Use 10 workers instead of the default 100 for re-save all EPP resources (#904 )

* Use 10 workers instead of the default 100 for re-save all EPP resources The intended/desired effect is to have a larger number of GCS commit log diffs spread out over a longer period of time, with each diff itself being significantly smaller. This should retain roughly the same amount of total work for the async Cloud SQL replication action to have to deal with, but spread across 10X as much time.
Add a credential store backed by Secret Manager (#901 )
2026-02-02 02:52:30 +00:00 · 2020-12-10 15:25:25 -05:00 · 2020-12-10 11:29:44 -05:00 · 2020-12-09 15:52:56 -05:00 · 2020-12-09 10:30:23 -05:00 · 2020-12-08 15:13:44 -05:00
757 changed files with 42830 additions and 7199 deletions
--- a/build.gradle
+++ b/build.gradle
@@ -191,7 +191,7 @@ allprojects {
 }

 task runPresubmits(type: Exec) {
-  executable '/usr/bin/python'
+  executable '/usr/bin/python3'
  args('config/presubmits.py')
 }

@@ -260,7 +260,7 @@ subprojects {
      // in the 'configurations' block, the following code must run after
      // project evaluation, when all configurations have been created.
      configurations.each {
-        if (it.name != 'dependencyLicenseReport') {
+        if (it.name != 'dependencyLicenseReport' && it.name != 'integration') {
          it.resolutionStrategy.activateDependencyLocking()
        }
      }
--- a/buildSrc/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/buildSrc/gradle/dependency-locks/annotationProcessor.lockfile
@@ -1,25 +1,28 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto.value:auto-value:1.6.3
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/buildSrc/gradle/dependency-locks/compile.lockfile
+++ b/buildSrc/gradle/dependency-locks/compile.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/compileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/compileClasspath.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/deploy_jar.lockfile
+++ b/buildSrc/gradle/dependency-locks/deploy_jar.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/runtime.lockfile
+++ b/buildSrc/gradle/dependency-locks/runtime.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/testAnnotationProcessor.lockfile
+++ b/buildSrc/gradle/dependency-locks/testAnnotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/buildSrc/gradle/dependency-locks/testCompile.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompile.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -58,7 +58,7 @@ org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -58,7 +58,7 @@ org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/buildSrc/gradle/dependency-locks/testRuntime.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntime.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -58,7 +58,7 @@ org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -58,7 +58,7 @@ org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/common/gradle/dependency-locks/annotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/common/gradle/dependency-locks/compile.lockfile
+++ b/common/gradle/dependency-locks/compile.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/compileClasspath.lockfile
+++ b/common/gradle/dependency-locks/compileClasspath.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/default.lockfile
+++ b/common/gradle/dependency-locks/default.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/deploy_jar.lockfile
+++ b/common/gradle/dependency-locks/deploy_jar.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/errorprone.lockfile
+++ b/common/gradle/dependency-locks/errorprone.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/common/gradle/dependency-locks/runtime.lockfile
+++ b/common/gradle/dependency-locks/runtime.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/testAnnotationProcessor.lockfile
+++ b/common/gradle/dependency-locks/testAnnotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/common/gradle/dependency-locks/testCompile.lockfile
+++ b/common/gradle/dependency-locks/testCompile.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,7 +17,7 @@ joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/common/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,7 +17,7 @@ joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/testRuntime.lockfile
+++ b/common/gradle/dependency-locks/testRuntime.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -18,7 +18,7 @@ joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -18,7 +18,7 @@ joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/testingAnnotationProcessor.lockfile
+++ b/common/gradle/dependency-locks/testingAnnotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/common/gradle/dependency-locks/testingCompile.lockfile
+++ b/common/gradle/dependency-locks/testingCompile.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -16,6 +16,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingCompileClasspath.lockfile
+++ b/common/gradle/dependency-locks/testingCompileClasspath.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -16,6 +16,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingRuntime.lockfile
+++ b/common/gradle/dependency-locks/testingRuntime.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,6 +17,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingRuntimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/testingRuntimeClasspath.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,6 +17,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/src/main/java/google/registry/util/DateTimeUtils.java
+++ b/common/src/main/java/google/registry/util/DateTimeUtils.java
@@ -24,6 +24,7 @@ import java.time.ZonedDateTime;
 import java.util.TimeZone;
 import org.joda.time.DateTime;
 import org.joda.time.DateTimeZone;
+import org.joda.time.LocalDate;

 /** Utilities methods and constants related to Joda {@link DateTime} objects. */
 public class DateTimeUtils {
@@ -108,4 +109,12 @@ public class DateTimeUtils {
        zonedDateTime.toInstant().toEpochMilli(),
        DateTimeZone.forTimeZone(TimeZone.getTimeZone(zonedDateTime.getZone())));
  }
+
+  public static java.sql.Date toSqlDate(LocalDate localDate) {
+    return new java.sql.Date(localDate.toDateTimeAtStartOfDay().getMillis());
+  }
+
+  public static LocalDate toLocalDate(java.sql.Date date) {
+    return new LocalDate(date.getTime(), DateTimeZone.UTC);
+  }
 }
--- a/common/src/main/java/google/registry/util/SystemSleeper.java
+++ b/common/src/main/java/google/registry/util/SystemSleeper.java
@@ -18,7 +18,6 @@ import static com.google.common.base.Preconditions.checkArgument;

 import com.google.common.util.concurrent.Uninterruptibles;
 import java.io.Serializable;
-import java.util.concurrent.TimeUnit;
 import javax.annotation.concurrent.ThreadSafe;
 import javax.inject.Inject;
 import org.joda.time.ReadableDuration;
@@ -41,6 +40,6 @@ public final class SystemSleeper implements Sleeper, Serializable {
  @Override
  public void sleepUninterruptibly(ReadableDuration duration) {
    checkArgument(duration.getMillis() >= 0);
-    Uninterruptibles.sleepUninterruptibly(duration.getMillis(), TimeUnit.MILLISECONDS);
+    Uninterruptibles.sleepUninterruptibly(java.time.Duration.ofMillis(duration.getMillis()));
  }
 }
--- a/common/src/testing/java/google/registry/testing/truth/TruthUtils.java
+++ b/common/src/testing/java/google/registry/testing/truth/TruthUtils.java
@@ -0,0 +1,47 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.testing.truth;
+
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import com.google.common.truth.Truth;
+import javax.annotation.Nullable;
+
+/** Utils class containing helper functions for {@link Truth}. */
+public class TruthUtils {
+
+  /** Asserts that both of the given objects are either null or nonnull. */
+  public static void assertNullnessParity(@Nullable Object thisObj, @Nullable Object thatObj) {
+    if (thisObj == null) {
+      assertWithMessage("Expects both objects are null but thatObj is not null")
+          .that(thatObj)
+          .isNull();
+    } else {
+      assertWithMessage("Expects both objects are not null but thatObj is null")
+          .that(thatObj)
+          .isNotNull();
+    }
+  }
+
+  /** Asserts that both of the given objects are either null or nonnull. */
+  public static void assertNullnessParity(
+      @Nullable Object thisObj, @Nullable Object thatObj, String errorMessage) {
+    if (thisObj == null) {
+      assertWithMessage(errorMessage).that(thatObj).isNull();
+    } else {
+      assertWithMessage(errorMessage).that(thatObj).isNotNull();
+    }
+  }
+}
--- a/config/nom_build.py
+++ b/config/nom_build.py
@@ -16,7 +16,7 @@
 """

 import argparse
-import attr
+import dataclasses
 import io
 import os
 import shutil
@@ -25,7 +25,7 @@ import sys
 from typing import List, Union


-@attr.s(auto_attribs=True)
+@dataclasses.dataclass
 class Property:
    name : str = ''
    desc : str = ''
@@ -39,7 +39,7 @@ class Property:
                raise ValidationError('value of {self.name} must be "true" or '
                                      '"false".')

-@attr.s(auto_attribs=True)
+@dataclasses.dataclass
 class GradleFlag:
    flags : Union[str, List[str]]
    desc : str
@@ -75,6 +75,7 @@ Pseudo-commands:
 """

 # Define all of our special gradle properties here.
+# TODO(b/169318491): use consistent naming style for properties and variables.
 PROPERTIES = [
    Property('mavenUrl',
             'URL to use for the main maven repository (defaults to maven '
@@ -124,6 +125,9 @@ PROPERTIES = [
             'server/schema integration tests. Please refer to <a '
             'href="./integration/README.md">integration project</a> for more '
             'information.'),
+    Property('baseSchemaTag',
+             'The nomulus version tag of the schema for use in the schema'
+             'deployment integration test (:db:schemaIncrementalDeployTest)'),
    Property('schema_version',
             'The nomulus version tag of the schema for use in a database'
             'integration test.'),
@@ -296,9 +300,15 @@ def do_pseudo_task(task: str) -> None:
                    f'{root}/db/src/main/resources/sql/schema/'
                    'nomulus.golden.sql')

-        if subprocess.call([f'{root}/gradlew', ':db:test']):
-            print('\033[31mERROR:\033[0m Golden file test failed after '
-                  'copying schema.  Please check your flyway files.')
+        # Rerun :db:test and regenerate the ER diagram (at "warning" log
+        # level so it doesn't generate pages of messaging)
+        if subprocess.call([f'{root}/gradlew', ':db:test', 'devTool',
+                            '--args=-e localhost --log_level=WARNING '
+                            'generate_sql_er_diagram -o '
+                            f'{root}/db/src/main/resources/sql/er_diagram']):
+            print('\033[31mERROR:\033[0m Golden file test or ER diagram '
+                  'generation failed after copying schema.  Please check your '
+                  'flyway files.')
            raise Abort()
    else:
        print(f'\033[31mERROR:\033[0m Unknown task {task}')
@@ -373,6 +383,7 @@ def main(args) -> int:

    # See if there are any special ":nom:" pseudo-tasks specified.
    got_non_pseudo_tasks = False
+    got_pseudo_tasks = False
    for arg in args.non_flag_args[1:]:
        if arg.startswith(':nom:'):
            if got_non_pseudo_tasks:
@@ -384,13 +395,14 @@ def main(args) -> int:
                      'specified prior to all actual gradle tasks.  Aborting.')
                return 1
            do_pseudo_task(arg)
+            got_pseudo_tasks = True
        else:
            got_non_pseudo_tasks = True
    non_flag_args = [
        arg for arg in args.non_flag_args[1:] if not arg.startswith(':nom:')]

    if not non_flag_args:
-        if not got_non_pseudo_tasks:
+        if not got_pseudo_tasks:
            print('\033[33mWARNING:\033[0m No tasks specified.  Not '
                  'doing anything')
        return 0
--- a/config/nom_build_test.py
+++ b/config/nom_build_test.py
@@ -113,7 +113,10 @@ class MyTest(unittest.TestCase):
        nom_build.main(['nom_build', ':nom:generate_golden_file'])
        self.call_mock.assert_has_calls([
            mock.call([GRADLEW, ':db:test']),
-            mock.call([GRADLEW, ':db:test'])
+            mock.call([GRADLEW, ':db:test', 'devTool',
+                       '--args=-e localhost --log_level=WARNING '
+                       'generate_sql_er_diagram -o '
+                       '/tmp/rootdir/db/src/main/resources/sql/er_diagram'])
        ])

    def test_generate_golden_file_nofail(self):
@@ -122,5 +125,3 @@ class MyTest(unittest.TestCase):
        self.call_mock.assert_has_calls([mock.call([GRADLEW, ':db:test'])])

 unittest.main()
-
-
--- a/config/presubmits.py
+++ b/config/presubmits.py
@@ -18,6 +18,7 @@ Error Prone) so we must write them manually.
 """

 import os
+from typing import List, Tuple
 import sys
 import re

@@ -178,6 +179,90 @@ PRESUBMITS = {
        "JavaScript files should not include console logging."
 }

+# Note that this regex only works for one kind of Flyway file.  If we want to
+# start using "R" and "U" files we'll need to update this script.
+FLYWAY_FILE_RX = re.compile(r'V(\d+)__.*')
+
+
+def get_seqnum(filename: str, location: str) -> int:
+  """Extracts the sequence number from a filename."""
+  m = FLYWAY_FILE_RX.match(filename)
+  if m is None:
+    raise ValueError('Illegal Flyway filename: %s in %s' % (filename, location))
+  return int(m.group(1))
+
+
+def files_by_seqnum(files: List[str], location: str) -> List[Tuple[int, str]]:
+  """Returns the list of seqnum, filename sorted by sequence number."""
+  return [(get_seqnum(filename, location), filename) for filename in files]
+
+
+def has_valid_order(indexed_files: List[Tuple[int, str]], location: str) -> bool:
+  """Verify that sequence numbers are in order without gaps or duplicates.
+
+  Args:
+    files: List of seqnum, filename for a list of Flyway files.
+    location: Where the list of files came from (for error reporting).
+
+  Returns:
+    True if the file list is valid.
+  """
+  last_index = 0
+  valid = True
+  for seqnum, filename in indexed_files:
+    if seqnum == last_index:
+      print('duplicate Flyway file sequence number found in %s: %s' %
+            (location, filename))
+      valid = False
+    elif seqnum < last_index:
+      print('File %s in %s is out of order.' % (filename, location))
+      valid = False
+    elif seqnum != last_index + 1:
+      print('Missing Flyway sequence number %d in %s.  Next file is %s' %
+            (last_index + 1, location, filename))
+      valid = False
+    last_index = seqnum
+  return valid
+
+
+def verify_flyway_index():
+  """Verifies that the Flyway index file is in sync with the directory."""
+  success = True
+
+  # Sort the files in the Flyway directory by their sequence number.
+  files = sorted(
+      files_by_seqnum(os.listdir('db/src/main/resources/sql/flyway'),
+                      'Flyway directory'))
+
+  # Make sure that there are no gaps and no duplicate sequence numbers in the
+  # files themselves.
+  if not has_valid_order(files, 'Flyway directory'):
+    success = False
+
+  # Remove the sequence numbers and compare against the index file contents.
+  files = [filename[1] for filename in sorted(files)]
+  with open('db/src/main/resources/sql/flyway.txt') as index:
+    indexed_files = index.read().splitlines()
+  if files != indexed_files:
+    unindexed = set(files) - set(indexed_files)
+    if unindexed:
+      print('The following Flyway files are not in flyway.txt: %s' % unindexed)
+
+    nonexistent = set(indexed_files) - set(files)
+    if nonexistent:
+      print('The following files are in flyway.txt but not in the Flyway '
+            'directory: %s' % nonexistent)
+
+    # Do an ordering check on the index file (ignore the result, we're failing
+    # anyway).
+    has_valid_order(files_by_seqnum(indexed_files, 'flyway.txt'), 'flyway.txt')
+    success = False
+
+  if not success:
+    print('Please fix any conflicts and run "./nom_build :db:generateFlywayIndex"')
+
+  return not success
+

 def get_files():
  for root, dirnames, filenames in os.walk("."):
@@ -197,5 +282,10 @@ if __name__ == "__main__":
      failed = True
      print("%s had errors: \n  %s" % (file, "\n  ".join(error_messages)))

+  # And now for something completely different: check to see if the Flyway
+  # index is up-to-date.  It's quicker to do it here than in the unit tests:
+  # when we put it here it fails fast before all of the tests are run.
+  failed |= verify_flyway_index()
+
  if failed:
    sys.exit(1)
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -63,8 +63,6 @@ def dockerIncompatibleTestPatterns = [
    // methods, so we exclude the whole test class.
    "google/registry/tools/params/PathParameterTest.*",
    "google/registry/persistence/PersistenceModuleTest.*",
-    // This test is failing in docker when using Java 11. The cause is unclear.
-    "google/registry/tools/DomainLockUtilsTest.*",
 ]

 // Tests that conflict with members of both the main test suite and the
@@ -173,6 +171,8 @@ dependencies {
  testRuntime files(sourceSets.test.resources.srcDirs)

  compile deps['com.beust:jcommander']
+  compile deps['com.google.api:gax']
+  compile deps['com.google.api.grpc:proto-google-cloud-secretmanager-v1']
  compile deps['com.google.api-client:google-api-client']
  compile deps['com.google.api-client:google-api-client-appengine']
  compile deps['com.google.api-client:google-api-client-servlet']
@@ -198,6 +198,7 @@ dependencies {
  compile deps['com.google.auth:google-auth-library-oauth2-http']
  compile deps['com.google.cloud.sql:jdbc-socket-factory-core']
  runtimeOnly deps['com.google.cloud.sql:postgres-socket-factory']
+  compile deps['com.google.cloud:google-cloud-secretmanager']
  compile deps['com.google.code.gson:gson']
  compile deps['com.google.auto.value:auto-value-annotations']
  compile deps['com.google.code.findbugs:jsr305']
@@ -217,12 +218,15 @@ dependencies {
  compile deps['com.google.oauth-client:google-oauth-client-jetty']
  compile deps['com.google.oauth-client:google-oauth-client-appengine']
  compile deps['com.google.oauth-client:google-oauth-client-servlet']
+  compile deps['com.google.protobuf:protobuf-java']
  compile deps['com.google.re2j:re2j']
  compile deps['com.google.template:soy']
  compile deps['com.googlecode.json-simple:json-simple']
  compile deps['com.jcraft:jsch']
  testCompile deps['com.thoughtworks.qdox:qdox']
+  compile deps['com.zaxxer:HikariCP']
  compile deps['dnsjava:dnsjava']
+  runtime deps['guru.nidi:graphviz-java-all-j2v8']
  testCompile deps['io.github.classgraph:classgraph']
  testRuntime deps['io.github.java-diff-utils:java-diff-utils']
  testCompile deps['javax.annotation:javax.annotation-api']
@@ -247,6 +251,7 @@ dependencies {
  testCompile deps['org.apache.ftpserver:ftpserver-core']
  compile deps['org.apache.httpcomponents:httpclient']
  compile deps['org.apache.httpcomponents:httpcore']
+  runtime deps['org.apache.logging.log4j:log4j-core']
  testCompile deps['org.apache.sshd:sshd-core']
  testCompile deps['org.apache.sshd:sshd-scp']
  testCompile deps['org.apache.sshd:sshd-sftp']
@@ -257,8 +262,10 @@ dependencies {
  testCompile deps['com.fasterxml.jackson.core:jackson-databind']
  runtime deps['org.glassfish.jaxb:jaxb-runtime']
  compile deps['org.hibernate:hibernate-core']
+  compile deps['org.hibernate:hibernate-hikaricp']
  compile deps['org.joda:joda-money']
  compile deps['org.json:json']
+  compile deps['org.jsoup:jsoup']
  testCompile deps['org.mortbay.jetty:jetty']
  compile deps['org.postgresql:postgresql']
  testCompile deps['org.seleniumhq.selenium:selenium-api']
@@ -271,6 +278,10 @@ dependencies {
  compile deps['org.testcontainers:postgresql']
  testCompile deps['org.testcontainers:selenium']
  testCompile deps['org.testcontainers:testcontainers']
+  compile deps['us.fatehi:schemacrawler']
+  compile deps['us.fatehi:schemacrawler-api']
+  compile deps['us.fatehi:schemacrawler-diagram']
+  compile deps['us.fatehi:schemacrawler-tools']
  compile deps['xerces:xmlParserAPIs']
  compile deps['xpp3:xpp3']
  // This dependency must come after javax.mail:mail as it would otherwise
@@ -305,7 +316,6 @@ dependencies {
  testCompile deps['org.hamcrest:hamcrest-all']
  testCompile deps['org.hamcrest:hamcrest-core']
  testCompile deps['org.hamcrest:hamcrest-library']
-  compile deps['org.hibernate:hibernate-hikaricp']
  testCompile deps['junit:junit']
  testCompile deps['org.junit.jupiter:junit-jupiter-api']
  testCompile deps['org.junit.jupiter:junit-jupiter-engine']
--- a/core/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/annotationProcessor.lockfile
@@ -1,8 +1,8 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto.value:auto-value:1.6.3
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
@@ -11,15 +11,15 @@ com.google.dagger:dagger-compiler:2.28
 com.google.dagger:dagger-producers:2.28
 com.google.dagger:dagger-spi:2.28
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotation:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
 com.google.errorprone:error_prone_annotations:2.3.4
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.errorprone:javac-shaded:9-dev-r4023-3
 com.google.googlejavaformat:google-java-format:1.5
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.protobuf:protobuf-java:3.4.0
@@ -30,11 +30,14 @@ javax.inject:javax.inject:1
 javax.persistence:javax.persistence-api:2.2
 net.ltgt.gradle.incap:incap:0.2
 org.checkerframework:checker-compat-qual:2.5.3
-org.checkerframework:checker-qual:2.11.1
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.5.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.jetbrains.kotlin:kotlin-stdlib-common:1.3.61
 org.jetbrains.kotlin:kotlin-stdlib:1.3.61
 org.jetbrains.kotlinx:kotlinx-metadata-jvm:0.1.0
 org.jetbrains:annotations:13.0
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/core/gradle/dependency-locks/compile.lockfile
+++ b/core/gradle/dependency-locks/compile.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +36,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +69,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +84,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +113,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +128,25 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +179,7 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -198,16 +201,17 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -215,16 +219,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -234,7 +239,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -244,10 +249,15 @@ org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/compileClasspath.lockfile
+++ b/core/gradle/dependency-locks/compileClasspath.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -18,7 +18,6 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.30.9
 com.google.api-client:google-api-client-java6:1.30.9
@@ -36,15 +35,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +68,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,22 +83,23 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,7 +112,7 @@ com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
 com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -124,25 +126,25 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -158,7 +160,6 @@ io.netty:netty-transport:4.1.42.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
-io.perfmark:perfmark-api:0.19.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -174,7 +175,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -196,32 +197,33 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -231,7 +233,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -241,10 +243,15 @@ org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/default.lockfile
+++ b/core/gradle/dependency-locks/default.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,23 +89,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -111,8 +118,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -126,25 +133,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -177,7 +187,8 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -198,17 +209,20 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
-org.apache.logging.log4j:log4j-api:2.6.2
+org.apache.logging.log4j:log4j-api:2.13.3
+org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -216,16 +230,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -235,21 +250,29 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/deploy_jar.lockfile
+++ b/core/gradle/dependency-locks/deploy_jar.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,23 +89,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -111,8 +118,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -126,25 +133,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,33 +208,37 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
-org.apache.logging.log4j:log4j-api:2.6.2
+org.apache.logging.log4j:log4j-api:2.13.3
+org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -233,21 +248,29 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/errorprone.lockfile
+++ b/core/gradle/dependency-locks/errorprone.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/core/gradle/dependency-locks/nonprodAnnotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/nonprodAnnotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/core/gradle/dependency-locks/nonprodCompile.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompile.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +36,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +69,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +84,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +113,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +128,25 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +179,7 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -198,16 +201,17 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -215,16 +219,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -234,7 +239,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -244,10 +249,15 @@ org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/nonprodCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompileClasspath.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -18,7 +18,6 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.30.9
 com.google.api-client:google-api-client-java6:1.30.9
@@ -36,15 +35,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +68,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,22 +83,23 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,7 +112,7 @@ com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
 com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -124,25 +126,25 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -158,7 +160,6 @@ io.netty:netty-transport:4.1.42.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
-io.perfmark:perfmark-api:0.19.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -175,7 +176,7 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,16 +198,16 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -214,16 +215,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -233,7 +235,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -243,10 +245,15 @@ org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/nonprodRuntime.lockfile
+++ b/core/gradle/dependency-locks/nonprodRuntime.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +88,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +117,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +132,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,17 +208,20 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
-org.apache.logging.log4j:log4j-api:2.6.2
+org.apache.logging.log4j:log4j-api:2.13.3
+org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -215,16 +229,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -234,20 +249,28 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/nonprodRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/nonprodRuntimeClasspath.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +88,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +117,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +132,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,17 +208,20 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
-org.apache.logging.log4j:log4j-api:2.6.2
+org.apache.logging.log4j:log4j-api:2.13.3
+org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -215,16 +229,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -234,20 +249,28 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/runtime.lockfile
+++ b/core/gradle/dependency-locks/runtime.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +88,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +117,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +132,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,17 +208,20 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
-org.apache.logging.log4j:log4j-api:2.6.2
+org.apache.logging.log4j:log4j-api:2.13.3
+org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -215,16 +229,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -234,20 +249,28 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,23 +89,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -111,8 +118,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -126,25 +133,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,33 +208,37 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
-org.apache.logging.log4j:log4j-api:2.6.2
+org.apache.logging.log4j:log4j-api:2.13.3
+org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -233,21 +248,29 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/testAnnotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/testAnnotationProcessor.lockfile
@@ -1,8 +1,8 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto.value:auto-value:1.6.3
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
@@ -11,15 +11,15 @@ com.google.dagger:dagger-compiler:2.28
 com.google.dagger:dagger-producers:2.28
 com.google.dagger:dagger-spi:2.28
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotation:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
 com.google.errorprone:error_prone_annotations:2.3.4
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.errorprone:javac-shaded:9-dev-r4023-3
 com.google.googlejavaformat:google-java-format:1.5
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.protobuf:protobuf-java:3.4.0
@@ -30,11 +30,14 @@ javax.inject:javax.inject:1
 javax.persistence:javax.persistence-api:2.2
 net.ltgt.gradle.incap:incap:0.2
 org.checkerframework:checker-compat-qual:2.5.3
-org.checkerframework:checker-qual:2.11.1
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.5.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.jetbrains.kotlin:kotlin-stdlib-common:1.3.61
 org.jetbrains.kotlin:kotlin-stdlib:1.3.61
 org.jetbrains.kotlinx:kotlinx-metadata-jvm:0.1.0
 org.jetbrains:annotations:13.0
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/core/gradle/dependency-locks/testCompile.lockfile
+++ b/core/gradle/dependency-locks/testCompile.lockfile
@@ -6,9 +6,9 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.11.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
+com.fasterxml.jackson.core:jackson-databind:2.11.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
@@ -36,15 +36,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -68,9 +70,9 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,24 +85,25 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:29.0-jre
-com.google.guava:guava:29.0-jre
+com.google.guava:guava-testlib:30.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -113,8 +116,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -133,25 +136,25 @@ com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -185,7 +188,7 @@ jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.13
 net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -212,7 +215,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.apache.mina:mina-core:2.0.4
@@ -225,10 +228,10 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -238,16 +241,17 @@ org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
 org.junit.jupiter:junit-jupiter-api:5.6.2
 org.junit.jupiter:junit-jupiter-engine:5.6.2
@@ -271,7 +275,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -293,10 +297,15 @@ org.testcontainers:junit-jupiter:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:selenium:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -6,9 +6,9 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.11.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
+com.fasterxml.jackson.core:jackson-databind:2.11.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
@@ -18,7 +18,6 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.30.9
 com.google.api-client:google-api-client-java6:1.30.9
@@ -36,15 +35,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -68,9 +69,9 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,23 +84,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:29.0-jre
-com.google.guava:guava:29.0-jre
+com.google.guava:guava-testlib:30.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -113,7 +115,7 @@ com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
 com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -132,25 +134,25 @@ com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -166,7 +168,6 @@ io.netty:netty-transport:4.1.42.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
-io.perfmark:perfmark-api:0.19.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -184,7 +185,7 @@ jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.13
 net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -211,7 +212,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.apache.mina:mina-core:2.0.4
@@ -224,10 +225,9 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -237,16 +237,17 @@ org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
 org.junit.jupiter:junit-jupiter-api:5.6.2
 org.junit.jupiter:junit-jupiter-engine:5.6.2
@@ -270,7 +271,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -292,10 +293,15 @@ org.testcontainers:junit-jupiter:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:selenium:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/testRuntime.lockfile
+++ b/core/gradle/dependency-locks/testRuntime.lockfile
@@ -6,9 +6,13 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
+com.fasterxml.jackson.core:jackson-annotations:2.11.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
+com.fasterxml.jackson.core:jackson-databind:2.11.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -68,9 +74,9 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -84,24 +90,25 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:29.0-jre
-com.google.guava:guava:29.0-jre
+com.google.guava:guava-testlib:30.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -114,8 +121,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -134,26 +141,29 @@ com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.github.java-diff-utils:java-diff-utils:4.0
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -186,8 +196,9 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.13
+net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -214,9 +225,10 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
-org.apache.logging.log4j:log4j-api:2.6.2
+org.apache.logging.log4j:log4j-api:2.13.3
+org.apache.logging.log4j:log4j-core:2.13.3
 org.apache.mina:mina-core:2.0.4
 org.apache.sshd:sshd-core:2.0.0
 org.apache.sshd:sshd-scp:2.0.0
@@ -227,10 +239,10 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -241,16 +253,17 @@ org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
 org.junit.jupiter:junit-jupiter-api:5.6.2
 org.junit.jupiter:junit-jupiter-engine:5.6.2
@@ -274,7 +287,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -289,6 +302,8 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
@@ -296,10 +311,16 @@ org.testcontainers:junit-jupiter:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:selenium:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -6,9 +6,13 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
+com.fasterxml.jackson.core:jackson-annotations:2.11.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
+com.fasterxml.jackson.core:jackson-databind:2.11.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -68,9 +74,9 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -84,24 +90,25 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:29.0-jre
-com.google.guava:guava:29.0-jre
+com.google.guava:guava-testlib:30.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -114,8 +121,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -134,26 +141,29 @@ com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.github.java-diff-utils:java-diff-utils:4.0
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -186,8 +196,9 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.13
+net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -214,9 +225,10 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
-org.apache.logging.log4j:log4j-api:2.6.2
+org.apache.logging.log4j:log4j-api:2.13.3
+org.apache.logging.log4j:log4j-core:2.13.3
 org.apache.mina:mina-core:2.0.4
 org.apache.sshd:sshd-core:2.0.0
 org.apache.sshd:sshd-scp:2.0.0
@@ -227,10 +239,10 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -241,16 +253,17 @@ org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
 org.junit.jupiter:junit-jupiter-api:5.6.2
 org.junit.jupiter:junit-jupiter-engine:5.6.2
@@ -274,7 +287,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -289,6 +302,8 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
 org.testcontainers:database-commons:1.14.3
@@ -297,10 +312,16 @@ org.testcontainers:junit-jupiter:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:selenium:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/src/main/java/google/registry/backup/CommitLogImports.java
+++ b/core/src/main/java/google/registry/backup/CommitLogImports.java
@@ -15,10 +15,10 @@
 package google.registry.backup;

 import static com.google.common.base.Preconditions.checkState;
+import static com.google.common.collect.ImmutableList.toImmutableList;
 import static google.registry.backup.BackupUtils.createDeserializingIterator;

 import com.google.common.collect.ImmutableList;
-import com.google.common.collect.Streams;
 import google.registry.model.ImmutableObject;
 import google.registry.model.ofy.CommitLogCheckpoint;
 import google.registry.model.ofy.CommitLogManifest;
@@ -31,7 +31,6 @@ import java.io.InputStream;
 import java.nio.channels.Channels;
 import java.nio.channels.ReadableByteChannel;
 import java.util.Iterator;
-import java.util.stream.Stream;

 /**
 * Helpers for reading CommitLog records from a file.
@@ -43,6 +42,56 @@ public final class CommitLogImports {

  private CommitLogImports() {}

+  /**
+   * Returns entities in an {@code inputStream} (from a single CommitLog file) as an {@link
+   * ImmutableList} of {@link ImmutableList}s of {@link VersionedEntity} records where the inner
+   * lists each consist of one transaction. Upon completion the {@code inputStream} is closed.
+   *
+   * <p>The returned list may be empty, since CommitLogs are written at fixed intervals regardless
+   * if actual changes exist. Each sublist, however, will not be empty.
+   *
+   * <p>A CommitLog file starts with a {@link CommitLogCheckpoint}, followed by (repeated)
+   * subsequences of [{@link CommitLogManifest}, [{@link CommitLogMutation}] ...]. Each subsequence
+   * represents the changes in one transaction. The {@code CommitLogManifest} contains deleted
+   * entity keys, whereas each {@code CommitLogMutation} contains one whole entity.
+   */
+  public static ImmutableList<ImmutableList<VersionedEntity>> loadEntitiesByTransaction(
+      InputStream inputStream) {
+    try (AppEngineEnvironment appEngineEnvironment = new AppEngineEnvironment();
+        InputStream input = new BufferedInputStream(inputStream)) {
+      Iterator<ImmutableObject> commitLogs = createDeserializingIterator(input);
+      checkState(commitLogs.hasNext());
+      checkState(commitLogs.next() instanceof CommitLogCheckpoint);
+
+      ImmutableList.Builder<ImmutableList<VersionedEntity>> resultBuilder =
+          new ImmutableList.Builder<>();
+      ImmutableList.Builder<VersionedEntity> currentTransactionBuilder =
+          new ImmutableList.Builder<>();
+
+      while (commitLogs.hasNext()) {
+        ImmutableObject currentObject = commitLogs.next();
+        if (currentObject instanceof CommitLogManifest) {
+          // CommitLogManifest means we are starting a new transaction
+          addIfNonempty(resultBuilder, currentTransactionBuilder);
+          currentTransactionBuilder = new ImmutableList.Builder<>();
+          VersionedEntity.fromManifest((CommitLogManifest) currentObject)
+              .forEach(currentTransactionBuilder::add);
+        } else if (currentObject instanceof CommitLogMutation) {
+          currentTransactionBuilder.add(
+              VersionedEntity.fromMutation((CommitLogMutation) currentObject));
+        } else {
+          throw new IllegalStateException(
+              String.format("Unknown entity type %s in commit logs", currentObject.getClass()));
+        }
+      }
+      // Add the last transaction in (if it's not empty)
+      addIfNonempty(resultBuilder, currentTransactionBuilder);
+      return resultBuilder.build();
+    } catch (IOException e) {
+      throw new RuntimeException(e);
+    }
+  }
+
  /**
   * Returns entities in an {@code inputStream} (from a single CommitLog file) as an {@link
   * ImmutableList} of {@link VersionedEntity} records. Upon completion the {@code inputStream} is
@@ -57,23 +106,9 @@ public final class CommitLogImports {
   * entity keys, whereas each {@code CommitLogMutation} contains one whole entity.
   */
  public static ImmutableList<VersionedEntity> loadEntities(InputStream inputStream) {
-    try (AppEngineEnvironment appEngineEnvironment = new AppEngineEnvironment();
-        InputStream input = new BufferedInputStream(inputStream)) {
-      Iterator<ImmutableObject> commitLogs = createDeserializingIterator(input);
-      checkState(commitLogs.hasNext());
-      checkState(commitLogs.next() instanceof CommitLogCheckpoint);
-
-      return Streams.stream(commitLogs)
-          .map(
-              e ->
-                  e instanceof CommitLogManifest
-                      ? VersionedEntity.fromManifest((CommitLogManifest) e)
-                      : Stream.of(VersionedEntity.fromMutation((CommitLogMutation) e)))
-          .flatMap(s -> s)
-          .collect(ImmutableList.toImmutableList());
-    } catch (IOException e) {
-      throw new RuntimeException(e);
-    }
+    return loadEntitiesByTransaction(inputStream).stream()
+        .flatMap(ImmutableList::stream)
+        .collect(toImmutableList());
  }

  /** Covenience method that adapts {@link #loadEntities(InputStream)} to a {@link File}. */
@@ -92,4 +127,13 @@ public final class CommitLogImports {
  public static ImmutableList<VersionedEntity> loadEntities(ReadableByteChannel channel) {
    return loadEntities(Channels.newInputStream(channel));
  }
+
+  private static void addIfNonempty(
+      ImmutableList.Builder<ImmutableList<VersionedEntity>> resultBuilder,
+      ImmutableList.Builder<VersionedEntity> currentTransactionBuilder) {
+    ImmutableList<VersionedEntity> currentTransaction = currentTransactionBuilder.build();
+    if (!currentTransaction.isEmpty()) {
+      resultBuilder.add(currentTransaction);
+    }
+  }
 }
--- a/core/src/main/java/google/registry/backup/GcsDiffFileLister.java
+++ b/core/src/main/java/google/registry/backup/GcsDiffFileLister.java
@@ -122,7 +122,7 @@ class GcsDiffFileLister {

    // Reconstruct the sequence of files by traversing backwards from "lastUpperBoundTime" (i.e. the
    // last file that we found) and finding its previous file until we either run out of files or
-    // get to one that preceeds "fromTime".
+    // get to one that precedes "fromTime".
    //
    // GCS file listing is eventually consistent, so it's possible that we are missing a file. The
    // metadata of a file is sufficient to identify the preceding file, so if we start from the
--- a/core/src/main/java/google/registry/backup/ReplayCommitLogsToSqlAction.java
+++ b/core/src/main/java/google/registry/backup/ReplayCommitLogsToSqlAction.java
@@ -0,0 +1,188 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.backup;
+
+import static google.registry.backup.ExportCommitLogDiffAction.DIFF_FILE_PREFIX;
+import static google.registry.model.ofy.EntityWritePriorities.getEntityPriority;
+import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
+import static javax.servlet.http.HttpServletResponse.SC_NO_CONTENT;
+import static org.joda.time.Duration.standardHours;
+
+import com.google.appengine.api.datastore.Entity;
+import com.google.appengine.api.datastore.Key;
+import com.google.appengine.tools.cloudstorage.GcsFileMetadata;
+import com.google.appengine.tools.cloudstorage.GcsService;
+import com.google.common.collect.ImmutableList;
+import com.google.common.flogger.FluentLogger;
+import google.registry.config.RegistryConfig;
+import google.registry.model.server.Lock;
+import google.registry.model.translators.VKeyTranslatorFactory;
+import google.registry.persistence.VKey;
+import google.registry.request.Action;
+import google.registry.request.Response;
+import google.registry.request.auth.Auth;
+import google.registry.schema.replay.DatastoreEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;
+import google.registry.schema.replay.NonReplicatedEntity;
+import google.registry.schema.replay.SqlReplayCheckpoint;
+import google.registry.util.RequestStatusChecker;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.channels.Channels;
+import java.util.Optional;
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletResponse;
+import org.joda.time.DateTime;
+import org.joda.time.Duration;
+
+/** Action that replays commit logs to Cloud SQL to keep it up to date. */
+@Action(
+    service = Action.Service.BACKEND,
+    path = ReplayCommitLogsToSqlAction.PATH,
+    method = Action.Method.POST,
+    automaticallyPrintOk = true,
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
+public class ReplayCommitLogsToSqlAction implements Runnable {
+
+  static final String PATH = "/_dr/task/replayCommitLogsToSql";
+
+  private static final int BLOCK_SIZE =
+      1024 * 1024; // Buffer 1mb at a time, for no particular reason.
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+  private static final Duration LEASE_LENGTH = standardHours(1);
+
+  @Inject GcsService gcsService;
+  @Inject Response response;
+  @Inject RequestStatusChecker requestStatusChecker;
+  @Inject GcsDiffFileLister diffLister;
+
+  @Inject
+  ReplayCommitLogsToSqlAction() {}
+
+  @Override
+  public void run() {
+    if (!RegistryConfig.getCloudSqlReplayCommitLogs()) {
+      String message = "ReplayCommitLogsToSqlAction was called but disabled in the config.";
+      logger.atWarning().log(message);
+      // App Engine will retry on any non-2xx status code, which we don't want in this case.
+      response.setStatus(SC_NO_CONTENT);
+      response.setPayload(message);
+      return;
+    }
+    Optional<Lock> lock =
+        Lock.acquire(
+            this.getClass().getSimpleName(), null, LEASE_LENGTH, requestStatusChecker, false);
+    if (lock.isEmpty()) {
+      String message = "Can't acquire SQL commit log replay lock, aborting.";
+      logger.atSevere().log(message);
+      // App Engine will retry on any non-2xx status code, which we don't want in this case.
+      // Let the next run after the next export happen naturally.
+      response.setStatus(SC_NO_CONTENT);
+      response.setPayload(message);
+      return;
+    }
+    try {
+      replayFiles();
+      response.setStatus(HttpServletResponse.SC_OK);
+      logger.atInfo().log("ReplayCommitLogsToSqlAction completed successfully.");
+    } finally {
+      lock.ifPresent(Lock::release);
+    }
+  }
+
+  private void replayFiles() {
+    // Start at the first millisecond we haven't seen yet
+    DateTime fromTime = jpaTm().transact(() -> SqlReplayCheckpoint.get().plusMillis(1));
+    // If there's an inconsistent file set, this will throw IllegalStateException and the job
+    // will try later -- this is likely because an export hasn't finished yet.
+    ImmutableList<GcsFileMetadata> commitLogFiles =
+        diffLister.listDiffFiles(fromTime, /* current time */ null);
+    for (GcsFileMetadata metadata : commitLogFiles) {
+      // One transaction per GCS file
+      jpaTm().transact(() -> processFile(metadata));
+    }
+    logger.atInfo().log("Replayed %d commit log files to SQL successfully.", commitLogFiles.size());
+  }
+
+  private void processFile(GcsFileMetadata metadata) {
+    try (InputStream input =
+        Channels.newInputStream(
+            gcsService.openPrefetchingReadChannel(metadata.getFilename(), 0, BLOCK_SIZE))) {
+      // Load and process the Datastore transactions one at a time
+      ImmutableList<ImmutableList<VersionedEntity>> allTransactions =
+          CommitLogImports.loadEntitiesByTransaction(input);
+      allTransactions.forEach(this::replayTransaction);
+      // if we succeeded, set the last-seen time
+      DateTime checkpoint =
+          DateTime.parse(
+              metadata.getFilename().getObjectName().substring(DIFF_FILE_PREFIX.length()));
+      SqlReplayCheckpoint.set(checkpoint);
+      logger.atInfo().log("Replayed %d transactions from commit log file.", allTransactions.size());
+    } catch (IOException e) {
+      throw new RuntimeException(e);
+    }
+  }
+
+  private void replayTransaction(ImmutableList<VersionedEntity> transaction) {
+    transaction.stream()
+        .sorted(ReplayCommitLogsToSqlAction::compareByWeight)
+        .forEach(
+            versionedEntity ->
+                versionedEntity
+                    .getEntity()
+                    .ifPresentOrElse(
+                        this::handleEntityPut, () -> handleEntityDelete(versionedEntity)));
+  }
+
+  private void handleEntityPut(Entity entity) {
+    Object ofyPojo = ofy().toPojo(entity);
+    if (ofyPojo instanceof DatastoreEntity) {
+      DatastoreEntity datastoreEntity = (DatastoreEntity) ofyPojo;
+      datastoreEntity.toSqlEntity().ifPresent(jpaTm()::put);
+    } else {
+      // this should never happen, but we shouldn't fail on it
+      logger.atSevere().log(
+          "%s does not implement DatastoreEntity, which is necessary for SQL replay.",
+          ofyPojo.getClass());
+    }
+  }
+
+  private void handleEntityDelete(VersionedEntity entityToDelete) {
+    Key key = entityToDelete.key();
+    VKey<?> entityVKey;
+    try {
+      entityVKey = VKeyTranslatorFactory.createVKey(key);
+    } catch (RuntimeException e) {
+      // This means that the key wasn't convertible to VKey through the standard methods or via
+      // a createVKey method. This means that the object isn't persisted in SQL so we ignore it.
+      logger.atInfo().log(
+          "Skipping SQL delete for kind %s since it is not convertible.", key.getKind());
+      return;
+    }
+    Class<?> entityClass = entityVKey.getKind();
+    // Delete the key iff the class represents a JPA entity that is replicated
+    if (!NonReplicatedEntity.class.isAssignableFrom(entityClass)
+        && !DatastoreOnlyEntity.class.isAssignableFrom(entityClass)
+        && entityClass.getAnnotation(javax.persistence.Entity.class) != null) {
+      jpaTm().delete(entityVKey);
+    }
+  }
+
+  private static int compareByWeight(VersionedEntity a, VersionedEntity b) {
+    return getEntityPriority(a.key().getKind(), a.getEntity().isEmpty())
+        - getEntityPriority(b.key().getKind(), b.getEntity().isEmpty());
+  }
+}
--- a/core/src/main/java/google/registry/batch/AsyncTaskEnqueuer.java
+++ b/core/src/main/java/google/registry/batch/AsyncTaskEnqueuer.java
@@ -169,16 +169,20 @@ public final class AsyncTaskEnqueuer {
        lock.getRelockDuration().isPresent(),
        "Lock with ID %s not configured for relock",
        lock.getRevisionId());
+    enqueueDomainRelock(lock.getRelockDuration().get(), lock.getRevisionId(), 0);
+  }
+
+  /** Enqueues a task to asynchronously re-lock a registry-locked domain after it was unlocked. */
+  void enqueueDomainRelock(Duration countdown, long lockRevisionId, int previousAttempts) {
    String backendHostname = appEngineServiceUtils.getServiceHostname("backend");
    addTaskToQueueWithRetry(
        asyncActionsPushQueue,
        TaskOptions.Builder.withUrl(RelockDomainAction.PATH)
            .method(Method.POST)
            .header("Host", backendHostname)
-            .param(
-                RelockDomainAction.OLD_UNLOCK_REVISION_ID_PARAM,
-                String.valueOf(lock.getRevisionId()))
-            .countdownMillis(lock.getRelockDuration().get().getMillis()));
+            .param(RelockDomainAction.OLD_UNLOCK_REVISION_ID_PARAM, String.valueOf(lockRevisionId))
+            .param(RelockDomainAction.PREVIOUS_ATTEMPTS_PARAM, String.valueOf(previousAttempts))
+            .countdownMillis(countdown.getMillis()));
  }

  /**
--- a/core/src/main/java/google/registry/batch/BatchModule.java
+++ b/core/src/main/java/google/registry/batch/BatchModule.java
@@ -21,6 +21,7 @@ import static google.registry.batch.AsyncTaskEnqueuer.PARAM_RESOURCE_KEY;
 import static google.registry.batch.AsyncTaskEnqueuer.QUEUE_ASYNC_ACTIONS;
 import static google.registry.batch.AsyncTaskEnqueuer.QUEUE_ASYNC_DELETE;
 import static google.registry.batch.AsyncTaskEnqueuer.QUEUE_ASYNC_HOST_RENAME;
+import static google.registry.request.RequestParameters.extractIntParameter;
 import static google.registry.request.RequestParameters.extractLongParameter;
 import static google.registry.request.RequestParameters.extractOptionalBooleanParameter;
 import static google.registry.request.RequestParameters.extractOptionalIntParameter;
@@ -94,9 +95,15 @@ public class BatchModule {
  }

  @Provides
-  @Parameter("oldUnlockRevisionId")
+  @Parameter(RelockDomainAction.OLD_UNLOCK_REVISION_ID_PARAM)
  static long provideOldUnlockRevisionId(HttpServletRequest req) {
-    return extractLongParameter(req, "oldUnlockRevisionId");
+    return extractLongParameter(req, RelockDomainAction.OLD_UNLOCK_REVISION_ID_PARAM);
+  }
+
+  @Provides
+  @Parameter(RelockDomainAction.PREVIOUS_ATTEMPTS_PARAM)
+  static int providePreviousAttempts(HttpServletRequest req) {
+    return extractIntParameter(req, RelockDomainAction.PREVIOUS_ATTEMPTS_PARAM);
  }

  @Provides
--- a/core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java
+++ b/core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java
@@ -464,7 +464,7 @@ public class DeleteContactsAndHostsAction implements Runnable {
        HostResource host = (HostResource) existingResource;
        if (host.isSubordinate()) {
          dnsQueue.addHostRefreshTask(host.getHostName());
-          tm().saveNewOrUpdate(
+          tm().put(
                  tm().load(host.getSuperordinateDomain())
                      .asBuilder()
                      .removeSubordinateHost(host.getHostName())
--- a/core/src/main/java/google/registry/batch/RelockDomainAction.java
+++ b/core/src/main/java/google/registry/batch/RelockDomainAction.java
@@ -15,19 +15,23 @@
 package google.registry.batch;

 import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.request.Action.Method.POST;
 import static google.registry.tools.LockOrUnlockDomainCommand.REGISTRY_LOCK_STATUSES;
-import static javax.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
 import static javax.servlet.http.HttpServletResponse.SC_NO_CONTENT;
 import static javax.servlet.http.HttpServletResponse.SC_OK;

 import com.google.common.collect.ImmutableSet;
 import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
+import google.registry.config.RegistryConfig.Config;
 import google.registry.model.domain.DomainBase;
 import google.registry.model.eppcommon.StatusValue;
+import google.registry.model.registrar.Registrar;
+import google.registry.model.registrar.RegistrarContact;
 import google.registry.model.registry.RegistryLockDao;
 import google.registry.request.Action;
 import google.registry.request.Parameter;
@@ -36,11 +40,15 @@ import google.registry.request.auth.Auth;
 import google.registry.schema.domain.RegistryLock;
 import google.registry.tools.DomainLockUtils;
 import google.registry.util.DateTimeUtils;
+import google.registry.util.EmailMessage;
+import google.registry.util.SendEmailService;
+import java.util.Optional;
 import javax.inject.Inject;
+import javax.mail.internet.AddressException;
+import javax.mail.internet.InternetAddress;
+import org.joda.time.Duration;

-/**
- * Task that relocks a previously-Registry-Locked domain after some predetermined period of time.
- */
+/** Task that re-locks a previously-Registry-Locked domain after a predetermined period of time. */
@Action(
    service = Action.Service.BACKEND,
    path = RelockDomainAction.PATH,
@@ -51,30 +59,78 @@ public class RelockDomainAction implements Runnable {

  public static final String PATH = "/_dr/task/relockDomain";
  public static final String OLD_UNLOCK_REVISION_ID_PARAM = "oldUnlockRevisionId";
+  public static final String PREVIOUS_ATTEMPTS_PARAM = "previousAttempts";
+
+  static final int ATTEMPTS_BEFORE_SLOWDOWN = 36; // every ten minutes for six hours then every hour
+  static final int FAILURES_BEFORE_EMAIL = 2; // email after three failures, one half hour
+  private static final Duration TEN_MINUTES = Duration.standardMinutes(10);
+  private static final Duration ONE_HOUR = Duration.standardHours(1);
+
+  private static final String RELOCK_SUCCESS_EMAIL_TEMPLATE =
+      "The domain %s was successfully re-locked.\n\nPlease contact support at %s if you have any "
+          + "questions.";
+  private static final String RELOCK_NON_RETRYABLE_FAILURE_EMAIL_TEMPLATE =
+      "There was an error when automatically re-locking %s. Error message: %s\n\nPlease contact "
+          + "support at %s if you have any questions.";
+  private static final String RELOCK_TRANSIENT_FAILURE_EMAIL_TEMPLATE =
+      "There was an unexpected error when automatically re-locking %s. We will continue retrying "
+          + "the lock for five hours. Please contact support at %s if you have any questions";
+  private static final String RELOCK_UNKNOWN_ID_FAILURE_EMAIL_TEMPLATE =
+      "The old lock with revision ID %d is not present or is not accessible";

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();

  private final long oldUnlockRevisionId;
+  private final int previousAttempts;
+  private final InternetAddress alertRecipientAddress;
+  private final InternetAddress gSuiteOutgoingEmailAddress;
+  private final String supportEmail;
+  private final SendEmailService sendEmailService;
  private final DomainLockUtils domainLockUtils;
  private final Response response;
+  private final AsyncTaskEnqueuer asyncTaskEnqueuer;

  @Inject
  public RelockDomainAction(
      @Parameter(OLD_UNLOCK_REVISION_ID_PARAM) long oldUnlockRevisionId,
+      @Parameter(PREVIOUS_ATTEMPTS_PARAM) int previousAttempts,
+      @Config("alertRecipientEmailAddress") InternetAddress alertRecipientAddress,
+      @Config("gSuiteOutgoingEmailAddress") InternetAddress gSuiteOutgoingEmailAddress,
+      @Config("supportEmail") String supportEmail,
+      SendEmailService sendEmailService,
      DomainLockUtils domainLockUtils,
-      Response response) {
+      Response response,
+      AsyncTaskEnqueuer asyncTaskEnqueuer) {
    this.oldUnlockRevisionId = oldUnlockRevisionId;
+    this.previousAttempts = previousAttempts;
+    this.alertRecipientAddress = alertRecipientAddress;
+    this.gSuiteOutgoingEmailAddress = gSuiteOutgoingEmailAddress;
+    this.supportEmail = supportEmail;
+    this.sendEmailService = sendEmailService;
    this.domainLockUtils = domainLockUtils;
    this.response = response;
+    this.asyncTaskEnqueuer = asyncTaskEnqueuer;
  }

  @Override
  public void run() {
-    jpaTm().transact(this::relockDomain);
+    /* We wish to manually control our retry behavior, in order to limit the number of retries
+     * and/or notify registrars / support only after a certain number of retries, or only
+     * with a certain type of failure. AppEngine will automatically retry on any non-2xx status
+     * code, so return SC_NO_CONTENT (204) by default to avoid this auto-retry.
+     *
+     * See https://cloud.google.com/appengine/docs/standard/java/taskqueue/push/retrying-tasks
+     * for more details on retry behavior. */
+    response.setStatus(SC_NO_CONTENT);
+    response.setContentType(MediaType.PLAIN_TEXT_UTF_8);
+
+    // nb: DomainLockUtils relies on the JPA transaction being the outermost transaction
+    jpaTm().transact(() -> tm().transact(this::relockDomain));
  }

  private void relockDomain() {
-    RegistryLock oldLock;
+    RegistryLock oldLock = null;
+    DomainBase domain;
    try {
      oldLock =
          RegistryLockDao.getByRevisionId(oldUnlockRevisionId)
@@ -82,87 +138,187 @@ public class RelockDomainAction implements Runnable {
                  () ->
                      new IllegalArgumentException(
                          String.format("Unknown revision ID %d", oldUnlockRevisionId)));
-      DomainBase domain =
+      domain =
          ofy()
              .load()
              .type(DomainBase.class)
              .id(oldLock.getRepoId())
              .now()
              .cloneProjectedAtTime(jpaTm().getTransactionTime());
-
-      if (domain.getStatusValues().containsAll(REGISTRY_LOCK_STATUSES)
-          || oldLock.getRelock() != null) {
-        // The domain was manually locked, so we shouldn't worry about relocking
-        String message =
-            String.format(
-                "Domain %s is already manually relocked, skipping automated relock.",
-                domain.getDomainName());
-        logger.atInfo().log(message);
-        // SC_NO_CONTENT (204) skips retry -- see the comment below
-        response.setStatus(SC_NO_CONTENT);
-        response.setContentType(MediaType.PLAIN_TEXT_UTF_8);
-        response.setPayload(message);
-        return;
-      }
-      verifyDomainAndLockState(oldLock, domain);
    } catch (Throwable t) {
-      /* If there's a bad verification code or the domain is in a bad state, we won't want to retry.
-       * AppEngine will retry on non-2xx error codes, so we return SC_NO_CONTENT (204) to avoid it.
-       *
-       * See https://cloud.google.com/appengine/docs/standard/java/taskqueue/push/retrying-tasks
-       * for more details on retry behavior. */
-      logger.atWarning().withCause(t).log(
-          "Exception when attempting to relock domain with old revision ID %d.",
-          oldUnlockRevisionId);
-      response.setStatus(SC_NO_CONTENT);
-      response.setContentType(MediaType.PLAIN_TEXT_UTF_8);
-      response.setPayload(String.format("Relock failed: %s", t.getMessage()));
+      handleTransientFailure(Optional.ofNullable(oldLock), t);
      return;
    }
-    applyRelock(oldLock);
+
+    if (domain.getStatusValues().containsAll(REGISTRY_LOCK_STATUSES)
+        || oldLock.getRelock() != null) {
+      // The domain was manually locked, so we shouldn't worry about re-locking
+      String message =
+          String.format(
+              "Domain %s is already manually re-locked, skipping automated re-lock.",
+              domain.getDomainName());
+      logger.atInfo().log(message);
+      response.setPayload(message);
+      return;
+    }
+    try {
+      verifyDomainAndLockState(oldLock, domain);
+    } catch (Throwable t) {
+      // If the domain was, for example, transferred, then notify the old registrar and don't retry.
+      handleNonRetryableFailure(oldLock, t);
+      return;
+    }
+    try {
+      applyRelock(oldLock);
+    } catch (Throwable t) {
+      handleTransientFailure(Optional.of(oldLock), t);
+    }
  }

  private void applyRelock(RegistryLock oldLock) {
-    try {
-      domainLockUtils.administrativelyApplyLock(
-          oldLock.getDomainName(),
-          oldLock.getRegistrarId(),
-          oldLock.getRegistrarPocId(),
-          oldLock.isSuperuser());
-      logger.atInfo().log("Relocked domain %s.", oldLock.getDomainName());
-      response.setStatus(SC_OK);
-    } catch (Throwable t) {
-      // Any errors that occur here are unexpected, so we should retry. Return a non-2xx
-      // error code to get AppEngine to retry
-      logger.atSevere().withCause(t).log(
-          "Exception when attempting to relock domain %s.", oldLock.getDomainName());
-      response.setStatus(SC_INTERNAL_SERVER_ERROR);
-      response.setContentType(MediaType.PLAIN_TEXT_UTF_8);
-      response.setPayload(String.format("Relock failed: %s", t.getMessage()));
+    domainLockUtils.administrativelyApplyLock(
+        oldLock.getDomainName(),
+        oldLock.getRegistrarId(),
+        oldLock.getRegistrarPocId(),
+        oldLock.isSuperuser());
+    logger.atInfo().log("Re-locked domain %s.", oldLock.getDomainName());
+    response.setStatus(SC_OK);
+    // Only send a success email if we previously sent a failure email
+    if (previousAttempts > FAILURES_BEFORE_EMAIL) {
+      sendSuccessEmail(oldLock);
    }
  }

  private void verifyDomainAndLockState(RegistryLock oldLock, DomainBase domain) {
    // Domain shouldn't be deleted or have a pending transfer/delete
    String domainName = domain.getDomainName();
-    checkArgument(
-        !DateTimeUtils.isAtOrAfter(jpaTm().getTransactionTime(), domain.getDeletionTime()),
-        "Domain %s has been deleted",
-        domainName);
    ImmutableSet<StatusValue> statusValues = domain.getStatusValues();
    checkArgument(
        !statusValues.contains(StatusValue.PENDING_DELETE),
-        "Domain %s has a pending delete",
+        "Domain %s has a pending delete.",
+        domainName);
+    checkArgument(
+        !DateTimeUtils.isAtOrAfter(jpaTm().getTransactionTime(), domain.getDeletionTime()),
+        "Domain %s has been deleted.",
        domainName);
    checkArgument(
        !statusValues.contains(StatusValue.PENDING_TRANSFER),
-        "Domain %s has a pending transfer",
+        "Domain %s has a pending transfer.",
        domainName);
    checkArgument(
        domain.getCurrentSponsorClientId().equals(oldLock.getRegistrarId()),
-        "Domain %s has been transferred from registrar %s to registrar %s since the unlock",
+        "Domain %s has been transferred from registrar %s to registrar %s since the unlock.",
        domainName,
        oldLock.getRegistrarId(),
        domain.getCurrentSponsorClientId());
  }
+
+  private void handleNonRetryableFailure(RegistryLock oldLock, Throwable t) {
+    logger.atWarning().withCause(t).log(
+        "Exception thrown when attempting to re-lock domain with old revision ID %d.",
+        oldUnlockRevisionId);
+    response.setPayload(String.format("Re-lock failed: %s", t.getMessage()));
+
+    String body =
+        String.format(
+            RELOCK_NON_RETRYABLE_FAILURE_EMAIL_TEMPLATE,
+            oldLock.getDomainName(),
+            t.getMessage(),
+            supportEmail);
+    sendEmailService.sendEmail(
+        EmailMessage.newBuilder()
+            .setFrom(gSuiteOutgoingEmailAddress)
+            .setBody(body)
+            .setSubject(String.format("Error re-locking domain %s", oldLock.getDomainName()))
+            .setRecipients(getEmailRecipients(oldLock.getRegistrarId()))
+            .build());
+  }
+
+  private void handleTransientFailure(Optional<RegistryLock> oldLock, Throwable t) {
+    String message = String.format("Re-lock failed: %s", t.getMessage());
+    logger.atSevere().withCause(t).log(message);
+    response.setPayload(message);
+
+    if (previousAttempts == FAILURES_BEFORE_EMAIL) {
+      if (oldLock.isPresent()) {
+        sendGenericTransientFailureEmail(oldLock.get());
+      } else {
+        // if the old lock isn't present, something has gone horribly wrong
+        sendUnknownRevisionIdAlertEmail();
+      }
+    }
+    Duration timeBeforeRetry = previousAttempts < ATTEMPTS_BEFORE_SLOWDOWN ? TEN_MINUTES : ONE_HOUR;
+    asyncTaskEnqueuer.enqueueDomainRelock(
+        timeBeforeRetry, oldUnlockRevisionId, previousAttempts + 1);
+  }
+
+  private void sendSuccessEmail(RegistryLock oldLock) {
+    String body =
+        String.format(RELOCK_SUCCESS_EMAIL_TEMPLATE, oldLock.getDomainName(), supportEmail);
+
+    sendEmailService.sendEmail(
+        EmailMessage.newBuilder()
+            .setFrom(gSuiteOutgoingEmailAddress)
+            .setBody(body)
+            .setSubject(String.format("Successful re-lock of domain %s", oldLock.getDomainName()))
+            .setRecipients(getEmailRecipients(oldLock.getRegistrarId()))
+            .build());
+  }
+
+  private void sendGenericTransientFailureEmail(RegistryLock oldLock) {
+    String body =
+        String.format(
+            RELOCK_TRANSIENT_FAILURE_EMAIL_TEMPLATE, oldLock.getDomainName(), supportEmail);
+    // For an unexpected failure, notify both the lock-enabled contacts and our alerting email
+    ImmutableSet<InternetAddress> allRecipients =
+        new ImmutableSet.Builder<InternetAddress>()
+            .addAll(getEmailRecipients(oldLock.getRegistrarId()))
+            .add(alertRecipientAddress)
+            .build();
+    sendEmailService.sendEmail(
+        EmailMessage.newBuilder()
+            .setFrom(gSuiteOutgoingEmailAddress)
+            .setBody(body)
+            .setSubject(String.format("Error re-locking domain %s", oldLock.getDomainName()))
+            .setRecipients(allRecipients)
+            .build());
+  }
+
+  private void sendUnknownRevisionIdAlertEmail() {
+    sendEmailService.sendEmail(
+        EmailMessage.newBuilder()
+            .setFrom(gSuiteOutgoingEmailAddress)
+            .setBody(String.format(RELOCK_UNKNOWN_ID_FAILURE_EMAIL_TEMPLATE, oldUnlockRevisionId))
+            .setSubject("Error re-locking domain")
+            .setRecipients(ImmutableSet.of(alertRecipientAddress))
+            .build());
+  }
+
+  private ImmutableSet<InternetAddress> getEmailRecipients(String registrarId) {
+    Registrar registrar =
+        Registrar.loadByClientIdCached(registrarId)
+            .orElseThrow(
+                () ->
+                    new IllegalStateException(String.format("Unknown registrar %s", registrarId)));
+
+    ImmutableSet<String> registryLockEmailAddresses =
+        registrar.getContacts().stream()
+            .filter(RegistrarContact::isRegistryLockAllowed)
+            .map(RegistrarContact::getRegistryLockEmailAddress)
+            .filter(Optional::isPresent)
+            .map(Optional::get)
+            .collect(toImmutableSet());
+
+    ImmutableSet.Builder<InternetAddress> builder = new ImmutableSet.Builder<>();
+    // can't use streams due to the 'throws' in the InternetAddress constructor
+    for (String registryLockEmailAddress : registryLockEmailAddresses) {
+      try {
+        builder.add(new InternetAddress(registryLockEmailAddress));
+      } catch (AddressException e) {
+        // This shouldn't stop any other emails going out, so swallow it
+        logger.atWarning().log("Invalid email address %s", registryLockEmailAddress);
+      }
+    }
+    return builder.build();
+  }
 }
--- a/core/src/main/java/google/registry/batch/ResaveAllEppResourcesAction.java
+++ b/core/src/main/java/google/registry/batch/ResaveAllEppResourcesAction.java
@@ -50,11 +50,21 @@ public class ResaveAllEppResourcesAction implements Runnable {
  @Inject Response response;
  @Inject ResaveAllEppResourcesAction() {}

+  /**
+   * The number of shards to run the map-only mapreduce on.
+   *
+   * <p>This is less than the default of 100 because we only run this action monthly and can afford
+   * it being slower, but we don't want to write out lots of large commit logs in a short period of
+   * time because they make the Cloud SQL migration tougher.
+   */
+  private static final int NUM_SHARDS = 10;
+
  @Override
  public void run() {
    mrRunner
        .setJobName("Re-save all EPP resources")
        .setModuleName("backend")
+        .setDefaultMapShards(NUM_SHARDS)
        .runMapOnly(
            new ResaveAllEppResourcesActionMapper(),
            ImmutableList.of(EppResourceInputs.createKeyInput(EppResource.class)))
--- a/core/src/main/java/google/registry/beam/initsql/InitSqlPipeline.java
+++ b/core/src/main/java/google/registry/beam/initsql/InitSqlPipeline.java
@@ -92,9 +92,8 @@ public class InitSqlPipeline implements Serializable {
   * Datastore kinds to be written to the SQL database before the cleansed version of {@link
   * DomainBase}.
   */
-  // TODO(weiminyu): include Registry.class when it is modeled in JPA.
  private static final ImmutableList<Class<?>> PHASE_ONE_ORDERED =
-      ImmutableList.of(Registrar.class, ContactResource.class);
+      ImmutableList.of(Registry.class, Registrar.class, ContactResource.class);

  /**
   * Datastore kinds to be written to the SQL database after the cleansed version of {@link
--- a/core/src/main/java/google/registry/beam/initsql/Transforms.java
+++ b/core/src/main/java/google/registry/beam/initsql/Transforms.java
@@ -20,6 +20,7 @@ import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.base.Throwables.throwIfUnchecked;
 import static google.registry.beam.initsql.BackupPaths.getCommitLogTimestamp;
 import static google.registry.beam.initsql.BackupPaths.getExportFilePatterns;
+import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.JpaRetries.isFailedTxnRetriable;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.setJpaTm;
@@ -68,6 +69,7 @@ import org.apache.beam.sdk.transforms.MapElements;
 import org.apache.beam.sdk.transforms.PTransform;
 import org.apache.beam.sdk.transforms.ParDo;
 import org.apache.beam.sdk.transforms.ProcessFunction;
+import org.apache.beam.sdk.transforms.SerializableFunction;
 import org.apache.beam.sdk.values.KV;
 import org.apache.beam.sdk.values.PBegin;
 import org.apache.beam.sdk.values.PCollection;
@@ -264,9 +266,9 @@ public final class Transforms {
  }

  /**
-   * Returns a {@link PTransform} that writes a {@link PCollection} of entities to a SQL database.
-   * and outputs an empty {@code PCollection<Void>}. This allows other operations to {@link
-   * org.apache.beam.sdk.transforms.Wait wait} for the completion of this transform.
+   * Returns a {@link PTransform} that writes a {@link PCollection} of {@link VersionedEntity}s to a
+   * SQL database. and outputs an empty {@code PCollection<Void>}. This allows other operations to
+   * {@link org.apache.beam.sdk.transforms.Wait wait} for the completion of this transform.
   *
   * <p>Errors are handled according to the pipeline runner's default policy. As part of a one-time
   * job, we will not add features unless proven necessary.
@@ -282,16 +284,53 @@ public final class Transforms {
      int maxWriters,
      int batchSize,
      SerializableSupplier<JpaTransactionManager> jpaSupplier) {
-    return new PTransform<PCollection<VersionedEntity>, PCollection<Void>>() {
+    return writeToSql(
+        transformId,
+        maxWriters,
+        batchSize,
+        jpaSupplier,
+        (e) -> ofy().toPojo(e.getEntity().get()),
+        TypeDescriptor.of(VersionedEntity.class));
+  }
+
+  /**
+   * Returns a {@link PTransform} that writes a {@link PCollection} of entities to a SQL database.
+   * and outputs an empty {@code PCollection<Void>}. This allows other operations to {@link
+   * org.apache.beam.sdk.transforms.Wait wait} for the completion of this transform.
+   *
+   * <p>The converter and type descriptor are generics so that we can convert any type of entity to
+   * an object to be placed in SQL.
+   *
+   * <p>Errors are handled according to the pipeline runner's default policy. As part of a one-time
+   * job, we will not add features unless proven necessary.
+   *
+   * @param transformId a unique ID for an instance of the returned transform
+   * @param maxWriters the max number of concurrent writes to SQL, which also determines the max
+   *     number of connection pools created
+   * @param batchSize the number of entities to write in each operation
+   * @param jpaSupplier supplier of a {@link JpaTransactionManager}
+   * @param jpaConverter the function that converts the input object to a JPA entity
+   * @param objectDescriptor the type descriptor of the input object
+   */
+  public static <T> PTransform<PCollection<T>, PCollection<Void>> writeToSql(
+      String transformId,
+      int maxWriters,
+      int batchSize,
+      SerializableSupplier<JpaTransactionManager> jpaSupplier,
+      SerializableFunction<T, Object> jpaConverter,
+      TypeDescriptor<T> objectDescriptor) {
+    return new PTransform<PCollection<T>, PCollection<Void>>() {
      @Override
-      public PCollection<Void> expand(PCollection<VersionedEntity> input) {
+      public PCollection<Void> expand(PCollection<T> input) {
        return input
            .apply(
                "Shard data for " + transformId,
-                MapElements.into(kvs(integers(), TypeDescriptor.of(VersionedEntity.class)))
+                MapElements.into(kvs(integers(), objectDescriptor))
                    .via(ve -> KV.of(ThreadLocalRandom.current().nextInt(maxWriters), ve)))
            .apply("Batch output by shard " + transformId, GroupIntoBatches.ofSize(batchSize))
-            .apply("Write in batch for " + transformId, ParDo.of(new SqlBatchWriter(jpaSupplier)));
+            .apply(
+                "Write in batch for " + transformId,
+                ParDo.of(new SqlBatchWriter<T>(jpaSupplier, jpaConverter)));
      }
    };
  }
@@ -385,18 +424,22 @@ public final class Transforms {
   * to hold the {@code JpaTransactionManager} instance, we must ensure that JpaTransactionManager
   * is not changed or torn down while being used by some instance.
   */
-  private static class SqlBatchWriter extends DoFn<KV<Integer, Iterable<VersionedEntity>>, Void> {
+  private static class SqlBatchWriter<T> extends DoFn<KV<Integer, Iterable<T>>, Void> {

    private static int instanceCount = 0;
    private static JpaTransactionManager originalJpa;

    private final SerializableSupplier<JpaTransactionManager> jpaSupplier;
+    private final SerializableFunction<T, Object> jpaConverter;

    private transient Ofy ofy;
    private transient SystemSleeper sleeper;

-    SqlBatchWriter(SerializableSupplier<JpaTransactionManager> jpaSupplier) {
+    SqlBatchWriter(
+        SerializableSupplier<JpaTransactionManager> jpaSupplier,
+        SerializableFunction<T, Object> jpaConverter) {
      this.jpaSupplier = jpaSupplier;
+      this.jpaConverter = jpaConverter;
    }

    @Setup
@@ -429,15 +472,13 @@ public final class Transforms {
    }

    @ProcessElement
-    public void processElement(@Element KV<Integer, Iterable<VersionedEntity>> kv) {
+    public void processElement(@Element KV<Integer, Iterable<T>> kv) {
      try (AppEngineEnvironment env = new AppEngineEnvironment()) {
        ImmutableList<Object> ofyEntities =
            Streams.stream(kv.getValue())
-                .map(VersionedEntity::getEntity)
-                .map(Optional::get)
-                .map(ofy::toPojo)
+                .map(this.jpaConverter::apply)
                .collect(ImmutableList.toImmutableList());
-        retry(() -> jpaTm().transact(() -> jpaTm().saveNewOrUpdateAll(ofyEntities)));
+        retry(() -> jpaTm().transact(() -> jpaTm().putAll(ofyEntities)));
      }
    }

--- a/core/src/main/java/google/registry/beam/invoicing/sql/billing_events.sql
+++ b/core/src/main/java/google/registry/beam/invoicing/sql/billing_events.sql
@@ -55,9 +55,7 @@ FROM (
    FROM
      `%PROJECT_ID%.%DATASTORE_EXPORT_DATA_SET%.%REGISTRY_TABLE%`
    WHERE
-    -- TODO(b/18092292): Add a filter for tldState (not PDT/PREDELEGATION)
-      tldType = 'REAL'
-    AND disableInvoicing is not TRUE) ) AS BillingEvent
+      invoicingEnabled IS TRUE) ) AS BillingEvent
  -- Gather billing ID from registrar table
  -- This is a 'JOIN' as opposed to 'LEFT JOIN' to filter out
  -- non-billable registrars
--- a/core/src/main/java/google/registry/beam/spec11/Spec11Pipeline.java
+++ b/core/src/main/java/google/registry/beam/spec11/Spec11Pipeline.java
@@ -20,7 +20,7 @@ import static google.registry.beam.BeamUtils.getQueryFromFile;
 import com.google.auth.oauth2.GoogleCredentials;
 import com.google.auto.value.AutoValue;
 import com.google.common.collect.ImmutableSet;
-import google.registry.backup.AppEngineEnvironment;
+import google.registry.beam.initsql.Transforms;
 import google.registry.beam.initsql.Transforms.SerializableSupplier;
 import google.registry.beam.spec11.SafeBrowsingTransforms.EvaluateSafeBrowsingFn;
 import google.registry.config.CredentialModule.LocalCredential;
@@ -43,7 +43,6 @@ import org.apache.beam.sdk.options.Description;
 import org.apache.beam.sdk.options.PipelineOptionsFactory;
 import org.apache.beam.sdk.options.ValueProvider;
 import org.apache.beam.sdk.options.ValueProvider.NestedValueProvider;
-import org.apache.beam.sdk.transforms.DoFn;
 import org.apache.beam.sdk.transforms.GroupByKey;
 import org.apache.beam.sdk.transforms.MapElements;
 import org.apache.beam.sdk.transforms.ParDo;
@@ -191,34 +190,27 @@ public class Spec11Pipeline implements Serializable {
      PCollection<Subdomain> domains,
      EvaluateSafeBrowsingFn evaluateSafeBrowsingFn,
      ValueProvider<String> dateProvider) {
-
    PCollection<KV<Subdomain, ThreatMatch>> subdomainsSql =
        domains.apply("Run through SafeBrowsing API", ParDo.of(evaluateSafeBrowsingFn));
-    /* Store ThreatMatch objects in SQL. */
+    TypeDescriptor<KV<Subdomain, ThreatMatch>> descriptor =
+        new TypeDescriptor<KV<Subdomain, ThreatMatch>>() {};
    subdomainsSql.apply(
-        ParDo.of(
-            new DoFn<KV<Subdomain, ThreatMatch>, Void>() {
-              @ProcessElement
-              public void processElement(ProcessContext context) {
-                // create the Spec11ThreatMatch from Subdomain and ThreatMatch
-                try (AppEngineEnvironment env = new AppEngineEnvironment()) {
-                  Subdomain subdomain = context.element().getKey();
-                  Spec11ThreatMatch threatMatch =
-                      new Spec11ThreatMatch.Builder()
-                          .setThreatTypes(
-                              ImmutableSet.of(
-                                  ThreatType.valueOf(context.element().getValue().threatType())))
-                          .setCheckDate(
-                              LocalDate.parse(dateProvider.get(), ISODateTimeFormat.date()))
-                          .setDomainName(subdomain.domainName())
-                          .setDomainRepoId(subdomain.domainRepoId())
-                          .setRegistrarId(subdomain.registrarId())
-                          .build();
-                  JpaTransactionManager jpaTransactionManager = jpaSupplierFactory.get();
-                  jpaTransactionManager.transact(() -> jpaTransactionManager.saveNew(threatMatch));
-                }
-              }
-            }));
+        Transforms.writeToSql(
+            "Spec11ThreatMatch",
+            4,
+            4,
+            jpaSupplierFactory,
+            (kv) -> {
+              Subdomain subdomain = kv.getKey();
+              return new Spec11ThreatMatch.Builder()
+                  .setThreatTypes(ImmutableSet.of(ThreatType.valueOf(kv.getValue().threatType())))
+                  .setCheckDate(LocalDate.parse(dateProvider.get(), ISODateTimeFormat.date()))
+                  .setDomainName(subdomain.domainName())
+                  .setDomainRepoId(subdomain.domainRepoId())
+                  .setRegistrarId(subdomain.registrarId())
+                  .build();
+            },
+            descriptor));

    /* Store ThreatMatch objects in JSON. */
    PCollection<KV<Subdomain, ThreatMatch>> subdomainsJson =
--- a/core/src/main/java/google/registry/config/RegistryConfig.java
+++ b/core/src/main/java/google/registry/config/RegistryConfig.java
@@ -16,9 +16,12 @@ package google.registry.config;

 import static com.google.common.base.Suppliers.memoize;
 import static com.google.common.collect.ImmutableList.toImmutableList;
+import static com.google.common.collect.ImmutableSortedMap.toImmutableSortedMap;
 import static google.registry.config.ConfigUtils.makeUrl;
+import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static google.registry.util.ResourceUtils.readResourceUtf8;
 import static java.lang.annotation.RetentionPolicy.RUNTIME;
+import static java.util.Comparator.naturalOrder;

 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Ascii;
@@ -27,6 +30,7 @@ import com.google.common.base.Strings;
 import com.google.common.base.Supplier;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableSortedMap;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.util.TaskQueueUtils;
@@ -46,6 +50,7 @@ import javax.inject.Qualifier;
 import javax.inject.Singleton;
 import javax.mail.internet.AddressException;
 import javax.mail.internet.InternetAddress;
+import org.joda.time.DateTime;
 import org.joda.time.DateTimeConstants;
 import org.joda.time.Duration;

@@ -410,6 +415,14 @@ public final class RegistryConfig {
      return config.cloudSql.instanceConnectionName;
    }

+    @Provides
+    @Config("cloudSqlDbInstanceName")
+    public static String providesCloudSqlDbInstance(RegistryConfigSettings config) {
+      // Format of instanceConnectionName: project-id:region:instance-name
+      int lastColonIndex = config.cloudSql.instanceConnectionName.lastIndexOf(':');
+      return config.cloudSql.instanceConnectionName.substring(lastColonIndex + 1);
+    }
+
    @Provides
    @Config("cloudDnsRootUrl")
    public static Optional<String> getCloudDnsRootUrl(RegistryConfigSettings config) {
@@ -1345,6 +1358,39 @@ public final class RegistryConfig {
    public static String provideRdapTosStaticUrl(RegistryConfigSettings config) {
      return config.registryPolicy.rdapTosStaticUrl;
    }
+
+    @Provides
+    @Config("maxValidityDaysSchedule")
+    public static ImmutableSortedMap<DateTime, Integer> provideValidityDaysMap(
+        RegistryConfigSettings config) {
+      return config.sslCertificateValidation.maxValidityDaysSchedule.entrySet().stream()
+          .collect(
+              toImmutableSortedMap(
+                  naturalOrder(),
+                  e ->
+                      e.getKey().equals("START_OF_TIME")
+                          ? START_OF_TIME
+                          : DateTime.parse(e.getKey()),
+                  e -> e.getValue()));
+    }
+
+    @Provides
+    @Config("expirationWarningDays")
+    public static int provideDaysToExpiration(RegistryConfigSettings config) {
+      return config.sslCertificateValidation.expirationWarningDays;
+    }
+
+    @Provides
+    @Config("minimumRsaKeyLength")
+    public static int provideMinimumRsaKeyLength(RegistryConfigSettings config) {
+      return config.sslCertificateValidation.minimumRsaKeyLength;
+    }
+
+    @Provides
+    @Config("allowedEcdsaCurves")
+    public static ImmutableSet<String> provideAllowedEcdsaCurves(RegistryConfigSettings config) {
+      return ImmutableSet.copyOf(config.sslCertificateValidation.allowedEcdsaCurves);
+    }
  }

  /** Returns the App Engine project ID, which is based off the environment name. */
@@ -1554,6 +1600,22 @@ public final class RegistryConfig {
    CONFIG_SETTINGS.get().cloudSql.replicateTransactions = replicateTransactions;
  }

+  /**
+   * Returns whether or not to replay commit logs to the SQL database after export to GCS.
+   *
+   * <p>If true, we will trigger the {@link google.registry.backup.ReplayCommitLogsToSqlAction}
+   * after the {@link google.registry.backup.ExportCommitLogDiffAction} to load the commit logs and
+   * replay them to SQL.
+   */
+  public static boolean getCloudSqlReplayCommitLogs() {
+    return CONFIG_SETTINGS.get().cloudSql.replayCommitLogs;
+  }
+
+  @VisibleForTesting
+  public static void overrideCloudSqlReplayCommitLogs(boolean replayCommitLogs) {
+    CONFIG_SETTINGS.get().cloudSql.replayCommitLogs = replayCommitLogs;
+  }
+
  /** Returns the roid suffix to be used for the roids of all contacts and hosts. */
  public static String getContactAndHostRoidSuffix() {
    return CONFIG_SETTINGS.get().registryPolicy.contactAndHostRoidSuffix;
--- a/core/src/main/java/google/registry/config/RegistryConfigSettings.java
+++ b/core/src/main/java/google/registry/config/RegistryConfigSettings.java
@@ -15,6 +15,8 @@
 package google.registry.config;

 import java.util.List;
+import java.util.Map;
+import java.util.Set;

 /** The POJO that YAML config files are deserialized into. */
 public class RegistryConfigSettings {
@@ -38,6 +40,7 @@ public class RegistryConfigSettings {
  public Beam beam;
  public Keyring keyring;
  public RegistryTool registryTool;
+  public SslCertificateValidation sslCertificateValidation;

  /** Configuration options that apply to the entire App Engine project. */
  public static class AppEngine {
@@ -123,6 +126,7 @@ public class RegistryConfigSettings {
    public String username;
    public String instanceConnectionName;
    public boolean replicateTransactions;
+    public boolean replayCommitLogs;
  }

  /** Configuration for Apache Beam (Cloud Dataflow). */
@@ -218,4 +222,12 @@ public class RegistryConfigSettings {
    public String clientSecret;
    public String username;
  }
+
+  /** Configuration for the certificate checker. */
+  public static class SslCertificateValidation {
+    public Map<String, Integer> maxValidityDaysSchedule;
+    public int expirationWarningDays;
+    public int minimumRsaKeyLength;
+    public Set<String> allowedEcdsaCurves;
+  }
 }
--- a/core/src/main/java/google/registry/config/files/default-config.yaml
+++ b/core/src/main/java/google/registry/config/files/default-config.yaml
@@ -233,6 +233,8 @@ cloudSql:
  # Set this to true to replicate cloud SQL transactions to datastore in the
  # background.
  replicateTransactions: false
+  # Set this to true to enable replay of commit logs to SQL
+  replayCommitLogs: false

 cloudDns:
  # Set both properties to null in Production.
@@ -446,3 +448,21 @@ registryTool:
  # OAuth client secret used by the tool.
  clientSecret: YOUR_CLIENT_SECRET
  username: toolusername
+
+# Configuration options for checking SSL certificates.
+sslCertificateValidation:
+  # A map specifying the maximum amount of days the certificate can be valid.
+  # The entry key is the date closest before the date the certificate was issued
+  # and the entry value is the applicable maximum validity days for that certificate.
+  maxValidityDaysSchedule:
+    "START_OF_TIME": 825
+    "2020-09-01T00:00:00Z": 398
+  # The number of days before a certificate expires that indicates the
+  # certificate is nearing expiration and warnings should be sent.
+  expirationWarningDays: 30
+  # The minimum number of bits an RSA key must contain.
+  minimumRsaKeyLength: 2048
+  # The ECDSA curves that are allowed for public keys.
+  allowedEcdsaCurves:
+    - secp256r1
+    - secp384r1
--- a/core/src/main/java/google/registry/env/common/default/WEB-INF/queue.xml
+++ b/core/src/main/java/google/registry/env/common/default/WEB-INF/queue.xml
@@ -208,6 +208,12 @@
    <max-concurrent-requests>5</max-concurrent-requests>
  </queue>

+  <!-- Queue for replaying commit logs to SQL during the transition from Datastore -> SQL. -->
+  <queue>
+    <name>replay-commit-logs-to-sql</name>
+    <rate>1/s</rate>
+  </queue>
+
  <!-- The load[0-9] queues are used for load-testing, and can be safely deleted
       in any environment that doesn't require load-testing. -->
  <queue>
--- a/core/src/main/java/google/registry/flows/EppRequestHandler.java
+++ b/core/src/main/java/google/registry/flows/EppRequestHandler.java
@@ -74,6 +74,14 @@ public class EppRequestHandler {
          && eppOutput.getResponse().getResult().getCode() == SUCCESS_AND_CLOSE) {
        response.setHeader("Epp-Session", "close");
      }
+      // If a login request returns a success, a logged-in header is added to the response to inform
+      // the proxy that it is no longer necessary to send the full client certificate to the backend
+      // for this connection.
+      if (eppOutput.isResponse()
+          && eppOutput.getResponse().isLoginResponse()
+          && eppOutput.isSuccess()) {
+        response.setHeader("Logged-In", "true");
+      }
    } catch (Exception e) {
      logger.atWarning().withCause(e).log("handleEppCommand general exception");
      response.setStatus(SC_BAD_REQUEST);
--- a/core/src/main/java/google/registry/flows/certs/CertificateChecker.java
+++ b/core/src/main/java/google/registry/flows/certs/CertificateChecker.java
@@ -0,0 +1,261 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.flows.certs;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.util.DateTimeUtils.START_OF_TIME;
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableSortedMap;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.util.Clock;
+import google.registry.util.DateTimeUtils;
+import java.io.ByteArrayInputStream;
+import java.security.PublicKey;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.security.interfaces.ECPublicKey;
+import java.security.interfaces.RSAPublicKey;
+import java.util.Date;
+import java.util.stream.Collectors;
+import javax.inject.Inject;
+import org.bouncycastle.jcajce.provider.asymmetric.util.EC5Util;
+import org.bouncycastle.jce.ECNamedCurveTable;
+import org.bouncycastle.jce.spec.ECNamedCurveParameterSpec;
+import org.joda.time.DateTime;
+import org.joda.time.Days;
+
+/** An utility to check that a given certificate meets our requirements */
+public class CertificateChecker {
+
+  private final ImmutableSortedMap<DateTime, Integer> maxValidityLengthSchedule;
+  private final int daysToExpiration;
+  private final int minimumRsaKeyLength;
+  private final Clock clock;
+  private final ImmutableSet<String> allowedEcdsaCurves;
+
+  /**
+   * Constructs a CertificateChecker instance with the specified configuration parameters.
+   *
+   * <p>The max validity length schedule is a sorted map of {@link DateTime} to {@link Integer}
+   * entries representing a maximum validity period for certificates issued on or after that date.
+   * The first entry must have a key of {@link DateTimeUtils#START_OF_TIME}, such that every
+   * possible date has an applicable max validity period. Since security requirements tighten over
+   * time, the max validity periods will be decreasing as the date increases.
+   *
+   * <p>The validity length schedule used by all major Web browsers as of 2020Q4 would be
+   * represented as:
+   *
+   * <pre>
+   *   ImmutableSortedMap.of(
+   *     START_OF_TIME, 825,
+   *     DateTime.parse("2020-09-01T00:00:00Z"), 398
+   *   );
+   * </pre>
+   */
+  @Inject
+  public CertificateChecker(
+      @Config("maxValidityDaysSchedule")
+          ImmutableSortedMap<DateTime, Integer> maxValidityDaysSchedule,
+      @Config("expirationWarningDays") int expirationWarningDays,
+      @Config("minimumRsaKeyLength") int minimumRsaKeyLength,
+      @Config("allowedEcdsaCurves") ImmutableSet<String> allowedEcdsaCurves,
+      Clock clock) {
+    checkArgument(
+        maxValidityDaysSchedule.containsKey(START_OF_TIME),
+        "Max validity length schedule must contain an entry for START_OF_TIME");
+    this.maxValidityLengthSchedule = maxValidityDaysSchedule;
+    this.daysToExpiration = expirationWarningDays;
+    this.minimumRsaKeyLength = minimumRsaKeyLength;
+    this.allowedEcdsaCurves = allowedEcdsaCurves;
+    this.clock = clock;
+  }
+
+  /**
+   * Checks the given certificate string for violations and throws an exception if any violations
+   * exist.
+   */
+  public void validateCertificate(String certificateString) {
+    ImmutableSet<CertificateViolation> violations = checkCertificate(certificateString);
+    if (!violations.isEmpty()) {
+      String displayMessages =
+          violations.stream()
+              .map(violation -> getViolationDisplayMessage(violation))
+              .collect(Collectors.joining("\n"));
+      throw new IllegalArgumentException(displayMessages);
+    }
+  }
+
+  /**
+   * Checks a given certificate for violations and returns a list of all the violations the
+   * certificate has.
+   */
+  public ImmutableSet<CertificateViolation> checkCertificate(X509Certificate certificate) {
+    ImmutableSet.Builder<CertificateViolation> violations = new ImmutableSet.Builder<>();
+
+    // Check if currently in validity period
+    Date now = clock.nowUtc().toDate();
+    if (certificate.getNotAfter().before(now)) {
+      violations.add(CertificateViolation.EXPIRED);
+    } else if (certificate.getNotBefore().after(now)) {
+      violations.add(CertificateViolation.NOT_YET_VALID);
+    }
+
+    // Check validity period length
+    int maxValidityDays =
+        maxValidityLengthSchedule.floorEntry(new DateTime(certificate.getNotBefore())).getValue();
+    if (getValidityLengthInDays(certificate) > maxValidityDays) {
+      violations.add(CertificateViolation.VALIDITY_LENGTH_TOO_LONG);
+    }
+
+    // Check key strengths
+    PublicKey key = certificate.getPublicKey();
+    if (key.getAlgorithm().equals("RSA")) {
+      RSAPublicKey rsaPublicKey = (RSAPublicKey) key;
+      if (rsaPublicKey.getModulus().bitLength() < minimumRsaKeyLength) {
+        violations.add(CertificateViolation.RSA_KEY_LENGTH_TOO_SHORT);
+      }
+    } else if (key.getAlgorithm().equals("EC")) {
+      if (!checkCurveName(key, allowedEcdsaCurves)) {
+        violations.add(CertificateViolation.INVALID_ECDSA_CURVE);
+      }
+    } else {
+      violations.add(CertificateViolation.ALGORITHM_CONSTRAINED);
+    }
+    return violations.build();
+  }
+
+  /**
+   * Converts a given string to a certificate and checks it for violations, returning a list of all
+   * the violations the certificate has.
+   */
+  public ImmutableSet<CertificateViolation> checkCertificate(String certificateString) {
+    X509Certificate certificate;
+
+    try {
+      certificate =
+          (X509Certificate)
+              CertificateFactory.getInstance("X509")
+                  .generateCertificate(new ByteArrayInputStream(certificateString.getBytes(UTF_8)));
+    } catch (CertificateException e) {
+      throw new IllegalArgumentException("Unable to read given certificate.");
+    }
+
+    return checkCertificate(certificate);
+  }
+
+  /**
+   * Returns whether the certificate is nearing expiration.
+   *
+   * <p>Note that this is <i>all</i> that it checks. The certificate itself may well be expired or
+   * not yet valid and this message will still return false. So you definitely want to pair a call
+   * to this method with a call to {@link #checkCertificate} to determine other issues with the
+   * certificate that may be occurring.
+   */
+  public boolean isNearingExpiration(X509Certificate certificate) {
+    Date nearingExpirationDate =
+        DateTime.parse(certificate.getNotAfter().toInstant().toString())
+            .minusDays(daysToExpiration)
+            .toDate();
+    return clock.nowUtc().toDate().after(nearingExpirationDate);
+  }
+
+  private static int getValidityLengthInDays(X509Certificate certificate) {
+    DateTime start = DateTime.parse(certificate.getNotBefore().toInstant().toString());
+    DateTime end = DateTime.parse(certificate.getNotAfter().toInstant().toString());
+    return Days.daysBetween(start.withTimeAtStartOfDay(), end.withTimeAtStartOfDay()).getDays();
+  }
+
+  /** Checks if the curve used for a public key is in the list of acceptable curves. */
+  private static boolean checkCurveName(PublicKey key, ImmutableSet<String> allowedEcdsaCurves) {
+    org.bouncycastle.jce.spec.ECParameterSpec params;
+    // These 2 different instances of PublicKey need to be handled separately since their OIDs are
+    // encoded differently. More details on this can be found at
+    // https://stackoverflow.com/questions/49895713/how-to-find-the-matching-curve-name-from-an-ecpublickey.
+    if (key instanceof ECPublicKey) {
+      ECPublicKey ecKey = (ECPublicKey) key;
+      params = EC5Util.convertSpec(ecKey.getParams(), false);
+    } else if (key instanceof org.bouncycastle.jce.interfaces.ECPublicKey) {
+      org.bouncycastle.jce.interfaces.ECPublicKey ecKey =
+          (org.bouncycastle.jce.interfaces.ECPublicKey) key;
+      params = ecKey.getParameters();
+    } else {
+      throw new IllegalArgumentException("Unrecognized instance of PublicKey.");
+    }
+    return allowedEcdsaCurves.stream()
+        .anyMatch(
+            curve -> {
+              ECNamedCurveParameterSpec cParams = ECNamedCurveTable.getParameterSpec(curve);
+              return cParams.getN().equals(params.getN())
+                  && cParams.getH().equals(params.getH())
+                  && cParams.getCurve().equals(params.getCurve())
+                  && cParams.getG().equals(params.getG());
+            });
+  }
+
+  private String getViolationDisplayMessage(CertificateViolation certificateViolation) {
+    // Yes, we'd rather do this as an instance method on the CertificateViolation enum itself, but
+    // we can't because we need access to configuration (injected as instance variables) which you
+    // can't get in a static enum context.
+    switch (certificateViolation) {
+      case EXPIRED:
+        return "Certificate is expired.";
+      case NOT_YET_VALID:
+        return "Certificate start date is in the future.";
+      case ALGORITHM_CONSTRAINED:
+        return "Certificate key algorithm must be RSA or ECDSA.";
+      case RSA_KEY_LENGTH_TOO_SHORT:
+        return String.format(
+            "RSA key length is too short; the minimum allowed length is %d bits.",
+            this.minimumRsaKeyLength);
+      case VALIDITY_LENGTH_TOO_LONG:
+        return String.format(
+            "Certificate validity period is too long; it must be less than or equal to %d days.",
+            this.maxValidityLengthSchedule.lastEntry().getValue());
+      case INVALID_ECDSA_CURVE:
+        return String.format(
+            "The ECDSA key must use one of these algorithms: %s", allowedEcdsaCurves);
+      default:
+        throw new IllegalArgumentException(
+            String.format(
+                "Unknown CertificateViolation enum value: %s", certificateViolation.name()));
+    }
+  }
+
+  /**
+   * The type of violation a certificate has based on the certificate requirements
+   * (go/registry-proxy-security).
+   */
+  public enum CertificateViolation {
+    EXPIRED,
+    NOT_YET_VALID,
+    VALIDITY_LENGTH_TOO_LONG,
+    RSA_KEY_LENGTH_TOO_SHORT,
+    ALGORITHM_CONSTRAINED,
+    INVALID_ECDSA_CURVE;
+
+    /**
+     * Gets a suitable end-user-facing display message for this particular certificate violation.
+     *
+     * <p>Note that the {@link CertificateChecker} instance must be passed in because it contains
+     * configuration values (e.g. minimum RSA key length) that go into the error message text.
+     */
+    public String getDisplayMessage(CertificateChecker certificateChecker) {
+      return certificateChecker.getViolationDisplayMessage(this);
+    }
+  }
+}
--- a/core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java
@@ -110,6 +110,7 @@ import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
+import google.registry.persistence.DomainHistoryVKey;
 import google.registry.persistence.VKey;
 import google.registry.tmch.LordnTaskUtils;
 import java.util.Optional;
@@ -371,7 +372,7 @@ public class DomainCreateFlow implements TransactionalFlow {
        && TokenType.SINGLE_USE.equals(allocationToken.get().getTokenType())) {
      entitiesToSave.add(
          allocationTokenFlowUtils.redeemToken(
-              allocationToken.get(), HistoryEntry.createVKey(Key.create(historyEntry))));
+              allocationToken.get(), DomainHistoryVKey.create(Key.create(historyEntry))));
    }
    enqueueTasks(newDomain, hasSignedMarks, hasClaimsNotice);

--- a/core/src/main/java/google/registry/flows/domain/DomainRestoreRequestFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainRestoreRequestFlow.java
@@ -173,7 +173,7 @@ public final class DomainRestoreRequestFlow implements TransactionalFlow  {
            existingDomain, newExpirationTime, autorenewEvent, autorenewPollMessage, now, clientId);
    updateForeignKeyIndexDeletionTime(newDomain);
    entitiesToSave.add(newDomain, historyEntry, autorenewEvent, autorenewPollMessage);
-    tm().saveNewOrUpdateAll(entitiesToSave.build());
+    tm().putAll(entitiesToSave.build());
    tm().delete(existingDomain.getDeletePollMessage());
    dnsQueue.addDomainRefreshTask(existingDomain.getDomainName());
    return responseBuilder
--- a/core/src/main/java/google/registry/flows/domain/DomainUpdateFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainUpdateFlow.java
@@ -67,6 +67,7 @@ import google.registry.model.domain.DomainCommand.Update.AddRemove;
 import google.registry.model.domain.DomainCommand.Update.Change;
 import google.registry.model.domain.fee.FeeUpdateCommandExtension;
 import google.registry.model.domain.metadata.MetadataExtension;
+import google.registry.model.domain.secdns.DelegationSignerData;
 import google.registry.model.domain.secdns.SecDnsUpdateExtension;
 import google.registry.model.domain.superuser.DomainUpdateSuperuserExtension;
 import google.registry.model.eppcommon.AuthInfo;
@@ -238,10 +239,16 @@ public final class DomainUpdateFlow implements TransactionalFlow {
    DomainBase.Builder domainBuilder =
        domain
            .asBuilder()
-            // Handle the secDNS extension.
+            // Handle the secDNS extension. As dsData in secDnsUpdate is read from EPP input and
+            // does not have domainRepoId set, we create a copy of the existing dsData without
+            // domainRepoId for comparison.
            .setDsData(
                secDnsUpdate.isPresent()
-                    ? updateDsData(domain.getDsData(), secDnsUpdate.get())
+                    ? updateDsData(
+                        domain.getDsData().stream()
+                            .map(DelegationSignerData::cloneWithoutDomainRepoId)
+                            .collect(toImmutableSet()),
+                        secDnsUpdate.get())
                    : domain.getDsData())
            .setLastEppUpdateTime(now)
            .setLastEppUpdateClientId(clientId)
--- a/core/src/main/java/google/registry/flows/domain/token/AllocationTokenFlowUtils.java
+++ b/core/src/main/java/google/registry/flows/domain/token/AllocationTokenFlowUtils.java
@@ -32,8 +32,7 @@ import google.registry.model.domain.token.AllocationToken;
 import google.registry.model.domain.token.AllocationToken.TokenStatus;
 import google.registry.model.domain.token.AllocationToken.TokenType;
 import google.registry.model.registry.Registry;
-import google.registry.model.reporting.HistoryEntry;
-import google.registry.persistence.VKey;
+import google.registry.persistence.DomainHistoryVKey;
 import java.util.List;
 import java.util.Optional;
 import javax.inject.Inject;
@@ -108,7 +107,7 @@ public class AllocationTokenFlowUtils {

  /** Redeems a SINGLE_USE {@link AllocationToken}, returning the redeemed copy. */
  public AllocationToken redeemToken(
-      AllocationToken token, VKey<HistoryEntry> redemptionHistoryEntry) {
+      AllocationToken token, DomainHistoryVKey redemptionHistoryEntry) {
    checkArgument(
        TokenType.SINGLE_USE.equals(token.getTokenType()),
        "Only SINGLE_USE tokens can be marked as redeemed");
--- a/core/src/main/java/google/registry/flows/host/HostUpdateFlow.java
+++ b/core/src/main/java/google/registry/flows/host/HostUpdateFlow.java
@@ -285,7 +285,7 @@ public final class HostUpdateFlow implements TransactionalFlow {
        && newHost.isSubordinate()
        && Objects.equals(
            existingHost.getSuperordinateDomain(), newHost.getSuperordinateDomain())) {
-      tm().saveNewOrUpdate(
+      tm().put(
              tm().load(existingHost.getSuperordinateDomain())
                  .asBuilder()
                  .removeSubordinateHost(existingHost.getHostName())
@@ -294,14 +294,14 @@ public final class HostUpdateFlow implements TransactionalFlow {
      return;
    }
    if (existingHost.isSubordinate()) {
-      tm().saveNewOrUpdate(
+      tm().put(
              tm().load(existingHost.getSuperordinateDomain())
                  .asBuilder()
                  .removeSubordinateHost(existingHost.getHostName())
                  .build());
    }
    if (newHost.isSubordinate()) {
-      tm().saveNewOrUpdate(
+      tm().put(
              tm().load(newHost.getSuperordinateDomain())
                  .asBuilder()
                  .addSubordinateHost(newHost.getHostName())
--- a/core/src/main/java/google/registry/flows/poll/PollFlowUtils.java
+++ b/core/src/main/java/google/registry/flows/poll/PollFlowUtils.java
@@ -64,7 +64,7 @@ public final class PollFlowUtils {
      // and re-save it for future autorenew poll messages to be delivered. Otherwise, this
      // autorenew poll message has no more events to deliver and should be deleted.
      if (nextEventTime.isBefore(autorenewPollMessage.getAutorenewEndTime())) {
-        tm().saveNewOrUpdate(autorenewPollMessage.asBuilder().setEventTime(nextEventTime).build());
+        tm().put(autorenewPollMessage.asBuilder().setEventTime(nextEventTime).build());
        includeAckedMessageInCount = isBeforeOrAt(nextEventTime, tm().getTransactionTime());
      } else {
        tm().delete(autorenewPollMessage.createVKey());
--- a/core/src/main/java/google/registry/flows/session/LoginFlow.java
+++ b/core/src/main/java/google/registry/flows/session/LoginFlow.java
@@ -141,7 +141,7 @@ public class LoginFlow implements Flow {
    sessionMetadata.resetFailedLoginAttempts();
    sessionMetadata.setClientId(login.getClientId());
    sessionMetadata.setServiceExtensionUris(serviceExtensionUrisBuilder.build());
-    return responseBuilder.build();
+    return responseBuilder.setIsLoginResponse().build();
  }

  /** Registrar with this client ID could not be found. */
--- a/core/src/main/java/google/registry/idn/Arabic-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Arabic-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Arab
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Armenian-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Armenian-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Armn
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Bengali-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Bengali-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Beng
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Chinese-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Chinese-IDN.txt
@@ -1,24 +1,24 @@
 # Registry: Charleston Road Registry Inc.
-# Script: Chinese
+# Script: zh-Hans
 # Version: 1.0
 # Effective Date: 04-12-2012
 #
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
 # Notes: This table describes codepoints allowed for the Chinese script.

-Reference 0 Unicode 3.2
-Reference 1 A Complete Set of Simplified Chinese Characters
-Reference 2 Chinese Variants Collation Table
-Reference 3 Chinese Big Dictionary
-Reference 4 Chinese Relationship Table for Unihan Project
-Reference 5 GB2312
-Reference 6 General Table for Modern Chinese
-Reference 7 International Chinese Standard Big Dictionary
-Reference 8 Unihan Database
-Reference 9 BIG5
+# Reference 0 Unicode 3.2
+# Reference 1 A Complete Set of Simplified Chinese Characters
+# Reference 2 Chinese Variants Collation Table
+# Reference 3 Chinese Big Dictionary
+# Reference 4 Chinese Relationship Table for Unihan Project
+# Reference 5 GB2312
+# Reference 6 General Table for Modern Chinese
+# Reference 7 International Chinese Standard Big Dictionary
+# Reference 8 Unihan Database
+# Reference 9 BIG5

 U+002D(0);U+002D(0);
 U+0030(0);U+0030(0);
--- a/core/src/main/java/google/registry/idn/Cyrillic-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Cyrillic-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Cyrl
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Devanagari-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Devanagari-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Deva
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Ethiopic-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Ethiopic-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Ethi
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Georgian-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Georgian-IDN.txt
@@ -3,7 +3,7 @@
 #
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Greek-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Greek-IDN.txt
@@ -3,7 +3,7 @@
 # Script: Grek
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Gurmukhi-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Gurmukhi-IDN.txt
@@ -3,7 +3,7 @@
 # Script: Guru
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Hebrew-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Hebrew-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Hebr
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Kannada-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Kannada-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Knda
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Khmer-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Khmer-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Khmr
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 #
 # Telephone: +1 (650) 253-0000
--- a/core/src/main/java/google/registry/idn/Korean-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Korean-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Kore
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Malayalam-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Malayalam-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Mlym
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Myanmar-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Myanmar-IDN.txt
@@ -3,7 +3,7 @@
 # Version: 1.0
 # Effective Date: 04-12-2012
 #
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Oriya-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Oriya-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Orya
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Sinhala-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Sinhala-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Sinh
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Tamil-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Tamil-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Taml
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Telugu-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Telugu-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Telu
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/Show More
+++ b/Show More