diff --git a/Jenkinsfile b/Jenkinsfile
index a3e573e3f2c..3abf6cc4b22 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -121,7 +121,7 @@ pipeline {
 
         stage('Analytics') {
             steps {
-                sh './gradlew --console=plain check -x test'
+                sh './gradlew --console=plain check -x test -x pmdMain -x pmdTest -x pmdJmh' // TODO: Probably more cleanly remove PMD overall if no use?
             }
             post {
                 always {
@@ -140,8 +140,7 @@ pipeline {
 
                     recordIssues(skipBlames: true, enabledForFailure: true,
                         tools: [
-                            spotBugs(pattern: '**/build/reports/spotbugs/*.xml', useRankAsPriority: true),
-                            pmdParser(pattern: '**/build/reports/pmd/*.xml')
+                            spotBugs(pattern: '**/build/reports/spotbugs/*.xml', useRankAsPriority: true)
                         ])
 
                     recordIssues(skipBlames: true, enabledForFailure: true,
diff --git a/build-logic/build.gradle.kts b/build-logic/build.gradle.kts
index 39955b5b511..af1854223f7 100644
--- a/build-logic/build.gradle.kts
+++ b/build-logic/build.gradle.kts
@@ -4,7 +4,7 @@
 import java.net.URI
 
 plugins {
-    id("org.gradle.kotlin.kotlin-dsl") version "4.1.0"
+    `kotlin-dsl`
 }
 
 kotlin {
@@ -18,18 +18,14 @@ repositories {
 
     maven {
         name = "Terasology Artifactory"
-        url = URI("http://artifactory.terasology.org/artifactory/virtual-repo-live")
-        @Suppress("UnstableApiUsage")
-        isAllowInsecureProtocol = true  // 😱
+        url = URI("https://artifactory.terasology.io/artifactory/virtual-repo-live")
     }
 
-    // TODO MYSTERY: As of November 7th 2011 virtual-repo-live could no longer be relied on for latest snapshots - Pro feature?
+    // TODO MYSTERY: As of November 7th 2021 virtual-repo-live could no longer be relied on for latest snapshots - Pro feature?
     // We've been using it that way for *years* and nothing likewise changed in the area for years as well. This seems to work ....
     maven {
         name = "Terasology snapshot locals"
-        url = URI("http://artifactory.terasology.org/artifactory/terasology-snapshot-local")
-        @Suppress("UnstableApiUsage")
-        isAllowInsecureProtocol = true  // 😱
+        url = URI("https://artifactory.terasology.io/artifactory/terasology-snapshot-local")
     }
 }
 
@@ -50,7 +46,7 @@ dependencies {
     implementation("org.terasology.gestalt:gestalt-module:7.1.0")
 
     // plugins we configure
-    implementation("com.github.spotbugs.snom:spotbugs-gradle-plugin:5.1.3")
+    implementation("com.github.spotbugs.snom:spotbugs-gradle-plugin:5.2.0")
     implementation("org.sonarsource.scanner.gradle:sonarqube-gradle-plugin:3.3")
 
     api(kotlin("test"))
diff --git a/build-logic/src/main/kotlin/terasology-metrics.gradle.kts b/build-logic/src/main/kotlin/terasology-metrics.gradle.kts
index 7382f3a2f1e..92e10afa33d 100644
--- a/build-logic/src/main/kotlin/terasology-metrics.gradle.kts
+++ b/build-logic/src/main/kotlin/terasology-metrics.gradle.kts
@@ -14,8 +14,8 @@ plugins {
 }
 
 dependencies {
-    "pmd"("net.sourceforge.pmd:pmd-core:6.15.0")
-    "pmd"("net.sourceforge.pmd:pmd-java:6.15.0")
+    pmd("net.sourceforge.pmd:pmd-core:6.55.0")
+    pmd("net.sourceforge.pmd:pmd-java:6.55.0")
 
     testRuntimeOnly("ch.qos.logback:logback-classic:1.2.11") {
         because("runtime: to configure logging during tests with logback.xml")
@@ -27,7 +27,7 @@ dependencies {
         because("redirects java.util.logging (from e.g. junit) through slf4j")
     }
 
-    add("testImplementation", platform("org.junit:junit-bom:5.8.1"))
+    add("testImplementation", platform("org.junit:junit-bom:5.10.0"))
     testImplementation("org.junit.jupiter:junit-jupiter-api")
     testImplementation("org.junit.jupiter:junit-jupiter-params")
     testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine")
@@ -60,16 +60,28 @@ tasks.withType<Test> {
     }
 }
 
-tasks.withType<Checkstyle> {
-    dependsOn(tasks.getByPath(":extractConfig"))
-}
+ tasks.withType<Checkstyle> {
+    //FIXME: This is a workaround for module harness builds, where the config 
+    //       files are part of the harness but the task is not defined.
+    if (rootProject.name == "Terasology") {
+        dependsOn(tasks.getByPath(":extractConfig"))
+    }
+ }
 
 tasks.withType<Pmd> {
-    dependsOn(tasks.getByPath(":extractConfig"))
+    //FIXME: This is a workaround for module harness builds, where the config 
+    //       files are part of the harness but the task is not defined.
+    if (rootProject.name == "Terasology") {
+        dependsOn(tasks.getByPath(":extractConfig"))
+    }
 }
 
 tasks.withType<SpotBugsTask> {
-    dependsOn(tasks.getByPath(":extractConfig"))
+    //FIXME: This is a workaround for module harness builds, where the config 
+    //       files are part of the harness but the task is not defined.
+    if (rootProject.name == "Terasology") {
+        dependsOn(tasks.getByPath(":extractConfig"))
+    }
 }
 
 // The config files here work in both a multi-project workspace (IDEs, running from source) and for solo module builds
diff --git a/build-logic/src/main/kotlin/terasology-repositories.gradle.kts b/build-logic/src/main/kotlin/terasology-repositories.gradle.kts
index 4c68a6a8863..105a1c79d81 100644
--- a/build-logic/src/main/kotlin/terasology-repositories.gradle.kts
+++ b/build-logic/src/main/kotlin/terasology-repositories.gradle.kts
@@ -44,8 +44,7 @@ repositories {
         } else {
             // Our default is the main virtual repo containing everything except repos for testing Artifactory itself
             name = "Terasology Artifactory"
-            url = URI("http://artifactory.terasology.org/artifactory/virtual-repo-live")
-            isAllowInsecureProtocol = true  // 😱
+            url = URI("https://artifactory.terasology.io/artifactory/virtual-repo-live")
         }
     }
 
@@ -53,7 +52,6 @@ repositories {
     // We've been using it that way for *years* and nothing likewise changed in the area for years as well. This seems to work ....
     maven {
         name = "Terasology snapshot locals"
-        url = URI("http://artifactory.terasology.org/artifactory/terasology-snapshot-local")
-        isAllowInsecureProtocol = true  // 😱
+        url = URI("https://artifactory.terasology.io/artifactory/terasology-snapshot-local")
     }
 }
diff --git a/build.gradle b/build.gradle
index 13acafc6551..998b4e4ec2c 100644
--- a/build.gradle
+++ b/build.gradle
@@ -11,16 +11,14 @@ buildscript {
         maven {
             // required to provide runtime dependencies to build-logic.
             name = "Terasology Artifactory"
-            url = "http://artifactory.terasology.org/artifactory/virtual-repo-live"
-            allowInsecureProtocol = true  // 😱
+            url = "https://artifactory.terasology.io/artifactory/virtual-repo-live"
         }
 
         // TODO MYSTERY: As of November 7th 2011 virtual-repo-live could no longer be relied on for latest snapshots - Pro feature?
         // We've been using it that way for *years* and nothing likewise changed in the area for years as well. This seems to work ....
         maven {
             name = "Terasology snapshot locals"
-            url = "http://artifactory.terasology.org/artifactory/terasology-snapshot-local"
-            allowInsecureProtocol = true  // 😱
+            url = "https://artifactory.terasology.io/artifactory/terasology-snapshot-local"
         }
     }
 
@@ -64,7 +62,7 @@ safe to use, any newer than 11 may cause issues.
 If you encounter oddities try Java 11.
 See https://github.com/MovingBlocks/Terasology/issues/3976.
 Current detected Java version is ${JavaVersion.current()}
- from vendor ${System.getProperty("java.vendor")} 
+ from vendor ${System.getProperty("java.vendor")}
 located at ${System.getProperty("java.home")}
 """)
 }
@@ -106,7 +104,7 @@ dependencies {
 
 
     // Config for our code analytics lives in a centralized repo: https://github.com/MovingBlocks/TeraConfig
-    codeMetrics group: 'org.terasology.config', name: 'codemetrics', version: '1.6.3', ext: 'zip'
+    codeMetrics group: 'org.terasology.config', name: 'codemetrics', version: '2.1.0', ext: 'zip'
 
     // Natives for JNLua (Kallisti, KComputers)
     natives group: 'org.terasology.jnlua', name: 'jnlua_natives', version: '0.1.0-SNAPSHOT', ext: 'zip'
@@ -294,3 +292,53 @@ if (hasProperty('buildScan')
         }
     }
 }
+    
+// A task to assemble various files into a single zip for distribution as 'build-harness.zip' for module builds
+task assembleBuildHarness(type: Zip) {
+    description 'Assembles a zip of files useful for module development'
+
+    dependsOn extractNatives
+    from('natives'){
+        include '**/*'
+        // TODO: use output of extractNatives?
+        // TODO: which module needs natives to build?
+        into 'natives'
+    }
+
+    dependsOn extractConfig
+    from('config'){
+        //include 'gradle/**/*', 'metrics/**/*'
+        include '**/*'
+        // TODO: depend on output of extractConfig?
+        into 'config'
+    }
+
+    from('gradle'){
+        include '**/*' // include all files in 'gradle'
+        // TODO: exclude groovy jar?
+        into 'gradle'
+    }
+
+    from('build-logic'){
+        include 'src/**', '*.kts'
+        into 'build-logic'
+    }
+
+    from('templates') {
+        include 'build.gradle'
+    }
+
+    from('.') {
+        include 'gradlew'
+    }
+
+    // include file 'templates/module.logback-test.xml' as 'src/test/resources/logback-test.xml'
+    from('templates'){
+        include 'module.logback-test.xml'
+        rename 'module.logback-test.xml', 'logback-test.xml'
+        into 'src/test/resources'
+    }
+
+    // set the archive name
+    archiveFileName.set('build-harness.zip')
+}
diff --git a/config/gradle/publish.gradle b/config/gradle/publish.gradle
index 31aeb166936..786b081afec 100644
--- a/config/gradle/publish.gradle
+++ b/config/gradle/publish.gradle
@@ -14,8 +14,7 @@ publishing {
 
             if (rootProject.hasProperty("publishRepo")) {
                 // This first option is good for local testing, you can set a full explicit target repo in gradle.properties
-                url = "http://artifactory.terasology.org/artifactory/$publishRepo"
-                allowInsecureProtocol true // 😱
+                url = "https://artifactory.terasology.io/artifactory/$publishRepo"
                 logger.info("Changing PUBLISH repoKey set via Gradle property to {}", publishRepo)
             } else {
                 // Support override from the environment to use a different target publish org
@@ -38,8 +37,7 @@ publishing {
                     }
 
                     logger.info("The final deduced publish repo is {}", deducedPublishRepo)
-                    url = "http://artifactory.terasology.org/artifactory/$deducedPublishRepo"
-                    allowInsecureProtocol true
+                    url = "https://artifactory.terasology.io/artifactory/$deducedPublishRepo"
                 }
             }
 
diff --git a/engine/build.gradle b/engine/build.gradle
index e10ec9d3b40..562ae47c417 100644
--- a/engine/build.gradle
+++ b/engine/build.gradle
@@ -247,7 +247,7 @@ def createVersionInfoFile = tasks.register("createVersionInfoFile", WritePropert
         // It is a value we can always get (on Jenkins or otherwise) but we don't want local builds
         // to invalidate their cache whenever the time changes.
         // TODO: after upgrading to Gradle 6.8, see if we can have it ignore this property specifically:
-        //     https://docs.gradle.org/current/userguide/more_about_tasks.html#sec:property_file_normalization
+        //     https://docs.gradle.org/current/userguide/incremental_build.html#sec:property_file_normalization
         property("dateTime", startDateTimeString)
     }
 
diff --git a/engine/src/main/java/org/terasology/engine/core/module/ModuleManager.java b/engine/src/main/java/org/terasology/engine/core/module/ModuleManager.java
index 7adedf161f9..5538bb2057c 100644
--- a/engine/src/main/java/org/terasology/engine/core/module/ModuleManager.java
+++ b/engine/src/main/java/org/terasology/engine/core/module/ModuleManager.java
@@ -272,8 +272,13 @@ private void setupSandbox() {
             permissionSet.grantPermission(new PropertyPermission("reactor.schedulers.defaultBoundedElasticQueueSize", "read"));
         }
 
-        Policy.setPolicy(new ModuleSecurityPolicy());
-        System.setSecurityManager(new ModuleSecurityManager());
+        if (Runtime.version().feature() < 18 || "allow".equals(System.getProperty("java.security.manager"))) {
+            Policy.setPolicy(new ModuleSecurityPolicy());
+            System.setSecurityManager(new ModuleSecurityManager());
+        } else {
+            logger.warn("SecurityManager is disabled starting with Java 18 - module sandbox functionality is limited!");
+            logger.warn("To enable SecurityManager, use the \"-Djava.security.manager=allow\" JVM option.");
+        }
     }
 
     /**
diff --git a/engine/src/main/java/org/terasology/engine/logic/console/commands/CoreCommands.java b/engine/src/main/java/org/terasology/engine/logic/console/commands/CoreCommands.java
index eb3c0621bb6..5a13e239daf 100644
--- a/engine/src/main/java/org/terasology/engine/logic/console/commands/CoreCommands.java
+++ b/engine/src/main/java/org/terasology/engine/logic/console/commands/CoreCommands.java
@@ -479,7 +479,7 @@ public String dumpEntities(@CommandParam(value = "componentNames", required = fa
         PrefabSerializer prefabSerializer =
                 new PrefabSerializer(engineEntityManager.getComponentLibrary(), engineEntityManager.getTypeSerializerLibrary());
         WorldDumper worldDumper = new WorldDumper(engineEntityManager, prefabSerializer);
-        Path outFile = PathManager.getInstance().getHomePath().resolve(Instant.now() + "-entityDump.json");
+        Path outFile = PathManager.getInstance().getHomePath().resolve(Instant.now().toString().replaceAll(":", "-") + "-entityDump.json");
         if (componentNames.length == 0) {
             savedEntityCount = worldDumper.save(outFile);
         } else {
diff --git a/facades/PC/src/main/startScripts/unixStartScript.gsp b/facades/PC/src/main/startScripts/unixStartScript.gsp
index 911308c49a8..ee7249d5fd3 100644
--- a/facades/PC/src/main/startScripts/unixStartScript.gsp
+++ b/facades/PC/src/main/startScripts/unixStartScript.gsp
@@ -169,13 +169,6 @@ save () {
 }
 APP_ARGS=`save "\$@"`
 
-# Terasology-specific changes - Re-enable SecurityManager on Java 18+
-# According to https://openjdk.org/jeps/223, this string is intentionally parsable.
-JAVA_VERSION=`java -fullversion 2>&1 | sed 's/.* //;s/"//;s/\\([0-9]*\\)\\..*/\\1/'`
-if [ \$JAVA_VERSION -gt 17 ]; then
-    DEFAULT_JVM_OPTS="\$DEFAULT_JVM_OPTS -Djava.security.manager=allow"
-fi
-
 # Collect all arguments for the java command, following the shell quoting and substitution rules
 eval set -- \$DEFAULT_JVM_OPTS \$JAVA_OPTS \$${optsEnvironmentVar} <% if ( appNameSystemProperty ) { %>"\"-D${appNameSystemProperty}=\$APP_BASE_NAME\"" <% } %> <% if ( mainClassName.startsWith('--module ') ) { %>--module-path "\"\$MODULE_PATH\"" <% } %>-jar lib/Terasology.jar "\$APP_ARGS"
 
diff --git a/facades/PC/src/main/startScripts/windowsStartScript.bat.gsp b/facades/PC/src/main/startScripts/windowsStartScript.bat.gsp
index f33992fabd2..a4cf2790ac4 100644
--- a/facades/PC/src/main/startScripts/windowsStartScript.bat.gsp
+++ b/facades/PC/src/main/startScripts/windowsStartScript.bat.gsp
@@ -62,14 +62,6 @@ goto fail
 
 <% if ( mainClassName.startsWith('--module ') ) { %>set MODULE_PATH=$modulePath<% } %>
 
-@rem Terasology-specific changes - Re-enable SecurityManager on Java 18+
-@rem According to https://openjdk.org/jeps/223, this string is intentionally parsable.
-for /f "tokens=4 delims= " %%a in ('"%JAVA_EXE%" -fullversion 2^>^&1 1^>nul') do ( for /f "delims=." %%b in ('echo %%a') do set JAVA_VERSION="%%b" )
-set JAVA_VERSION=%JAVA_VERSION:"=%
-if %JAVA_VERSION% gtr 17 (
-    set DEFAULT_JVM_OPTS=%DEFAULT_JVM_OPTS% -Djava.security.manager=allow
-)
-
 @rem Execute ${applicationName}
 "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %${optsEnvironmentVar}% <% if ( appNameSystemProperty ) { %>"-D${appNameSystemProperty}=%APP_BASE_NAME%"<% } %> <% if ( mainClassName.startsWith('--module ') ) { %>--module-path "%MODULE_PATH%" <% } %>-jar lib\\Terasology.jar %*
 
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index c747538fb38..8838ba97ba0 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.2.1-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.4-all.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
diff --git a/gradle/wrapper/groovy-wrapper.jar b/gradle/wrapper/groovy-wrapper.jar
index c17384dc4da..5d9efb6ac38 100644
Binary files a/gradle/wrapper/groovy-wrapper.jar and b/gradle/wrapper/groovy-wrapper.jar differ
diff --git a/groovyw.bat b/groovyw.bat
index d2623ce34fb..3cd68e56e1a 100644
--- a/groovyw.bat
+++ b/groovyw.bat
@@ -77,33 +77,7 @@ set _SKIP=2
 :win9xME_args_slurp
 if "x%~1" == "x" goto execute
 
-@REM Escapes all arguments containing either "*" or "?" before passing them to the groovy process
-:process_args
-@REM If we have no more arguments to process then exit the loop
-IF "%1"=="" GOTO end
-SET ARG=%~1
-@REM "echo "%ARG%" will simply output the argument as an escaped text string
-@REM for piping to other applications. This is needed to ensure that the arguments are not expanded.
-@REM findstr is a built-in Windows utility (it has been since Windows 2000)
-@REM that finds matches in strings based on regular expressions.
-@REM The "&&" operator is followed if the findstr program returns an exit code of 0
-@REM Otherwise, the "||" operator is followed instead.
-echo "%ARG%" | findstr /C:"\*" 1>nul && (
-    SET CMD_LINE_ARGS=%CMD_LINE_ARGS% "%ARG%"
-) || (
-    echo "%ARG%" | findstr /C:"\?" 1>nul && (
-        SET CMD_LINE_ARGS=%CMD_LINE_ARGS% "%ARG%"
-    ) || (
-        SET CMD_LINE_ARGS=%CMD_LINE_ARGS% %ARG%
-    )
-)
-SHIFT
-GOTO process_args
-
-:end
-@REM For some reason, the escaped arguments always contain an extra space at the end, which confuses groovy.
-@REM This should remove it.
-SET CMD_LINE_ARGS=%CMD_LINE_ARGS:~1%
+set CMD_LINE_ARGS=%*
 
 :execute
 @rem Setup the command line
diff --git a/templates/build.gradle b/templates/build.gradle
index b05d96aa3fe..5a4a69661de 100644
--- a/templates/build.gradle
+++ b/templates/build.gradle
@@ -7,16 +7,14 @@ buildscript {
         maven {
             // required to provide runtime dependencies to build-logic.
             name = "Terasology Artifactory"
-            url = "http://artifactory.terasology.org/artifactory/virtual-repo-live"
-            allowInsecureProtocol = true  // 😱
+            url = "https://artifactory.terasology.io/artifactory/virtual-repo-live"
         }
 
         // TODO MYSTERY: As of November 7th 2011 virtual-repo-live could no longer be relied on for latest snapshots - Pro feature?
         // We've been using it that way for *years* and nothing likewise changed in the area for years as well. This seems to work ....
         maven {
             name = "Terasology snapshot locals"
-            url = "http://artifactory.terasology.org/artifactory/terasology-snapshot-local"
-            allowInsecureProtocol = true  // 😱
+            url = "https://artifactory.terasology.io/artifactory/terasology-snapshot-local"
         }
     }
 }
diff --git a/templates/facades.gradle b/templates/facades.gradle
index b5eb74306f2..7733b3e024e 100644
--- a/templates/facades.gradle
+++ b/templates/facades.gradle
@@ -12,7 +12,7 @@ repositories {
     // MovingBlocks Artifactory instance for libs not readily available elsewhere plus our own libs
     maven {
         name "Terasology Artifactory"
-        url "http://artifactory.terasology.org/artifactory/repo"
+        url "https://artifactory.terasology.io/artifactory/repo"
     }
 }
 
diff --git a/templates/gradle.properties b/templates/gradle.properties
index 0461586709b..5dd1b59553c 100644
--- a/templates/gradle.properties
+++ b/templates/gradle.properties
@@ -12,7 +12,7 @@ org.gradle.jvmargs=-Xmx1024m
 # To pass via CLI use: -Dorg.gradle.internal.publish.checksums.insecure=true
 
 # Alternative resolution repo to use - this can be used to ignore "live" artifacts and only accept experimental ones.
-# alternativeResolutionRepo=http://artifactory.terasology.org/artifactory/virtual-nanoware-and-remote
+# alternativeResolutionRepo=https://artifactory.terasology.io/artifactory/virtual-nanoware-and-remote
 
 # Credentials for publishing to Artifactory. Good for local testing
 # mavenUser=