Add domainRepoId to Subdomain class (#674 )

* Change Subdomain class to contain domainRepoId * Remove jpaTm from Spec11PipelineTest and change clientId -> registrarId * Remove 'client' from a comment * Include changes to Spec11Pipeline * add SafeBrowsingTransforms * Run style
Upgrade to Gradle 6.5.1 (#673 )
2026-01-25 15:12:13 +00:00 · 2020-07-09 16:26:35 -07:00 · 2020-07-09 14:04:22 -04:00 · 2020-07-09 12:54:32 -04:00 · 2020-07-09 11:52:15 -04:00 · 2020-07-08 14:08:05 -04:00
1001 changed files with 30586 additions and 11395 deletions
--- a/README.md
+++ b/README.md
@@ -1,8 +1,8 @@
 # Nomulus

 | Internal Build | FOSS Build | LGTM | License | Code Search |
-|----------------|------------|------|---------|-------------|
-|[![Build Status for Google Registry internal build](https://storage.googleapis.com/domain-registry-kokoro/internal/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/internal/index.html)|[![Build Status for the open source build](https://storage.googleapis.com/domain-registry-kokoro/foss/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/foss/index.html)|[![Total alerts](https://img.shields.io/lgtm/alerts/g/google/nomulus.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/google/nomulus/alerts/)|[![License for this repo](https://img.shields.io/github/license/google/nomulus.svg)](https://github.com/google/nomulus/blob/master/LICENSE)|[![Link to Source Graph](https://sourcegraph.com/.assets/img/sourcegraph-light-head-logo.svg)](https://sourcegraph.com/github.com/google/nomulus)|
+|:--------------:|:----------:|:----:|:-------:|:-----------:|
+|[![Build Status for Google Registry internal build](https://storage.googleapis.com/domain-registry-kokoro/internal/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/internal/index.html)|[![Build Status for the open source build](https://storage.googleapis.com/domain-registry-kokoro/foss/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/foss/index.html)|[![Total alerts](https://img.shields.io/lgtm/alerts/g/google/nomulus.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/google/nomulus/alerts/)|[![License for this repo](https://img.shields.io/github/license/google/nomulus.svg)](https://github.com/google/nomulus/blob/master/LICENSE)|[![Link to Code Search](https://www.gstatic.com/devopsconsole/images/oss/favicons/oss-32x32.png)](https://cs.opensource.google/nomulus/nomulus)|

 ![Nomulus logo](./nomulus-logo.png)

@@ -33,7 +33,7 @@ running system:
 *   View the source code for the [GAE app](https://github.com/google/nomulus/tree/master/core/src/main/java/google/registry)
    and for the [GKE proxy](https://github.com/google/nomulus/tree/master/proxy/src/main/java/google/registry)
 *   [Other docs](https://github.com/google/nomulus/tree/master/docs)
-*   [Javadoc](https://nomulus.foo/javadoc/latest/)
+*   [Javadoc](https://javadoc.nomulus.foo/)
 *   [Nomulus discussion
    group](https://groups.google.com/forum/#!forum/nomulus-discuss), for any
    other questions
--- a/appengine_war.gradle
+++ b/appengine_war.gradle
@@ -31,10 +31,6 @@ def coreResourcesDir = "${rootDir}/core/build/resources/main"
 war {
    webInf {
        from "../../core/src/main/java/google/registry/env/common/${project.name}/WEB-INF"
-
-        from("${coreResourcesDir}/META-INF/persistence.xml") {
-            into "classes/META-INF"
-        }
    }
 }

--- a/build.gradle
+++ b/build.gradle
@@ -169,14 +169,15 @@ allprojects {
  if (project.name == 'services') return

  repositories {
-    if (rootProject.mavenUrl) {
+    if (!mavenUrl.isEmpty()) {
      maven {
-        println "Java dependencies: Using repo $pluginsUrl..."
-        url rootProject.mavenUrl
+        println "Java dependencies: Using repo ${mavenUrl}..."
+        url mavenUrl
      }
    } else {
      println "Java dependencies: Using Maven Central..."
      mavenCentral()
+      google()
    }
  }

@@ -196,6 +197,10 @@ task runPresubmits(type: Exec) {
  args('config/presubmits.py')
 }

+def javadocSource = []
+def javadocClasspath = []
+def javadocDependentTasks = []
+
 subprojects {
  // Skip no-op project
  if (project.name == 'services') return
@@ -316,6 +321,10 @@ subprojects {
      }
    }
  }
+
+  javadocSource << project.sourceSets.main.allJava
+  javadocClasspath << project.sourceSets.main.compileClasspath
+  javadocDependentTasks << project.tasks.compileJava
 }

 // If "-P verboseTestOutput=true" is passed in, configure all subprojects to dump all of their
@@ -444,3 +453,19 @@ task javaIncrementalFormatApply {
 }

 tasks.build.dependsOn(tasks.javaIncrementalFormatCheck)
+
+task javadoc(type: Javadoc) {
+  source javadocSource
+  classpath = files(javadocClasspath)
+  destinationDir = file("${buildDir}/docs/javadoc")
+  options.encoding = "UTF-8"
+  // In a lot of places we don't write @return so suppress warnings about that.
+  options.addBooleanOption('Xdoclint:all,-missing', true)
+  options.addBooleanOption("-allow-script-in-comments",true)
+  options.tags = ["type:a:Generic Type",
+                  "error:a:Expected Error"]
+}
+
+tasks.build.dependsOn(tasks.javadoc)
+
+javadocDependentTasks.each { tasks.javadoc.dependsOn(it) }
--- a/buildSrc/build.gradle
+++ b/buildSrc/build.gradle
@@ -12,6 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

+import static com.google.common.base.Strings.isNullOrEmpty;
+
 buildscript {
  if (project.enableDependencyLocking.toBoolean()) {
    // Lock buildscript dependencies.
@@ -40,12 +42,13 @@ if (rootProject.enableDependencyLocking.toBoolean()) {
 }

 repositories {
-  if (project.ext.properties.mavenUrl == null) {
-    println "Plugin dependencies: Using Maven central..."
+  if (isNullOrEmpty(project.ext.properties.mavenUrl)) {
+    println "Java dependencies: Using Maven central..."
    mavenCentral()
+    google()
  } else {
    maven {
-      println "Plugin dependencies: Using repo ${mavenUrl}..."
+      println "Java dependencies: Using repo ${mavenUrl}..."
      url mavenUrl
    }
  }
@@ -81,6 +84,9 @@ dependencies {
  testCompile deps['com.google.truth:truth']
  testCompile deps['com.google.truth.extensions:truth-java8-extension']
  testCompile deps['junit:junit']
+  testCompile deps['org.junit.jupiter:junit-jupiter-api']
+  testCompile deps['org.junit.jupiter:junit-jupiter-engine']
+  testCompile deps['org.junit.vintage:junit-vintage-engine']
  testCompile deps['org.mockito:mockito-core']
 }

--- a/buildSrc/gradle/dependency-locks/checkstyle.lockfile
+++ b/buildSrc/gradle/dependency-locks/checkstyle.lockfile
@@ -5,14 +5,14 @@ antlr:antlr:2.7.7
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.0-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
-com.puppycrawl.tools:checkstyle:8.24
+com.puppycrawl.tools:checkstyle:8.27
 commons-beanutils:commons-beanutils:1.9.4
 commons-collections:commons-collections:3.2.2
-info.picocli:picocli:4.0.3
-net.sf.saxon:Saxon-HE:9.9.1-4
+info.picocli:picocli:4.1.1
+net.sf.saxon:Saxon-HE:9.9.1-5
 org.antlr:antlr4-runtime:4.7.2
 org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.mojo:animal-sniffer-annotations:1.18
--- a/buildSrc/gradle/dependency-locks/compile.lockfile
+++ b/buildSrc/gradle/dependency-locks/compile.lockfile
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,8 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/compileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/compileClasspath.lockfile
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,8 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/default.lockfile
+++ b/buildSrc/gradle/dependency-locks/default.lockfile
@@ -1,61 +0,0 @@
-# This is a Gradle generated file for dependency locking.
-# Manual edits can break the build and are not advised.
-# This file is expected to be part of source control.
-aopalliance:aopalliance:1.0
-args4j:args4j:2.0.23
-com.fasterxml.jackson.core:jackson-core:2.9.9
-com.google.api-client:google-api-client:1.27.0
-com.google.api.grpc:proto-google-common-protos:1.12.0
-com.google.api.grpc:proto-google-iam-v1:0.12.0
-com.google.api:api-common:1.7.0
-com.google.api:gax-httpjson:0.52.1
-com.google.api:gax:1.35.1
-com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
-com.google.auth:google-auth-library-credentials:0.16.1
-com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
-com.google.cloud:google-cloud-core-http:1.59.0
-com.google.cloud:google-cloud-core:1.59.0
-com.google.cloud:google-cloud-storage:1.59.0
-com.google.code.findbugs:jsr305:3.0.2
-com.google.code.gson:gson:2.7
-com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.3.2
-com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
-com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
-com.google.gwt:gwt-user:2.8.0-beta1
-com.google.http-client:google-http-client-appengine:1.27.0
-com.google.http-client:google-http-client-jackson2:1.30.1
-com.google.http-client:google-http-client:1.30.1
-com.google.inject.extensions:guice-multibindings:4.1.0
-com.google.inject:guice:4.1.0
-com.google.j2objc:j2objc-annotations:1.3
-com.google.oauth-client:google-oauth-client:1.27.0
-com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
-com.google.template:soy:2018-03-14
-com.ibm.icu:icu4j:57.1
-commons-codec:commons-codec:1.11
-commons-logging:commons-logging:1.2
-io.grpc:grpc-context:1.19.0
-io.opencensus:opencensus-api:0.21.0
-io.opencensus:opencensus-contrib-http-util:0.21.0
-javax.annotation:javax.annotation-api:1.2
-javax.annotation:jsr250-api:1.0
-javax.inject:javax.inject:1
-javax.validation:validation-api:1.0.0.GA
-joda-time:joda-time:2.9.2
-org.apache.commons:commons-lang3:3.8.1
-org.apache.commons:commons-text:1.6
-org.apache.httpcomponents:httpclient:4.5.8
-org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
-org.json:json:20160212
-org.ow2.asm:asm-analysis:6.0
-org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:6.0
-org.ow2.asm:asm-util:6.0
-org.ow2.asm:asm:6.0
-org.threeten:threetenbp:1.3.3
--- a/buildSrc/gradle/dependency-locks/deploy_jar.lockfile
+++ b/buildSrc/gradle/dependency-locks/deploy_jar.lockfile
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,8 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/runtime.lockfile
+++ b/buildSrc/gradle/dependency-locks/runtime.lockfile
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,8 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,8 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/testCompile.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompile.lockfile
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,19 +50,26 @@ javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
 junit:junit:4.13
-net.bytebuddy:byte-buddy-agent:1.9.7
-net.bytebuddy:byte-buddy:1.9.7
+net.bytebuddy:byte-buddy-agent:1.10.5
+net.bytebuddy:byte-buddy:1.10.5
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
+org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
-org.mockito:mockito-core:2.25.0
+org.junit.jupiter:junit-jupiter-api:5.6.1
+org.junit.jupiter:junit-jupiter-engine:5.6.1
+org.junit.platform:junit-platform-commons:1.6.1
+org.junit.platform:junit-platform-engine:1.6.1
+org.junit.vintage:junit-vintage-engine:5.6.1
+org.junit:junit-bom:5.6.1
+org.mockito:mockito-core:3.3.3
 org.objenesis:objenesis:2.6
+org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
 org.ow2.asm:asm-tree:6.0
--- a/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,19 +50,26 @@ javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
 junit:junit:4.13
-net.bytebuddy:byte-buddy-agent:1.9.7
-net.bytebuddy:byte-buddy:1.9.7
+net.bytebuddy:byte-buddy-agent:1.10.5
+net.bytebuddy:byte-buddy:1.10.5
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
+org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
-org.mockito:mockito-core:2.25.0
+org.junit.jupiter:junit-jupiter-api:5.6.1
+org.junit.jupiter:junit-jupiter-engine:5.6.1
+org.junit.platform:junit-platform-commons:1.6.1
+org.junit.platform:junit-platform-engine:1.6.1
+org.junit.vintage:junit-vintage-engine:5.6.1
+org.junit:junit-bom:5.6.1
+org.mockito:mockito-core:3.3.3
 org.objenesis:objenesis:2.6
+org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
 org.ow2.asm:asm-tree:6.0
--- a/buildSrc/gradle/dependency-locks/testRuntime.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntime.lockfile
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,19 +50,26 @@ javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
 junit:junit:4.13
-net.bytebuddy:byte-buddy-agent:1.9.7
-net.bytebuddy:byte-buddy:1.9.7
+net.bytebuddy:byte-buddy-agent:1.10.5
+net.bytebuddy:byte-buddy:1.10.5
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
+org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
-org.mockito:mockito-core:2.25.0
+org.junit.jupiter:junit-jupiter-api:5.6.1
+org.junit.jupiter:junit-jupiter-engine:5.6.1
+org.junit.platform:junit-platform-commons:1.6.1
+org.junit.platform:junit-platform-engine:1.6.1
+org.junit.vintage:junit-vintage-engine:5.6.1
+org.junit:junit-bom:5.6.1
+org.mockito:mockito-core:3.3.3
 org.objenesis:objenesis:2.6
+org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
 org.ow2.asm:asm-tree:6.0
--- a/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,19 +50,26 @@ javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
 junit:junit:4.13
-net.bytebuddy:byte-buddy-agent:1.9.7
-net.bytebuddy:byte-buddy:1.9.7
+net.bytebuddy:byte-buddy-agent:1.10.5
+net.bytebuddy:byte-buddy:1.10.5
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
+org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
-org.mockito:mockito-core:2.25.0
+org.junit.jupiter:junit-jupiter-api:5.6.1
+org.junit.jupiter:junit-jupiter-engine:5.6.1
+org.junit.platform:junit-platform-commons:1.6.1
+org.junit.platform:junit-platform-engine:1.6.1
+org.junit.vintage:junit-vintage-engine:5.6.1
+org.junit:junit-bom:5.6.1
+org.mockito:mockito-core:3.3.3
 org.objenesis:objenesis:2.6
+org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
 org.ow2.asm:asm-tree:6.0
--- a/buildSrc/src/main/java/google/registry/gradle/plugin/CoverPageGenerator.java
+++ b/buildSrc/src/main/java/google/registry/gradle/plugin/CoverPageGenerator.java
@@ -29,6 +29,7 @@ import google.registry.gradle.plugin.ProjectData.TaskData;
 import java.io.File;
 import java.nio.file.Path;
 import java.nio.file.Paths;
+import java.util.Map;
 import java.util.function.Supplier;
 import java.util.stream.Collectors;

@@ -162,7 +163,7 @@ final class CoverPageGenerator {
            task.reports().entrySet().stream()
                .collect(
                    toImmutableMap(
-                        entry -> entry.getKey(),
+                        Map.Entry::getKey,
                        entry ->
                            entry.getValue().files().isEmpty()
                                ? ""
--- a/buildSrc/src/main/java/google/registry/gradle/plugin/GcsPluginUtils.java
+++ b/buildSrc/src/main/java/google/registry/gradle/plugin/GcsPluginUtils.java
@@ -168,7 +168,7 @@ final class GcsPluginUtils {
            .collect(
                toImmutableMap(
                    file -> rootDir.relativize(toNormalizedPath(file)),
-                    file -> toByteArraySupplier(file)));
+                    GcsPluginUtils::toByteArraySupplier));

    if (files.isEmpty()) {
      // The directory exists, but is empty. Return empty FilesWithEntryPoint
--- a/common/build.gradle
+++ b/common/build.gradle
@@ -62,4 +62,7 @@ dependencies {
  testingCompile deps['io.github.java-diff-utils:java-diff-utils']

  testCompile deps['junit:junit']
+  testCompile deps['org.junit.jupiter:junit-jupiter-api']
+  testCompile deps['org.junit.jupiter:junit-jupiter-engine']
+  testCompile deps['org.junit.vintage:junit-vintage-engine']
 }
--- a/common/gradle/dependency-locks/checkstyle.lockfile
+++ b/common/gradle/dependency-locks/checkstyle.lockfile
@@ -5,14 +5,14 @@ antlr:antlr:2.7.7
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.0-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
-com.puppycrawl.tools:checkstyle:8.24
+com.puppycrawl.tools:checkstyle:8.27
 commons-beanutils:commons-beanutils:1.9.4
 commons-collections:commons-collections:3.2.2
-info.picocli:picocli:4.0.3
-net.sf.saxon:Saxon-HE:9.9.1-4
+info.picocli:picocli:4.1.1
+net.sf.saxon:Saxon-HE:9.9.1-5
 org.antlr:antlr4-runtime:4.7.2
 org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.mojo:animal-sniffer-annotations:1.18
--- a/common/gradle/dependency-locks/compile.lockfile
+++ b/common/gradle/dependency-locks/compile.lockfile
@@ -2,12 +2,11 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
--- a/common/gradle/dependency-locks/compileClasspath.lockfile
+++ b/common/gradle/dependency-locks/compileClasspath.lockfile
@@ -2,12 +2,11 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
--- a/common/gradle/dependency-locks/default.lockfile
+++ b/common/gradle/dependency-locks/default.lockfile
@@ -2,12 +2,11 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
--- a/common/gradle/dependency-locks/deploy_jar.lockfile
+++ b/common/gradle/dependency-locks/deploy_jar.lockfile
@@ -2,12 +2,11 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
--- a/common/gradle/dependency-locks/runtime.lockfile
+++ b/common/gradle/dependency-locks/runtime.lockfile
@@ -2,12 +2,11 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
--- a/common/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -2,12 +2,11 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
--- a/common/gradle/dependency-locks/testCompile.lockfile
+++ b/common/gradle/dependency-locks/testCompile.lockfile
@@ -3,10 +3,10 @@
 # This file is expected to be part of source control.
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -15,8 +15,15 @@ io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.13
+org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
+org.junit.jupiter:junit-jupiter-api:5.6.1
+org.junit.jupiter:junit-jupiter-engine:5.6.1
+org.junit.platform:junit-platform-commons:1.6.1
+org.junit.platform:junit-platform-engine:1.6.1
+org.junit.vintage:junit-vintage-engine:5.6.1
+org.junit:junit-bom:5.6.1
+org.opentest4j:opentest4j:1.2.0
--- a/common/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/common/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -3,10 +3,10 @@
 # This file is expected to be part of source control.
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -15,8 +15,15 @@ io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.13
+org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
+org.junit.jupiter:junit-jupiter-api:5.6.1
+org.junit.jupiter:junit-jupiter-engine:5.6.1
+org.junit.platform:junit-platform-commons:1.6.1
+org.junit.platform:junit-platform-engine:1.6.1
+org.junit.vintage:junit-vintage-engine:5.6.1
+org.junit:junit-bom:5.6.1
+org.opentest4j:opentest4j:1.2.0
--- a/common/gradle/dependency-locks/testRuntime.lockfile
+++ b/common/gradle/dependency-locks/testRuntime.lockfile
@@ -3,11 +3,11 @@
 # This file is expected to be part of source control.
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -16,8 +16,15 @@ io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.13
+org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
+org.junit.jupiter:junit-jupiter-api:5.6.1
+org.junit.jupiter:junit-jupiter-engine:5.6.1
+org.junit.platform:junit-platform-commons:1.6.1
+org.junit.platform:junit-platform-engine:1.6.1
+org.junit.vintage:junit-vintage-engine:5.6.1
+org.junit:junit-bom:5.6.1
+org.opentest4j:opentest4j:1.2.0
--- a/common/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -3,11 +3,11 @@
 # This file is expected to be part of source control.
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -16,8 +16,15 @@ io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.13
+org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
+org.junit.jupiter:junit-jupiter-api:5.6.1
+org.junit.jupiter:junit-jupiter-engine:5.6.1
+org.junit.platform:junit-platform-commons:1.6.1
+org.junit.platform:junit-platform-engine:1.6.1
+org.junit.vintage:junit-vintage-engine:5.6.1
+org.junit:junit-bom:5.6.1
+org.opentest4j:opentest4j:1.2.0
--- a/common/gradle/dependency-locks/testingCompile.lockfile
+++ b/common/gradle/dependency-locks/testingCompile.lockfile
@@ -3,10 +3,10 @@
 # This file is expected to be part of source control.
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -16,7 +16,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingCompileClasspath.lockfile
+++ b/common/gradle/dependency-locks/testingCompileClasspath.lockfile
@@ -3,10 +3,10 @@
 # This file is expected to be part of source control.
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -16,7 +16,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingRuntime.lockfile
+++ b/common/gradle/dependency-locks/testingRuntime.lockfile
@@ -3,11 +3,11 @@
 # This file is expected to be part of source control.
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,7 +17,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingRuntimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/testingRuntimeClasspath.lockfile
@@ -3,11 +3,11 @@
 # This file is expected to be part of source control.
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,7 +17,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.checkerframework:checker-qual:2.11.1
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/src/main/java/google/registry/util/Sleeper.java
+++ b/common/src/main/java/google/registry/util/Sleeper.java
@@ -21,7 +21,6 @@ import org.joda.time.ReadableDuration;
 * An object which accepts requests to put the current thread to sleep.
 *
 * @see SystemSleeper
- * @see google.registry.testing.FakeSleeper
 */
@ThreadSafe
 public interface Sleeper {
--- a/config/dependency-license/allowed_licenses.json
+++ b/config/dependency-license/allowed_licenses.json
@@ -144,6 +144,9 @@
    {
      "moduleLicense": "Eclipse Public License 2.0"
    },
+    {
+      "moduleLicense": "Eclipse Public License v2.0"
+    },
    {
      "moduleLicense": "https://www.eclipse.org/legal/epl-2.0/, http://www.gnu.org/copyleft/gpl.html, http://www.gnu.org/licenses/lgpl.html"
    },
@@ -224,6 +227,11 @@
      "moduleLicense": "Public Domain",
      "moduleName": "org.tukaani:xz"
    },
+    {
+      // Actually Eclipse Public License v2.0
+      "moduleLicense": null,
+      "moduleName": "org.junit:junit-bom"
+    },
    {
      "moduleLicense": "The W3C Software License"
    }
--- a/config/nom_build.py
+++ b/config/nom_build.py
@@ -0,0 +1,327 @@
+# Copyright 2020 The Nomulus Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Script to generate dr-build and the properties file.
+"""
+
+import argparse
+import attr
+import io
+import os
+import subprocess
+import sys
+from typing import List, Union
+
+
+@attr.s(auto_attribs=True)
+class Property:
+    name : str = ''
+    desc : str = ''
+    default : str = ''
+    constraints : type = str
+
+    def validate(self, value: str):
+        """Verify that "value" is appropriate for the property."""
+        if type is bool:
+            if value not in ('true', 'false'):
+                raise ValidationError('value of {self.name} must be "true" or '
+                                      '"false".')
+
+@attr.s(auto_attribs=True)
+class GradleFlag:
+    flags : Union[str, List[str]]
+    desc : str
+    has_arg : bool = False
+
+
+PROPERTIES_HEADER = """\
+# This file defines properties used by the gradle build.  It must be kept in
+# sync with config/nom_build.py.
+#
+# To regenerate, run config/nom_build.py --generate-gradle-properties
+#
+# To view property descriptions (which are command line flags for
+# nom_build), run config/nom_build.py --help.
+#
+# DO NOT EDIT THIS FILE BY HAND
+org.gradle.jvmargs=-Xmx1024m
+"""
+
+# Define all of our special gradle properties here.
+PROPERTIES = [
+    Property('mavenUrl',
+             'URL to use for the main maven repository (defaults to maven '
+             'central).  This can be http(s) or a "gcs" repo.'),
+    Property('pluginsUrl',
+             'URL to use for the gradle plugins repository (defaults to maven '
+             'central, see also mavenUrl'),
+    Property('uploaderDestination',
+             'Location to upload test reports to.  Normally this should be a '
+             'GCS url (see also uploaderCredentialsFile)'),
+    Property('uploaderCredentialsFile',
+             'json credentials file to use to upload test reports.'),
+    Property('uploaderMultithreadedUpload',
+             'Whether to enable multithread upload.'),
+    Property('verboseTestOutput',
+             'If true, show all test output in near-realtime.',
+             'false',
+             bool),
+    Property('flowDocsFile',
+             'Output filename for the flowDocsTool command.'),
+    Property('enableDependencyLocking',
+             'Enables dependency locking.',
+             'true',
+             bool),
+    Property('enableCrossReferencing',
+             'generate metadata during java compile (used for kythe source '
+             'reference generation).',
+             'false'),
+    Property('testFilter',
+             'Comma separated list of test patterns, if specified run only '
+             'these.'),
+    Property('environment', 'GAE Environment for deployment and staging.'),
+
+    # Cloud SQL properties
+    Property('dbServer',
+             'A registry environment name (e.g., "alpha") or a host[:port] '
+             'string'),
+    Property('dbName',
+             'Database name to use in connection.',
+             'postgres'),
+    Property('dbUser', 'Database user name for use in connection'),
+    Property('dbPassword', 'Database password for use in connection'),
+
+    Property('publish_repo',
+             'Maven repository that hosts the Cloud SQL schema jar and the '
+             'registry server test jars. Such jars are needed for '
+             'server/schema integration tests. Please refer to <a '
+             'href="./integration/README.md">integration project</a> for more '
+             'information.'),
+    Property('schema_version',
+             'The nomulus version tag of the schema for use in a database'
+             'integration test.'),
+    Property('nomulus_version',
+             'The version of nomulus to test against in a database '
+             'integration test.'),
+]
+
+GRADLE_FLAGS = [
+    GradleFlag(['-a', '--no-rebuild'],
+               'Do not rebuild project dependencies.'),
+    GradleFlag(['-b', '--build-file'], 'Specify the build file.', True),
+    GradleFlag(['--build-cache'],
+               'Enables the Gradle build cache. Gradle will try to reuse '
+               'outputs from previous builds.'),
+    GradleFlag(['-c', '--settings-file'], 'Specify the settings file.', True),
+    GradleFlag(['--configure-on-demand'],
+               'Configure necessary projects only. Gradle will attempt to '
+               'reduce configuration time for large multi-project builds. '
+               '[incubating]'),
+    GradleFlag(['--console'],
+               'Specifies which type of console output to generate. Values '
+               "are 'plain', 'auto' (default), 'rich' or 'verbose'.",
+               True),
+    GradleFlag(['--continue'], 'Continue task execution after a task failure.'),
+    GradleFlag(['-D', '--system-prop'],
+               'Set system property of the JVM (e.g. -Dmyprop=myvalue).',
+               True),
+    GradleFlag(['-d', '--debug'],
+               'Log in debug mode (includes normal stacktrace).'),
+    GradleFlag(['--daemon'],
+               'Uses the Gradle Daemon to run the build. Starts the Daemon '
+               'if not running.'),
+    GradleFlag(['--foreground'], 'Starts the Gradle Daemon in the foreground.'),
+    GradleFlag(['-g', '--gradle-user-home'],
+               'Specifies the gradle user home directory.',
+               True),
+    GradleFlag(['-I', '--init-script'], 'Specify an initialization script.',
+               True),
+    GradleFlag(['-i', '--info'], 'Set log level to info.'),
+    GradleFlag(['--include-build'],
+               'Include the specified build in the composite.',
+               True),
+    GradleFlag(['-m', '--dry-run'],
+               'Run the builds with all task actions disabled.'),
+    GradleFlag(['--max-workers'],
+               'Configure the number of concurrent workers Gradle is '
+               'allowed to use.',
+               True),
+    GradleFlag(['--no-build-cache'], 'Disables the Gradle build cache.'),
+    GradleFlag(['--no-configure-on-demand'],
+               'Disables the use of configuration on demand. [incubating]'),
+    GradleFlag(['--no-daemon'],
+               'Do not use the Gradle daemon to run the build. Useful '
+               'occasionally if you have configured Gradle to always run '
+               'with the daemon by default.'),
+    GradleFlag(['--no-parallel'],
+               'Disables parallel execution to build projects.'),
+    GradleFlag(['--no-scan'],
+               'Disables the creation of a build scan. For more information '
+               'about build scans, please visit '
+               'https://gradle.com/build-scans.'),
+    GradleFlag(['--offline'],
+               'Execute the build without accessing network resources.'),
+    GradleFlag(['-P', '--project-prop'],
+               'Set project property for the build script (e.g. '
+               '-Pmyprop=myvalue).',
+               True),
+    GradleFlag(['-p', '--project-dir'],
+               'Specifies the start directory for Gradle. Defaults to '
+               'current directory.'),
+    GradleFlag(['--parallel'],
+               'Build projects in parallel. Gradle will attempt to '
+               'determine the optimal number of executor threads to use.'),
+    GradleFlag(['--priority'],
+               'Specifies the scheduling priority for the Gradle daemon and '
+               "all processes launched by it. Values are 'normal' (default) "
+               "or 'low' [incubating]",
+               True),
+    GradleFlag(['--profile'],
+               'Profile build execution time and generates a report in the '
+               '<build_dir>/reports/profile directory.'),
+    GradleFlag(['--project-cache-dir'],
+               'Specify the project-specific cache directory. Defaults to '
+               '.gradle in the root project directory.',
+               True),
+    GradleFlag(['-q', '--quiet'], 'Log errors only.'),
+    GradleFlag(['--refresh-dependencies'], 'Refresh the state of dependencies.'),
+    GradleFlag(['--rerun-tasks'], 'Ignore previously cached task results.'),
+    GradleFlag(['-S', '--full-stacktrace'],
+               'Print out the full (very verbose) stacktrace for all '
+               'exceptions.'),
+    GradleFlag(['-s', '--stacktrace'],
+               'Print out the stacktrace for all exceptions.'),
+    GradleFlag(['--scan'],
+               'Creates a build scan. Gradle will emit a warning if the '
+               'build scan plugin has not been applied. '
+               '(https://gradle.com/build-scans)'),
+    GradleFlag(['--status'],
+               'Shows status of running and recently stopped Gradle '
+               'Daemon(s).'),
+    GradleFlag(['--stop'], 'Stops the Gradle Daemon if it is running.'),
+    GradleFlag(['-t', '--continuous'],
+               'Enables continuous build. Gradle does not exit and will '
+               're-execute tasks when task file inputs change.'),
+    GradleFlag(['--update-locks'],
+               'Perform a partial update of the dependency lock, letting '
+               'passed in module notations change version. [incubating]'),
+    GradleFlag(['-v', '--version'], 'Print version info.'),
+    GradleFlag(['-w', '--warn'], 'Set log level to warn.'),
+    GradleFlag(['--warning-mode'],
+               'Specifies which mode of warnings to generate. Values are '
+               "'all', 'fail', 'summary'(default) or 'none'",
+               True),
+    GradleFlag(['--write-locks'],
+               'Persists dependency resolution for locked configurations, '
+               'ignoring existing locking information if it exists '
+               '[incubating]'),
+    GradleFlag(['-x', '--exclude-task'],
+               'Specify a task to be excluded from execution.',
+               True),
+]
+def generate_gradle_properties() -> str:
+    """Returns the expected contents of gradle.properties."""
+    out = io.StringIO()
+    out.write(PROPERTIES_HEADER)
+
+    for prop in PROPERTIES:
+        out.write(f'{prop.name}={prop.default}\n')
+
+    return out.getvalue()
+
+
+def get_root() -> str:
+    """Returns the root of the nomulus build tree."""
+    cur_dir = os.getcwd()
+    if not os.path.exists(os.path.join(cur_dir, '.git')) or \
+       not os.path.exists(os.path.join(cur_dir, 'core')) or \
+       not os.path.exists(os.path.join(cur_dir, 'gradle.properties')):
+        raise Exception('You must run this script from the root directory')
+    return cur_dir
+
+
+def main(args):
+    parser = argparse.ArgumentParser('nom_build')
+    for prop in PROPERTIES:
+        parser.add_argument('--' + prop.name, default=prop.default,
+                            help=prop.desc)
+
+    # Add Gradle flags.  We set 'dest' to the first flag to get a name that is
+    # predictable for getattr (even though it will have a leading '-' and thus
+    # we can't use normal python attribute syntax to get it).
+    for flag in GRADLE_FLAGS:
+        if flag.has_arg:
+            parser.add_argument(*flag.flags, dest=flag.flags[0],
+                                help=flag.desc)
+        else:
+            parser.add_argument(*flag.flags, dest=flag.flags[0],
+                                help=flag.desc,
+                                action='store_true')
+
+    # Add a flag to regenerate the gradle properties file.
+    parser.add_argument('--generate-gradle-properties',
+                        help='Regenerate the gradle.properties file.  This '
+                        'file must be regenerated when changes are made to '
+                        'config/nom_build.py, and should not be updated by '
+                        'hand.',
+                        action='store_true')
+
+    # Consume the remaining non-flag arguments.
+    parser.add_argument('non_flag_args', nargs='*')
+
+    # Parse command line arguments. Note that this exits the program and
+    # prints usage if either of the help options (-h, --help) are specified.
+    args = parser.parse_args(args)
+
+    gradle_properties = generate_gradle_properties()
+    root = get_root()
+
+    # If we're regenerating properties, do so and exit.
+    if args.generate_gradle_properties:
+        with open(f'{root}/gradle.properties', 'w') as dst:
+            dst.write(gradle_properties)
+        return
+
+    # Verify that the gradle properties file is what we expect it to be.
+    with open(f'{root}/gradle.properties') as src:
+        if src.read() != gradle_properties:
+            print('\033[33mWARNING:\033[0m Gradle properties out of sync '
+                  'with nom_build.  Run with --generate-gradle-properties '
+                  'to regenerate.')
+
+    # Add properties to the gradle argument list.
+    gradle_command = [f'{root}/gradlew']
+    for prop in PROPERTIES:
+        arg_val = getattr(args, prop.name)
+        if arg_val != prop.default:
+            prop.validate(arg_val)
+            gradle_command.extend(['-P', f'{prop.name}={arg_val}'])
+
+    # Add Gradle flags to the gradle argument list.
+    for flag in GRADLE_FLAGS:
+        arg_val = getattr(args, flag.flags[0])
+        if arg_val:
+            gradle_command.append(flag.flags[-1])
+            if flag.has_arg:
+                gradle_command.append(arg_val)
+
+    # Add the non-flag args (we exclude the first, which is the command name
+    # itself) and run.
+    gradle_command.extend(args.non_flag_args[1:])
+    subprocess.call(gradle_command)
+
+
+if __name__ == '__main__':
+    main(sys.argv)
+
--- a/config/nom_build_test.py
+++ b/config/nom_build_test.py
@@ -0,0 +1,109 @@
+# Copyright 2020 The Nomulus Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import io
+import os
+import unittest
+from unittest import mock
+import nom_build
+import subprocess
+
+FAKE_PROPERTIES = [
+    nom_build.Property('foo', 'help text'),
+    nom_build.Property('bar', 'more text', 'true', bool),
+]
+
+FAKE_PROP_CONTENTS = nom_build.PROPERTIES_HEADER + 'foo=\nbar=true\n'
+PROPERTIES_FILENAME = '/tmp/rootdir/gradle.properties'
+GRADLEW = '/tmp/rootdir/gradlew'
+
+
+class FileFake(io.StringIO):
+    """File fake that writes file contents to the dictionary on close."""
+    def __init__(self, contents_dict, filename):
+        self.dict = contents_dict
+        self.filename = filename
+        super(FileFake, self).__init__()
+
+    def close(self):
+        self.dict[self.filename] = self.getvalue()
+        super(FileFake, self).close()
+
+
+class MyTest(unittest.TestCase):
+
+    def open_fake(self, filename, action='r'):
+        if action == 'r':
+            return io.StringIO(self.file_contents.get(filename, ''))
+        elif action == 'w':
+            result = self.file_contents[filename] = (
+                FileFake(self.file_contents, filename))
+            return result
+        else:
+            raise Exception(f'Unexpected action {action}')
+
+    def print_fake(self, data):
+        self.printed.append(data)
+
+    def setUp(self):
+        self.addCleanup(mock.patch.stopall)
+        self.exists_mock = mock.patch.object(os.path, 'exists').start()
+        self.getcwd_mock = mock.patch.object(os, 'getcwd').start()
+        self.getcwd_mock.return_value = '/tmp/rootdir'
+        self.open_mock = (
+            mock.patch.object(nom_build, 'open', self.open_fake).start())
+        self.print_mock = (
+            mock.patch.object(nom_build, 'print', self.print_fake).start())
+
+        self.call_mock = mock.patch.object(subprocess, 'call').start()
+
+        self.file_contents = {
+            # Prefil with the actual file contents.
+            PROPERTIES_FILENAME: nom_build.generate_gradle_properties()
+        }
+        self.printed = []
+
+    @mock.patch.object(nom_build, 'PROPERTIES', FAKE_PROPERTIES)
+    def test_property_generation(self):
+        self.assertEqual(nom_build.generate_gradle_properties(),
+                         FAKE_PROP_CONTENTS)
+
+    @mock.patch.object(nom_build, 'PROPERTIES', FAKE_PROPERTIES)
+    def test_property_file_write(self):
+        nom_build.main(['nom_build', '--generate-gradle-properties'])
+        self.assertEqual(self.file_contents[PROPERTIES_FILENAME],
+                         FAKE_PROP_CONTENTS)
+
+    def test_property_file_incorrect(self):
+        self.file_contents[PROPERTIES_FILENAME] = 'bad contents'
+        nom_build.main(['nom_build'])
+        self.assertIn('', self.printed[0])
+
+    def test_no_args(self):
+        nom_build.main(['nom_build'])
+        self.assertEqual(self.printed, [])
+        self.call_mock.assert_called_with([GRADLEW])
+
+    def test_property_calls(self):
+        nom_build.main(['nom_build', '--testFilter=foo'])
+        self.call_mock.assert_called_with([GRADLEW, '-P', 'testFilter=foo'])
+
+    def test_gradle_flags(self):
+        nom_build.main(['nom_build', '-d', '-b', 'foo'])
+        self.call_mock.assert_called_with([GRADLEW, '--build-file', 'foo',
+                                          '--debug'])
+
+unittest.main()
+
+
--- a/config/presubmits.py
+++ b/config/presubmits.py
@@ -99,6 +99,15 @@ PRESUBMITS = {
        "System.(out|err).println is only allowed in tools/ packages. Please "
        "use a logger instead.",

+    # ObjectifyService.register is restricted to main/ or AppEngineRule.
+    PresubmitCheck(
+        r".*\bObjectifyService\.register", "java", {
+            "/build/", "/generated/", "node_modules/", "src/main/",
+            "AppEngineRule.java"
+        }):
+      "ObjectifyService.register is not allowed in tests. Please use "
+      "AppengineRule.register instead.",
+
    # PostgreSQLContainer instantiation must specify docker tag
    PresubmitCheck(
        r"[\s\S]*new\s+PostgreSQLContainer(<[\s\S]*>)?\(\s*\)[\s\S]*",
--- a/core/WEB-INF/appengine-generated/local_db.bin
+++ b/core/WEB-INF/appengine-generated/local_db.bin
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -177,6 +177,8 @@ dependencies {

  compile deps['com.beust:jcommander']
  compile deps['com.google.api-client:google-api-client']
+  compile deps['com.google.api-client:google-api-client-appengine']
+  compile deps['com.google.api-client:google-api-client-servlet']
  compile deps['com.google.monitoring-client:metrics']
  compile deps['com.google.monitoring-client:stackdriver']
  compile deps['com.google.api-client:google-api-client-java6']
@@ -197,6 +199,7 @@ dependencies {
  compile deps['com.google.appengine:appengine-remote-api']
  compile deps['com.google.auth:google-auth-library-credentials']
  compile deps['com.google.auth:google-auth-library-oauth2-http']
+  compile deps['com.google.cloud.sql:jdbc-socket-factory-core']
  runtimeOnly deps['com.google.cloud.sql:postgres-socket-factory']
  compile deps['com.google.code.gson:gson']
  compile deps['com.google.auto.value:auto-value-annotations']
@@ -215,6 +218,8 @@ dependencies {
  compile deps['com.google.oauth-client:google-oauth-client']
  compile deps['com.google.oauth-client:google-oauth-client-java6']
  compile deps['com.google.oauth-client:google-oauth-client-jetty']
+  compile deps['com.google.oauth-client:google-oauth-client-appengine']
+  compile deps['com.google.oauth-client:google-oauth-client-servlet']
  compile deps['com.google.re2j:re2j']
  compile deps['com.google.template:soy']
  compile deps['com.googlecode.json-simple:json-simple']
@@ -261,7 +266,9 @@ dependencies {
  testCompile deps['org.seleniumhq.selenium:selenium-chrome-driver']
  testCompile deps['org.seleniumhq.selenium:selenium-java']
  testCompile deps['org.seleniumhq.selenium:selenium-remote-driver']
+  runtimeOnly deps['org.slf4j:slf4j-jdk14']
  testCompile deps['org.testcontainers:jdbc']
+  testCompile deps['org.testcontainers:junit-jupiter']
  compile deps['org.testcontainers:postgresql']
  testCompile deps['org.testcontainers:selenium']
  testCompile deps['org.testcontainers:testcontainers']
@@ -289,6 +296,8 @@ dependencies {
  testAnnotationProcessor deps['com.google.auto.value:auto-value']
  annotationProcessor deps['com.google.dagger:dagger-compiler']
  testAnnotationProcessor deps['com.google.dagger:dagger-compiler']
+  annotationProcessor project(':processor')
+  testAnnotationProcessor project(':processor')

  testCompile deps['com.google.appengine:appengine-testing']
  testCompile deps['com.google.guava:guava-testlib']
@@ -300,7 +309,14 @@ dependencies {
  testCompile deps['org.hamcrest:hamcrest-library']
  compile deps['org.hibernate:hibernate-hikaricp']
  testCompile deps['junit:junit']
+  testCompile deps['org.junit.jupiter:junit-jupiter-api']
+  testCompile deps['org.junit.jupiter:junit-jupiter-engine']
+  testCompile deps['org.junit.jupiter:junit-jupiter-migrationsupport']
+  testCompile deps['org.junit.platform:junit-platform-runner']
+  testCompile deps['org.junit.platform:junit-platform-suite-api']
+  testCompile deps['org.junit.vintage:junit-vintage-engine']
  testCompile deps['org.mockito:mockito-core']
+  testCompile deps['org.mockito:mockito-junit-jupiter']
  runtime deps['org.postgresql:postgresql']

  // Indirect dependency found by undeclared-dependency check. Such
@@ -636,6 +652,10 @@ artifacts {
 */
 class FilteringTest extends Test {

+  FilteringTest() {
+    useJUnitPlatform();
+  }
+
  private void applyTestFilter() {
    if (project.testFilter) {
      testNameIncludePatterns = project.testFilter.split(',')
@@ -691,7 +711,10 @@ task outcastTest(type: FilteringTest) {
  tests = outcastTestPatterns

  // Sets the maximum number of test executors that may exist at the same time.
-  maxParallelForks 5
+  // Note that this number appears to contribute to NoClassDefFoundError
+  // exceptions on certain machines and distros. The root cause is unclear.
+  // Try reducing this number if you experience similar problems.
+  maxParallelForks 3
 }

 // Whitebox test verifying that RegistryTool can be instantiated. Note the
@@ -723,6 +746,10 @@ task registryToolIntegrationTest {

 // Dedicated test suite for schema-dependent tests.
 task sqlIntegrationTest(type: FilteringTest) {
+  // TestSuite still requires a JUnit 4 runner, which knows how to handle JUnit 5 tests.
+  // Here we need to override parent's choice of JUnit 5. If changing this, remember to
+  // change :integration:sqlIntegrationTest too.
+  useJUnit()
  excludeTestCases = false
  tests = ['google/registry/schema/integration/SqlIntegrationTestSuite.*']
 }
@@ -842,6 +869,8 @@ task standardTest(type: FilteringTest) {
  includeAllTests()
  exclude fragileTestPatterns
  exclude outcastTestPatterns
+  // See SqlIntegrationTestSuite.java
+  exclude '**/*BeforeSuiteTest.*', '**/*AfterSuiteTest.*'

  if (rootProject.findProperty("skipDockerIncompatibleTests") == "true") {
    exclude dockerIncompatibleTestPatterns
@@ -853,6 +882,9 @@ task standardTest(type: FilteringTest) {
  // forkEvery 1

  // Sets the maximum number of test executors that may exist at the same time.
+  // Also, Gradle executes tests in 1 thread and some of our test infrastructures
+  // depend on that, e.g. DualDatabaseTestInvocationContextProvider injects
+  // different implementation of TransactionManager into TransactionManagerFactory.
  maxParallelForks 5

  systemProperty 'test.projectRoot', rootProject.projectRootDir
@@ -867,17 +899,21 @@ test {
  // Don't run any tests from this task, all testing gets done in the
  // FilteringTest tasks.
  exclude "**"
-}.dependsOn(fragileTest, outcastTest, standardTest, registryToolIntegrationTest)
+  // TODO(weiminyu): Remove dependency on sqlIntegrationTest
+}.dependsOn(fragileTest, outcastTest, standardTest, registryToolIntegrationTest, sqlIntegrationTest)

 createUberJar('nomulus', 'nomulus', 'google.registry.tools.RegistryTool')

 // A jar with classes and resources from main sourceSet, excluding internal
 // data. See comments on configurations.nomulus_test above for details.
+// TODO(weiminyu): release process should build this using the public repo to eliminate the need
+// for excludes.
 task nomulusFossJar (type: Jar) {
  archiveBaseName = 'nomulus'
  archiveClassifier = 'public'
  from (project.sourceSets.main.output) {
    exclude 'google/registry/config/files/**'
+    exclude 'google/registry/proxy/config/**'
  }
  from (project.sourceSets.main.output) {
    include 'google/registry/config/files/default-config.yaml'
--- a/core/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/annotationProcessor.lockfile
@@ -7,29 +7,34 @@ com.google.auto.value:auto-value:1.6.3
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.dagger:dagger-compiler:2.21
-com.google.dagger:dagger-producers:2.21
-com.google.dagger:dagger-spi:2.21
-com.google.dagger:dagger:2.21
+com.google.dagger:dagger-compiler:2.28
+com.google.dagger:dagger-producers:2.28
+com.google.dagger:dagger-spi:2.28
+com.google.dagger:dagger:2.28
 com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.errorprone:error_prone_check_api:2.3.3
 com.google.errorprone:error_prone_core:2.3.3
 com.google.errorprone:error_prone_type_annotations:2.3.3
 com.google.errorprone:javac-shaded:9-dev-r4023-3
 com.google.googlejavaformat:google-java-format:1.5
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.0.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
-com.google.j2objc:j2objc-annotations:1.1
+com.google.j2objc:j2objc-annotations:1.3
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-com.squareup:javapoet:1.11.1
+com.squareup:javapoet:1.12.1
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
+javax.persistence:javax.persistence-api:2.2
+net.ltgt.gradle.incap:incap:0.2
 org.checkerframework:checker-compat-qual:2.5.3
-org.checkerframework:checker-qual:2.5.3
+org.checkerframework:checker-qual:2.11.1
 org.checkerframework:dataflow:2.5.3
 org.checkerframework:javacutil:2.5.3
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.jetbrains.kotlin:kotlin-stdlib-common:1.3.61
+org.jetbrains.kotlin:kotlin-stdlib:1.3.61
+org.jetbrains.kotlinx:kotlinx-metadata-jvm:0.1.0
+org.jetbrains:annotations:13.0
 org.pcollections:pcollections:2.1.2
--- a/core/gradle/dependency-locks/checkstyle.lockfile
+++ b/core/gradle/dependency-locks/checkstyle.lockfile
@@ -5,14 +5,14 @@ antlr:antlr:2.7.7
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.0-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
-com.puppycrawl.tools:checkstyle:8.24
+com.puppycrawl.tools:checkstyle:8.27
 commons-beanutils:commons-beanutils:1.9.4
 commons-collections:commons-collections:3.2.2
-info.picocli:picocli:4.0.3
-net.sf.saxon:Saxon-HE:9.9.1-4
+info.picocli:picocli:4.1.1
+net.sf.saxon:Saxon-HE:9.9.1-5
 org.antlr:antlr4-runtime:4.7.2
 org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.mojo:animal-sniffer-annotations:1.18
--- a/core/gradle/dependency-locks/compile.lockfile
+++ b/core/gradle/dependency-locks/compile.lockfile
@@ -1,20 +1,29 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+androidx.annotation:annotation:1.1.0
 antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.10
-com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.10.2
 com.fasterxml.jackson.core:jackson-databind:2.9.10
-com.fasterxml:classmate:1.3.4
-com.google.api-client:google-api-client-appengine:1.30.7
+com.fasterxml:classmate:1.5.1
+com.github.jnr:jffi:1.2.23
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.15
+com.github.jnr:jnr-enxio:0.26
+com.github.jnr:jnr-ffi:2.1.13
+com.github.jnr:jnr-posix:3.0.55
+com.github.jnr:jnr-unixsocket:0.30
+com.github.jnr:jnr-x86asm:1.0.2
+com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.30.7
-com.google.api-client:google-api-client:1.30.7
+com.google.api-client:google-api-client-servlet:1.30.8
+com.google.api-client:google-api-client:1.30.8
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -50,6 +59,7 @@ com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -57,14 +67,15 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.16.1
-com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auth:google-auth-library-credentials:0.20.0
+com.google.auth:google-auth-library-oauth2-http:0.20.0
+com.google.auto.value:auto-value-annotations:1.7
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -75,20 +86,20 @@ com.google.cloud:google-cloud-spanner:1.6.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.5
 com.google.common.html.types:types:1.0.4
-com.google.dagger:dagger:2.21
-com.google.errorprone:error_prone_annotations:2.3.3
+com.google.dagger:dagger:2.28
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.0
-com.google.http-client:google-http-client-jackson2:1.32.1
+com.google.http-client:google-http-client-appengine:1.34.1
+com.google.http-client:google-http-client-jackson2:1.34.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.34.0
+com.google.http-client:google-http-client:1.34.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -153,7 +164,7 @@ io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
-javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:javax.annotation-api:1.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
@@ -166,9 +177,9 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.9.11
-net.java.dev.jna:jna-platform:5.3.1
-net.java.dev.jna:jna:5.3.1
+net.bytebuddy:byte-buddy:1.10.10
+net.java.dev.jna:jna-platform:5.5.0
+net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.16.0
 org.apache.beam:beam-model-pipeline:2.16.0
@@ -181,30 +192,30 @@ org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
 org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
 org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.10
-org.apache.httpcomponents:httpcore:4.4.12
+org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpcore:4.4.13
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
-org.checkerframework:checker-qual:2.8.1
+org.checkerframework:checker-qual:2.11.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
-org.dom4j:dom4j:2.1.1
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.4.Final
-org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.hibernate:hibernate-core:5.4.17.Final
+org.hibernate:hibernate-hikaricp:5.4.17.Final
 org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
-org.jboss:jandex:2.0.5.Final
-org.jetbrains:annotations:17.0.0
+org.jboss:jandex:2.1.3.Final
+org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
@@ -212,20 +223,20 @@ org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2
-org.ow2.asm:asm-analysis:6.0
-org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:6.0
-org.ow2.asm:asm-util:6.0
-org.ow2.asm:asm:6.0
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm-util:8.0.1
+org.ow2.asm:asm:8.0.1
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
-org.slf4j:slf4j-api:1.7.28
-org.testcontainers:database-commons:1.12.1
-org.testcontainers:jdbc:1.12.1
-org.testcontainers:postgresql:1.12.1
-org.testcontainers:testcontainers:1.12.1
+org.slf4j:slf4j-api:1.7.30
+org.testcontainers:database-commons:1.14.3
+org.testcontainers:jdbc:1.14.3
+org.testcontainers:postgresql:1.14.3
+org.testcontainers:testcontainers:1.14.3
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/compileClasspath.lockfile
+++ b/core/gradle/dependency-locks/compileClasspath.lockfile
@@ -1,20 +1,29 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+androidx.annotation:annotation:1.1.0
 antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.10
-com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.10.2
 com.fasterxml.jackson.core:jackson-databind:2.9.10
-com.fasterxml:classmate:1.3.4
-com.google.api-client:google-api-client-appengine:1.30.7
+com.fasterxml:classmate:1.5.1
+com.github.jnr:jffi:1.2.23
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.15
+com.github.jnr:jnr-enxio:0.26
+com.github.jnr:jnr-ffi:2.1.13
+com.github.jnr:jnr-posix:3.0.55
+com.github.jnr:jnr-unixsocket:0.30
+com.github.jnr:jnr-x86asm:1.0.2
+com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.30.7
-com.google.api-client:google-api-client:1.30.7
+com.google.api-client:google-api-client-servlet:1.30.8
+com.google.api-client:google-api-client:1.30.8
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -50,6 +59,7 @@ com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -57,14 +67,15 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.16.1
-com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auth:google-auth-library-credentials:0.20.0
+com.google.auth:google-auth-library-oauth2-http:0.20.0
+com.google.auto.value:auto-value-annotations:1.7
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -75,19 +86,19 @@ com.google.cloud:google-cloud-spanner:1.6.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.5
 com.google.common.html.types:types:1.0.4
-com.google.dagger:dagger:2.21
-com.google.errorprone:error_prone_annotations:2.3.3
+com.google.dagger:dagger:2.28
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.0
-com.google.http-client:google-http-client-jackson2:1.32.1
+com.google.http-client:google-http-client-appengine:1.34.1
+com.google.http-client:google-http-client-jackson2:1.34.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.34.0
+com.google.http-client:google-http-client:1.34.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -151,7 +162,7 @@ io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
-javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:javax.annotation-api:1.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
@@ -163,9 +174,9 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
-net.bytebuddy:byte-buddy:1.9.11
-net.java.dev.jna:jna-platform:5.3.1
-net.java.dev.jna:jna:5.3.1
+net.bytebuddy:byte-buddy:1.10.10
+net.java.dev.jna:jna-platform:5.5.0
+net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.16.0
 org.apache.beam:beam-model-pipeline:2.16.0
@@ -178,49 +189,49 @@ org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
 org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
 org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.10
-org.apache.httpcomponents:httpcore:4.4.12
+org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpcore:4.4.13
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
-org.checkerframework:checker-qual:2.8.1
+org.checkerframework:checker-qual:2.11.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
-org.dom4j:dom4j:2.1.1
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.4.Final
-org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.hibernate:hibernate-core:5.4.17.Final
+org.hibernate:hibernate-hikaricp:5.4.17.Final
 org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
-org.jboss:jandex:2.0.5.Final
-org.jetbrains:annotations:17.0.0
+org.jboss:jandex:2.1.3.Final
+org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2
-org.ow2.asm:asm-analysis:6.0
-org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:6.0
-org.ow2.asm:asm-util:6.0
-org.ow2.asm:asm:6.0
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm-util:8.0.1
+org.ow2.asm:asm:8.0.1
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
-org.slf4j:slf4j-api:1.7.28
-org.testcontainers:database-commons:1.12.1
-org.testcontainers:jdbc:1.12.1
-org.testcontainers:postgresql:1.12.1
-org.testcontainers:testcontainers:1.12.1
+org.slf4j:slf4j-api:1.7.30
+org.testcontainers:database-commons:1.14.3
+org.testcontainers:jdbc:1.14.3
+org.testcontainers:postgresql:1.14.3
+org.testcontainers:testcontainers:1.14.3
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/default.lockfile
+++ b/core/gradle/dependency-locks/default.lockfile
@@ -1,28 +1,29 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+androidx.annotation:annotation:1.1.0
 antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.10
-com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.10.2
 com.fasterxml.jackson.core:jackson-databind:2.9.10
-com.fasterxml:classmate:1.3.4
-com.github.jnr:jffi:1.2.17
+com.fasterxml:classmate:1.5.1
+com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
-com.github.jnr:jnr-constants:0.9.11
-com.github.jnr:jnr-enxio:0.19
-com.github.jnr:jnr-ffi:2.1.9
-com.github.jnr:jnr-posix:3.0.47
-com.github.jnr:jnr-unixsocket:0.21
+com.github.jnr:jnr-constants:0.9.15
+com.github.jnr:jnr-enxio:0.26
+com.github.jnr:jnr-ffi:2.1.13
+com.github.jnr:jnr-posix:3.0.55
+com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.api-client:google-api-client-appengine:1.30.7
+com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.30.7
-com.google.api-client:google-api-client:1.30.7
+com.google.api-client:google-api-client-servlet:1.30.8
+com.google.api-client:google-api-client:1.30.8
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -58,7 +59,7 @@ com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
-com.google.apis:google-api-services-sqladmin:v1beta4-rev56-1.23.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -66,16 +67,16 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.16.1
-com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auth:google-auth-library-credentials:0.20.0
+com.google.auth:google-auth-library-oauth2-http:0.20.0
+com.google.auto.value:auto-value-annotations:1.7
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
-com.google.cloud.sql:jdbc-socket-factory-core:1.0.12
-com.google.cloud.sql:postgres-socket-factory:1.0.12
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
+com.google.cloud.sql:postgres-socket-factory:1.0.16
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -86,20 +87,20 @@ com.google.cloud:google-cloud-spanner:1.6.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.5
 com.google.common.html.types:types:1.0.4
-com.google.dagger:dagger:2.21
-com.google.errorprone:error_prone_annotations:2.3.3
+com.google.dagger:dagger:2.28
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.0
-com.google.http-client:google-http-client-jackson2:1.32.1
+com.google.http-client:google-http-client-appengine:1.34.1
+com.google.http-client:google-http-client-jackson2:1.34.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.34.0
+com.google.http-client:google-http-client:1.34.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -164,7 +165,7 @@ io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
-javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:javax.annotation-api:1.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
@@ -177,9 +178,9 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.9.11
-net.java.dev.jna:jna-platform:5.3.1
-net.java.dev.jna:jna:5.3.1
+net.bytebuddy:byte-buddy:1.10.10
+net.java.dev.jna:jna-platform:5.5.0
+net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.16.0
 org.apache.beam:beam-model-pipeline:2.16.0
@@ -192,30 +193,30 @@ org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
 org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
 org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.10
-org.apache.httpcomponents:httpcore:4.4.12
+org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpcore:4.4.13
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
-org.checkerframework:checker-qual:2.8.1
+org.checkerframework:checker-qual:2.11.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
-org.dom4j:dom4j:2.1.1
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.4.Final
-org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.hibernate:hibernate-core:5.4.17.Final
+org.hibernate:hibernate-hikaricp:5.4.17.Final
 org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
-org.jboss:jandex:2.0.5.Final
-org.jetbrains:annotations:17.0.0
+org.jboss:jandex:2.1.3.Final
+org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
@@ -223,21 +224,22 @@ org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2
-org.ow2.asm:asm-analysis:7.0
-org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:7.0
-org.ow2.asm:asm-util:7.0
-org.ow2.asm:asm:7.0
-org.postgresql:postgresql:42.2.6
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm-util:8.0.1
+org.ow2.asm:asm:8.0.1
+org.postgresql:postgresql:42.2.14
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
-org.slf4j:slf4j-api:1.7.28
-org.testcontainers:database-commons:1.12.1
-org.testcontainers:jdbc:1.12.1
-org.testcontainers:postgresql:1.12.1
-org.testcontainers:testcontainers:1.12.1
+org.slf4j:slf4j-api:1.7.30
+org.slf4j:slf4j-jdk14:1.7.28
+org.testcontainers:database-commons:1.14.3
+org.testcontainers:jdbc:1.14.3
+org.testcontainers:postgresql:1.14.3
+org.testcontainers:testcontainers:1.14.3
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/deploy_jar.lockfile
+++ b/core/gradle/dependency-locks/deploy_jar.lockfile
@@ -1,28 +1,29 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+androidx.annotation:annotation:1.1.0
 antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.10
-com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.10.2
 com.fasterxml.jackson.core:jackson-databind:2.9.10
-com.fasterxml:classmate:1.3.4
-com.github.jnr:jffi:1.2.17
+com.fasterxml:classmate:1.5.1
+com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
-com.github.jnr:jnr-constants:0.9.11
-com.github.jnr:jnr-enxio:0.19
-com.github.jnr:jnr-ffi:2.1.9
-com.github.jnr:jnr-posix:3.0.47
-com.github.jnr:jnr-unixsocket:0.21
+com.github.jnr:jnr-constants:0.9.15
+com.github.jnr:jnr-enxio:0.26
+com.github.jnr:jnr-ffi:2.1.13
+com.github.jnr:jnr-posix:3.0.55
+com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.api-client:google-api-client-appengine:1.30.7
+com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.30.7
-com.google.api-client:google-api-client:1.30.7
+com.google.api-client:google-api-client-servlet:1.30.8
+com.google.api-client:google-api-client:1.30.8
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -58,7 +59,7 @@ com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
-com.google.apis:google-api-services-sqladmin:v1beta4-rev56-1.23.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -66,16 +67,16 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.16.1
-com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auth:google-auth-library-credentials:0.20.0
+com.google.auth:google-auth-library-oauth2-http:0.20.0
+com.google.auto.value:auto-value-annotations:1.7
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
-com.google.cloud.sql:jdbc-socket-factory-core:1.0.12
-com.google.cloud.sql:postgres-socket-factory:1.0.12
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
+com.google.cloud.sql:postgres-socket-factory:1.0.16
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -86,20 +87,20 @@ com.google.cloud:google-cloud-spanner:1.6.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.5
 com.google.common.html.types:types:1.0.4
-com.google.dagger:dagger:2.21
-com.google.errorprone:error_prone_annotations:2.3.3
+com.google.dagger:dagger:2.28
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.0
-com.google.http-client:google-http-client-jackson2:1.32.1
+com.google.http-client:google-http-client-appengine:1.34.1
+com.google.http-client:google-http-client-jackson2:1.34.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.34.0
+com.google.http-client:google-http-client:1.34.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -164,7 +165,7 @@ io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
-javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:javax.annotation-api:1.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
@@ -176,9 +177,9 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
-net.bytebuddy:byte-buddy:1.9.11
-net.java.dev.jna:jna-platform:5.3.1
-net.java.dev.jna:jna:5.3.1
+net.bytebuddy:byte-buddy:1.10.10
+net.java.dev.jna:jna-platform:5.5.0
+net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.16.0
 org.apache.beam:beam-model-pipeline:2.16.0
@@ -191,50 +192,51 @@ org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
 org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
 org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.10
-org.apache.httpcomponents:httpcore:4.4.12
+org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpcore:4.4.13
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
-org.checkerframework:checker-qual:2.8.1
+org.checkerframework:checker-qual:2.11.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
-org.dom4j:dom4j:2.1.1
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.4.Final
-org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.hibernate:hibernate-core:5.4.17.Final
+org.hibernate:hibernate-hikaricp:5.4.17.Final
 org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
-org.jboss:jandex:2.0.5.Final
-org.jetbrains:annotations:17.0.0
+org.jboss:jandex:2.1.3.Final
+org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2
-org.ow2.asm:asm-analysis:7.0
-org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:7.0
-org.ow2.asm:asm-util:7.0
-org.ow2.asm:asm:7.0
-org.postgresql:postgresql:42.2.6
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm-util:8.0.1
+org.ow2.asm:asm:8.0.1
+org.postgresql:postgresql:42.2.14
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
-org.slf4j:slf4j-api:1.7.28
-org.testcontainers:database-commons:1.12.1
-org.testcontainers:jdbc:1.12.1
-org.testcontainers:postgresql:1.12.1
-org.testcontainers:testcontainers:1.12.1
+org.slf4j:slf4j-api:1.7.30
+org.slf4j:slf4j-jdk14:1.7.28
+org.testcontainers:database-commons:1.14.3
+org.testcontainers:jdbc:1.14.3
+org.testcontainers:postgresql:1.14.3
+org.testcontainers:testcontainers:1.14.3
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/nonprodCompile.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompile.lockfile
@@ -1,20 +1,29 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+androidx.annotation:annotation:1.1.0
 antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.10
-com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.10.2
 com.fasterxml.jackson.core:jackson-databind:2.9.10
-com.fasterxml:classmate:1.3.4
-com.google.api-client:google-api-client-appengine:1.30.7
+com.fasterxml:classmate:1.5.1
+com.github.jnr:jffi:1.2.23
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.15
+com.github.jnr:jnr-enxio:0.26
+com.github.jnr:jnr-ffi:2.1.13
+com.github.jnr:jnr-posix:3.0.55
+com.github.jnr:jnr-unixsocket:0.30
+com.github.jnr:jnr-x86asm:1.0.2
+com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.30.7
-com.google.api-client:google-api-client:1.30.7
+com.google.api-client:google-api-client-servlet:1.30.8
+com.google.api-client:google-api-client:1.30.8
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -50,6 +59,7 @@ com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -57,14 +67,15 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.16.1
-com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auth:google-auth-library-credentials:0.20.0
+com.google.auth:google-auth-library-oauth2-http:0.20.0
+com.google.auto.value:auto-value-annotations:1.7
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -75,20 +86,20 @@ com.google.cloud:google-cloud-spanner:1.6.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.5
 com.google.common.html.types:types:1.0.4
-com.google.dagger:dagger:2.21
-com.google.errorprone:error_prone_annotations:2.3.3
+com.google.dagger:dagger:2.28
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.0
-com.google.http-client:google-http-client-jackson2:1.32.1
+com.google.http-client:google-http-client-appengine:1.34.1
+com.google.http-client:google-http-client-jackson2:1.34.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.34.0
+com.google.http-client:google-http-client:1.34.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -153,7 +164,7 @@ io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
-javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:javax.annotation-api:1.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
@@ -166,9 +177,9 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.9.11
-net.java.dev.jna:jna-platform:5.3.1
-net.java.dev.jna:jna:5.3.1
+net.bytebuddy:byte-buddy:1.10.10
+net.java.dev.jna:jna-platform:5.5.0
+net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.16.0
 org.apache.beam:beam-model-pipeline:2.16.0
@@ -181,30 +192,30 @@ org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
 org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
 org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.10
-org.apache.httpcomponents:httpcore:4.4.12
+org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpcore:4.4.13
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
-org.checkerframework:checker-qual:2.8.1
+org.checkerframework:checker-qual:2.11.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
-org.dom4j:dom4j:2.1.1
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.4.Final
-org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.hibernate:hibernate-core:5.4.17.Final
+org.hibernate:hibernate-hikaricp:5.4.17.Final
 org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
-org.jboss:jandex:2.0.5.Final
-org.jetbrains:annotations:17.0.0
+org.jboss:jandex:2.1.3.Final
+org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
@@ -212,20 +223,20 @@ org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2
-org.ow2.asm:asm-analysis:6.0
-org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:6.0
-org.ow2.asm:asm-util:6.0
-org.ow2.asm:asm:6.0
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm-util:8.0.1
+org.ow2.asm:asm:8.0.1
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
-org.slf4j:slf4j-api:1.7.28
-org.testcontainers:database-commons:1.12.1
-org.testcontainers:jdbc:1.12.1
-org.testcontainers:postgresql:1.12.1
-org.testcontainers:testcontainers:1.12.1
+org.slf4j:slf4j-api:1.7.30
+org.testcontainers:database-commons:1.14.3
+org.testcontainers:jdbc:1.14.3
+org.testcontainers:postgresql:1.14.3
+org.testcontainers:testcontainers:1.14.3
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/nonprodCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompileClasspath.lockfile
@@ -1,20 +1,29 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+androidx.annotation:annotation:1.1.0
 antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.10
-com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.10.2
 com.fasterxml.jackson.core:jackson-databind:2.9.10
-com.fasterxml:classmate:1.3.4
-com.google.api-client:google-api-client-appengine:1.30.7
+com.fasterxml:classmate:1.5.1
+com.github.jnr:jffi:1.2.23
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.15
+com.github.jnr:jnr-enxio:0.26
+com.github.jnr:jnr-ffi:2.1.13
+com.github.jnr:jnr-posix:3.0.55
+com.github.jnr:jnr-unixsocket:0.30
+com.github.jnr:jnr-x86asm:1.0.2
+com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.30.7
-com.google.api-client:google-api-client:1.30.7
+com.google.api-client:google-api-client-servlet:1.30.8
+com.google.api-client:google-api-client:1.30.8
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -50,6 +59,7 @@ com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -57,14 +67,15 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.16.1
-com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auth:google-auth-library-credentials:0.20.0
+com.google.auth:google-auth-library-oauth2-http:0.20.0
+com.google.auto.value:auto-value-annotations:1.7
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -75,19 +86,19 @@ com.google.cloud:google-cloud-spanner:1.6.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.5
 com.google.common.html.types:types:1.0.4
-com.google.dagger:dagger:2.21
-com.google.errorprone:error_prone_annotations:2.3.3
+com.google.dagger:dagger:2.28
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.0
-com.google.http-client:google-http-client-jackson2:1.32.1
+com.google.http-client:google-http-client-appengine:1.34.1
+com.google.http-client:google-http-client-jackson2:1.34.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.34.0
+com.google.http-client:google-http-client:1.34.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -151,7 +162,7 @@ io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
-javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:javax.annotation-api:1.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
@@ -164,9 +175,9 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.9.11
-net.java.dev.jna:jna-platform:5.3.1
-net.java.dev.jna:jna:5.3.1
+net.bytebuddy:byte-buddy:1.10.10
+net.java.dev.jna:jna-platform:5.5.0
+net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.16.0
 org.apache.beam:beam-model-pipeline:2.16.0
@@ -179,30 +190,30 @@ org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
 org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
 org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.10
-org.apache.httpcomponents:httpcore:4.4.12
+org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpcore:4.4.13
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
-org.checkerframework:checker-qual:2.8.1
+org.checkerframework:checker-qual:2.11.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
-org.dom4j:dom4j:2.1.1
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.4.Final
-org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.hibernate:hibernate-core:5.4.17.Final
+org.hibernate:hibernate-hikaricp:5.4.17.Final
 org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
-org.jboss:jandex:2.0.5.Final
-org.jetbrains:annotations:17.0.0
+org.jboss:jandex:2.1.3.Final
+org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
@@ -210,20 +221,20 @@ org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2
-org.ow2.asm:asm-analysis:6.0
-org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:6.0
-org.ow2.asm:asm-util:6.0
-org.ow2.asm:asm:6.0
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm-util:8.0.1
+org.ow2.asm:asm:8.0.1
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
-org.slf4j:slf4j-api:1.7.28
-org.testcontainers:database-commons:1.12.1
-org.testcontainers:jdbc:1.12.1
-org.testcontainers:postgresql:1.12.1
-org.testcontainers:testcontainers:1.12.1
+org.slf4j:slf4j-api:1.7.30
+org.testcontainers:database-commons:1.14.3
+org.testcontainers:jdbc:1.14.3
+org.testcontainers:postgresql:1.14.3
+org.testcontainers:testcontainers:1.14.3
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/nonprodRuntime.lockfile
+++ b/core/gradle/dependency-locks/nonprodRuntime.lockfile
@@ -1,20 +1,29 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+androidx.annotation:annotation:1.1.0
 antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.10
-com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.10.2
 com.fasterxml.jackson.core:jackson-databind:2.9.10
-com.fasterxml:classmate:1.3.4
-com.google.api-client:google-api-client-appengine:1.30.7
+com.fasterxml:classmate:1.5.1
+com.github.jnr:jffi:1.2.23
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.15
+com.github.jnr:jnr-enxio:0.26
+com.github.jnr:jnr-ffi:2.1.13
+com.github.jnr:jnr-posix:3.0.55
+com.github.jnr:jnr-unixsocket:0.30
+com.github.jnr:jnr-x86asm:1.0.2
+com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.30.7
-com.google.api-client:google-api-client:1.30.7
+com.google.api-client:google-api-client-servlet:1.30.8
+com.google.api-client:google-api-client:1.30.8
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -50,6 +59,7 @@ com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -57,14 +67,15 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.16.1
-com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auth:google-auth-library-credentials:0.20.0
+com.google.auth:google-auth-library-oauth2-http:0.20.0
+com.google.auto.value:auto-value-annotations:1.7
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -75,20 +86,20 @@ com.google.cloud:google-cloud-spanner:1.6.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.5
 com.google.common.html.types:types:1.0.4
-com.google.dagger:dagger:2.21
-com.google.errorprone:error_prone_annotations:2.3.3
+com.google.dagger:dagger:2.28
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.0
-com.google.http-client:google-http-client-jackson2:1.32.1
+com.google.http-client:google-http-client-appengine:1.34.1
+com.google.http-client:google-http-client-jackson2:1.34.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.34.0
+com.google.http-client:google-http-client:1.34.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -153,7 +164,7 @@ io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
-javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:javax.annotation-api:1.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
@@ -166,9 +177,9 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.9.11
-net.java.dev.jna:jna-platform:5.3.1
-net.java.dev.jna:jna:5.3.1
+net.bytebuddy:byte-buddy:1.10.10
+net.java.dev.jna:jna-platform:5.5.0
+net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.16.0
 org.apache.beam:beam-model-pipeline:2.16.0
@@ -181,30 +192,30 @@ org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
 org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
 org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.10
-org.apache.httpcomponents:httpcore:4.4.12
+org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpcore:4.4.13
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
-org.checkerframework:checker-qual:2.8.1
+org.checkerframework:checker-qual:2.11.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
-org.dom4j:dom4j:2.1.1
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.4.Final
-org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.hibernate:hibernate-core:5.4.17.Final
+org.hibernate:hibernate-hikaricp:5.4.17.Final
 org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
-org.jboss:jandex:2.0.5.Final
-org.jetbrains:annotations:17.0.0
+org.jboss:jandex:2.1.3.Final
+org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
@@ -212,21 +223,21 @@ org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2
-org.ow2.asm:asm-analysis:6.0
-org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:6.0
-org.ow2.asm:asm-util:6.0
-org.ow2.asm:asm:6.0
-org.postgresql:postgresql:42.2.6
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm-util:8.0.1
+org.ow2.asm:asm:8.0.1
+org.postgresql:postgresql:42.2.14
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
-org.slf4j:slf4j-api:1.7.28
-org.testcontainers:database-commons:1.12.1
-org.testcontainers:jdbc:1.12.1
-org.testcontainers:postgresql:1.12.1
-org.testcontainers:testcontainers:1.12.1
+org.slf4j:slf4j-api:1.7.30
+org.testcontainers:database-commons:1.14.3
+org.testcontainers:jdbc:1.14.3
+org.testcontainers:postgresql:1.14.3
+org.testcontainers:testcontainers:1.14.3
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/nonprodRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/nonprodRuntimeClasspath.lockfile
@@ -1,20 +1,29 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+androidx.annotation:annotation:1.1.0
 antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.10
-com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.10.2
 com.fasterxml.jackson.core:jackson-databind:2.9.10
-com.fasterxml:classmate:1.3.4
-com.google.api-client:google-api-client-appengine:1.30.7
+com.fasterxml:classmate:1.5.1
+com.github.jnr:jffi:1.2.23
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.15
+com.github.jnr:jnr-enxio:0.26
+com.github.jnr:jnr-ffi:2.1.13
+com.github.jnr:jnr-posix:3.0.55
+com.github.jnr:jnr-unixsocket:0.30
+com.github.jnr:jnr-x86asm:1.0.2
+com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.30.7
-com.google.api-client:google-api-client:1.30.7
+com.google.api-client:google-api-client-servlet:1.30.8
+com.google.api-client:google-api-client:1.30.8
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -50,6 +59,7 @@ com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -57,14 +67,15 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.16.1
-com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auth:google-auth-library-credentials:0.20.0
+com.google.auth:google-auth-library-oauth2-http:0.20.0
+com.google.auto.value:auto-value-annotations:1.7
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -75,20 +86,20 @@ com.google.cloud:google-cloud-spanner:1.6.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.5
 com.google.common.html.types:types:1.0.4
-com.google.dagger:dagger:2.21
-com.google.errorprone:error_prone_annotations:2.3.3
+com.google.dagger:dagger:2.28
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.0
-com.google.http-client:google-http-client-jackson2:1.32.1
+com.google.http-client:google-http-client-appengine:1.34.1
+com.google.http-client:google-http-client-jackson2:1.34.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.34.0
+com.google.http-client:google-http-client:1.34.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -153,7 +164,7 @@ io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
-javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:javax.annotation-api:1.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
@@ -166,9 +177,9 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.9.11
-net.java.dev.jna:jna-platform:5.3.1
-net.java.dev.jna:jna:5.3.1
+net.bytebuddy:byte-buddy:1.10.10
+net.java.dev.jna:jna-platform:5.5.0
+net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.16.0
 org.apache.beam:beam-model-pipeline:2.16.0
@@ -181,30 +192,30 @@ org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
 org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
 org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.10
-org.apache.httpcomponents:httpcore:4.4.12
+org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpcore:4.4.13
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
-org.checkerframework:checker-qual:2.8.1
+org.checkerframework:checker-qual:2.11.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
-org.dom4j:dom4j:2.1.1
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.4.Final
-org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.hibernate:hibernate-core:5.4.17.Final
+org.hibernate:hibernate-hikaricp:5.4.17.Final
 org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
-org.jboss:jandex:2.0.5.Final
-org.jetbrains:annotations:17.0.0
+org.jboss:jandex:2.1.3.Final
+org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
@@ -212,21 +223,21 @@ org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2
-org.ow2.asm:asm-analysis:6.0
-org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:6.0
-org.ow2.asm:asm-util:6.0
-org.ow2.asm:asm:6.0
-org.postgresql:postgresql:42.2.6
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm-util:8.0.1
+org.ow2.asm:asm:8.0.1
+org.postgresql:postgresql:42.2.14
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
-org.slf4j:slf4j-api:1.7.28
-org.testcontainers:database-commons:1.12.1
-org.testcontainers:jdbc:1.12.1
-org.testcontainers:postgresql:1.12.1
-org.testcontainers:testcontainers:1.12.1
+org.slf4j:slf4j-api:1.7.30
+org.testcontainers:database-commons:1.14.3
+org.testcontainers:jdbc:1.14.3
+org.testcontainers:postgresql:1.14.3
+org.testcontainers:testcontainers:1.14.3
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/runtime.lockfile
+++ b/core/gradle/dependency-locks/runtime.lockfile
@@ -1,20 +1,29 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+androidx.annotation:annotation:1.1.0
 antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.10
-com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.10.2
 com.fasterxml.jackson.core:jackson-databind:2.9.10
-com.fasterxml:classmate:1.3.4
-com.google.api-client:google-api-client-appengine:1.30.7
+com.fasterxml:classmate:1.5.1
+com.github.jnr:jffi:1.2.23
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.15
+com.github.jnr:jnr-enxio:0.26
+com.github.jnr:jnr-ffi:2.1.13
+com.github.jnr:jnr-posix:3.0.55
+com.github.jnr:jnr-unixsocket:0.30
+com.github.jnr:jnr-x86asm:1.0.2
+com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.30.7
-com.google.api-client:google-api-client:1.30.7
+com.google.api-client:google-api-client-servlet:1.30.8
+com.google.api-client:google-api-client:1.30.8
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -50,6 +59,7 @@ com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -57,14 +67,15 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.16.1
-com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auth:google-auth-library-credentials:0.20.0
+com.google.auth:google-auth-library-oauth2-http:0.20.0
+com.google.auto.value:auto-value-annotations:1.7
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -75,20 +86,20 @@ com.google.cloud:google-cloud-spanner:1.6.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.5
 com.google.common.html.types:types:1.0.4
-com.google.dagger:dagger:2.21
-com.google.errorprone:error_prone_annotations:2.3.3
+com.google.dagger:dagger:2.28
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.0
-com.google.http-client:google-http-client-jackson2:1.32.1
+com.google.http-client:google-http-client-appengine:1.34.1
+com.google.http-client:google-http-client-jackson2:1.34.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.34.0
+com.google.http-client:google-http-client:1.34.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -153,7 +164,7 @@ io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
-javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:javax.annotation-api:1.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
@@ -166,9 +177,9 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.9.11
-net.java.dev.jna:jna-platform:5.3.1
-net.java.dev.jna:jna:5.3.1
+net.bytebuddy:byte-buddy:1.10.10
+net.java.dev.jna:jna-platform:5.5.0
+net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.16.0
 org.apache.beam:beam-model-pipeline:2.16.0
@@ -181,30 +192,30 @@ org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
 org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
 org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.10
-org.apache.httpcomponents:httpcore:4.4.12
+org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpcore:4.4.13
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
-org.checkerframework:checker-qual:2.8.1
+org.checkerframework:checker-qual:2.11.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
-org.dom4j:dom4j:2.1.1
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.4.Final
-org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.hibernate:hibernate-core:5.4.17.Final
+org.hibernate:hibernate-hikaricp:5.4.17.Final
 org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
-org.jboss:jandex:2.0.5.Final
-org.jetbrains:annotations:17.0.0
+org.jboss:jandex:2.1.3.Final
+org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
@@ -212,21 +223,21 @@ org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2
-org.ow2.asm:asm-analysis:6.0
-org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:6.0
-org.ow2.asm:asm-util:6.0
-org.ow2.asm:asm:6.0
-org.postgresql:postgresql:42.2.6
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm-util:8.0.1
+org.ow2.asm:asm:8.0.1
+org.postgresql:postgresql:42.2.14
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
-org.slf4j:slf4j-api:1.7.28
-org.testcontainers:database-commons:1.12.1
-org.testcontainers:jdbc:1.12.1
-org.testcontainers:postgresql:1.12.1
-org.testcontainers:testcontainers:1.12.1
+org.slf4j:slf4j-api:1.7.30
+org.testcontainers:database-commons:1.14.3
+org.testcontainers:jdbc:1.14.3
+org.testcontainers:postgresql:1.14.3
+org.testcontainers:testcontainers:1.14.3
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -1,28 +1,29 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+androidx.annotation:annotation:1.1.0
 antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.10
-com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.10.2
 com.fasterxml.jackson.core:jackson-databind:2.9.10
-com.fasterxml:classmate:1.3.4
-com.github.jnr:jffi:1.2.17
+com.fasterxml:classmate:1.5.1
+com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
-com.github.jnr:jnr-constants:0.9.11
-com.github.jnr:jnr-enxio:0.19
-com.github.jnr:jnr-ffi:2.1.9
-com.github.jnr:jnr-posix:3.0.47
-com.github.jnr:jnr-unixsocket:0.21
+com.github.jnr:jnr-constants:0.9.15
+com.github.jnr:jnr-enxio:0.26
+com.github.jnr:jnr-ffi:2.1.13
+com.github.jnr:jnr-posix:3.0.55
+com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.api-client:google-api-client-appengine:1.30.7
+com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.30.7
-com.google.api-client:google-api-client:1.30.7
+com.google.api-client:google-api-client-servlet:1.30.8
+com.google.api-client:google-api-client:1.30.8
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -58,7 +59,7 @@ com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
-com.google.apis:google-api-services-sqladmin:v1beta4-rev56-1.23.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -66,16 +67,16 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.16.1
-com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auth:google-auth-library-credentials:0.20.0
+com.google.auth:google-auth-library-oauth2-http:0.20.0
+com.google.auto.value:auto-value-annotations:1.7
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
-com.google.cloud.sql:jdbc-socket-factory-core:1.0.12
-com.google.cloud.sql:postgres-socket-factory:1.0.12
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
+com.google.cloud.sql:postgres-socket-factory:1.0.16
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -86,20 +87,20 @@ com.google.cloud:google-cloud-spanner:1.6.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.5
 com.google.common.html.types:types:1.0.4
-com.google.dagger:dagger:2.21
-com.google.errorprone:error_prone_annotations:2.3.3
+com.google.dagger:dagger:2.28
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.0
-com.google.http-client:google-http-client-jackson2:1.32.1
+com.google.http-client:google-http-client-appengine:1.34.1
+com.google.http-client:google-http-client-jackson2:1.34.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.34.0
+com.google.http-client:google-http-client:1.34.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -164,7 +165,7 @@ io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
-javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:javax.annotation-api:1.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
@@ -176,9 +177,9 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
-net.bytebuddy:byte-buddy:1.9.11
-net.java.dev.jna:jna-platform:5.3.1
-net.java.dev.jna:jna:5.3.1
+net.bytebuddy:byte-buddy:1.10.10
+net.java.dev.jna:jna-platform:5.5.0
+net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.16.0
 org.apache.beam:beam-model-pipeline:2.16.0
@@ -191,50 +192,51 @@ org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
 org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
 org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.10
-org.apache.httpcomponents:httpcore:4.4.12
+org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpcore:4.4.13
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
-org.checkerframework:checker-qual:2.8.1
+org.checkerframework:checker-qual:2.11.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
-org.dom4j:dom4j:2.1.1
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.4.Final
-org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.hibernate:hibernate-core:5.4.17.Final
+org.hibernate:hibernate-hikaricp:5.4.17.Final
 org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
-org.jboss:jandex:2.0.5.Final
-org.jetbrains:annotations:17.0.0
+org.jboss:jandex:2.1.3.Final
+org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2
-org.ow2.asm:asm-analysis:7.0
-org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:7.0
-org.ow2.asm:asm-util:7.0
-org.ow2.asm:asm:7.0
-org.postgresql:postgresql:42.2.6
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm-util:8.0.1
+org.ow2.asm:asm:8.0.1
+org.postgresql:postgresql:42.2.14
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
-org.slf4j:slf4j-api:1.7.28
-org.testcontainers:database-commons:1.12.1
-org.testcontainers:jdbc:1.12.1
-org.testcontainers:postgresql:1.12.1
-org.testcontainers:testcontainers:1.12.1
+org.slf4j:slf4j-api:1.7.30
+org.slf4j:slf4j-jdk14:1.7.28
+org.testcontainers:database-commons:1.14.3
+org.testcontainers:jdbc:1.14.3
+org.testcontainers:postgresql:1.14.3
+org.testcontainers:testcontainers:1.14.3
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/testAnnotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/testAnnotationProcessor.lockfile
@@ -7,29 +7,34 @@ com.google.auto.value:auto-value:1.6.3
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.dagger:dagger-compiler:2.21
-com.google.dagger:dagger-producers:2.21
-com.google.dagger:dagger-spi:2.21
-com.google.dagger:dagger:2.21
+com.google.dagger:dagger-compiler:2.28
+com.google.dagger:dagger-producers:2.28
+com.google.dagger:dagger-spi:2.28
+com.google.dagger:dagger:2.28
 com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.errorprone:error_prone_check_api:2.3.3
 com.google.errorprone:error_prone_core:2.3.3
 com.google.errorprone:error_prone_type_annotations:2.3.3
 com.google.errorprone:javac-shaded:9-dev-r4023-3
 com.google.googlejavaformat:google-java-format:1.5
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.0.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
-com.google.j2objc:j2objc-annotations:1.1
+com.google.j2objc:j2objc-annotations:1.3
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-com.squareup:javapoet:1.11.1
+com.squareup:javapoet:1.12.1
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
+javax.persistence:javax.persistence-api:2.2
+net.ltgt.gradle.incap:incap:0.2
 org.checkerframework:checker-compat-qual:2.5.3
-org.checkerframework:checker-qual:2.5.3
+org.checkerframework:checker-qual:2.11.1
 org.checkerframework:dataflow:2.5.3
 org.checkerframework:javacutil:2.5.3
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.jetbrains.kotlin:kotlin-stdlib-common:1.3.61
+org.jetbrains.kotlin:kotlin-stdlib:1.3.61
+org.jetbrains.kotlinx:kotlinx-metadata-jvm:0.1.0
+org.jetbrains:annotations:13.0
 org.pcollections:pcollections:2.1.2
--- a/core/gradle/dependency-locks/testCompile.lockfile
+++ b/core/gradle/dependency-locks/testCompile.lockfile
@@ -1,20 +1,29 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+androidx.annotation:annotation:1.1.0
 antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.10
-com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.10.2
 com.fasterxml.jackson.core:jackson-databind:2.9.10
-com.fasterxml:classmate:1.3.4
-com.google.api-client:google-api-client-appengine:1.30.7
+com.fasterxml:classmate:1.5.1
+com.github.jnr:jffi:1.2.23
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.15
+com.github.jnr:jnr-enxio:0.26
+com.github.jnr:jnr-ffi:2.1.13
+com.github.jnr:jnr-posix:3.0.55
+com.github.jnr:jnr-unixsocket:0.30
+com.github.jnr:jnr-x86asm:1.0.2
+com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.30.7
-com.google.api-client:google-api-client:1.30.7
+com.google.api-client:google-api-client-servlet:1.30.8
+com.google.api-client:google-api-client:1.30.8
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -50,6 +59,7 @@ com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -58,14 +68,15 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-api-stubs:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.16.1
-com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auth:google-auth-library-credentials:0.20.0
+com.google.auth:google-auth-library-oauth2-http:0.20.0
+com.google.auto.value:auto-value-annotations:1.7
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -76,21 +87,21 @@ com.google.cloud:google-cloud-spanner:1.6.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.5
 com.google.common.html.types:types:1.0.4
-com.google.dagger:dagger:2.21
-com.google.errorprone:error_prone_annotations:2.3.3
+com.google.dagger:dagger:2.28
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:28.1-jre
-com.google.guava:guava:28.1-jre
+com.google.guava:guava-testlib:29.0-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.0
-com.google.http-client:google-http-client-jackson2:1.32.1
+com.google.http-client:google-http-client-appengine:1.34.1
+com.google.http-client:google-http-client-jackson2:1.34.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.34.0
+com.google.http-client:google-http-client:1.34.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -175,10 +186,10 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
 junit:junit:4.13
-net.bytebuddy:byte-buddy-agent:1.9.7
-net.bytebuddy:byte-buddy:1.9.11
-net.java.dev.jna:jna-platform:5.3.1
-net.java.dev.jna:jna:5.3.1
+net.bytebuddy:byte-buddy-agent:1.10.5
+net.bytebuddy:byte-buddy:1.10.10
+net.java.dev.jna:jna-platform:5.5.0
+net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.16.0
 org.apache.beam:beam-model-pipeline:2.16.0
@@ -192,28 +203,29 @@ org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
 org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
 org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.10
-org.apache.httpcomponents:httpcore:4.4.12
+org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpcore:4.4.13
 org.apache.mina:mina-core:2.0.4
 org.apache.sshd:sshd-core:2.0.0
 org.apache.sshd:sshd-scp:2.0.0
 org.apache.sshd:sshd-sftp:2.0.0
 org.apache.tomcat:tomcat-annotations-api:8.0.5
+org.apiguardian:apiguardian-api:1.1.0
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.8.1
+org.checkerframework:checker-qual:2.11.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
-org.dom4j:dom4j:2.1.1
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
@@ -222,25 +234,37 @@ org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.4.Final
-org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.hibernate:hibernate-core:5.4.17.Final
+org.hibernate:hibernate-hikaricp:5.4.17.Final
 org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
-org.jboss:jandex:2.0.5.Final
-org.jetbrains:annotations:17.0.0
+org.jboss:jandex:2.1.3.Final
+org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.junit.jupiter:junit-jupiter-api:5.6.2
+org.junit.jupiter:junit-jupiter-engine:5.6.2
+org.junit.jupiter:junit-jupiter-migrationsupport:5.6.2
+org.junit.platform:junit-platform-commons:1.6.2
+org.junit.platform:junit-platform-engine:1.6.2
+org.junit.platform:junit-platform-launcher:1.6.2
+org.junit.platform:junit-platform-runner:1.6.2
+org.junit.platform:junit-platform-suite-api:1.6.2
+org.junit.vintage:junit-vintage-engine:5.6.2
+org.junit:junit-bom:5.6.2
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:2.25.0
+org.mockito:mockito-core:3.3.3
+org.mockito:mockito-junit-jupiter:3.3.3
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:2.6
-org.ow2.asm:asm-analysis:6.0
-org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:6.0
-org.ow2.asm:asm-util:6.0
-org.ow2.asm:asm:6.0
+org.opentest4j:opentest4j:1.2.0
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm-util:8.0.1
+org.ow2.asm:asm:8.0.1
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -255,12 +279,13 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
-org.slf4j:slf4j-api:1.7.28
-org.testcontainers:database-commons:1.12.1
-org.testcontainers:jdbc:1.12.1
-org.testcontainers:postgresql:1.12.1
-org.testcontainers:selenium:1.12.1
-org.testcontainers:testcontainers:1.12.1
+org.slf4j:slf4j-api:1.7.30
+org.testcontainers:database-commons:1.14.3
+org.testcontainers:jdbc:1.14.3
+org.testcontainers:junit-jupiter:1.14.3
+org.testcontainers:postgresql:1.14.3
+org.testcontainers:selenium:1.14.3
+org.testcontainers:testcontainers:1.14.3
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -1,20 +1,29 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+androidx.annotation:annotation:1.1.0
 antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.10
-com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.10.2
 com.fasterxml.jackson.core:jackson-databind:2.9.10
-com.fasterxml:classmate:1.3.4
-com.google.api-client:google-api-client-appengine:1.30.7
+com.fasterxml:classmate:1.5.1
+com.github.jnr:jffi:1.2.23
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.15
+com.github.jnr:jnr-enxio:0.26
+com.github.jnr:jnr-ffi:2.1.13
+com.github.jnr:jnr-posix:3.0.55
+com.github.jnr:jnr-unixsocket:0.30
+com.github.jnr:jnr-x86asm:1.0.2
+com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.30.7
-com.google.api-client:google-api-client:1.30.7
+com.google.api-client:google-api-client-servlet:1.30.8
+com.google.api-client:google-api-client:1.30.8
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -50,6 +59,7 @@ com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -58,14 +68,15 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-api-stubs:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.16.1
-com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auth:google-auth-library-credentials:0.20.0
+com.google.auth:google-auth-library-oauth2-http:0.20.0
+com.google.auto.value:auto-value-annotations:1.7
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -76,20 +87,20 @@ com.google.cloud:google-cloud-spanner:1.6.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.5
 com.google.common.html.types:types:1.0.4
-com.google.dagger:dagger:2.21
-com.google.errorprone:error_prone_annotations:2.3.3
+com.google.dagger:dagger:2.28
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:28.1-jre
-com.google.guava:guava:28.1-jre
+com.google.guava:guava-testlib:29.0-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.0
-com.google.http-client:google-http-client-jackson2:1.32.1
+com.google.http-client:google-http-client-appengine:1.34.1
+com.google.http-client:google-http-client-jackson2:1.34.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.34.0
+com.google.http-client:google-http-client:1.34.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -173,10 +184,10 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
 junit:junit:4.13
-net.bytebuddy:byte-buddy-agent:1.9.7
-net.bytebuddy:byte-buddy:1.9.11
-net.java.dev.jna:jna-platform:5.3.1
-net.java.dev.jna:jna:5.3.1
+net.bytebuddy:byte-buddy-agent:1.10.5
+net.bytebuddy:byte-buddy:1.10.10
+net.java.dev.jna:jna-platform:5.5.0
+net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.16.0
 org.apache.beam:beam-model-pipeline:2.16.0
@@ -190,28 +201,29 @@ org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
 org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
 org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.10
-org.apache.httpcomponents:httpcore:4.4.12
+org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpcore:4.4.13
 org.apache.mina:mina-core:2.0.4
 org.apache.sshd:sshd-core:2.0.0
 org.apache.sshd:sshd-scp:2.0.0
 org.apache.sshd:sshd-sftp:2.0.0
 org.apache.tomcat:tomcat-annotations-api:8.0.5
+org.apiguardian:apiguardian-api:1.1.0
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.8.1
+org.checkerframework:checker-qual:2.11.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
-org.dom4j:dom4j:2.1.1
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
@@ -220,25 +232,37 @@ org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.4.Final
-org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.hibernate:hibernate-core:5.4.17.Final
+org.hibernate:hibernate-hikaricp:5.4.17.Final
 org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
-org.jboss:jandex:2.0.5.Final
-org.jetbrains:annotations:17.0.0
+org.jboss:jandex:2.1.3.Final
+org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.junit.jupiter:junit-jupiter-api:5.6.2
+org.junit.jupiter:junit-jupiter-engine:5.6.2
+org.junit.jupiter:junit-jupiter-migrationsupport:5.6.2
+org.junit.platform:junit-platform-commons:1.6.2
+org.junit.platform:junit-platform-engine:1.6.2
+org.junit.platform:junit-platform-launcher:1.6.2
+org.junit.platform:junit-platform-runner:1.6.2
+org.junit.platform:junit-platform-suite-api:1.6.2
+org.junit.vintage:junit-vintage-engine:5.6.2
+org.junit:junit-bom:5.6.2
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:2.25.0
+org.mockito:mockito-core:3.3.3
+org.mockito:mockito-junit-jupiter:3.3.3
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:2.6
-org.ow2.asm:asm-analysis:6.0
-org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:6.0
-org.ow2.asm:asm-util:6.0
-org.ow2.asm:asm:6.0
+org.opentest4j:opentest4j:1.2.0
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm-util:8.0.1
+org.ow2.asm:asm:8.0.1
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -253,12 +277,13 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
-org.slf4j:slf4j-api:1.7.28
-org.testcontainers:database-commons:1.12.1
-org.testcontainers:jdbc:1.12.1
-org.testcontainers:postgresql:1.12.1
-org.testcontainers:selenium:1.12.1
-org.testcontainers:testcontainers:1.12.1
+org.slf4j:slf4j-api:1.7.30
+org.testcontainers:database-commons:1.14.3
+org.testcontainers:jdbc:1.14.3
+org.testcontainers:junit-jupiter:1.14.3
+org.testcontainers:postgresql:1.14.3
+org.testcontainers:selenium:1.14.3
+org.testcontainers:testcontainers:1.14.3
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/testRuntime.lockfile
+++ b/core/gradle/dependency-locks/testRuntime.lockfile
@@ -1,28 +1,29 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+androidx.annotation:annotation:1.1.0
 antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.10
-com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.10.2
 com.fasterxml.jackson.core:jackson-databind:2.9.10
-com.fasterxml:classmate:1.3.4
-com.github.jnr:jffi:1.2.17
+com.fasterxml:classmate:1.5.1
+com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
-com.github.jnr:jnr-constants:0.9.11
-com.github.jnr:jnr-enxio:0.19
-com.github.jnr:jnr-ffi:2.1.9
-com.github.jnr:jnr-posix:3.0.47
-com.github.jnr:jnr-unixsocket:0.21
+com.github.jnr:jnr-constants:0.9.15
+com.github.jnr:jnr-enxio:0.26
+com.github.jnr:jnr-ffi:2.1.13
+com.github.jnr:jnr-posix:3.0.55
+com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.api-client:google-api-client-appengine:1.30.7
+com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.30.7
-com.google.api-client:google-api-client:1.30.7
+com.google.api-client:google-api-client-servlet:1.30.8
+com.google.api-client:google-api-client:1.30.8
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -58,7 +59,7 @@ com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
-com.google.apis:google-api-services-sqladmin:v1beta4-rev56-1.23.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -67,16 +68,16 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-api-stubs:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.16.1
-com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auth:google-auth-library-credentials:0.20.0
+com.google.auth:google-auth-library-oauth2-http:0.20.0
+com.google.auto.value:auto-value-annotations:1.7
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
-com.google.cloud.sql:jdbc-socket-factory-core:1.0.12
-com.google.cloud.sql:postgres-socket-factory:1.0.12
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
+com.google.cloud.sql:postgres-socket-factory:1.0.16
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -87,21 +88,21 @@ com.google.cloud:google-cloud-spanner:1.6.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.5
 com.google.common.html.types:types:1.0.4
-com.google.dagger:dagger:2.21
-com.google.errorprone:error_prone_annotations:2.3.3
+com.google.dagger:dagger:2.28
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:28.1-jre
-com.google.guava:guava:28.1-jre
+com.google.guava:guava-testlib:29.0-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.0
-com.google.http-client:google-http-client-jackson2:1.32.1
+com.google.http-client:google-http-client-appengine:1.34.1
+com.google.http-client:google-http-client-jackson2:1.34.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.34.0
+com.google.http-client:google-http-client:1.34.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -187,10 +188,10 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
 junit:junit:4.13
-net.bytebuddy:byte-buddy-agent:1.9.7
-net.bytebuddy:byte-buddy:1.9.11
-net.java.dev.jna:jna-platform:5.3.1
-net.java.dev.jna:jna:5.3.1
+net.bytebuddy:byte-buddy-agent:1.10.5
+net.bytebuddy:byte-buddy:1.10.10
+net.java.dev.jna:jna-platform:5.5.0
+net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.16.0
 org.apache.beam:beam-model-pipeline:2.16.0
@@ -204,28 +205,29 @@ org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
 org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
 org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.10
-org.apache.httpcomponents:httpcore:4.4.12
+org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpcore:4.4.13
 org.apache.mina:mina-core:2.0.4
 org.apache.sshd:sshd-core:2.0.0
 org.apache.sshd:sshd-scp:2.0.0
 org.apache.sshd:sshd-sftp:2.0.0
 org.apache.tomcat:tomcat-annotations-api:8.0.5
+org.apiguardian:apiguardian-api:1.1.0
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.8.1
+org.checkerframework:checker-qual:2.11.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
-org.dom4j:dom4j:2.1.1
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.flywaydb:flyway-core:5.2.4
@@ -235,26 +237,38 @@ org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.4.Final
-org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.hibernate:hibernate-core:5.4.17.Final
+org.hibernate:hibernate-hikaricp:5.4.17.Final
 org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
-org.jboss:jandex:2.0.5.Final
-org.jetbrains:annotations:17.0.0
+org.jboss:jandex:2.1.3.Final
+org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.junit.jupiter:junit-jupiter-api:5.6.2
+org.junit.jupiter:junit-jupiter-engine:5.6.2
+org.junit.jupiter:junit-jupiter-migrationsupport:5.6.2
+org.junit.platform:junit-platform-commons:1.6.2
+org.junit.platform:junit-platform-engine:1.6.2
+org.junit.platform:junit-platform-launcher:1.6.2
+org.junit.platform:junit-platform-runner:1.6.2
+org.junit.platform:junit-platform-suite-api:1.6.2
+org.junit.vintage:junit-vintage-engine:5.6.2
+org.junit:junit-bom:5.6.2
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:2.25.0
+org.mockito:mockito-core:3.3.3
+org.mockito:mockito-junit-jupiter:3.3.3
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:2.6
-org.ow2.asm:asm-analysis:7.0
-org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:7.0
-org.ow2.asm:asm-util:7.0
-org.ow2.asm:asm:7.0
-org.postgresql:postgresql:42.2.6
+org.opentest4j:opentest4j:1.2.0
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm-util:8.0.1
+org.ow2.asm:asm:8.0.1
+org.postgresql:postgresql:42.2.14
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -269,12 +283,13 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
-org.slf4j:slf4j-api:1.7.28
-org.testcontainers:database-commons:1.12.1
-org.testcontainers:jdbc:1.12.1
-org.testcontainers:postgresql:1.12.1
-org.testcontainers:selenium:1.12.1
-org.testcontainers:testcontainers:1.12.1
+org.slf4j:slf4j-api:1.7.30
+org.testcontainers:database-commons:1.14.3
+org.testcontainers:jdbc:1.14.3
+org.testcontainers:junit-jupiter:1.14.3
+org.testcontainers:postgresql:1.14.3
+org.testcontainers:selenium:1.14.3
+org.testcontainers:testcontainers:1.14.3
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -1,28 +1,29 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+androidx.annotation:annotation:1.1.0
 antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.10
-com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.10.2
 com.fasterxml.jackson.core:jackson-databind:2.9.10
-com.fasterxml:classmate:1.3.4
-com.github.jnr:jffi:1.2.17
+com.fasterxml:classmate:1.5.1
+com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
-com.github.jnr:jnr-constants:0.9.11
-com.github.jnr:jnr-enxio:0.19
-com.github.jnr:jnr-ffi:2.1.9
-com.github.jnr:jnr-posix:3.0.47
-com.github.jnr:jnr-unixsocket:0.21
+com.github.jnr:jnr-constants:0.9.15
+com.github.jnr:jnr-enxio:0.26
+com.github.jnr:jnr-ffi:2.1.13
+com.github.jnr:jnr-posix:3.0.55
+com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.api-client:google-api-client-appengine:1.30.7
+com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.30.7
-com.google.api-client:google-api-client:1.30.7
+com.google.api-client:google-api-client-servlet:1.30.8
+com.google.api-client:google-api-client:1.30.8
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -58,7 +59,7 @@ com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
-com.google.apis:google-api-services-sqladmin:v1beta4-rev56-1.23.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -67,16 +68,16 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-api-stubs:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.16.1
-com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auth:google-auth-library-credentials:0.20.0
+com.google.auth:google-auth-library-oauth2-http:0.20.0
+com.google.auto.value:auto-value-annotations:1.7
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
-com.google.cloud.sql:jdbc-socket-factory-core:1.0.12
-com.google.cloud.sql:postgres-socket-factory:1.0.12
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
+com.google.cloud.sql:postgres-socket-factory:1.0.16
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -87,21 +88,21 @@ com.google.cloud:google-cloud-spanner:1.6.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.5
 com.google.common.html.types:types:1.0.4
-com.google.dagger:dagger:2.21
-com.google.errorprone:error_prone_annotations:2.3.3
+com.google.dagger:dagger:2.28
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:28.1-jre
-com.google.guava:guava:28.1-jre
+com.google.guava:guava-testlib:29.0-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.0
-com.google.http-client:google-http-client-jackson2:1.32.1
+com.google.http-client:google-http-client-appengine:1.34.1
+com.google.http-client:google-http-client-jackson2:1.34.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.34.0
+com.google.http-client:google-http-client:1.34.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -187,10 +188,10 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
 junit:junit:4.13
-net.bytebuddy:byte-buddy-agent:1.9.7
-net.bytebuddy:byte-buddy:1.9.11
-net.java.dev.jna:jna-platform:5.3.1
-net.java.dev.jna:jna:5.3.1
+net.bytebuddy:byte-buddy-agent:1.10.5
+net.bytebuddy:byte-buddy:1.10.10
+net.java.dev.jna:jna-platform:5.5.0
+net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.16.0
 org.apache.beam:beam-model-pipeline:2.16.0
@@ -204,28 +205,29 @@ org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
 org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
 org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.10
-org.apache.httpcomponents:httpcore:4.4.12
+org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpcore:4.4.13
 org.apache.mina:mina-core:2.0.4
 org.apache.sshd:sshd-core:2.0.0
 org.apache.sshd:sshd-scp:2.0.0
 org.apache.sshd:sshd-sftp:2.0.0
 org.apache.tomcat:tomcat-annotations-api:8.0.5
+org.apiguardian:apiguardian-api:1.1.0
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.8.1
+org.checkerframework:checker-qual:2.11.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
-org.dom4j:dom4j:2.1.1
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.flywaydb:flyway-core:5.2.4
@@ -235,26 +237,38 @@ org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.4.Final
-org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.hibernate:hibernate-core:5.4.17.Final
+org.hibernate:hibernate-hikaricp:5.4.17.Final
 org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
-org.jboss:jandex:2.0.5.Final
-org.jetbrains:annotations:17.0.0
+org.jboss:jandex:2.1.3.Final
+org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.junit.jupiter:junit-jupiter-api:5.6.2
+org.junit.jupiter:junit-jupiter-engine:5.6.2
+org.junit.jupiter:junit-jupiter-migrationsupport:5.6.2
+org.junit.platform:junit-platform-commons:1.6.2
+org.junit.platform:junit-platform-engine:1.6.2
+org.junit.platform:junit-platform-launcher:1.6.2
+org.junit.platform:junit-platform-runner:1.6.2
+org.junit.platform:junit-platform-suite-api:1.6.2
+org.junit.vintage:junit-vintage-engine:5.6.2
+org.junit:junit-bom:5.6.2
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:2.25.0
+org.mockito:mockito-core:3.3.3
+org.mockito:mockito-junit-jupiter:3.3.3
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:2.6
-org.ow2.asm:asm-analysis:7.0
-org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:7.0
-org.ow2.asm:asm-util:7.0
-org.ow2.asm:asm:7.0
-org.postgresql:postgresql:42.2.6
+org.opentest4j:opentest4j:1.2.0
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm-util:8.0.1
+org.ow2.asm:asm:8.0.1
+org.postgresql:postgresql:42.2.14
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -269,12 +283,14 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
-org.slf4j:slf4j-api:1.7.28
-org.testcontainers:database-commons:1.12.1
-org.testcontainers:jdbc:1.12.1
-org.testcontainers:postgresql:1.12.1
-org.testcontainers:selenium:1.12.1
-org.testcontainers:testcontainers:1.12.1
+org.slf4j:slf4j-api:1.7.30
+org.slf4j:slf4j-jdk14:1.7.28
+org.testcontainers:database-commons:1.14.3
+org.testcontainers:jdbc:1.14.3
+org.testcontainers:junit-jupiter:1.14.3
+org.testcontainers:postgresql:1.14.3
+org.testcontainers:selenium:1.14.3
+org.testcontainers:testcontainers:1.14.3
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/src/main/java/google/registry/backup/AppEngineEnvironment.java
+++ b/core/src/main/java/google/registry/backup/AppEngineEnvironment.java
@@ -0,0 +1,67 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.backup;
+
+import com.google.apphosting.api.ApiProxy;
+import com.google.apphosting.api.ApiProxy.Environment;
+import com.google.common.collect.ImmutableMap;
+import java.io.Closeable;
+import java.lang.reflect.Method;
+import java.lang.reflect.Proxy;
+
+/**
+ * Sets up a placeholder {@link Environment} on a non-AppEngine platform so that Datastore Entities
+ * can be converted from/to Objectify entities. See {@code DatastoreEntityExtension} in test source
+ * for more information.
+ */
+public class AppEngineEnvironment implements Closeable {
+
+  private static final Environment PLACEHOLDER_ENV = createAppEngineEnvironment();
+
+  private boolean isPlaceHolderNeeded;
+
+  public AppEngineEnvironment() {
+    isPlaceHolderNeeded = ApiProxy.getCurrentEnvironment() == null;
+    // isPlaceHolderNeeded may be true when we are invoked in a test with AppEngineRule.
+    if (isPlaceHolderNeeded) {
+      ApiProxy.setEnvironmentForCurrentThread(PLACEHOLDER_ENV);
+    }
+  }
+
+  @Override
+  public void close() {
+    if (isPlaceHolderNeeded) {
+      ApiProxy.setEnvironmentForCurrentThread(null);
+    }
+  }
+
+  /** Returns a placeholder {@link Environment} that can return hardcoded AppId and Attributes. */
+  private static Environment createAppEngineEnvironment() {
+    return (Environment)
+        Proxy.newProxyInstance(
+            Environment.class.getClassLoader(),
+            new Class[] {Environment.class},
+            (Object proxy, Method method, Object[] args) -> {
+              switch (method.getName()) {
+                case "getAppId":
+                  return "PlaceholderAppId";
+                case "getAttributes":
+                  return ImmutableMap.<String, Object>of();
+                default:
+                  throw new UnsupportedOperationException(method.getName());
+              }
+            });
+  }
+}
--- a/core/src/main/java/google/registry/backup/CommitLogImports.java
+++ b/core/src/main/java/google/registry/backup/CommitLogImports.java
@@ -0,0 +1,95 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.backup;
+
+import static com.google.common.base.Preconditions.checkState;
+import static google.registry.backup.BackupUtils.createDeserializingIterator;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.Streams;
+import google.registry.model.ImmutableObject;
+import google.registry.model.ofy.CommitLogCheckpoint;
+import google.registry.model.ofy.CommitLogManifest;
+import google.registry.model.ofy.CommitLogMutation;
+import java.io.BufferedInputStream;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.channels.Channels;
+import java.nio.channels.ReadableByteChannel;
+import java.util.Iterator;
+import java.util.stream.Stream;
+
+/**
+ * Helpers for reading CommitLog records from a file.
+ *
+ * <p>This class is adapted from {@link RestoreCommitLogsAction}, and will be used in the initial
+ * population of the Cloud SQL database.
+ */
+public final class CommitLogImports {
+
+  private CommitLogImports() {}
+
+  /**
+   * Returns entities in an {@code inputStream} (from a single CommitLog file) as an {@link
+   * ImmutableList} of {@link VersionedEntity} records. Upon completion the {@code inputStream} is
+   * closed.
+   *
+   * <p>The returned list may be empty, since CommitLogs are written at fixed intervals regardless
+   * if actual changes exist.
+   *
+   * <p>A CommitLog file starts with a {@link CommitLogCheckpoint}, followed by (repeated)
+   * subsequences of [{@link CommitLogManifest}, [{@link CommitLogMutation}] ...]. Each subsequence
+   * represents the changes in one transaction. The {@code CommitLogManifest} contains deleted
+   * entity keys, whereas each {@code CommitLogMutation} contains one whole entity.
+   */
+  public static ImmutableList<VersionedEntity> loadEntities(InputStream inputStream) {
+    try (AppEngineEnvironment appEngineEnvironment = new AppEngineEnvironment();
+        InputStream input = new BufferedInputStream(inputStream)) {
+      Iterator<ImmutableObject> commitLogs = createDeserializingIterator(input);
+      checkState(commitLogs.hasNext());
+      checkState(commitLogs.next() instanceof CommitLogCheckpoint);
+
+      return Streams.stream(commitLogs)
+          .map(
+              e ->
+                  e instanceof CommitLogManifest
+                      ? VersionedEntity.fromManifest((CommitLogManifest) e)
+                      : Stream.of(VersionedEntity.fromMutation((CommitLogMutation) e)))
+          .flatMap(s -> s)
+          .collect(ImmutableList.toImmutableList());
+    } catch (IOException e) {
+      throw new RuntimeException(e);
+    }
+  }
+
+  /** Covenience method that adapts {@link #loadEntities(InputStream)} to a {@link File}. */
+  public static ImmutableList<VersionedEntity> loadEntities(File commitLogFile) {
+    try {
+      return loadEntities(new FileInputStream(commitLogFile));
+    } catch (IOException e) {
+      throw new RuntimeException(e);
+    }
+  }
+
+  /**
+   * Covenience method that adapts {@link #loadEntities(InputStream)} to a {@link
+   * ReadableByteChannel}.
+   */
+  public static ImmutableList<VersionedEntity> loadEntities(ReadableByteChannel channel) {
+    return loadEntities(Channels.newInputStream(channel));
+  }
+}
--- a/core/src/main/java/google/registry/backup/VersionedEntity.java
+++ b/core/src/main/java/google/registry/backup/VersionedEntity.java
@@ -0,0 +1,198 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.backup;
+
+import com.google.appengine.api.datastore.Entity;
+import com.google.appengine.api.datastore.EntityTranslator;
+import com.google.appengine.api.datastore.Key;
+import com.google.auto.value.AutoValue;
+import com.google.auto.value.extension.memoized.Memoized;
+import google.registry.model.ofy.CommitLogManifest;
+import google.registry.model.ofy.CommitLogMutation;
+import java.io.Serializable;
+import java.util.Arrays;
+import java.util.Optional;
+import java.util.stream.Stream;
+import javax.annotation.Nullable;
+
+/**
+ * A Datastore {@link Entity Entity's} serialized state with timestamp. The intended use case is a
+ * multi-stage pipeline where an Entity's Java form is not needed in most stages.
+ *
+ * <p>For a new or updated Entity, its serialized bytes are stored along with its Datastore {@link
+ * Key}. For a deleted entity, only its Datastore {@link Key} is stored, and the {@link
+ * #entityProtoBytes} field is left unset.
+ *
+ * <p>Storing raw bytes is motivated by two factors. First, since I/O is frequent and the Java
+ * objects are rarely needed in our target use case, storing raw bytes is the most efficient
+ * approach. More importantly, due to our data model and our customization of {@link
+ * google.registry.model.ofy.ObjectifyService ObjectifyService}, it is challenging to implement a
+ * serializer for Objectify entities that preserves the value of all properties. Without such
+ * serializers, Objectify entities cannot be used in a pipeline.
+ *
+ * <p>Objectify entities do not implement {@link Serializable}, serialization of such objects is as
+ * follows:
+ *
+ * <ul>
+ *   <li>Convert an Objectify entity to a Datastore {@link Entity}: {@code
+ *       ofy().save().toEntity(..)}
+ *   <li>Entity is serializable, but the more efficient approach is to convert an Entity to a
+ *       ProtocolBuffer ({@link com.google.storage.onestore.v3.OnestoreEntity.EntityProto}) and then
+ *       to raw bytes.
+ * </ul>
+ *
+ * <p>When the first conversion above is applied to an Objectify entity, a property value in the
+ * output may differ from the input in two situations:
+ *
+ * <ul>
+ *   <li>If a property is of an assign-on-persist data type, e.g., {@link
+ *       google.registry.model.UpdateAutoTimestamp}.
+ *   <li>If it is related to CommitLog management, e.g., {@link google.registry.model.EppResource
+ *       EppResource.revisions}.
+ * </ul>
+ *
+ * <p>Working around the side effects caused by our customization is difficult. Any solution would
+ * likely rely on Objectify's stack of context. However, many Objectify invocations in our code base
+ * are hardcoded to call the customized version of ObjectifyService, rendering Objectify's stack
+ * useless.
+ *
+ * <p>For now, this inability to use Objectify entities in pipelines is mostly a testing problem: we
+ * can not perform {@link org.apache.beam.sdk.testing.PAssert BEAM pipeline assertions} on Objectify
+ * entities. {@code InitSqlTestUtils.assertContainsExactlyElementsIn} is an example of a workaround.
+ *
+ * <p>Note that {@link Optional java.util.Optional} is not serializable, therefore cannot be used as
+ * property type in this class.
+ */
+@AutoValue
+public abstract class VersionedEntity implements Serializable {
+
+  private static final long serialVersionUID = 1L;
+
+  public abstract long commitTimeMills();
+
+  /** The {@link Key} of the {@link Entity}. */
+  public abstract Key key();
+
+  /** Serialized form of the {@link Entity}. This property is {@code null} for a deleted Entity. */
+  @Nullable
+  abstract ImmutableBytes entityProtoBytes();
+
+  @Memoized
+  public Optional<Entity> getEntity() {
+    return Optional.ofNullable(entityProtoBytes())
+        .map(ImmutableBytes::getBytes)
+        .map(EntityTranslator::createFromPbBytes);
+  }
+
+  public boolean isDelete() {
+    return entityProtoBytes() == null;
+  }
+
+  /**
+   * Converts deleted entity keys in {@code manifest} into a {@link Stream} of {@link
+   * VersionedEntity VersionedEntities}. See {@link CommitLogImports#loadEntities} for more
+   * information.
+   */
+  public static Stream<VersionedEntity> fromManifest(CommitLogManifest manifest) {
+    long commitTimeMillis = manifest.getCommitTime().getMillis();
+    return manifest.getDeletions().stream()
+        .map(com.googlecode.objectify.Key::getRaw)
+        .map(key -> builder().commitTimeMills(commitTimeMillis).key(key).build());
+  }
+
+  /* Converts a {@link CommitLogMutation} to a {@link VersionedEntity}. */
+  public static VersionedEntity fromMutation(CommitLogMutation mutation) {
+    return from(
+        com.googlecode.objectify.Key.create(mutation).getParent().getId(),
+        mutation.getEntityProtoBytes());
+  }
+
+  public static VersionedEntity from(long commitTimeMillis, byte[] entityProtoBytes) {
+    return builder()
+        .entityProtoBytes(entityProtoBytes)
+        .key(EntityTranslator.createFromPbBytes(entityProtoBytes).getKey())
+        .commitTimeMills(commitTimeMillis)
+        .build();
+  }
+
+  static Builder builder() {
+    return new AutoValue_VersionedEntity.Builder();
+  }
+
+  @AutoValue.Builder
+  public abstract static class Builder {
+
+    public abstract Builder commitTimeMills(long commitTimeMillis);
+
+    abstract Builder entityProtoBytes(ImmutableBytes bytes);
+
+    public abstract Builder key(Key key);
+
+    public abstract VersionedEntity build();
+
+    public Builder entityProtoBytes(byte[] bytes) {
+      return entityProtoBytes(new ImmutableBytes(bytes));
+    }
+  }
+
+  /**
+   * Wraps a byte array and prevents it from being modified by its original owner.
+   *
+   * <p>While this class seems an overkill, it exists for two reasons:
+   *
+   * <ul>
+   *   <li>It is easier to override the {@link #equals} method here (for value-equivalence check)
+   *       than to override the AutoValue-generated {@code equals} method.
+   *   <li>To appease the style checker, which forbids arrays as AutoValue property.
+   * </ul>
+   */
+  static final class ImmutableBytes implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    private final byte[] bytes;
+
+    ImmutableBytes(byte[] bytes) {
+      this.bytes = Arrays.copyOf(bytes, bytes.length);
+    }
+
+    /**
+     * Returns the saved byte array. Invocation is restricted to trusted callers, who must not
+     * modify the array.
+     */
+    byte[] getBytes() {
+      return bytes;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+      if (this == o) {
+        return true;
+      }
+      if (!(o instanceof ImmutableBytes)) {
+        return false;
+      }
+      ImmutableBytes that = (ImmutableBytes) o;
+      // Do not use Objects.equals, which checks reference identity instead of data in array.
+      return Arrays.equals(bytes, that.bytes);
+    }
+
+    @Override
+    public int hashCode() {
+      // Do not use Objects.hashCode, which hashes the reference, not the data in array.
+      return Arrays.hashCode(bytes);
+    }
+  }
+}
--- a/core/src/main/java/google/registry/batch/AsyncTaskEnqueuer.java
+++ b/core/src/main/java/google/registry/batch/AsyncTaskEnqueuer.java
@@ -30,6 +30,8 @@ import google.registry.model.EppResource;
 import google.registry.model.ImmutableObject;
 import google.registry.model.eppcommon.Trid;
 import google.registry.model.host.HostResource;
+import google.registry.persistence.VKey;
+import google.registry.schema.domain.RegistryLock;
 import google.registry.util.AppEngineServiceUtils;
 import google.registry.util.Retrier;
 import javax.inject.Inject;
@@ -148,15 +150,35 @@ public final class AsyncTaskEnqueuer {

  /** Enqueues a task to asynchronously refresh DNS for a renamed host. */
  public void enqueueAsyncDnsRefresh(HostResource host, DateTime now) {
-    Key<HostResource> hostKey = Key.create(host);
+    VKey<HostResource> hostKey = host.createVKey();
    logger.atInfo().log("Enqueuing async DNS refresh for renamed host %s.", hostKey);
    addTaskToQueueWithRetry(
        asyncDnsRefreshPullQueue,
        TaskOptions.Builder.withMethod(Method.PULL)
-            .param(PARAM_HOST_KEY, hostKey.getString())
+            .param(PARAM_HOST_KEY, hostKey.getOfyKey().getString())
            .param(PARAM_REQUESTED_TIME, now.toString()));
  }

+  /**
+   * Enqueues a task to asynchronously re-lock a registry-locked domain after it was unlocked.
+   *
+   * <p>Note: the relockDuration must be present on the lock object.
+   */
+  public void enqueueDomainRelock(RegistryLock lock) {
+    checkArgument(
+        lock.getRelockDuration().isPresent(),
+        "Lock with ID %s not configured for relock",
+        lock.getRevisionId());
+    addTaskToQueueWithRetry(
+        asyncActionsPushQueue,
+        TaskOptions.Builder.withUrl(RelockDomainAction.PATH)
+            .method(Method.POST)
+            .param(
+                RelockDomainAction.OLD_UNLOCK_REVISION_ID_PARAM,
+                String.valueOf(lock.getRevisionId()))
+            .countdownMillis(lock.getRelockDuration().get().getMillis()));
+  }
+
  /**
   * Adds a task to a queue with retrying, to avoid aborting the entire flow over a transient issue
   * enqueuing a task.
--- a/core/src/main/java/google/registry/batch/BatchModule.java
+++ b/core/src/main/java/google/registry/batch/BatchModule.java
@@ -21,6 +21,7 @@ import static google.registry.batch.AsyncTaskEnqueuer.PARAM_RESOURCE_KEY;
 import static google.registry.batch.AsyncTaskEnqueuer.QUEUE_ASYNC_ACTIONS;
 import static google.registry.batch.AsyncTaskEnqueuer.QUEUE_ASYNC_DELETE;
 import static google.registry.batch.AsyncTaskEnqueuer.QUEUE_ASYNC_HOST_RENAME;
+import static google.registry.request.RequestParameters.extractLongParameter;
 import static google.registry.request.RequestParameters.extractOptionalBooleanParameter;
 import static google.registry.request.RequestParameters.extractOptionalIntParameter;
 import static google.registry.request.RequestParameters.extractOptionalParameter;
@@ -40,9 +41,7 @@ import javax.inject.Named;
 import javax.servlet.http.HttpServletRequest;
 import org.joda.time.DateTime;

-/**
- * Dagger module for injecting common settings for batch actions.
- */
+/** Dagger module for injecting common settings for batch actions. */
@Module
 public class BatchModule {

@@ -94,6 +93,12 @@ public class BatchModule {
    return extractSetOfDatetimeParameters(req, PARAM_RESAVE_TIMES);
  }

+  @Provides
+  @Parameter("oldUnlockRevisionId")
+  static long provideOldUnlockRevisionId(HttpServletRequest req) {
+    return extractLongParameter(req, "oldUnlockRevisionId");
+  }
+
  @Provides
  @Named(QUEUE_ASYNC_ACTIONS)
  static Queue provideAsyncActionsPushQueue() {
--- a/core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java
+++ b/core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java
@@ -85,6 +85,7 @@ import google.registry.model.poll.PendingActionNotificationResponse.HostPendingA
 import google.registry.model.poll.PollMessage;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.server.Lock;
+import google.registry.persistence.VKey;
 import google.registry.request.Action;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
@@ -282,9 +283,11 @@ public class DeleteContactsAndHostsAction implements Runnable {
    /** Determine whether the target resource is a linked resource on the domain. */
    private boolean isLinked(DomainBase domain, Key<? extends EppResource> resourceKey) {
      if (resourceKey.getKind().equals(KIND_CONTACT)) {
-        return domain.getReferencedContacts().contains(resourceKey);
+        return domain
+            .getReferencedContacts()
+            .contains(VKey.from((Key<ContactResource>) resourceKey));
      } else if (resourceKey.getKind().equals(KIND_HOST)) {
-        return domain.getNameservers().contains(resourceKey);
+        return domain.getNameservers().contains(VKey.from((Key<HostResource>) resourceKey));
      } else {
        throw new IllegalStateException("EPP resource key of unknown type: " + resourceKey);
      }
@@ -342,7 +345,7 @@ public class DeleteContactsAndHostsAction implements Runnable {
      String resourceClientId = resource.getPersistedCurrentSponsorClientId();
      if (resource instanceof HostResource && ((HostResource) resource).isSubordinate()) {
        resourceClientId =
-            ofy().load().key(((HostResource) resource).getSuperordinateDomain()).now()
+            tm().load(((HostResource) resource).getSuperordinateDomain())
                .cloneProjectedAtTime(now)
                .getCurrentSponsorClientId();
      }
@@ -421,7 +424,7 @@ public class DeleteContactsAndHostsAction implements Runnable {
      if (resource instanceof HostResource) {
        return ImmutableList.of(
            HostPendingActionNotificationResponse.create(
-                ((HostResource) resource).getFullyQualifiedHostName(), deleteAllowed, trid, now));
+                ((HostResource) resource).getHostName(), deleteAllowed, trid, now));
      } else if (resource instanceof ContactResource) {
        return ImmutableList.of(
            ContactPendingActionNotificationResponse.create(
@@ -460,11 +463,12 @@ public class DeleteContactsAndHostsAction implements Runnable {
      } else if (existingResource instanceof HostResource) {
        HostResource host = (HostResource) existingResource;
        if (host.isSubordinate()) {
-          dnsQueue.addHostRefreshTask(host.getFullyQualifiedHostName());
-          ofy().save().entity(
-              ofy().load().key(host.getSuperordinateDomain()).now().asBuilder()
-                  .removeSubordinateHost(host.getFullyQualifiedHostName())
-                  .build());
+          dnsQueue.addHostRefreshTask(host.getHostName());
+          tm().saveNewOrUpdate(
+                  tm().load(host.getSuperordinateDomain())
+                      .asBuilder()
+                      .removeSubordinateHost(host.getHostName())
+                      .build());
        }
      } else {
        throw new IllegalStateException(
--- a/core/src/main/java/google/registry/batch/DeleteProberDataAction.java
+++ b/core/src/main/java/google/registry/batch/DeleteProberDataAction.java
@@ -177,7 +177,7 @@ public class DeleteProberDataAction implements Runnable {
        return;
      }

-      String domainName = domain.getFullyQualifiedDomainName();
+      String domainName = domain.getDomainName();
      if (domainName.equals("nic." + domain.getTld())) {
        getContext().incrementCounter("skipped, NIC domain");
        return;
@@ -246,28 +246,32 @@ public class DeleteProberDataAction implements Runnable {
    }

    private void softDeleteDomain(final DomainBase domain) {
-      tm().transactNew(() -> {
-          DomainBase deletedDomain = domain
-              .asBuilder()
-              .setDeletionTime(tm().getTransactionTime())
-              .setStatusValues(null)
-              .build();
-          HistoryEntry historyEntry = new HistoryEntry.Builder()
-              .setParent(domain)
-              .setType(DOMAIN_DELETE)
-              .setModificationTime(tm().getTransactionTime())
-              .setBySuperuser(true)
-              .setReason("Deletion of prober data")
-              .setClientId(registryAdminClientId)
-              .build();
-          // Note that we don't bother handling grace periods, billing events, pending transfers,
-          // poll messages, or auto-renews because these will all be hard-deleted the next time the
-          // mapreduce runs anyway.
-          ofy().save().entities(deletedDomain, historyEntry);
-          updateForeignKeyIndexDeletionTime(deletedDomain);
-          dnsQueue.addDomainRefreshTask(deletedDomain.getFullyQualifiedDomainName());
-        }
-      );
+      tm().transactNew(
+              () -> {
+                DomainBase deletedDomain =
+                    domain
+                        .asBuilder()
+                        .setDeletionTime(tm().getTransactionTime())
+                        .setStatusValues(null)
+                        .build();
+                HistoryEntry historyEntry =
+                    new HistoryEntry.Builder()
+                        .setParent(domain)
+                        .setType(DOMAIN_DELETE)
+                        .setModificationTime(tm().getTransactionTime())
+                        .setBySuperuser(true)
+                        .setReason("Deletion of prober data")
+                        .setClientId(registryAdminClientId)
+                        .build();
+                // Note that we don't bother handling grace periods, billing events, pending
+                // transfers,
+                // poll messages, or auto-renews because these will all be hard-deleted the next
+                // time the
+                // mapreduce runs anyway.
+                ofy().save().entities(deletedDomain, historyEntry);
+                updateForeignKeyIndexDeletionTime(deletedDomain);
+                dnsQueue.addDomainRefreshTask(deletedDomain.getDomainName());
+              });
    }
  }
 }
--- a/core/src/main/java/google/registry/batch/ExpandRecurringBillingEventsAction.java
+++ b/core/src/main/java/google/registry/batch/ExpandRecurringBillingEventsAction.java
@@ -25,6 +25,8 @@ import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_AUTORENEW;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.pricing.PricingEngineProxy.getDomainRenewCost;
+import static google.registry.schema.cursor.Cursor.GLOBAL;
+import static google.registry.schema.cursor.CursorDao.loadAndCompare;
 import static google.registry.util.CollectionUtils.union;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static google.registry.util.DateTimeUtils.earliestOf;
@@ -93,6 +95,7 @@ public class ExpandRecurringBillingEventsAction implements Runnable {
  @Override
  public void run() {
    Cursor cursor = ofy().load().key(Cursor.createGlobalKey(RECURRING_BILLING)).now();
+    loadAndCompare(cursor, GLOBAL);
    DateTime executeTime = clock.nowUtc();
    DateTime persistedCursorTime = (cursor == null ? START_OF_TIME : cursor.getCursorTime());
    DateTime cursorTime = cursorTimeParam.orElse(persistedCursorTime);
@@ -152,89 +155,100 @@ public class ExpandRecurringBillingEventsAction implements Runnable {
      }
      int numBillingEventsSaved = 0;
      try {
-        numBillingEventsSaved = tm().transactNew(() -> {
-          ImmutableSet.Builder<OneTime> syntheticOneTimesBuilder =
-              new ImmutableSet.Builder<>();
-          final Registry tld = Registry.get(getTldFromDomainName(recurring.getTargetId()));
+        numBillingEventsSaved =
+            tm().transactNew(
+                    () -> {
+                      ImmutableSet.Builder<OneTime> syntheticOneTimesBuilder =
+                          new ImmutableSet.Builder<>();
+                      final Registry tld =
+                          Registry.get(getTldFromDomainName(recurring.getTargetId()));

-          // Determine the complete set of times at which this recurring event should occur
-          // (up to and including the runtime of the mapreduce).
-          Iterable<DateTime> eventTimes =
-              recurring.getRecurrenceTimeOfYear().getInstancesInRange(Range.closed(
-                  recurring.getEventTime(),
-                  earliestOf(recurring.getRecurrenceEndTime(), executeTime)));
+                      // Determine the complete set of times at which this recurring event should
+                      // occur (up to and including the runtime of the mapreduce).
+                      Iterable<DateTime> eventTimes =
+                          recurring
+                              .getRecurrenceTimeOfYear()
+                              .getInstancesInRange(
+                                  Range.closed(
+                                      recurring.getEventTime(),
+                                      earliestOf(recurring.getRecurrenceEndTime(), executeTime)));

-          // Convert these event times to billing times
-          final ImmutableSet<DateTime> billingTimes =
-              getBillingTimesInScope(eventTimes, cursorTime, executeTime, tld);
+                      // Convert these event times to billing times
+                      final ImmutableSet<DateTime> billingTimes =
+                          getBillingTimesInScope(eventTimes, cursorTime, executeTime, tld);

-          Key<? extends EppResource> domainKey = recurring.getParentKey().getParent();
-          Iterable<OneTime> oneTimesForDomain =
-              ofy().load().type(OneTime.class).ancestor(domainKey);
+                      Key<? extends EppResource> domainKey = recurring.getParentKey().getParent();
+                      Iterable<OneTime> oneTimesForDomain =
+                          ofy().load().type(OneTime.class).ancestor(domainKey);

-          // Determine the billing times that already have OneTime events persisted.
-          ImmutableSet<DateTime> existingBillingTimes =
-              getExistingBillingTimes(oneTimesForDomain, recurring);
+                      // Determine the billing times that already have OneTime events persisted.
+                      ImmutableSet<DateTime> existingBillingTimes =
+                          getExistingBillingTimes(oneTimesForDomain, recurring);

-          ImmutableSet.Builder<HistoryEntry> historyEntriesBuilder =
-              new ImmutableSet.Builder<>();
-          // Create synthetic OneTime events for all billing times that do not yet have an event
-          // persisted.
-          for (DateTime billingTime : difference(billingTimes, existingBillingTimes)) {
-            // Construct a new HistoryEntry that parents over the OneTime
-            HistoryEntry historyEntry = new HistoryEntry.Builder()
-                .setBySuperuser(false)
-                .setClientId(recurring.getClientId())
-                .setModificationTime(tm().getTransactionTime())
-                .setParent(domainKey)
-                .setPeriod(Period.create(1, YEARS))
-                .setReason("Domain autorenewal by ExpandRecurringBillingEventsAction")
-                .setRequestedByRegistrar(false)
-                .setType(DOMAIN_AUTORENEW)
-                // Don't write a domain transaction record if the recurrence was ended prior to the
-                // billing time (i.e. a domain was deleted during the autorenew grace period).
-                .setDomainTransactionRecords(
-                    recurring.getRecurrenceEndTime().isBefore(billingTime)
-                        ? ImmutableSet.of()
-                        : ImmutableSet.of(
-                            DomainTransactionRecord.create(
-                                tld.getTldStr(),
-                                // We report this when the autorenew grace period ends
-                                billingTime,
-                                TransactionReportField.netRenewsFieldFromYears(1),
-                                1)))
-                .build();
-            historyEntriesBuilder.add(historyEntry);
+                      ImmutableSet.Builder<HistoryEntry> historyEntriesBuilder =
+                          new ImmutableSet.Builder<>();
+                      // Create synthetic OneTime events for all billing times that do not yet have
+                      // an event persisted.
+                      for (DateTime billingTime : difference(billingTimes, existingBillingTimes)) {
+                        // Construct a new HistoryEntry that parents over the OneTime
+                        HistoryEntry historyEntry =
+                            new HistoryEntry.Builder()
+                                .setBySuperuser(false)
+                                .setClientId(recurring.getClientId())
+                                .setModificationTime(tm().getTransactionTime())
+                                .setParent(domainKey)
+                                .setPeriod(Period.create(1, YEARS))
+                                .setReason(
+                                    "Domain autorenewal by ExpandRecurringBillingEventsAction")
+                                .setRequestedByRegistrar(false)
+                                .setType(DOMAIN_AUTORENEW)
+                                // Don't write a domain transaction record if the recurrence was
+                                // ended prior to the billing time (i.e. a domain was deleted
+                                // during the autorenew grace period).
+                                .setDomainTransactionRecords(
+                                    recurring.getRecurrenceEndTime().isBefore(billingTime)
+                                        ? ImmutableSet.of()
+                                        : ImmutableSet.of(
+                                            DomainTransactionRecord.create(
+                                                tld.getTldStr(),
+                                                // We report this when the autorenew grace period
+                                                // ends
+                                                billingTime,
+                                                TransactionReportField.netRenewsFieldFromYears(1),
+                                                1)))
+                                .build();
+                        historyEntriesBuilder.add(historyEntry);

-            DateTime eventTime = billingTime.minus(tld.getAutoRenewGracePeriodLength());
-            // Determine the cost for a one-year renewal.
-            Money renewCost = getDomainRenewCost(recurring.getTargetId(), eventTime, 1);
-            syntheticOneTimesBuilder.add(new OneTime.Builder()
-                .setBillingTime(billingTime)
-                .setClientId(recurring.getClientId())
-                .setCost(renewCost)
-                .setEventTime(eventTime)
-                .setFlags(union(recurring.getFlags(), Flag.SYNTHETIC))
-                .setParent(historyEntry)
-                .setPeriodYears(1)
-                .setReason(recurring.getReason())
-                .setSyntheticCreationTime(executeTime)
-                .setCancellationMatchingBillingEvent(Key.create(recurring))
-                .setTargetId(recurring.getTargetId())
-                .build());
-          }
-          Set<HistoryEntry> historyEntries = historyEntriesBuilder.build();
-          Set<OneTime> syntheticOneTimes = syntheticOneTimesBuilder.build();
-          if (!isDryRun) {
-            ImmutableSet<ImmutableObject> entitiesToSave =
-                new ImmutableSet.Builder<ImmutableObject>()
-                    .addAll(historyEntries)
-                    .addAll(syntheticOneTimes)
-                    .build();
-            ofy().save().entities(entitiesToSave).now();
-          }
-          return syntheticOneTimes.size();
-        });
+                        DateTime eventTime = billingTime.minus(tld.getAutoRenewGracePeriodLength());
+                        // Determine the cost for a one-year renewal.
+                        Money renewCost = getDomainRenewCost(recurring.getTargetId(), eventTime, 1);
+                        syntheticOneTimesBuilder.add(
+                            new OneTime.Builder()
+                                .setBillingTime(billingTime)
+                                .setClientId(recurring.getClientId())
+                                .setCost(renewCost)
+                                .setEventTime(eventTime)
+                                .setFlags(union(recurring.getFlags(), Flag.SYNTHETIC))
+                                .setParent(historyEntry)
+                                .setPeriodYears(1)
+                                .setReason(recurring.getReason())
+                                .setSyntheticCreationTime(executeTime)
+                                .setCancellationMatchingBillingEvent(recurring.createVKey())
+                                .setTargetId(recurring.getTargetId())
+                                .build());
+                      }
+                      Set<HistoryEntry> historyEntries = historyEntriesBuilder.build();
+                      Set<OneTime> syntheticOneTimes = syntheticOneTimesBuilder.build();
+                      if (!isDryRun) {
+                        ImmutableSet<ImmutableObject> entitiesToSave =
+                            new ImmutableSet.Builder<ImmutableObject>()
+                                .addAll(historyEntries)
+                                .addAll(syntheticOneTimes)
+                                .build();
+                        ofy().save().entities(entitiesToSave).now();
+                      }
+                      return syntheticOneTimes.size();
+                    });
      } catch (Throwable t) {
        getContext().incrementCounter("error: " + t.getClass().getSimpleName());
        getContext().incrementCounter(ERROR_COUNTER);
@@ -276,7 +290,8 @@ public class ExpandRecurringBillingEventsAction implements Runnable {
      return Streams.stream(oneTimesForDomain)
          .filter(
              billingEvent ->
-                  Key.create(recurringEvent)
+                  recurringEvent
+                      .createVKey()
                      .equals(billingEvent.getCancellationMatchingBillingEvent()))
          .map(OneTime::getBillingTime)
          .collect(toImmutableSet());
@@ -317,6 +332,7 @@ public class ExpandRecurringBillingEventsAction implements Runnable {
      tm().transact(
              () -> {
                Cursor cursor = ofy().load().key(Cursor.createGlobalKey(RECURRING_BILLING)).now();
+                loadAndCompare(cursor, GLOBAL);
                DateTime currentCursorTime =
                    (cursor == null ? START_OF_TIME : cursor.getCursorTime());
                if (!currentCursorTime.equals(expectedPersistedCursorTime)) {
@@ -327,8 +343,7 @@ public class ExpandRecurringBillingEventsAction implements Runnable {
                }
                if (!isDryRun) {
                  CursorDao.saveCursor(
-                      Cursor.createGlobal(RECURRING_BILLING, executionTime),
-                      google.registry.schema.cursor.Cursor.GLOBAL);
+                      Cursor.createGlobal(RECURRING_BILLING, executionTime), GLOBAL);
                }
              });
    }
--- a/core/src/main/java/google/registry/batch/RefreshDnsOnHostRenameAction.java
+++ b/core/src/main/java/google/registry/batch/RefreshDnsOnHostRenameAction.java
@@ -52,6 +52,7 @@ import google.registry.mapreduce.inputs.NullInput;
 import google.registry.model.domain.DomainBase;
 import google.registry.model.host.HostResource;
 import google.registry.model.server.Lock;
+import google.registry.persistence.VKey;
 import google.registry.request.Action;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
@@ -206,18 +207,18 @@ public class RefreshDnsOnHostRenameAction implements Runnable {
      Key<HostResource> referencingHostKey = null;
      for (DnsRefreshRequest request : refreshRequests) {
        if (isActive(domain, request.lastUpdateTime())
-            && domain.getNameservers().contains(request.hostKey())) {
+            && domain.getNameservers().contains(VKey.from(request.hostKey()))) {
          referencingHostKey = request.hostKey();
          break;
        }
      }
      if (referencingHostKey != null) {
        retrier.callWithRetry(
-            () -> dnsQueue.addDomainRefreshTask(domain.getFullyQualifiedDomainName()),
+            () -> dnsQueue.addDomainRefreshTask(domain.getDomainName()),
            TransientFailureException.class);
        logger.atInfo().log(
            "Enqueued DNS refresh for domain %s referenced by host %s.",
-            domain.getFullyQualifiedDomainName(), referencingHostKey);
+            domain.getDomainName(), referencingHostKey);
        getContext().incrementCounter("domains refreshed");
      } else {
        getContext().incrementCounter("domains not refreshed");
--- a/core/src/main/java/google/registry/batch/RelockDomainAction.java
+++ b/core/src/main/java/google/registry/batch/RelockDomainAction.java
@@ -0,0 +1,168 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.batch;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
+import static google.registry.request.Action.Method.POST;
+import static google.registry.tools.LockOrUnlockDomainCommand.REGISTRY_LOCK_STATUSES;
+import static javax.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
+import static javax.servlet.http.HttpServletResponse.SC_NO_CONTENT;
+import static javax.servlet.http.HttpServletResponse.SC_OK;
+
+import com.google.common.collect.ImmutableSet;
+import com.google.common.flogger.FluentLogger;
+import com.google.common.net.MediaType;
+import google.registry.model.domain.DomainBase;
+import google.registry.model.eppcommon.StatusValue;
+import google.registry.model.registry.RegistryLockDao;
+import google.registry.request.Action;
+import google.registry.request.Parameter;
+import google.registry.request.Response;
+import google.registry.request.auth.Auth;
+import google.registry.schema.domain.RegistryLock;
+import google.registry.tools.DomainLockUtils;
+import google.registry.util.DateTimeUtils;
+import javax.inject.Inject;
+
+/**
+ * Task that relocks a previously-Registry-Locked domain after some predetermined period of time.
+ */
+@Action(
+    service = Action.Service.BACKEND,
+    path = RelockDomainAction.PATH,
+    method = POST,
+    automaticallyPrintOk = true,
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
+public class RelockDomainAction implements Runnable {
+
+  public static final String PATH = "/_dr/task/relockDomain";
+  public static final String OLD_UNLOCK_REVISION_ID_PARAM = "oldUnlockRevisionId";
+
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  private final long oldUnlockRevisionId;
+  private final DomainLockUtils domainLockUtils;
+  private final Response response;
+
+  @Inject
+  public RelockDomainAction(
+      @Parameter(OLD_UNLOCK_REVISION_ID_PARAM) long oldUnlockRevisionId,
+      DomainLockUtils domainLockUtils,
+      Response response) {
+    this.oldUnlockRevisionId = oldUnlockRevisionId;
+    this.domainLockUtils = domainLockUtils;
+    this.response = response;
+  }
+
+  @Override
+  public void run() {
+    jpaTm().transact(this::relockDomain);
+  }
+
+  private void relockDomain() {
+    RegistryLock oldLock;
+    try {
+      oldLock =
+          RegistryLockDao.getByRevisionId(oldUnlockRevisionId)
+              .orElseThrow(
+                  () ->
+                      new IllegalArgumentException(
+                          String.format("Unknown revision ID %d", oldUnlockRevisionId)));
+      DomainBase domain =
+          ofy()
+              .load()
+              .type(DomainBase.class)
+              .id(oldLock.getRepoId())
+              .now()
+              .cloneProjectedAtTime(jpaTm().getTransactionTime());
+
+      if (domain.getStatusValues().containsAll(REGISTRY_LOCK_STATUSES)
+          || oldLock.getRelock() != null) {
+        // The domain was manually locked, so we shouldn't worry about relocking
+        String message =
+            String.format(
+                "Domain %s is already manually relocked, skipping automated relock.",
+                domain.getDomainName());
+        logger.atInfo().log(message);
+        // SC_NO_CONTENT (204) skips retry -- see the comment below
+        response.setStatus(SC_NO_CONTENT);
+        response.setContentType(MediaType.PLAIN_TEXT_UTF_8);
+        response.setPayload(message);
+        return;
+      }
+      verifyDomainAndLockState(oldLock, domain);
+    } catch (Throwable t) {
+      /* If there's a bad verification code or the domain is in a bad state, we won't want to retry.
+       * AppEngine will retry on non-2xx error codes, so we return SC_NO_CONTENT (204) to avoid it.
+       *
+       * See https://cloud.google.com/appengine/docs/standard/java/taskqueue/push/retrying-tasks
+       * for more details on retry behavior. */
+      logger.atWarning().withCause(t).log(
+          "Exception when attempting to relock domain with old revision ID %d.",
+          oldUnlockRevisionId);
+      response.setStatus(SC_NO_CONTENT);
+      response.setContentType(MediaType.PLAIN_TEXT_UTF_8);
+      response.setPayload(String.format("Relock failed: %s", t.getMessage()));
+      return;
+    }
+    applyRelock(oldLock);
+  }
+
+  private void applyRelock(RegistryLock oldLock) {
+    try {
+      domainLockUtils.administrativelyApplyLock(
+          oldLock.getDomainName(),
+          oldLock.getRegistrarId(),
+          oldLock.getRegistrarPocId(),
+          oldLock.isSuperuser());
+      logger.atInfo().log("Relocked domain %s.", oldLock.getDomainName());
+      response.setStatus(SC_OK);
+    } catch (Throwable t) {
+      // Any errors that occur here are unexpected, so we should retry. Return a non-2xx
+      // error code to get AppEngine to retry
+      logger.atSevere().withCause(t).log(
+          "Exception when attempting to relock domain %s.", oldLock.getDomainName());
+      response.setStatus(SC_INTERNAL_SERVER_ERROR);
+      response.setContentType(MediaType.PLAIN_TEXT_UTF_8);
+      response.setPayload(String.format("Relock failed: %s", t.getMessage()));
+    }
+  }
+
+  private void verifyDomainAndLockState(RegistryLock oldLock, DomainBase domain) {
+    // Domain shouldn't be deleted or have a pending transfer/delete
+    String domainName = domain.getDomainName();
+    checkArgument(
+        !DateTimeUtils.isAtOrAfter(jpaTm().getTransactionTime(), domain.getDeletionTime()),
+        "Domain %s has been deleted",
+        domainName);
+    ImmutableSet<StatusValue> statusValues = domain.getStatusValues();
+    checkArgument(
+        !statusValues.contains(StatusValue.PENDING_DELETE),
+        "Domain %s has a pending delete",
+        domainName);
+    checkArgument(
+        !statusValues.contains(StatusValue.PENDING_TRANSFER),
+        "Domain %s has a pending transfer",
+        domainName);
+    checkArgument(
+        domain.getCurrentSponsorClientId().equals(oldLock.getRegistrarId()),
+        "Domain %s has been transferred from registrar %s to registrar %s since the unlock",
+        domainName,
+        oldLock.getRegistrarId(),
+        domain.getCurrentSponsorClientId());
+  }
+}
--- a/core/src/main/java/google/registry/beam/initsql/BackupPaths.java
+++ b/core/src/main/java/google/registry/beam/initsql/BackupPaths.java
@@ -0,0 +1,117 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.initsql;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Preconditions.checkNotNull;
+import static com.google.common.base.Strings.isNullOrEmpty;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Streams;
+import org.joda.time.DateTime;
+
+/**
+ * Helpers for determining the fully qualified paths to Nomulus backup files. A backup consists of a
+ * Datastore export and Nomulus CommitLogs that overlap with the export.
+ */
+public final class BackupPaths {
+
+  private BackupPaths() {}
+
+  private static final String WILDCARD_CHAR = "*";
+  private static final String EXPORT_PATTERN_TEMPLATE = "%s/all_namespaces/kind_%s/input-%s";
+
+  public static final String COMMIT_LOG_NAME_PREFIX = "commit_diff_until_";
+  private static final String COMMIT_LOG_PATTERN_TEMPLATE = "%s/" + COMMIT_LOG_NAME_PREFIX + "*";
+
+  /**
+   * Pattern of the per-project file with Cloud SQL connection information. To get a concrete path,
+   * user needs to provide the name of the environment, alpha, crash, sandbox, or production. This
+   * file is meant for applications without access to secrets stored in Datastore.
+   *
+   * <p>In production, this is an base-64 encoded encrypted file with one line, which contains
+   * space-separated values of Cloud SQL instance name, login, and password.
+   *
+   * <p>A plain text may be used for tests to a local database. Replace Cloud SQL instance name with
+   * JDBC URL.
+   */
+  private static final String SQL_CONN_INFO_FILE_PATTERN =
+      "gs://domain-registry-dev-deploy/cloudsql-credentials/%s/admin_credential.enc";
+
+  private static final ImmutableSet<String> ALLOWED_ENV =
+      ImmutableSet.of("alpha", "crash", "sandbox", "production");
+
+  /**
+   * Returns a regex pattern that matches all Datastore export files of a given {@code kind}.
+   *
+   * @param exportDir path to the top directory of a Datastore export
+   * @param kind the 'kind' of the Datastore entity
+   */
+  public static String getExportFileNamePattern(String exportDir, String kind) {
+    checkArgument(!isNullOrEmpty(exportDir), "Null or empty exportDir.");
+    checkArgument(!isNullOrEmpty(kind), "Null or empty kind.");
+    return String.format(EXPORT_PATTERN_TEMPLATE, exportDir, kind, WILDCARD_CHAR);
+  }
+
+  /**
+   * Returns an {@link ImmutableList} of regex patterns that match all Datastore export files of the
+   * given {@code kinds}.
+   *
+   * @param exportDir path to the top directory of a Datastore export
+   * @param kinds all entity 'kinds' to be matched
+   */
+  public static ImmutableList<String> getExportFilePatterns(
+      String exportDir, Iterable<String> kinds) {
+    checkNotNull(kinds, "kinds");
+    return Streams.stream(kinds)
+        .map(kind -> getExportFileNamePattern(exportDir, kind))
+        .collect(ImmutableList.toImmutableList());
+  }
+
+  /**
+   * Returns the fully qualified path of a Datastore export file with the given {@code kind} and
+   * {@code shard}.
+   *
+   * @param exportDir path to the top directory of a Datastore export
+   * @param kind the 'kind' of the Datastore entity
+   * @param shard an integer suffix of the file name
+   */
+  public static String getExportFileNameByShard(String exportDir, String kind, int shard) {
+    checkArgument(!isNullOrEmpty(exportDir), "Null or empty exportDir.");
+    checkArgument(!isNullOrEmpty(kind), "Null or empty kind.");
+    checkArgument(shard >= 0, "Negative shard %s not allowed.", shard);
+    return String.format(EXPORT_PATTERN_TEMPLATE, exportDir, kind, Integer.toString(shard));
+  }
+
+  /** Returns an {@link ImmutableList} of regex patterns that match all CommitLog files. */
+  public static ImmutableList<String> getCommitLogFilePatterns(String commitLogDir) {
+    return ImmutableList.of(String.format(COMMIT_LOG_PATTERN_TEMPLATE, commitLogDir));
+  }
+
+  /** Gets the Commit timestamp from a CommitLog file name. */
+  public static DateTime getCommitLogTimestamp(String fileName) {
+    checkArgument(!isNullOrEmpty(fileName), "Null or empty fileName.");
+    int start = fileName.lastIndexOf(COMMIT_LOG_NAME_PREFIX);
+    checkArgument(start >= 0, "Illegal file name %s.", fileName);
+    return DateTime.parse(fileName.substring(start + COMMIT_LOG_NAME_PREFIX.length()));
+  }
+
+  public static ImmutableList<String> getCloudSQLCredentialFilePatterns(String environmentName) {
+    checkArgument(
+        ALLOWED_ENV.contains(environmentName), "Invalid environment name %s", environmentName);
+    return ImmutableList.of(String.format(SQL_CONN_INFO_FILE_PATTERN, environmentName));
+  }
+}
--- a/core/src/main/java/google/registry/beam/initsql/BeamJpaModule.java
+++ b/core/src/main/java/google/registry/beam/initsql/BeamJpaModule.java
@@ -0,0 +1,192 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.initsql;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Preconditions.checkState;
+import static com.google.common.base.Strings.isNullOrEmpty;
+
+import com.google.common.base.Splitter;
+import dagger.Binds;
+import dagger.Component;
+import dagger.Lazy;
+import dagger.Module;
+import dagger.Provides;
+import google.registry.config.CredentialModule;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.config.RegistryConfig.ConfigModule;
+import google.registry.keyring.kms.KmsModule;
+import google.registry.persistence.PersistenceModule;
+import google.registry.persistence.PersistenceModule.JdbcJpaTm;
+import google.registry.persistence.PersistenceModule.SocketFactoryJpaTm;
+import google.registry.persistence.transaction.JpaTransactionManager;
+import google.registry.util.Clock;
+import google.registry.util.Sleeper;
+import google.registry.util.SystemClock;
+import google.registry.util.SystemSleeper;
+import google.registry.util.UtilsModule;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.nio.channels.Channels;
+import java.nio.charset.StandardCharsets;
+import java.util.List;
+import javax.annotation.Nullable;
+import javax.inject.Singleton;
+import org.apache.beam.sdk.io.FileSystems;
+import org.apache.beam.sdk.io.fs.ResourceId;
+
+/**
+ * Provides bindings for {@link JpaTransactionManager} to Cloud SQL.
+ *
+ * <p>This module is intended for use in BEAM pipelines, and uses a BEAM utility to access GCS like
+ * a regular file system.
+ */
+@Module
+public class BeamJpaModule {
+
+  private static final String GCS_SCHEME = "gs://";
+
+  @Nullable private final String credentialFilePath;
+
+  /**
+   * Constructs a new instance of {@link BeamJpaModule}.
+   *
+   * <p>Note: it is an unfortunately necessary antipattern to check for the validity of
+   * credentialFilePath in {@link #provideCloudSqlAccessInfo} rather than in the constructor.
+   * Unfortunately, this is a restriction imposed upon us by Dagger. Specifically, because we use
+   * this in at least one 1 {@link google.registry.tools.RegistryTool} command(s), it must be
+   * instantiated in {@code google.registry.tools.RegistryToolComponent} for all possible commands;
+   * Dagger doesn't permit it to ever be null. For the vast majority of commands, it will never be
+   * used (so a null credential file path is fine in those cases).
+   *
+   * @param credentialFilePath the path to a Cloud SQL credential file. This must refer to either a
+   *     real encrypted file on GCS as returned by {@link
+   *     BackupPaths#getCloudSQLCredentialFilePatterns} or an unencrypted file on local filesystem
+   *     with credentials to a test database.
+   */
+  public BeamJpaModule(@Nullable String credentialFilePath) {
+    this.credentialFilePath = credentialFilePath;
+  }
+
+  /** Returns true if the credential file is on GCS (and therefore expected to be encrypted). */
+  private boolean isCloudSqlCredential() {
+    return credentialFilePath.startsWith(GCS_SCHEME);
+  }
+
+  @Provides
+  @Singleton
+  SqlAccessInfo provideCloudSqlAccessInfo(Lazy<CloudSqlCredentialDecryptor> lazyDecryptor) {
+    checkArgument(!isNullOrEmpty(credentialFilePath), "Null or empty credentialFilePath");
+    String line = readOnlyLineFromCredentialFile();
+    if (isCloudSqlCredential()) {
+      line = lazyDecryptor.get().decrypt(line);
+    }
+    // See ./BackupPaths.java for explanation of the line format.
+    List<String> parts = Splitter.on(' ').splitToList(line.trim());
+    checkState(parts.size() == 3, "Expecting three phrases in %s", line);
+    if (isCloudSqlCredential()) {
+      return SqlAccessInfo.createCloudSqlAccessInfo(parts.get(0), parts.get(1), parts.get(2));
+    } else {
+      return SqlAccessInfo.createLocalSqlAccessInfo(parts.get(0), parts.get(1), parts.get(2));
+    }
+  }
+
+  String readOnlyLineFromCredentialFile() {
+    try {
+      ResourceId resourceId = FileSystems.matchSingleFileSpec(credentialFilePath).resourceId();
+      try (BufferedReader reader =
+          new BufferedReader(
+              new InputStreamReader(
+                  Channels.newInputStream(FileSystems.open(resourceId)), StandardCharsets.UTF_8))) {
+        return reader.readLine();
+      }
+    } catch (IOException e) {
+      throw new RuntimeException(e);
+    }
+  }
+
+  @Provides
+  @Config("beamCloudSqlJdbcUrl")
+  String provideJdbcUrl(SqlAccessInfo sqlAccessInfo) {
+    return sqlAccessInfo.jdbcUrl();
+  }
+
+  @Provides
+  @Config("beamCloudSqlInstanceConnectionName")
+  String provideSqlInstanceName(SqlAccessInfo sqlAccessInfo) {
+    return sqlAccessInfo
+        .cloudSqlInstanceName()
+        .orElseThrow(() -> new IllegalStateException("Cloud SQL not provisioned."));
+  }
+
+  @Provides
+  @Config("beamCloudSqlUsername")
+  String provideSqlUsername(SqlAccessInfo sqlAccessInfo) {
+    return sqlAccessInfo.user();
+  }
+
+  @Provides
+  @Config("beamCloudSqlPassword")
+  String provideSqlPassword(SqlAccessInfo sqlAccessInfo) {
+    return sqlAccessInfo.password();
+  }
+
+  @Provides
+  @Config("beamCloudKmsProjectId")
+  static String kmsProjectId() {
+    return "domain-registry-dev";
+  }
+
+  @Provides
+  @Config("beamCloudKmsKeyRing")
+  static String keyRingName() {
+    return "nomulus-tool-keyring";
+  }
+
+  @Provides
+  @Config("beamHibernateHikariMaximumPoolSize")
+  static int getBeamHibernateHikariMaximumPoolSize() {
+    return 4;
+  }
+
+  @Module
+  interface BindModule {
+
+    @Binds
+    Sleeper sleeper(SystemSleeper sleeper);
+
+    @Binds
+    Clock clock(SystemClock clock);
+  }
+
+  @Singleton
+  @Component(
+      modules = {
+        ConfigModule.class,
+        CredentialModule.class,
+        BeamJpaModule.class,
+        KmsModule.class,
+        PersistenceModule.class,
+        UtilsModule.class
+      })
+  public interface JpaTransactionManagerComponent {
+    @SocketFactoryJpaTm
+    JpaTransactionManager cloudSqlJpaTransactionManager();
+
+    @JdbcJpaTm
+    JpaTransactionManager localDbJpaTransactionManager();
+  }
+}
--- a/core/src/main/java/google/registry/beam/initsql/CloudSqlCredentialDecryptor.java
+++ b/core/src/main/java/google/registry/beam/initsql/CloudSqlCredentialDecryptor.java
@@ -0,0 +1,50 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.initsql;
+
+import static com.google.common.base.Preconditions.checkArgument;
+
+import com.google.api.services.cloudkms.v1.model.DecryptRequest;
+import com.google.common.base.Strings;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.keyring.kms.KmsConnection;
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import javax.inject.Inject;
+
+/**
+ * Decrypts data using Cloud KMS, with the same crypto key with which Cloud SQL credential files on
+ * GCS was encrypted. See {@link BackupPaths#getCloudSQLCredentialFilePatterns} for more
+ * information.
+ */
+public class CloudSqlCredentialDecryptor {
+
+  private static final String CRYPTO_KEY_NAME = "nomulus-tool-key";
+  private final KmsConnection kmsConnection;
+
+  @Inject
+  CloudSqlCredentialDecryptor(@Config("beamKmsConnection") KmsConnection kmsConnection) {
+    this.kmsConnection = kmsConnection;
+  }
+
+  public String decrypt(String data) {
+    checkArgument(!Strings.isNullOrEmpty(data), "Null or empty data.");
+    byte[] ciphertext = Base64.getDecoder().decode(data);
+    // Re-encode for Cloud KMS JSON REST API, invoked through kmsConnection.
+    String urlSafeCipherText = new DecryptRequest().encodeCiphertext(ciphertext).getCiphertext();
+    return new String(
+        kmsConnection.decrypt(CRYPTO_KEY_NAME, urlSafeCipherText), StandardCharsets.UTF_8);
+  }
+}
--- a/core/src/main/java/google/registry/beam/initsql/README.md
+++ b/core/src/main/java/google/registry/beam/initsql/README.md
@@ -0,0 +1,3 @@
+## Summary
+
+This package contains a BEAM pipeline that populates a Cloud SQL database from a Datastore backup.
--- a/core/src/main/java/google/registry/beam/initsql/SqlAccessInfo.java
+++ b/core/src/main/java/google/registry/beam/initsql/SqlAccessInfo.java
@@ -0,0 +1,45 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.initsql;
+
+import com.google.auto.value.AutoValue;
+import java.util.Optional;
+
+/**
+ * Information needed to connect to a database, including JDBC URL, user name, password, and in the
+ * case of Cloud SQL, the database instance's name.
+ */
+@AutoValue
+abstract class SqlAccessInfo {
+
+  abstract String jdbcUrl();
+
+  abstract String user();
+
+  abstract String password();
+
+  abstract Optional<String> cloudSqlInstanceName();
+
+  public static SqlAccessInfo createCloudSqlAccessInfo(
+      String sqlInstanceName, String username, String password) {
+    return new AutoValue_SqlAccessInfo(
+        "jdbc:postgresql://google/postgres", username, password, Optional.of(sqlInstanceName));
+  }
+
+  public static SqlAccessInfo createLocalSqlAccessInfo(
+      String jdbcUrl, String username, String password) {
+    return new AutoValue_SqlAccessInfo(jdbcUrl, username, password, Optional.empty());
+  }
+}
--- a/core/src/main/java/google/registry/beam/initsql/Transforms.java
+++ b/core/src/main/java/google/registry/beam/initsql/Transforms.java
@@ -0,0 +1,325 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.initsql;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Preconditions.checkNotNull;
+import static com.google.common.base.Preconditions.checkState;
+import static google.registry.beam.initsql.BackupPaths.getCommitLogTimestamp;
+import static google.registry.beam.initsql.BackupPaths.getExportFilePatterns;
+import static google.registry.util.DateTimeUtils.START_OF_TIME;
+import static google.registry.util.DateTimeUtils.isBeforeOrAt;
+import static java.util.Comparator.comparing;
+import static org.apache.beam.sdk.values.TypeDescriptors.kvs;
+import static org.apache.beam.sdk.values.TypeDescriptors.strings;
+
+import avro.shaded.com.google.common.collect.Iterators;
+import com.google.common.annotations.VisibleForTesting;
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.Streams;
+import google.registry.backup.CommitLogImports;
+import google.registry.backup.VersionedEntity;
+import google.registry.tools.LevelDbLogReader;
+import java.util.Collection;
+import java.util.Iterator;
+import java.util.Optional;
+import java.util.Set;
+import org.apache.beam.sdk.coders.StringUtf8Coder;
+import org.apache.beam.sdk.io.Compression;
+import org.apache.beam.sdk.io.FileIO;
+import org.apache.beam.sdk.io.FileIO.ReadableFile;
+import org.apache.beam.sdk.io.fs.EmptyMatchTreatment;
+import org.apache.beam.sdk.io.fs.MatchResult.Metadata;
+import org.apache.beam.sdk.transforms.Create;
+import org.apache.beam.sdk.transforms.DoFn;
+import org.apache.beam.sdk.transforms.Flatten;
+import org.apache.beam.sdk.transforms.GroupByKey;
+import org.apache.beam.sdk.transforms.MapElements;
+import org.apache.beam.sdk.transforms.PTransform;
+import org.apache.beam.sdk.transforms.ParDo;
+import org.apache.beam.sdk.transforms.ProcessFunction;
+import org.apache.beam.sdk.values.KV;
+import org.apache.beam.sdk.values.PBegin;
+import org.apache.beam.sdk.values.PCollection;
+import org.apache.beam.sdk.values.PCollectionList;
+import org.apache.beam.sdk.values.PCollectionTuple;
+import org.apache.beam.sdk.values.TupleTag;
+import org.apache.beam.sdk.values.TupleTagList;
+import org.apache.beam.sdk.values.TypeDescriptor;
+import org.joda.time.DateTime;
+
+/**
+ * {@link PTransform Pipeline transforms} used in pipelines that load from both Datastore export
+ * files and Nomulus CommitLog files.
+ */
+public final class Transforms {
+
+  private Transforms() {}
+
+  /**
+   * The commitTimestamp assigned to all entities loaded from a Datastore export file. The exact
+   * value does not matter, but it must be lower than the timestamps of real CommitLog records.
+   */
+  @VisibleForTesting static final long EXPORT_ENTITY_TIME_STAMP = START_OF_TIME.getMillis();
+
+  /**
+   * Returns a {@link TupleTag} that can be used to retrieve entities of the given {@code kind} from
+   * the Datastore snapshot returned by {@link #loadDatastoreSnapshot}.
+   */
+  public static TupleTag<VersionedEntity> createTagForKind(String kind) {
+    // When used with PCollectionTuple the result must retain generic type information.
+    // Both the Generic param and the empty bracket below are important.
+    return new TupleTag<VersionedEntity>(Transforms.class.getSimpleName() + ":" + kind) {};
+  }
+
+  /**
+   * Composite {@link PTransform transform} that loads the Datastore snapshot at {@code
+   * commitLogToTime} for caller specified {@code kinds}.
+   *
+   * <p>Caller must provide the location of a Datastore export that started AFTER {@code
+   * commitLogFromTime} and completed BEFORE {@code commitLogToTime}, as well as the root directory
+   * of all CommitLog files.
+   *
+   * <p>Selection of {@code commitLogFromTime} and {@code commitLogToTime} should follow the
+   * guidelines below to ensure that all incremental changes concurrent with the export are covered:
+   *
+   * <ul>
+   *   <li>Two or more CommitLogs should exist between {@code commitLogFromTime} and the starting
+   *       time of the Datastore export. This ensures that the earlier CommitLog file was complete
+   *       before the export started.
+   *   <li>Two or more CommitLogs should exit between the export completion time and {@code
+   *       commitLogToTime}.
+   * </ul>
+   *
+   * <p>The output from the returned transform is a {@link PCollectionTuple} consisting of {@link
+   * VersionedEntity VersionedEntities} grouped into {@link PCollection PCollections} by {@code
+   * kind}.
+   */
+  public static PTransform<PBegin, PCollectionTuple> loadDatastoreSnapshot(
+      String exportDir,
+      String commitLogDir,
+      DateTime commitLogFromTime,
+      DateTime commitLogToTime,
+      Set<String> kinds) {
+    checkArgument(kinds != null && !kinds.isEmpty(), "At least one kind is expected.");
+
+    // Create tags to collect entities by kind in final step.
+    final ImmutableMap<String, TupleTag<VersionedEntity>> outputTags =
+        kinds.stream()
+            .collect(ImmutableMap.toImmutableMap(kind -> kind, Transforms::createTagForKind));
+    // Arbitrarily select one tag as mainOutTag and put the remaining ones in a TupleTagList.
+    // This separation is required by ParDo's config API.
+    Iterator<TupleTag<VersionedEntity>> tagsIt = outputTags.values().iterator();
+    final TupleTag<VersionedEntity> mainOutputTag = tagsIt.next();
+    final TupleTagList additionalTags = TupleTagList.of(ImmutableList.copyOf(tagsIt));
+
+    return new PTransform<PBegin, PCollectionTuple>() {
+      @Override
+      public PCollectionTuple expand(PBegin input) {
+        PCollection<VersionedEntity> exportedEntities =
+            input
+                .apply("Get export file patterns", getDatastoreExportFilePatterns(exportDir, kinds))
+                .apply("Find export files", getFilesByPatterns())
+                .apply("Load export data", loadExportDataFromFiles());
+        PCollection<VersionedEntity> commitLogEntities =
+            input
+                .apply("Get commitlog file patterns", getCommitLogFilePatterns(commitLogDir))
+                .apply("Find commitlog files", getFilesByPatterns())
+                .apply(
+                    "Filter commitLog by time",
+                    filterCommitLogsByTime(commitLogFromTime, commitLogToTime))
+                .apply("Load commitlog data", loadCommitLogsFromFiles(kinds));
+        return PCollectionList.of(exportedEntities)
+            .and(commitLogEntities)
+            .apply("Merge exports and CommitLogs", Flatten.pCollections())
+            .apply(
+                "Key entities by Datastore Keys",
+                // Converting to KV<String, VE> instead of KV<Key, VE> b/c default coder for Key
+                // (SerializableCoder) is not deterministic and cannot be used with GroupBy.
+                MapElements.into(kvs(strings(), TypeDescriptor.of(VersionedEntity.class)))
+                    .via((VersionedEntity e) -> KV.of(e.key().toString(), e)))
+            .apply("Gather entities by key", GroupByKey.create())
+            .apply(
+                "Output latest version per entity",
+                ParDo.of(
+                        new DoFn<KV<String, Iterable<VersionedEntity>>, VersionedEntity>() {
+                          @ProcessElement
+                          public void processElement(
+                              @Element KV<String, Iterable<VersionedEntity>> kv,
+                              MultiOutputReceiver out) {
+                            Optional<VersionedEntity> latest =
+                                Streams.stream(kv.getValue())
+                                    .sorted(comparing(VersionedEntity::commitTimeMills).reversed())
+                                    .findFirst();
+                            // Throw to abort (after default retries). Investigate, fix, and rerun.
+                            checkState(
+                                latest.isPresent(), "Unexpected key with no data", kv.getKey());
+                            if (latest.get().isDelete()) {
+                              return;
+                            }
+                            String kind = latest.get().getEntity().get().getKind();
+                            out.get(outputTags.get(kind)).output(latest.get());
+                          }
+                        })
+                    .withOutputTags(mainOutputTag, additionalTags));
+      }
+    };
+  }
+
+  /**
+   * Returns a {@link PTransform transform} that can generate a collection of patterns that match
+   * all Datastore CommitLog files.
+   */
+  public static PTransform<PBegin, PCollection<String>> getCommitLogFilePatterns(
+      String commitLogDir) {
+    return toStringPCollection(BackupPaths.getCommitLogFilePatterns(commitLogDir));
+  }
+
+  /**
+   * Returns a {@link PTransform transform} that can generate a collection of patterns that match
+   * all Datastore export files of the given {@code kinds}.
+   */
+  public static PTransform<PBegin, PCollection<String>> getDatastoreExportFilePatterns(
+      String exportDir, Collection<String> kinds) {
+    return toStringPCollection(getExportFilePatterns(exportDir, kinds));
+  }
+
+  public static PTransform<PBegin, PCollection<String>> getCloudSqlConnectionInfoFilePatterns(
+      String gcpProjectName) {
+    return toStringPCollection(BackupPaths.getCloudSQLCredentialFilePatterns(gcpProjectName));
+  }
+
+  /**
+   * Returns a {@link PTransform} from file name patterns to file {@link Metadata Metadata records}.
+   */
+  public static PTransform<PCollection<String>, PCollection<Metadata>> getFilesByPatterns() {
+    return new PTransform<PCollection<String>, PCollection<Metadata>>() {
+      @Override
+      public PCollection<Metadata> expand(PCollection<String> input) {
+        return input.apply(FileIO.matchAll().withEmptyMatchTreatment(EmptyMatchTreatment.DISALLOW));
+      }
+    };
+  }
+
+  /**
+   * Returns CommitLog files with timestamps between {@code fromTime} (inclusive) and {@code
+   * endTime} (exclusive).
+   */
+  public static PTransform<PCollection<? extends Metadata>, PCollection<Metadata>>
+      filterCommitLogsByTime(DateTime fromTime, DateTime toTime) {
+    return ParDo.of(new FilterCommitLogFileByTime(fromTime, toTime));
+  }
+
+  /** Returns a {@link PTransform} from file {@link Metadata} to {@link VersionedEntity}. */
+  public static PTransform<PCollection<Metadata>, PCollection<VersionedEntity>>
+      loadExportDataFromFiles() {
+    return processFiles(
+        new BackupFileReader(
+            file ->
+                Iterators.transform(
+                    LevelDbLogReader.from(file.open()),
+                    (byte[] bytes) -> VersionedEntity.from(EXPORT_ENTITY_TIME_STAMP, bytes))));
+  }
+
+  /** Returns a {@link PTransform} from file {@link Metadata} to {@link VersionedEntity}. */
+  public static PTransform<PCollection<Metadata>, PCollection<VersionedEntity>>
+      loadCommitLogsFromFiles(Set<String> kinds) {
+    return processFiles(
+        new BackupFileReader(
+            file ->
+                CommitLogImports.loadEntities(file.open()).stream()
+                    .filter(e -> kinds.contains(e.key().getKind()))
+                    .iterator()));
+  }
+
+  /**
+   * Returns a {@link PTransform} that produces a {@link PCollection} containing all elements in the
+   * given {@link Iterable}.
+   */
+  static PTransform<PBegin, PCollection<String>> toStringPCollection(Iterable<String> strings) {
+    return Create.of(strings).withCoder(StringUtf8Coder.of());
+  }
+
+  /**
+   * Returns a {@link PTransform} from file {@link Metadata} to {@link VersionedEntity} using
+   * caller-provided {@code transformer}.
+   */
+  static PTransform<PCollection<Metadata>, PCollection<VersionedEntity>> processFiles(
+      DoFn<ReadableFile, VersionedEntity> transformer) {
+    return new PTransform<PCollection<Metadata>, PCollection<VersionedEntity>>() {
+      @Override
+      public PCollection<VersionedEntity> expand(PCollection<Metadata> input) {
+        return input
+            .apply(FileIO.readMatches().withCompression(Compression.UNCOMPRESSED))
+            .apply(transformer.getClass().getSimpleName(), ParDo.of(transformer));
+      }
+    };
+  }
+
+  private static class FilterCommitLogFileByTime extends DoFn<Metadata, Metadata> {
+    private final DateTime fromTime;
+    private final DateTime toTime;
+
+    public FilterCommitLogFileByTime(DateTime fromTime, DateTime toTime) {
+      checkNotNull(fromTime, "fromTime");
+      checkNotNull(toTime, "toTime");
+      checkArgument(
+          fromTime.isBefore(toTime),
+          "Invalid time range: fromTime (%s) is before endTime (%s)",
+          fromTime,
+          toTime);
+      this.fromTime = fromTime;
+      this.toTime = toTime;
+    }
+
+    @ProcessElement
+    public void processElement(@Element Metadata fileMeta, OutputReceiver<Metadata> out) {
+      DateTime timestamp = getCommitLogTimestamp(fileMeta.resourceId().toString());
+      if (isBeforeOrAt(fromTime, timestamp) && timestamp.isBefore(toTime)) {
+        out.output(fileMeta);
+      }
+    }
+  }
+
+  /**
+   * Reads from a Datastore backup file and converts its content into {@link VersionedEntity
+   * VersionedEntities}.
+   *
+   * <p>The input file may be either a LevelDb file from a Datastore export or a CommitLog file
+   * generated by the Nomulus server. In either case, the file contains variable-length records and
+   * must be read sequentially from the beginning. If the read fails, the file needs to be retried
+   * from the beginning.
+   */
+  private static class BackupFileReader extends DoFn<ReadableFile, VersionedEntity> {
+    private final ProcessFunction<ReadableFile, Iterator<VersionedEntity>> reader;
+
+    private BackupFileReader(ProcessFunction<ReadableFile, Iterator<VersionedEntity>> reader) {
+      this.reader = reader;
+    }
+
+    @ProcessElement
+    public void processElement(@Element ReadableFile file, OutputReceiver<VersionedEntity> out) {
+      try {
+        reader.apply(file).forEachRemaining(out::output);
+      } catch (Exception e) {
+        // Let the pipeline use default retry strategy on the whole file. For GCP Dataflow this
+        // means retrying up to 4 times (may include other files grouped with this one), and failing
+        // the pipeline if no success.
+        throw new RuntimeException(e);
+      }
+    }
+  }
+}
--- a/core/src/main/java/google/registry/beam/invoicing/BillingEvent.java
+++ b/core/src/main/java/google/registry/beam/invoicing/BillingEvent.java
@@ -235,6 +235,7 @@ public abstract class BillingEvent implements Serializable {
                DATE_TIME_FORMATTER.format(eventTime()),
                registrarId(),
                billingId(),
+                poNumber(),
                tld(),
                action(),
                domain(),
--- a/core/src/main/java/google/registry/beam/invoicing/sql/billing_events.sql
+++ b/core/src/main/java/google/registry/beam/invoicing/sql/billing_events.sql
@@ -56,7 +56,8 @@ FROM (
      `%PROJECT_ID%.%DATASTORE_EXPORT_DATA_SET%.%REGISTRY_TABLE%`
    WHERE
    -- TODO(b/18092292): Add a filter for tldState (not PDT/PREDELEGATION)
-      tldType = 'REAL') ) AS BillingEvent
+      tldType = 'REAL'
+    AND disableInvoicing is not TRUE) ) AS BillingEvent
  -- Gather billing ID from registrar table
  -- This is a 'JOIN' as opposed to 'LEFT JOIN' to filter out
  -- non-billable registrars
--- a/core/src/main/java/google/registry/beam/spec11/SafeBrowsingTransforms.java
+++ b/core/src/main/java/google/registry/beam/spec11/SafeBrowsingTransforms.java
@@ -141,7 +141,7 @@ public class SafeBrowsingTransforms {
    @ProcessElement
    public void processElement(ProcessContext context) {
      Subdomain subdomain = context.element();
-      subdomainBuffer.put(subdomain.fullyQualifiedDomainName(), subdomain);
+      subdomainBuffer.put(subdomain.domainName(), subdomain);
      if (subdomainBuffer.size() >= BATCH_SIZE) {
        ImmutableSet<KV<Subdomain, ThreatMatch>> results = evaluateAndFlush();
        results.forEach(context::output);
@@ -239,7 +239,7 @@ public class SafeBrowsingTransforms {
            String url = match.getJSONObject("threat").getString("url");
            Subdomain subdomain = subdomainBuffer.get(url);
            resultBuilder.add(
-                KV.of(subdomain, ThreatMatch.create(match, subdomain.fullyQualifiedDomainName())));
+                KV.of(subdomain, ThreatMatch.create(match, subdomain.domainName())));
          }
        }
      }
--- a/core/src/main/java/google/registry/beam/spec11/Spec11Pipeline.java
+++ b/core/src/main/java/google/registry/beam/spec11/Spec11Pipeline.java
@@ -77,7 +77,7 @@ public class Spec11Pipeline implements Serializable {
  public static final String REGISTRAR_EMAIL_FIELD = "registrarEmailAddress";
  /** The JSON object field into which we put the registrar's name for Spec11 reports. */
  public static final String REGISTRAR_CLIENT_ID_FIELD = "registrarClientId";
-  /** The JSON object field we put the threat match array for Spec11 reports. */
+  /** The JSON object field into which we put the threat match array for Spec11 reports. */
  public static final String THREAT_MATCHES_FIELD = "threatMatches";

  private final String projectId;
@@ -94,8 +94,7 @@ public class Spec11Pipeline implements Serializable {
      @Config("spec11TemplateUrl") String spec11TemplateUrl,
      @Config("reportingBucketUrl") String reportingBucketUrl,
      @LocalCredential GoogleCredentialsBundle googleCredentialsBundle,
-      Retrier retrier
-  ) {
+      Retrier retrier) {
    this.projectId = projectId;
    this.beamStagingUrl = beamStagingUrl;
    this.spec11TemplateUrl = spec11TemplateUrl;
@@ -177,9 +176,11 @@ public class Spec11Pipeline implements Serializable {
      PCollection<Subdomain> domains,
      EvaluateSafeBrowsingFn evaluateSafeBrowsingFn,
      ValueProvider<String> dateProvider) {
-    PCollection<KV<Subdomain, ThreatMatch>> subdomains =
+
+    /* Store ThreatMatch objects in JSON. */
+    PCollection<KV<Subdomain, ThreatMatch>> subdomainsJson =
        domains.apply("Run through SafeBrowsingAPI", ParDo.of(evaluateSafeBrowsingFn));
-    subdomains
+    subdomainsJson
        .apply(
            "Map registrar client ID to email/ThreatMatch pair",
            MapElements.into(
@@ -188,7 +189,7 @@ public class Spec11Pipeline implements Serializable {
                .via(
                    (KV<Subdomain, ThreatMatch> kv) ->
                        KV.of(
-                            kv.getKey().registrarClientId(),
+                            kv.getKey().registrarId(),
                            EmailAndThreatMatch.create(
                                kv.getKey().registrarEmailAddress(), kv.getValue()))))
        .apply("Group by registrar client ID", GroupByKey.create())
--- a/core/src/main/java/google/registry/beam/spec11/Subdomain.java
+++ b/core/src/main/java/google/registry/beam/spec11/Subdomain.java
@@ -36,12 +36,14 @@ import org.apache.beam.sdk.io.gcp.bigquery.SchemaAndRecord;
 public abstract class Subdomain implements Serializable {

  private static final ImmutableList<String> FIELD_NAMES =
-      ImmutableList.of("fullyQualifiedDomainName", "registrarClientId", "registrarEmailAddress");
+      ImmutableList.of("domainName", "domainRepoId", "registrarId", "registrarEmailAddress");

  /** Returns the fully qualified domain name. */
-  abstract String fullyQualifiedDomainName();
-  /** Returns the client ID of the associated registrar for this domain. */
-  abstract String registrarClientId();
+  abstract String domainName();
+  /** Returns the domain repo ID (the primary key of the domain table). */
+  abstract String domainRepoId();
+  /** Returns the registrar ID of the associated registrar for this domain. */
+  abstract String registrarId();
  /** Returns the email address of the registrar associated with this domain. */
  abstract String registrarEmailAddress();

@@ -56,8 +58,9 @@ public abstract class Subdomain implements Serializable {
    checkFieldsNotNull(FIELD_NAMES, schemaAndRecord);
    GenericRecord record = schemaAndRecord.getRecord();
    return create(
-        extractField(record, "fullyQualifiedDomainName"),
-        extractField(record, "registrarClientId"),
+        extractField(record, "domainName"),
+        extractField(record, "domainRepoId"),
+        extractField(record, "registrarId"),
        extractField(record, "registrarEmailAddress"));
  }

@@ -69,9 +72,11 @@ public abstract class Subdomain implements Serializable {
   */
  @VisibleForTesting
  static Subdomain create(
-      String fullyQualifiedDomainName, String registrarClientId, String registrarEmailAddress) {
+      String domainName,
+      String domainRepoId,
+      String registrarId,
+      String registrarEmailAddress) {
    return new AutoValue_Subdomain(
-        fullyQualifiedDomainName, registrarClientId, registrarEmailAddress);
+        domainName, domainRepoId, registrarId, registrarEmailAddress);
  }
 }
-
--- a/core/src/main/java/google/registry/beam/spec11/ThreatMatch.java
+++ b/core/src/main/java/google/registry/beam/spec11/ThreatMatch.java
@@ -24,22 +24,10 @@ import org.json.JSONObject;
 public abstract class ThreatMatch implements Serializable {

  private static final String THREAT_TYPE_FIELD = "threatType";
-  private static final String PLATFORM_TYPE_FIELD = "platformType";
-  private static final String METADATA_FIELD = "threatEntryMetadata";
  private static final String DOMAIN_NAME_FIELD = "fullyQualifiedDomainName";

  /** Returns what kind of threat it is (malware, phishing etc.) */
  public abstract String threatType();
-  /** Returns what platforms it affects (Windows, Linux etc.) */
-  abstract String platformType();
-  /**
-   * Returns a String representing a JSON Object containing arbitrary metadata associated with this
-   * threat, or "NONE" if there is no metadata to retrieve.
-   *
-   * <p>This ideally would be a {@link JSONObject} type, but can't be due to serialization
-   * requirements.
-   */
-  abstract String metadata();
  /** Returns the fully qualified domain name [SLD].[TLD] of the matched threat. */
  public abstract String fullyQualifiedDomainName();

@@ -52,29 +40,19 @@ public abstract class ThreatMatch implements Serializable {
  static ThreatMatch create(JSONObject threatMatchJSON, String fullyQualifiedDomainName)
      throws JSONException {
    return new AutoValue_ThreatMatch(
-        threatMatchJSON.getString(THREAT_TYPE_FIELD),
-        threatMatchJSON.getString(PLATFORM_TYPE_FIELD),
-        threatMatchJSON.has(METADATA_FIELD)
-            ? threatMatchJSON.getJSONObject(METADATA_FIELD).toString()
-            : "NONE",
-        fullyQualifiedDomainName);
+        threatMatchJSON.getString(THREAT_TYPE_FIELD), fullyQualifiedDomainName);
  }

  /** Returns a {@link JSONObject} representing a subset of this object's data. */
  JSONObject toJSON() throws JSONException {
    return new JSONObject()
        .put(THREAT_TYPE_FIELD, threatType())
-        .put(PLATFORM_TYPE_FIELD, platformType())
-        .put(METADATA_FIELD, metadata())
        .put(DOMAIN_NAME_FIELD, fullyQualifiedDomainName());
  }

  /** Parses a {@link JSONObject} and returns an equivalent {@link ThreatMatch}. */
  public static ThreatMatch fromJSON(JSONObject threatMatch) throws JSONException {
    return new AutoValue_ThreatMatch(
-        threatMatch.getString(THREAT_TYPE_FIELD),
-        threatMatch.getString(PLATFORM_TYPE_FIELD),
-        threatMatch.getString(METADATA_FIELD),
-        threatMatch.getString(DOMAIN_NAME_FIELD));
+        threatMatch.getString(THREAT_TYPE_FIELD), threatMatch.getString(DOMAIN_NAME_FIELD));
  }
 }
--- a/core/src/main/java/google/registry/beam/spec11/sql/subdomains.sql
+++ b/core/src/main/java/google/registry/beam/spec11/sql/subdomains.sql
@@ -19,11 +19,13 @@
  -- email address.

 SELECT
-  domain.fullyQualifiedDomainName AS fullyQualifiedDomainName,
-  registrar.clientId AS registrarClientId,
+  domain.fullyQualifiedDomainName AS domainName,
+  domain.__key__.name AS domainRepoId,
+  registrar.clientId AS clientId,
  COALESCE(registrar.emailAddress, '') AS registrarEmailAddress
 FROM ( (
    SELECT
+      __key__,
      fullyQualifiedDomainName,
      currentSponsorClientId,
      creationTime
--- a/core/src/main/java/google/registry/bigquery/BigqueryConnection.java
+++ b/core/src/main/java/google/registry/bigquery/BigqueryConnection.java
@@ -442,10 +442,8 @@ public class BigqueryConnection implements AutoCloseable {
   * Returns the result of calling queryToLocalTable, but synchronously to avoid spawning new
   * background threads, which App Engine doesn't support.
   *
-   * @see <a href="https://cloud.google.com/appengine/docs/standard/java/runtime#Threads">
-   *   App Engine Runtime</a>
-   *
-   * <p>Returns the results of the query in an ImmutableTable on success.
+   * @see <a href="https://cloud.google.com/appengine/docs/standard/java/runtime#Threads">App Engine
+   *     Runtime</a>
   */
  public ImmutableTable<Integer, TableFieldSchema, Object> queryToLocalTableSync(String querySql) {
    Job job = new Job()
@@ -576,8 +574,6 @@ public class BigqueryConnection implements AutoCloseable {

  /**
   * Launch a job, wait for it to complete, but <i>do not</i> check for errors.
-   *
-   * @throws BigqueryJobFailureException
   */
  public Job runJob(Job job, @Nullable AbstractInputStreamContent data) {
    return checkJob(waitForJob(launchJob(job, data)));
--- a/core/src/main/java/google/registry/config/files/default-config.yaml
+++ b/core/src/main/java/google/registry/config/files/default-config.yaml
@@ -207,8 +207,20 @@ hibernate:

  # Connection pool configurations.
  hikariConnectionTimeout: 20000
-  hikariMinimumIdle: 0
-  hikariMaximumPoolSize: 20
+  # We occasionally received "Connection is not available, request timed out"
+  # exception when setting minimumIdle to 0 and it turned out it is a bug (See
+  # https://github.com/brettwooldridge/HikariCP/issues/1212) in HikariCP.
+  #
+  # We tried to use a fixed size pool but ran into an issue(See b/155383029),
+  # so we need further investigation to figure out the proper size of the pool.
+  #
+  # HikariCP also recommends not setting minimumIdle for maximum performance
+  # and responsiveness to spike demands (See
+  # https://github.com/brettwooldridge/HikariCP).
+  #
+  # TODO(b/154720215): Investigate the long term fix.
+  hikariMinimumIdle: 1
+  hikariMaximumPoolSize: 10
  hikariIdleTimeout: 300000

 cloudSql:
--- a/core/src/main/java/google/registry/dns/DnsQueue.java
+++ b/core/src/main/java/google/registry/dns/DnsQueue.java
@@ -119,35 +119,31 @@ public class DnsQueue {
            .param(PARAM_TLD, tld));
  }

-  /**
-   * Adds a task to the queue to refresh the DNS information for the specified subordinate host.
-   */
-  public TaskHandle addHostRefreshTask(String fullyQualifiedHostName) {
-    Optional<InternetDomainName> tld =
-        Registries.findTldForName(InternetDomainName.from(fullyQualifiedHostName));
-    checkArgument(tld.isPresent(),
-        String.format("%s is not a subordinate host to a known tld", fullyQualifiedHostName));
-    return addToQueue(TargetType.HOST, fullyQualifiedHostName, tld.get().toString(), Duration.ZERO);
+  /** Adds a task to the queue to refresh the DNS information for the specified subordinate host. */
+  public TaskHandle addHostRefreshTask(String hostName) {
+    Optional<InternetDomainName> tld = Registries.findTldForName(InternetDomainName.from(hostName));
+    checkArgument(
+        tld.isPresent(), String.format("%s is not a subordinate host to a known tld", hostName));
+    return addToQueue(TargetType.HOST, hostName, tld.get().toString(), Duration.ZERO);
  }

  /** Enqueues a task to refresh DNS for the specified domain now. */
-  public TaskHandle addDomainRefreshTask(String fullyQualifiedDomainName) {
-    return addDomainRefreshTask(fullyQualifiedDomainName, Duration.ZERO);
+  public TaskHandle addDomainRefreshTask(String domainName) {
+    return addDomainRefreshTask(domainName, Duration.ZERO);
  }

  /** Enqueues a task to refresh DNS for the specified domain at some point in the future. */
-  public TaskHandle addDomainRefreshTask(String fullyQualifiedDomainName, Duration countdown) {
+  public TaskHandle addDomainRefreshTask(String domainName, Duration countdown) {
    return addToQueue(
        TargetType.DOMAIN,
-        fullyQualifiedDomainName,
-        assertTldExists(getTldFromDomainName(fullyQualifiedDomainName)),
+        domainName,
+        assertTldExists(getTldFromDomainName(domainName)),
        countdown);
  }

  /** Adds a task to the queue to refresh the DNS information for the specified zone. */
-  public TaskHandle addZoneRefreshTask(String fullyQualifiedZoneName) {
-    return addToQueue(
-        TargetType.ZONE, fullyQualifiedZoneName, fullyQualifiedZoneName, Duration.ZERO);
+  public TaskHandle addZoneRefreshTask(String zoneName) {
+    return addToQueue(TargetType.ZONE, zoneName, zoneName, Duration.ZERO);
  }

  /**
--- a/core/src/main/java/google/registry/dns/RefreshDnsAction.java
+++ b/core/src/main/java/google/registry/dns/RefreshDnsAction.java
@@ -89,7 +89,7 @@ public final class RefreshDnsAction implements Runnable {
  private static void verifyHostIsSubordinate(HostResource host) {
    if (!host.isSubordinate()) {
      throw new BadRequestException(
-          String.format("%s isn't a subordinate hostname", host.getFullyQualifiedHostName()));
+          String.format("%s isn't a subordinate hostname", host.getHostName()));
    }
  }
 }
--- a/core/src/main/java/google/registry/dns/writer/clouddns/CloudDnsWriter.java
+++ b/core/src/main/java/google/registry/dns/writer/clouddns/CloudDnsWriter.java
@@ -154,7 +154,7 @@ public class CloudDnsWriter extends BaseDnsWriter {
    }

    // Construct NS records (if any).
-    Set<String> nameserverData = domainBase.get().loadNameserverFullyQualifiedHostNames();
+    Set<String> nameserverData = domainBase.get().loadNameserverHostNames();
    Set<String> subordinateHosts = domainBase.get().getSubordinateHosts();
    if (!nameserverData.isEmpty()) {
      HashSet<String> nsRrData = new HashSet<>();
--- a/core/src/main/java/google/registry/dns/writer/dnsupdate/DnsMessageTransport.java
+++ b/core/src/main/java/google/registry/dns/writer/dnsupdate/DnsMessageTransport.java
@@ -84,7 +84,7 @@ public class DnsMessageTransport {
   * @param query a message to send
   * @return the response received from the server
   * @throws IOException if the Socket input/output streams throws one
-   * @throws IllegalArgumentException if the query is too large to be sent (> 65535 bytes)
+   * @throws IllegalArgumentException if the query is too large to be sent (&gt; 65535 bytes)
   */
  public Message send(Message query) throws IOException {
    try (Socket socket = factory.createSocket(InetAddress.getByName(updateHost), DNS_PORT)) {
--- a/core/src/main/java/google/registry/dns/writer/dnsupdate/DnsUpdateWriter.java
+++ b/core/src/main/java/google/registry/dns/writer/dnsupdate/DnsUpdateWriter.java
@@ -189,7 +189,7 @@ public class DnsUpdateWriter extends BaseDnsWriter {
    for (DelegationSignerData signerData : domain.getDsData()) {
      DSRecord dsRecord =
          new DSRecord(
-              toAbsoluteName(domain.getFullyQualifiedDomainName()),
+              toAbsoluteName(domain.getDomainName()),
              DClass.IN,
              dnsDefaultDsTtl.getStandardSeconds(),
              signerData.getKeyTag(),
@@ -215,8 +215,7 @@ public class DnsUpdateWriter extends BaseDnsWriter {

  private void addInBailiwickNameServerSet(DomainBase domain, Update update) {
    for (String hostName :
-        intersection(
-            domain.loadNameserverFullyQualifiedHostNames(), domain.getSubordinateHosts())) {
+        intersection(domain.loadNameserverHostNames(), domain.getSubordinateHosts())) {
      Optional<HostResource> host = loadByForeignKey(HostResource.class, hostName, clock.nowUtc());
      checkState(host.isPresent(), "Host %s cannot be loaded", hostName);
      update.add(makeAddressSet(host.get()));
@@ -226,10 +225,10 @@ public class DnsUpdateWriter extends BaseDnsWriter {

  private RRset makeNameServerSet(DomainBase domain) {
    RRset nameServerSet = new RRset();
-    for (String hostName : domain.loadNameserverFullyQualifiedHostNames()) {
+    for (String hostName : domain.loadNameserverHostNames()) {
      NSRecord record =
          new NSRecord(
-              toAbsoluteName(domain.getFullyQualifiedDomainName()),
+              toAbsoluteName(domain.getDomainName()),
              DClass.IN,
              dnsDefaultNsTtl.getStandardSeconds(),
              toAbsoluteName(hostName));
@@ -244,7 +243,7 @@ public class DnsUpdateWriter extends BaseDnsWriter {
      if (address instanceof Inet4Address) {
        ARecord record =
            new ARecord(
-                toAbsoluteName(host.getFullyQualifiedHostName()),
+                toAbsoluteName(host.getHostName()),
                DClass.IN,
                dnsDefaultATtl.getStandardSeconds(),
                address);
@@ -260,7 +259,7 @@ public class DnsUpdateWriter extends BaseDnsWriter {
      if (address instanceof Inet6Address) {
        AAAARecord record =
            new AAAARecord(
-                toAbsoluteName(host.getFullyQualifiedHostName()),
+                toAbsoluteName(host.getHostName()),
                DClass.IN,
                dnsDefaultATtl.getStandardSeconds(),
                address);
--- a/core/src/main/java/google/registry/env/production/default/WEB-INF/cron.xml
+++ b/core/src/main/java/google/registry/env/production/default/WEB-INF/cron.xml
@@ -279,6 +279,18 @@
    <target>backend</target>
  </cron>

+  <cron>
+    <url><![CDATA[/_dr/task/icannReportingUpload]]></url>
+    <description>
+      Checks if the monthly ICANN reports have been successfully uploaded. If they have not, attempts to upload them again.
+      Most of the time, this job should not do anything since the uploads are triggered when the reports are staged.
+      However, in the event that an upload failed for any reason (e.g. ICANN server is down, IP allow list issues),
+      this cron job will continue to retry uploads daily until they succeed.
+    </description>
+    <schedule>every day 15:00</schedule>
+    <target>backend</target>
+  </cron>
+
  <cron>
    <url><![CDATA[/_dr/cron/fanout?queue=retryable-cron-tasks&endpoint=/_dr/task/generateInvoices&runInEmpty]]></url>
    <description>
--- a/core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml
@@ -7,7 +7,7 @@
  <sessions-enabled>true</sessions-enabled>
  <instance-class>B4_1G</instance-class>
  <manual-scaling>
-    <instances>10</instances>
+    <instances>20</instances>
  </manual-scaling>

  <system-properties>
--- a/core/src/main/java/google/registry/export/BigqueryPollJobAction.java
+++ b/core/src/main/java/google/registry/export/BigqueryPollJobAction.java
@@ -73,8 +73,10 @@ public class BigqueryPollJobAction implements Runnable {

  @Override
  public void run() {
-    checkJobOutcome();  // Throws a NotModifiedException if the job hasn't completed.
-    if (payload == null || payload.length == 0) {
+    boolean jobOutcome =
+        checkJobOutcome(); // Throws a NotModifiedException if the job hasn't completed.
+    // If the job failed, do not enqueue the next step.
+    if (!jobOutcome || payload == null || payload.length == 0) {
      return;
    }
    // If there is a payload, it's a chained task, so enqueue it.
--- a/core/src/main/java/google/registry/export/ExportDomainListsAction.java
+++ b/core/src/main/java/google/registry/export/ExportDomainListsAction.java
@@ -107,7 +107,7 @@ public class ExportDomainListsAction implements Runnable {
    @Override
    public void map(DomainBase domain) {
      if (realTlds.contains(domain.getTld()) && isActive(domain, exportTime)) {
-        emit(domain.getTld(), domain.getFullyQualifiedDomainName());
+        emit(domain.getTld(), domain.getDomainName());
        getContext().incrementCounter(String.format("domains in tld %s", domain.getTld()));
      }
    }
--- a/core/src/main/java/google/registry/export/sheet/SyncRegistrarsSheet.java
+++ b/core/src/main/java/google/registry/export/sheet/SyncRegistrarsSheet.java
@@ -25,6 +25,8 @@ import static google.registry.model.registrar.RegistrarContact.Type.LEGAL;
 import static google.registry.model.registrar.RegistrarContact.Type.MARKETING;
 import static google.registry.model.registrar.RegistrarContact.Type.TECH;
 import static google.registry.model.registrar.RegistrarContact.Type.WHOIS;
+import static google.registry.schema.cursor.Cursor.GLOBAL;
+import static google.registry.schema.cursor.CursorDao.loadAndCompare;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;

 import com.google.common.base.Joiner;
@@ -62,6 +64,7 @@ class SyncRegistrarsSheet {
   */
  boolean wereRegistrarsModified() {
    Cursor cursor = ofy().load().key(Cursor.createGlobalKey(SYNC_REGISTRAR_SHEET)).now();
+    loadAndCompare(cursor, GLOBAL);
    DateTime lastUpdateTime = (cursor == null) ? START_OF_TIME : cursor.getCursorTime();
    for (Registrar registrar : Registrar.loadAllCached()) {
      if (DateTimeUtils.isAtOrAfter(registrar.getLastUpdateTime(), lastUpdateTime)) {
@@ -81,8 +84,7 @@ class SyncRegistrarsSheet {
          public int compare(Registrar left, Registrar right) {
            return left.getClientId().compareTo(right.getClientId());
          }
-        }.immutableSortedCopy(Registrar.loadAllCached())
-            .stream()
+        }.immutableSortedCopy(Registrar.loadAllCached()).stream()
            .filter(
                registrar ->
                    registrar.getType() == Registrar.Type.REAL
@@ -146,7 +148,7 @@ class SyncRegistrarsSheet {
                  builder.put("allowedTlds", convert(registrar.getAllowedTlds()));
                  builder.put("whoisServer", convert(registrar.getWhoisServer()));
                  builder.put("blockPremiumNames", convert(registrar.getBlockPremiumNames()));
-                  builder.put("ipAddressWhitelist", convert(registrar.getIpAddressWhitelist()));
+                  builder.put("ipAddressAllowList", convert(registrar.getIpAddressAllowList()));
                  builder.put("url", convert(registrar.getUrl()));
                  builder.put("referralUrl", convert(registrar.getUrl()));
                  builder.put("icannReferralEmail", convert(registrar.getIcannReferralEmail()));
--- a/core/src/main/java/google/registry/flows/EppXmlSanitizer.java
+++ b/core/src/main/java/google/registry/flows/EppXmlSanitizer.java
@@ -42,8 +42,8 @@ import javax.xml.stream.events.XMLEvent;
 /**
 * Sanitizes sensitive data in incoming/outgoing EPP XML messages.
 *
- * <p>Current implementation masks user credentials (text following <pw> and <newPW> tags) as
- * follows:
+ * <p>Current implementation masks user credentials (text following &lt;pw&gt; and &lt;newPW&gt;
+ * tags) as follows:
 *
 * <ul>
 *   <li>A control character (in ranges [0 - 1F] and [7F - 9F]) is replaced with 'C'.
--- a/core/src/main/java/google/registry/flows/ResourceFlowUtils.java
+++ b/core/src/main/java/google/registry/flows/ResourceFlowUtils.java
@@ -48,6 +48,7 @@ import google.registry.model.eppcommon.AuthInfo;
 import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.index.ForeignKeyIndex;
 import google.registry.model.transfer.TransferStatus;
+import google.registry.persistence.VKey;
 import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
@@ -80,11 +81,9 @@ public final class ResourceFlowUtils {
      final Function<DomainBase, ImmutableSet<?>> getPotentialReferences) throws EppException {
    // Enter a transactionless context briefly.
    EppException failfastException =
-        tm()
-            .doTransactionless(
+        tm().doTransactionless(
                () -> {
-                  final ForeignKeyIndex<R> fki =
-                      ForeignKeyIndex.load(resourceClass, targetId, now);
+                  final ForeignKeyIndex<R> fki = ForeignKeyIndex.load(resourceClass, targetId, now);
                  if (fki == null) {
                    return new ResourceDoesNotExistException(resourceClass, targetId);
                  }
@@ -95,12 +94,12 @@ public final class ResourceFlowUtils {
                   * trust the query and need to do the full mapreduce.
                   */
                  Iterable<Key<DomainBase>> keys =
-                      queryForLinkedDomains(fki.getResourceKey(), now)
+                      queryForLinkedDomains(fki.getResourceKey().getOfyKey(), now)
                          .limit(FAILFAST_CHECK_COUNT)
                          .keys();
+                  VKey<R> resourceVKey = fki.getResourceKey();
                  Predicate<DomainBase> predicate =
-                      domain ->
-                          getPotentialReferences.apply(domain).contains(fki.getResourceKey());
+                      domain -> getPotentialReferences.apply(domain).contains(resourceVKey);
                  return ofy().load().keys(keys).values().stream().anyMatch(predicate)
                      ? new ResourceToDeleteIsReferencedException()
                      : null;
@@ -137,9 +136,9 @@ public final class ResourceFlowUtils {

  public static <R extends EppResource> void verifyResourceDoesNotExist(
      Class<R> clazz, String targetId, DateTime now, String clientId) throws EppException {
-    Key<R> key = loadAndGetKey(clazz, targetId, now);
+    VKey<R> key = loadAndGetKey(clazz, targetId, now);
    if (key != null) {
-      R resource = ofy().load().key(key).now();
+      R resource = tm().load(key);
      // These are similar exceptions, but we can track them internally as log-based metrics.
      if (Objects.equals(clientId, resource.getPersistedCurrentSponsorClientId())) {
        throw new ResourceAlreadyExistsForThisClientException(targetId);
@@ -187,9 +186,8 @@ public final class ResourceFlowUtils {
    }
    // The roid should match one of the contacts.
    Optional<Key<ContactResource>> foundContact =
-        domain
-            .getReferencedContacts()
-            .stream()
+        domain.getReferencedContacts().stream()
+            .map(VKey::getOfyKey)
            .filter(key -> key.getName().equals(authRepoId))
            .findFirst();
    if (!foundContact.isPresent()) {
--- a/core/src/main/java/google/registry/flows/TlsCredentials.java
+++ b/core/src/main/java/google/registry/flows/TlsCredentials.java
@@ -37,7 +37,7 @@ import javax.inject.Inject;
 import javax.servlet.http.HttpServletRequest;

 /**
- * Container and validation for TLS certificate and ip-whitelisting.
+ * Container and validation for TLS certificate and IP-allow-listing.
 *
 * <p>Credentials are based on the following headers:
 *
@@ -48,7 +48,7 @@ import javax.servlet.http.HttpServletRequest;
 *       band.
 *   <dt>X-Forwarded-For
 *   <dd>This field should contain the host and port of the connecting client. It is validated
- *       during an EPP login command against an IP whitelist that is transmitted out of band.
+ *       during an EPP login command against an IP allow list that is transmitted out of band.
 * </dl>
 */
 public class TlsCredentials implements TransportCredentials {
@@ -85,27 +85,28 @@ public class TlsCredentials implements TransportCredentials {
  }

  /**
-   * Verifies {@link #clientInetAddr} is in CIDR whitelist associated with {@code registrar}.
+   * Verifies {@link #clientInetAddr} is in CIDR allow list associated with {@code registrar}.
   *
-   * @throws BadRegistrarIpAddressException If IP address is not in the whitelist provided
+   * @throws BadRegistrarIpAddressException If IP address is not in the allow list provided
   */
  private void validateIp(Registrar registrar) throws AuthenticationErrorException {
-    ImmutableList<CidrAddressBlock> ipWhitelist = registrar.getIpAddressWhitelist();
-    if (ipWhitelist.isEmpty()) {
+    ImmutableList<CidrAddressBlock> ipAddressAllowList = registrar.getIpAddressAllowList();
+    if (ipAddressAllowList.isEmpty()) {
      logger.atInfo().log(
-          "Skipping IP whitelist check because %s doesn't have an IP whitelist",
+          "Skipping IP allow list check because %s doesn't have an IP allow list",
          registrar.getClientId());
      return;
    }
-    for (CidrAddressBlock cidrAddressBlock : ipWhitelist) {
+    for (CidrAddressBlock cidrAddressBlock : ipAddressAllowList) {
      if (cidrAddressBlock.contains(clientInetAddr)) {
-        // IP address is in whitelist; return early.
+        // IP address is in allow list; return early.
        return;
      }
    }
    logger.atInfo().log(
-        "Authentication error: IP address %s is not whitelisted for registrar %s; whitelist is: %s",
-        clientInetAddr, registrar.getClientId(), ipWhitelist);
+        "Authentication error: IP address %s is not allow-listed for registrar %s; allow list is:"
+            + " %s",
+        clientInetAddr, registrar.getClientId(), ipAddressAllowList);
    throw new BadRegistrarIpAddressException();
  }

@@ -180,10 +181,10 @@ public class TlsCredentials implements TransportCredentials {
    }
  }

-  /** Registrar IP address is not in stored whitelist. */
+  /** Registrar IP address is not in stored allow list. */
  public static class BadRegistrarIpAddressException extends AuthenticationErrorException {
    public BadRegistrarIpAddressException() {
-      super("Registrar IP address is not in stored whitelist");
+      super("Registrar IP address is not in stored allow list");
    }
  }

--- a/core/src/main/java/google/registry/flows/contact/ContactCheckFlow.java
+++ b/core/src/main/java/google/registry/flows/contact/ContactCheckFlow.java
@@ -19,6 +19,7 @@ import static google.registry.flows.ResourceFlowUtils.verifyTargetIdCount;
 import static google.registry.model.EppResourceUtils.checkResourcesExist;

 import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.flows.EppException;
 import google.registry.flows.ExtensionManager;
@@ -33,8 +34,6 @@ import google.registry.model.eppoutput.CheckData.ContactCheckData;
 import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
 import google.registry.util.Clock;
-import java.util.List;
-import java.util.Set;
 import javax.inject.Inject;

 /**
@@ -59,9 +58,10 @@ public final class ContactCheckFlow implements Flow {
  public final EppResponse run() throws EppException {
    extensionManager.validate();  // There are no legal extensions for this flow.
    validateClientIsLoggedIn(clientId);
-    List<String> targetIds = ((Check) resourceCommand).getTargetIds();
+    ImmutableList<String> targetIds = ((Check) resourceCommand).getTargetIds();
    verifyTargetIdCount(targetIds, maxChecks);
-    Set<String> existingIds = checkResourcesExist(ContactResource.class, targetIds, clock.nowUtc());
+    ImmutableSet<String> existingIds =
+        checkResourcesExist(ContactResource.class, targetIds, clock.nowUtc());
    ImmutableList.Builder<ContactCheck> checks = new ImmutableList.Builder<>();
    for (String id : targetIds) {
      boolean unused = !existingIds.contains(id);
--- a/core/src/main/java/google/registry/flows/contact/ContactTransferApproveFlow.java
+++ b/core/src/main/java/google/registry/flows/contact/ContactTransferApproveFlow.java
@@ -97,7 +97,7 @@ public final class ContactTransferApproveFlow implements TransactionalFlow {
    ofy().save().<Object>entities(newContact, historyEntry, gainingPollMessage);
    // Delete the billing event and poll messages that were written in case the transfer would have
    // been implicitly server approved.
-    ofy().delete().keys(existingContact.getTransferData().getServerApproveEntities());
+    tm().delete(existingContact.getTransferData().getServerApproveEntities());
    return responseBuilder
        .setResData(createTransferResponse(targetId, newContact.getTransferData()))
        .build();
--- a/core/src/main/java/google/registry/flows/contact/ContactTransferCancelFlow.java
+++ b/core/src/main/java/google/registry/flows/contact/ContactTransferCancelFlow.java
@@ -93,7 +93,7 @@ public final class ContactTransferCancelFlow implements TransactionalFlow {
    ofy().save().<Object>entities(newContact, historyEntry, losingPollMessage);
    // Delete the billing event and poll messages that were written in case the transfer would have
    // been implicitly server approved.
-    ofy().delete().keys(existingContact.getTransferData().getServerApproveEntities());
+    tm().delete(existingContact.getTransferData().getServerApproveEntities());
    return responseBuilder
        .setResData(createTransferResponse(targetId, newContact.getTransferData()))
        .build();
--- a/core/src/main/java/google/registry/flows/contact/ContactTransferRejectFlow.java
+++ b/core/src/main/java/google/registry/flows/contact/ContactTransferRejectFlow.java
@@ -90,7 +90,7 @@ public final class ContactTransferRejectFlow implements TransactionalFlow {
    ofy().save().<Object>entities(newContact, historyEntry, gainingPollMessage);
    // Delete the billing event and poll messages that were written in case the transfer would have
    // been implicitly server approved.
-    ofy().delete().keys(existingContact.getTransferData().getServerApproveEntities());
+    tm().delete(existingContact.getTransferData().getServerApproveEntities());
    return responseBuilder
        .setResData(createTransferResponse(targetId, newContact.getTransferData()))
        .build();
--- a/core/src/main/java/google/registry/flows/contact/ContactTransferRequestFlow.java
+++ b/core/src/main/java/google/registry/flows/contact/ContactTransferRequestFlow.java
@@ -46,7 +46,7 @@ import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.poll.PollMessage;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.model.transfer.TransferData;
+import google.registry.model.transfer.ContactTransferData;
 import google.registry.model.transfer.TransferStatus;
 import java.util.Optional;
 import javax.inject.Inject;
@@ -112,27 +112,30 @@ public final class ContactTransferRequestFlow implements TransactionalFlow {
        .setParent(Key.create(existingContact))
        .build();
    DateTime transferExpirationTime = now.plus(automaticTransferLength);
-    TransferData serverApproveTransferData = new TransferData.Builder()
-        .setTransferRequestTime(now)
-        .setTransferRequestTrid(trid)
-        .setGainingClientId(gainingClientId)
-        .setLosingClientId(losingClientId)
-        .setPendingTransferExpirationTime(transferExpirationTime)
-        .setTransferStatus(TransferStatus.SERVER_APPROVED)
-        .build();
+    ContactTransferData serverApproveTransferData =
+        new ContactTransferData.Builder()
+            .setTransferRequestTime(now)
+            .setTransferRequestTrid(trid)
+            .setGainingClientId(gainingClientId)
+            .setLosingClientId(losingClientId)
+            .setPendingTransferExpirationTime(transferExpirationTime)
+            .setTransferStatus(TransferStatus.SERVER_APPROVED)
+            .build();
    // If the transfer is server approved, this message will be sent to the losing registrar. */
    PollMessage serverApproveLosingPollMessage =
        createLosingTransferPollMessage(targetId, serverApproveTransferData, historyEntry);
    // If the transfer is server approved, this message will be sent to the gaining registrar. */
    PollMessage serverApproveGainingPollMessage =
        createGainingTransferPollMessage(targetId, serverApproveTransferData, historyEntry);
-    TransferData pendingTransferData = serverApproveTransferData.asBuilder()
-        .setTransferStatus(TransferStatus.PENDING)
-        .setServerApproveEntities(
-            ImmutableSet.of(
-                Key.create(serverApproveGainingPollMessage),
-                Key.create(serverApproveLosingPollMessage)))
-        .build();
+    ContactTransferData pendingTransferData =
+        serverApproveTransferData
+            .asBuilder()
+            .setTransferStatus(TransferStatus.PENDING)
+            .setServerApproveEntities(
+                ImmutableSet.of(
+                    serverApproveGainingPollMessage.createVKey(),
+                    serverApproveLosingPollMessage.createVKey()))
+            .build();
    // When a transfer is requested, a poll message is created to notify the losing registrar.
    PollMessage requestPollMessage =
        createLosingTransferPollMessage(targetId, pendingTransferData, historyEntry).asBuilder()
--- a/Show More
+++ b/Show More