def poll_and_publish_deployment(deployment_id, token)
   encoded_id = URI.encode_www_form_component(deployment_id.strip)
   status = {}
   max_attempts = 60
   delay = 5
 
   max_attempts.times do |attempt|
-    status = sonatype_api_post("https://central.sonatype.com/api/v1/publisher/status?id=#{encoded_id}", token)
-    state = status['deploymentState']
-    puts "Deployment state: #{state}"
+    begin
+      status = sonatype_api_post("https://central.sonatype.com/api/v1/publisher/status?id=#{encoded_id}", token)
+      state = status['deploymentState']
+      puts "Deployment state: #{state}"
 
-    case state
-    when 'VALIDATED', 'PUBLISHED' then break
-    when 'FAILED' then raise "Deployment failed: #{status['errors']}"
+      case state
+      when 'VALIDATED', 'PUBLISHED' then break
+      when 'FAILED' then raise "Deployment failed: #{status['errors']}"
+      end
+
+      sleep(delay) unless attempt == max_attempts - 1
+    rescue StandardError => e
+      raise if e.message.start_with?('Deployment failed')
+
+      warn "API error (attempt #{attempt + 1}/#{max_attempts}): #{e.message}"
+      sleep(delay) unless attempt == max_attempts - 1
     end
-    sleep(delay) unless attempt == max_attempts - 1
-  rescue StandardError => e
-    raise if e.message.start_with?('Deployment failed')
-
-    warn "API error (attempt #{attempt + 1}/#{max_attempts}): #{e.message}"
-    sleep(delay) unless attempt == max_attempts - 1
   end

 def node_version
-  File.foreach('javascript/selenium-webdriver/package.json') do |line|
-    return line.split(':').last.strip.tr('",', '') if line.include?('version')
-  end
+  json = JSON.parse(File.read('javascript/selenium-webdriver/package.json'))
+  json.fetch('version')
 end

 task :check_credentials do |_task, arguments|
   args = arguments.to_a
   failures = []
   %w[java py rb dotnet node].each do |lang|
-    Rake::Task["#{lang}:check_credentials"].invoke(*args)
+    t = Rake::Task["#{lang}:check_credentials"]
+    t.reenable
+    t.invoke(*args)
   rescue StandardError => e
     failures << "#{lang}: #{e.message}"
   end
   raise "Credential check failed:\n#{failures.join("\n")}" unless failures.empty?
 end

 filegroup(
     name = "rakefile",
     srcs = [
         "Rakefile",
-    ] + glob(["rake_tasks/*.rake", "rake_tasks/*.rb"]),
+    ] + glob(["rake_tasks/**/*.rake", "rake_tasks/**/*.rb"]),
     visibility = ["//rb:__subpackages__"],
 )

 def self.verify_package_published(url)
   puts "Verifying #{url}..."
   uri = URI(url)
-  res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') { |http| http.request(Net::HTTP::Get.new(uri)) }
+  res = Net::HTTP.start(uri.hostname, uri.port,
+                        use_ssl: uri.scheme == 'https',
+                        open_timeout: 10,
+                        read_timeout: 30) do |http|
+    http.request(Net::HTTP::Get.new(uri))
+  end
   raise "Package not published: #{url}" unless res.is_a?(Net::HTTPSuccess)
 
   puts 'Verified!'
 end

 def sonatype_api_post(url, token)
-  uri = URI(url)
+  uri = URI.parse(url.to_s.strip)
   req = Net::HTTP::Post.new(uri)
   req['Authorization'] = "Basic #{token}"
 
-  res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(req) }
+  res = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == 'https', open_timeout: 10, read_timeout: 30) do |http|
+    http.request(req)
+  end
   raise "Sonatype API error (#{res.code}): #{res.body}" unless res.is_a?(Net::HTTPSuccess)
 
-  res.body.to_s.empty? ? {} : JSON.parse(res.body)
+  body = res.body.to_s
+  return {} if body.strip.empty?
+
+  JSON.parse(body)
+rescue JSON::ParserError => e
+  raise "Sonatype API returned non-JSON response: #{e.message}"
 end

 all_langs = %w[java py rb node rust]
-skip = arguments.to_a.select { |a| a.start_with?('-') }.map { |a| a.delete_prefix('-') }
+args = arguments.to_a.map(&:to_s)
+skip = args.select { |a| a.start_with?('-') }.map { |a| a.delete_prefix('-') }

-namespace(:appium) { load 'rake_tasks/appium.rake' }
+namespace(:appium) { load File.expand_path('rake_tasks/appium.rake', __dir__) }

 def read_m2_user_pass
   settings_path = File.join(Dir.home, '.m2', 'settings.xml')
   unless File.exist?(settings_path)
     warn "Maven settings file not found at #{settings_path}"
     return
   end
 
   puts 'Maven environment variables not set, inspecting ~/.m2/settings.xml.'
   settings = File.read(settings_path)
-  found_section = false
+  in_central_server = false
+
   settings.each_line do |line|
-    if !found_section
-      found_section = line.include? '<id>central</id>'
+    if !in_central_server
+      in_central_server = line.include?('<id>central</id>')
+      next
+    end
+
+    if line.include?('</server>')
+      break
     elsif line.include?('<username>')
       ENV['MAVEN_USER'] = line[%r{<username>(.*?)</username>}, 1]
     elsif line.include?('<password>')
       ENV['MAVEN_PASSWORD'] = line[%r{<password>(.*?)</password>}, 1]
     end
+
     break if ENV['MAVEN_PASSWORD'] && ENV['MAVEN_USER']
   end
 end

-SeleniumRake.git = Git.open(__dir__)
+begin
+  SeleniumRake.git = Git.open(__dir__)
+rescue StandardError
+  SeleniumRake.git = nil
+end

-SeleniumRake.git.add('common/repositories.bzl')
+SeleniumRake.git&.add('common/repositories.bzl')

 output = nil
 Bazel.execute('run', [], '@maven//:outdated') do |out|
   output = out
 end
 
+if output.nil? || output.strip.empty?
+  raise 'Failed to fetch Maven outdated report (no output returned)'
+end
+
 versions = output.scan(/(\S+) \[\S+ -> (\S+)\]/).to_h

+FileUtils.mkdir_p("#{lib_path}/remote")
+
 %w[getAttribute.js isDisplayed.js findElements.js].each do |atom|
-  FileUtils.cp("#{bazel_bin}/remote/#{atom}", "#{lib_path}/remote/#{atom}")
+  src = "#{bazel_bin}/remote/#{atom}"
+  dest = "#{lib_path}/remote/#{atom}"
+  raise "Missing generated atom: #{src}" unless File.exist?(src)
+
+  FileUtils.cp(src, dest)
 end

 desc 'Run linters for all languages (skip with: ./go all:lint -rb -rust)'
 task :lint do |_task, arguments|
   all_langs = %w[java py rb node rust]
-  skip = arguments.to_a.select { |a| a.start_with?('-') }.map { |a| a.delete_prefix('-') }
+  raw_args = arguments.to_a
+  skip_args = raw_args.select { |a| a.start_with?('-') }
+  skip = skip_args.map { |a| a.delete_prefix('-') }
+
   invalid = skip - all_langs
   raise "Unknown languages: #{invalid.join(', ')}. Valid: #{all_langs.join(', ')}" if invalid.any?
 
+  forward_args = raw_args - skip_args
   langs = all_langs - skip
+
   failures = []
   langs.each do |lang|
     puts "Linting #{lang}..."
-    Rake::Task["#{lang}:lint"].invoke
+    Rake::Task["#{lang}:lint"].invoke(*forward_args)
   rescue StandardError => e
     failures << "#{lang}: #{e.message}"
   end
+
   raise "Lint failed:\n#{failures.join("\n")}" unless failures.empty?
 end

 FileUtils.copy('bazel-bin/dotnet/release.zip', "build/dist/selenium-dotnet-#{dotnet_version}.zip")
-FileUtils.chmod(0o666, "build/dist/selenium-dotnet-#{dotnet_version}.zip")
+FileUtils.chmod(0o644, "build/dist/selenium-dotnet-#{dotnet_version}.zip")
 FileUtils.copy('bazel-bin/dotnet/strongnamed.zip', "build/dist/selenium-dotnet-strongnamed-#{dotnet_version}.zip")
-FileUtils.chmod(0o666, "build/dist/selenium-dotnet-strongnamed-#{dotnet_version}.zip")
+FileUtils.chmod(0o644, "build/dist/selenium-dotnet-strongnamed-#{dotnet_version}.zip")

-command = "git log #{tag}...HEAD --pretty=format:'%s' --reverse -- #{path}"
-log = `#{command}`
+require 'open3'
+...
+log, status = Open3.capture2('git', 'log', "#{tag}...HEAD", "--pretty=format:%s", '--reverse', '--', path.to_s)
+raise "git log failed for changelog generation (#{tag}..HEAD)" unless status.success?

+response = nil
 5.times do
-  response = Net::HTTP.get_response(uri)
+  response = Net::HTTP.start(uri.hostname, uri.port,
+                            use_ssl: uri.scheme == 'https',
+                            open_timeout: 10,
+                            read_timeout: 30) do |http|
+    http.request(Net::HTTP::Get.new(uri))
+  end
   break unless response.is_a?(Net::HTTPRedirection)
 
   uri = URI(response['location'])
 end
 
 unless response.is_a?(Net::HTTPSuccess)
   puts "  #{key}: failed (HTTP #{response.code})"
   failed << key
   next
 end
 
 sha = Digest::SHA256.hexdigest(response.body)

 task :docs do |_task, arguments|
-  args = arguments.to_a
+  args = arguments.to_a.compact
   Rake::Task['java:docs'].invoke(*args)
   Rake::Task['py:docs'].invoke(*args)
   Rake::Task['rb:docs'].invoke(*args)
   Rake::Task['dotnet:docs'].invoke(*args)
   Rake::Task['node:docs'].invoke(*args)
   Rake::Task['rust:docs'].invoke(*args)
 end

 task :build do |_task, arguments|
-  Rake::Task['java:build'].invoke(*arguments.to_a)
-  Rake::Task['py:build'].invoke(*arguments.to_a)
-  Rake::Task['rb:build'].invoke(*arguments.to_a)
-  Rake::Task['dotnet:build'].invoke(*arguments.to_a)
-  Rake::Task['node:build'].invoke(*arguments.to_a)
+  args = arguments.to_a.compact
+  Rake::Task['java:build'].invoke(*args)
+  Rake::Task['py:build'].invoke(*args)
+  Rake::Task['rb:build'].invoke(*args)
+  Rake::Task['dotnet:build'].invoke(*args)
+  Rake::Task['node:build'].invoke(*args)
 end

 task :lint do |_task, arguments|
   all_langs = %w[java py rb node dotnet rust]
-  skip = arguments.to_a.select { |a| a.start_with?('-') }.map { |a| a.delete_prefix('-') }
+  raw_args = arguments.to_a.compact.map(&:to_s)
+  skip = raw_args.select { |a| a.start_with?('-') }.map { |a| a.delete_prefix('-') }
   invalid = skip - all_langs
   raise "Unknown languages: #{invalid.join(', ')}. Valid: #{all_langs.join(', ')}" if invalid.any?

-res.body.to_s.empty? ? {} : JSON.parse(res.body)
+body = res.body.to_s.strip
+return {} if body.empty?
 
+JSON.parse(body)
+

 elsif line.include?('<username>')
-  ENV['MAVEN_USER'] = line[%r{<username>(.*?)</username>}, 1]
+  user = line[%r{<username>(.*?)</username>}, 1].to_s.strip
+  ENV['MAVEN_USER'] = user unless user.empty?
 elsif line.include?('<password>')
-  ENV['MAVEN_PASSWORD'] = line[%r{<password>(.*?)</password>}, 1]
+  pass = line[%r{<password>(.*?)</password>}, 1].to_s.strip
+  ENV['MAVEN_PASSWORD'] = pass unless pass.empty?
 end

 desc 'Update everything in preparation for a release'
 task :prep_release, [:version, :channel] do |_task, arguments|
   version = arguments[:version]
+  raise 'Missing required version: ./go prep_release[4.31.0,early-stable]' if version.nil? || version.empty?
 
-  Rake::Task['update_browsers'].invoke(arguments[:channel])
-  Rake::Task['update_cdp'].invoke(arguments[:channel])
+  channel = arguments[:channel] || 'stable'
+
+  Rake::Task['update_browsers'].invoke(channel)
+  Rake::Task['update_cdp'].invoke(channel)
   Rake::Task['update_manager'].invoke
   Rake::Task['java:update'].invoke
   Rake::Task['authors'].invoke
   Rake::Task['all:version'].invoke(version)
   Rake::Task['all:changelogs'].invoke
 end

 def read_m2_user_pass
   puts 'Maven environment variables not set, inspecting ~/.m2/settings.xml.'
-  settings = File.read("#{Dir.home}/.m2/settings.xml")
+  settings_path = File.join(Dir.home, '.m2', 'settings.xml')
+  unless File.exist?(settings_path)
+    warn "Maven settings file not found at #{settings_path}"
+    return
+  end
+
+  settings = File.read(settings_path)
   found_section = false
   settings.each_line do |line|
     if !found_section
       found_section = line.include? '<id>central</id>'
     elsif line.include?('<username>')
       ENV['MAVEN_USER'] = line[%r{<username>(.*?)</username>}, 1]
     elsif line.include?('<password>')
       ENV['MAVEN_PASSWORD'] = line[%r{<password>(.*?)</password>}, 1]
     end
     break if ENV['MAVEN_PASSWORD'] && ENV['MAVEN_USER']
   end
 end

 desc 'Run linters for all languages (skip with: ./go all:lint -rb -rust)'
 task :lint do |_task, arguments|
   all_langs = %w[java py rb node dotnet rust]
-  skip = arguments.to_a.select { |a| a.start_with?('-') }.map { |a| a.delete_prefix('-') }
-  invalid = skip - all_langs
+  args = arguments.to_a
+
+  # Only treat exact `-<lang>` tokens as skip flags; allow other `--foo` args to pass through.
+  skip_tokens, pass_through = args.partition { |a| all_langs.any? { |lang| a == "-#{lang}" } }
+  skip = skip_tokens.map { |a| a.delete_prefix('-') }
+
+  invalid = (args.grep(/\A-/).map { |a| a.delete_prefix('-') } - pass_through.grep(/\A--/).map { |a| a.delete_prefix('-') } - all_langs)
   raise "Unknown languages: #{invalid.join(', ')}. Valid: #{all_langs.join(', ')}" if invalid.any?
 
   langs = all_langs - skip
   failures = []
   langs.each do |lang|
     puts "Linting #{lang}..."
-    Rake::Task["#{lang}:lint"].invoke
+    Rake::Task["#{lang}:lint"].invoke(*pass_through)
   rescue StandardError => e
     failures << "#{lang}: #{e.message}"
   end
   raise "Lint failed:\n#{failures.join("\n")}" unless failures.empty?
 end

 to_download.each do |key|
   uri = URI("https://rubygems.org/gems/#{key}.gem")
 
+  response = nil
   5.times do
     response = Net::HTTP.get_response(uri)
     break unless response.is_a?(Net::HTTPRedirection)
 
     uri = URI(response['location'])
   end
 
   unless response.is_a?(Net::HTTPSuccess)
-    puts "  #{key}: failed (HTTP #{response.code})"
+    code = response&.code || 'no response'
+    puts "  #{key}: failed (HTTP #{code})"
     failed << key
     next
   end

 def self.verify_package_published(url)
+  url = url.to_s.strip
+  raise 'Package URL must be provided' if url.empty?
+
+  uri = URI(url)
+  raise "Unsupported URL scheme: #{uri.scheme}" unless %w[http https].include?(uri.scheme)
+
   puts "Verifying #{url}..."
-  uri = URI(url)
-  res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') { |http| http.request(Net::HTTP::Get.new(uri)) }
+  res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
+    http.request(Net::HTTP::Get.new(uri))
+  end
   raise "Package not published: #{url}" unless res.is_a?(Net::HTTPSuccess)
 
   puts 'Verified!'
 end

 FileUtils.copy('bazel-bin/dotnet/release.zip', "build/dist/selenium-dotnet-#{dotnet_version}.zip")
-FileUtils.chmod(0o666, "build/dist/selenium-dotnet-#{dotnet_version}.zip")
+FileUtils.chmod(0o644, "build/dist/selenium-dotnet-#{dotnet_version}.zip")
 FileUtils.copy('bazel-bin/dotnet/strongnamed.zip', "build/dist/selenium-dotnet-strongnamed-#{dotnet_version}.zip")
-FileUtils.chmod(0o666, "build/dist/selenium-dotnet-strongnamed-#{dotnet_version}.zip")
+FileUtils.chmod(0o644, "build/dist/selenium-dotnet-strongnamed-#{dotnet_version}.zip")

 def verify_java_release_targets
-  query = 'kind(maven_publish, set(//java/... //third_party/...))'
-  current_targets = []
-
-  Bazel.execute('query', [], query) do |output|
-    current_targets = output.lines.map(&:strip).reject(&:empty?).select { |line| line.start_with?('//') }
-  end
-
-  missing_targets = current_targets - JAVA_RELEASE_TARGETS
-  extra_targets = JAVA_RELEASE_TARGETS - current_targets
-
-  return if missing_targets.empty? && extra_targets.empty?
-
-  error_message = 'Java release targets are out of sync with Bazel query results.'
-
-  error_message += "\nMissing targets: #{missing_targets.join(', ')}" unless missing_targets.empty?
-
-  error_message += "\nObsolete targets: #{extra_targets.join(', ')}" unless extra_targets.empty?
-
-  raise error_message
+  # ...
+  missing_targets = JAVA_RELEASE_TARGETS - current_targets
+  extra_targets   = current_targets - JAVA_RELEASE_TARGETS
+  # ...
 end

 target = '//javascript/selenium-webdriver:selenium-webdriver.publish'
-target += ' -- --dry-run=true' if dry_run
-Bazel.execute('run', ['--config=release'], target)
+args = ['--config=release']
+if dry_run
+  args += ['--', '--dry-run=true']
+end
+Bazel.execute('run', args, target)

 task :lint do |_task, arguments|
   failures = []
 
-  begin
-    Rake::Task['all:lint'].invoke(*arguments.to_a)
-  rescue StandardError => e
-    failures << e.message
-  end
+  Rake::Task['all:lint'].invoke(*arguments.to_a)
 
   puts 'Linting Bazel files...'
   begin
     Bazel.execute('run', [], '//:buildifier')
   rescue StandardError => e
     failures << "buildifier: #{e.message}"
   end
 
   puts 'Linting shell scripts and GitHub Actions...'
   begin
     shellcheck = Bazel.execute('build', [], '@multitool//tools/shellcheck')
     Bazel.execute('run', ['--', '-shellcheck', shellcheck], '@multitool//tools/actionlint:cwd')
   rescue StandardError => e
     failures << "shellcheck/actionlint: #{e.message}"
   end
 
   puts 'Updating copyright headers...'
   begin
     Bazel.execute('run', [], '//scripts:update_copyright')
   rescue StandardError => e
     failures << "copyright: #{e.message}"
   end
 
   raise "Lint failed:\n#{failures.join("\n")}" unless failures.empty?
 end

 def java_release_targets
-  @targets_verified ||= verify_java_release_targets
-
+  unless @targets_verified
+    verify_java_release_targets
+    @targets_verified = true
+  end
   JAVA_RELEASE_TARGETS
 end