Add a full ASCII StringGenerator alphabet (#882 )

* Add a full ASCII StringGenerator alphabet This is intended for the purpose of generating maximally secure passwords for PostgreSQL and others. We may need to remove a few of these punctuation characters if they prove to be more trouble than they're worth (e.g. backtick).
Fix pseudo typo (#880 )
2026-05-18 13:51:45 +00:00 · 2020-11-19 18:08:04 -05:00 · 2020-11-19 17:25:19 -05:00 · 2020-11-19 17:24:53 -05:00 · 2020-11-19 13:38:28 -05:00 · 2020-11-18 20:56:08 -05:00
682 changed files with 38733 additions and 5989 deletions
--- a/build.gradle
+++ b/build.gradle
@@ -191,7 +191,7 @@ allprojects {
 }

 task runPresubmits(type: Exec) {
-  executable '/usr/bin/python'
+  executable '/usr/bin/python3'
  args('config/presubmits.py')
 }

@@ -260,7 +260,7 @@ subprojects {
      // in the 'configurations' block, the following code must run after
      // project evaluation, when all configurations have been created.
      configurations.each {
-        if (it.name != 'dependencyLicenseReport') {
+        if (it.name != 'dependencyLicenseReport' && it.name != 'integration') {
          it.resolutionStrategy.activateDependencyLocking()
        }
      }
--- a/buildSrc/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/buildSrc/gradle/dependency-locks/annotationProcessor.lockfile
@@ -1,25 +1,28 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto.value:auto-value:1.6.3
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/buildSrc/gradle/dependency-locks/compile.lockfile
+++ b/buildSrc/gradle/dependency-locks/compile.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/compileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/compileClasspath.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/deploy_jar.lockfile
+++ b/buildSrc/gradle/dependency-locks/deploy_jar.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/runtime.lockfile
+++ b/buildSrc/gradle/dependency-locks/runtime.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/testAnnotationProcessor.lockfile
+++ b/buildSrc/gradle/dependency-locks/testAnnotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/buildSrc/gradle/dependency-locks/testCompile.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompile.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -58,7 +58,7 @@ org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -58,7 +58,7 @@ org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/buildSrc/gradle/dependency-locks/testRuntime.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntime.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -58,7 +58,7 @@ org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -58,7 +58,7 @@ org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/common/gradle/dependency-locks/annotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/common/gradle/dependency-locks/compile.lockfile
+++ b/common/gradle/dependency-locks/compile.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/compileClasspath.lockfile
+++ b/common/gradle/dependency-locks/compileClasspath.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/default.lockfile
+++ b/common/gradle/dependency-locks/default.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/deploy_jar.lockfile
+++ b/common/gradle/dependency-locks/deploy_jar.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/errorprone.lockfile
+++ b/common/gradle/dependency-locks/errorprone.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/common/gradle/dependency-locks/runtime.lockfile
+++ b/common/gradle/dependency-locks/runtime.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/testAnnotationProcessor.lockfile
+++ b/common/gradle/dependency-locks/testAnnotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/common/gradle/dependency-locks/testCompile.lockfile
+++ b/common/gradle/dependency-locks/testCompile.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,7 +17,7 @@ joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/common/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,7 +17,7 @@ joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/testRuntime.lockfile
+++ b/common/gradle/dependency-locks/testRuntime.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -18,7 +18,7 @@ joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -18,7 +18,7 @@ joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/testingAnnotationProcessor.lockfile
+++ b/common/gradle/dependency-locks/testingAnnotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/common/gradle/dependency-locks/testingCompile.lockfile
+++ b/common/gradle/dependency-locks/testingCompile.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -16,6 +16,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingCompileClasspath.lockfile
+++ b/common/gradle/dependency-locks/testingCompileClasspath.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -16,6 +16,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingRuntime.lockfile
+++ b/common/gradle/dependency-locks/testingRuntime.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,6 +17,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingRuntimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/testingRuntimeClasspath.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,6 +17,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/src/main/java/google/registry/util/DateTimeUtils.java
+++ b/common/src/main/java/google/registry/util/DateTimeUtils.java
@@ -24,6 +24,7 @@ import java.time.ZonedDateTime;
 import java.util.TimeZone;
 import org.joda.time.DateTime;
 import org.joda.time.DateTimeZone;
+import org.joda.time.LocalDate;

 /** Utilities methods and constants related to Joda {@link DateTime} objects. */
 public class DateTimeUtils {
@@ -108,4 +109,12 @@ public class DateTimeUtils {
        zonedDateTime.toInstant().toEpochMilli(),
        DateTimeZone.forTimeZone(TimeZone.getTimeZone(zonedDateTime.getZone())));
  }
+
+  public static java.sql.Date toSqlDate(LocalDate localDate) {
+    return new java.sql.Date(localDate.toDateTimeAtStartOfDay().getMillis());
+  }
+
+  public static LocalDate toLocalDate(java.sql.Date date) {
+    return new LocalDate(date.getTime(), DateTimeZone.UTC);
+  }
 }
--- a/common/src/main/java/google/registry/util/SystemSleeper.java
+++ b/common/src/main/java/google/registry/util/SystemSleeper.java
@@ -18,7 +18,6 @@ import static com.google.common.base.Preconditions.checkArgument;

 import com.google.common.util.concurrent.Uninterruptibles;
 import java.io.Serializable;
-import java.util.concurrent.TimeUnit;
 import javax.annotation.concurrent.ThreadSafe;
 import javax.inject.Inject;
 import org.joda.time.ReadableDuration;
@@ -41,6 +40,6 @@ public final class SystemSleeper implements Sleeper, Serializable {
  @Override
  public void sleepUninterruptibly(ReadableDuration duration) {
    checkArgument(duration.getMillis() >= 0);
-    Uninterruptibles.sleepUninterruptibly(duration.getMillis(), TimeUnit.MILLISECONDS);
+    Uninterruptibles.sleepUninterruptibly(java.time.Duration.ofMillis(duration.getMillis()));
  }
 }
--- a/common/src/testing/java/google/registry/testing/truth/TruthUtils.java
+++ b/common/src/testing/java/google/registry/testing/truth/TruthUtils.java
@@ -0,0 +1,47 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.testing.truth;
+
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import com.google.common.truth.Truth;
+import javax.annotation.Nullable;
+
+/** Utils class containing helper functions for {@link Truth}. */
+public class TruthUtils {
+
+  /** Asserts that both of the given objects are either null or nonnull. */
+  public static void assertNullnessParity(@Nullable Object thisObj, @Nullable Object thatObj) {
+    if (thisObj == null) {
+      assertWithMessage("Expects both objects are null but thatObj is not null")
+          .that(thatObj)
+          .isNull();
+    } else {
+      assertWithMessage("Expects both objects are not null but thatObj is null")
+          .that(thatObj)
+          .isNotNull();
+    }
+  }
+
+  /** Asserts that both of the given objects are either null or nonnull. */
+  public static void assertNullnessParity(
+      @Nullable Object thisObj, @Nullable Object thatObj, String errorMessage) {
+    if (thisObj == null) {
+      assertWithMessage(errorMessage).that(thatObj).isNull();
+    } else {
+      assertWithMessage(errorMessage).that(thatObj).isNotNull();
+    }
+  }
+}
--- a/config/nom_build.py
+++ b/config/nom_build.py
@@ -16,7 +16,7 @@
 """

 import argparse
-import attr
+import dataclasses
 import io
 import os
 import shutil
@@ -25,7 +25,7 @@ import sys
 from typing import List, Union


-@attr.s(auto_attribs=True)
+@dataclasses.dataclass
 class Property:
    name : str = ''
    desc : str = ''
@@ -39,7 +39,7 @@ class Property:
                raise ValidationError('value of {self.name} must be "true" or '
                                      '"false".')

-@attr.s(auto_attribs=True)
+@dataclasses.dataclass
 class GradleFlag:
    flags : Union[str, List[str]]
    desc : str
@@ -75,6 +75,7 @@ Pseudo-commands:
 """

 # Define all of our special gradle properties here.
+# TODO(b/169318491): use consistent naming style for properties and variables.
 PROPERTIES = [
    Property('mavenUrl',
             'URL to use for the main maven repository (defaults to maven '
@@ -124,6 +125,9 @@ PROPERTIES = [
             'server/schema integration tests. Please refer to <a '
             'href="./integration/README.md">integration project</a> for more '
             'information.'),
+    Property('baseSchemaTag',
+             'The nomulus version tag of the schema for use in the schema'
+             'deployment integration test (:db:schemaIncrementalDeployTest)'),
    Property('schema_version',
             'The nomulus version tag of the schema for use in a database'
             'integration test.'),
@@ -296,9 +300,15 @@ def do_pseudo_task(task: str) -> None:
                    f'{root}/db/src/main/resources/sql/schema/'
                    'nomulus.golden.sql')

-        if subprocess.call([f'{root}/gradlew', ':db:test']):
-            print('\033[31mERROR:\033[0m Golden file test failed after '
-                  'copying schema.  Please check your flyway files.')
+        # Rerun :db:test and regenerate the ER diagram (at "warning" log
+        # level so it doesn't generate pages of messaging)
+        if subprocess.call([f'{root}/gradlew', ':db:test', 'devTool',
+                            '--args=-e localhost --log_level=WARNING '
+                            'generate_sql_er_diagram -o '
+                            f'{root}/db/src/main/resources/sql/er_diagram']):
+            print('\033[31mERROR:\033[0m Golden file test or ER diagram '
+                  'generation failed after copying schema.  Please check your '
+                  'flyway files.')
            raise Abort()
    else:
        print(f'\033[31mERROR:\033[0m Unknown task {task}')
@@ -373,6 +383,7 @@ def main(args) -> int:

    # See if there are any special ":nom:" pseudo-tasks specified.
    got_non_pseudo_tasks = False
+    got_pseudo_tasks = False
    for arg in args.non_flag_args[1:]:
        if arg.startswith(':nom:'):
            if got_non_pseudo_tasks:
@@ -384,13 +395,14 @@ def main(args) -> int:
                      'specified prior to all actual gradle tasks.  Aborting.')
                return 1
            do_pseudo_task(arg)
+            got_pseudo_tasks = True
        else:
            got_non_pseudo_tasks = True
    non_flag_args = [
        arg for arg in args.non_flag_args[1:] if not arg.startswith(':nom:')]

    if not non_flag_args:
-        if not got_non_pseudo_tasks:
+        if not got_pseudo_tasks:
            print('\033[33mWARNING:\033[0m No tasks specified.  Not '
                  'doing anything')
        return 0
--- a/config/nom_build_test.py
+++ b/config/nom_build_test.py
@@ -113,7 +113,10 @@ class MyTest(unittest.TestCase):
        nom_build.main(['nom_build', ':nom:generate_golden_file'])
        self.call_mock.assert_has_calls([
            mock.call([GRADLEW, ':db:test']),
-            mock.call([GRADLEW, ':db:test'])
+            mock.call([GRADLEW, ':db:test', 'devTool',
+                       '--args=-e localhost --log_level=WARNING '
+                       'generate_sql_er_diagram -o '
+                       '/tmp/rootdir/db/src/main/resources/sql/er_diagram'])
        ])

    def test_generate_golden_file_nofail(self):
@@ -122,5 +125,3 @@ class MyTest(unittest.TestCase):
        self.call_mock.assert_has_calls([mock.call([GRADLEW, ':db:test'])])

 unittest.main()
-
-
--- a/config/presubmits.py
+++ b/config/presubmits.py
@@ -18,6 +18,7 @@ Error Prone) so we must write them manually.
 """

 import os
+from typing import List, Tuple
 import sys
 import re

@@ -178,6 +179,90 @@ PRESUBMITS = {
        "JavaScript files should not include console logging."
 }

+# Note that this regex only works for one kind of Flyway file.  If we want to
+# start using "R" and "U" files we'll need to update this script.
+FLYWAY_FILE_RX = re.compile(r'V(\d+)__.*')
+
+
+def get_seqnum(filename: str, location: str) -> int:
+  """Extracts the sequence number from a filename."""
+  m = FLYWAY_FILE_RX.match(filename)
+  if m is None:
+    raise ValueError('Illegal Flyway filename: %s in %s' % (filename, location))
+  return int(m.group(1))
+
+
+def files_by_seqnum(files: List[str], location: str) -> List[Tuple[int, str]]:
+  """Returns the list of seqnum, filename sorted by sequence number."""
+  return [(get_seqnum(filename, location), filename) for filename in files]
+
+
+def has_valid_order(indexed_files: List[Tuple[int, str]], location: str) -> bool:
+  """Verify that sequence numbers are in order without gaps or duplicates.
+
+  Args:
+    files: List of seqnum, filename for a list of Flyway files.
+    location: Where the list of files came from (for error reporting).
+
+  Returns:
+    True if the file list is valid.
+  """
+  last_index = 0
+  valid = True
+  for seqnum, filename in indexed_files:
+    if seqnum == last_index:
+      print('duplicate Flyway file sequence number found in %s: %s' %
+            (location, filename))
+      valid = False
+    elif seqnum < last_index:
+      print('File %s in %s is out of order.' % (filename, location))
+      valid = False
+    elif seqnum != last_index + 1:
+      print('Missing Flyway sequence number %d in %s.  Next file is %s' %
+            (last_index + 1, location, filename))
+      valid = False
+    last_index = seqnum
+  return valid
+
+
+def verify_flyway_index():
+  """Verifies that the Flyway index file is in sync with the directory."""
+  success = True
+
+  # Sort the files in the Flyway directory by their sequence number.
+  files = sorted(
+      files_by_seqnum(os.listdir('db/src/main/resources/sql/flyway'),
+                      'Flyway directory'))
+
+  # Make sure that there are no gaps and no duplicate sequence numbers in the
+  # files themselves.
+  if not has_valid_order(files, 'Flyway directory'):
+    success = False
+
+  # Remove the sequence numbers and compare against the index file contents.
+  files = [filename[1] for filename in sorted(files)]
+  with open('db/src/main/resources/sql/flyway.txt') as index:
+    indexed_files = index.read().splitlines()
+  if files != indexed_files:
+    unindexed = set(files) - set(indexed_files)
+    if unindexed:
+      print('The following Flyway files are not in flyway.txt: %s' % unindexed)
+
+    nonexistent = set(indexed_files) - set(files)
+    if nonexistent:
+      print('The following files are in flyway.txt but not in the Flyway '
+            'directory: %s' % nonexistent)
+
+    # Do an ordering check on the index file (ignore the result, we're failing
+    # anyway).
+    has_valid_order(files_by_seqnum(indexed_files, 'flyway.txt'), 'flyway.txt')
+    success = False
+
+  if not success:
+    print('Please fix any conflicts and run "./nom_build :db:generateFlywayIndex"')
+
+  return not success
+

 def get_files():
  for root, dirnames, filenames in os.walk("."):
@@ -197,5 +282,10 @@ if __name__ == "__main__":
      failed = True
      print("%s had errors: \n  %s" % (file, "\n  ".join(error_messages)))

+  # And now for something completely different: check to see if the Flyway
+  # index is up-to-date.  It's quicker to do it here than in the unit tests:
+  # when we put it here it fails fast before all of the tests are run.
+  failed |= verify_flyway_index()
+
  if failed:
    sys.exit(1)
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -171,6 +171,8 @@ dependencies {
  testRuntime files(sourceSets.test.resources.srcDirs)

  compile deps['com.beust:jcommander']
+  compile deps['com.google.api:gax']
+  compile deps['com.google.api.grpc:proto-google-cloud-secretmanager-v1']
  compile deps['com.google.api-client:google-api-client']
  compile deps['com.google.api-client:google-api-client-appengine']
  compile deps['com.google.api-client:google-api-client-servlet']
@@ -196,6 +198,7 @@ dependencies {
  compile deps['com.google.auth:google-auth-library-oauth2-http']
  compile deps['com.google.cloud.sql:jdbc-socket-factory-core']
  runtimeOnly deps['com.google.cloud.sql:postgres-socket-factory']
+  compile deps['com.google.cloud:google-cloud-secretmanager']
  compile deps['com.google.code.gson:gson']
  compile deps['com.google.auto.value:auto-value-annotations']
  compile deps['com.google.code.findbugs:jsr305']
@@ -215,12 +218,15 @@ dependencies {
  compile deps['com.google.oauth-client:google-oauth-client-jetty']
  compile deps['com.google.oauth-client:google-oauth-client-appengine']
  compile deps['com.google.oauth-client:google-oauth-client-servlet']
+  compile deps['com.google.protobuf:protobuf-java']
  compile deps['com.google.re2j:re2j']
  compile deps['com.google.template:soy']
  compile deps['com.googlecode.json-simple:json-simple']
  compile deps['com.jcraft:jsch']
  testCompile deps['com.thoughtworks.qdox:qdox']
+  compile deps['com.zaxxer:HikariCP']
  compile deps['dnsjava:dnsjava']
+  runtime deps['guru.nidi:graphviz-java-all-j2v8']
  testCompile deps['io.github.classgraph:classgraph']
  testRuntime deps['io.github.java-diff-utils:java-diff-utils']
  testCompile deps['javax.annotation:javax.annotation-api']
@@ -245,6 +251,7 @@ dependencies {
  testCompile deps['org.apache.ftpserver:ftpserver-core']
  compile deps['org.apache.httpcomponents:httpclient']
  compile deps['org.apache.httpcomponents:httpcore']
+  runtime deps['org.apache.logging.log4j:log4j-core']
  testCompile deps['org.apache.sshd:sshd-core']
  testCompile deps['org.apache.sshd:sshd-scp']
  testCompile deps['org.apache.sshd:sshd-sftp']
@@ -255,8 +262,10 @@ dependencies {
  testCompile deps['com.fasterxml.jackson.core:jackson-databind']
  runtime deps['org.glassfish.jaxb:jaxb-runtime']
  compile deps['org.hibernate:hibernate-core']
+  compile deps['org.hibernate:hibernate-hikaricp']
  compile deps['org.joda:joda-money']
  compile deps['org.json:json']
+  compile deps['org.jsoup:jsoup']
  testCompile deps['org.mortbay.jetty:jetty']
  compile deps['org.postgresql:postgresql']
  testCompile deps['org.seleniumhq.selenium:selenium-api']
@@ -269,6 +278,10 @@ dependencies {
  compile deps['org.testcontainers:postgresql']
  testCompile deps['org.testcontainers:selenium']
  testCompile deps['org.testcontainers:testcontainers']
+  compile deps['us.fatehi:schemacrawler']
+  compile deps['us.fatehi:schemacrawler-api']
+  compile deps['us.fatehi:schemacrawler-diagram']
+  compile deps['us.fatehi:schemacrawler-tools']
  compile deps['xerces:xmlParserAPIs']
  compile deps['xpp3:xpp3']
  // This dependency must come after javax.mail:mail as it would otherwise
@@ -303,7 +316,6 @@ dependencies {
  testCompile deps['org.hamcrest:hamcrest-all']
  testCompile deps['org.hamcrest:hamcrest-core']
  testCompile deps['org.hamcrest:hamcrest-library']
-  compile deps['org.hibernate:hibernate-hikaricp']
  testCompile deps['junit:junit']
  testCompile deps['org.junit.jupiter:junit-jupiter-api']
  testCompile deps['org.junit.jupiter:junit-jupiter-engine']
--- a/core/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/annotationProcessor.lockfile
@@ -1,8 +1,8 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto.value:auto-value:1.6.3
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
@@ -11,15 +11,15 @@ com.google.dagger:dagger-compiler:2.28
 com.google.dagger:dagger-producers:2.28
 com.google.dagger:dagger-spi:2.28
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotation:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
 com.google.errorprone:error_prone_annotations:2.3.4
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.errorprone:javac-shaded:9-dev-r4023-3
 com.google.googlejavaformat:google-java-format:1.5
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.protobuf:protobuf-java:3.4.0
@@ -30,11 +30,14 @@ javax.inject:javax.inject:1
 javax.persistence:javax.persistence-api:2.2
 net.ltgt.gradle.incap:incap:0.2
 org.checkerframework:checker-compat-qual:2.5.3
-org.checkerframework:checker-qual:2.11.1
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.5.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.jetbrains.kotlin:kotlin-stdlib-common:1.3.61
 org.jetbrains.kotlin:kotlin-stdlib:1.3.61
 org.jetbrains.kotlinx:kotlinx-metadata-jvm:0.1.0
 org.jetbrains:annotations:13.0
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/core/gradle/dependency-locks/compile.lockfile
+++ b/core/gradle/dependency-locks/compile.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +36,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +69,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +84,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +113,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +128,25 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +179,7 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -198,16 +201,17 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -215,16 +219,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -234,7 +239,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -244,10 +249,15 @@ org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/compileClasspath.lockfile
+++ b/core/gradle/dependency-locks/compileClasspath.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -18,7 +18,6 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.30.9
 com.google.api-client:google-api-client-java6:1.30.9
@@ -36,15 +35,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +68,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,22 +83,23 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,7 +112,7 @@ com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
 com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -124,25 +126,25 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -158,7 +160,6 @@ io.netty:netty-transport:4.1.42.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
-io.perfmark:perfmark-api:0.19.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -174,7 +175,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -196,32 +197,33 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -231,7 +233,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -241,10 +243,15 @@ org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/default.lockfile
+++ b/core/gradle/dependency-locks/default.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,23 +89,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -111,8 +118,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -126,25 +133,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -177,7 +187,8 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -198,17 +209,20 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
-org.apache.logging.log4j:log4j-api:2.6.2
+org.apache.logging.log4j:log4j-api:2.13.3
+org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -216,16 +230,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -235,21 +250,29 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/deploy_jar.lockfile
+++ b/core/gradle/dependency-locks/deploy_jar.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,23 +89,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -111,8 +118,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -126,25 +133,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,33 +208,37 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
-org.apache.logging.log4j:log4j-api:2.6.2
+org.apache.logging.log4j:log4j-api:2.13.3
+org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -233,21 +248,29 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/errorprone.lockfile
+++ b/core/gradle/dependency-locks/errorprone.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/core/gradle/dependency-locks/nonprodAnnotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/nonprodAnnotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/core/gradle/dependency-locks/nonprodCompile.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompile.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +36,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +69,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +84,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +113,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +128,25 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +179,7 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -198,16 +201,17 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -215,16 +219,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -234,7 +239,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -244,10 +249,15 @@ org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/nonprodCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompileClasspath.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -18,7 +18,6 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.30.9
 com.google.api-client:google-api-client-java6:1.30.9
@@ -36,15 +35,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +68,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,22 +83,23 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,7 +112,7 @@ com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
 com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -124,25 +126,25 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -158,7 +160,6 @@ io.netty:netty-transport:4.1.42.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
-io.perfmark:perfmark-api:0.19.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -175,7 +176,7 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,16 +198,16 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -214,16 +215,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -233,7 +235,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -243,10 +245,15 @@ org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/nonprodRuntime.lockfile
+++ b/core/gradle/dependency-locks/nonprodRuntime.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +88,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +117,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +132,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,17 +208,20 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
-org.apache.logging.log4j:log4j-api:2.6.2
+org.apache.logging.log4j:log4j-api:2.13.3
+org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -215,16 +229,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -234,20 +249,28 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/nonprodRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/nonprodRuntimeClasspath.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +88,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +117,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +132,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,17 +208,20 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
-org.apache.logging.log4j:log4j-api:2.6.2
+org.apache.logging.log4j:log4j-api:2.13.3
+org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -215,16 +229,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -234,20 +249,28 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/runtime.lockfile
+++ b/core/gradle/dependency-locks/runtime.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +88,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +117,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +132,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,17 +208,20 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
-org.apache.logging.log4j:log4j-api:2.6.2
+org.apache.logging.log4j:log4j-api:2.13.3
+org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -215,16 +229,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -234,20 +249,28 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,23 +89,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -111,8 +118,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -126,25 +133,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,33 +208,37 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
-org.apache.logging.log4j:log4j-api:2.6.2
+org.apache.logging.log4j:log4j-api:2.13.3
+org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -233,21 +248,29 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/testAnnotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/testAnnotationProcessor.lockfile
@@ -1,8 +1,8 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto.value:auto-value:1.6.3
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
@@ -11,15 +11,15 @@ com.google.dagger:dagger-compiler:2.28
 com.google.dagger:dagger-producers:2.28
 com.google.dagger:dagger-spi:2.28
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotation:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
 com.google.errorprone:error_prone_annotations:2.3.4
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.errorprone:javac-shaded:9-dev-r4023-3
 com.google.googlejavaformat:google-java-format:1.5
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.protobuf:protobuf-java:3.4.0
@@ -30,11 +30,14 @@ javax.inject:javax.inject:1
 javax.persistence:javax.persistence-api:2.2
 net.ltgt.gradle.incap:incap:0.2
 org.checkerframework:checker-compat-qual:2.5.3
-org.checkerframework:checker-qual:2.11.1
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.5.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.jetbrains.kotlin:kotlin-stdlib-common:1.3.61
 org.jetbrains.kotlin:kotlin-stdlib:1.3.61
 org.jetbrains.kotlinx:kotlinx-metadata-jvm:0.1.0
 org.jetbrains:annotations:13.0
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/core/gradle/dependency-locks/testCompile.lockfile
+++ b/core/gradle/dependency-locks/testCompile.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.11.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +36,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -68,9 +70,9 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,24 +85,25 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:29.0-jre
-com.google.guava:guava:29.0-jre
+com.google.guava:guava-testlib:30.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -113,8 +116,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -133,25 +136,25 @@ com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -185,7 +188,7 @@ jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.13
 net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -212,7 +215,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.apache.mina:mina-core:2.0.4
@@ -225,10 +228,10 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -238,16 +241,17 @@ org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
 org.junit.jupiter:junit-jupiter-api:5.6.2
 org.junit.jupiter:junit-jupiter-engine:5.6.2
@@ -271,7 +275,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -293,10 +297,15 @@ org.testcontainers:junit-jupiter:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:selenium:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.11.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -18,7 +18,6 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.30.9
 com.google.api-client:google-api-client-java6:1.30.9
@@ -36,15 +35,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -68,9 +69,9 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,23 +84,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:29.0-jre
-com.google.guava:guava:29.0-jre
+com.google.guava:guava-testlib:30.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -113,7 +115,7 @@ com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
 com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -132,25 +134,25 @@ com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -166,7 +168,6 @@ io.netty:netty-transport:4.1.42.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
-io.perfmark:perfmark-api:0.19.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -184,7 +185,7 @@ jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.13
 net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -211,7 +212,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.apache.mina:mina-core:2.0.4
@@ -224,10 +225,9 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -237,16 +237,17 @@ org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
 org.junit.jupiter:junit-jupiter-api:5.6.2
 org.junit.jupiter:junit-jupiter-engine:5.6.2
@@ -270,7 +271,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -292,10 +293,15 @@ org.testcontainers:junit-jupiter:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:selenium:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/testRuntime.lockfile
+++ b/core/gradle/dependency-locks/testRuntime.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.11.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -68,9 +74,9 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -84,24 +90,25 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:29.0-jre
-com.google.guava:guava:29.0-jre
+com.google.guava:guava-testlib:30.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -114,8 +121,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -134,26 +141,29 @@ com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.github.java-diff-utils:java-diff-utils:4.0
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -186,8 +196,9 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.13
+net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -214,9 +225,10 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
-org.apache.logging.log4j:log4j-api:2.6.2
+org.apache.logging.log4j:log4j-api:2.13.3
+org.apache.logging.log4j:log4j-core:2.13.3
 org.apache.mina:mina-core:2.0.4
 org.apache.sshd:sshd-core:2.0.0
 org.apache.sshd:sshd-scp:2.0.0
@@ -227,10 +239,10 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -241,16 +253,17 @@ org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
 org.junit.jupiter:junit-jupiter-api:5.6.2
 org.junit.jupiter:junit-jupiter-engine:5.6.2
@@ -274,7 +287,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -289,6 +302,8 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
@@ -296,10 +311,16 @@ org.testcontainers:junit-jupiter:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:selenium:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.11.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -68,9 +74,9 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -84,24 +90,25 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:29.0-jre
-com.google.guava:guava:29.0-jre
+com.google.guava:guava-testlib:30.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -114,8 +121,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -134,26 +141,29 @@ com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.github.java-diff-utils:java-diff-utils:4.0
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -186,8 +196,9 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.13
+net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -214,9 +225,10 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
-org.apache.logging.log4j:log4j-api:2.6.2
+org.apache.logging.log4j:log4j-api:2.13.3
+org.apache.logging.log4j:log4j-core:2.13.3
 org.apache.mina:mina-core:2.0.4
 org.apache.sshd:sshd-core:2.0.0
 org.apache.sshd:sshd-scp:2.0.0
@@ -227,10 +239,10 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -241,16 +253,17 @@ org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
 org.junit.jupiter:junit-jupiter-api:5.6.2
 org.junit.jupiter:junit-jupiter-engine:5.6.2
@@ -274,7 +287,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -289,6 +302,8 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
 org.testcontainers:database-commons:1.14.3
@@ -297,10 +312,16 @@ org.testcontainers:junit-jupiter:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:selenium:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java
+++ b/core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java
@@ -464,7 +464,7 @@ public class DeleteContactsAndHostsAction implements Runnable {
        HostResource host = (HostResource) existingResource;
        if (host.isSubordinate()) {
          dnsQueue.addHostRefreshTask(host.getHostName());
-          tm().saveNewOrUpdate(
+          tm().put(
                  tm().load(host.getSuperordinateDomain())
                      .asBuilder()
                      .removeSubordinateHost(host.getHostName())
--- a/core/src/main/java/google/registry/beam/initsql/InitSqlPipeline.java
+++ b/core/src/main/java/google/registry/beam/initsql/InitSqlPipeline.java
@@ -92,9 +92,8 @@ public class InitSqlPipeline implements Serializable {
   * Datastore kinds to be written to the SQL database before the cleansed version of {@link
   * DomainBase}.
   */
-  // TODO(weiminyu): include Registry.class when it is modeled in JPA.
  private static final ImmutableList<Class<?>> PHASE_ONE_ORDERED =
-      ImmutableList.of(Registrar.class, ContactResource.class);
+      ImmutableList.of(Registry.class, Registrar.class, ContactResource.class);

  /**
   * Datastore kinds to be written to the SQL database after the cleansed version of {@link
--- a/core/src/main/java/google/registry/beam/initsql/Transforms.java
+++ b/core/src/main/java/google/registry/beam/initsql/Transforms.java
@@ -437,7 +437,7 @@ public final class Transforms {
                .map(Optional::get)
                .map(ofy::toPojo)
                .collect(ImmutableList.toImmutableList());
-        retry(() -> jpaTm().transact(() -> jpaTm().saveNewOrUpdateAll(ofyEntities)));
+        retry(() -> jpaTm().transact(() -> jpaTm().putAll(ofyEntities)));
      }
    }

--- a/core/src/main/java/google/registry/beam/invoicing/sql/billing_events.sql
+++ b/core/src/main/java/google/registry/beam/invoicing/sql/billing_events.sql
@@ -55,9 +55,7 @@ FROM (
    FROM
      `%PROJECT_ID%.%DATASTORE_EXPORT_DATA_SET%.%REGISTRY_TABLE%`
    WHERE
-    -- TODO(b/18092292): Add a filter for tldState (not PDT/PREDELEGATION)
-      tldType = 'REAL'
-    AND disableInvoicing is not TRUE) ) AS BillingEvent
+      invoicingEnabled IS TRUE) ) AS BillingEvent
  -- Gather billing ID from registrar table
  -- This is a 'JOIN' as opposed to 'LEFT JOIN' to filter out
  -- non-billable registrars
--- a/core/src/main/java/google/registry/beam/spec11/Spec11Pipeline.java
+++ b/core/src/main/java/google/registry/beam/spec11/Spec11Pipeline.java
@@ -215,7 +215,7 @@ public class Spec11Pipeline implements Serializable {
                          .setRegistrarId(subdomain.registrarId())
                          .build();
                  JpaTransactionManager jpaTransactionManager = jpaSupplierFactory.get();
-                  jpaTransactionManager.transact(() -> jpaTransactionManager.saveNew(threatMatch));
+                  jpaTransactionManager.transact(() -> jpaTransactionManager.insert(threatMatch));
                }
              }
            }));
--- a/core/src/main/java/google/registry/config/RegistryConfig.java
+++ b/core/src/main/java/google/registry/config/RegistryConfig.java
@@ -16,9 +16,12 @@ package google.registry.config;

 import static com.google.common.base.Suppliers.memoize;
 import static com.google.common.collect.ImmutableList.toImmutableList;
+import static com.google.common.collect.ImmutableSortedMap.toImmutableSortedMap;
 import static google.registry.config.ConfigUtils.makeUrl;
+import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static google.registry.util.ResourceUtils.readResourceUtf8;
 import static java.lang.annotation.RetentionPolicy.RUNTIME;
+import static java.util.Comparator.naturalOrder;

 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Ascii;
@@ -27,6 +30,7 @@ import com.google.common.base.Strings;
 import com.google.common.base.Supplier;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableSortedMap;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.util.TaskQueueUtils;
@@ -46,6 +50,7 @@ import javax.inject.Qualifier;
 import javax.inject.Singleton;
 import javax.mail.internet.AddressException;
 import javax.mail.internet.InternetAddress;
+import org.joda.time.DateTime;
 import org.joda.time.DateTimeConstants;
 import org.joda.time.Duration;

@@ -1345,6 +1350,39 @@ public final class RegistryConfig {
    public static String provideRdapTosStaticUrl(RegistryConfigSettings config) {
      return config.registryPolicy.rdapTosStaticUrl;
    }
+
+    @Provides
+    @Config("maxValidityDaysSchedule")
+    public static ImmutableSortedMap<DateTime, Integer> provideValidityDaysMap(
+        RegistryConfigSettings config) {
+      return config.sslCertificateValidation.maxValidityDaysSchedule.entrySet().stream()
+          .collect(
+              toImmutableSortedMap(
+                  naturalOrder(),
+                  e ->
+                      e.getKey().equals("START_OF_TIME")
+                          ? START_OF_TIME
+                          : DateTime.parse(e.getKey()),
+                  e -> e.getValue()));
+    }
+
+    @Provides
+    @Config("expirationWarningDays")
+    public static int provideDaysToExpiration(RegistryConfigSettings config) {
+      return config.sslCertificateValidation.expirationWarningDays;
+    }
+
+    @Provides
+    @Config("minimumRsaKeyLength")
+    public static int provideMinimumRsaKeyLength(RegistryConfigSettings config) {
+      return config.sslCertificateValidation.minimumRsaKeyLength;
+    }
+
+    @Provides
+    @Config("allowedEcdsaCurves")
+    public static ImmutableSet<String> provideAllowedEcdsaCurves(RegistryConfigSettings config) {
+      return ImmutableSet.copyOf(config.sslCertificateValidation.allowedEcdsaCurves);
+    }
  }

  /** Returns the App Engine project ID, which is based off the environment name. */
--- a/core/src/main/java/google/registry/config/RegistryConfigSettings.java
+++ b/core/src/main/java/google/registry/config/RegistryConfigSettings.java
@@ -15,6 +15,8 @@
 package google.registry.config;

 import java.util.List;
+import java.util.Map;
+import java.util.Set;

 /** The POJO that YAML config files are deserialized into. */
 public class RegistryConfigSettings {
@@ -38,6 +40,7 @@ public class RegistryConfigSettings {
  public Beam beam;
  public Keyring keyring;
  public RegistryTool registryTool;
+  public SslCertificateValidation sslCertificateValidation;

  /** Configuration options that apply to the entire App Engine project. */
  public static class AppEngine {
@@ -218,4 +221,12 @@ public class RegistryConfigSettings {
    public String clientSecret;
    public String username;
  }
+
+  /** Configuration for the certificate checker. */
+  public static class SslCertificateValidation {
+    public Map<String, Integer> maxValidityDaysSchedule;
+    public int expirationWarningDays;
+    public int minimumRsaKeyLength;
+    public Set<String> allowedEcdsaCurves;
+  }
 }
--- a/core/src/main/java/google/registry/config/files/default-config.yaml
+++ b/core/src/main/java/google/registry/config/files/default-config.yaml
@@ -446,3 +446,21 @@ registryTool:
  # OAuth client secret used by the tool.
  clientSecret: YOUR_CLIENT_SECRET
  username: toolusername
+
+# Configuration options for checking SSL certificates.
+sslCertificateValidation:
+  # A map specifying the maximum amount of days the certificate can be valid.
+  # The entry key is the date closest before the date the certificate was issued
+  # and the entry value is the applicable maximum validity days for that certificate.
+  maxValidityDaysSchedule:
+    "START_OF_TIME": 825
+    "2020-09-01T00:00:00Z": 398
+  # The number of days before a certificate expires that indicates the
+  # certificate is nearing expiration and warnings should be sent.
+  expirationWarningDays: 30
+  # The minimum number of bits an RSA key must contain.
+  minimumRsaKeyLength: 2048
+  # The ECDSA curves that are allowed for public keys.
+  allowedEcdsaCurves:
+    - secp256r1
+    - secp384r1
--- a/core/src/main/java/google/registry/flows/certs/CertificateChecker.java
+++ b/core/src/main/java/google/registry/flows/certs/CertificateChecker.java
@@ -0,0 +1,261 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.flows.certs;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.util.DateTimeUtils.START_OF_TIME;
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableSortedMap;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.util.Clock;
+import google.registry.util.DateTimeUtils;
+import java.io.ByteArrayInputStream;
+import java.security.PublicKey;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.security.interfaces.ECPublicKey;
+import java.security.interfaces.RSAPublicKey;
+import java.util.Date;
+import java.util.stream.Collectors;
+import javax.inject.Inject;
+import org.bouncycastle.jcajce.provider.asymmetric.util.EC5Util;
+import org.bouncycastle.jce.ECNamedCurveTable;
+import org.bouncycastle.jce.spec.ECNamedCurveParameterSpec;
+import org.joda.time.DateTime;
+import org.joda.time.Days;
+
+/** An utility to check that a given certificate meets our requirements */
+public class CertificateChecker {
+
+  private final ImmutableSortedMap<DateTime, Integer> maxValidityLengthSchedule;
+  private final int daysToExpiration;
+  private final int minimumRsaKeyLength;
+  private final Clock clock;
+  private final ImmutableSet<String> allowedEcdsaCurves;
+
+  /**
+   * Constructs a CertificateChecker instance with the specified configuration parameters.
+   *
+   * <p>The max validity length schedule is a sorted map of {@link DateTime} to {@link Integer}
+   * entries representing a maximum validity period for certificates issued on or after that date.
+   * The first entry must have a key of {@link DateTimeUtils#START_OF_TIME}, such that every
+   * possible date has an applicable max validity period. Since security requirements tighten over
+   * time, the max validity periods will be decreasing as the date increases.
+   *
+   * <p>The validity length schedule used by all major Web browsers as of 2020Q4 would be
+   * represented as:
+   *
+   * <pre>
+   *   ImmutableSortedMap.of(
+   *     START_OF_TIME, 825,
+   *     DateTime.parse("2020-09-01T00:00:00Z"), 398
+   *   );
+   * </pre>
+   */
+  @Inject
+  public CertificateChecker(
+      @Config("maxValidityDaysSchedule")
+          ImmutableSortedMap<DateTime, Integer> maxValidityDaysSchedule,
+      @Config("expirationWarningDays") int expirationWarningDays,
+      @Config("minimumRsaKeyLength") int minimumRsaKeyLength,
+      @Config("allowedEcdsaCurves") ImmutableSet<String> allowedEcdsaCurves,
+      Clock clock) {
+    checkArgument(
+        maxValidityDaysSchedule.containsKey(START_OF_TIME),
+        "Max validity length schedule must contain an entry for START_OF_TIME");
+    this.maxValidityLengthSchedule = maxValidityDaysSchedule;
+    this.daysToExpiration = expirationWarningDays;
+    this.minimumRsaKeyLength = minimumRsaKeyLength;
+    this.allowedEcdsaCurves = allowedEcdsaCurves;
+    this.clock = clock;
+  }
+
+  /**
+   * Checks the given certificate string for violations and throws an exception if any violations
+   * exist.
+   */
+  public void validateCertificate(String certificateString) {
+    ImmutableSet<CertificateViolation> violations = checkCertificate(certificateString);
+    if (!violations.isEmpty()) {
+      String displayMessages =
+          violations.stream()
+              .map(violation -> getViolationDisplayMessage(violation))
+              .collect(Collectors.joining("\n"));
+      throw new IllegalArgumentException(displayMessages);
+    }
+  }
+
+  /**
+   * Checks a given certificate for violations and returns a list of all the violations the
+   * certificate has.
+   */
+  public ImmutableSet<CertificateViolation> checkCertificate(X509Certificate certificate) {
+    ImmutableSet.Builder<CertificateViolation> violations = new ImmutableSet.Builder<>();
+
+    // Check if currently in validity period
+    Date now = clock.nowUtc().toDate();
+    if (certificate.getNotAfter().before(now)) {
+      violations.add(CertificateViolation.EXPIRED);
+    } else if (certificate.getNotBefore().after(now)) {
+      violations.add(CertificateViolation.NOT_YET_VALID);
+    }
+
+    // Check validity period length
+    int maxValidityDays =
+        maxValidityLengthSchedule.floorEntry(new DateTime(certificate.getNotBefore())).getValue();
+    if (getValidityLengthInDays(certificate) > maxValidityDays) {
+      violations.add(CertificateViolation.VALIDITY_LENGTH_TOO_LONG);
+    }
+
+    // Check key strengths
+    PublicKey key = certificate.getPublicKey();
+    if (key.getAlgorithm().equals("RSA")) {
+      RSAPublicKey rsaPublicKey = (RSAPublicKey) key;
+      if (rsaPublicKey.getModulus().bitLength() < minimumRsaKeyLength) {
+        violations.add(CertificateViolation.RSA_KEY_LENGTH_TOO_SHORT);
+      }
+    } else if (key.getAlgorithm().equals("EC")) {
+      if (!checkCurveName(key, allowedEcdsaCurves)) {
+        violations.add(CertificateViolation.INVALID_ECDSA_CURVE);
+      }
+    } else {
+      violations.add(CertificateViolation.ALGORITHM_CONSTRAINED);
+    }
+    return violations.build();
+  }
+
+  /**
+   * Converts a given string to a certificate and checks it for violations, returning a list of all
+   * the violations the certificate has.
+   */
+  public ImmutableSet<CertificateViolation> checkCertificate(String certificateString) {
+    X509Certificate certificate;
+
+    try {
+      certificate =
+          (X509Certificate)
+              CertificateFactory.getInstance("X509")
+                  .generateCertificate(new ByteArrayInputStream(certificateString.getBytes(UTF_8)));
+    } catch (CertificateException e) {
+      throw new IllegalArgumentException("Unable to read given certificate.");
+    }
+
+    return checkCertificate(certificate);
+  }
+
+  /**
+   * Returns whether the certificate is nearing expiration.
+   *
+   * <p>Note that this is <i>all</i> that it checks. The certificate itself may well be expired or
+   * not yet valid and this message will still return false. So you definitely want to pair a call
+   * to this method with a call to {@link #checkCertificate} to determine other issues with the
+   * certificate that may be occurring.
+   */
+  public boolean isNearingExpiration(X509Certificate certificate) {
+    Date nearingExpirationDate =
+        DateTime.parse(certificate.getNotAfter().toInstant().toString())
+            .minusDays(daysToExpiration)
+            .toDate();
+    return clock.nowUtc().toDate().after(nearingExpirationDate);
+  }
+
+  private static int getValidityLengthInDays(X509Certificate certificate) {
+    DateTime start = DateTime.parse(certificate.getNotBefore().toInstant().toString());
+    DateTime end = DateTime.parse(certificate.getNotAfter().toInstant().toString());
+    return Days.daysBetween(start.withTimeAtStartOfDay(), end.withTimeAtStartOfDay()).getDays();
+  }
+
+  /** Checks if the curve used for a public key is in the list of acceptable curves. */
+  private static boolean checkCurveName(PublicKey key, ImmutableSet<String> allowedEcdsaCurves) {
+    org.bouncycastle.jce.spec.ECParameterSpec params;
+    // These 2 different instances of PublicKey need to be handled separately since their OIDs are
+    // encoded differently. More details on this can be found at
+    // https://stackoverflow.com/questions/49895713/how-to-find-the-matching-curve-name-from-an-ecpublickey.
+    if (key instanceof ECPublicKey) {
+      ECPublicKey ecKey = (ECPublicKey) key;
+      params = EC5Util.convertSpec(ecKey.getParams(), false);
+    } else if (key instanceof org.bouncycastle.jce.interfaces.ECPublicKey) {
+      org.bouncycastle.jce.interfaces.ECPublicKey ecKey =
+          (org.bouncycastle.jce.interfaces.ECPublicKey) key;
+      params = ecKey.getParameters();
+    } else {
+      throw new IllegalArgumentException("Unrecognized instance of PublicKey.");
+    }
+    return allowedEcdsaCurves.stream()
+        .anyMatch(
+            curve -> {
+              ECNamedCurveParameterSpec cParams = ECNamedCurveTable.getParameterSpec(curve);
+              return cParams.getN().equals(params.getN())
+                  && cParams.getH().equals(params.getH())
+                  && cParams.getCurve().equals(params.getCurve())
+                  && cParams.getG().equals(params.getG());
+            });
+  }
+
+  private String getViolationDisplayMessage(CertificateViolation certificateViolation) {
+    // Yes, we'd rather do this as an instance method on the CertificateViolation enum itself, but
+    // we can't because we need access to configuration (injected as instance variables) which you
+    // can't get in a static enum context.
+    switch (certificateViolation) {
+      case EXPIRED:
+        return "Certificate is expired.";
+      case NOT_YET_VALID:
+        return "Certificate start date is in the future.";
+      case ALGORITHM_CONSTRAINED:
+        return "Certificate key algorithm must be RSA or ECDSA.";
+      case RSA_KEY_LENGTH_TOO_SHORT:
+        return String.format(
+            "RSA key length is too short; the minimum allowed length is %d bits.",
+            this.minimumRsaKeyLength);
+      case VALIDITY_LENGTH_TOO_LONG:
+        return String.format(
+            "Certificate validity period is too long; it must be less than or equal to %d days.",
+            this.maxValidityLengthSchedule.lastEntry().getValue());
+      case INVALID_ECDSA_CURVE:
+        return String.format(
+            "The ECDSA key must use one of these algorithms: %s", allowedEcdsaCurves);
+      default:
+        throw new IllegalArgumentException(
+            String.format(
+                "Unknown CertificateViolation enum value: %s", certificateViolation.name()));
+    }
+  }
+
+  /**
+   * The type of violation a certificate has based on the certificate requirements
+   * (go/registry-proxy-security).
+   */
+  public enum CertificateViolation {
+    EXPIRED,
+    NOT_YET_VALID,
+    VALIDITY_LENGTH_TOO_LONG,
+    RSA_KEY_LENGTH_TOO_SHORT,
+    ALGORITHM_CONSTRAINED,
+    INVALID_ECDSA_CURVE;
+
+    /**
+     * Gets a suitable end-user-facing display message for this particular certificate violation.
+     *
+     * <p>Note that the {@link CertificateChecker} instance must be passed in because it contains
+     * configuration values (e.g. minimum RSA key length) that go into the error message text.
+     */
+    public String getDisplayMessage(CertificateChecker certificateChecker) {
+      return certificateChecker.getViolationDisplayMessage(this);
+    }
+  }
+}
--- a/core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java
@@ -110,6 +110,7 @@ import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
+import google.registry.persistence.DomainHistoryVKey;
 import google.registry.persistence.VKey;
 import google.registry.tmch.LordnTaskUtils;
 import java.util.Optional;
@@ -371,7 +372,7 @@ public class DomainCreateFlow implements TransactionalFlow {
        && TokenType.SINGLE_USE.equals(allocationToken.get().getTokenType())) {
      entitiesToSave.add(
          allocationTokenFlowUtils.redeemToken(
-              allocationToken.get(), HistoryEntry.createVKey(Key.create(historyEntry))));
+              allocationToken.get(), DomainHistoryVKey.create(Key.create(historyEntry))));
    }
    enqueueTasks(newDomain, hasSignedMarks, hasClaimsNotice);

--- a/core/src/main/java/google/registry/flows/domain/DomainRestoreRequestFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainRestoreRequestFlow.java
@@ -173,7 +173,7 @@ public final class DomainRestoreRequestFlow implements TransactionalFlow  {
            existingDomain, newExpirationTime, autorenewEvent, autorenewPollMessage, now, clientId);
    updateForeignKeyIndexDeletionTime(newDomain);
    entitiesToSave.add(newDomain, historyEntry, autorenewEvent, autorenewPollMessage);
-    tm().saveNewOrUpdateAll(entitiesToSave.build());
+    tm().putAll(entitiesToSave.build());
    tm().delete(existingDomain.getDeletePollMessage());
    dnsQueue.addDomainRefreshTask(existingDomain.getDomainName());
    return responseBuilder
--- a/core/src/main/java/google/registry/flows/domain/DomainUpdateFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainUpdateFlow.java
@@ -67,6 +67,7 @@ import google.registry.model.domain.DomainCommand.Update.AddRemove;
 import google.registry.model.domain.DomainCommand.Update.Change;
 import google.registry.model.domain.fee.FeeUpdateCommandExtension;
 import google.registry.model.domain.metadata.MetadataExtension;
+import google.registry.model.domain.secdns.DelegationSignerData;
 import google.registry.model.domain.secdns.SecDnsUpdateExtension;
 import google.registry.model.domain.superuser.DomainUpdateSuperuserExtension;
 import google.registry.model.eppcommon.AuthInfo;
@@ -238,10 +239,16 @@ public final class DomainUpdateFlow implements TransactionalFlow {
    DomainBase.Builder domainBuilder =
        domain
            .asBuilder()
-            // Handle the secDNS extension.
+            // Handle the secDNS extension. As dsData in secDnsUpdate is read from EPP input and
+            // does not have domainRepoId set, we create a copy of the existing dsData without
+            // domainRepoId for comparison.
            .setDsData(
                secDnsUpdate.isPresent()
-                    ? updateDsData(domain.getDsData(), secDnsUpdate.get())
+                    ? updateDsData(
+                        domain.getDsData().stream()
+                            .map(DelegationSignerData::cloneWithoutDomainRepoId)
+                            .collect(toImmutableSet()),
+                        secDnsUpdate.get())
                    : domain.getDsData())
            .setLastEppUpdateTime(now)
            .setLastEppUpdateClientId(clientId)
--- a/core/src/main/java/google/registry/flows/domain/token/AllocationTokenFlowUtils.java
+++ b/core/src/main/java/google/registry/flows/domain/token/AllocationTokenFlowUtils.java
@@ -32,8 +32,7 @@ import google.registry.model.domain.token.AllocationToken;
 import google.registry.model.domain.token.AllocationToken.TokenStatus;
 import google.registry.model.domain.token.AllocationToken.TokenType;
 import google.registry.model.registry.Registry;
-import google.registry.model.reporting.HistoryEntry;
-import google.registry.persistence.VKey;
+import google.registry.persistence.DomainHistoryVKey;
 import java.util.List;
 import java.util.Optional;
 import javax.inject.Inject;
@@ -108,7 +107,7 @@ public class AllocationTokenFlowUtils {

  /** Redeems a SINGLE_USE {@link AllocationToken}, returning the redeemed copy. */
  public AllocationToken redeemToken(
-      AllocationToken token, VKey<HistoryEntry> redemptionHistoryEntry) {
+      AllocationToken token, DomainHistoryVKey redemptionHistoryEntry) {
    checkArgument(
        TokenType.SINGLE_USE.equals(token.getTokenType()),
        "Only SINGLE_USE tokens can be marked as redeemed");
--- a/core/src/main/java/google/registry/flows/host/HostUpdateFlow.java
+++ b/core/src/main/java/google/registry/flows/host/HostUpdateFlow.java
@@ -285,7 +285,7 @@ public final class HostUpdateFlow implements TransactionalFlow {
        && newHost.isSubordinate()
        && Objects.equals(
            existingHost.getSuperordinateDomain(), newHost.getSuperordinateDomain())) {
-      tm().saveNewOrUpdate(
+      tm().put(
              tm().load(existingHost.getSuperordinateDomain())
                  .asBuilder()
                  .removeSubordinateHost(existingHost.getHostName())
@@ -294,14 +294,14 @@ public final class HostUpdateFlow implements TransactionalFlow {
      return;
    }
    if (existingHost.isSubordinate()) {
-      tm().saveNewOrUpdate(
+      tm().put(
              tm().load(existingHost.getSuperordinateDomain())
                  .asBuilder()
                  .removeSubordinateHost(existingHost.getHostName())
                  .build());
    }
    if (newHost.isSubordinate()) {
-      tm().saveNewOrUpdate(
+      tm().put(
              tm().load(newHost.getSuperordinateDomain())
                  .asBuilder()
                  .addSubordinateHost(newHost.getHostName())
--- a/core/src/main/java/google/registry/flows/poll/PollFlowUtils.java
+++ b/core/src/main/java/google/registry/flows/poll/PollFlowUtils.java
@@ -64,7 +64,7 @@ public final class PollFlowUtils {
      // and re-save it for future autorenew poll messages to be delivered. Otherwise, this
      // autorenew poll message has no more events to deliver and should be deleted.
      if (nextEventTime.isBefore(autorenewPollMessage.getAutorenewEndTime())) {
-        tm().saveNewOrUpdate(autorenewPollMessage.asBuilder().setEventTime(nextEventTime).build());
+        tm().put(autorenewPollMessage.asBuilder().setEventTime(nextEventTime).build());
        includeAckedMessageInCount = isBeforeOrAt(nextEventTime, tm().getTransactionTime());
      } else {
        tm().delete(autorenewPollMessage.createVKey());
--- a/core/src/main/java/google/registry/idn/Arabic-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Arabic-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Arab
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Armenian-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Armenian-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Armn
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Bengali-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Bengali-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Beng
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Chinese-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Chinese-IDN.txt
@@ -1,24 +1,24 @@
 # Registry: Charleston Road Registry Inc.
-# Script: Chinese
+# Script: zh-Hans
 # Version: 1.0
 # Effective Date: 04-12-2012
 #
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
 # Notes: This table describes codepoints allowed for the Chinese script.

-Reference 0 Unicode 3.2
-Reference 1 A Complete Set of Simplified Chinese Characters
-Reference 2 Chinese Variants Collation Table
-Reference 3 Chinese Big Dictionary
-Reference 4 Chinese Relationship Table for Unihan Project
-Reference 5 GB2312
-Reference 6 General Table for Modern Chinese
-Reference 7 International Chinese Standard Big Dictionary
-Reference 8 Unihan Database
-Reference 9 BIG5
+# Reference 0 Unicode 3.2
+# Reference 1 A Complete Set of Simplified Chinese Characters
+# Reference 2 Chinese Variants Collation Table
+# Reference 3 Chinese Big Dictionary
+# Reference 4 Chinese Relationship Table for Unihan Project
+# Reference 5 GB2312
+# Reference 6 General Table for Modern Chinese
+# Reference 7 International Chinese Standard Big Dictionary
+# Reference 8 Unihan Database
+# Reference 9 BIG5

 U+002D(0);U+002D(0);
 U+0030(0);U+0030(0);
--- a/core/src/main/java/google/registry/idn/Cyrillic-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Cyrillic-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Cyrl
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Devanagari-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Devanagari-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Deva
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Ethiopic-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Ethiopic-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Ethi
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Georgian-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Georgian-IDN.txt
@@ -3,7 +3,7 @@
 #
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Greek-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Greek-IDN.txt
@@ -3,7 +3,7 @@
 # Script: Grek
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Gurmukhi-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Gurmukhi-IDN.txt
@@ -3,7 +3,7 @@
 # Script: Guru
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Hebrew-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Hebrew-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Hebr
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Kannada-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Kannada-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Knda
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Khmer-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Khmer-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Khmr
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 #
 # Telephone: +1 (650) 253-0000
--- a/core/src/main/java/google/registry/idn/Korean-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Korean-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Kore
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Malayalam-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Malayalam-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Mlym
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Myanmar-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Myanmar-IDN.txt
@@ -3,7 +3,7 @@
 # Version: 1.0
 # Effective Date: 04-12-2012
 #
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Oriya-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Oriya-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Orya
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Sinhala-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Sinhala-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Sinh
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Tamil-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Tamil-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Taml
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Telugu-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Telugu-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Telu
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Thai-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Thai-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Thai
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Tibetan-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Tibetan-IDN.txt
@@ -2,7 +2,7 @@
 # Script: Tibt
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
--- a/core/src/main/java/google/registry/idn/Traditional-Chinese-IDN.txt
+++ b/core/src/main/java/google/registry/idn/Traditional-Chinese-IDN.txt
@@ -1,23 +1,23 @@
 # Registry: Charleston Road Registry Inc.
-# Script: Traditional Chinese
+# Script: zh-Hant
 # Version: 1.0
 # Effective Date: 04-12-2012
-# Contact: tas-contact.google.com
+# Contact: iana-contact@google.com
 # Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
 # Telephone: +1 (650) 253-0000
 # Website: www.google.com
 # Notes: This table describes codepoints allowed for the Traditional Chinese script.

-Reference 0 Unicode 3.2
-Reference 1 A Complete Set of Simplified Chinese Characters
-Reference 2 Chinese Variants Collation Table
-Reference 3 Chinese Big Dictionary
-Reference 4 Chinese Relationship Table for Unihan Project
-Reference 5 GB2312
-Reference 6 General Table for Modern Chinese
-Reference 7 International Chinese Standard Big Dictionary
-Reference 8 Unihan Database
-Reference 9 BIG5
+# Reference 0 Unicode 3.2
+# Reference 1 A Complete Set of Simplified Chinese Characters
+# Reference 2 Chinese Variants Collation Table
+# Reference 3 Chinese Big Dictionary
+# Reference 4 Chinese Relationship Table for Unihan Project
+# Reference 5 GB2312
+# Reference 6 General Table for Modern Chinese
+# Reference 7 International Chinese Standard Big Dictionary
+# Reference 8 Unihan Database
+# Reference 9 BIG5

 U+002D(0);U+002D(0);
 U+0030(0);U+0030(0);
--- a/core/src/main/java/google/registry/model/EppResource.java
+++ b/core/src/main/java/google/registry/model/EppResource.java
@@ -24,7 +24,6 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import static google.registry.util.CollectionUtils.nullToEmpty;
 import static google.registry.util.CollectionUtils.nullToEmptyImmutableCopy;
 import static google.registry.util.DateTimeUtils.END_OF_TIME;
-import static java.util.concurrent.TimeUnit.MILLISECONDS;

 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.cache.CacheBuilder;
@@ -62,23 +61,32 @@ public abstract class EppResource extends BackupGroupRoot implements Buildable {
  /**
   * Unique identifier in the registry for this resource.
   *
+   * <p>Not persisted so that we can store these in references to other objects. Subclasses that
+   * wish to use this as the primary key should create a getter method annotated with @Id
+   *
   * <p>This is in the (\w|_){1,80}-\w{1,8} format specified by RFC 5730 for roidType.
   *
   * @see <a href="https://tools.ietf.org/html/rfc5730">RFC 5730</a>
   */
-  @Id
-  // not persisted so that we can store these in references to other objects. Subclasses that wish
-  // to use this as the primary key should create a getter method annotated with @Id
-  @Transient
-  String repoId;
+  @Id @Transient String repoId;

-  /** The ID of the registrar that is currently sponsoring this resource. */
+  /**
+   * The ID of the registrar that is currently sponsoring this resource.
+   *
+   * <p>This can be null in the case of pre-Registry-3.0-migration history objects with null
+   * resource fields.
+   */
  @Index
-  @Column(name = "currentSponsorRegistrarId", nullable = false)
+  @Column(name = "currentSponsorRegistrarId")
  String currentSponsorClientId;

-  /** The ID of the registrar that created this resource. */
-  @Column(name = "creationRegistrarId", nullable = false)
+  /**
+   * The ID of the registrar that created this resource.
+   *
+   * <p>This can be null in the case of pre-Registry-3.0-migration history objects with null
+   * resource fields.
+   */
+  @Column(name = "creationRegistrarId")
  String creationClientId;

  /**
@@ -91,13 +99,17 @@ public abstract class EppResource extends BackupGroupRoot implements Buildable {
  @Column(name = "lastEppUpdateRegistrarId")
  String lastEppUpdateClientId;

-  /** The time when this resource was created. */
-  // Map the method to XML, not the field, because if we map the field (with an adaptor class) it
-  // will never be omitted from the xml even if the timestamp inside creationTime is null and we
-  // return null from the adaptor. (Instead it gets written as an empty tag.)
-  @Column(nullable = false)
-  @Index
-  CreateAutoTimestamp creationTime = CreateAutoTimestamp.create(null);
+  /**
+   * The time when this resource was created.
+   *
+   * <p>Map the method to XML, not the field, because if we map the field (with an adaptor class) it
+   * will never be omitted from the xml even if the timestamp inside creationTime is null and we
+   * return null from the adaptor (instead it gets written as an empty tag).
+   *
+   * <p>This can be null in the case of pre-Registry-3.0-migration history objects with null
+   * resource fields.
+   */
+  @Index CreateAutoTimestamp creationTime = CreateAutoTimestamp.create(null);

  /**
   * The time when this resource was or will be deleted.
@@ -112,8 +124,7 @@ public abstract class EppResource extends BackupGroupRoot implements Buildable {
   * out of the index at that time, as long as we query for resources whose deletion time is before
   * now.
   */
-  @Index
-  DateTime deletionTime;
+  @Index DateTime deletionTime;

  /**
   * The time that this resource was last updated.
@@ -144,7 +155,7 @@ public abstract class EppResource extends BackupGroupRoot implements Buildable {
    return repoId;
  }

-  // Hibernate needs this to populate the repo ID, but no one else should ever use it
+  /** This method exists solely to satisfy Hibernate. Use {@link Builder} instead. */
  @SuppressWarnings("UnusedMethod")
  private void setRepoId(String repoId) {
    this.repoId = repoId;
@@ -375,7 +386,7 @@ public abstract class EppResource extends BackupGroupRoot implements Buildable {
  private static LoadingCache<VKey<? extends EppResource>, EppResource> createEppResourcesCache(
      Duration expiry) {
    return CacheBuilder.newBuilder()
-        .expireAfterWrite(expiry.getMillis(), MILLISECONDS)
+        .expireAfterWrite(java.time.Duration.ofMillis(expiry.getMillis()))
        .maximumSize(getEppResourceMaxCachedEntries())
        .build(CACHE_LOADER);
  }
--- a/core/src/main/java/google/registry/model/ImmutableObject.java
+++ b/core/src/main/java/google/registry/model/ImmutableObject.java
@@ -61,7 +61,17 @@ public abstract class ImmutableObject implements Cloneable {
  private boolean equalsImmutableObject(ImmutableObject other) {
    return getClass().equals(other.getClass())
        && hashCode() == other.hashCode()
-        && ModelUtils.getFieldValues(this).equals(ModelUtils.getFieldValues(other));
+        && getSignificantFields().equals(other.getSignificantFields());
+  }
+
+  /**
+   * Returns the map of significant fields (fields that we care about for purposes of comparison and
+   * display).
+   *
+   * <p>Isolated into a method so that derived classes can override it.
+   */
+  protected Map<Field, Object> getSignificantFields() {
+    return ModelUtils.getFieldValues(this);
  }

  @Override
@@ -72,7 +82,7 @@ public abstract class ImmutableObject implements Cloneable {
  @Override
  public int hashCode() {
    if (hashCode == null) {
-      hashCode = Arrays.hashCode(ModelUtils.getFieldValues(this).values().toArray());
+      hashCode = Arrays.hashCode(getSignificantFields().values().toArray());
    }
    return hashCode;
  }
@@ -111,7 +121,7 @@ public abstract class ImmutableObject implements Cloneable {
  @Override
  public String toString() {
    NavigableMap<String, Object> sortedFields = new TreeMap<>();
-    for (Entry<Field, Object> entry : ModelUtils.getFieldValues(this).entrySet()) {
+    for (Entry<Field, Object> entry : getSignificantFields().entrySet()) {
      sortedFields.put(entry.getKey().getName(), entry.getValue());
    }
    return toStringHelper(sortedFields);
@@ -121,7 +131,7 @@ public abstract class ImmutableObject implements Cloneable {
  public String toHydratedString() {
    // We can't use ImmutableSortedMap because we need to allow null values.
    NavigableMap<String, Object> sortedFields = new TreeMap<>();
-    for (Entry<Field, Object> entry : ModelUtils.getFieldValues(this).entrySet()) {
+    for (Entry<Field, Object> entry : getSignificantFields().entrySet()) {
      Field field = entry.getKey();
      Object value = entry.getValue();
      sortedFields.put(
@@ -161,7 +171,7 @@ public abstract class ImmutableObject implements Cloneable {
      // LinkedHashMap to preserve field ordering and because ImmutableMap forbids null
      // values.
      Map<String, Object> result = new LinkedHashMap<>();
-      for (Entry<Field, Object> entry : ModelUtils.getFieldValues(o).entrySet()) {
+      for (Entry<Field, Object> entry : ((ImmutableObject) o).getSignificantFields().entrySet()) {
        Field field = entry.getKey();
        if (!field.isAnnotationPresent(IgnoredInDiffableMap.class)) {
          result.put(field.getName(), toMapRecursive(entry.getValue()));
--- a/core/src/main/java/google/registry/model/ModelUtils.java
+++ b/core/src/main/java/google/registry/model/ModelUtils.java
@@ -194,7 +194,7 @@ public class ModelUtils {
   * returned map in its implementation of {@link ImmutableObject#toString} and {@link
   * ImmutableObject#equals}, which work by comparing and printing these maps.
   */
-  static Map<Field, Object> getFieldValues(Object instance) {
+  public static Map<Field, Object> getFieldValues(Object instance) {
    // Don't make this ImmutableMap because field values can be null.
    Map<Field, Object> values = new LinkedHashMap<>();
    for (Field field : getAllFields(instance.getClass()).values()) {
--- a/core/src/main/java/google/registry/model/OteAccountBuilder.java
+++ b/core/src/main/java/google/registry/model/OteAccountBuilder.java
@@ -252,7 +252,8 @@ public final class OteAccountBuilder {
  private void saveAllEntities() {
    tm().assertInTransaction();

-    ImmutableList<Registry> registries = ImmutableList.of(sunriseTld, gaTld, eapTld);
+    // use ImmutableObject instead of Registry so that the Key generation doesn't break
+    ImmutableList<ImmutableObject> registries = ImmutableList.of(sunriseTld, gaTld, eapTld);
    ImmutableList<RegistrarContact> contacts = contactsBuilder.build();

    if (!replaceExisting) {
--- a/core/src/main/java/google/registry/model/OteStats.java
+++ b/core/src/main/java/google/registry/model/OteStats.java
@@ -59,25 +59,11 @@ public class OteStats {

  private OteStats() {}

-  private static final Predicate<EppInput> HAS_CLAIMS_NOTICE =
-      eppInput -> {
-        Optional<LaunchCreateExtension> launchCreate =
-            eppInput.getSingleExtension(LaunchCreateExtension.class);
-        return launchCreate.isPresent() && launchCreate.get().getNotice() != null;
-      };
-
  private static final Predicate<EppInput> HAS_SEC_DNS =
      eppInput ->
          eppInput.getSingleExtension(SecDnsCreateExtension.class).isPresent()
              || eppInput.getSingleExtension(SecDnsUpdateExtension.class).isPresent();

-  private static final Predicate<EppInput> IS_SUNRISE =
-      eppInput -> {
-        Optional<LaunchCreateExtension> launchCreate =
-            eppInput.getSingleExtension(LaunchCreateExtension.class);
-        return launchCreate.isPresent() && !isNullOrEmpty(launchCreate.get().getSignedMarks());
-      };
-
  private static final Predicate<EppInput> IS_IDN =
      eppInput ->
          ((DomainCommand.Create)
@@ -94,6 +80,18 @@ public class OteStats {
                          .getResourceCommand())
                  .getInetAddresses());

+  private static boolean hasClaimsNotice(EppInput eppInput) {
+    Optional<LaunchCreateExtension> launchCreate =
+        eppInput.getSingleExtension(LaunchCreateExtension.class);
+    return launchCreate.isPresent() && launchCreate.get().getNotice() != null;
+  }
+
+  private static boolean isSunrise(EppInput eppInput) {
+    Optional<LaunchCreateExtension> launchCreate =
+        eppInput.getSingleExtension(LaunchCreateExtension.class);
+    return launchCreate.isPresent() && !isNullOrEmpty(launchCreate.get().getSignedMarks());
+  }
+
  /** Enum defining the distinct statistics (types of registrar actions) to record. */
  public enum StatType {
    CONTACT_CREATES(0, equalTo(Type.CONTACT_CREATE)),
@@ -107,8 +105,8 @@ public class OteStats {
    DOMAIN_CREATES(0, equalTo(Type.DOMAIN_CREATE)),
    DOMAIN_CREATES_ASCII(1, equalTo(Type.DOMAIN_CREATE), IS_IDN.negate()),
    DOMAIN_CREATES_IDN(1, equalTo(Type.DOMAIN_CREATE), IS_IDN),
-    DOMAIN_CREATES_START_DATE_SUNRISE(1, equalTo(Type.DOMAIN_CREATE), IS_SUNRISE),
-    DOMAIN_CREATES_WITH_CLAIMS_NOTICE(1, equalTo(Type.DOMAIN_CREATE), HAS_CLAIMS_NOTICE),
+    DOMAIN_CREATES_START_DATE_SUNRISE(1, equalTo(Type.DOMAIN_CREATE), OteStats::isSunrise),
+    DOMAIN_CREATES_WITH_CLAIMS_NOTICE(1, equalTo(Type.DOMAIN_CREATE), OteStats::hasClaimsNotice),
    DOMAIN_CREATES_WITH_FEE(
        1,
        equalTo(Type.DOMAIN_CREATE),
--- a/core/src/main/java/google/registry/model/billing/BillingEvent.java
+++ b/core/src/main/java/google/registry/model/billing/BillingEvent.java
@@ -24,6 +24,7 @@ import static google.registry.util.CollectionUtils.nullToEmptyImmutableCopy;
 import static google.registry.util.DateTimeUtils.END_OF_TIME;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;

+import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Sets;
@@ -33,12 +34,14 @@ import com.googlecode.objectify.annotation.Id;
 import com.googlecode.objectify.annotation.Ignore;
 import com.googlecode.objectify.annotation.IgnoreSave;
 import com.googlecode.objectify.annotation.Index;
+import com.googlecode.objectify.annotation.OnLoad;
 import com.googlecode.objectify.annotation.Parent;
 import com.googlecode.objectify.condition.IfNull;
 import google.registry.model.Buildable;
 import google.registry.model.ImmutableObject;
 import google.registry.model.annotations.ReportedOn;
 import google.registry.model.common.TimeOfYear;
+import google.registry.model.domain.DomainBase;
 import google.registry.model.domain.GracePeriod;
 import google.registry.model.domain.rgp.GracePeriodStatus;
 import google.registry.model.domain.token.AllocationToken;
@@ -46,6 +49,9 @@ import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.transfer.TransferData.TransferServerApproveEntity;
 import google.registry.persistence.VKey;
 import google.registry.persistence.WithLongVKey;
+import google.registry.schema.replay.DatastoreAndSqlEntity;
+import google.registry.schema.replay.DatastoreEntity;
+import google.registry.schema.replay.SqlEntity;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
@@ -56,16 +62,14 @@ import javax.persistence.Column;
 import javax.persistence.Embedded;
 import javax.persistence.EnumType;
 import javax.persistence.Enumerated;
-import javax.persistence.GeneratedValue;
-import javax.persistence.GenerationType;
 import javax.persistence.MappedSuperclass;
+import javax.persistence.PostLoad;
 import javax.persistence.Transient;
 import org.joda.money.Money;
 import org.joda.time.DateTime;

 /** A billable event in a domain's lifecycle. */
@MappedSuperclass
-@WithLongVKey
 public abstract class BillingEvent extends ImmutableObject
    implements Buildable, TransferServerApproveEntity {

@@ -107,10 +111,7 @@ public abstract class BillingEvent extends ImmutableObject
  }

  /** Entity id. */
-  @Id
-  @javax.persistence.Id
-  @GeneratedValue(strategy = GenerationType.IDENTITY)
-  Long id;
+  @Id @javax.persistence.Id Long id;

  @Parent @DoNotHydrate @Transient Key<HistoryEntry> parent;

@@ -120,13 +121,11 @@ public abstract class BillingEvent extends ImmutableObject
  String clientId;

  /** Revision id of the entry in DomainHistory table that ths bill belongs to. */
-  // TODO(shicong): Add foreign key constraint when DomainHistory table is generated
  @Ignore
  @Column(nullable = false)
  Long domainHistoryRevisionId;

  /** ID of the EPP resource that the bill is for. */
-  // TODO(shicong): Add foreign key constraint when we expand DatastoreHelp for Postgresql
  @Ignore
  @Column(nullable = false)
  String domainRepoId;
@@ -148,6 +147,21 @@ public abstract class BillingEvent extends ImmutableObject
  @Nullable
  Set<Flag> flags;

+  @PostLoad
+  void postLoad() {
+    parent =
+        Key.create(
+            Key.create(DomainBase.class, domainRepoId),
+            HistoryEntry.class,
+            domainHistoryRevisionId);
+  }
+
+  @OnLoad
+  void onLoad() {
+    domainHistoryRevisionId = parent.getId();
+    domainRepoId = parent.getParent().getName();
+  }
+
  public String getClientId() {
    return clientId;
  }
@@ -244,7 +258,6 @@ public abstract class BillingEvent extends ImmutableObject
    }

    public B setParent(Key<HistoryEntry> parentKey) {
-      // TODO(shicong): Figure out how to set domainHistoryRevisionId and domainRepoId
      getInstance().parent = parentKey;
      return thisCastToDerived();
    }
@@ -257,6 +270,11 @@ public abstract class BillingEvent extends ImmutableObject
      checkNotNull(instance.eventTime, "Event time must be set");
      checkNotNull(instance.targetId, "Target ID must be set");
      checkNotNull(instance.parent, "Parent must be set");
+      checkNotNull(instance.parent.getParent(), "parent.getParent() must be set");
+      checkNotNull(
+          instance.parent.getParent().getName(), "parent.getParent().getName() must be set");
+      instance.domainHistoryRevisionId = instance.parent.getId();
+      instance.domainRepoId = instance.parent.getParent().getName();
      return super.build();
    }
  }
@@ -271,10 +289,11 @@ public abstract class BillingEvent extends ImmutableObject
        @javax.persistence.Index(columnList = "eventTime"),
        @javax.persistence.Index(columnList = "billingTime"),
        @javax.persistence.Index(columnList = "syntheticCreationTime"),
-        @javax.persistence.Index(columnList = "allocation_token_id")
+        @javax.persistence.Index(columnList = "allocationToken")
      })
  @AttributeOverride(name = "id", column = @Column(name = "billing_event_id"))
-  public static class OneTime extends BillingEvent {
+  @WithLongVKey
+  public static class OneTime extends BillingEvent implements DatastoreAndSqlEntity {

    /** The billable value. */
    @AttributeOverrides({
@@ -309,14 +328,11 @@ public abstract class BillingEvent extends ImmutableObject
     * Cancellation}s.
     */
    @Column(name = "cancellation_matching_billing_recurrence_id")
-    VKey<? extends BillingEvent> cancellationMatchingBillingEvent;
+    VKey<Recurring> cancellationMatchingBillingEvent;

    /**
     * The {@link AllocationToken} used in the creation of this event, or null if one was not used.
-     *
-     * <p>TODO(shicong): Add foreign key constraint when AllocationToken schema is generated
     */
-    @Column(name = "allocation_token_id")
    @Index
    @Nullable
    VKey<AllocationToken> allocationToken;
@@ -391,7 +407,7 @@ public abstract class BillingEvent extends ImmutableObject
      }

      public Builder setCancellationMatchingBillingEvent(
-          VKey<? extends BillingEvent> cancellationMatchingBillingEvent) {
+          VKey<Recurring> cancellationMatchingBillingEvent) {
        getInstance().cancellationMatchingBillingEvent = cancellationMatchingBillingEvent;
        return this;
      }
@@ -450,7 +466,8 @@ public abstract class BillingEvent extends ImmutableObject
        @javax.persistence.Index(columnList = "recurrence_time_of_year")
      })
  @AttributeOverride(name = "id", column = @Column(name = "billing_recurrence_id"))
-  public static class Recurring extends BillingEvent {
+  @WithLongVKey
+  public static class Recurring extends BillingEvent implements DatastoreAndSqlEntity {

    /**
     * The billing event recurs every year between {@link #eventTime} and this time on the
@@ -544,7 +561,8 @@ public abstract class BillingEvent extends ImmutableObject
        @javax.persistence.Index(columnList = "billingTime")
      })
  @AttributeOverride(name = "id", column = @Column(name = "billing_cancellation_id"))
-  public static class Cancellation extends BillingEvent {
+  @WithLongVKey
+  public static class Cancellation extends BillingEvent implements DatastoreAndSqlEntity {

    /** The billing time of the charge that is being cancelled. */
    @Index
@@ -664,7 +682,8 @@ public abstract class BillingEvent extends ImmutableObject
  /** An event representing a modification of an existing one-time billing event. */
  @ReportedOn
  @Entity
-  public static class Modification extends BillingEvent {
+  @WithLongVKey
+  public static class Modification extends BillingEvent implements DatastoreEntity {

    /** The change in cost that should be applied to the original billing event. */
    Money cost;
@@ -726,6 +745,11 @@ public abstract class BillingEvent extends ImmutableObject
          .build();
    }

+    @Override
+    public ImmutableList<SqlEntity> toSqlEntities() {
+      return ImmutableList.of(); // not persisted in SQL
+    }
+
    /** A builder for {@link Modification} since it is immutable. */
    public static class Builder extends BillingEvent.Builder<Modification, Builder> {

--- a/core/src/main/java/google/registry/model/common/CrossTldSingleton.java
+++ b/core/src/main/java/google/registry/model/common/CrossTldSingleton.java
@@ -20,15 +20,16 @@ import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Id;
 import com.googlecode.objectify.annotation.Parent;
 import google.registry.model.ImmutableObject;
+import javax.persistence.MappedSuperclass;
+import javax.persistence.Transient;

 /** A singleton entity in Datastore. */
+@MappedSuperclass
 public abstract class CrossTldSingleton extends ImmutableObject {

-  public static final long SINGLETON_ID = 1;  // There is always exactly one of these.
+  public static final long SINGLETON_ID = 1; // There is always exactly one of these.

-  @Id
-  long id = SINGLETON_ID;
+  @Id @Transient long id = SINGLETON_ID;

-  @Parent
-  Key<EntityGroupRoot> parent = getCrossTldKey();
+  @Transient @Parent Key<EntityGroupRoot> parent = getCrossTldKey();
 }
--- a/Show More
+++ b/Show More