Add replay-testing to DomainDeleteFlowTest (#886 )

* Minor fixes: - Initialize "requestedByRegistrar" to false (it's non-nullable). - Store test entities (registrar, hosts and contacts) in JPA. * Flyway changes * Add ReplayExtension to DomainDeleteFlowTest * Check in latest ER diagrams
Ensure that all relevant Keys can be converted to VKeys (#883 )
2026-05-17 05:11:50 +00:00 · 2020-11-25 11:15:10 -05:00 · 2020-11-24 14:33:06 -05:00 · 2020-11-24 14:32:15 -05:00 · 2020-11-24 11:42:00 -05:00 · 2020-11-23 13:47:27 -05:00
592 changed files with 34871 additions and 5386 deletions
--- a/buildSrc/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/buildSrc/gradle/dependency-locks/annotationProcessor.lockfile
@@ -1,25 +1,28 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto.value:auto-value:1.6.3
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/buildSrc/gradle/dependency-locks/compile.lockfile
+++ b/buildSrc/gradle/dependency-locks/compile.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/compileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/compileClasspath.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/deploy_jar.lockfile
+++ b/buildSrc/gradle/dependency-locks/deploy_jar.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/runtime.lockfile
+++ b/buildSrc/gradle/dependency-locks/runtime.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/testAnnotationProcessor.lockfile
+++ b/buildSrc/gradle/dependency-locks/testAnnotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/buildSrc/gradle/dependency-locks/testCompile.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompile.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -58,7 +58,7 @@ org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -58,7 +58,7 @@ org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/buildSrc/gradle/dependency-locks/testRuntime.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntime.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -58,7 +58,7 @@ org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -58,7 +58,7 @@ org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/common/gradle/dependency-locks/annotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/common/gradle/dependency-locks/compile.lockfile
+++ b/common/gradle/dependency-locks/compile.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/compileClasspath.lockfile
+++ b/common/gradle/dependency-locks/compileClasspath.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/default.lockfile
+++ b/common/gradle/dependency-locks/default.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/deploy_jar.lockfile
+++ b/common/gradle/dependency-locks/deploy_jar.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/errorprone.lockfile
+++ b/common/gradle/dependency-locks/errorprone.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/common/gradle/dependency-locks/runtime.lockfile
+++ b/common/gradle/dependency-locks/runtime.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/testAnnotationProcessor.lockfile
+++ b/common/gradle/dependency-locks/testAnnotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/common/gradle/dependency-locks/testCompile.lockfile
+++ b/common/gradle/dependency-locks/testCompile.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,7 +17,7 @@ joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/common/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,7 +17,7 @@ joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/testRuntime.lockfile
+++ b/common/gradle/dependency-locks/testRuntime.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -18,7 +18,7 @@ joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -18,7 +18,7 @@ joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/testingAnnotationProcessor.lockfile
+++ b/common/gradle/dependency-locks/testingAnnotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/common/gradle/dependency-locks/testingCompile.lockfile
+++ b/common/gradle/dependency-locks/testingCompile.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -16,6 +16,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingCompileClasspath.lockfile
+++ b/common/gradle/dependency-locks/testingCompileClasspath.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -16,6 +16,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingRuntime.lockfile
+++ b/common/gradle/dependency-locks/testingRuntime.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,6 +17,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingRuntimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/testingRuntimeClasspath.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,6 +17,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/src/main/java/google/registry/util/DateTimeUtils.java
+++ b/common/src/main/java/google/registry/util/DateTimeUtils.java
@@ -24,6 +24,7 @@ import java.time.ZonedDateTime;
 import java.util.TimeZone;
 import org.joda.time.DateTime;
 import org.joda.time.DateTimeZone;
+import org.joda.time.LocalDate;

 /** Utilities methods and constants related to Joda {@link DateTime} objects. */
 public class DateTimeUtils {
@@ -108,4 +109,12 @@ public class DateTimeUtils {
        zonedDateTime.toInstant().toEpochMilli(),
        DateTimeZone.forTimeZone(TimeZone.getTimeZone(zonedDateTime.getZone())));
  }
+
+  public static java.sql.Date toSqlDate(LocalDate localDate) {
+    return new java.sql.Date(localDate.toDateTimeAtStartOfDay().getMillis());
+  }
+
+  public static LocalDate toLocalDate(java.sql.Date date) {
+    return new LocalDate(date.getTime(), DateTimeZone.UTC);
+  }
 }
--- a/common/src/main/java/google/registry/util/SystemSleeper.java
+++ b/common/src/main/java/google/registry/util/SystemSleeper.java
@@ -18,7 +18,6 @@ import static com.google.common.base.Preconditions.checkArgument;

 import com.google.common.util.concurrent.Uninterruptibles;
 import java.io.Serializable;
-import java.util.concurrent.TimeUnit;
 import javax.annotation.concurrent.ThreadSafe;
 import javax.inject.Inject;
 import org.joda.time.ReadableDuration;
@@ -41,6 +40,6 @@ public final class SystemSleeper implements Sleeper, Serializable {
  @Override
  public void sleepUninterruptibly(ReadableDuration duration) {
    checkArgument(duration.getMillis() >= 0);
-    Uninterruptibles.sleepUninterruptibly(duration.getMillis(), TimeUnit.MILLISECONDS);
+    Uninterruptibles.sleepUninterruptibly(java.time.Duration.ofMillis(duration.getMillis()));
  }
 }
--- a/common/src/testing/java/google/registry/testing/truth/TruthUtils.java
+++ b/common/src/testing/java/google/registry/testing/truth/TruthUtils.java
@@ -0,0 +1,47 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.testing.truth;
+
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import com.google.common.truth.Truth;
+import javax.annotation.Nullable;
+
+/** Utils class containing helper functions for {@link Truth}. */
+public class TruthUtils {
+
+  /** Asserts that both of the given objects are either null or nonnull. */
+  public static void assertNullnessParity(@Nullable Object thisObj, @Nullable Object thatObj) {
+    if (thisObj == null) {
+      assertWithMessage("Expects both objects are null but thatObj is not null")
+          .that(thatObj)
+          .isNull();
+    } else {
+      assertWithMessage("Expects both objects are not null but thatObj is null")
+          .that(thatObj)
+          .isNotNull();
+    }
+  }
+
+  /** Asserts that both of the given objects are either null or nonnull. */
+  public static void assertNullnessParity(
+      @Nullable Object thisObj, @Nullable Object thatObj, String errorMessage) {
+    if (thisObj == null) {
+      assertWithMessage(errorMessage).that(thatObj).isNull();
+    } else {
+      assertWithMessage(errorMessage).that(thatObj).isNotNull();
+    }
+  }
+}
--- a/config/nom_build.py
+++ b/config/nom_build.py
@@ -300,9 +300,15 @@ def do_pseudo_task(task: str) -> None:
                    f'{root}/db/src/main/resources/sql/schema/'
                    'nomulus.golden.sql')

-        if subprocess.call([f'{root}/gradlew', ':db:test']):
-            print('\033[31mERROR:\033[0m Golden file test failed after '
-                  'copying schema.  Please check your flyway files.')
+        # Rerun :db:test and regenerate the ER diagram (at "warning" log
+        # level so it doesn't generate pages of messaging)
+        if subprocess.call([f'{root}/gradlew', ':db:test', 'devTool',
+                            '--args=-e localhost --log_level=WARNING '
+                            'generate_sql_er_diagram -o '
+                            f'{root}/db/src/main/resources/sql/er_diagram']):
+            print('\033[31mERROR:\033[0m Golden file test or ER diagram '
+                  'generation failed after copying schema.  Please check your '
+                  'flyway files.')
            raise Abort()
    else:
        print(f'\033[31mERROR:\033[0m Unknown task {task}')
@@ -377,6 +383,7 @@ def main(args) -> int:

    # See if there are any special ":nom:" pseudo-tasks specified.
    got_non_pseudo_tasks = False
+    got_pseudo_tasks = False
    for arg in args.non_flag_args[1:]:
        if arg.startswith(':nom:'):
            if got_non_pseudo_tasks:
@@ -388,13 +395,14 @@ def main(args) -> int:
                      'specified prior to all actual gradle tasks.  Aborting.')
                return 1
            do_pseudo_task(arg)
+            got_pseudo_tasks = True
        else:
            got_non_pseudo_tasks = True
    non_flag_args = [
        arg for arg in args.non_flag_args[1:] if not arg.startswith(':nom:')]

    if not non_flag_args:
-        if not got_non_pseudo_tasks:
+        if not got_pseudo_tasks:
            print('\033[33mWARNING:\033[0m No tasks specified.  Not '
                  'doing anything')
        return 0
--- a/config/nom_build_test.py
+++ b/config/nom_build_test.py
@@ -113,7 +113,10 @@ class MyTest(unittest.TestCase):
        nom_build.main(['nom_build', ':nom:generate_golden_file'])
        self.call_mock.assert_has_calls([
            mock.call([GRADLEW, ':db:test']),
-            mock.call([GRADLEW, ':db:test'])
+            mock.call([GRADLEW, ':db:test', 'devTool',
+                       '--args=-e localhost --log_level=WARNING '
+                       'generate_sql_er_diagram -o '
+                       '/tmp/rootdir/db/src/main/resources/sql/er_diagram'])
        ])

    def test_generate_golden_file_nofail(self):
@@ -122,5 +125,3 @@ class MyTest(unittest.TestCase):
        self.call_mock.assert_has_calls([mock.call([GRADLEW, ':db:test'])])

 unittest.main()
-
-
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -171,6 +171,8 @@ dependencies {
  testRuntime files(sourceSets.test.resources.srcDirs)

  compile deps['com.beust:jcommander']
+  compile deps['com.google.api:gax']
+  compile deps['com.google.api.grpc:proto-google-cloud-secretmanager-v1']
  compile deps['com.google.api-client:google-api-client']
  compile deps['com.google.api-client:google-api-client-appengine']
  compile deps['com.google.api-client:google-api-client-servlet']
@@ -196,6 +198,7 @@ dependencies {
  compile deps['com.google.auth:google-auth-library-oauth2-http']
  compile deps['com.google.cloud.sql:jdbc-socket-factory-core']
  runtimeOnly deps['com.google.cloud.sql:postgres-socket-factory']
+  compile deps['com.google.cloud:google-cloud-secretmanager']
  compile deps['com.google.code.gson:gson']
  compile deps['com.google.auto.value:auto-value-annotations']
  compile deps['com.google.code.findbugs:jsr305']
@@ -215,12 +218,15 @@ dependencies {
  compile deps['com.google.oauth-client:google-oauth-client-jetty']
  compile deps['com.google.oauth-client:google-oauth-client-appengine']
  compile deps['com.google.oauth-client:google-oauth-client-servlet']
+  compile deps['com.google.protobuf:protobuf-java']
  compile deps['com.google.re2j:re2j']
  compile deps['com.google.template:soy']
  compile deps['com.googlecode.json-simple:json-simple']
  compile deps['com.jcraft:jsch']
  testCompile deps['com.thoughtworks.qdox:qdox']
+  compile deps['com.zaxxer:HikariCP']
  compile deps['dnsjava:dnsjava']
+  runtime deps['guru.nidi:graphviz-java-all-j2v8']
  testCompile deps['io.github.classgraph:classgraph']
  testRuntime deps['io.github.java-diff-utils:java-diff-utils']
  testCompile deps['javax.annotation:javax.annotation-api']
@@ -256,8 +262,10 @@ dependencies {
  testCompile deps['com.fasterxml.jackson.core:jackson-databind']
  runtime deps['org.glassfish.jaxb:jaxb-runtime']
  compile deps['org.hibernate:hibernate-core']
+  compile deps['org.hibernate:hibernate-hikaricp']
  compile deps['org.joda:joda-money']
  compile deps['org.json:json']
+  compile deps['org.jsoup:jsoup']
  testCompile deps['org.mortbay.jetty:jetty']
  compile deps['org.postgresql:postgresql']
  testCompile deps['org.seleniumhq.selenium:selenium-api']
@@ -271,7 +279,9 @@ dependencies {
  testCompile deps['org.testcontainers:selenium']
  testCompile deps['org.testcontainers:testcontainers']
  compile deps['us.fatehi:schemacrawler']
+  compile deps['us.fatehi:schemacrawler-api']
  compile deps['us.fatehi:schemacrawler-diagram']
+  compile deps['us.fatehi:schemacrawler-tools']
  compile deps['xerces:xmlParserAPIs']
  compile deps['xpp3:xpp3']
  // This dependency must come after javax.mail:mail as it would otherwise
@@ -306,7 +316,6 @@ dependencies {
  testCompile deps['org.hamcrest:hamcrest-all']
  testCompile deps['org.hamcrest:hamcrest-core']
  testCompile deps['org.hamcrest:hamcrest-library']
-  compile deps['org.hibernate:hibernate-hikaricp']
  testCompile deps['junit:junit']
  testCompile deps['org.junit.jupiter:junit-jupiter-api']
  testCompile deps['org.junit.jupiter:junit-jupiter-engine']
--- a/core/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/annotationProcessor.lockfile
@@ -1,8 +1,8 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto.value:auto-value:1.6.3
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
@@ -11,15 +11,15 @@ com.google.dagger:dagger-compiler:2.28
 com.google.dagger:dagger-producers:2.28
 com.google.dagger:dagger-spi:2.28
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotation:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
 com.google.errorprone:error_prone_annotations:2.3.4
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.errorprone:javac-shaded:9-dev-r4023-3
 com.google.googlejavaformat:google-java-format:1.5
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.protobuf:protobuf-java:3.4.0
@@ -30,11 +30,14 @@ javax.inject:javax.inject:1
 javax.persistence:javax.persistence-api:2.2
 net.ltgt.gradle.incap:incap:0.2
 org.checkerframework:checker-compat-qual:2.5.3
-org.checkerframework:checker-qual:2.11.1
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.5.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.jetbrains.kotlin:kotlin-stdlib-common:1.3.61
 org.jetbrains.kotlin:kotlin-stdlib:1.3.61
 org.jetbrains.kotlinx:kotlinx-metadata-jvm:0.1.0
 org.jetbrains:annotations:13.0
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/core/gradle/dependency-locks/compile.lockfile
+++ b/core/gradle/dependency-locks/compile.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +36,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +69,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +84,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +113,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +128,25 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +179,7 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -198,17 +201,17 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -216,16 +219,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -235,7 +239,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -245,7 +249,7 @@ org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/compileClasspath.lockfile
+++ b/core/gradle/dependency-locks/compileClasspath.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -18,7 +18,6 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.30.9
 com.google.api-client:google-api-client-java6:1.30.9
@@ -36,15 +35,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +68,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,22 +83,23 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,7 +112,7 @@ com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
 com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -124,25 +126,25 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -158,7 +160,6 @@ io.netty:netty-transport:4.1.42.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
-io.perfmark:perfmark-api:0.19.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -174,7 +175,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -196,33 +197,33 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -232,7 +233,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -242,7 +243,7 @@ org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/default.lockfile
+++ b/core/gradle/dependency-locks/default.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,23 +89,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -111,8 +118,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -126,25 +133,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -177,7 +187,8 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -198,8 +209,9 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
@@ -207,10 +219,10 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -218,16 +230,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -237,20 +250,23 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
 us.fatehi:schemacrawler-api:16.10.1
--- a/core/gradle/dependency-locks/deploy_jar.lockfile
+++ b/core/gradle/dependency-locks/deploy_jar.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,23 +89,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -111,8 +118,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -126,25 +133,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,8 +208,9 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
@@ -206,26 +218,27 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -235,20 +248,23 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
 us.fatehi:schemacrawler-api:16.10.1
--- a/core/gradle/dependency-locks/errorprone.lockfile
+++ b/core/gradle/dependency-locks/errorprone.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/core/gradle/dependency-locks/nonprodAnnotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/nonprodAnnotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/core/gradle/dependency-locks/nonprodCompile.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompile.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +36,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +69,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +84,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +113,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +128,25 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +179,7 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -198,17 +201,17 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -216,16 +219,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -235,7 +239,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -245,7 +249,7 @@ org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/nonprodCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompileClasspath.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -18,7 +18,6 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.30.9
 com.google.api-client:google-api-client-java6:1.30.9
@@ -36,15 +35,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +68,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,22 +83,23 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,7 +112,7 @@ com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
 com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -124,25 +126,25 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -158,7 +160,6 @@ io.netty:netty-transport:4.1.42.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
-io.perfmark:perfmark-api:0.19.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -175,7 +176,7 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,17 +198,16 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -215,16 +215,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -234,7 +235,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -244,7 +245,7 @@ org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/nonprodRuntime.lockfile
+++ b/core/gradle/dependency-locks/nonprodRuntime.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +88,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +117,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +132,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,8 +208,9 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
@@ -206,10 +218,10 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -217,16 +229,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -236,19 +249,22 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
 us.fatehi:schemacrawler-api:16.10.1
--- a/core/gradle/dependency-locks/nonprodRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/nonprodRuntimeClasspath.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +88,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +117,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +132,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,8 +208,9 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
@@ -206,10 +218,10 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -217,16 +229,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -236,19 +249,22 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
 us.fatehi:schemacrawler-api:16.10.1
--- a/core/gradle/dependency-locks/runtime.lockfile
+++ b/core/gradle/dependency-locks/runtime.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +88,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +117,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +132,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,8 +208,9 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
@@ -206,10 +218,10 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -217,16 +229,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -236,19 +249,22 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
 us.fatehi:schemacrawler-api:16.10.1
--- a/core/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,23 +89,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -111,8 +118,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -126,25 +133,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,8 +208,9 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
@@ -206,26 +218,27 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -235,20 +248,23 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
 us.fatehi:schemacrawler-api:16.10.1
--- a/core/gradle/dependency-locks/testAnnotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/testAnnotationProcessor.lockfile
@@ -1,8 +1,8 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto.value:auto-value:1.6.3
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
@@ -11,15 +11,15 @@ com.google.dagger:dagger-compiler:2.28
 com.google.dagger:dagger-producers:2.28
 com.google.dagger:dagger-spi:2.28
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotation:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
 com.google.errorprone:error_prone_annotations:2.3.4
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.errorprone:javac-shaded:9-dev-r4023-3
 com.google.googlejavaformat:google-java-format:1.5
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.protobuf:protobuf-java:3.4.0
@@ -30,11 +30,14 @@ javax.inject:javax.inject:1
 javax.persistence:javax.persistence-api:2.2
 net.ltgt.gradle.incap:incap:0.2
 org.checkerframework:checker-compat-qual:2.5.3
-org.checkerframework:checker-qual:2.11.1
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.5.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.jetbrains.kotlin:kotlin-stdlib-common:1.3.61
 org.jetbrains.kotlin:kotlin-stdlib:1.3.61
 org.jetbrains.kotlinx:kotlinx-metadata-jvm:0.1.0
 org.jetbrains:annotations:13.0
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/core/gradle/dependency-locks/testCompile.lockfile
+++ b/core/gradle/dependency-locks/testCompile.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.11.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +36,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -68,9 +70,9 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,24 +85,25 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:29.0-jre
-com.google.guava:guava:29.0-jre
+com.google.guava:guava-testlib:30.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -113,8 +116,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -133,25 +136,25 @@ com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -185,7 +188,7 @@ jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.13
 net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -212,7 +215,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.apache.mina:mina-core:2.0.4
@@ -225,10 +228,10 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -238,16 +241,17 @@ org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
 org.junit.jupiter:junit-jupiter-api:5.6.2
 org.junit.jupiter:junit-jupiter-engine:5.6.2
@@ -271,7 +275,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -293,7 +297,7 @@ org.testcontainers:junit-jupiter:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:selenium:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.11.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -18,7 +18,6 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.30.9
 com.google.api-client:google-api-client-java6:1.30.9
@@ -36,15 +35,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -68,9 +69,9 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,23 +84,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:29.0-jre
-com.google.guava:guava:29.0-jre
+com.google.guava:guava-testlib:30.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -113,7 +115,7 @@ com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
 com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -132,25 +134,25 @@ com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -166,7 +168,6 @@ io.netty:netty-transport:4.1.42.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
-io.perfmark:perfmark-api:0.19.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -184,7 +185,7 @@ jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.13
 net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -211,7 +212,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.apache.mina:mina-core:2.0.4
@@ -224,10 +225,9 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -237,16 +237,17 @@ org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
 org.junit.jupiter:junit-jupiter-api:5.6.2
 org.junit.jupiter:junit-jupiter-engine:5.6.2
@@ -270,7 +271,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -292,7 +293,7 @@ org.testcontainers:junit-jupiter:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:selenium:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/testRuntime.lockfile
+++ b/core/gradle/dependency-locks/testRuntime.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.11.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -68,9 +74,9 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -84,24 +90,25 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:29.0-jre
-com.google.guava:guava:29.0-jre
+com.google.guava:guava-testlib:30.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -114,8 +121,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -134,26 +141,29 @@ com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.github.java-diff-utils:java-diff-utils:4.0
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -186,8 +196,9 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.13
+net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -214,7 +225,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
@@ -228,10 +239,10 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -242,16 +253,17 @@ org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
 org.junit.jupiter:junit-jupiter-api:5.6.2
 org.junit.jupiter:junit-jupiter-engine:5.6.2
@@ -275,7 +287,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -290,6 +302,8 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
@@ -297,9 +311,10 @@ org.testcontainers:junit-jupiter:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:selenium:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
 us.fatehi:schemacrawler-api:16.10.1
--- a/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.11.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -68,9 +74,9 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -84,24 +90,25 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:29.0-jre
-com.google.guava:guava:29.0-jre
+com.google.guava:guava-testlib:30.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -114,8 +121,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -134,26 +141,29 @@ com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.github.java-diff-utils:java-diff-utils:4.0
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -186,8 +196,9 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.13
+net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -214,7 +225,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
@@ -228,10 +239,10 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -242,16 +253,17 @@ org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
 org.junit.jupiter:junit-jupiter-api:5.6.2
 org.junit.jupiter:junit-jupiter-engine:5.6.2
@@ -275,7 +287,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -290,6 +302,8 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
 org.testcontainers:database-commons:1.14.3
@@ -298,9 +312,10 @@ org.testcontainers:junit-jupiter:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:selenium:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
 us.fatehi:schemacrawler-api:16.10.1
--- a/core/src/main/java/google/registry/beam/initsql/InitSqlPipeline.java
+++ b/core/src/main/java/google/registry/beam/initsql/InitSqlPipeline.java
@@ -92,9 +92,8 @@ public class InitSqlPipeline implements Serializable {
   * Datastore kinds to be written to the SQL database before the cleansed version of {@link
   * DomainBase}.
   */
-  // TODO(weiminyu): include Registry.class when it is modeled in JPA.
  private static final ImmutableList<Class<?>> PHASE_ONE_ORDERED =
-      ImmutableList.of(Registrar.class, ContactResource.class);
+      ImmutableList.of(Registry.class, Registrar.class, ContactResource.class);

  /**
   * Datastore kinds to be written to the SQL database after the cleansed version of {@link
--- a/core/src/main/java/google/registry/config/RegistryConfig.java
+++ b/core/src/main/java/google/registry/config/RegistryConfig.java
@@ -16,9 +16,12 @@ package google.registry.config;

 import static com.google.common.base.Suppliers.memoize;
 import static com.google.common.collect.ImmutableList.toImmutableList;
+import static com.google.common.collect.ImmutableSortedMap.toImmutableSortedMap;
 import static google.registry.config.ConfigUtils.makeUrl;
+import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static google.registry.util.ResourceUtils.readResourceUtf8;
 import static java.lang.annotation.RetentionPolicy.RUNTIME;
+import static java.util.Comparator.naturalOrder;

 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Ascii;
@@ -27,6 +30,7 @@ import com.google.common.base.Strings;
 import com.google.common.base.Supplier;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableSortedMap;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.util.TaskQueueUtils;
@@ -46,6 +50,7 @@ import javax.inject.Qualifier;
 import javax.inject.Singleton;
 import javax.mail.internet.AddressException;
 import javax.mail.internet.InternetAddress;
+import org.joda.time.DateTime;
 import org.joda.time.DateTimeConstants;
 import org.joda.time.Duration;

@@ -1345,6 +1350,39 @@ public final class RegistryConfig {
    public static String provideRdapTosStaticUrl(RegistryConfigSettings config) {
      return config.registryPolicy.rdapTosStaticUrl;
    }
+
+    @Provides
+    @Config("maxValidityDaysSchedule")
+    public static ImmutableSortedMap<DateTime, Integer> provideValidityDaysMap(
+        RegistryConfigSettings config) {
+      return config.sslCertificateValidation.maxValidityDaysSchedule.entrySet().stream()
+          .collect(
+              toImmutableSortedMap(
+                  naturalOrder(),
+                  e ->
+                      e.getKey().equals("START_OF_TIME")
+                          ? START_OF_TIME
+                          : DateTime.parse(e.getKey()),
+                  e -> e.getValue()));
+    }
+
+    @Provides
+    @Config("expirationWarningDays")
+    public static int provideDaysToExpiration(RegistryConfigSettings config) {
+      return config.sslCertificateValidation.expirationWarningDays;
+    }
+
+    @Provides
+    @Config("minimumRsaKeyLength")
+    public static int provideMinimumRsaKeyLength(RegistryConfigSettings config) {
+      return config.sslCertificateValidation.minimumRsaKeyLength;
+    }
+
+    @Provides
+    @Config("allowedEcdsaCurves")
+    public static ImmutableSet<String> provideAllowedEcdsaCurves(RegistryConfigSettings config) {
+      return ImmutableSet.copyOf(config.sslCertificateValidation.allowedEcdsaCurves);
+    }
  }

  /** Returns the App Engine project ID, which is based off the environment name. */
--- a/core/src/main/java/google/registry/config/RegistryConfigSettings.java
+++ b/core/src/main/java/google/registry/config/RegistryConfigSettings.java
@@ -15,6 +15,8 @@
 package google.registry.config;

 import java.util.List;
+import java.util.Map;
+import java.util.Set;

 /** The POJO that YAML config files are deserialized into. */
 public class RegistryConfigSettings {
@@ -38,6 +40,7 @@ public class RegistryConfigSettings {
  public Beam beam;
  public Keyring keyring;
  public RegistryTool registryTool;
+  public SslCertificateValidation sslCertificateValidation;

  /** Configuration options that apply to the entire App Engine project. */
  public static class AppEngine {
@@ -218,4 +221,12 @@ public class RegistryConfigSettings {
    public String clientSecret;
    public String username;
  }
+
+  /** Configuration for the certificate checker. */
+  public static class SslCertificateValidation {
+    public Map<String, Integer> maxValidityDaysSchedule;
+    public int expirationWarningDays;
+    public int minimumRsaKeyLength;
+    public Set<String> allowedEcdsaCurves;
+  }
 }
--- a/core/src/main/java/google/registry/config/files/default-config.yaml
+++ b/core/src/main/java/google/registry/config/files/default-config.yaml
@@ -446,3 +446,21 @@ registryTool:
  # OAuth client secret used by the tool.
  clientSecret: YOUR_CLIENT_SECRET
  username: toolusername
+
+# Configuration options for checking SSL certificates.
+sslCertificateValidation:
+  # A map specifying the maximum amount of days the certificate can be valid.
+  # The entry key is the date closest before the date the certificate was issued
+  # and the entry value is the applicable maximum validity days for that certificate.
+  maxValidityDaysSchedule:
+    "START_OF_TIME": 825
+    "2020-09-01T00:00:00Z": 398
+  # The number of days before a certificate expires that indicates the
+  # certificate is nearing expiration and warnings should be sent.
+  expirationWarningDays: 30
+  # The minimum number of bits an RSA key must contain.
+  minimumRsaKeyLength: 2048
+  # The ECDSA curves that are allowed for public keys.
+  allowedEcdsaCurves:
+    - secp256r1
+    - secp384r1
--- a/core/src/main/java/google/registry/flows/certs/CertificateChecker.java
+++ b/core/src/main/java/google/registry/flows/certs/CertificateChecker.java
@@ -12,17 +12,30 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-package google.registry.util;
+package google.registry.flows.certs;

 import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
+import static java.nio.charset.StandardCharsets.UTF_8;

 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedMap;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.util.Clock;
+import google.registry.util.DateTimeUtils;
+import java.io.ByteArrayInputStream;
 import java.security.PublicKey;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
+import java.security.interfaces.ECPublicKey;
 import java.security.interfaces.RSAPublicKey;
 import java.util.Date;
+import java.util.stream.Collectors;
+import javax.inject.Inject;
+import org.bouncycastle.jcajce.provider.asymmetric.util.EC5Util;
+import org.bouncycastle.jce.ECNamedCurveTable;
+import org.bouncycastle.jce.spec.ECNamedCurveParameterSpec;
 import org.joda.time.DateTime;
 import org.joda.time.Days;

@@ -33,6 +46,7 @@ public class CertificateChecker {
  private final int daysToExpiration;
  private final int minimumRsaKeyLength;
  private final Clock clock;
+  private final ImmutableSet<String> allowedEcdsaCurves;

  /**
   * Constructs a CertificateChecker instance with the specified configuration parameters.
@@ -53,24 +67,42 @@ public class CertificateChecker {
   *   );
   * </pre>
   */
-  // TODO(sarahbot): Inject this.
+  @Inject
  public CertificateChecker(
-      ImmutableSortedMap<DateTime, Integer> maxValidityLengthSchedule,
-      int daysToExpiration,
-      int minimumRsaKeyLength,
+      @Config("maxValidityDaysSchedule")
+          ImmutableSortedMap<DateTime, Integer> maxValidityDaysSchedule,
+      @Config("expirationWarningDays") int expirationWarningDays,
+      @Config("minimumRsaKeyLength") int minimumRsaKeyLength,
+      @Config("allowedEcdsaCurves") ImmutableSet<String> allowedEcdsaCurves,
      Clock clock) {
    checkArgument(
-        maxValidityLengthSchedule.containsKey(START_OF_TIME),
+        maxValidityDaysSchedule.containsKey(START_OF_TIME),
        "Max validity length schedule must contain an entry for START_OF_TIME");
-    this.maxValidityLengthSchedule = maxValidityLengthSchedule;
-    this.daysToExpiration = daysToExpiration;
+    this.maxValidityLengthSchedule = maxValidityDaysSchedule;
+    this.daysToExpiration = expirationWarningDays;
    this.minimumRsaKeyLength = minimumRsaKeyLength;
+    this.allowedEcdsaCurves = allowedEcdsaCurves;
    this.clock = clock;
  }

  /**
-   * Checks a certificate for violations and returns a list of all the violations the certificate
-   * has.
+   * Checks the given certificate string for violations and throws an exception if any violations
+   * exist.
+   */
+  public void validateCertificate(String certificateString) {
+    ImmutableSet<CertificateViolation> violations = checkCertificate(certificateString);
+    if (!violations.isEmpty()) {
+      String displayMessages =
+          violations.stream()
+              .map(violation -> getViolationDisplayMessage(violation))
+              .collect(Collectors.joining("\n"));
+      throw new IllegalArgumentException(displayMessages);
+    }
+  }
+
+  /**
+   * Checks a given certificate for violations and returns a list of all the violations the
+   * certificate has.
   */
  public ImmutableSet<CertificateViolation> checkCertificate(X509Certificate certificate) {
    ImmutableSet.Builder<CertificateViolation> violations = new ImmutableSet.Builder<>();
@@ -98,13 +130,34 @@ public class CertificateChecker {
        violations.add(CertificateViolation.RSA_KEY_LENGTH_TOO_SHORT);
      }
    } else if (key.getAlgorithm().equals("EC")) {
-      // TODO(sarahbot): Add verification of ECDSA curves
+      if (!checkCurveName(key, allowedEcdsaCurves)) {
+        violations.add(CertificateViolation.INVALID_ECDSA_CURVE);
+      }
    } else {
      violations.add(CertificateViolation.ALGORITHM_CONSTRAINED);
    }
    return violations.build();
  }

+  /**
+   * Converts a given string to a certificate and checks it for violations, returning a list of all
+   * the violations the certificate has.
+   */
+  public ImmutableSet<CertificateViolation> checkCertificate(String certificateString) {
+    X509Certificate certificate;
+
+    try {
+      certificate =
+          (X509Certificate)
+              CertificateFactory.getInstance("X509")
+                  .generateCertificate(new ByteArrayInputStream(certificateString.getBytes(UTF_8)));
+    } catch (CertificateException e) {
+      throw new IllegalArgumentException("Unable to read given certificate.");
+    }
+
+    return checkCertificate(certificate);
+  }
+
  /**
   * Returns whether the certificate is nearing expiration.
   *
@@ -127,6 +180,33 @@ public class CertificateChecker {
    return Days.daysBetween(start.withTimeAtStartOfDay(), end.withTimeAtStartOfDay()).getDays();
  }

+  /** Checks if the curve used for a public key is in the list of acceptable curves. */
+  private static boolean checkCurveName(PublicKey key, ImmutableSet<String> allowedEcdsaCurves) {
+    org.bouncycastle.jce.spec.ECParameterSpec params;
+    // These 2 different instances of PublicKey need to be handled separately since their OIDs are
+    // encoded differently. More details on this can be found at
+    // https://stackoverflow.com/questions/49895713/how-to-find-the-matching-curve-name-from-an-ecpublickey.
+    if (key instanceof ECPublicKey) {
+      ECPublicKey ecKey = (ECPublicKey) key;
+      params = EC5Util.convertSpec(ecKey.getParams(), false);
+    } else if (key instanceof org.bouncycastle.jce.interfaces.ECPublicKey) {
+      org.bouncycastle.jce.interfaces.ECPublicKey ecKey =
+          (org.bouncycastle.jce.interfaces.ECPublicKey) key;
+      params = ecKey.getParameters();
+    } else {
+      throw new IllegalArgumentException("Unrecognized instance of PublicKey.");
+    }
+    return allowedEcdsaCurves.stream()
+        .anyMatch(
+            curve -> {
+              ECNamedCurveParameterSpec cParams = ECNamedCurveTable.getParameterSpec(curve);
+              return cParams.getN().equals(params.getN())
+                  && cParams.getH().equals(params.getH())
+                  && cParams.getCurve().equals(params.getCurve())
+                  && cParams.getG().equals(params.getG());
+            });
+  }
+
  private String getViolationDisplayMessage(CertificateViolation certificateViolation) {
    // Yes, we'd rather do this as an instance method on the CertificateViolation enum itself, but
    // we can't because we need access to configuration (injected as instance variables) which you
@@ -146,6 +226,9 @@ public class CertificateChecker {
        return String.format(
            "Certificate validity period is too long; it must be less than or equal to %d days.",
            this.maxValidityLengthSchedule.lastEntry().getValue());
+      case INVALID_ECDSA_CURVE:
+        return String.format(
+            "The ECDSA key must use one of these algorithms: %s", allowedEcdsaCurves);
      default:
        throw new IllegalArgumentException(
            String.format(
@@ -162,7 +245,8 @@ public class CertificateChecker {
    NOT_YET_VALID,
    VALIDITY_LENGTH_TOO_LONG,
    RSA_KEY_LENGTH_TOO_SHORT,
-    ALGORITHM_CONSTRAINED;
+    ALGORITHM_CONSTRAINED,
+    INVALID_ECDSA_CURVE;

    /**
     * Gets a suitable end-user-facing display message for this particular certificate violation.
--- a/core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java
@@ -110,6 +110,7 @@ import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
+import google.registry.persistence.DomainHistoryVKey;
 import google.registry.persistence.VKey;
 import google.registry.tmch.LordnTaskUtils;
 import java.util.Optional;
@@ -371,7 +372,7 @@ public class DomainCreateFlow implements TransactionalFlow {
        && TokenType.SINGLE_USE.equals(allocationToken.get().getTokenType())) {
      entitiesToSave.add(
          allocationTokenFlowUtils.redeemToken(
-              allocationToken.get(), HistoryEntry.createVKey(Key.create(historyEntry))));
+              allocationToken.get(), DomainHistoryVKey.create(Key.create(historyEntry))));
    }
    enqueueTasks(newDomain, hasSignedMarks, hasClaimsNotice);

--- a/core/src/main/java/google/registry/flows/domain/token/AllocationTokenFlowUtils.java
+++ b/core/src/main/java/google/registry/flows/domain/token/AllocationTokenFlowUtils.java
@@ -32,8 +32,7 @@ import google.registry.model.domain.token.AllocationToken;
 import google.registry.model.domain.token.AllocationToken.TokenStatus;
 import google.registry.model.domain.token.AllocationToken.TokenType;
 import google.registry.model.registry.Registry;
-import google.registry.model.reporting.HistoryEntry;
-import google.registry.persistence.VKey;
+import google.registry.persistence.DomainHistoryVKey;
 import java.util.List;
 import java.util.Optional;
 import javax.inject.Inject;
@@ -108,7 +107,7 @@ public class AllocationTokenFlowUtils {

  /** Redeems a SINGLE_USE {@link AllocationToken}, returning the redeemed copy. */
  public AllocationToken redeemToken(
-      AllocationToken token, VKey<HistoryEntry> redemptionHistoryEntry) {
+      AllocationToken token, DomainHistoryVKey redemptionHistoryEntry) {
    checkArgument(
        TokenType.SINGLE_USE.equals(token.getTokenType()),
        "Only SINGLE_USE tokens can be marked as redeemed");
--- a/core/src/main/java/google/registry/model/EppResource.java
+++ b/core/src/main/java/google/registry/model/EppResource.java
@@ -24,7 +24,6 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import static google.registry.util.CollectionUtils.nullToEmpty;
 import static google.registry.util.CollectionUtils.nullToEmptyImmutableCopy;
 import static google.registry.util.DateTimeUtils.END_OF_TIME;
-import static java.util.concurrent.TimeUnit.MILLISECONDS;

 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.cache.CacheBuilder;
@@ -387,7 +386,7 @@ public abstract class EppResource extends BackupGroupRoot implements Buildable {
  private static LoadingCache<VKey<? extends EppResource>, EppResource> createEppResourcesCache(
      Duration expiry) {
    return CacheBuilder.newBuilder()
-        .expireAfterWrite(expiry.getMillis(), MILLISECONDS)
+        .expireAfterWrite(java.time.Duration.ofMillis(expiry.getMillis()))
        .maximumSize(getEppResourceMaxCachedEntries())
        .build(CACHE_LOADER);
  }
--- a/core/src/main/java/google/registry/model/ImmutableObject.java
+++ b/core/src/main/java/google/registry/model/ImmutableObject.java
@@ -61,7 +61,17 @@ public abstract class ImmutableObject implements Cloneable {
  private boolean equalsImmutableObject(ImmutableObject other) {
    return getClass().equals(other.getClass())
        && hashCode() == other.hashCode()
-        && ModelUtils.getFieldValues(this).equals(ModelUtils.getFieldValues(other));
+        && getSignificantFields().equals(other.getSignificantFields());
+  }
+
+  /**
+   * Returns the map of significant fields (fields that we care about for purposes of comparison and
+   * display).
+   *
+   * <p>Isolated into a method so that derived classes can override it.
+   */
+  protected Map<Field, Object> getSignificantFields() {
+    return ModelUtils.getFieldValues(this);
  }

  @Override
@@ -72,7 +82,7 @@ public abstract class ImmutableObject implements Cloneable {
  @Override
  public int hashCode() {
    if (hashCode == null) {
-      hashCode = Arrays.hashCode(ModelUtils.getFieldValues(this).values().toArray());
+      hashCode = Arrays.hashCode(getSignificantFields().values().toArray());
    }
    return hashCode;
  }
@@ -111,7 +121,7 @@ public abstract class ImmutableObject implements Cloneable {
  @Override
  public String toString() {
    NavigableMap<String, Object> sortedFields = new TreeMap<>();
-    for (Entry<Field, Object> entry : ModelUtils.getFieldValues(this).entrySet()) {
+    for (Entry<Field, Object> entry : getSignificantFields().entrySet()) {
      sortedFields.put(entry.getKey().getName(), entry.getValue());
    }
    return toStringHelper(sortedFields);
@@ -121,7 +131,7 @@ public abstract class ImmutableObject implements Cloneable {
  public String toHydratedString() {
    // We can't use ImmutableSortedMap because we need to allow null values.
    NavigableMap<String, Object> sortedFields = new TreeMap<>();
-    for (Entry<Field, Object> entry : ModelUtils.getFieldValues(this).entrySet()) {
+    for (Entry<Field, Object> entry : getSignificantFields().entrySet()) {
      Field field = entry.getKey();
      Object value = entry.getValue();
      sortedFields.put(
@@ -161,7 +171,7 @@ public abstract class ImmutableObject implements Cloneable {
      // LinkedHashMap to preserve field ordering and because ImmutableMap forbids null
      // values.
      Map<String, Object> result = new LinkedHashMap<>();
-      for (Entry<Field, Object> entry : ModelUtils.getFieldValues(o).entrySet()) {
+      for (Entry<Field, Object> entry : ((ImmutableObject) o).getSignificantFields().entrySet()) {
        Field field = entry.getKey();
        if (!field.isAnnotationPresent(IgnoredInDiffableMap.class)) {
          result.put(field.getName(), toMapRecursive(entry.getValue()));
--- a/core/src/main/java/google/registry/model/ModelUtils.java
+++ b/core/src/main/java/google/registry/model/ModelUtils.java
@@ -87,7 +87,7 @@ public class ModelUtils {
              });

  /** Lists all instance fields on an object, including non-public and inherited fields. */
-  static Map<String, Field> getAllFields(Class<?> clazz) {
+  public static Map<String, Field> getAllFields(Class<?> clazz) {
    return ALL_FIELDS_CACHE.getUnchecked(clazz);
  }

@@ -194,7 +194,7 @@ public class ModelUtils {
   * returned map in its implementation of {@link ImmutableObject#toString} and {@link
   * ImmutableObject#equals}, which work by comparing and printing these maps.
   */
-  static Map<Field, Object> getFieldValues(Object instance) {
+  public static Map<Field, Object> getFieldValues(Object instance) {
    // Don't make this ImmutableMap because field values can be null.
    Map<Field, Object> values = new LinkedHashMap<>();
    for (Field field : getAllFields(instance.getClass()).values()) {
--- a/core/src/main/java/google/registry/model/OteStats.java
+++ b/core/src/main/java/google/registry/model/OteStats.java
@@ -59,25 +59,11 @@ public class OteStats {

  private OteStats() {}

-  private static final Predicate<EppInput> HAS_CLAIMS_NOTICE =
-      eppInput -> {
-        Optional<LaunchCreateExtension> launchCreate =
-            eppInput.getSingleExtension(LaunchCreateExtension.class);
-        return launchCreate.isPresent() && launchCreate.get().getNotice() != null;
-      };
-
  private static final Predicate<EppInput> HAS_SEC_DNS =
      eppInput ->
          eppInput.getSingleExtension(SecDnsCreateExtension.class).isPresent()
              || eppInput.getSingleExtension(SecDnsUpdateExtension.class).isPresent();

-  private static final Predicate<EppInput> IS_SUNRISE =
-      eppInput -> {
-        Optional<LaunchCreateExtension> launchCreate =
-            eppInput.getSingleExtension(LaunchCreateExtension.class);
-        return launchCreate.isPresent() && !isNullOrEmpty(launchCreate.get().getSignedMarks());
-      };
-
  private static final Predicate<EppInput> IS_IDN =
      eppInput ->
          ((DomainCommand.Create)
@@ -94,6 +80,18 @@ public class OteStats {
                          .getResourceCommand())
                  .getInetAddresses());

+  private static boolean hasClaimsNotice(EppInput eppInput) {
+    Optional<LaunchCreateExtension> launchCreate =
+        eppInput.getSingleExtension(LaunchCreateExtension.class);
+    return launchCreate.isPresent() && launchCreate.get().getNotice() != null;
+  }
+
+  private static boolean isSunrise(EppInput eppInput) {
+    Optional<LaunchCreateExtension> launchCreate =
+        eppInput.getSingleExtension(LaunchCreateExtension.class);
+    return launchCreate.isPresent() && !isNullOrEmpty(launchCreate.get().getSignedMarks());
+  }
+
  /** Enum defining the distinct statistics (types of registrar actions) to record. */
  public enum StatType {
    CONTACT_CREATES(0, equalTo(Type.CONTACT_CREATE)),
@@ -107,8 +105,8 @@ public class OteStats {
    DOMAIN_CREATES(0, equalTo(Type.DOMAIN_CREATE)),
    DOMAIN_CREATES_ASCII(1, equalTo(Type.DOMAIN_CREATE), IS_IDN.negate()),
    DOMAIN_CREATES_IDN(1, equalTo(Type.DOMAIN_CREATE), IS_IDN),
-    DOMAIN_CREATES_START_DATE_SUNRISE(1, equalTo(Type.DOMAIN_CREATE), IS_SUNRISE),
-    DOMAIN_CREATES_WITH_CLAIMS_NOTICE(1, equalTo(Type.DOMAIN_CREATE), HAS_CLAIMS_NOTICE),
+    DOMAIN_CREATES_START_DATE_SUNRISE(1, equalTo(Type.DOMAIN_CREATE), OteStats::isSunrise),
+    DOMAIN_CREATES_WITH_CLAIMS_NOTICE(1, equalTo(Type.DOMAIN_CREATE), OteStats::hasClaimsNotice),
    DOMAIN_CREATES_WITH_FEE(
        1,
        equalTo(Type.DOMAIN_CREATE),
--- a/core/src/main/java/google/registry/model/billing/BillingEvent.java
+++ b/core/src/main/java/google/registry/model/billing/BillingEvent.java
@@ -49,6 +49,7 @@ import google.registry.model.transfer.TransferData.TransferServerApproveEntity;
 import google.registry.persistence.VKey;
 import google.registry.persistence.WithLongVKey;
 import google.registry.schema.replay.DatastoreAndSqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
@@ -118,13 +119,11 @@ public abstract class BillingEvent extends ImmutableObject
  String clientId;

  /** Revision id of the entry in DomainHistory table that ths bill belongs to. */
-  // TODO(shicong): Add foreign key constraint when DomainHistory table is generated
  @Ignore
  @Column(nullable = false)
  Long domainHistoryRevisionId;

  /** ID of the EPP resource that the bill is for. */
-  // TODO(shicong): Add foreign key constraint when we expand DatastoreHelp for Postgresql
  @Ignore
  @Column(nullable = false)
  String domainRepoId;
@@ -288,7 +287,7 @@ public abstract class BillingEvent extends ImmutableObject
        @javax.persistence.Index(columnList = "eventTime"),
        @javax.persistence.Index(columnList = "billingTime"),
        @javax.persistence.Index(columnList = "syntheticCreationTime"),
-        @javax.persistence.Index(columnList = "allocation_token_id")
+        @javax.persistence.Index(columnList = "allocationToken")
      })
  @AttributeOverride(name = "id", column = @Column(name = "billing_event_id"))
  @WithLongVKey
@@ -331,10 +330,7 @@ public abstract class BillingEvent extends ImmutableObject

    /**
     * The {@link AllocationToken} used in the creation of this event, or null if one was not used.
-     *
-     * <p>TODO(shicong): Add foreign key constraint when AllocationToken schema is generated
     */
-    @Column(name = "allocation_token_id")
    @Index
    @Nullable
    VKey<AllocationToken> allocationToken;
@@ -685,7 +681,7 @@ public abstract class BillingEvent extends ImmutableObject
  @ReportedOn
  @Entity
  @WithLongVKey
-  public static class Modification extends BillingEvent implements DatastoreAndSqlEntity {
+  public static class Modification extends BillingEvent implements DatastoreOnlyEntity {

    /** The change in cost that should be applied to the original billing event. */
    Money cost;
--- a/core/src/main/java/google/registry/model/common/CrossTldSingleton.java
+++ b/core/src/main/java/google/registry/model/common/CrossTldSingleton.java
@@ -20,15 +20,16 @@ import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Id;
 import com.googlecode.objectify.annotation.Parent;
 import google.registry.model.ImmutableObject;
+import javax.persistence.MappedSuperclass;
+import javax.persistence.Transient;

 /** A singleton entity in Datastore. */
+@MappedSuperclass
 public abstract class CrossTldSingleton extends ImmutableObject {

-  public static final long SINGLETON_ID = 1;  // There is always exactly one of these.
+  public static final long SINGLETON_ID = 1; // There is always exactly one of these.

-  @Id
-  long id = SINGLETON_ID;
+  @Id @Transient long id = SINGLETON_ID;

-  @Parent
-  Key<EntityGroupRoot> parent = getCrossTldKey();
+  @Transient @Parent Key<EntityGroupRoot> parent = getCrossTldKey();
 }
--- a/core/src/main/java/google/registry/model/common/Cursor.java
+++ b/core/src/main/java/google/registry/model/common/Cursor.java
@@ -21,7 +21,6 @@ import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;

 import com.google.common.base.Splitter;
-import com.google.common.collect.ImmutableList;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Entity;
 import com.googlecode.objectify.annotation.Id;
@@ -29,8 +28,7 @@ import com.googlecode.objectify.annotation.Parent;
 import google.registry.model.ImmutableObject;
 import google.registry.model.UpdateAutoTimestamp;
 import google.registry.model.registry.Registry;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;
 import java.util.List;
 import org.joda.time.DateTime;

@@ -40,7 +38,7 @@ import org.joda.time.DateTime;
 * scoped on {@link EntityGroupRoot}.
 */
@Entity
-public class Cursor extends ImmutableObject implements DatastoreEntity {
+public class Cursor extends ImmutableObject implements DatastoreOnlyEntity {

  /** The types of cursors, used as the string id field for each cursor in Datastore. */
  public enum CursorType {
@@ -137,11 +135,6 @@ public class Cursor extends ImmutableObject implements DatastoreEntity {
    return CursorType.valueOf(String.join("_", id.subList(1, id.size())));
  }

-  @Override
-  public ImmutableList<SqlEntity> toSqlEntities() {
-    return ImmutableList.of(); // Cursors are not converted since they are ephemeral
-  }
-
  /**
   * Checks that the type of the scoped object (or null) matches the required type for the specified
   * cursor (or null, if the cursor is a global cursor).
--- a/core/src/main/java/google/registry/model/common/EntityGroupRoot.java
+++ b/core/src/main/java/google/registry/model/common/EntityGroupRoot.java
@@ -14,13 +14,11 @@

 package google.registry.model.common;

-import com.google.common.collect.ImmutableList;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Entity;
 import com.googlecode.objectify.annotation.Id;
 import google.registry.model.BackupGroupRoot;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;

 /**
 * The root key for the entity group which is known as the cross-tld entity group for historical
@@ -37,7 +35,7 @@ import google.registry.schema.replay.SqlEntity;
 * entity group for the single namespace where global data applicable for all TLDs lived.
 */
@Entity
-public class EntityGroupRoot extends BackupGroupRoot implements DatastoreEntity {
+public class EntityGroupRoot extends BackupGroupRoot implements DatastoreOnlyEntity {

  @SuppressWarnings("unused")
  @Id
@@ -47,9 +45,4 @@ public class EntityGroupRoot extends BackupGroupRoot implements DatastoreEntity
  public static Key<EntityGroupRoot> getCrossTldKey() {
    return Key.create(EntityGroupRoot.class, "cross-tld");
  }
-
-  @Override
-  public ImmutableList<SqlEntity> toSqlEntities() {
-    return ImmutableList.of(); // not persisted in SQL
-  }
 }
--- a/core/src/main/java/google/registry/model/contact/ContactHistory.java
+++ b/core/src/main/java/google/registry/model/contact/ContactHistory.java
@@ -60,7 +60,9 @@ public class ContactHistory extends HistoryEntry implements SqlEntity {
  @Id
  @Access(AccessType.PROPERTY)
  public String getContactRepoId() {
-    return parent.getName();
+    // We need to handle null case here because Hibernate sometimes accesses this method before
+    // parent gets initialized
+    return parent == null ? null : parent.getName();
  }

  /** This method is private because it is only used by Hibernate. */
@@ -93,9 +95,9 @@ public class ContactHistory extends HistoryEntry implements SqlEntity {
  }

  /** Creates a {@link VKey} instance for this entity. */
+  @SuppressWarnings("unchecked")
  public VKey<ContactHistory> createVKey() {
-    return VKey.create(
-        ContactHistory.class, new ContactHistoryId(getContactRepoId(), getId()), Key.create(this));
+    return (VKey<ContactHistory>) createVKey(Key.create(this));
  }

  @PostLoad
@@ -114,7 +116,7 @@ public class ContactHistory extends HistoryEntry implements SqlEntity {
  }

  /** Class to represent the composite primary key of {@link ContactHistory} entity. */
-  static class ContactHistoryId extends ImmutableObject implements Serializable {
+  public static class ContactHistoryId extends ImmutableObject implements Serializable {

    private String contactRepoId;

@@ -123,7 +125,7 @@ public class ContactHistory extends HistoryEntry implements SqlEntity {
    /** Hibernate requires this default constructor. */
    private ContactHistoryId() {}

-    ContactHistoryId(String contactRepoId, long id) {
+    public ContactHistoryId(String contactRepoId, long id) {
      this.contactRepoId = contactRepoId;
      this.id = id;
    }
--- a/core/src/main/java/google/registry/model/domain/DomainContent.java
+++ b/core/src/main/java/google/registry/model/domain/DomainContent.java
@@ -303,15 +303,17 @@ public class DomainContent extends EppResource
        allContacts.stream().map(DesignatedContact::reconstitute).collect(toImmutableSet());
    setContactFields(allContacts, true);

-    // We have to return the cloned object here because the original object's
-    // hashcode is not correct due to the change to its domainRepoId. The cloned
-    // object will have a null hashcode so that it can get a recalculated hashcode
-    // when its hashCode() is invoked.
+    // We have to return the cloned object here because the original object's hashcode is not
+    // correct due to the change to its domainRepoId and history ids. The cloned object will have a
+    // null hashcode so that it can get a recalculated hashcode when its hashCode() is invoked.
    // TODO(b/162739503): Remove this after fully migrating to Cloud SQL.
    gracePeriods =
        nullToEmptyImmutableCopy(gracePeriods).stream()
-            .map(gracePeriod -> gracePeriod.cloneWithDomainRepoId(getRepoId()))
+            .map(gracePeriod -> gracePeriod.cloneAfterOfyLoad(getRepoId()))
            .collect(toImmutableSet());
+    // TODO(b/169873747): Remove this method after explicitly re-saving all domain entities.
+    // See also: GradePeriod.onLoad.
+    gracePeriods.forEach(GracePeriod::onLoad);

    // Restore history record ids.
    autorenewPollMessageHistoryId = getHistoryId(autorenewPollMessage);
@@ -352,9 +354,13 @@ public class DomainContent extends EppResource
        restoreOfyFrom(myKey, autorenewBillingEvent, autorenewBillingEventHistoryId);
    autorenewPollMessage =
        restoreOfyFrom(myKey, autorenewPollMessage, autorenewPollMessageHistoryId);
+
+    if (transferData != null) {
+      transferData.restoreOfyKeys(myKey);
+    }
  }

-  private <T> VKey<T> restoreOfyFrom(Key<DomainBase> domainKey, VKey<T> key, Long historyId) {
+  public static <T> VKey<T> restoreOfyFrom(Key<DomainBase> domainKey, VKey<T> key, Long historyId) {
    if (historyId == null) {
      // This is a legacy key (or a null key, in which case this works too)
      return VKey.restoreOfyFrom(key, EntityGroupRoot.class, "per-tld");
@@ -716,7 +722,14 @@ public class DomainContent extends EppResource
            + " use DomainBase instead");
  }

-  private static Long getHistoryId(VKey<?> key) {
+  /**
+   * Obtains a history id from the given key.
+   *
+   * <p>The key must be a composite key either of the form domain-key/history-key/long-event-key or
+   * EntityGroupRoot/long-event-key (for legacy keys). In the latter case or for a null key returns
+   * a history id of null.
+   */
+  public static Long getHistoryId(VKey<?> key) {
    if (key == null) {
      return null;
    }
--- a/core/src/main/java/google/registry/model/domain/DomainHistory.java
+++ b/core/src/main/java/google/registry/model/domain/DomainHistory.java
@@ -14,14 +14,18 @@

 package google.registry.model.domain;

+import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.util.CollectionUtils.nullToEmptyImmutableCopy;

 import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.EntitySubclass;
 import com.googlecode.objectify.annotation.Ignore;
 import google.registry.model.ImmutableObject;
 import google.registry.model.domain.DomainHistory.DomainHistoryId;
+import google.registry.model.domain.GracePeriod.GracePeriodHistory;
+import google.registry.model.domain.secdns.DomainDsDataHistory;
 import google.registry.model.host.HostResource;
 import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.HistoryEntry;
@@ -40,10 +44,12 @@ import javax.persistence.CascadeType;
 import javax.persistence.Column;
 import javax.persistence.ElementCollection;
 import javax.persistence.Entity;
+import javax.persistence.FetchType;
 import javax.persistence.Id;
 import javax.persistence.IdClass;
 import javax.persistence.Index;
 import javax.persistence.JoinColumn;
+import javax.persistence.JoinColumns;
 import javax.persistence.JoinTable;
 import javax.persistence.OneToMany;
 import javax.persistence.PostLoad;
@@ -75,7 +81,9 @@ public class DomainHistory extends HistoryEntry implements SqlEntity {
  @Id
  @Access(AccessType.PROPERTY)
  public String getDomainRepoId() {
-    return parent.getName();
+    // We need to handle null case here because Hibernate sometimes accesses this method before
+    // parent gets initialized
+    return parent == null ? null : parent.getName();
  }

  /** This method is private because it is only used by Hibernate. */
@@ -93,16 +101,50 @@ public class DomainHistory extends HistoryEntry implements SqlEntity {
  @Column(name = "host_repo_id")
  Set<VKey<HostResource>> nsHosts;

+  @Ignore
+  @OneToMany(
+      cascade = {CascadeType.ALL},
+      fetch = FetchType.EAGER,
+      orphanRemoval = true)
+  @JoinColumns({
+    @JoinColumn(
+        name = "domainHistoryRevisionId",
+        referencedColumnName = "historyRevisionId",
+        insertable = false,
+        updatable = false),
+    @JoinColumn(
+        name = "domainRepoId",
+        referencedColumnName = "domainRepoId",
+        insertable = false,
+        updatable = false)
+  })
+  Set<DomainDsDataHistory> dsDataHistories = ImmutableSet.of();
+
+  @Ignore
+  @OneToMany(
+      cascade = {CascadeType.ALL},
+      fetch = FetchType.EAGER,
+      orphanRemoval = true)
+  @JoinColumns({
+    @JoinColumn(
+        name = "domainHistoryRevisionId",
+        referencedColumnName = "historyRevisionId",
+        insertable = false,
+        updatable = false),
+    @JoinColumn(
+        name = "domainRepoId",
+        referencedColumnName = "domainRepoId",
+        insertable = false,
+        updatable = false)
+  })
+  Set<GracePeriodHistory> gracePeriodHistories = ImmutableSet.of();
+
  @Override
  @Nullable
  @Access(AccessType.PROPERTY)
  @AttributeOverrides({
-      @AttributeOverride(
-          name = "unit",
-          column = @Column(name = "historyPeriodUnit")),
-      @AttributeOverride(
-          name = "value",
-          column = @Column(name = "historyPeriodValue"))
+    @AttributeOverride(name = "unit", column = @Column(name = "historyPeriodUnit")),
+    @AttributeOverride(name = "value", column = @Column(name = "historyPeriodValue"))
  })
  public Period getPeriod() {
    return super.getPeriod();
@@ -127,14 +169,24 @@ public class DomainHistory extends HistoryEntry implements SqlEntity {
   *
   * <p>This will be empty for any DomainHistory/HistoryEntry generated before this field was added,
   * mid-2017, as well as any action that does not generate billable events (e.g. updates).
+   *
+   * <p>This method is dedicated for Hibernate, external caller should use {@link
+   * #getDomainTransactionRecords()}.
   */
  @Access(AccessType.PROPERTY)
  @OneToMany(cascade = {CascadeType.ALL})
  @JoinColumn(name = "historyRevisionId", referencedColumnName = "historyRevisionId")
  @JoinColumn(name = "domainRepoId", referencedColumnName = "domainRepoId")
-  @Override
-  public Set<DomainTransactionRecord> getDomainTransactionRecords() {
-    return super.getDomainTransactionRecords();
+  @SuppressWarnings("unused")
+  private Set<DomainTransactionRecord> getInternalDomainTransactionRecords() {
+    return domainTransactionRecords;
+  }
+
+  /** Sets the domain transaction records. This method is dedicated for Hibernate. */
+  @SuppressWarnings("unused")
+  private void setInternalDomainTransactionRecords(
+      Set<DomainTransactionRecord> domainTransactionRecords) {
+    this.domainTransactionRecords = domainTransactionRecords;
  }

  @Id
@@ -150,6 +202,11 @@ public class DomainHistory extends HistoryEntry implements SqlEntity {
    return nsHosts;
  }

+  /** Returns the collection of {@link DomainDsDataHistory} instances. */
+  public ImmutableSet<DomainDsDataHistory> getDsDataHistories() {
+    return nullToEmptyImmutableCopy(dsDataHistories);
+  }
+
  /**
   * The values of all the fields on the {@link DomainContent} object after the action represented
   * by this history object was executed.
@@ -165,10 +222,14 @@ public class DomainHistory extends HistoryEntry implements SqlEntity {
    return VKey.create(DomainBase.class, getDomainRepoId());
  }

+  public Set<GracePeriodHistory> getGracePeriodHistories() {
+    return nullToEmptyImmutableCopy(gracePeriodHistories);
+  }
+
  /** Creates a {@link VKey} instance for this entity. */
+  @SuppressWarnings("unchecked")
  public VKey<DomainHistory> createVKey() {
-    return VKey.create(
-        DomainHistory.class, new DomainHistoryId(getDomainRepoId(), getId()), Key.create(this));
+    return (VKey<DomainHistory>) createVKey(Key.create(this));
  }

  @PostLoad
@@ -194,7 +255,7 @@ public class DomainHistory extends HistoryEntry implements SqlEntity {
  }

  /** Class to represent the composite primary key of {@link DomainHistory} entity. */
-  static class DomainHistoryId extends ImmutableObject implements Serializable {
+  public static class DomainHistoryId extends ImmutableObject implements Serializable {

    private String domainRepoId;

@@ -203,7 +264,7 @@ public class DomainHistory extends HistoryEntry implements SqlEntity {
    /** Hibernate requires this default constructor. */
    private DomainHistoryId() {}

-    DomainHistoryId(String domainRepoId, long id) {
+    public DomainHistoryId(String domainRepoId, long id) {
      this.domainRepoId = domainRepoId;
      this.id = id;
    }
@@ -266,9 +327,6 @@ public class DomainHistory extends HistoryEntry implements SqlEntity {

    public Builder setDomainContent(DomainContent domainContent) {
      getInstance().domainContent = domainContent;
-      if (domainContent != null) {
-        getInstance().nsHosts = nullToEmptyImmutableCopy(domainContent.nsHosts);
-      }
      return this;
    }

@@ -276,5 +334,26 @@ public class DomainHistory extends HistoryEntry implements SqlEntity {
      getInstance().parent = Key.create(DomainBase.class, domainRepoId);
      return this;
    }
+
+    @Override
+    public DomainHistory build() {
+      DomainHistory instance = super.build();
+      // TODO(b/171990736): Assert instance.domainContent is not null after database migration.
+      // Note that we cannot assert that instance.domainContent is not null here because this
+      // builder is also used to convert legacy HistoryEntry objects to DomainHistory, when
+      // domainContent is not available.
+      if (instance.domainContent != null) {
+        instance.nsHosts = nullToEmptyImmutableCopy(instance.domainContent.nsHosts);
+        instance.dsDataHistories =
+            nullToEmptyImmutableCopy(instance.domainContent.getDsData()).stream()
+                .map(dsData -> DomainDsDataHistory.createFrom(instance.id, dsData))
+                .collect(toImmutableSet());
+        instance.gracePeriodHistories =
+            nullToEmptyImmutableCopy(instance.domainContent.getGracePeriods()).stream()
+                .map(gracePeriod -> GracePeriodHistory.createFrom(instance.id, gracePeriod))
+                .collect(toImmutableSet());
+      }
+      return instance;
+    }
  }
 }
--- a/core/src/main/java/google/registry/model/domain/GracePeriod.java
+++ b/core/src/main/java/google/registry/model/domain/GracePeriod.java
@@ -17,14 +17,19 @@ package google.registry.model.domain;
 import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;

+import com.google.common.annotations.VisibleForTesting;
 import com.googlecode.objectify.annotation.Embed;
 import google.registry.model.billing.BillingEvent;
 import google.registry.model.billing.BillingEvent.Recurring;
 import google.registry.model.domain.rgp.GracePeriodStatus;
+import google.registry.model.ofy.ObjectifyService;
 import google.registry.persistence.VKey;
 import google.registry.schema.replay.DatastoreAndSqlEntity;
 import javax.annotation.Nullable;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
 import javax.persistence.Entity;
+import javax.persistence.Id;
 import javax.persistence.Index;
 import javax.persistence.Table;
 import org.joda.time.DateTime;
@@ -40,25 +45,47 @@ import org.joda.time.DateTime;
@Table(indexes = @Index(columnList = "domainRepoId"))
 public class GracePeriod extends GracePeriodBase implements DatastoreAndSqlEntity {

+  @Id
+  @Access(AccessType.PROPERTY)
+  @Override
+  public long getGracePeriodId() {
+    return super.getGracePeriodId();
+  }
+
+  // TODO(b/169873747): Remove this method after explicitly re-saving all domain entities.
+  // This method is invoked from DomainContent.load(): Objectify's @OnLoad annotation
+  // apparently does not work on embedded objects inside an entity.
+  // Changing signature to void onLoad(@AlsoLoad("gracePeriodId") Long gracePeriodId)
+  // would not work. Method is not called if gracePeriodId is null.
+  void onLoad() {
+    if (gracePeriodId == null) {
+      gracePeriodId = ObjectifyService.allocateId();
+    }
+  }
+
  private static GracePeriod createInternal(
      GracePeriodStatus type,
      String domainRepoId,
      DateTime expirationTime,
      String clientId,
      @Nullable VKey<BillingEvent.OneTime> billingEventOneTime,
-      @Nullable VKey<BillingEvent.Recurring> billingEventRecurring) {
+      @Nullable VKey<BillingEvent.Recurring> billingEventRecurring,
+      @Nullable Long gracePeriodId) {
    checkArgument((billingEventOneTime == null) || (billingEventRecurring == null),
        "A grace period can have at most one billing event");
    checkArgument(
        (billingEventRecurring != null) == GracePeriodStatus.AUTO_RENEW.equals(type),
        "Recurring billing events must be present on (and only on) autorenew grace periods");
    GracePeriod instance = new GracePeriod();
+    instance.gracePeriodId = gracePeriodId == null ? ObjectifyService.allocateId() : gracePeriodId;
    instance.type = checkArgumentNotNull(type);
    instance.domainRepoId = checkArgumentNotNull(domainRepoId);
    instance.expirationTime = checkArgumentNotNull(expirationTime);
    instance.clientId = checkArgumentNotNull(clientId);
    instance.billingEventOneTime = billingEventOneTime;
+    instance.billingEventOneTimeHistoryId = DomainBase.getHistoryId(billingEventOneTime);
    instance.billingEventRecurring = billingEventRecurring;
+    instance.billingEventRecurringHistoryId = DomainBase.getHistoryId(billingEventRecurring);
    return instance;
  }

@@ -75,7 +102,28 @@ public class GracePeriod extends GracePeriodBase implements DatastoreAndSqlEntit
      DateTime expirationTime,
      String clientId,
      @Nullable VKey<BillingEvent.OneTime> billingEventOneTime) {
-    return createInternal(type, domainRepoId, expirationTime, clientId, billingEventOneTime, null);
+    return createInternal(
+        type, domainRepoId, expirationTime, clientId, billingEventOneTime, null, null);
+  }
+
+  /**
+   * Creates a GracePeriod for an (optional) OneTime billing event and a given {@link
+   * #gracePeriodId}.
+   *
+   * <p>Normal callers should always use {@link #forBillingEvent} instead, assuming they do not need
+   * to avoid loading the BillingEvent from Datastore. This method should typically be called only
+   * from test code to explicitly construct GracePeriods.
+   */
+  @VisibleForTesting
+  public static GracePeriod create(
+      GracePeriodStatus type,
+      String domainRepoId,
+      DateTime expirationTime,
+      String clientId,
+      @Nullable VKey<BillingEvent.OneTime> billingEventOneTime,
+      @Nullable Long gracePeriodId) {
+    return createInternal(
+        type, domainRepoId, expirationTime, clientId, billingEventOneTime, null, gracePeriodId);
  }

  /** Creates a GracePeriod for a Recurring billing event. */
@@ -87,13 +135,27 @@ public class GracePeriod extends GracePeriodBase implements DatastoreAndSqlEntit
      VKey<Recurring> billingEventRecurring) {
    checkArgumentNotNull(billingEventRecurring, "billingEventRecurring cannot be null");
    return createInternal(
-        type, domainRepoId, expirationTime, clientId, null, billingEventRecurring);
+        type, domainRepoId, expirationTime, clientId, null, billingEventRecurring, null);
+  }
+
+  /** Creates a GracePeriod for a Recurring billing event and a given {@link #gracePeriodId}. */
+  @VisibleForTesting
+  public static GracePeriod createForRecurring(
+      GracePeriodStatus type,
+      String domainRepoId,
+      DateTime expirationTime,
+      String clientId,
+      VKey<Recurring> billingEventRecurring,
+      @Nullable Long gracePeriodId) {
+    checkArgumentNotNull(billingEventRecurring, "billingEventRecurring cannot be null");
+    return createInternal(
+        type, domainRepoId, expirationTime, clientId, null, billingEventRecurring, gracePeriodId);
  }

  /** Creates a GracePeriod with no billing event. */
  public static GracePeriod createWithoutBillingEvent(
      GracePeriodStatus type, String domainRepoId, DateTime expirationTime, String clientId) {
-    return createInternal(type, domainRepoId, expirationTime, clientId, null, null);
+    return createInternal(type, domainRepoId, expirationTime, clientId, null, null, null);
  }

  /** Constructs a GracePeriod of the given type from the provided one-time BillingEvent. */
@@ -108,14 +170,72 @@ public class GracePeriod extends GracePeriodBase implements DatastoreAndSqlEntit
  }

  /**
-   * Returns a clone of this {@link GracePeriod} with {@link #domainRepoId} set to the given value.
+   * Returns a clone of this {@link GracePeriod} with {@link #domainRepoId} set to the given value
+   * and reconstructed history ids.
   *
   * <p>TODO(b/162739503): Remove this function after fully migrating to Cloud SQL.
   */
-  public GracePeriod cloneWithDomainRepoId(String domainRepoId) {
+  public GracePeriod cloneAfterOfyLoad(String domainRepoId) {
    GracePeriod clone = clone(this);
    clone.domainRepoId = checkArgumentNotNull(domainRepoId);
+    clone.restoreHistoryIds();
    return clone;
  }

+  /**
+   * Returns a clone of this {@link GracePeriod} with {@link #billingEventRecurring} set to the
+   * given value.
+   *
+   * <p>TODO(b/162231099): Remove this function after duplicate id issue is solved.
+   */
+  public GracePeriod cloneWithRecurringBillingEvent(VKey<BillingEvent.Recurring> recurring) {
+    GracePeriod clone = clone(this);
+    clone.billingEventRecurring = recurring;
+    return clone;
+  }
+
+  /**
+   * Returns a clone of this {@link GracePeriod} with prepopulated {@link #gracePeriodId} generated
+   * by {@link ObjectifyService#allocateId()}.
+   *
+   * <p>TODO(shicong): Figure out how to generate the id only when the entity is used for Cloud SQL.
+   */
+  @VisibleForTesting
+  public GracePeriod cloneWithPrepopulatedId() {
+    GracePeriod clone = clone(this);
+    clone.gracePeriodId = ObjectifyService.allocateId();
+    return clone;
+  }
+
+  /** Entity class to represent a historic {@link GracePeriod}. */
+  @Entity(name = "GracePeriodHistory")
+  @Table(indexes = @Index(columnList = "domainRepoId"))
+  static class GracePeriodHistory extends GracePeriodBase {
+    @Id Long gracePeriodHistoryRevisionId;
+
+    /** ID for the associated {@link DomainHistory} entity. */
+    Long domainHistoryRevisionId;
+
+    @Override
+    @Access(AccessType.PROPERTY)
+    public long getGracePeriodId() {
+      return super.getGracePeriodId();
+    }
+
+    static GracePeriodHistory createFrom(long historyRevisionId, GracePeriod gracePeriod) {
+      GracePeriodHistory instance = new GracePeriodHistory();
+      instance.gracePeriodHistoryRevisionId = ObjectifyService.allocateId();
+      instance.domainHistoryRevisionId = historyRevisionId;
+      instance.gracePeriodId = gracePeriod.gracePeriodId;
+      instance.type = gracePeriod.type;
+      instance.domainRepoId = gracePeriod.domainRepoId;
+      instance.expirationTime = gracePeriod.expirationTime;
+      instance.clientId = gracePeriod.clientId;
+      instance.billingEventOneTime = gracePeriod.billingEventOneTime;
+      instance.billingEventOneTimeHistoryId = gracePeriod.billingEventOneTimeHistoryId;
+      instance.billingEventRecurring = gracePeriod.billingEventRecurring;
+      instance.billingEventRecurringHistoryId = gracePeriod.billingEventRecurringHistoryId;
+      return instance;
+    }
+  }
 }
--- a/core/src/main/java/google/registry/model/domain/GracePeriodBase.java
+++ b/core/src/main/java/google/registry/model/domain/GracePeriodBase.java
@@ -14,31 +14,35 @@

 package google.registry.model.domain;

+import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Embed;
 import com.googlecode.objectify.annotation.Ignore;
 import google.registry.model.ImmutableObject;
+import google.registry.model.ModelUtils;
 import google.registry.model.billing.BillingEvent;
 import google.registry.model.billing.BillingEvent.OneTime;
 import google.registry.model.domain.rgp.GracePeriodStatus;
 import google.registry.persistence.VKey;
+import java.lang.reflect.Field;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
 import javax.persistence.Column;
 import javax.persistence.EnumType;
 import javax.persistence.Enumerated;
-import javax.persistence.GeneratedValue;
-import javax.persistence.GenerationType;
 import javax.persistence.MappedSuperclass;
+import javax.persistence.Transient;
 import org.joda.time.DateTime;

 /** Base class containing common fields and methods for {@link GracePeriod}. */
@Embed
@MappedSuperclass
+@Access(AccessType.FIELD)
 public class GracePeriodBase extends ImmutableObject {

  /** Unique id required for hibernate representation. */
-  @javax.persistence.Id
-  @GeneratedValue(strategy = GenerationType.IDENTITY)
-  @Ignore
-  Long id;
+  @Transient Long gracePeriodId;

  /** Repository id for the domain which this grace period belongs to. */
  @Ignore
@@ -67,6 +71,10 @@ public class GracePeriodBase extends ImmutableObject {
  @Column(name = "billing_event_id")
  VKey<OneTime> billingEventOneTime = null;

+  @Ignore
+  @Column(name = "billing_event_history_id")
+  Long billingEventOneTimeHistoryId;
+
  /**
   * The recurring billing event corresponding to the action that triggered this grace period, if
   * applicable - i.e. if the action was an autorenew - or null in all other cases.
@@ -75,6 +83,14 @@ public class GracePeriodBase extends ImmutableObject {
  @Column(name = "billing_recurrence_id")
  VKey<BillingEvent.Recurring> billingEventRecurring = null;

+  @Ignore
+  @Column(name = "billing_recurrence_history_id")
+  Long billingEventRecurringHistoryId;
+
+  public long getGracePeriodId() {
+    return gracePeriodId;
+  }
+
  public GracePeriodStatus getType() {
    return type;
  }
@@ -91,6 +107,12 @@ public class GracePeriodBase extends ImmutableObject {
    return clientId;
  }

+  /** This method is private because it is only used by Hibernate. */
+  @SuppressWarnings("unused")
+  private void setGracePeriodId(long gracePeriodId) {
+    this.gracePeriodId = gracePeriodId;
+  }
+
  /** Returns true if this GracePeriod has an associated BillingEvent; i.e. if it's refundable. */
  public boolean hasBillingEvent() {
    return billingEventOneTime != null || billingEventRecurring != null;
@@ -101,6 +123,7 @@ public class GracePeriodBase extends ImmutableObject {
   * period is not AUTO_RENEW.
   */
  public VKey<BillingEvent.OneTime> getOneTimeBillingEvent() {
+    restoreOfyKeys();
    return billingEventOneTime;
  }

@@ -109,6 +132,63 @@ public class GracePeriodBase extends ImmutableObject {
   * period is AUTO_RENEW.
   */
  public VKey<BillingEvent.Recurring> getRecurringBillingEvent() {
+    restoreOfyKeys();
    return billingEventRecurring;
  }
+
+  /**
+   * Restores history ids for composite VKeys after a load from datastore.
+   *
+   * <p>For use by DomainContent.load() ONLY.
+   */
+  protected void restoreHistoryIds() {
+    billingEventOneTimeHistoryId = DomainBase.getHistoryId(billingEventOneTime);
+    billingEventRecurringHistoryId = DomainBase.getHistoryId(billingEventRecurring);
+  }
+
+  /**
+   * Override {@link ImmutableObject#getSignificantFields()} to exclude "id", which breaks equality
+   * testing in the unit tests.
+   */
+  @Override
+  protected Map<Field, Object> getSignificantFields() {
+    restoreOfyKeys();
+    // Can't use streams or ImmutableMap because we can have null values.
+    Map<Field, Object> result = new LinkedHashMap();
+    for (Map.Entry<Field, Object> entry : ModelUtils.getFieldValues(this).entrySet()) {
+      if (!entry.getKey().getName().equals("id")) {
+        result.put(entry.getKey(), entry.getValue());
+      }
+    }
+    return result;
+  }
+
+  /**
+   * Restores Ofy keys in the billing events.
+   *
+   * <p>This must be called by all methods that access the one time or recurring billing event keys.
+   * When the billing event keys are loaded from SQL, they are loaded as asymmetric keys because the
+   * database columns that we load them from do not contain all of the information necessary to
+   * reconsitute the Ofy side of the key. In other cases, we restore the Ofy key during the
+   * hibernate {@link javax.persistence.PostLoad} method from the other fields of the object, but we
+   * have been unable to make this work with hibernate's internal persistence model in this case
+   * because the {@link GracePeriod}'s hash code is evaluated prior to these calls, and would be
+   * invalidated by changing the fields.
+   */
+  private final synchronized void restoreOfyKeys() {
+    if (billingEventOneTime != null && !billingEventOneTime.maybeGetOfyKey().isPresent()) {
+      billingEventOneTime =
+          DomainBase.restoreOfyFrom(
+              Key.create(DomainBase.class, domainRepoId),
+              billingEventOneTime,
+              billingEventOneTimeHistoryId);
+    }
+    if (billingEventRecurring != null && !billingEventRecurring.maybeGetOfyKey().isPresent()) {
+      billingEventRecurring =
+          DomainBase.restoreOfyFrom(
+              Key.create(DomainBase.class, domainRepoId),
+              billingEventRecurring,
+              billingEventRecurringHistoryId);
+    }
+  }
 }
--- a/core/src/main/java/google/registry/model/domain/secdns/DelegationSignerData.java
+++ b/core/src/main/java/google/registry/model/domain/secdns/DelegationSignerData.java
@@ -17,89 +17,68 @@ package google.registry.model.domain.secdns;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;

 import com.googlecode.objectify.annotation.Embed;
-import com.googlecode.objectify.annotation.Ignore;
 import google.registry.model.ImmutableObject;
-import google.registry.model.domain.secdns.DelegationSignerData.DelegationSignerDataId;
-import google.registry.schema.replay.DatastoreAndSqlEntity;
+import google.registry.model.domain.secdns.DelegationSignerData.DomainDsDataId;
 import java.io.Serializable;
-import javax.persistence.Column;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
 import javax.persistence.Entity;
+import javax.persistence.Id;
 import javax.persistence.IdClass;
 import javax.persistence.Index;
 import javax.persistence.Table;
 import javax.xml.bind.DatatypeConverter;
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlTransient;
 import javax.xml.bind.annotation.XmlType;
-import javax.xml.bind.annotation.adapters.HexBinaryAdapter;
-import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;

 /**
 * Holds the data necessary to construct a single Delegation Signer (DS) record for a domain.
 *
 * @see <a href="http://tools.ietf.org/html/rfc5910">RFC 5910</a>
 * @see <a href="http://tools.ietf.org/html/rfc4034">RFC 4034</a>
+ *     <p>TODO(shicong): Rename this class to DomainDsData.
 */
@Embed
@XmlType(name = "dsData")
@Entity
+@IdClass(DomainDsDataId.class)
@Table(indexes = @Index(columnList = "domainRepoId"))
-@IdClass(DelegationSignerDataId.class)
-public class DelegationSignerData extends ImmutableObject implements DatastoreAndSqlEntity {
+public class DelegationSignerData extends DomainDsDataBase {

  private DelegationSignerData() {}

-  @Ignore @XmlTransient @javax.persistence.Id String domainRepoId;
-
-  /** The identifier for this particular key in the domain. */
-  @javax.persistence.Id
-  @Column(nullable = false)
-  int keyTag;
-
-  /**
-   * The algorithm used by this key.
-   *
-   * @see <a href="http://tools.ietf.org/html/rfc4034#appendix-A.1">RFC 4034 Appendix A.1</a>
-   */
-  @Column(nullable = false)
-  @XmlElement(name = "alg")
-  int algorithm;
-
-  /**
-   * The algorithm used to generate the digest.
-   *
-   * @see <a href="http://tools.ietf.org/html/rfc4034#appendix-A.2">RFC 4034 Appendix A.2</a>
-   */
-  @Column(nullable = false)
-  int digestType;
-
-  /**
-   * The hexBinary digest of the public key.
-   *
-   * @see <a href="http://tools.ietf.org/html/rfc4034#section-5.1.4">RFC 4034 Section 5.1.4</a>
-   */
-  @Column(nullable = false)
-  @XmlJavaTypeAdapter(HexBinaryAdapter.class)
-  byte[] digest;
+  @Override
+  @Id
+  @Access(AccessType.PROPERTY)
+  public String getDomainRepoId() {
+    return super.getDomainRepoId();
+  }

+  @Override
+  @Id
+  @Access(AccessType.PROPERTY)
  public int getKeyTag() {
-    return keyTag;
+    return super.getKeyTag();
  }

+  @Override
+  @Id
+  @Access(AccessType.PROPERTY)
  public int getAlgorithm() {
-    return algorithm;
+    return super.getAlgorithm();
  }

+  @Override
+  @Id
+  @Access(AccessType.PROPERTY)
  public int getDigestType() {
-    return digestType;
+    return super.getDigestType();
  }

+  @Override
+  @Id
+  @Access(AccessType.PROPERTY)
  public byte[] getDigest() {
-    return digest;
-  }
-
-  public String getDigestAsString() {
-    return digest == null ? "" : DatatypeConverter.printHexBinary(digest);
+    return super.getDigest();
  }

  public DelegationSignerData cloneWithDomainRepoId(String domainRepoId) {
@@ -135,30 +114,135 @@ public class DelegationSignerData extends ImmutableObject implements DatastoreAn
    return create(keyTag, algorithm, digestType, DatatypeConverter.parseHexBinary(digestAsHex));
  }

-  /**
-   * Returns the presentation format of this DS record.
-   *
-   * @see <a href="https://tools.ietf.org/html/rfc4034#section-5.3">RFC 4034 Section 5.3</a>
-   */
-  public String toRrData() {
-    return String.format(
-        "%d %d %d %s",
-        this.keyTag, this.algorithm, this.digestType, DatatypeConverter.printHexBinary(digest));
-  }
+  /** Class to represent the composite primary key of {@link DelegationSignerData} entity. */
+  static class DomainDsDataId extends ImmutableObject implements Serializable {

-  static class DelegationSignerDataId extends ImmutableObject implements Serializable {
    String domainRepoId;
+
    int keyTag;

-    private DelegationSignerDataId() {}
+    int algorithm;

-    private DelegationSignerDataId(String domainRepoId, int keyTag) {
+    int digestType;
+
+    byte[] digest;
+
+    /** Hibernate requires this default constructor. */
+    private DomainDsDataId() {}
+
+    /** Constructs a {link DomainDsDataId} instance. */
+    DomainDsDataId(String domainRepoId, int keyTag, int algorithm, int digestType, byte[] digest) {
      this.domainRepoId = domainRepoId;
      this.keyTag = keyTag;
+      this.algorithm = algorithm;
+      this.digestType = digestType;
+      this.digest = digest;
+    }
+
+    /**
+     * Returns the domain repository ID.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private String getDomainRepoId() {
+      return domainRepoId;
+    }
+
+    /**
+     * Returns the key tag.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private int getKeyTag() {
+      return keyTag;
+    }
+
+    /**
+     * Returns the algorithm.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private int getAlgorithm() {
+      return algorithm;
+    }
+
+    /**
+     * Returns the digest type.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private int getDigestType() {
+      return digestType;
+    }
+
+    /**
+     * Returns the digest.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private byte[] getDigest() {
+      return digest;
+    }
+
+    /**
+     * Sets the domain repository ID.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private void setDomainRepoId(String domainRepoId) {
+      this.domainRepoId = domainRepoId;
+    }
+
+    /**
+     * Sets the key tag.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private void setKeyTag(int keyTag) {
+      this.keyTag = keyTag;
    }

-    public static DelegationSignerDataId create(String domainRepoId, int keyTag) {
-      return new DelegationSignerDataId(checkArgumentNotNull(domainRepoId), keyTag);
+    /**
+     * Sets the algorithm.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private void setAlgorithm(int algorithm) {
+      this.algorithm = algorithm;
+    }
+
+    /**
+     * Sets the digest type.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private void setDigestType(int digestType) {
+      this.digestType = digestType;
+    }
+
+    /**
+     * Sets the digest.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private void setDigest(byte[] digest) {
+      this.digest = digest;
+    }
+
+    public static DomainDsDataId create(
+        String domainRepoId, int keyTag, int algorithm, int digestType, byte[] digest) {
+      return new DomainDsDataId(
+          domainRepoId, keyTag, algorithm, digestType, checkArgumentNotNull(digest));
    }
  }
 }
--- a/core/src/main/java/google/registry/model/domain/secdns/DomainDsDataBase.java
+++ b/core/src/main/java/google/registry/model/domain/secdns/DomainDsDataBase.java
@@ -0,0 +1,150 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.domain.secdns;
+
+import com.googlecode.objectify.annotation.Embed;
+import com.googlecode.objectify.annotation.Ignore;
+import google.registry.model.ImmutableObject;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.MappedSuperclass;
+import javax.persistence.Transient;
+import javax.xml.bind.DatatypeConverter;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlTransient;
+import javax.xml.bind.annotation.adapters.HexBinaryAdapter;
+import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
+
+/** Base class for {@link DelegationSignerData} and {@link DomainDsDataHistory}. */
+@Embed
+@MappedSuperclass
+@Access(AccessType.FIELD)
+public abstract class DomainDsDataBase extends ImmutableObject {
+
+  @Ignore @XmlTransient @Transient String domainRepoId;
+
+  /** The identifier for this particular key in the domain. */
+  @Transient int keyTag;
+
+  /**
+   * The algorithm used by this key.
+   *
+   * @see <a href="http://tools.ietf.org/html/rfc4034#appendix-A.1">RFC 4034 Appendix A.1</a>
+   */
+  @Transient
+  @XmlElement(name = "alg")
+  int algorithm;
+
+  /**
+   * The algorithm used to generate the digest.
+   *
+   * @see <a href="http://tools.ietf.org/html/rfc4034#appendix-A.2">RFC 4034 Appendix A.2</a>
+   */
+  @Transient int digestType;
+
+  /**
+   * The hexBinary digest of the public key.
+   *
+   * @see <a href="http://tools.ietf.org/html/rfc4034#section-5.1.4">RFC 4034 Section 5.1.4</a>
+   */
+  @Transient
+  @XmlJavaTypeAdapter(HexBinaryAdapter.class)
+  byte[] digest;
+
+  public String getDomainRepoId() {
+    return domainRepoId;
+  }
+
+  public int getKeyTag() {
+    return keyTag;
+  }
+
+  public int getAlgorithm() {
+    return algorithm;
+  }
+
+  public int getDigestType() {
+    return digestType;
+  }
+
+  public byte[] getDigest() {
+    return digest;
+  }
+
+  /**
+   * Sets the domain repository ID.
+   *
+   * <p>This method is private because it is only used by Hibernate.
+   */
+  @SuppressWarnings("unused")
+  private void setDomainRepoId(String domainRepoId) {
+    this.domainRepoId = domainRepoId;
+  }
+
+  /**
+   * Sets the key tag.
+   *
+   * <p>This method is private because it is only used by Hibernate.
+   */
+  @SuppressWarnings("unused")
+  private void setKeyTag(int keyTag) {
+    this.keyTag = keyTag;
+  }
+
+  /**
+   * Sets the algorithm.
+   *
+   * <p>This method is private because it is only used by Hibernate.
+   */
+  @SuppressWarnings("unused")
+  private void setAlgorithm(int algorithm) {
+    this.algorithm = algorithm;
+  }
+
+  /**
+   * Sets the digest type.
+   *
+   * <p>This method is private because it is only used by Hibernate.
+   */
+  @SuppressWarnings("unused")
+  private void setDigestType(int digestType) {
+    this.digestType = digestType;
+  }
+
+  /**
+   * Sets the digest.
+   *
+   * <p>This method is private because it is only used by Hibernate.
+   */
+  @SuppressWarnings("unused")
+  private void setDigest(byte[] digest) {
+    this.digest = digest;
+  }
+
+  public String getDigestAsString() {
+    return digest == null ? "" : DatatypeConverter.printHexBinary(digest);
+  }
+
+  /**
+   * Returns the presentation format of this DS record.
+   *
+   * @see <a href="https://tools.ietf.org/html/rfc4034#section-5.3">RFC 4034 Section 5.3</a>
+   */
+  public String toRrData() {
+    return String.format(
+        "%d %d %d %s",
+        this.keyTag, this.algorithm, this.digestType, DatatypeConverter.printHexBinary(digest));
+  }
+}
--- a/core/src/main/java/google/registry/model/domain/secdns/DomainDsDataHistory.java
+++ b/core/src/main/java/google/registry/model/domain/secdns/DomainDsDataHistory.java
@@ -0,0 +1,92 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.domain.secdns;
+
+import com.google.common.collect.ImmutableList;
+import google.registry.model.domain.DomainHistory;
+import google.registry.model.ofy.ObjectifyService;
+import google.registry.schema.replay.DatastoreEntity;
+import google.registry.schema.replay.SqlEntity;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+
+/** Entity class to represent a historic {@link DelegationSignerData}. */
+@Entity
+public class DomainDsDataHistory extends DomainDsDataBase implements SqlEntity {
+
+  @Id Long dsDataHistoryRevisionId;
+
+  /** ID of the {@link DomainHistory} entity that this entity is associated with. */
+  @Column(nullable = false)
+  Long domainHistoryRevisionId;
+
+  private DomainDsDataHistory() {}
+
+  /**
+   * Creates a {@link DomainDsDataHistory} instance from given {@link #domainHistoryRevisionId} and
+   * {@link DelegationSignerData} instance.
+   */
+  public static DomainDsDataHistory createFrom(
+      long domainHistoryRevisionId, DelegationSignerData dsData) {
+    DomainDsDataHistory instance = new DomainDsDataHistory();
+    instance.domainHistoryRevisionId = domainHistoryRevisionId;
+    instance.domainRepoId = dsData.domainRepoId;
+    instance.keyTag = dsData.getKeyTag();
+    instance.algorithm = dsData.getAlgorithm();
+    instance.digestType = dsData.getDigestType();
+    instance.digest = dsData.getDigest();
+    instance.dsDataHistoryRevisionId = ObjectifyService.allocateId();
+    return instance;
+  }
+
+  @Override
+  @Access(AccessType.PROPERTY)
+  public String getDomainRepoId() {
+    return super.getDomainRepoId();
+  }
+
+  @Override
+  @Access(AccessType.PROPERTY)
+  public int getKeyTag() {
+    return super.getKeyTag();
+  }
+
+  @Override
+  @Access(AccessType.PROPERTY)
+  public int getAlgorithm() {
+    return super.getAlgorithm();
+  }
+
+  @Override
+  @Access(AccessType.PROPERTY)
+  public int getDigestType() {
+    return super.getDigestType();
+  }
+
+  @Override
+  @Access(AccessType.PROPERTY)
+  @Column(nullable = false)
+  public byte[] getDigest() {
+    return super.getDigest();
+  }
+
+  @Override
+  public ImmutableList<DatastoreEntity> toDatastoreEntities() {
+    return ImmutableList.of(); // not persisted in Datastore
+  }
+}
--- a/core/src/main/java/google/registry/model/domain/token/AllocationToken.java
+++ b/core/src/main/java/google/registry/model/domain/token/AllocationToken.java
@@ -47,12 +47,15 @@ import google.registry.model.common.TimedTransitionProperty;
 import google.registry.model.common.TimedTransitionProperty.TimeMapper;
 import google.registry.model.common.TimedTransitionProperty.TimedTransition;
 import google.registry.model.reporting.HistoryEntry;
+import google.registry.persistence.DomainHistoryVKey;
 import google.registry.persistence.VKey;
 import google.registry.persistence.WithStringVKey;
 import google.registry.schema.replay.DatastoreAndSqlEntity;
 import java.util.Optional;
 import java.util.Set;
 import javax.annotation.Nullable;
+import javax.persistence.AttributeOverride;
+import javax.persistence.AttributeOverrides;
 import javax.persistence.Column;
 import javax.persistence.EnumType;
 import javax.persistence.Enumerated;
@@ -105,7 +108,15 @@ public class AllocationToken extends BackupGroupRoot implements Buildable, Datas
  @javax.persistence.Id @Id String token;

  /** The key of the history entry for which the token was used. Null if not yet used. */
-  @Nullable @Index VKey<HistoryEntry> redemptionHistoryEntry;
+  @Nullable
+  @Index
+  @AttributeOverrides({
+    @AttributeOverride(name = "domainRepoId", column = @Column(name = "redemption_domain_repo_id")),
+    @AttributeOverride(
+        name = "domainHistoryId",
+        column = @Column(name = "redemption_domain_history_id"))
+  })
+  DomainHistoryVKey redemptionHistoryEntry;

  /** The fully-qualified domain name that this token is limited to, if any. */
  @Nullable @Index String domainName;
@@ -280,7 +291,7 @@ public class AllocationToken extends BackupGroupRoot implements Buildable, Datas
      return this;
    }

-    public Builder setRedemptionHistoryEntry(VKey<HistoryEntry> redemptionHistoryEntry) {
+    public Builder setRedemptionHistoryEntry(DomainHistoryVKey redemptionHistoryEntry) {
      getInstance().redemptionHistoryEntry =
          checkArgumentNotNull(redemptionHistoryEntry, "Redemption history entry must not be null");
      return this;
--- a/core/src/main/java/google/registry/model/host/HostHistory.java
+++ b/core/src/main/java/google/registry/model/host/HostHistory.java
@@ -61,7 +61,9 @@ public class HostHistory extends HistoryEntry implements SqlEntity {
  @Id
  @Access(AccessType.PROPERTY)
  public String getHostRepoId() {
-    return parent.getName();
+    // We need to handle null case here because Hibernate sometimes accesses this method before
+    // parent gets initialized
+    return parent == null ? null : parent.getName();
  }

  /** This method is private because it is only used by Hibernate. */
@@ -94,9 +96,9 @@ public class HostHistory extends HistoryEntry implements SqlEntity {
  }

  /** Creates a {@link VKey} instance for this entity. */
+  @SuppressWarnings("unchecked")
  public VKey<HostHistory> createVKey() {
-    return VKey.create(
-        HostHistory.class, new HostHistoryId(getHostRepoId(), getId()), Key.create(this));
+    return (VKey<HostHistory>) createVKey(Key.create(this));
  }

  @PostLoad
@@ -115,7 +117,7 @@ public class HostHistory extends HistoryEntry implements SqlEntity {
  }

  /** Class to represent the composite primary key of {@link HostHistory} entity. */
-  static class HostHistoryId extends ImmutableObject implements Serializable {
+  public static class HostHistoryId extends ImmutableObject implements Serializable {

    private String hostRepoId;

@@ -124,7 +126,7 @@ public class HostHistory extends HistoryEntry implements SqlEntity {
    /** Hibernate requires this default constructor. */
    private HostHistoryId() {}

-    HostHistoryId(String hostRepoId, long id) {
+    public HostHistoryId(String hostRepoId, long id) {
      this.hostRepoId = hostRepoId;
      this.id = id;
    }
--- a/core/src/main/java/google/registry/model/index/EppResourceIndex.java
+++ b/core/src/main/java/google/registry/model/index/EppResourceIndex.java
@@ -17,7 +17,6 @@ package google.registry.model.index;
 import static google.registry.util.TypeUtils.instantiate;

 import com.google.common.annotations.VisibleForTesting;
-import com.google.common.collect.ImmutableList;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Entity;
 import com.googlecode.objectify.annotation.Id;
@@ -26,25 +25,21 @@ import com.googlecode.objectify.annotation.Parent;
 import google.registry.model.BackupGroupRoot;
 import google.registry.model.EppResource;
 import google.registry.model.annotations.ReportedOn;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;

 /** An index that allows for quick enumeration of all EppResource entities (e.g. via map reduce). */
@ReportedOn
@Entity
-public class EppResourceIndex extends BackupGroupRoot implements DatastoreEntity {
+public class EppResourceIndex extends BackupGroupRoot implements DatastoreOnlyEntity {

-  @Id
-  String id;
+  @Id String id;

-  @Parent
-  Key<EppResourceIndexBucket> bucket;
+  @Parent Key<EppResourceIndexBucket> bucket;

  /** Although this field holds a {@link Key} it is named "reference" for historical reasons. */
  Key<? extends EppResource> reference;

-  @Index
-  String kind;
+  @Index String kind;

  public String getId() {
    return id;
@@ -69,7 +64,7 @@ public class EppResourceIndex extends BackupGroupRoot implements DatastoreEntity
    EppResourceIndex instance = instantiate(EppResourceIndex.class);
    instance.reference = resourceKey;
    instance.kind = resourceKey.getKind();
-    instance.id = resourceKey.getString();  // creates a web-safe key string
+    instance.id = resourceKey.getString(); // creates a web-safe key string
    instance.bucket = bucket;
    return instance;
  }
@@ -77,9 +72,4 @@ public class EppResourceIndex extends BackupGroupRoot implements DatastoreEntity
  public static <T extends EppResource> EppResourceIndex create(Key<T> resourceKey) {
    return create(EppResourceIndexBucket.getBucketKey(resourceKey), resourceKey);
  }
-
-  @Override
-  public ImmutableList<SqlEntity> toSqlEntities() {
-    return ImmutableList.of(); // not relevant in SQL
-  }
 }
--- a/core/src/main/java/google/registry/model/index/EppResourceIndexBucket.java
+++ b/core/src/main/java/google/registry/model/index/EppResourceIndexBucket.java
@@ -24,23 +24,17 @@ import com.googlecode.objectify.annotation.Id;
 import google.registry.model.EppResource;
 import google.registry.model.ImmutableObject;
 import google.registry.model.annotations.VirtualEntity;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;

 /** A virtual entity to represent buckets to which EppResourceIndex objects are randomly added. */
@Entity
@VirtualEntity
-public class EppResourceIndexBucket extends ImmutableObject implements DatastoreEntity {
+public class EppResourceIndexBucket extends ImmutableObject implements DatastoreOnlyEntity {

  @SuppressWarnings("unused")
  @Id
  private long bucketId;

-  @Override
-  public ImmutableList<SqlEntity> toSqlEntities() {
-    return ImmutableList.of(); // not relevant in SQL
-  }
-
  /**
   * Deterministic function that returns a bucket id based on the resource's roid.
   * NB: At the moment, nothing depends on this being deterministic, so we have the ability to
--- a/core/src/main/java/google/registry/model/index/ForeignKeyIndex.java
+++ b/core/src/main/java/google/registry/model/index/ForeignKeyIndex.java
@@ -20,7 +20,6 @@ import static google.registry.config.RegistryConfig.getEppResourceMaxCachedEntri
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.TypeUtils.instantiate;
-import static java.util.concurrent.TimeUnit.MILLISECONDS;

 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.cache.CacheBuilder;
@@ -43,8 +42,7 @@ import google.registry.model.contact.ContactResource;
 import google.registry.model.domain.DomainBase;
 import google.registry.model.host.HostResource;
 import google.registry.persistence.VKey;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;
 import google.registry.util.NonFinalForTesting;
 import java.util.Map;
 import java.util.Optional;
@@ -64,34 +62,19 @@ public abstract class ForeignKeyIndex<E extends EppResource> extends BackupGroup
  @ReportedOn
  @Entity
  public static class ForeignKeyContactIndex extends ForeignKeyIndex<ContactResource>
-      implements DatastoreEntity {
-    @Override
-    public ImmutableList<SqlEntity> toSqlEntities() {
-      return ImmutableList.of(); // not relevant in SQL
-    }
-  }
+      implements DatastoreOnlyEntity {}

  /** The {@link ForeignKeyIndex} type for {@link DomainBase} entities. */
  @ReportedOn
  @Entity
  public static class ForeignKeyDomainIndex extends ForeignKeyIndex<DomainBase>
-      implements DatastoreEntity {
-    @Override
-    public ImmutableList<SqlEntity> toSqlEntities() {
-      return ImmutableList.of(); // not relevant in SQL
-    }
-  }
+      implements DatastoreOnlyEntity {}

  /** The {@link ForeignKeyIndex} type for {@link HostResource} entities. */
  @ReportedOn
  @Entity
  public static class ForeignKeyHostIndex extends ForeignKeyIndex<HostResource>
-      implements DatastoreEntity {
-    @Override
-    public ImmutableList<SqlEntity> toSqlEntities() {
-      return ImmutableList.of(); // not relevant in SQL
-    }
-  }
+      implements DatastoreOnlyEntity {}

  static final ImmutableMap<Class<? extends EppResource>, Class<? extends ForeignKeyIndex<?>>>
      RESOURCE_CLASS_TO_FKI_CLASS =
@@ -244,7 +227,7 @@ public abstract class ForeignKeyIndex<E extends EppResource> extends BackupGroup
  private static LoadingCache<Key<ForeignKeyIndex<?>>, Optional<ForeignKeyIndex<?>>>
      createForeignKeyIndexesCache(Duration expiry) {
    return CacheBuilder.newBuilder()
-        .expireAfterWrite(expiry.getMillis(), MILLISECONDS)
+        .expireAfterWrite(java.time.Duration.ofMillis(expiry.getMillis()))
        .maximumSize(getEppResourceMaxCachedEntries())
        .build(CACHE_LOADER);
  }
--- a/core/src/main/java/google/registry/model/ofy/CommitLogBucket.java
+++ b/core/src/main/java/google/registry/model/ofy/CommitLogBucket.java
@@ -22,7 +22,6 @@ import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;

 import com.google.common.collect.ContiguousSet;
-import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedSet;
 import com.google.common.collect.Range;
@@ -34,8 +33,7 @@ import google.registry.model.Buildable;
 import google.registry.model.ImmutableObject;
 import google.registry.model.annotations.NotBackedUp;
 import google.registry.model.annotations.NotBackedUp.Reason;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;
 import google.registry.util.NonFinalForTesting;
 import java.util.Random;
 import java.util.function.Supplier;
@@ -53,7 +51,7 @@ import org.joda.time.DateTime;
 */
@Entity
@NotBackedUp(reason = Reason.COMMIT_LOGS)
-public class CommitLogBucket extends ImmutableObject implements Buildable, DatastoreEntity {
+public class CommitLogBucket extends ImmutableObject implements Buildable, DatastoreOnlyEntity {

  /**
   * Ranges from 1 to {@link RegistryConfig#getCommitLogBucketCount()}, inclusive; starts at 1 since
@@ -72,11 +70,6 @@ public class CommitLogBucket extends ImmutableObject implements Buildable, Datas
    return lastWrittenTime;
  }

-  @Override
-  public ImmutableList<SqlEntity> toSqlEntities() {
-    return ImmutableList.of(); // not persisted in SQL
-  }
-
  /**
   * Returns the key for the specified bucket ID.
   *
--- a/core/src/main/java/google/registry/model/ofy/CommitLogCheckpoint.java
+++ b/core/src/main/java/google/registry/model/ofy/CommitLogCheckpoint.java
@@ -27,8 +27,7 @@ import com.googlecode.objectify.annotation.Parent;
 import google.registry.model.ImmutableObject;
 import google.registry.model.annotations.NotBackedUp;
 import google.registry.model.annotations.NotBackedUp.Reason;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Objects;
@@ -46,7 +45,7 @@ import org.joda.time.DateTime;
 */
@Entity
@NotBackedUp(reason = Reason.COMMIT_LOGS)
-public class CommitLogCheckpoint extends ImmutableObject implements DatastoreEntity {
+public class CommitLogCheckpoint extends ImmutableObject implements DatastoreOnlyEntity {

  /** Shared singleton parent entity for commit log checkpoints. */
  @Parent
@@ -73,11 +72,6 @@ public class CommitLogCheckpoint extends ImmutableObject implements DatastoreEnt
    return builder.build();
  }

-  @Override
-  public ImmutableList<SqlEntity> toSqlEntities() {
-    return ImmutableList.of(); // not persisted in SQL
-  }
-
  /**
   * Creates a CommitLogCheckpoint for the given wall time and bucket checkpoint times, specified as
   * a map from bucket ID to bucket commit timestamp.
--- a/core/src/main/java/google/registry/model/ofy/CommitLogCheckpointRoot.java
+++ b/core/src/main/java/google/registry/model/ofy/CommitLogCheckpointRoot.java
@@ -17,21 +17,19 @@ package google.registry.model.ofy;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;

-import com.google.common.collect.ImmutableList;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Entity;
 import com.googlecode.objectify.annotation.Id;
 import google.registry.model.ImmutableObject;
 import google.registry.model.annotations.NotBackedUp;
 import google.registry.model.annotations.NotBackedUp.Reason;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;
 import org.joda.time.DateTime;

 /** Singleton parent entity for all commit log checkpoints. */
@Entity
@NotBackedUp(reason = Reason.COMMIT_LOGS)
-public class CommitLogCheckpointRoot extends ImmutableObject implements DatastoreEntity {
+public class CommitLogCheckpointRoot extends ImmutableObject implements DatastoreOnlyEntity {

  public static final long SINGLETON_ID = 1;  // There is always exactly one of these.

@@ -50,11 +48,6 @@ public class CommitLogCheckpointRoot extends ImmutableObject implements Datastor
    return lastWrittenTime;
  }

-  @Override
-  public ImmutableList<SqlEntity> toSqlEntities() {
-    return ImmutableList.of(); // not persisted in SQL
-  }
-
  public static CommitLogCheckpointRoot loadRoot() {
    CommitLogCheckpointRoot root = ofy().load().key(getKey()).now();
    return root == null ? new CommitLogCheckpointRoot() : root;
--- a/core/src/main/java/google/registry/model/ofy/CommitLogManifest.java
+++ b/core/src/main/java/google/registry/model/ofy/CommitLogManifest.java
@@ -17,7 +17,6 @@ package google.registry.model.ofy;
 import static google.registry.util.CollectionUtils.nullToEmptyImmutableCopy;
 import static org.joda.time.DateTimeZone.UTC;

-import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Entity;
@@ -26,8 +25,7 @@ import com.googlecode.objectify.annotation.Parent;
 import google.registry.model.ImmutableObject;
 import google.registry.model.annotations.NotBackedUp;
 import google.registry.model.annotations.NotBackedUp.Reason;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;
 import java.util.LinkedHashSet;
 import java.util.Set;
 import org.joda.time.DateTime;
@@ -41,7 +39,7 @@ import org.joda.time.DateTime;
 */
@Entity
@NotBackedUp(reason = Reason.COMMIT_LOGS)
-public class CommitLogManifest extends ImmutableObject implements DatastoreEntity {
+public class CommitLogManifest extends ImmutableObject implements DatastoreOnlyEntity {

  /** Commit log manifests are parented on a random bucket. */
  @Parent
@@ -70,11 +68,6 @@ public class CommitLogManifest extends ImmutableObject implements DatastoreEntit
    return nullToEmptyImmutableCopy(deletions);
  }

-  @Override
-  public ImmutableList<SqlEntity> toSqlEntities() {
-    return ImmutableList.of(); // not persisted in SQL
-  }
-
  public static CommitLogManifest create(
      Key<CommitLogBucket> parent, DateTime commitTime, Set<Key<?>> deletions) {
    CommitLogManifest instance = new CommitLogManifest();
--- a/core/src/main/java/google/registry/model/ofy/CommitLogMutation.java
+++ b/core/src/main/java/google/registry/model/ofy/CommitLogMutation.java
@@ -21,7 +21,6 @@ import static google.registry.model.ofy.ObjectifyService.ofy;

 import com.google.appengine.api.datastore.KeyFactory;
 import com.google.common.annotations.VisibleForTesting;
-import com.google.common.collect.ImmutableList;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Entity;
 import com.googlecode.objectify.annotation.Id;
@@ -29,13 +28,12 @@ import com.googlecode.objectify.annotation.Parent;
 import google.registry.model.ImmutableObject;
 import google.registry.model.annotations.NotBackedUp;
 import google.registry.model.annotations.NotBackedUp.Reason;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;

 /** Representation of a saved entity in a {@link CommitLogManifest} (not deletes). */
@Entity
@NotBackedUp(reason = Reason.COMMIT_LOGS)
-public class CommitLogMutation extends ImmutableObject implements DatastoreEntity {
+public class CommitLogMutation extends ImmutableObject implements DatastoreOnlyEntity {

  /** The manifest this belongs to. */
  @Parent
@@ -61,11 +59,6 @@ public class CommitLogMutation extends ImmutableObject implements DatastoreEntit
    return createFromPbBytes(entityProtoBytes);
  }

-  @Override
-  public ImmutableList<SqlEntity> toSqlEntities() {
-    return ImmutableList.of(); // not persisted in SQL
-  }
-
  /**
   * Returns a new mutation entity created from an @Entity ImmutableObject instance.
   *
--- a/core/src/main/java/google/registry/model/ofy/CommitLoggedWork.java
+++ b/core/src/main/java/google/registry/model/ofy/CommitLoggedWork.java
@@ -161,6 +161,7 @@ class CommitLoggedWork<R> implements Runnable {
          .addAll(untouchedRootsWithTouchedChildren)
          .build())
      .now();
+    ReplayQueue.addInTests(info);
  }

  /** Check that the timestamp of each BackupGroupRoot is in the past. */
--- a/core/src/main/java/google/registry/model/ofy/DatastoreTransactionManager.java
+++ b/core/src/main/java/google/registry/model/ofy/DatastoreTransactionManager.java
@@ -23,7 +23,9 @@ import com.google.common.base.Functions;
 import com.google.common.collect.ImmutableCollection;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.Streams;
 import com.googlecode.objectify.Key;
+import com.googlecode.objectify.Result;
 import google.registry.model.contact.ContactHistory;
 import google.registry.model.host.HostHistory;
 import google.registry.model.reporting.HistoryEntry;
@@ -102,12 +104,22 @@ public class DatastoreTransactionManager implements TransactionManager {

  @Override
  public void insert(Object entity) {
-    saveEntity(entity);
+    put(entity);
  }

  @Override
  public void insertAll(ImmutableCollection<?> entities) {
-    getOfy().save().entities(entities);
+    putAll(entities);
+  }
+
+  @Override
+  public void insertWithoutBackup(Object entity) {
+    putWithoutBackup(entity);
+  }
+
+  @Override
+  public void insertAllWithoutBackup(ImmutableCollection<?> entities) {
+    putAllWithoutBackup(entities);
  }

  @Override
@@ -117,17 +129,37 @@ public class DatastoreTransactionManager implements TransactionManager {

  @Override
  public void putAll(ImmutableCollection<?> entities) {
-    getOfy().save().entities(entities);
+    syncIfTransactionless(getOfy().save().entities(entities));
+  }
+
+  @Override
+  public void putWithoutBackup(Object entity) {
+    syncIfTransactionless(getOfy().saveWithoutBackup().entities(entity));
+  }
+
+  @Override
+  public void putAllWithoutBackup(ImmutableCollection<?> entities) {
+    syncIfTransactionless(getOfy().saveWithoutBackup().entities(entities));
  }

  @Override
  public void update(Object entity) {
-    saveEntity(entity);
+    put(entity);
  }

  @Override
  public void updateAll(ImmutableCollection<?> entities) {
-    getOfy().save().entities(entities);
+    putAll(entities);
+  }
+
+  @Override
+  public void updateWithoutBackup(Object entity) {
+    putWithoutBackup(entity);
+  }
+
+  @Override
+  public void updateAllWithoutBackup(ImmutableCollection<?> entities) {
+    putAllWithoutBackup(entities);
  }

  @Override
@@ -158,6 +190,11 @@ public class DatastoreTransactionManager implements TransactionManager {
    return result;
  }

+  @Override
+  public <T> T load(T entity) {
+    return ofy().load().entity(entity).now();
+  }
+
  @Override
  public <T> ImmutableMap<VKey<? extends T>, T> load(Iterable<? extends VKey<? extends T>> keys) {
    // Keep track of the Key -> VKey mapping so we can translate them back.
@@ -175,13 +212,17 @@ public class DatastoreTransactionManager implements TransactionManager {

  @Override
  public <T> ImmutableList<T> loadAll(Class<T> clazz) {
-    // We can do a ofy().load().type(clazz), but this doesn't work in a transaction.
-    throw new UnsupportedOperationException("Not available in the Datastore transaction manager");
+    return ImmutableList.copyOf(getOfy().load().type(clazz));
+  }
+
+  @Override
+  public <T> ImmutableList<T> loadAll(Iterable<T> entities) {
+    return ImmutableList.copyOf(getOfy().load().entities(entities).values());
  }

  @Override
  public void delete(VKey<?> key) {
-    getOfy().delete().key(key.getOfyKey()).now();
+    syncIfTransactionless(getOfy().delete().key(key.getOfyKey()));
  }

  @Override
@@ -192,7 +233,35 @@ public class DatastoreTransactionManager implements TransactionManager {
        StreamSupport.stream(vKeys.spliterator(), false)
            .map(VKey::getOfyKey)
            .collect(toImmutableList());
-    getOfy().delete().keys(list).now();
+    syncIfTransactionless(getOfy().delete().keys(list));
+  }
+
+  @Override
+  public void delete(Object entity) {
+    syncIfTransactionless(getOfy().delete().entity(entity));
+  }
+
+  @Override
+  public void deleteWithoutBackup(VKey<?> key) {
+    syncIfTransactionless(getOfy().deleteWithoutBackup().key(key.getOfyKey()));
+  }
+
+  @Override
+  public void deleteWithoutBackup(Iterable<? extends VKey<?>> keys) {
+    syncIfTransactionless(
+        getOfy()
+            .deleteWithoutBackup()
+            .keys(Streams.stream(keys).map(VKey::getOfyKey).collect(toImmutableList())));
+  }
+
+  @Override
+  public void deleteWithoutBackup(Object entity) {
+    syncIfTransactionless(getOfy().deleteWithoutBackup().entity(entity));
+  }
+
+  @Override
+  public void clearSessionCache() {
+    getOfy().clearSessionCache();
  }

  /**
@@ -209,7 +278,7 @@ public class DatastoreTransactionManager implements TransactionManager {
    if (entity instanceof HistoryEntry) {
      entity = ((HistoryEntry) entity).asHistoryEntry();
    }
-    getOfy().save().entity(entity);
+    syncIfTransactionless(getOfy().save().entity(entity));
  }

  @SuppressWarnings("unchecked")
@@ -227,4 +296,19 @@ public class DatastoreTransactionManager implements TransactionManager {
  private <T> T loadNullable(VKey<T> key) {
    return toChildHistoryEntryIfPossible(getOfy().load().key(key.getOfyKey()).now());
  }
+
+  /**
+   * Executes the given {@link Result} instance synchronously if not in a transaction.
+   *
+   * <p>The {@link Result} instance contains a task that will be executed by Objectify
+   * asynchronously. If it is in a transaction, we don't need to execute the task immediately
+   * because it is guaranteed to be done by the end of the transaction. However, if it is not in a
+   * transaction, we need to execute it in case the following code expects that happens before
+   * themselves.
+   */
+  private void syncIfTransactionless(Result<?> result) {
+    if (!inTransaction()) {
+      result.now();
+    }
+  }
 }
--- a/core/src/main/java/google/registry/model/ofy/ObjectifyService.java
+++ b/core/src/main/java/google/registry/model/ofy/ObjectifyService.java
@@ -42,6 +42,7 @@ import google.registry.model.translators.CidrAddressBlockTranslatorFactory;
 import google.registry.model.translators.CommitLogRevisionsTranslatorFactory;
 import google.registry.model.translators.CreateAutoTimestampTranslatorFactory;
 import google.registry.model.translators.CurrencyUnitTranslatorFactory;
+import google.registry.model.translators.DomainHistoryVKeyTranslatorFactory;
 import google.registry.model.translators.DurationTranslatorFactory;
 import google.registry.model.translators.InetAddressTranslatorFactory;
 import google.registry.model.translators.ReadableInstantUtcTranslatorFactory;
@@ -127,6 +128,7 @@ public class ObjectifyService {
            new CreateAutoTimestampTranslatorFactory(),
            new CurrencyUnitTranslatorFactory(),
            new DurationTranslatorFactory(),
+            new DomainHistoryVKeyTranslatorFactory(),
            new InetAddressTranslatorFactory(),
            new MoneyStringTranslatorFactory(),
            new ReadableInstantUtcTranslatorFactory(),
--- a/core/src/main/java/google/registry/model/ofy/ReplayQueue.java
+++ b/core/src/main/java/google/registry/model/ofy/ReplayQueue.java
@@ -0,0 +1,46 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.ofy;
+
+import google.registry.config.RegistryEnvironment;
+import java.util.concurrent.ConcurrentLinkedQueue;
+
+/**
+ * Implements simplified datastore to SQL transaction replay.
+ *
+ * <p>This code is to be removed when the actual replay cron job is implemented.
+ */
+public class ReplayQueue {
+
+  static ConcurrentLinkedQueue<TransactionInfo> queue =
+      new ConcurrentLinkedQueue<TransactionInfo>();
+
+  static void addInTests(TransactionInfo info) {
+    if (RegistryEnvironment.get() == RegistryEnvironment.UNITTEST) {
+      queue.add(info);
+    }
+  }
+
+  public static void replay() {
+    TransactionInfo info;
+    while ((info = queue.poll()) != null) {
+      info.saveToJpa();
+    }
+  }
+
+  public static void clear() {
+    queue.clear();
+  }
+}
--- a/core/src/main/java/google/registry/model/ofy/TransactionInfo.java
+++ b/core/src/main/java/google/registry/model/ofy/TransactionInfo.java
@@ -21,17 +21,25 @@ import static com.google.common.collect.Maps.filterValues;
 import static com.google.common.collect.Maps.toMap;
 import static google.registry.model.ofy.CommitLogBucket.getArbitraryBucketId;
 import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;

+import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.googlecode.objectify.Key;
+import google.registry.persistence.VKey;
+import google.registry.schema.replay.DatastoreEntity;
+import google.registry.schema.replay.SqlEntity;
 import java.util.Map;
 import org.joda.time.DateTime;

 /** Metadata for an {@link Ofy} transaction that saves commit logs. */
 class TransactionInfo {

-  private enum Delete { SENTINEL }
+  @VisibleForTesting
+  enum Delete {
+    SENTINEL
+  }

  /** Logical "now" of the transaction. */
  DateTime transactionTime;
@@ -92,4 +100,49 @@ class TransactionInfo {
        .filter(not(Delete.SENTINEL::equals))
        .collect(toImmutableSet());
  }
+
+  // Mapping from class name to "weight" (which in this case is the order in which the class must
+  // be "put" in a transaction with respect to instances of other classes).  Lower weight classes
+  // are put first, by default all classes have a weight of zero.
+  static final ImmutableMap<String, Integer> CLASS_WEIGHTS =
+      ImmutableMap.of(
+          "HistoryEntry", -1,
+          "DomainBase", 1);
+
+  // The beginning of the range of weights reserved for delete.  This must be greater than any of
+  // the values in CLASS_WEIGHTS by enough overhead to accomodate any negative values in it.
+  @VisibleForTesting static final int DELETE_RANGE = Integer.MAX_VALUE / 2;
+
+  /** Returns the weight of the entity type in the map entry. */
+  @VisibleForTesting
+  static int getWeight(ImmutableMap.Entry<Key<?>, Object> entry) {
+    int weight = CLASS_WEIGHTS.getOrDefault(entry.getKey().getKind(), 0);
+    return entry.getValue().equals(Delete.SENTINEL) ? DELETE_RANGE - weight : weight;
+  }
+
+  private static int compareByWeight(
+      ImmutableMap.Entry<Key<?>, Object> a, ImmutableMap.Entry<Key<?>, Object> b) {
+    return getWeight(a) - getWeight(b);
+  }
+
+  void saveToJpa() {
+    // Sort the changes into an order that will work for insertion into the database.
+    jpaTm()
+        .transact(
+            () -> {
+              changesBuilder.build().entrySet().stream()
+                  .sorted(TransactionInfo::compareByWeight)
+                  .forEach(
+                      entry -> {
+                        if (entry.getValue().equals(Delete.SENTINEL)) {
+                          jpaTm().delete(VKey.from(entry.getKey()));
+                        } else {
+                          for (SqlEntity entity :
+                              ((DatastoreEntity) entry.getValue()).toSqlEntities()) {
+                            jpaTm().put(entity);
+                          }
+                        }
+                      });
+            });
+  }
 }
--- a/core/src/main/java/google/registry/model/rde/RdeRevision.java
+++ b/core/src/main/java/google/registry/model/rde/RdeRevision.java
@@ -15,17 +15,30 @@
 package google.registry.model.rde;

 import static com.google.common.base.Preconditions.checkArgument;
-import static com.google.common.base.Verify.verify;
-import static com.google.common.base.Verify.verifyNotNull;
-import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.model.rde.RdeNamingUtils.makePartialName;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

 import com.google.common.base.VerifyException;
+import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Entity;
 import com.googlecode.objectify.annotation.Id;
+import com.googlecode.objectify.annotation.Ignore;
+import google.registry.model.BackupGroupRoot;
 import google.registry.model.ImmutableObject;
+import google.registry.model.rde.RdeRevision.RdeRevisionId;
+import google.registry.persistence.VKey;
+import google.registry.persistence.converter.LocalDateConverter;
+import google.registry.schema.replay.NonReplicatedEntity;
+import java.io.Serializable;
+import java.util.Optional;
+import javax.persistence.Column;
+import javax.persistence.Convert;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.IdClass;
+import javax.persistence.Transient;
 import org.joda.time.DateTime;
+import org.joda.time.LocalDate;

 /**
 * Datastore entity for tracking RDE revisions.
@@ -35,19 +48,41 @@ import org.joda.time.DateTime;
 * flag is included in the generated XML.
 */
@Entity
-public final class RdeRevision extends ImmutableObject {
+@javax.persistence.Entity
+@IdClass(RdeRevisionId.class)
+public final class RdeRevision extends BackupGroupRoot implements NonReplicatedEntity {

  /** String triplet of tld, date, and mode, e.g. {@code soy_2015-09-01_full}. */
-  @Id
-  String id;
+  @Id @Transient String id;
+
+  @javax.persistence.Id @Ignore String tld;
+
+  @javax.persistence.Id @Ignore LocalDate date;
+
+  @javax.persistence.Id @Ignore RdeMode mode;

  /**
   * Number of last revision successfully staged to GCS.
   *
   * <p>This values begins at zero upon object creation and thenceforth incremented transactionally.
   */
+  @Column(nullable = false)
  int revision;

+  /** Hibernate requires an empty constructor. */
+  private RdeRevision() {}
+
+  public static RdeRevision create(
+      String id, String tld, LocalDate date, RdeMode mode, int revision) {
+    RdeRevision instance = new RdeRevision();
+    instance.id = id;
+    instance.tld = tld;
+    instance.date = date;
+    instance.mode = mode;
+    instance.revision = revision;
+    return instance;
+  }
+
  public int getRevision() {
    return revision;
  }
@@ -58,9 +93,12 @@ public final class RdeRevision extends ImmutableObject {
   * @return {@code 0} for first deposit generation and {@code >0} for resends
   */
  public static int getNextRevision(String tld, DateTime date, RdeMode mode) {
-    RdeRevision object =
-        ofy().load().type(RdeRevision.class).id(makePartialName(tld, date, mode)).now();
-    return object == null ? 0 : object.revision + 1;
+    String id = makePartialName(tld, date, mode);
+    RdeRevisionId sqlKey = RdeRevisionId.create(tld, date.toLocalDate(), mode);
+    Key<RdeRevision> ofyKey = Key.create(RdeRevision.class, id);
+    Optional<RdeRevision> revisionOptional =
+        tm().maybeLoad(VKey.create(RdeRevision.class, sqlKey, ofyKey));
+    return revisionOptional.map(rdeRevision -> rdeRevision.revision + 1).orElse(0);
  }

  /**
@@ -76,17 +114,56 @@ public final class RdeRevision extends ImmutableObject {
    checkArgument(revision >= 0, "Negative revision: %s", revision);
    String triplet = makePartialName(tld, date, mode);
    tm().assertInTransaction();
-    RdeRevision object = ofy().load().type(RdeRevision.class).id(triplet).now();
+    RdeRevisionId sqlKey = RdeRevisionId.create(tld, date.toLocalDate(), mode);
+    Key<RdeRevision> ofyKey = Key.create(RdeRevision.class, triplet);
+    Optional<RdeRevision> revisionOptional =
+        tm().maybeLoad(VKey.create(RdeRevision.class, sqlKey, ofyKey));
    if (revision == 0) {
-      verify(object == null, "RdeRevision object already created: %s", object);
+      revisionOptional.ifPresent(
+          rdeRevision -> {
+            throw new IllegalArgumentException(
+                String.format(
+                    "RdeRevision object already created and revision 0 specified: %s",
+                    rdeRevision));
+          });
    } else {
-      verifyNotNull(object, "RDE revision object missing for %s?! revision=%s", triplet, revision);
-      verify(object.revision == revision - 1,
-          "RDE revision object should be at %s but was: %s", revision - 1, object);
+      checkArgument(
+          revisionOptional.isPresent(),
+          "Couldn't find existing RDE revision %s when trying to save new revision %s",
+          triplet,
+          revision);
+      checkArgument(
+          revisionOptional.get().revision == revision - 1,
+          "RDE revision object should be at revision %s but was: %s",
+          revision - 1,
+          revisionOptional.get());
+    }
+    RdeRevision object = RdeRevision.create(triplet, tld, date.toLocalDate(), mode, revision);
+    tm().put(object);
+  }
+
+  /** Class to represent the composite primary key of {@link RdeRevision} entity. */
+  static class RdeRevisionId extends ImmutableObject implements Serializable {
+
+    String tld;
+
+    // Auto-conversion doesn't work for ID classes, we must specify @Column and @Convert
+    @Column(columnDefinition = "date")
+    @Convert(converter = LocalDateConverter.class)
+    LocalDate date;
+
+    @Enumerated(EnumType.STRING)
+    RdeMode mode;
+
+    /** Hibernate requires this default constructor. */
+    private RdeRevisionId() {}
+
+    static RdeRevisionId create(String tld, LocalDate date, RdeMode mode) {
+      RdeRevisionId instance = new RdeRevisionId();
+      instance.tld = tld;
+      instance.date = date;
+      instance.mode = mode;
+      return instance;
    }
-    object = new RdeRevision();
-    object.id = triplet;
-    object.revision = revision;
-    ofy().save().entity(object);
  }
 }
--- a/core/src/main/java/google/registry/model/registrar/Registrar.java
+++ b/core/src/main/java/google/registry/model/registrar/Registrar.java
@@ -19,6 +19,7 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Strings.emptyToNull;
 import static com.google.common.base.Strings.nullToEmpty;
+import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.collect.ImmutableSortedMap.toImmutableSortedMap;
@@ -31,7 +32,9 @@ import static google.registry.model.CacheUtils.memoizeWithShortExpiration;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.model.registry.Registries.assertTldsExist;
+import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.persistence.transaction.TransactionManagerUtil.transactIfJpaTm;
 import static google.registry.util.CollectionUtils.nullToEmptyImmutableCopy;
 import static google.registry.util.CollectionUtils.nullToEmptyImmutableSortedCopy;
 import static google.registry.util.PasswordUtils.SALT_SUPPLIER;
@@ -118,33 +121,34 @@ public class Registrar extends ImmutableObject
    REAL(Objects::nonNull),

    /**
-     * A registrar account used by a real third-party registrar undergoing operational testing
-     * and evaluation. Should only be created in sandbox, and should have null IANA/billing IDs.
+     * A registrar account used by a real third-party registrar undergoing operational testing and
+     * evaluation. Should only be created in sandbox, and should have null IANA/billing IDs.
     */
    OTE(Objects::isNull),

    /**
-     * A registrar used for predelegation testing.  Should have a null billing ID.  The IANA ID
-     * should be either 9995 or 9996, which are reserved for predelegation testing.
+     * A registrar used for predelegation testing. Should have a null billing ID. The IANA ID should
+     * be either 9995 or 9996, which are reserved for predelegation testing.
     */
    PDT(n -> ImmutableSet.of(9995L, 9996L).contains(n)),

    /**
-     * A registrar used for external monitoring by ICANN.  Should have IANA ID 9997 and a null
+     * A registrar used for external monitoring by ICANN. Should have IANA ID 9997 and a null
     * billing ID.
     */
    EXTERNAL_MONITORING(isEqual(9997L)),

    /**
-     * A registrar used for when the registry acts as a registrar.  Must have either IANA ID
-     * 9998 (for billable transactions) or 9999 (for non-billable transactions). */
+     * A registrar used for when the registry acts as a registrar. Must have either IANA ID 9998
+     * (for billable transactions) or 9999 (for non-billable transactions).
+     */
    // TODO(b/13786188): determine what billing ID for this should be, if any.
    INTERNAL(n -> ImmutableSet.of(9998L, 9999L).contains(n)),

-    /** A registrar used for internal monitoring.  Should have null IANA/billing IDs. */
+    /** A registrar used for internal monitoring. Should have null IANA/billing IDs. */
    MONITORING(Objects::isNull),

-    /** A registrar used for internal testing.  Should have null IANA/billing IDs. */
+    /** A registrar used for internal testing. Should have null IANA/billing IDs. */
    TEST(Objects::isNull);

    /**
@@ -222,10 +226,7 @@ public class Registrar extends ImmutableObject
   */
  private static final Supplier<ImmutableMap<String, Registrar>> CACHE_BY_CLIENT_ID =
      memoizeWithShortExpiration(
-          () ->
-              tm()
-                  .doTransactionless(
-                      () -> Maps.uniqueIndex(loadAll(), Registrar::getClientId)));
+          () -> tm().doTransactionless(() -> Maps.uniqueIndex(loadAll(), Registrar::getClientId)));

  @Parent @Transient Key<EntityGroupRoot> parent = getCrossTldKey();

@@ -380,12 +381,10 @@ public class Registrar extends ImmutableObject
  @Index @Nullable Long ianaIdentifier;

  /** Identifier of registrar used in external billing system (e.g. Oracle). */
-  @Nullable
-  Long billingIdentifier;
+  @Nullable Long billingIdentifier;

  /** Purchase Order number used for invoices in external billing system, if applicable. */
-  @Nullable
-  String poNumber;
+  @Nullable String poNumber;

  /**
   * Map of currency-to-billing account for the registrar.
@@ -495,9 +494,7 @@ public class Registrar extends ImmutableObject
    if (billingAccountMap == null) {
      return ImmutableMap.of();
    }
-    return billingAccountMap
-        .entrySet()
-        .stream()
+    return billingAccountMap.entrySet().stream()
        .collect(toImmutableSortedMap(natural(), Map.Entry::getKey, v -> v.getValue().accountId));
  }

@@ -644,7 +641,20 @@ public class Registrar extends ImmutableObject
  }

  private Iterable<RegistrarContact> getContactsIterable() {
-    return ofy().load().type(RegistrarContact.class).ancestor(Registrar.this);
+    if (tm().isOfy()) {
+      return ofy().load().type(RegistrarContact.class).ancestor(Registrar.this);
+    } else {
+      return tm().transact(
+              () ->
+                  jpaTm()
+                      .getEntityManager()
+                      .createQuery(
+                          "FROM RegistrarPoc WHERE registrarId = :registrarId",
+                          RegistrarContact.class)
+                      .setParameter("registrarId", clientIdentifier)
+                      .getResultStream()
+                      .collect(toImmutableList()));
+    }
  }

  @Override
@@ -704,8 +714,20 @@ public class Registrar extends ImmutableObject
    return new Builder(clone(this));
  }

+  /** Creates a {@link VKey} for this instance. */
  public VKey<Registrar> createVKey() {
-    return VKey.create(Registrar.class, clientIdentifier, Key.create(this));
+    return createVKey(Key.create(this));
+  }
+
+  /** Creates a {@link VKey} for the given {@code registrarId}. */
+  public static VKey<Registrar> createVKey(String registrarId) {
+    checkArgumentNotNull(registrarId, "registrarId must be specified");
+    return createVKey(Key.create(getCrossTldKey(), Registrar.class, registrarId));
+  }
+
+  /** Creates a {@link VKey} instance from a {@link Key} instance. */
+  public static VKey<Registrar> createVKey(Key<Registrar> key) {
+    return VKey.create(Registrar.class, key.getName(), key);
  }

  /** A builder for constructing {@link Registrar}, since it is immutable. */
@@ -720,21 +742,22 @@ public class Registrar extends ImmutableObject
      // Client id must be [3,16] chars long. See "clIDType" in the base EPP schema of RFC 5730.
      // (Need to validate this here as there's no matching EPP XSD for validation.)
      checkArgument(
-          Range.closed(3,  16).contains(clientId.length()),
+          Range.closed(3, 16).contains(clientId.length()),
          "Client identifier must be 3-16 characters long.");
      getInstance().clientIdentifier = clientId;
      return this;
    }

    public Builder setIanaIdentifier(@Nullable Long ianaIdentifier) {
-      checkArgument(ianaIdentifier == null || ianaIdentifier > 0,
-          "IANA ID must be a positive number");
+      checkArgument(
+          ianaIdentifier == null || ianaIdentifier > 0, "IANA ID must be a positive number");
      getInstance().ianaIdentifier = ianaIdentifier;
      return this;
    }

    public Builder setBillingIdentifier(@Nullable Long billingIdentifier) {
-      checkArgument(billingIdentifier == null || billingIdentifier > 0,
+      checkArgument(
+          billingIdentifier == null || billingIdentifier > 0,
          "Billing ID must be a positive number");
      getInstance().billingIdentifier = billingIdentifier;
      return this;
@@ -750,9 +773,7 @@ public class Registrar extends ImmutableObject
        getInstance().billingAccountMap = null;
      } else {
        getInstance().billingAccountMap =
-            billingAccountMap
-                .entrySet()
-                .stream()
+            billingAccountMap.entrySet().stream()
                .collect(toImmutableMap(Map.Entry::getKey, BillingAccountEntry::new));
      }
      return this;
@@ -789,12 +810,12 @@ public class Registrar extends ImmutableObject
     * to set the allowed TLDs.
     */
    public Builder setAllowedTldsUncached(Set<String> allowedTlds) {
-      ImmutableSet<Key<Registry>> newTldKeys =
+      ImmutableSet<VKey<Registry>> newTldKeys =
          Sets.difference(allowedTlds, getInstance().getAllowedTlds()).stream()
-              .map(tld -> Key.create(getCrossTldKey(), Registry.class, tld))
+              .map(Registry::createVKey)
              .collect(toImmutableSet());
-      Set<Key<Registry>> missingTldKeys =
-          Sets.difference(newTldKeys, ofy().load().keys(newTldKeys).keySet());
+      Set<VKey<Registry>> missingTldKeys =
+          Sets.difference(newTldKeys, transactIfJpaTm(() -> tm().load(newTldKeys)).keySet());
      checkArgument(missingTldKeys.isEmpty(), "Trying to set nonexisting TLDs: %s", missingTldKeys);
      getInstance().allowedTlds = ImmutableSortedSet.copyOf(allowedTlds);
      return this;
@@ -876,16 +897,12 @@ public class Registrar extends ImmutableObject
    }

    public Builder setPhoneNumber(String phoneNumber) {
-      getInstance().phoneNumber = (phoneNumber == null)
-          ? null
-          : checkValidPhoneNumber(phoneNumber);
+      getInstance().phoneNumber = (phoneNumber == null) ? null : checkValidPhoneNumber(phoneNumber);
      return this;
    }

    public Builder setFaxNumber(String faxNumber) {
-      getInstance().faxNumber = (faxNumber == null)
-          ? null
-          : checkValidPhoneNumber(faxNumber);
+      getInstance().faxNumber = (faxNumber == null) ? null : checkValidPhoneNumber(faxNumber);
      return this;
    }

@@ -920,7 +937,8 @@ public class Registrar extends ImmutableObject
    }

    public Builder setDriveFolderId(@Nullable String driveFolderId) {
-      checkArgument(driveFolderId == null || !driveFolderId.contains("/"),
+      checkArgument(
+          driveFolderId == null || !driveFolderId.contains("/"),
          "Drive folder ID must not be a full URL");
      getInstance().driveFolderId = driveFolderId;
      return this;
@@ -938,9 +956,10 @@ public class Registrar extends ImmutableObject

    /** @throws IllegalArgumentException if provided passcode is not 5-digit numeric */
    public Builder setPhonePasscode(String phonePasscode) {
-      checkArgument(phonePasscode == null
-          || PHONE_PASSCODE_PATTERN.matcher(phonePasscode).matches(),
-          "Not a valid telephone passcode (must be 5 digits long): %s", phonePasscode);
+      checkArgument(
+          phonePasscode == null || PHONE_PASSCODE_PATTERN.matcher(phonePasscode).matches(),
+          "Not a valid telephone passcode (must be 5 digits long): %s",
+          phonePasscode);
      getInstance().phonePasscode = phonePasscode;
      return this;
    }
@@ -958,9 +977,11 @@ public class Registrar extends ImmutableObject
      checkArgument(
          getInstance().localizedAddress != null || getInstance().internationalizedAddress != null,
          "Must specify at least one of localized or internationalized address");
-      checkArgument(getInstance().type.isValidIanaId(getInstance().ianaIdentifier),
-          String.format("Supplied IANA ID is not valid for %s registrar type: %s",
-            getInstance().type, getInstance().ianaIdentifier));
+      checkArgument(
+          getInstance().type.isValidIanaId(getInstance().ianaIdentifier),
+          String.format(
+              "Supplied IANA ID is not valid for %s registrar type: %s",
+              getInstance().type, getInstance().ianaIdentifier));
      return cloneEmptyToNull(super.build());
    }
  }
@@ -980,7 +1001,9 @@ public class Registrar extends ImmutableObject

  /** Loads all registrar entities directly from Datastore. */
  public static Iterable<Registrar> loadAll() {
-    return ImmutableList.copyOf(ofy().load().type(Registrar.class).ancestor(getCrossTldKey()));
+    return tm().isOfy()
+        ? ImmutableList.copyOf(ofy().load().type(Registrar.class).ancestor(getCrossTldKey()))
+        : tm().transact(() -> tm().loadAll(Registrar.class));
  }

  /** Loads all registrar entities using an in-memory cache. */
@@ -991,8 +1014,7 @@ public class Registrar extends ImmutableObject
  /** Loads and returns a registrar entity by its client id directly from Datastore. */
  public static Optional<Registrar> loadByClientId(String clientId) {
    checkArgument(!Strings.isNullOrEmpty(clientId), "clientId must be specified");
-    return Optional.ofNullable(
-        ofy().load().type(Registrar.class).parent(getCrossTldKey()).id(clientId).now());
+    return transactIfJpaTm(() -> tm().maybeLoad(createVKey(clientId)));
  }

  /**
--- a/core/src/main/java/google/registry/model/registrar/RegistrarContact.java
+++ b/core/src/main/java/google/registry/model/registrar/RegistrarContact.java
@@ -119,9 +119,7 @@ public class RegistrarContact extends ImmutableObject
  String name;

  /** The email address of the contact. */
-  @Id
-  @javax.persistence.Id
-  String emailAddress;
+  @Id @javax.persistence.Id String emailAddress;

  @Ignore @javax.persistence.Id String registrarId;

@@ -147,8 +145,7 @@ public class RegistrarContact extends ImmutableObject
   *
   * @see com.google.appengine.api.users.User#getUserId()
   */
-  @Index
-  String gaeUserId;
+  @Index String gaeUserId;

  /**
   * Whether this contact is publicly visible in WHOIS registrar query results as an Admin contact.
@@ -202,8 +199,7 @@ public class RegistrarContact extends ImmutableObject
   */
  public static void updateContacts(
      final Registrar registrar, final Set<RegistrarContact> contacts) {
-    tm()
-        .transact(
+    tm().transact(
            () -> {
              ofy()
                  .delete()
@@ -364,8 +360,15 @@ public class RegistrarContact extends ImmutableObject
  }

  public VKey<RegistrarContact> createVKey() {
-    return VKey.create(
-        RegistrarContact.class, new RegistrarPocId(emailAddress, registrarId), Key.create(this));
+    return createVKey(Key.create(this));
+  }
+
+  /** Creates a {@link VKey} instance from a {@link Key} instance. */
+  public static VKey<RegistrarContact> createVKey(Key<RegistrarContact> key) {
+    Key<Registrar> parent = key.getParent();
+    String registrarId = parent.getName();
+    String emailAddress = key.getName();
+    return VKey.create(RegistrarContact.class, new RegistrarPocId(emailAddress, registrarId), key);
  }

  /** Class to represent the composite primary key for {@link RegistrarContact} entity. */
--- a/core/src/main/java/google/registry/model/registry/Registries.java
+++ b/core/src/main/java/google/registry/model/registry/Registries.java
@@ -59,15 +59,19 @@ public final class Registries {
            tm().doTransactionless(
                    () -> {
                      ImmutableSet<String> tlds =
-                          ofy()
-                              .load()
-                              .type(Registry.class)
-                              .ancestor(getCrossTldKey())
-                              .keys()
-                              .list()
-                              .stream()
-                              .map(Key::getName)
-                              .collect(toImmutableSet());
+                          tm().isOfy()
+                              ? ofy()
+                                  .load()
+                                  .type(Registry.class)
+                                  .ancestor(getCrossTldKey())
+                                  .keys()
+                                  .list()
+                                  .stream()
+                                  .map(Key::getName)
+                                  .collect(toImmutableSet())
+                              : tm().loadAll(Registry.class).stream()
+                                  .map(Registry::getTldStr)
+                                  .collect(toImmutableSet());
                      return Registry.getAll(tlds).stream()
                          .map(e -> Maps.immutableEntry(e.getTldStr(), e.getTldType()))
                          .collect(entriesToImmutableMap());
--- a/core/src/main/java/google/registry/model/registry/Registry.java
+++ b/core/src/main/java/google/registry/model/registry/Registry.java
@@ -22,13 +22,11 @@ import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.collect.Maps.toMap;
 import static google.registry.config.RegistryConfig.getSingletonCacheRefreshDuration;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.CollectionUtils.nullToEmptyImmutableCopy;
 import static google.registry.util.DateTimeUtils.END_OF_TIME;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
-import static java.util.concurrent.TimeUnit.MILLISECONDS;
 import static org.joda.money.CurrencyUnit.USD;

 import com.google.common.annotations.VisibleForTesting;
@@ -62,6 +60,7 @@ import google.registry.model.domain.fee.BaseFee.FeeType;
 import google.registry.model.domain.fee.Fee;
 import google.registry.model.registry.label.PremiumList;
 import google.registry.model.registry.label.ReservedList;
+import google.registry.persistence.VKey;
 import google.registry.schema.replay.DatastoreAndSqlEntity;
 import google.registry.util.Idn;
 import java.util.Map;
@@ -260,35 +259,36 @@ public class Registry extends ImmutableObject implements Buildable, DatastoreAnd
  /** A cache that loads the {@link Registry} for a given tld. */
  private static final LoadingCache<String, Optional<Registry>> CACHE =
      CacheBuilder.newBuilder()
-          .expireAfterWrite(getSingletonCacheRefreshDuration().getMillis(), MILLISECONDS)
+          .expireAfterWrite(
+              java.time.Duration.ofMillis(getSingletonCacheRefreshDuration().getMillis()))
          .build(
              new CacheLoader<String, Optional<Registry>>() {
                @Override
                public Optional<Registry> load(final String tld) {
                  // Enter a transaction-less context briefly; we don't want to enroll every TLD in
                  // a transaction that might be wrapping this call.
-                  return Optional.ofNullable(
-                      tm().doTransactionless(
-                              () ->
-                                  ofy()
-                                      .load()
-                                      .key(Key.create(getCrossTldKey(), Registry.class, tld))
-                                      .now()));
+                  return tm().doTransactionless(() -> tm().maybeLoad(createVKey(tld)));
                }

                @Override
                public Map<String, Optional<Registry>> loadAll(Iterable<? extends String> tlds) {
-                  ImmutableMap<String, Key<Registry>> keysMap =
-                      toMap(
-                          ImmutableSet.copyOf(tlds),
-                          tld -> Key.create(getCrossTldKey(), Registry.class, tld));
-                  Map<Key<Registry>, Registry> entities =
-                      tm().doTransactionless(() -> ofy().load().keys(keysMap.values()));
+                  ImmutableMap<String, VKey<Registry>> keysMap =
+                      toMap(ImmutableSet.copyOf(tlds), Registry::createVKey);
+                  Map<VKey<? extends Registry>, Registry> entities =
+                      tm().doTransactionless(() -> tm().load(keysMap.values()));
                  return Maps.transformEntries(
                      keysMap, (k, v) -> Optional.ofNullable(entities.getOrDefault(v, null)));
                }
              });

+  public static VKey<Registry> createVKey(String tld) {
+    return VKey.create(Registry.class, tld, Key.create(getCrossTldKey(), Registry.class, tld));
+  }
+
+  public static VKey<Registry> createVKey(Key<Registry> key) {
+    return createVKey(key.getName());
+  }
+
  /**
   * The name of the pricing engine that this TLD uses.
   *
@@ -386,7 +386,7 @@ public class Registry extends ImmutableObject implements Buildable, DatastoreAnd
  CreateAutoTimestamp creationTime = CreateAutoTimestamp.create(null);

  /** The set of reserved lists that are applicable to this registry. */
-  @Column(name = "reserved_list_names", nullable = false)
+  @Column(name = "reserved_list_names")
  Set<Key<ReservedList>> reservedLists;

  /** Retrieves an ImmutableSet of all ReservedLists associated with this tld. */
--- a/core/src/main/java/google/registry/model/registry/label/BaseDomainLabelList.java
+++ b/core/src/main/java/google/registry/model/registry/label/BaseDomainLabelList.java
@@ -79,7 +79,7 @@ public abstract class BaseDomainLabelList<T extends Comparable<?>, R extends Dom
  // set to the timestamp when the list is created. In Datastore, we have two fields and the
  // lastUpdateTime is set to the current timestamp when creating and updating a list. So, we use
  // lastUpdateTime as the creation_timestamp column during the dual-write phase for compatibility.
-  @Column(name = "creation_timestamp", nullable = false)
+  @Column(name = "creation_timestamp")
  DateTime lastUpdateTime;

  /** Returns the ID of this revision, or throws if null. */
--- a/core/src/main/java/google/registry/model/registry/label/PremiumList.java
+++ b/core/src/main/java/google/registry/model/registry/label/PremiumList.java
@@ -25,7 +25,6 @@ import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
 import static google.registry.model.ofy.ObjectifyService.allocateId;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static java.util.concurrent.TimeUnit.MILLISECONDS;

 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Splitter;
@@ -33,7 +32,6 @@ import com.google.common.cache.CacheBuilder;
 import com.google.common.cache.CacheLoader;
 import com.google.common.cache.CacheLoader.InvalidCacheLoadException;
 import com.google.common.cache.LoadingCache;
-import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.hash.BloomFilter;
 import com.google.common.util.concurrent.UncheckedExecutionException;
@@ -46,9 +44,8 @@ import google.registry.model.Buildable;
 import google.registry.model.ImmutableObject;
 import google.registry.model.annotations.ReportedOn;
 import google.registry.model.registry.Registry;
-import google.registry.schema.replay.DatastoreAndSqlEntity;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;
+import google.registry.schema.replay.NonReplicatedEntity;
 import google.registry.schema.tld.PremiumListDao;
 import google.registry.util.NonFinalForTesting;
 import java.io.ByteArrayOutputStream;
@@ -56,6 +53,7 @@ import java.io.IOException;
 import java.math.BigDecimal;
 import java.util.List;
 import java.util.Map;
+import java.util.NoSuchElementException;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
@@ -89,7 +87,7 @@ import org.joda.time.Duration;
@javax.persistence.Entity
@Table(indexes = {@Index(columnList = "name", name = "premiumlist_name_idx")})
 public final class PremiumList extends BaseDomainLabelList<Money, PremiumList.PremiumListEntry>
-    implements DatastoreAndSqlEntity {
+    implements NonReplicatedEntity {

  /** Stores the revision key for the set of currently used premium list entry entities. */
  @Transient Key<PremiumListRevision> revisionKey;
@@ -114,7 +112,7 @@ public final class PremiumList extends BaseDomainLabelList<Money, PremiumList.Pr
  /** Virtual parent entity for premium list entry entities associated with a single revision. */
  @ReportedOn
  @Entity
-  public static class PremiumListRevision extends ImmutableObject implements DatastoreEntity {
+  public static class PremiumListRevision extends ImmutableObject implements DatastoreOnlyEntity {

    @Parent Key<PremiumList> parent;

@@ -171,11 +169,6 @@ public final class PremiumList extends BaseDomainLabelList<Money, PremiumList.Pr
      }
      return revision;
    }
-
-    @Override
-    public ImmutableList<SqlEntity> toSqlEntities() {
-      return ImmutableList.of(); // not persisted in SQL
-    }
  }

  /**
@@ -197,7 +190,7 @@ public final class PremiumList extends BaseDomainLabelList<Money, PremiumList.Pr
  @VisibleForTesting
  static LoadingCache<String, PremiumList> createCachePremiumLists(Duration cachePersistDuration) {
    return CacheBuilder.newBuilder()
-        .expireAfterWrite(cachePersistDuration.getMillis(), MILLISECONDS)
+        .expireAfterWrite(java.time.Duration.ofMillis(cachePersistDuration.getMillis()))
        .build(
            new CacheLoader<String, PremiumList>() {
              @Override
@@ -208,7 +201,9 @@ public final class PremiumList extends BaseDomainLabelList<Money, PremiumList.Pr
  }

  private static PremiumList loadPremiumList(String name) {
-    return ofy().load().type(PremiumList.class).parent(getCrossTldKey()).id(name).now();
+    return tm().isOfy()
+        ? ofy().load().type(PremiumList.class).parent(getCrossTldKey()).id(name).now()
+        : PremiumListDao.getLatestRevision(name).orElseThrow(NoSuchElementException::new);
  }

  /**
@@ -221,7 +216,8 @@ public final class PremiumList extends BaseDomainLabelList<Money, PremiumList.Pr
  static final LoadingCache<Key<PremiumListRevision>, PremiumListRevision>
      cachePremiumListRevisions =
          CacheBuilder.newBuilder()
-              .expireAfterWrite(getSingletonCachePersistDuration().getMillis(), MILLISECONDS)
+              .expireAfterWrite(
+                  java.time.Duration.ofMillis(getSingletonCachePersistDuration().getMillis()))
              .build(
                  new CacheLoader<Key<PremiumListRevision>, PremiumListRevision>() {
                    @Override
@@ -260,14 +256,14 @@ public final class PremiumList extends BaseDomainLabelList<Money, PremiumList.Pr
  static LoadingCache<Key<PremiumListEntry>, Optional<PremiumListEntry>>
      createCachePremiumListEntries(Duration cachePersistDuration) {
    return CacheBuilder.newBuilder()
-        .expireAfterWrite(cachePersistDuration.getMillis(), MILLISECONDS)
+        .expireAfterWrite(java.time.Duration.ofMillis(cachePersistDuration.getMillis()))
        .maximumSize(getStaticPremiumListMaxCachedEntries())
        .build(
            new CacheLoader<Key<PremiumListEntry>, Optional<PremiumListEntry>>() {
              @Override
              public Optional<PremiumListEntry> load(final Key<PremiumListEntry> entryKey) {
-                return tm()
-                    .doTransactionless(() -> Optional.ofNullable(ofy().load().key(entryKey).now()));
+                return tm().doTransactionless(
+                        () -> Optional.ofNullable(ofy().load().key(entryKey).now()));
              }
            });
  }
@@ -329,7 +325,7 @@ public final class PremiumList extends BaseDomainLabelList<Money, PremiumList.Pr
  @ReportedOn
  @Entity
  public static class PremiumListEntry extends DomainLabelEntry<Money, PremiumListEntry>
-      implements Buildable, DatastoreEntity {
+      implements Buildable, DatastoreOnlyEntity {

    @Parent
    Key<PremiumListRevision> parent;
@@ -346,11 +342,6 @@ public final class PremiumList extends BaseDomainLabelList<Money, PremiumList.Pr
      return new Builder(clone(this));
    }

-    @Override
-    public ImmutableList<SqlEntity> toSqlEntities() {
-      return null;
-    }
-
    /** A builder for constructing {@link PremiumListEntry} objects, since they are immutable. */
    public static class Builder extends DomainLabelEntry.Builder<PremiumListEntry, Builder> {

--- a/core/src/main/java/google/registry/model/registry/label/ReservedList.java
+++ b/core/src/main/java/google/registry/model/registry/label/ReservedList.java
@@ -19,8 +19,8 @@ import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.config.RegistryConfig.getDomainLabelListCacheDuration;
 import static google.registry.model.registry.label.ReservationType.FULLY_BLOCKED;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.CollectionUtils.nullToEmpty;
-import static java.util.concurrent.TimeUnit.MILLISECONDS;
 import static org.joda.time.DateTimeZone.UTC;

 import com.google.common.base.Splitter;
@@ -38,7 +38,7 @@ import com.googlecode.objectify.mapper.Mapper;
 import google.registry.model.Buildable;
 import google.registry.model.registry.Registry;
 import google.registry.model.registry.label.DomainLabelMetrics.MetricsReservedListMatch;
-import google.registry.schema.replay.DatastoreAndSqlEntity;
+import google.registry.schema.replay.NonReplicatedEntity;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
@@ -67,7 +67,7 @@ import org.joda.time.DateTime;
@Table(indexes = {@Index(columnList = "name", name = "reservedlist_name_idx")})
 public final class ReservedList
    extends BaseDomainLabelList<ReservationType, ReservedList.ReservedListEntry>
-    implements DatastoreAndSqlEntity {
+    implements NonReplicatedEntity {

  @Mapify(ReservedListEntry.LabelMapper.class)
  @ElementCollection
@@ -241,12 +241,15 @@ public final class ReservedList

  private static LoadingCache<String, ReservedList> cache =
      CacheBuilder.newBuilder()
-          .expireAfterWrite(getDomainLabelListCacheDuration().getMillis(), MILLISECONDS)
+          .expireAfterWrite(
+              java.time.Duration.ofMillis(getDomainLabelListCacheDuration().getMillis()))
          .build(
              new CacheLoader<String, ReservedList>() {
                @Override
                public ReservedList load(String listName) {
-                  return ReservedListDualWriteDao.getLatestRevision(listName).orElse(null);
+                  return tm().isOfy()
+                      ? ReservedListDualWriteDao.getLatestRevision(listName).orElse(null)
+                      : ReservedListSqlDao.getLatestRevision(listName).orElse(null);
                }
              });

--- a/core/src/main/java/google/registry/model/reporting/HistoryEntry.java
+++ b/core/src/main/java/google/registry/model/reporting/HistoryEntry.java
@@ -32,15 +32,17 @@ import google.registry.model.EppResource;
 import google.registry.model.ImmutableObject;
 import google.registry.model.annotations.ReportedOn;
 import google.registry.model.contact.ContactHistory;
+import google.registry.model.contact.ContactHistory.ContactHistoryId;
 import google.registry.model.contact.ContactResource;
 import google.registry.model.domain.DomainBase;
 import google.registry.model.domain.DomainHistory;
+import google.registry.model.domain.DomainHistory.DomainHistoryId;
 import google.registry.model.domain.Period;
 import google.registry.model.eppcommon.Trid;
 import google.registry.model.host.HostHistory;
+import google.registry.model.host.HostHistory.HostHistoryId;
 import google.registry.model.host.HostResource;
 import google.registry.persistence.VKey;
-import google.registry.persistence.WithStringVKey;
 import google.registry.schema.replay.DatastoreEntity;
 import google.registry.schema.replay.SqlEntity;
 import java.util.Set;
@@ -60,7 +62,6 @@ import org.joda.time.DateTime;
@ReportedOn
@Entity
@MappedSuperclass
-@WithStringVKey // TODO(b/162229294): This should be resolved during the course of that bug
@Access(AccessType.FIELD)
 public class HistoryEntry extends ImmutableObject implements Buildable, DatastoreEntity {

@@ -137,8 +138,12 @@ public class HistoryEntry extends ImmutableObject implements Buildable, Datastor
  @Transient // domain-specific
  Period period;

-  /** The actual EPP xml of the command, stored as bytes to be agnostic of encoding. */
-  @Column(nullable = false, name = "historyXmlBytes")
+  /**
+   * The actual EPP xml of the command, stored as bytes to be agnostic of encoding.
+   *
+   * <p>Changes performed by backend actions would not have EPP requests to store.
+   */
+  @Column(name = "historyXmlBytes")
  byte[] xmlBytes;

  /** The time the command occurred, represented by the ofy transaction time. */
@@ -182,7 +187,7 @@ public class HistoryEntry extends ImmutableObject implements Buildable, Datastor
  String reason;

  /** Whether this change was requested by a registrar. */
-  @Column(nullable = false, name = "historyRequestedByRegistrar")
+  @Column(name = "historyRequestedByRegistrar")
  Boolean requestedByRegistrar;

  /**
@@ -193,7 +198,7 @@ public class HistoryEntry extends ImmutableObject implements Buildable, Datastor
   * transaction counts (such as contact or host mutations).
   */
  @Transient // domain-specific
-  Set<DomainTransactionRecord> domainTransactionRecords;
+  protected Set<DomainTransactionRecord> domainTransactionRecords;

  public long getId() {
    // For some reason, Hibernate throws NPE during some initialization phase if we don't deal with
@@ -273,20 +278,8 @@ public class HistoryEntry extends ImmutableObject implements Buildable, Datastor
  /** This method exists solely to satisfy Hibernate. Use the {@link Builder} instead. */
  @SuppressWarnings("UnusedMethod")
  private void setDomainTransactionRecords(Set<DomainTransactionRecord> domainTransactionRecords) {
-    this.domainTransactionRecords = ImmutableSet.copyOf(domainTransactionRecords);
-  }
-
-  public static VKey<HistoryEntry> createVKey(Key<HistoryEntry> key) {
-    // TODO(b/159207551): This will likely need some revision.  As it stands, this method was
-    // introduced purely to facilitate testing of VKey specialization in VKeyTranslatorFactory.
-    // This class will likely require that functionality, though perhaps not this implementation of
-    // it.
-    // For now, just assume that the primary key of a history entry is comprised of the parent
-    // type, key and the object identifer.
-    return VKey.create(
-        HistoryEntry.class,
-        key.getParent().getKind() + "/" + key.getParent().getName() + "/" + key.getId(),
-        key);
+    this.domainTransactionRecords =
+        domainTransactionRecords == null ? null : ImmutableSet.copyOf(domainTransactionRecords);
  }

  @Override
@@ -325,6 +318,33 @@ public class HistoryEntry extends ImmutableObject implements Buildable, Datastor
    return ImmutableList.of((SqlEntity) toChildHistoryEntity());
  }

+  /** Creates a {@link VKey} instance from a {@link Key} instance. */
+  public static VKey<? extends HistoryEntry> createVKey(Key<HistoryEntry> key) {
+    String repoId = key.getParent().getName();
+    long id = key.getId();
+    Key<EppResource> parent = key.getParent();
+    String parentKind = parent.getKind();
+    if (parentKind.equals(getKind(DomainBase.class))) {
+      return VKey.create(
+          DomainHistory.class,
+          new DomainHistoryId(repoId, id),
+          Key.create(parent, DomainHistory.class, id));
+    } else if (parentKind.equals(getKind(HostResource.class))) {
+      return VKey.create(
+          HostHistory.class,
+          new HostHistoryId(repoId, id),
+          Key.create(parent, HostHistory.class, id));
+    } else if (parentKind.equals(getKind(ContactResource.class))) {
+      return VKey.create(
+          ContactHistory.class,
+          new ContactHistoryId(repoId, id),
+          Key.create(parent, ContactHistory.class, id));
+    } else {
+      throw new IllegalStateException(
+          String.format("Unknown kind of HistoryEntry parent %s", parentKind));
+    }
+  }
+
  /** A builder for {@link HistoryEntry} since it is immutable */
  public static class Builder<T extends HistoryEntry, B extends Builder<?, ?>>
      extends GenericBuilder<T, B> {
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Michael Muller	cde1c78f5e	Add replay-testing to DomainDeleteFlowTest (#886 ) * Minor fixes: - Initialize "requestedByRegistrar" to false (it's non-nullable). - Store test entities (registrar, hosts and contacts) in JPA. * Flyway changes * Add ReplayExtension to DomainDeleteFlowTest * Check in latest ER diagrams	2020-11-25 11:15:10 -05:00
gbrodman	3b1c198c11	Ensure that all relevant Keys can be converted to VKeys (#883 ) * Ensure that all relevant Keys can be converted to VKeys When replaying commit logs to SQL (specifically deletes) we will need to convert Datastore Keys to SQL VKeys in order to know what (if anything) to delete. The test added to EntityTest (and the associated code changes) mean that for every relevant object we'll be able to call VKeyTranslatorFactory.createVKey(Key<?>) for all possible keys that we care about. Note that we do not care about entities that only exist in Datastore or entities that are non-replicated -- by their nature, deletes for those types of objects in Datastore are not relevant in SQL. * Responses to code review - changing comments / method names - using ModelUtils	2020-11-24 14:33:06 -05:00
Michael Muller	3afcc0dcb4	Fix DatastoreHelper -> DatabaseHelper in comments (#885 ) * Fix DatastoreHelper -> DatabaseHelper in comments Fix a few comments that still make reference to DatastoreHelper.	2020-11-24 14:32:15 -05:00
Michael Muller	67c6d73a18	Fix DomainHistory merge issues (#884 ) * Reproduce DomainHistory double write failure * Add fix for cascade sets and clean up hacks * Fix DatastoreHelper to work with name change. * Remove Ignored entities from ofy schema	2020-11-24 11:42:00 -05:00
Weimin Yu	33499aaf9e	Make sure post load work happens in GracePeriod (#878 ) * Make sure post load work happens in GracePeriod The GracePeriod method with ofy @OnLoad annotation is not called. Apparently Ofy only checks for @OnLoad on first-class entities, not embedded ones. Added a call to this method from DomainContent's OnLoad method. Reproduced issue with a test and verified that the fix works.	2020-11-23 13:47:27 -05:00
Ben McIlwain	fcd79e7c18	Add a full ASCII StringGenerator alphabet (#882 ) * Add a full ASCII StringGenerator alphabet This is intended for the purpose of generating maximally secure passwords for PostgreSQL and others. We may need to remove a few of these punctuation characters if they prove to be more trouble than they're worth (e.g. backtick).	2020-11-19 18:08:04 -05:00
Ben McIlwain	d9c06ce54c	Fix pseudo typo (#880 ) * Fix pseudo typo	2020-11-19 17:25:19 -05:00
Ben McIlwain	b4b7fdbc07	Rename DatastoreHelper -> DatabaseHelper (#881 ) * Rename DatastoreHelper -> DatabaseHelper It already contains some functionality for dealing with Cloud SQL and will increasingly contain more, so it should be renamed so that it does not falsely imply it is specific only to Datastore.	2020-11-19 17:24:53 -05:00
gbrodman	ef6d3890bc	Allow addition of extra entity classes for VKey conversion (#877 ) * Allow addition of extra entity classes for VKey conversion This allows us to create VKeys from Keys for test objects that may not be part of the original codebase. This isn't used anywhere directly yet but it will be useful in the future when testing the replay of SQL transactions.	2020-11-19 13:38:28 -05:00
Shicong Huang	1c7c202a80	Display concrete test method name for @@DualDatabaseTest (#876 )	2020-11-18 20:56:08 -05:00
Weimin Yu	e1ce357904	Drop foreign key constraints on PollMessages (#875 ) * Drop foreign key constraints on PollMessages PollMessages are deleted after being acked by recipients. Other tables cannot have foreign key constraints on them.	2020-11-18 20:28:56 -05:00
Shicong Huang	1d91a8e647	Use DomainHistoryVKey to restore symmetric VKey (#874 ) * Use DomainHistoryVKey to restore symmetric VKey * Rebase on HEAD	2020-11-17 16:32:32 -05:00
Michael Muller	ab7ee51fb2	Add an extension to verify transaction replay (#857 ) * Add an extension to verify transaction replay Add ReplayExtension, which can be applied to test suites to verify that transactions committed to datastore can be replayed to SQL. This introduces a ReplayQueue class, which serves as a stand-in for the current lack of replay-from-commit-logs. It also includes replay logic in TransactionInfo which introduces the concept of "entity class weights." Entity weighting allows us store and delete objects in an order that is consistent with the direction of foreign key and deferred foreign key relationships. As a general rule, lower weight classes must have no direct or indirect non-deferred foreign key relationships on higher weight classes. It is expected that much of this code will change when the final replay mechanism is implemented. * Minor fixes: - Initialize "requestedByRegistrar" to false (it's non-nullable). [reverted during rebase: non-nullable was removed in another PR] - Store test entities (registrar, hosts and contacts) in JPA. * Make testbed save replay This changes the replay system to make datastore saves initiated from the testbed (as opposed to just the tested code) replay when the ReplayExtension is enabled. This requires modifications to DatastoreHelper and the AppEngineExtension that the ReplayExtension can plug into. This changes also has some necessary fixes to objects that are persisted by the testbed (such as PremiumList).	2020-11-17 13:29:50 -05:00
Shicong Huang	c8159e7b35	Convert RegistrarTest to working with Postgresql (#865 ) * Convert RegistrarTest to working with Postgresql * Resolve comments	2020-11-16 12:18:28 -05:00
Weimin Yu	51942fcaad	Make some columns nullable in History tables (#873 ) * Make some columns nullable in History tables xmlBytes is made nullable in all history tables since changes performed by backend actions would not have it. In addition, epp requests are not saved to ContactHistory since data may contain PII. requestedByRegistrar in all history tables are made nullable. This property is set from metadata in epp requests. Null means not provided.	2020-11-13 15:25:54 -05:00
Weimin Yu	ae6b414b82	Add a Secret Manager client for Nomulus (#872 ) * Add a Secret Manager client for Nomulus	2020-11-12 17:12:52 -05:00
Shicong Huang	de20334a66	Add SQL schema for GracePeriodHistory (#746 ) * Add schema for GracePeriodHistory Rebase on HEAD Rebase on HEAD Rebase on HEAD and rename column Use OfyService to generate id Refactor GracePeriodsSubject Rebase on HEAD Remove GracePeriodSubject and GracePeriodsSubject Rebase on HEAD Rebase on HEAD Rebase on HEAD Add gracePeriodHistoryRevisionId and remove some foreign key * Rebase on HEAD	2020-11-12 10:06:58 -05:00
Michael Muller	78bc967357	Replace ofyOrJpaTm with tm().isOfy() conditionals (#870 ) * Replace ofyOrJpaTm with tm().isOfy() conditionals Replace existing ofyOrJpaTm() calls with conditionals (either "if" statements or ternary expressions) gated on tm().isOfy().	2020-11-11 07:40:43 -05:00
gbrodman	88f4f36678	Maintain only one row in the TmchCrl table at all times (#869 ) * Maintain only one row in the TmchCrl table at all times	2020-11-10 17:09:26 -05:00
gbrodman	f1eb1a8fe7	Add SQL replay checkpoint object to SQL (#868 ) * Add SQL replay checkpoint object to Datastore This will be part of the asynchronous commit-log replay to SQL. Whenever we successfully export commits up to a particular time, we should persist that time so we don't replay the same commits again (it is not idempotent) * Move SqlReplayCheckpoint from DS to SQL * Responses to CR	2020-11-10 17:09:18 -05:00
Michael Muller	82cc7b59fe	Small SQL persistence fixes to model classes (#863 ) * Small SQL persistence fixes to model classes - Add a createVKey() method to Registry (Registry vkeys are composite) - Add/fix toSqlEntities() methods in premium and reserved list classes. * Remove fixes addressed by #866	2020-11-10 11:12:09 -05:00
Michael Muller	633377a594	Generate ER diagrams in :nom:generate_golden_file (#867 ) Generate entity relationship diagrams during the same step in which we generate the golden schema.	2020-11-10 10:03:28 -05:00
sarahcaseybot	c729a30d38	Add ECDSA key validation to Certificate Checker (#855 ) * Add ecdsa key validation * Add some comments * fix merge conflicts * change variable names * Separate tests * separate curve tests	2020-11-09 15:28:48 -05:00
gbrodman	acce1a7d3b	Add DuallyWrittenEntity convenience interface (#866 ) * Add DuallyWrittenEntity convenience interface For classes that are dually written we don't need to worry about replay conversion, so this just allows us to remove unnecessary unimportant methods * Rename DWE to NonReplicatedEntity and enable test	2020-11-09 15:13:40 -05:00
gbrodman	0c6363c04f	Persist two singleton entities in SQL tables (#860 ) * Persist two singleton entities in SQL tables A table might not be the best place to store singleton entities, but by doing this we ensure we can easily inspect them later and use the same sort of persistence logic for these that we do elsewhere. ServerSecret is stored upon retrieval so that we make sure that the same secret is used in both Datastore and SQL (we wouldn't want to change it). * Responses to CR * Don't have a separate ID for the singleton entities * Rename secret UUID * Rename and regenerate	2020-11-09 13:47:42 -05:00
Shicong Huang	cb764b5d30	Convert Registry realted tests to working with SQL (#862 )	2020-11-09 12:10:55 -05:00
Shicong Huang	420f3bf380	Add missing foreign key constraints (#845 ) * Add missing foreign key constraints * Fix failed unit tests	2020-11-09 10:55:29 -05:00
Michael Muller	7097b0f5e6	Allow InjectExtension to apply in "before each" (#864 ) * Allow InjectExtension to apply in "before each" InjectExtension is non-standard in that, while it cleans up the changes it has applied in its "after each" method, those changes must be applied by the test driver or by another extension. This breaks extension ordering, which is something we're going to need to make heavy use of for the ReplayExtension. Allow changes to be specified (but not activated) after construction and apply all unactivated changes during "before each."	2020-11-09 07:52:55 -05:00
Shicong Huang	30d57d9476	Upgrade Postgres realted packages to latest version (#861 )	2020-11-06 10:14:44 -05:00
sarahcaseybot	700d612ff9	Remove November 1 check (#859 )	2020-11-04 13:10:48 -05:00
Shicong Huang	e3d400958c	Add a command to fix duplicate id issue for BillingEvent.Recurring (#798 ) * Refactor ResaveEntitiesWithUniqueIdCommand to extract common methods * Add a command to dedupe BillingEvent.Recurring entities	2020-11-03 16:11:56 -05:00
gbrodman	aa84d5d138	Fix entity annotations for a few classes (#856 ) * Fix entity annotations for a few classes - Abstract classes shouldn't implement DatastoreEntity/SqlEntity - We aren't persisting Modification in SQL - Because DelegationSignerData is embedded, we don't need to worry about converting and persisting it - DomainDsDataHistory isn't persisted in Datastore	2020-11-03 10:28:34 -05:00
gbrodman	d685f7e2df	Add a SQL schema and DAO for KmsSecretRevision (#840 ) * Add a SQL schema and DAO for KmsSecretRevision The dual-object nature of KmsSecret and KmsSecretRevision will not be necessary once we have moved to SQL. In that world, the only object will be the one now called KmsSecretRevision. KmsSecretRevision already stores its parent so all we need to do is convert that key to the String secretName (or from the secretName to the key, if loading from SQL) and select the max revision ID for a given secret name. In a future PR, we will add a dual-writing DAO to these objects and perform the dual writes, similar to how ReservedList functions. * Regenerate diagram * Rename revisionId and cryptoKeyVersionName * Fix SQL files and diagram	2020-10-30 18:45:43 -04:00
gbrodman	40eef2a06c	Add SQL schema and DAO for SignedMarkRevocationList (#850 ) * Add SQL schema and DAO for SignedMarkRevocationList This gets saved every day so we're not concerned about history, meaning we can dual-write and/or dual-read without concern. The structure here is somewhat similar to the ClaimsListDao and related classes. * Update the DB files	2020-10-30 17:52:09 -04:00
sarahcaseybot	8bd5eb4eca	Move CertificateChecker to core/ (#852 ) * Move CertificateChecker to core/ * rename certificates/ to certs/	2020-10-30 15:57:12 -04:00
Weimin Yu	83918e92b5	Sync the live folder after Nomulus rollback (#854 ) * Sync the live folder after Nomulus rollback To update the nomulus tool on corp desktop, the artifacts from the rollback target release should be copied to the 'live' folder. * Fix a test	2020-10-29 16:21:56 -04:00
Shicong Huang	5bba65835a	Change primary key of DelegationSignerData and add its history table (#841 ) * Change primary key of DelegationSignerData and add its history table * Change primary key and resolve comments * Rebase on HEAD	2020-10-29 16:19:15 -04:00
Shicong Huang	1e51f51979	Use TransactionManager APIs in DatastoreHelper (#849 ) * Make DatastoreHelper support Postgresql * Rebase on HEAD * Resolve comments * Use put* inside insert* and update* * Resolve comments	2020-10-29 11:41:04 -04:00
Weimin Yu	db2e896d42	An automated rollback tool for Nomulus (#847 ) * An automated rollback tool for Nomulus A tool that directs traffic between deployed versions. It handles the conversion between Nomulus tags and AppEngine versions, executes schema compatibility tests, ensures that steps are executed in the correct order, and updates deployment records appropriately.	2020-10-29 10:37:20 -04:00
Michael Muller	478064f32b	Add a test for ImmutableObject significant fields (#853 ) This should have been introduced in #846. Better late than never.	2020-10-28 11:11:42 -04:00
Shicong Huang	0db535b838	Add ER diagram links to db/README.md (#851 )	2020-10-28 10:13:39 -04:00
Shicong Huang	3705f37fab	Add a build task to upload ER diagrams to GCS (#844 ) * Add a build task to upload ER diagrams to GCS * Merge ER diagram task into cloudbuild-javadoc	2020-10-27 10:41:12 -04:00
Michael Muller	86bdd154bc	Restore ofy keys in GracePeriod objects (#846 ) * Restore ofy keys in GracePeriod objects Restore the ofy keys when loading GracePeriod object from SQL. There's no clear way to do this using the normal approach (fix-up during a PostLoad method) because fixups to these violate immutability after hibernate has already obtained their hash values. Instead, we force reconstitution of the ofy keys in all public methods that access them (including equals() and hashCode()) so that they can be generated before an invalid hash is generated. As part of this change, convert the GracePeriod id from an autogenerated sequence to a UUID allocated from ObjectifyService and enhance ImmutableObject to allow it to exclude certain fields from hash/equals and print. The ImmutableObject enhancements are necessary because we compare grace periods against locally created test objects in a number of unit tests and there's no way this can work with GracePeriods loaded from SQL currently, as they will have an identifier field generated from the database and the test objects will have an identifier field of null (or a new unique value, after this change). Removing autogeneration from GracePeriod ids ended up being likely not strictly necessary for this change (it was a consequence of an earlier iteration). However, it does alleviate the problem of mutation of an immutable object after creation and is more in line with how we've decided to allocate other identifiers. * Changed needed after rebase.	2020-10-26 13:38:14 -04:00
sarahcaseybot	576c05ff5f	Add certificate checks to RegistrarSettingsAction (#843 ) * Add certificate checks to RegistrarSettingsAction * Add some comments * Add more functionality to CertificateChecker and update call sites * Small code cleanups * Small format fix	2020-10-23 15:46:57 -04:00
gbrodman	f52e887db5	Create SQL schema for RdeRevision (#835 ) * Create SQL schema for RdeRevision * Split RdeRevision IDs into three separate DB fields as unified pkey * Rename variable * Merge remote-tracking branch 'origin/master' into rdeRevision * Rename variable in one other location * Implement no-op toDatastore/Sql for RdeRevision * Responses to CR * Merge remote-tracking branch 'origin/master' into rdeRevision * Use a date for the date column * Fix exception messages in tests * Regen diagram to fix the test * Use assignment in static factory methods * Merge remote-tracking branch 'origin/master' into rdeRevision	2020-10-23 13:14:07 -04:00
Weimin Yu	6ed286e3bc	Upgrade error-prone to 3.3.4 (#848 ) * Upgrade error-prone to 3.3.4 This would fix the failure with openjdk 11.0.9 in 3.3.3. Fixed new antipatterns raised by the new version: - Replaced unnecessary lambdas with methods. - Switched wait/sleep calls to equivalent methods using java.time types - Types inheriting Object.toString() should not be assigned to string parameter in logging statements.	2020-10-23 11:17:57 -04:00
sarahcaseybot	93d922af6f	Add certificate checks for create and update registrar commands (#837 ) * Add certificatechecks for create and update registrar commands * Add CertificateCheckerModule * Remove commented out code * Still tring to get dependency injection to work * Get this actually working * Add tests for multiple violations * Small formatting fixes * Rename configs and fix collectors * Add checks for failover client certificate * Fix formatting	2020-10-22 11:43:22 -04:00
gbrodman	0b73e9032c	Use a SQL date object for LocalDates (#842 ) * Use a SQL date object for LocalDates * Clean up comment	2020-10-20 15:44:23 -04:00
Shicong Huang	4d5d9700b8	Add a command to generate ER diagram for SQL schema (#839 ) * Add a command to generate ER diagram for SQL schema * Add graphviz as runtime dependency * Update ER diagrams for #838	2020-10-15 17:31:43 -04:00
Michael Muller	3534a146e4	Restore ofy keys in DomainTransferData (#838 ) * Restore ofy keys in DomainTransferData Restore composite VKeys correctly in DomainTransferData (they were previously missing their ofy keys). * Use "AlsoLoad" to populate history ids	2020-10-15 07:54:47 -04:00