/facades/PC/build.gradle.kts
+++ b/facades/PC/build.gradle.kts
@@ -69,7 +69,7 @@ dependencies {
     implementation("io.projectreactor:reactor-core:3.4.7")
 
     // TODO: Consider whether we can move the CR dependency back here from the engine, where it is referenced from the main menu
-    implementation(group = "org.terasology.crashreporter", name = "cr-terasology", version = "4.2.0")
+    implementation(group = "org.terasology.crashreporter", name = "cr-terasology", version = "5.0.0")
 
     runtimeOnly("ch.qos.logback:logback-classic:1.2.11") {
         because("to configure logging with logback.xml")
diff --git a/facades/PC/src/main/startScripts/unixStartScript.gsp b/facades/PC/src/main/startScripts/unixStartScript.gsp
index 911308c49a8..ee7249d5fd3 100644
--- a/facades/PC/src/main/startScripts/unixStartScript.gsp
+++ b/facades/PC/src/main/startScripts/unixStartScript.gsp
@@ -169,13 +169,6 @@ save () {
 }
 APP_ARGS=`save "\$@"`
 
-# Terasology-specific changes - Re-enable SecurityManager on Java 18+
-# According to https://openjdk.org/jeps/223, this string is intentionally parsable.
-JAVA_VERSION=`java -fullversion 2>&1 | sed 's/.* //;s/"//;s/\\([0-9]*\\)\\..*/\\1/'`
-if [ \$JAVA_VERSION -gt 17 ]; then
-    DEFAULT_JVM_OPTS="\$DEFAULT_JVM_OPTS -Djava.security.manager=allow"
-fi
-
 # Collect all arguments for the java command, following the shell quoting and substitution rules
 eval set -- \$DEFAULT_JVM_OPTS \$JAVA_OPTS \$${optsEnvironmentVar} <% if ( appNameSystemProperty ) { %>"\"-D${appNameSystemProperty}=\$APP_BASE_NAME\"" <% } %> <% if ( mainClassName.startsWith('--module ') ) { %>--module-path "\"\$MODULE_PATH\"" <% } %>-jar lib/Terasology.jar "\$APP_ARGS"
 
diff --git a/facades/PC/src/main/startScripts/windowsStartScript.bat.gsp b/facades/PC/src/main/startScripts/windowsStartScript.bat.gsp
index f33992fabd2..a4cf2790ac4 100644
--- a/facades/PC/src/main/startScripts/windowsStartScript.bat.gsp
+++ b/facades/PC/src/main/startScripts/windowsStartScript.bat.gsp
@@ -62,14 +62,6 @@ goto fail
 
 <% if ( mainClassName.startsWith('--module ') ) { %>set MODULE_PATH=$modulePath<% } %>
 
-@rem Terasology-specific changes - Re-enable SecurityManager on Java 18+
-@rem According to https://openjdk.org/jeps/223, this string is intentionally parsable.
-for /f "tokens=4 delims= " %%a in ('"%JAVA_EXE%" -fullversion 2^>^&1 1^>nul') do ( for /f "delims=." %%b in ('echo %%a') do set JAVA_VERSION="%%b" )
-set JAVA_VERSION=%JAVA_VERSION:"=%
-if %JAVA_VERSION% gtr 17 (
-    set DEFAULT_JVM_OPTS=%DEFAULT_JVM_OPTS% -Djava.security.manager=allow
-)
-
 @rem Execute ${applicationName}
 "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %${optsEnvironmentVar}% <% if ( appNameSystemProperty ) { %>"-D${appNameSystemProperty}=%APP_BASE_NAME%"<% } %> <% if ( mainClassName.startsWith('--module ') ) { %>--module-path "%MODULE_PATH%" <% } %>-jar lib\\Terasology.jar %*
 
diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
index e708b1c023e..033e24c4cdf 100644
Binary files a/gradle/wrapper/gradle-wrapper.jar and b/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index 25d3265315f..d11cdd907dd 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,5 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-6.8.2-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-all.zip
+networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
diff --git a/gradle/wrapper/groovy-wrapper.jar b/gradle/wrapper/groovy-wrapper.jar
index 7fadbd5150c..5d9efb6ac38 100644
Binary files a/gradle/wrapper/groovy-wrapper.jar and b/gradle/wrapper/groovy-wrapper.jar differ
diff --git a/gradlew b/gradlew
index 4f906e0c811..fcb6fca147c 100755
--- a/gradlew
+++ b/gradlew
@@ -1,7 +1,7 @@
-#!/usr/bin/env sh
+#!/bin/sh
 
 #
-# Copyright 2015 the original author or authors.
+# Copyright © 2015-2021 the original authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -17,67 +17,98 @@
 #
 
 ##############################################################################
-##
-##  Gradle start up script for UN*X
-##
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
 ##############################################################################
 
 # Attempt to set APP_HOME
+
 # Resolve links: $0 may be a link
-PRG="$0"
-# Need this for relative symlinks.
-while [ -h "$PRG" ] ; do
-    ls=`ls -ld "$PRG"`
-    link=`expr "$ls" : '.*-> \(.*\)$'`
-    if expr "$link" : '/.*' > /dev/null; then
-        PRG="$link"
-    else
-        PRG=`dirname "$PRG"`"/$link"
-    fi
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
 done
-SAVED="`pwd`"
-cd "`dirname \"$PRG\"`/" >/dev/null
-APP_HOME="`pwd -P`"
-cd "$SAVED" >/dev/null
 
-APP_NAME="Gradle"
-APP_BASE_NAME=`basename "$0"`
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
-MAX_FD="maximum"
+MAX_FD=maximum
 
 warn () {
     echo "$*"
-}
+} >&2
 
 die () {
     echo
     echo "$*"
     echo
     exit 1
-}
+} >&2
 
 # OS specific support (must be 'true' or 'false').
 cygwin=false
 msys=false
 darwin=false
 nonstop=false
-case "`uname`" in
-  CYGWIN* )
-    cygwin=true
-    ;;
-  Darwin* )
-    darwin=true
-    ;;
-  MINGW* )
-    msys=true
-    ;;
-  NONSTOP* )
-    nonstop=true
-    ;;
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
 esac
 
 CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
@@ -87,9 +118,9 @@ CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
 if [ -n "$JAVA_HOME" ] ; then
     if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
         # IBM's JDK on AIX uses strange locations for the executables
-        JAVACMD="$JAVA_HOME/jre/sh/java"
+        JAVACMD=$JAVA_HOME/jre/sh/java
     else
-        JAVACMD="$JAVA_HOME/bin/java"
+        JAVACMD=$JAVA_HOME/bin/java
     fi
     if [ ! -x "$JAVACMD" ] ; then
         die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
@@ -98,88 +129,120 @@ Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
     fi
 else
-    JAVACMD="java"
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
+    fi
 fi
 
 # Increase the maximum file descriptors if we can.
-if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
-    MAX_FD_LIMIT=`ulimit -H -n`
-    if [ $? -eq 0 ] ; then
-        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
-            MAX_FD="$MAX_FD_LIMIT"
-        fi
-        ulimit -n $MAX_FD
-        if [ $? -ne 0 ] ; then
-            warn "Could not set maximum file descriptor limit: $MAX_FD"
-        fi
-    else
-        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
-    fi
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
 fi
 
-# For Darwin, add options to specify how the application appears in the dock
-if $darwin; then
-    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
-fi
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
 
 # For Cygwin or MSYS, switch paths to Windows format before running java
-if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then
-    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
-    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
-
-    JAVACMD=`cygpath --unix "$JAVACMD"`
-
-    # We build the pattern for arguments to be converted via cygpath
-    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
-    SEP=""
-    for dir in $ROOTDIRSRAW ; do
-        ROOTDIRS="$ROOTDIRS$SEP$dir"
-        SEP="|"
-    done
-    OURCYGPATTERN="(^($ROOTDIRS))"
-    # Add a user-defined pattern to the cygpath arguments
-    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
-        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
-    fi
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
     # Now convert the arguments - kludge to limit ourselves to /bin/sh
-    i=0
-    for arg in "$@" ; do
-        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
-        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
-
-        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
-            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
-        else
-            eval `echo args$i`="\"$arg\""
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
         fi
-        i=`expr $i + 1`
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
     done
-    case $i in
-        0) set -- ;;
-        1) set -- "$args0" ;;
-        2) set -- "$args0" "$args1" ;;
-        3) set -- "$args0" "$args1" "$args2" ;;
-        4) set -- "$args0" "$args1" "$args2" "$args3" ;;
-        5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
-        6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
-        7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
-        8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
-        9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
-    esac
 fi
 
-# Escape application args
-save () {
-    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
-    echo " "
-}
-APP_ARGS=`save "$@"`
 
-# Collect all arguments for the java command, following the shell quoting and substitution rules
-eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command;
+#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
+#     shell script including quotes and variable substitutions, so put them in
+#     double quotes to make sure that they get re-expanded; and
+#   * put everything else in single quotes, so that it's not re-expanded.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        org.gradle.wrapper.GradleWrapperMain \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
 
 exec "$JAVACMD" "$@"
diff --git a/gradlew.bat b/gradlew.bat
index 107acd32c4e..93e3f59f135 100644
--- a/gradlew.bat
+++ b/gradlew.bat
@@ -14,7 +14,7 @@
 @rem limitations under the License.
 @rem
 
-@if "%DEBUG%" == "" @echo off
+@if "%DEBUG%"=="" @echo off
 @rem ##########################################################################
 @rem
 @rem  Gradle startup script for Windows
@@ -25,7 +25,8 @@
 if "%OS%"=="Windows_NT" setlocal
 
 set DIRNAME=%~dp0
-if "%DIRNAME%" == "" set DIRNAME=.
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
 set APP_BASE_NAME=%~n0
 set APP_HOME=%DIRNAME%
 
@@ -40,7 +41,7 @@ if defined JAVA_HOME goto findJavaFromJavaHome
 
 set JAVA_EXE=java.exe
 %JAVA_EXE% -version >NUL 2>&1
-if "%ERRORLEVEL%" == "0" goto execute
+if %ERRORLEVEL% equ 0 goto execute
 
 echo.
 echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
@@ -75,13 +76,15 @@ set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
 
 :end
 @rem End local scope for the variables with windows NT shell
-if "%ERRORLEVEL%"=="0" goto mainEnd
+if %ERRORLEVEL% equ 0 goto mainEnd
 
 :fail
 rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
 rem the _cmd.exe /c_ return code!
-if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
-exit /b 1
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
 
 :mainEnd
 if "%OS%"=="Windows_NT" endlocal
diff --git a/groovyw.bat b/groovyw.bat
index d2623ce34fb..3cd68e56e1a 100644
--- a/groovyw.bat
+++ b/groovyw.bat
@@ -77,33 +77,7 @@ set _SKIP=2
 :win9xME_args_slurp
 if "x%~1" == "x" goto execute
 
-@REM Escapes all arguments containing either "*" or "?" before passing them to the groovy process
-:process_args
-@REM If we have no more arguments to process then exit the loop
-IF "%1"=="" GOTO end
-SET ARG=%~1
-@REM "echo "%ARG%" will simply output the argument as an escaped text string
-@REM for piping to other applications. This is needed to ensure that the arguments are not expanded.
-@REM findstr is a built-in Windows utility (it has been since Windows 2000)
-@REM that finds matches in strings based on regular expressions.
-@REM The "&&" operator is followed if the findstr program returns an exit code of 0
-@REM Otherwise, the "||" operator is followed instead.
-echo "%ARG%" | findstr /C:"\*" 1>nul && (
-    SET CMD_LINE_ARGS=%CMD_LINE_ARGS% "%ARG%"
-) || (
-    echo "%ARG%" | findstr /C:"\?" 1>nul && (
-        SET CMD_LINE_ARGS=%CMD_LINE_ARGS% "%ARG%"
-    ) || (
-        SET CMD_LINE_ARGS=%CMD_LINE_ARGS% %ARG%
-    )
-)
-SHIFT
-GOTO process_args
-
-:end
-@REM For some reason, the escaped arguments always contain an extra space at the end, which confuses groovy.
-@REM This should remove it.
-SET CMD_LINE_ARGS=%CMD_LINE_ARGS:~1%
+set CMD_LINE_ARGS=%*
 
 :execute
 @rem Setup the command line
diff --git a/subsystems/DiscordRPC/build.gradle.kts b/subsystems/DiscordRPC/build.gradle.kts
index 403ce95e6e5..8e35a634457 100644
--- a/subsystems/DiscordRPC/build.gradle.kts
+++ b/subsystems/DiscordRPC/build.gradle.kts
@@ -9,6 +9,12 @@ plugins {
 
 apply(from = "$rootDir/config/gradle/common.gradle")
 
+configure<SourceSetContainer> {
+    // Adjust output path (changed with the Gradle 6 upgrade, this puts it back)
+    main { java.destinationDirectory.set(File("$buildDir/classes")) }
+    test { java.destinationDirectory.set(File("$buildDir/testClasses")) }
+}
+
 dependencies {
     implementation(project(":engine"))
     api("com.jagrosh:DiscordIPC:0.4")
diff --git a/subsystems/TypeHandlerLibrary/build.gradle.kts b/subsystems/TypeHandlerLibrary/build.gradle.kts
index 04d08725f1d..e8e3035d512 100644
--- a/subsystems/TypeHandlerLibrary/build.gradle.kts
+++ b/subsystems/TypeHandlerLibrary/build.gradle.kts
@@ -12,6 +12,12 @@ apply(from = "$rootDir/config/gradle/publish.gradle")
 group = "org.terasology.subsystems"
 version = project(":engine").version
 
+configure<SourceSetContainer> {
+    // Adjust output path (changed with the Gradle 6 upgrade, this puts it back)
+    main { java.destinationDirectory.set(File("$buildDir/classes")) }
+    test { java.destinationDirectory.set(File("$buildDir/testClasses")) }
+}
+
 dependencies {
     implementation("org.slf4j:slf4j-api:1.7.32")
     implementation("net.sf.trove4j:trove4j:3.0.3")
diff --git a/subsystems/build.gradle b/subsystems/build.gradle
index 0e6771f98f1..cb50dc0bdc5 100644
--- a/subsystems/build.gradle
+++ b/subsystems/build.gradle
@@ -9,7 +9,7 @@ subprojects {
     def sourceSets = project.getConvention().getPlugin(JavaPluginConvention.class).sourceSets
 
 
-    sourceSets.main.java.outputDir = new File("$buildDir/classes")
+    sourceSets.main.java.destinationDirectory = new File("$buildDir/classes")
     idea {
         module {
             // Change around the output a bit
diff --git a/templates/build.gradle b/templates/build.gradle
index b05d96aa3fe..5a4a69661de 100644
--- a/templates/build.gradle
+++ b/templates/build.gradle
@@ -7,16 +7,14 @@ buildscript {
         maven {
             // required to provide runtime dependencies to build-logic.
             name = "Terasology Artifactory"
-            url = "http://artifactory.terasology.org/artifactory/virtual-repo-live"
-            allowInsecureProtocol = true  // 😱
+            url = "https://artifactory.terasology.io/artifactory/virtual-repo-live"
         }
 
         // TODO MYSTERY: As of November 7th 2011 virtual-repo-live could no longer be relied on for latest snapshots - Pro feature?
         // We've been using it that way for *years* and nothing likewise changed in the area for years as well. This seems to work ....
         maven {
             name = "Terasology snapshot locals"
-            url = "http://artifactory.terasology.org/artifactory/terasology-snapshot-local"
-            allowInsecureProtocol = true  // 😱
+            url = "https://artifactory.terasology.io/artifactory/terasology-snapshot-local"
         }
     }
 }
diff --git a/templates/facades.gradle b/templates/facades.gradle
index b5eb74306f2..7733b3e024e 100644
--- a/templates/facades.gradle
+++ b/templates/facades.gradle
@@ -12,7 +12,7 @@ repositories {
     // MovingBlocks Artifactory instance for libs not readily available elsewhere plus our own libs
     maven {
         name "Terasology Artifactory"
-        url "http://artifactory.terasology.org/artifactory/repo"
+        url "https://artifactory.terasology.io/artifactory/repo"
     }
 }
 
diff --git a/templates/gradle.properties b/templates/gradle.properties
index 0461586709b..5dd1b59553c 100644
--- a/templates/gradle.properties
+++ b/templates/gradle.properties
@@ -12,7 +12,7 @@ org.gradle.jvmargs=-Xmx1024m
 # To pass via CLI use: -Dorg.gradle.internal.publish.checksums.insecure=true
 
 # Alternative resolution repo to use - this can be used to ignore "live" artifacts and only accept experimental ones.
-# alternativeResolutionRepo=http://artifactory.terasology.org/artifactory/virtual-nanoware-and-remote
+# alternativeResolutionRepo=https://artifactory.terasology.io/artifactory/virtual-nanoware-and-remote
 
 # Credentials for publishing to Artifactory. Good for local testing
 # mavenUser=