Fix flyway invocation in Gradle script (#993 )

* Fix flyway invocation in Gradle script Script wrongly assumed that Flyway task is invoked if --environment is set. Bug was introduced in go/r3pr/940
Convert DomainTransferRejectFlow to use tm() methods (#977 )
2026-05-20 06:41:51 +00:00 · 2021-03-08 13:59:28 -05:00 · 2021-03-08 13:24:30 -05:00 · 2021-03-08 12:33:23 -05:00 · 2021-03-05 10:35:30 -05:00 · 2021-03-04 19:58:09 -05:00
397 changed files with 19739 additions and 13356 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -75,7 +75,7 @@ local.properties
 autogenerated/

 # IDEA
-nomulus.iml
+**/*.iml
 nomulus.ipr
 nomulus.iws

--- a/build.gradle
+++ b/build.gradle
@@ -40,7 +40,7 @@ plugins {
  id 'com.github.johnrengelman.shadow' version '5.1.0'

  // NodeJs plugin
-  id "com.moowork.node" version "1.2.0"
+  id "com.github.node-gradle.node" version "3.0.1"

  id 'idea'
  id 'com.diffplug.gradle.spotless' version '3.25.0'
@@ -49,6 +49,12 @@ plugins {
  id 'com.dorongold.task-tree' version '1.5'
 }

+node {
+  download = true
+  version = "14.15.5"
+  npmVersion = "6.14.11"
+}
+
 wrapper {
  distributionType = Wrapper.DistributionType.ALL
 }
@@ -115,7 +121,7 @@ task stage {
 // App-engine environment configuration.  We set up all of the variables in
 // the root project.

-def environments = ['production', 'sandbox', 'alpha', 'crash']
+def environments = ['production', 'sandbox', 'alpha', 'crash', 'qa']

 def gcpProject = null

@@ -149,7 +155,7 @@ def verifyDeploymentParams() {
        System.err.println('-----------------------------------------------------------------')
        throw new GradleException('Aborting. See prominent error above.')
    } else if (gcpProject == null) {
-        def error = 'You must specify -P environment={alpha,crash}'
+        def error = 'You must specify -P environment={alpha,crash,qa}'
        System.err.println("\033[33;1m${error}\033[0m")
        throw GradleException("Aborting:  ${error}")
    }
--- a/buildSrc/build.gradle
+++ b/buildSrc/build.gradle
@@ -71,12 +71,13 @@ dependencies {
  def deps = dependencyMap
  compile deps['com.google.auth:google-auth-library-credentials']
  compile deps['com.google.auth:google-auth-library-oauth2-http']
-  compile deps['com.google.cloud:google-cloud-core']
-  compile deps['com.google.guava:guava']
  compile deps['com.google.auto.value:auto-value-annotations']
+  compile deps['com.google.cloud:google-cloud-core']
  compile deps['com.google.cloud:google-cloud-storage']
-  compile deps['org.apache.commons:commons-text']
+  compile deps['com.google.guava:guava']
+  compile deps['com.google.protobuf:protobuf-java']
  compile deps['com.google.template:soy']
+  compile deps['org.apache.commons:commons-text']
  annotationProcessor deps['com.google.auto.value:auto-value']
  testCompile deps['com.google.truth:truth']
  testCompile deps['com.google.truth.extensions:truth-java8-extension']
--- a/buildSrc/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/buildSrc/gradle/dependency-locks/annotationProcessor.lockfile
@@ -3,7 +3,7 @@
 # This file is expected to be part of source control.
 com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.google.auto.value:auto-value:1.6.3
+com.google.auto.value:auto-value:1.7.4
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
--- a/buildSrc/gradle/dependency-locks/checkstyle.lockfile
+++ b/buildSrc/gradle/dependency-locks/checkstyle.lockfile
@@ -3,16 +3,17 @@
 # This file is expected to be part of source control.
 antlr:antlr:2.7.7
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
-com.puppycrawl.tools:checkstyle:8.27
+com.puppycrawl.tools:checkstyle:8.37
 commons-beanutils:commons-beanutils:1.9.4
 commons-collections:commons-collections:3.2.2
-info.picocli:picocli:4.1.1
-net.sf.saxon:Saxon-HE:9.9.1-5
-org.antlr:antlr4-runtime:4.7.2
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+info.picocli:picocli:4.5.2
+net.sf.saxon:Saxon-HE:10.3
+org.antlr:antlr4-runtime:4.8-1
+org.checkerframework:checker-qual:2.11.1
+org.javassist:javassist:3.26.0-GA
+org.reflections:reflections:0.9.12
--- a/buildSrc/gradle/dependency-locks/compile.lockfile
+++ b/buildSrc/gradle/dependency-locks/compile.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.ibm.icu:icu4j:57.1
 commons-codec:commons-codec:1.11
--- a/buildSrc/gradle/dependency-locks/compileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/compileClasspath.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.ibm.icu:icu4j:57.1
 commons-codec:commons-codec:1.11
--- a/buildSrc/gradle/dependency-locks/deploy_jar.lockfile
+++ b/buildSrc/gradle/dependency-locks/deploy_jar.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.ibm.icu:icu4j:57.1
 commons-codec:commons-codec:1.11
--- a/buildSrc/gradle/dependency-locks/jacocoAgent.lockfile
+++ b/buildSrc/gradle/dependency-locks/jacocoAgent.lockfile
@@ -1,4 +1,4 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-org.jacoco:org.jacoco.agent:0.8.5
+org.jacoco:org.jacoco.agent:0.8.6
--- a/buildSrc/gradle/dependency-locks/jacocoAnt.lockfile
+++ b/buildSrc/gradle/dependency-locks/jacocoAnt.lockfile
@@ -1,11 +1,11 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-org.jacoco:org.jacoco.agent:0.8.5
-org.jacoco:org.jacoco.ant:0.8.5
-org.jacoco:org.jacoco.core:0.8.5
-org.jacoco:org.jacoco.report:0.8.5
-org.ow2.asm:asm-analysis:7.2
-org.ow2.asm:asm-commons:7.2
-org.ow2.asm:asm-tree:7.2
-org.ow2.asm:asm:7.2
+org.jacoco:org.jacoco.agent:0.8.6
+org.jacoco:org.jacoco.ant:0.8.6
+org.jacoco:org.jacoco.core:0.8.6
+org.jacoco:org.jacoco.report:0.8.6
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:8.0.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm:8.0.1
--- a/buildSrc/gradle/dependency-locks/runtime.lockfile
+++ b/buildSrc/gradle/dependency-locks/runtime.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.ibm.icu:icu4j:57.1
 commons-codec:commons-codec:1.11
--- a/buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.ibm.icu:icu4j:57.1
 commons-codec:commons-codec:1.11
--- a/buildSrc/gradle/dependency-locks/testCompile.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompile.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
 com.google.truth:truth:1.0
@@ -50,8 +50,8 @@ javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
 junit:junit:4.12
-net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.5
+net.bytebuddy:byte-buddy-agent:1.10.19
+net.bytebuddy:byte-buddy:1.10.19
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
@@ -66,8 +66,8 @@ org.junit.jupiter:junit-jupiter-engine:5.6.2
 org.junit.platform:junit-platform-commons:1.6.2
 org.junit.platform:junit-platform-engine:1.6.2
 org.junit:junit-bom:5.6.2
-org.mockito:mockito-core:3.3.3
-org.objenesis:objenesis:2.6
+org.mockito:mockito-core:3.7.7
+org.objenesis:objenesis:3.1
 org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
 com.google.truth:truth:1.0
@@ -50,8 +50,8 @@ javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
 junit:junit:4.12
-net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.5
+net.bytebuddy:byte-buddy-agent:1.10.19
+net.bytebuddy:byte-buddy:1.10.19
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
@@ -66,8 +66,8 @@ org.junit.jupiter:junit-jupiter-engine:5.6.2
 org.junit.platform:junit-platform-commons:1.6.2
 org.junit.platform:junit-platform-engine:1.6.2
 org.junit:junit-bom:5.6.2
-org.mockito:mockito-core:3.3.3
-org.objenesis:objenesis:2.6
+org.mockito:mockito-core:3.7.7
+org.objenesis:objenesis:3.1
 org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/testRuntime.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntime.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
 com.google.truth:truth:1.0
@@ -50,8 +50,8 @@ javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
 junit:junit:4.12
-net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.5
+net.bytebuddy:byte-buddy-agent:1.10.19
+net.bytebuddy:byte-buddy:1.10.19
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
@@ -66,8 +66,8 @@ org.junit.jupiter:junit-jupiter-engine:5.6.2
 org.junit.platform:junit-platform-commons:1.6.2
 org.junit.platform:junit-platform-engine:1.6.2
 org.junit:junit-bom:5.6.2
-org.mockito:mockito-core:3.3.3
-org.objenesis:objenesis:2.6
+org.mockito:mockito-core:3.7.7
+org.objenesis:objenesis:3.1
 org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
 com.google.truth:truth:1.0
@@ -50,8 +50,8 @@ javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
 junit:junit:4.12
-net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.5
+net.bytebuddy:byte-buddy-agent:1.10.19
+net.bytebuddy:byte-buddy:1.10.19
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
@@ -66,8 +66,8 @@ org.junit.jupiter:junit-jupiter-engine:5.6.2
 org.junit.platform:junit-platform-commons:1.6.2
 org.junit.platform:junit-platform-engine:1.6.2
 org.junit:junit-bom:5.6.2
-org.mockito:mockito-core:3.3.3
-org.objenesis:objenesis:2.6
+org.mockito:mockito-core:3.7.7
+org.objenesis:objenesis:3.1
 org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/src/test/resources/mockito-extensions/org.mockito.plugins.MockMaker
+++ b/buildSrc/src/test/resources/mockito-extensions/org.mockito.plugins.MockMaker
@@ -0,0 +1 @@
+mock-maker-inline
--- a/common/gradle/dependency-locks/checkstyle.lockfile
+++ b/common/gradle/dependency-locks/checkstyle.lockfile
@@ -3,16 +3,17 @@
 # This file is expected to be part of source control.
 antlr:antlr:2.7.7
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
-com.puppycrawl.tools:checkstyle:8.27
+com.puppycrawl.tools:checkstyle:8.37
 commons-beanutils:commons-beanutils:1.9.4
 commons-collections:commons-collections:3.2.2
-info.picocli:picocli:4.1.1
-net.sf.saxon:Saxon-HE:9.9.1-5
-org.antlr:antlr4-runtime:4.7.2
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+info.picocli:picocli:4.5.2
+net.sf.saxon:Saxon-HE:10.3
+org.antlr:antlr4-runtime:4.8-1
+org.checkerframework:checker-qual:2.11.1
+org.javassist:javassist:3.26.0-GA
+org.reflections:reflections:0.9.12
--- a/common/gradle/dependency-locks/compile.lockfile
+++ b/common/gradle/dependency-locks/compile.lockfile
@@ -4,7 +4,7 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
--- a/common/gradle/dependency-locks/compileClasspath.lockfile
+++ b/common/gradle/dependency-locks/compileClasspath.lockfile
@@ -4,7 +4,7 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
--- a/common/gradle/dependency-locks/default.lockfile
+++ b/common/gradle/dependency-locks/default.lockfile
@@ -4,7 +4,7 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
--- a/common/gradle/dependency-locks/deploy_jar.lockfile
+++ b/common/gradle/dependency-locks/deploy_jar.lockfile
@@ -4,7 +4,7 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
--- a/common/gradle/dependency-locks/jacocoAgent.lockfile
+++ b/common/gradle/dependency-locks/jacocoAgent.lockfile
@@ -1,4 +1,4 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-org.jacoco:org.jacoco.agent:0.8.5
+org.jacoco:org.jacoco.agent:0.8.6
--- a/common/gradle/dependency-locks/jacocoAnt.lockfile
+++ b/common/gradle/dependency-locks/jacocoAnt.lockfile
@@ -1,11 +1,11 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-org.jacoco:org.jacoco.agent:0.8.5
-org.jacoco:org.jacoco.ant:0.8.5
-org.jacoco:org.jacoco.core:0.8.5
-org.jacoco:org.jacoco.report:0.8.5
-org.ow2.asm:asm-analysis:7.2
-org.ow2.asm:asm-commons:7.2
-org.ow2.asm:asm-tree:7.2
-org.ow2.asm:asm:7.2
+org.jacoco:org.jacoco.agent:0.8.6
+org.jacoco:org.jacoco.ant:0.8.6
+org.jacoco:org.jacoco.core:0.8.6
+org.jacoco:org.jacoco.report:0.8.6
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:8.0.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm:8.0.1
--- a/common/gradle/dependency-locks/runtime.lockfile
+++ b/common/gradle/dependency-locks/runtime.lockfile
@@ -4,7 +4,7 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
--- a/common/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -4,7 +4,7 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
--- a/common/gradle/dependency-locks/testCompile.lockfile
+++ b/common/gradle/dependency-locks/testCompile.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
--- a/common/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/common/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
--- a/common/gradle/dependency-locks/testRuntime.lockfile
+++ b/common/gradle/dependency-locks/testRuntime.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
--- a/common/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
--- a/common/gradle/dependency-locks/testingCompile.lockfile
+++ b/common/gradle/dependency-locks/testingCompile.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
--- a/common/gradle/dependency-locks/testingCompileClasspath.lockfile
+++ b/common/gradle/dependency-locks/testingCompileClasspath.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
--- a/common/gradle/dependency-locks/testingRuntime.lockfile
+++ b/common/gradle/dependency-locks/testingRuntime.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
--- a/common/gradle/dependency-locks/testingRuntimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/testingRuntimeClasspath.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
--- a/config/dependency-license/allowed_licenses.json
+++ b/config/dependency-license/allowed_licenses.json
@@ -72,9 +72,15 @@
    {
      "moduleLicense": "The 3-Clause BSD License"
    },
+    {
+      "moduleLicense": "BSD Licence 3"
+    },
    {
      "moduleLicense": "BSD License"
    },
+    {
+      "moduleLicense": "BSD License 3"
+    },
    {
      "moduleLicense": "BSD New License"
    },
@@ -230,6 +236,13 @@
      "moduleLicense": "Public Domain",
      "moduleName": "org.tukaani:xz"
    },
+    {
+      // "Apache License, Version 2.0". The plugin is able to parse
+      // 2.11.3 correctly but not this version.
+      "moduleLicense": null,
+      "moduleVersion": "2.12.1",
+      "moduleName": "com.fasterxml.jackson:jackson-bom"
+    },
    {
      // Actually Eclipse Public License v2.0
      "moduleLicense": null,
--- a/config/nom_build.py
+++ b/config/nom_build.py
@@ -111,8 +111,9 @@ PROPERTIES = [

    # Cloud SQL properties
    Property('dbServer',
-             'A registry environment name (e.g., "alpha") or a host[:port] '
-             'string'),
+             'Sets the target database of a Flyway task. This may be a '
+             'registry environment name (e.g., alpha) or the host[:port] '
+             'of a database that accepts direct IP access.'),
    Property('dbName',
             'Database name to use in connection.',
             'postgres'),
--- a/config/presubmits.py
+++ b/config/presubmits.py
@@ -23,7 +23,7 @@ import sys
 import re

 # We should never analyze any generated files
-UNIVERSALLY_SKIPPED_PATTERNS = {"/build/", "cloudbuild-caches", "/out/", ".git/"}
+UNIVERSALLY_SKIPPED_PATTERNS = {"/build/", "cloudbuild-caches", "/out/", ".git/", ".gradle/"}
 # We can't rely on CI to have the Enum package installed so we do this instead.
 FORBIDDEN = 1
 REQUIRED = 2
@@ -176,7 +176,47 @@ PRESUBMITS = {
        "js",
        {"/node_modules/", "google/registry/ui/js/util.js", "registrar_bin."},
    ):
-        "JavaScript files should not include console logging."
+        "JavaScript files should not include console logging.",
+    # SQL injection protection rule for java source file:
+    # The sql template passed to createQuery/createNativeQuery methods must be
+    # a variable name in UPPER_CASE_UNDERSCORE format, i.e., a static final
+    # String variable. This forces the use of parameter-binding on all queries
+    # that take parameters.
+    # The rule would forbid invocation of createQuery(Criteria). However, this
+    # can be handled by adding a helper method in an exempted class to make
+    # the calls.
+    # TODO(b/179158393): enable the 'ConstantName' Java style check to ensure
+    # that non-final variables do not use the UPPER_CASE_UNDERSCORE format.
+    PresubmitCheck(
+        # Line 1: the method names we check and the opening parenthesis, which
+        #    marks the beginning of the first parameter
+        # Line 2: The first parameter is a match if is NOT any of the following:
+        #    - final variable name: \s*([A-Z_]+
+        #    - string literal: "([^"]|\\")*"
+        #    - concatenation of literals: (\s*\+\s*"([^"]|\\")*")*
+        # Line 3: , or the closing parenthesis, marking the end of the first
+        #    parameter
+        r'.*\.create(Native)?Query\('
+        r'(?!(\s*([A-Z_]+|"([^"]|\\")*"(\s*\+\s*"([^"]|\\")*")*)'
+        r'(,|\s*\))))',
+        "java",
+        # ActivityReportingQueryBuilder deals with Dremel queries
+        {"src/test", "ActivityReportingQueryBuilder.java",
+         # TODO(b/179158393): Remove everything below, which should be done
+         # using Criteria
+         "ForeignKeyIndex.java",
+         "HistoryEntryDao.java",
+         "JpaTransactionManagerImpl.java",
+         # CriteriaQueryBuilder is a false positive
+         "CriteriaQueryBuilder.java",
+         "RdapSearchActionBase.java",
+         },
+    ):
+        "The first String parameter to EntityManager.create(Native)Query "
+        "methods must be one of the following:\n"
+        "  - A String literal\n"
+        "  - Concatenation of String literals only\n"
+        "  - The name of a static final String variable"
 }

 # Note that this regex only works for one kind of Flyway file.  If we want to
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -76,6 +76,9 @@ def fragileTestPatterns = [
    "google/registry/model/tmch/ClaimsListShardTest.*",
    // Creates large object (64MBytes), occasionally throws OOM error.
    "google/registry/model/server/KmsSecretRevisionTest.*",
+    // Changes cache timeouts and for some reason appears to have contention
+    // with other tests.
+    "google/registry/whois/WhoisCommandFactoryTest.*",
 ] + dockerIncompatibleTestPatterns

 sourceSets {
@@ -172,6 +175,8 @@ dependencies {

  compile deps['com.beust:jcommander']
  compile deps['com.google.api:gax']
+  compile deps['com.google.api.grpc:proto-google-cloud-datastore-v1']
+  compile deps['com.google.api.grpc:proto-google-common-protos']
  compile deps['com.google.api.grpc:proto-google-cloud-secretmanager-v1']
  compile deps['com.google.api-client:google-api-client']
  compile deps['com.google.api-client:google-api-client-appengine']
@@ -196,10 +201,13 @@ dependencies {
  compile deps['com.google.appengine:appengine-remote-api']
  compile deps['com.google.auth:google-auth-library-credentials']
  compile deps['com.google.auth:google-auth-library-oauth2-http']
+  compile deps['com.google.cloud.bigdataoss:util']
+  compile deps['com.google.cloud.datastore:datastore-v1-proto-client']
  compile deps['com.google.cloud.sql:jdbc-socket-factory-core']
  runtimeOnly deps['com.google.cloud.sql:postgres-socket-factory']
  compile deps['com.google.cloud:google-cloud-secretmanager']
  compile deps['com.google.code.gson:gson']
+  compile deps['com.google.auto.service:auto-service-annotations']
  compile deps['com.google.auto.value:auto-value-annotations']
  compile deps['com.google.code.findbugs:jsr305']
  compile deps['com.google.dagger:dagger']
@@ -296,11 +304,7 @@ dependencies {
  compile project(path: ':db', configuration: 'compileApi')
  testRuntime project(':db')

-  // Include auto-value in compile until nebula-lint understands
-  // annotationProcessor
-  gradleLint.ignore('unused-dependency') {
-    compile deps['com.google.auto.value:auto-value']
-  }
+  annotationProcessor deps['com.google.auto.service:auto-service']
  annotationProcessor deps['com.google.auto.value:auto-value']
  testAnnotationProcessor deps['com.google.auto.value:auto-value']
  annotationProcessor deps['com.google.dagger:dagger-compiler']
@@ -313,7 +317,7 @@ dependencies {
  testCompile deps['com.google.monitoring-client:contrib']
  testCompile deps['com.google.truth:truth']
  testCompile deps['com.google.truth.extensions:truth-java8-extension']
-  testCompile deps['org.hamcrest:hamcrest-all']
+  testCompile deps['org.hamcrest:hamcrest']
  testCompile deps['org.hamcrest:hamcrest-core']
  testCompile deps['org.hamcrest:hamcrest-library']
  testCompile deps['junit:junit']
@@ -343,6 +347,8 @@ dependencies {
  jaxb deps['com.sun.xml.bind:jaxb-osgi']

  // Dependency needed for soy to java compilation.
+  soy deps['com.google.inject:guice']
+  soy deps['com.google.protobuf:protobuf-java']
  soy deps['com.google.template:soy']

  // Dependencies needed for compiling stylesheets to javascript
@@ -712,6 +718,10 @@ createToolTask(
    'google.registry.tools.DevTool',
    sourceSets.nonprod)

+
+createToolTask(
+        'jpaDemoPipeline', 'google.registry.beam.common.JpaDemoPipeline')
+
 project.tasks.create('initSqlPipeline', JavaExec) {
  main = 'google.registry.beam.initsql.InitSqlPipeline'

@@ -736,6 +746,13 @@ project.tasks.create('initSqlPipeline', JavaExec) {
  }
 }

+// Caller must provide projectId, GCP region, runner, and the kinds to delete
+// (comma-separated kind names or '*' for all). E.g.:
+// nom_build :core:bulkDeleteDatastore --args="--project=domain-registry-crash \
+//     --region=us-central1 --runner=DataflowRunner --kindsToDelete=*"
+createToolTask(
+    'bulkDeleteDatastore', 'google.registry.beam.datastore.BulkDeletePipeline')
+
 project.tasks.create('generateSqlSchema', JavaExec) {
  classpath = sourceSets.nonprod.runtimeClasspath
  main = 'google.registry.tools.DevTool'
--- a/core/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/annotationProcessor.lockfile
@@ -3,7 +3,9 @@
 # This file is expected to be part of source control.
 com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.google.auto.value:auto-value:1.6.3
+com.google.auto.service:auto-service-annotations:1.0-rc7
+com.google.auto.service:auto-service:1.0-rc7
+com.google.auto.value:auto-value:1.7.4
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
@@ -19,7 +21,7 @@ com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.errorprone:javac-shaded:9-dev-r4023-3
 com.google.googlejavaformat:google-java-format:1.5
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.protobuf:protobuf-java:3.4.0
--- a/core/gradle/dependency-locks/checkstyle.lockfile
+++ b/core/gradle/dependency-locks/checkstyle.lockfile
@@ -3,16 +3,17 @@
 # This file is expected to be part of source control.
 antlr:antlr:2.7.7
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
-com.puppycrawl.tools:checkstyle:8.27
+com.puppycrawl.tools:checkstyle:8.37
 commons-beanutils:commons-beanutils:1.9.4
 commons-collections:commons-collections:3.2.2
-info.picocli:picocli:4.1.1
-net.sf.saxon:Saxon-HE:9.9.1-5
-org.antlr:antlr4-runtime:4.7.2
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+info.picocli:picocli:4.5.2
+net.sf.saxon:Saxon-HE:10.3
+org.antlr:antlr4-runtime:4.8-1
+org.checkerframework:checker-qual:2.11.1
+org.javassist:javassist:3.26.0-GA
+org.reflections:reflections:0.9.12
--- a/core/gradle/dependency-locks/compile.lockfile
+++ b/core/gradle/dependency-locks/compile.lockfile
@@ -6,10 +6,14 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -18,90 +22,103 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -109,56 +126,49 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -178,27 +188,26 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.12
+junit:junit:4.13.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.13
@@ -208,17 +217,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-core:1.3
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -226,9 +236,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -242,14 +251,12 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/compileClasspath.lockfile
+++ b/core/gradle/dependency-locks/compileClasspath.lockfile
@@ -6,10 +6,14 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -18,88 +22,101 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -107,56 +124,47 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -176,25 +184,24 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.13
@@ -204,15 +211,17 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -220,9 +229,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -236,14 +244,12 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/default.lockfile
+++ b/core/gradle/dependency-locks/default.lockfile
@@ -10,10 +10,14 @@ com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -22,91 +26,104 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud.sql:postgres-socket-factory:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -114,27 +131,23 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 guru.nidi.com.kitfox:svgSalamander:1.1.3
@@ -142,31 +155,28 @@ guru.nidi:graphviz-java-all-j2v8:0.17.0
 guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -186,28 +196,27 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.12
+junit:junit:4.13.1
 net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
@@ -219,17 +228,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-core:1.3
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -237,9 +247,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -253,17 +262,15 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:jcl-over-slf4j:1.7.30
 org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.webjars.npm:viz.js-for-graphviz-java:2.1.3
--- a/core/gradle/dependency-locks/deploy_jar.lockfile
+++ b/core/gradle/dependency-locks/deploy_jar.lockfile
@@ -10,10 +10,14 @@ com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -22,91 +26,104 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud.sql:postgres-socket-factory:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -114,27 +131,23 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 guru.nidi.com.kitfox:svgSalamander:1.1.3
@@ -142,31 +155,28 @@ guru.nidi:graphviz-java-all-j2v8:0.17.0
 guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -188,25 +198,24 @@ jline:jline:1.0
 joda-time:joda-time:2.10.5
 net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
@@ -218,16 +227,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -235,9 +246,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -251,17 +261,15 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:jcl-over-slf4j:1.7.30
 org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.webjars.npm:viz.js-for-graphviz-java:2.1.3
--- a/core/gradle/dependency-locks/jacocoAgent.lockfile
+++ b/core/gradle/dependency-locks/jacocoAgent.lockfile
@@ -1,4 +1,4 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-org.jacoco:org.jacoco.agent:0.8.5
+org.jacoco:org.jacoco.agent:0.8.6
--- a/core/gradle/dependency-locks/jacocoAnt.lockfile
+++ b/core/gradle/dependency-locks/jacocoAnt.lockfile
@@ -1,11 +1,11 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-org.jacoco:org.jacoco.agent:0.8.5
-org.jacoco:org.jacoco.ant:0.8.5
-org.jacoco:org.jacoco.core:0.8.5
-org.jacoco:org.jacoco.report:0.8.5
-org.ow2.asm:asm-analysis:7.2
-org.ow2.asm:asm-commons:7.2
-org.ow2.asm:asm-tree:7.2
-org.ow2.asm:asm:7.2
+org.jacoco:org.jacoco.agent:0.8.6
+org.jacoco:org.jacoco.ant:0.8.6
+org.jacoco:org.jacoco.core:0.8.6
+org.jacoco:org.jacoco.report:0.8.6
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:8.0.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm:8.0.1
--- a/core/gradle/dependency-locks/nonprodCompile.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompile.lockfile
@@ -6,10 +6,14 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -18,90 +22,103 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -109,56 +126,49 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -178,27 +188,26 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.12
+junit:junit:4.13.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.13
@@ -208,17 +217,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-core:1.3
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -226,9 +236,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -242,14 +251,12 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/nonprodCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompileClasspath.lockfile
@@ -6,10 +6,14 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -18,88 +22,101 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -107,56 +124,47 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -175,27 +183,26 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.12
+junit:junit:4.13.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.13
@@ -205,16 +212,17 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-core:1.3
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -222,9 +230,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -238,14 +245,12 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/nonprodRuntime.lockfile
+++ b/core/gradle/dependency-locks/nonprodRuntime.lockfile
@@ -10,10 +10,14 @@ com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -22,90 +26,103 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -113,27 +130,23 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 guru.nidi.com.kitfox:svgSalamander:1.1.3
@@ -141,31 +154,28 @@ guru.nidi:graphviz-java-all-j2v8:0.17.0
 guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -185,28 +195,27 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.12
+junit:junit:4.13.1
 net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
@@ -218,17 +227,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-core:1.3
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -236,9 +246,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -252,16 +261,14 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:jcl-over-slf4j:1.7.30
 org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.webjars.npm:viz.js-for-graphviz-java:2.1.3
--- a/core/gradle/dependency-locks/nonprodRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/nonprodRuntimeClasspath.lockfile
@@ -10,10 +10,14 @@ com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -22,90 +26,103 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -113,27 +130,23 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 guru.nidi.com.kitfox:svgSalamander:1.1.3
@@ -141,31 +154,28 @@ guru.nidi:graphviz-java-all-j2v8:0.17.0
 guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -185,28 +195,27 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.12
+junit:junit:4.13.1
 net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
@@ -218,17 +227,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-core:1.3
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -236,9 +246,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -252,16 +261,14 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:jcl-over-slf4j:1.7.30
 org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.webjars.npm:viz.js-for-graphviz-java:2.1.3
--- a/core/gradle/dependency-locks/runtime.lockfile
+++ b/core/gradle/dependency-locks/runtime.lockfile
@@ -10,10 +10,14 @@ com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -22,90 +26,103 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -113,27 +130,23 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 guru.nidi.com.kitfox:svgSalamander:1.1.3
@@ -141,31 +154,28 @@ guru.nidi:graphviz-java-all-j2v8:0.17.0
 guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -185,28 +195,27 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.12
+junit:junit:4.13.1
 net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
@@ -218,17 +227,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-core:1.3
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -236,9 +246,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -252,16 +261,14 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:jcl-over-slf4j:1.7.30
 org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.webjars.npm:viz.js-for-graphviz-java:2.1.3
--- a/core/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -10,10 +10,14 @@ com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -22,91 +26,104 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud.sql:postgres-socket-factory:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -114,27 +131,23 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 guru.nidi.com.kitfox:svgSalamander:1.1.3
@@ -142,31 +155,28 @@ guru.nidi:graphviz-java-all-j2v8:0.17.0
 guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -188,25 +198,24 @@ jline:jline:1.0
 joda-time:joda-time:2.10.5
 net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
@@ -218,16 +227,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -235,9 +246,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -251,17 +261,15 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:jcl-over-slf4j:1.7.30
 org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.webjars.npm:viz.js-for-graphviz-java:2.1.3
--- a/core/gradle/dependency-locks/soy.lockfile
+++ b/core/gradle/dependency-locks/soy.lockfile
@@ -3,19 +3,24 @@
 # This file is expected to be part of source control.
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
-com.google.code.findbugs:jsr305:2.0.3
+com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.guava:guava:21.0
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:30.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.inject.extensions:guice-multibindings:4.1.0
-com.google.inject:guice:4.1.0
-com.google.protobuf:protobuf-java:3.3.0
+com.google.inject:guice:5.0.1
+com.google.j2objc:j2objc-annotations:1.3
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.ibm.icu:icu4j:57.1
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/core/gradle/dependency-locks/testAnnotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/testAnnotationProcessor.lockfile
@@ -3,7 +3,7 @@
 # This file is expected to be part of source control.
 com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.google.auto.value:auto-value:1.6.3
+com.google.auto.value:auto-value:1.7.4
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
@@ -19,7 +19,7 @@ com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.errorprone:javac-shaded:9-dev-r4023-3
 com.google.googlejavaformat:google-java-format:1.5
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.protobuf:protobuf-java:3.4.0
--- a/core/gradle/dependency-locks/testCompile.lockfile
+++ b/core/gradle/dependency-locks/testCompile.lockfile
@@ -6,10 +6,14 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.11.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -18,51 +22,61 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
@@ -70,40 +84,43 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:30.0-jre
-com.google.guava:guava:30.0-jre
+com.google.guava:guava-testlib:30.1-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -112,12 +129,12 @@ com.google.monitoring-client:contrib:1.0.7
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -127,46 +144,40 @@ com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp3:okhttp:3.11.0
-com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.14.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -186,29 +197,28 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.13
-net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
+junit:junit:4.13.1
+net.bytebuddy:byte-buddy-agent:1.10.19
+net.bytebuddy:byte-buddy:1.10.19
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-direct-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-direct-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
@@ -228,19 +238,19 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-all:1.3
-org.hamcrest:hamcrest-core:1.3
-org.hamcrest:hamcrest-library:1.3
+org.hamcrest:hamcrest-core:2.2
+org.hamcrest:hamcrest-library:2.2
+org.hamcrest:hamcrest:2.2
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -248,27 +258,26 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
-org.junit.jupiter:junit-jupiter-api:5.6.2
-org.junit.jupiter:junit-jupiter-engine:5.6.2
-org.junit.jupiter:junit-jupiter-migrationsupport:5.6.2
-org.junit.jupiter:junit-jupiter-params:5.6.2
-org.junit.platform:junit-platform-commons:1.6.2
-org.junit.platform:junit-platform-engine:1.6.2
-org.junit.platform:junit-platform-launcher:1.6.2
-org.junit.platform:junit-platform-runner:1.6.2
-org.junit.platform:junit-platform-suite-api:1.6.2
-org.junit:junit-bom:5.6.2
+org.junit.jupiter:junit-jupiter-api:5.7.0
+org.junit.jupiter:junit-jupiter-engine:5.7.0
+org.junit.jupiter:junit-jupiter-migrationsupport:5.7.0
+org.junit.jupiter:junit-jupiter-params:5.7.0
+org.junit.platform:junit-platform-commons:1.7.0
+org.junit.platform:junit-platform-engine:1.7.0
+org.junit.platform:junit-platform-launcher:1.7.0
+org.junit.platform:junit-platform-runner:1.7.0
+org.junit.platform:junit-platform-suite-api:1.7.0
+org.junit:junit-bom:5.7.0
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:3.3.3
-org.mockito:mockito-junit-jupiter:3.3.3
+org.mockito:mockito-core:3.7.7
+org.mockito:mockito-junit-jupiter:3.7.7
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
-org.objenesis:objenesis:2.6
+org.objenesis:objenesis:3.1
 org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:8.0.1
 org.ow2.asm:asm-commons:7.1
@@ -278,8 +287,6 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.seleniumhq.selenium:selenium-api:3.141.59
 org.seleniumhq.selenium:selenium-chrome-driver:3.141.59
 org.seleniumhq.selenium:selenium-edge-driver:3.141.59
@@ -291,13 +298,13 @@ org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:junit-jupiter:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:selenium:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:junit-jupiter:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:selenium:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -6,10 +6,14 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.11.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -18,50 +22,60 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
@@ -69,39 +83,42 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:30.0-jre
-com.google.guava:guava:30.0-jre
+com.google.guava:guava-testlib:30.1-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,12 +127,12 @@ com.google.monitoring-client:contrib:1.0.7
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -125,46 +142,38 @@ com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp3:okhttp:3.11.0
-com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.14.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -183,29 +192,28 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.13
-net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
+junit:junit:4.13.1
+net.bytebuddy:byte-buddy-agent:1.10.19
+net.bytebuddy:byte-buddy:1.10.19
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-direct-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-direct-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
@@ -225,18 +233,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-all:1.3
-org.hamcrest:hamcrest-core:1.3
-org.hamcrest:hamcrest-library:1.3
+org.hamcrest:hamcrest-core:2.2
+org.hamcrest:hamcrest-library:2.2
+org.hamcrest:hamcrest:2.2
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -244,27 +252,26 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
-org.junit.jupiter:junit-jupiter-api:5.6.2
-org.junit.jupiter:junit-jupiter-engine:5.6.2
-org.junit.jupiter:junit-jupiter-migrationsupport:5.6.2
-org.junit.jupiter:junit-jupiter-params:5.6.2
-org.junit.platform:junit-platform-commons:1.6.2
-org.junit.platform:junit-platform-engine:1.6.2
-org.junit.platform:junit-platform-launcher:1.6.2
-org.junit.platform:junit-platform-runner:1.6.2
-org.junit.platform:junit-platform-suite-api:1.6.2
-org.junit:junit-bom:5.6.2
+org.junit.jupiter:junit-jupiter-api:5.7.0
+org.junit.jupiter:junit-jupiter-engine:5.7.0
+org.junit.jupiter:junit-jupiter-migrationsupport:5.7.0
+org.junit.jupiter:junit-jupiter-params:5.7.0
+org.junit.platform:junit-platform-commons:1.7.0
+org.junit.platform:junit-platform-engine:1.7.0
+org.junit.platform:junit-platform-launcher:1.7.0
+org.junit.platform:junit-platform-runner:1.7.0
+org.junit.platform:junit-platform-suite-api:1.7.0
+org.junit:junit-bom:5.7.0
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:3.3.3
-org.mockito:mockito-junit-jupiter:3.3.3
+org.mockito:mockito-core:3.7.7
+org.mockito:mockito-junit-jupiter:3.7.7
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
-org.objenesis:objenesis:2.6
+org.objenesis:objenesis:3.1
 org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:8.0.1
 org.ow2.asm:asm-commons:7.1
@@ -274,8 +281,6 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.seleniumhq.selenium:selenium-api:3.141.59
 org.seleniumhq.selenium:selenium-chrome-driver:3.141.59
 org.seleniumhq.selenium:selenium-edge-driver:3.141.59
@@ -287,13 +292,13 @@ org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:junit-jupiter:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:selenium:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:junit-jupiter:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:selenium:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/testRuntime.lockfile
+++ b/core/gradle/dependency-locks/testRuntime.lockfile
@@ -10,10 +10,14 @@ com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
-com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.11.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -22,51 +26,61 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
@@ -74,41 +88,44 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud.sql:postgres-socket-factory:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:30.0-jre
-com.google.guava:guava:30.0-jre
+com.google.guava:guava-testlib:30.1-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -117,12 +134,12 @@ com.google.monitoring-client:contrib:1.0.7
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -132,17 +149,14 @@ com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp3:okhttp:3.11.0
-com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.14.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 guru.nidi.com.kitfox:svgSalamander:1.1.3
@@ -151,31 +165,28 @@ guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.github.java-diff-utils:java-diff-utils:4.0
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -195,30 +206,29 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.13
+junit:junit:4.13.1
 net.arnx:nashorn-promise:0.1.1
-net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
+net.bytebuddy:byte-buddy-agent:1.10.19
+net.bytebuddy:byte-buddy:1.10.19
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-direct-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-direct-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
@@ -239,20 +249,20 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-all:1.3
-org.hamcrest:hamcrest-core:1.3
-org.hamcrest:hamcrest-library:1.3
+org.hamcrest:hamcrest-core:2.2
+org.hamcrest:hamcrest-library:2.2
+org.hamcrest:hamcrest:2.2
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -260,27 +270,26 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
-org.junit.jupiter:junit-jupiter-api:5.6.2
-org.junit.jupiter:junit-jupiter-engine:5.6.2
-org.junit.jupiter:junit-jupiter-migrationsupport:5.6.2
-org.junit.jupiter:junit-jupiter-params:5.6.2
-org.junit.platform:junit-platform-commons:1.6.2
-org.junit.platform:junit-platform-engine:1.6.2
-org.junit.platform:junit-platform-launcher:1.6.2
-org.junit.platform:junit-platform-runner:1.6.2
-org.junit.platform:junit-platform-suite-api:1.6.2
-org.junit:junit-bom:5.6.2
+org.junit.jupiter:junit-jupiter-api:5.7.0
+org.junit.jupiter:junit-jupiter-engine:5.7.0
+org.junit.jupiter:junit-jupiter-migrationsupport:5.7.0
+org.junit.jupiter:junit-jupiter-params:5.7.0
+org.junit.platform:junit-platform-commons:1.7.0
+org.junit.platform:junit-platform-engine:1.7.0
+org.junit.platform:junit-platform-launcher:1.7.0
+org.junit.platform:junit-platform-runner:1.7.0
+org.junit.platform:junit-platform-suite-api:1.7.0
+org.junit:junit-bom:5.7.0
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:3.3.3
-org.mockito:mockito-junit-jupiter:3.3.3
+org.mockito:mockito-core:3.7.7
+org.mockito:mockito-junit-jupiter:3.7.7
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
-org.objenesis:objenesis:2.6
+org.objenesis:objenesis:3.1
 org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:8.0.1
 org.ow2.asm:asm-commons:7.1
@@ -290,8 +299,6 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.seleniumhq.selenium:selenium-api:3.141.59
 org.seleniumhq.selenium:selenium-chrome-driver:3.141.59
 org.seleniumhq.selenium:selenium-edge-driver:3.141.59
@@ -305,13 +312,13 @@ org.seleniumhq.selenium:selenium-support:3.141.59
 org.slf4j:jcl-over-slf4j:1.7.30
 org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:junit-jupiter:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:selenium:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:junit-jupiter:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:selenium:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.webjars.npm:viz.js-for-graphviz-java:2.1.3
--- a/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -10,10 +10,14 @@ com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
-com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.11.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -22,51 +26,61 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
@@ -74,41 +88,44 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud.sql:postgres-socket-factory:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:30.0-jre
-com.google.guava:guava:30.0-jre
+com.google.guava:guava-testlib:30.1-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -117,12 +134,12 @@ com.google.monitoring-client:contrib:1.0.7
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -132,17 +149,14 @@ com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp3:okhttp:3.11.0
-com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.14.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 guru.nidi.com.kitfox:svgSalamander:1.1.3
@@ -151,31 +165,28 @@ guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.github.java-diff-utils:java-diff-utils:4.0
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -195,30 +206,29 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.13
+junit:junit:4.13.1
 net.arnx:nashorn-promise:0.1.1
-net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
+net.bytebuddy:byte-buddy-agent:1.10.19
+net.bytebuddy:byte-buddy:1.10.19
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-direct-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-direct-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
@@ -239,20 +249,20 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-all:1.3
-org.hamcrest:hamcrest-core:1.3
-org.hamcrest:hamcrest-library:1.3
+org.hamcrest:hamcrest-core:2.2
+org.hamcrest:hamcrest-library:2.2
+org.hamcrest:hamcrest:2.2
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -260,27 +270,26 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
-org.junit.jupiter:junit-jupiter-api:5.6.2
-org.junit.jupiter:junit-jupiter-engine:5.6.2
-org.junit.jupiter:junit-jupiter-migrationsupport:5.6.2
-org.junit.jupiter:junit-jupiter-params:5.6.2
-org.junit.platform:junit-platform-commons:1.6.2
-org.junit.platform:junit-platform-engine:1.6.2
-org.junit.platform:junit-platform-launcher:1.6.2
-org.junit.platform:junit-platform-runner:1.6.2
-org.junit.platform:junit-platform-suite-api:1.6.2
-org.junit:junit-bom:5.6.2
+org.junit.jupiter:junit-jupiter-api:5.7.0
+org.junit.jupiter:junit-jupiter-engine:5.7.0
+org.junit.jupiter:junit-jupiter-migrationsupport:5.7.0
+org.junit.jupiter:junit-jupiter-params:5.7.0
+org.junit.platform:junit-platform-commons:1.7.0
+org.junit.platform:junit-platform-engine:1.7.0
+org.junit.platform:junit-platform-launcher:1.7.0
+org.junit.platform:junit-platform-runner:1.7.0
+org.junit.platform:junit-platform-suite-api:1.7.0
+org.junit:junit-bom:5.7.0
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:3.3.3
-org.mockito:mockito-junit-jupiter:3.3.3
+org.mockito:mockito-core:3.7.7
+org.mockito:mockito-junit-jupiter:3.7.7
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
-org.objenesis:objenesis:2.6
+org.objenesis:objenesis:3.1
 org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:8.0.1
 org.ow2.asm:asm-commons:7.1
@@ -290,8 +299,6 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.seleniumhq.selenium:selenium-api:3.141.59
 org.seleniumhq.selenium:selenium-chrome-driver:3.141.59
 org.seleniumhq.selenium:selenium-edge-driver:3.141.59
@@ -306,13 +313,13 @@ org.slf4j:jcl-over-slf4j:1.7.30
 org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:junit-jupiter:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:selenium:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:junit-jupiter:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:selenium:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.webjars.npm:viz.js-for-graphviz-java:2.1.3
--- a/core/src/main/java/google/registry/backup/ReplayCommitLogsToSqlAction.java
+++ b/core/src/main/java/google/registry/backup/ReplayCommitLogsToSqlAction.java
@@ -140,11 +140,13 @@ public class ReplayCommitLogsToSqlAction implements Runnable {
    transaction.stream()
        .sorted(ReplayCommitLogsToSqlAction::compareByWeight)
        .forEach(
-            versionedEntity ->
-                versionedEntity
-                    .getEntity()
-                    .ifPresentOrElse(
-                        this::handleEntityPut, () -> handleEntityDelete(versionedEntity)));
+            versionedEntity -> {
+              if (versionedEntity.getEntity().isPresent()) {
+                handleEntityPut(versionedEntity.getEntity().get());
+              } else {
+                handleEntityDelete(versionedEntity);
+              }
+            });
  }

  private void handleEntityPut(Entity entity) {
--- a/core/src/main/java/google/registry/batch/DeleteExpiredDomainsAction.java
+++ b/core/src/main/java/google/registry/batch/DeleteExpiredDomainsAction.java
@@ -0,0 +1,194 @@
+// Copyright 2021 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.batch;
+
+import static com.google.common.collect.ImmutableList.toImmutableList;
+import static com.google.common.net.MediaType.PLAIN_TEXT_UTF_8;
+import static google.registry.flows.FlowUtils.marshalWithLenientRetry;
+import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.util.DateTimeUtils.END_OF_TIME;
+import static google.registry.util.ResourceUtils.readResourceUtf8;
+import static java.nio.charset.StandardCharsets.UTF_8;
+import static javax.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
+import static javax.servlet.http.HttpServletResponse.SC_NO_CONTENT;
+import static javax.servlet.http.HttpServletResponse.SC_OK;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.flogger.FluentLogger;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.flows.EppController;
+import google.registry.flows.EppRequestSource;
+import google.registry.flows.PasswordOnlyTransportCredentials;
+import google.registry.flows.StatelessRequestSessionMetadata;
+import google.registry.model.domain.DomainBase;
+import google.registry.model.eppcommon.ProtocolDefinition;
+import google.registry.model.eppoutput.EppOutput;
+import google.registry.request.Action;
+import google.registry.request.Action.Method;
+import google.registry.request.Response;
+import google.registry.request.auth.Auth;
+import google.registry.request.lock.LockHandler;
+import google.registry.util.Clock;
+import java.util.Optional;
+import java.util.concurrent.Callable;
+import javax.inject.Inject;
+import org.joda.time.DateTime;
+import org.joda.time.Duration;
+
+/**
+ * An action that deletes all non-renewing domains whose expiration dates have now passed.
+ *
+ * <p>The registry runs on an autorenew domain model, so domains don't ever expire naturally; they
+ * are only ever autorenewed. However, in some situations (such as URS) we don't want this to
+ * happen. Thus, the domains are tagged as non-renewing and are deleted by the next daily invocation
+ * of this action once they are past the date at which they were to expire.
+ *
+ * <p>Note that this action works by running a superuser EPP domain delete command, and as a side
+ * effect of when domains are deleted (just past their expiration date), they are invariably in the
+ * autorenew grace period when this happens.
+ */
+@Action(
+    service = Action.Service.BACKEND,
+    path = DeleteExpiredDomainsAction.PATH,
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN,
+    method = Method.POST)
+public class DeleteExpiredDomainsAction implements Runnable {
+
+  public static final String PATH = "/_dr/task/deleteExpiredDomains";
+  private static final String LOCK_NAME = "Delete expired domains";
+
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+  private final EppController eppController;
+  private final String registryAdminClientId;
+  private final Clock clock;
+  private final LockHandler lockHandler;
+  private final Response response;
+  private final String deleteXmlTmpl;
+
+  @Inject
+  DeleteExpiredDomainsAction(
+      EppController eppController,
+      @Config("registryAdminClientId") String registryAdminClientId,
+      Clock clock,
+      LockHandler lockHandler,
+      Response response) {
+    this.eppController = eppController;
+    this.registryAdminClientId = registryAdminClientId;
+    this.clock = clock;
+    this.lockHandler = lockHandler;
+    this.response = response;
+    this.deleteXmlTmpl =
+        readResourceUtf8(DeleteExpiredDomainsAction.class, "delete_expired_domain.xml");
+  }
+
+  @Override
+  public void run() {
+    response.setContentType(PLAIN_TEXT_UTF_8);
+
+    Callable<Void> runner =
+        () -> {
+          try {
+            runLocked();
+            response.setStatus(SC_OK);
+          } catch (Exception e) {
+            logger.atSevere().withCause(e).log("Errored out during execution.");
+            response.setStatus(SC_INTERNAL_SERVER_ERROR);
+            response.setPayload(String.format("Errored out with cause: %s", e));
+          }
+          return null;
+        };
+
+    if (!lockHandler.executeWithLocks(runner, null, Duration.standardHours(1), LOCK_NAME)) {
+      // Send a 200-series status code to prevent this conflicting action from retrying.
+      response.setStatus(SC_NO_CONTENT);
+      response.setPayload("Could not acquire lock; already running?");
+    }
+  }
+
+  private void runLocked() {
+    DateTime runTime = clock.nowUtc();
+    logger.atInfo().log(
+        "Deleting non-renewing domains with autorenew end times up through %s.", runTime);
+
+    // Note: This query is (and must be) non-transactional, and thus, is only eventually consistent.
+    ImmutableList<DomainBase> domainsToDelete =
+        ofy().load().type(DomainBase.class).filter("autorenewEndTime <=", runTime).list().stream()
+            // Datastore can't do two inequalities in one query, so the second happens in-memory.
+            .filter(d -> d.getDeletionTime().isEqual(END_OF_TIME))
+            .collect(toImmutableList());
+    if (domainsToDelete.isEmpty()) {
+      logger.atInfo().log("Found 0 domains to delete.");
+      response.setPayload("Found 0 domains to delete.");
+      return;
+    }
+
+    logger.atInfo().log(
+        "Found %d domains to delete: %s.",
+        domainsToDelete.size(),
+        String.join(
+            ", ",
+            domainsToDelete.stream().map(DomainBase::getDomainName).collect(toImmutableList())));
+    domainsToDelete.forEach(this::runDomainDeleteFlow);
+    logger.atInfo().log("Finished deleting domains.");
+    response.setPayload("Finished deleting domains.");
+  }
+
+  private void runDomainDeleteFlow(DomainBase domain) {
+    logger.atInfo().log("Attempting to delete domain %s", domain.getDomainName());
+    // Create a new transaction that the flow's execution will be enlisted in that loads the domain
+    // transactionally. This way we can ensure that nothing else has modified the domain in question
+    // in the intervening period since the query above found it.
+    Optional<EppOutput> eppOutput =
+        tm().transact(
+                () -> {
+                  DomainBase transDomain = tm().loadByKey(domain.createVKey());
+                  if (!domain.getAutorenewEndTime().isPresent()
+                      || domain.getAutorenewEndTime().get().isAfter(tm().getTransactionTime())) {
+                    logger.atSevere().log(
+                        "Failed to delete domain %s because of its autorenew end time: %s.",
+                        transDomain.getDomainName(), transDomain.getAutorenewEndTime());
+                    return Optional.empty();
+                  } else if (domain.getDeletionTime().isBefore(END_OF_TIME)) {
+                    logger.atSevere().log(
+                        "Failed to delete domain %s because it was already deleted on %s.",
+                        transDomain.getDomainName(), transDomain.getDeletionTime());
+                    return Optional.empty();
+                  }
+                  return Optional.of(
+                      eppController.handleEppCommand(
+                          new StatelessRequestSessionMetadata(
+                              registryAdminClientId,
+                              ProtocolDefinition.getVisibleServiceExtensionUris()),
+                          new PasswordOnlyTransportCredentials(),
+                          EppRequestSource.BACKEND,
+                          false,
+                          true,
+                          deleteXmlTmpl
+                              .replace("%DOMAIN%", transDomain.getDomainName())
+                              .getBytes(UTF_8)));
+                });
+
+    if (eppOutput.isPresent()) {
+      if (eppOutput.get().isSuccess()) {
+        logger.atInfo().log("Successfully deleted domain %s", domain.getDomainName());
+      } else {
+        logger.atWarning().log(
+            "Failed to delete domain %s; EPP response:\n\n%s",
+            domain.getDomainName(), new String(marshalWithLenientRetry(eppOutput.get()), UTF_8));
+      }
+    }
+  }
+}
--- a/core/src/main/java/google/registry/batch/delete_expired_domain.xml
+++ b/core/src/main/java/google/registry/batch/delete_expired_domain.xml
@@ -0,0 +1,17 @@
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
+  <command>
+    <delete>
+      <domain:delete
+       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
+        <domain:name>%DOMAIN%</domain:name>
+      </domain:delete>
+    </delete>
+    <extension>
+      <metadata:metadata xmlns:metadata="urn:google:params:xml:ns:metadata-1.0">
+        <metadata:reason>Non-renewing domain has reached expiration date.</metadata:reason>
+        <metadata:requestedByRegistrar>false</metadata:requestedByRegistrar>
+      </metadata:metadata>
+    </extension>
+    <clTRID>ABC-12345</clTRID>
+  </command>
+</epp>
--- a/core/src/main/java/google/registry/beam/common/JpaDemoPipeline.java
+++ b/core/src/main/java/google/registry/beam/common/JpaDemoPipeline.java
@@ -0,0 +1,81 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.common;
+
+import static com.google.common.base.Verify.verify;
+import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
+
+import google.registry.backup.AppEngineEnvironment;
+import google.registry.persistence.transaction.JpaTransactionManager;
+import java.io.Serializable;
+import org.apache.beam.sdk.Pipeline;
+import org.apache.beam.sdk.metrics.Counter;
+import org.apache.beam.sdk.metrics.Metrics;
+import org.apache.beam.sdk.options.PipelineOptionsFactory;
+import org.apache.beam.sdk.transforms.Create;
+import org.apache.beam.sdk.transforms.DoFn;
+import org.apache.beam.sdk.transforms.ParDo;
+
+/** Toy pipeline that demonstrates how to use {@link JpaTransactionManager} in BEAM pipelines. */
+public class JpaDemoPipeline implements Serializable {
+
+  public static void main(String[] args) {
+    RegistryPipelineOptions options =
+        PipelineOptionsFactory.fromArgs(args).withValidation().as(RegistryPipelineOptions.class);
+    RegistryPipelineOptions.validateRegistryPipelineOptions(options);
+
+    Pipeline pipeline = Pipeline.create(options);
+    pipeline
+        .apply("Start", Create.of((Void) null))
+        .apply(
+            "Generate Elements",
+            ParDo.of(
+                new DoFn<Void, Void>() {
+                  @ProcessElement
+                  public void processElement(OutputReceiver<Void> output) {
+                    for (int i = 0; i < 500; i++) {
+                      output.output(null);
+                    }
+                  }
+                }))
+        .apply(
+            "Make Query",
+            ParDo.of(
+                new DoFn<Void, Void>() {
+                  private Counter counter = Metrics.counter("Demo", "Read");
+
+                  @ProcessElement
+                  public void processElement() {
+                    // AppEngineEnvironment is needed as long as JPA entity classes still depends
+                    // on Objectify.
+                    try (AppEngineEnvironment allowOfyEntity = new AppEngineEnvironment()) {
+                      int result =
+                          (Integer)
+                              jpaTm()
+                                  .transact(
+                                      () ->
+                                          jpaTm()
+                                              .getEntityManager()
+                                              .createNativeQuery("select 1;")
+                                              .getSingleResult());
+                      verify(result == 1, "Expecting 1, got %s.", result);
+                    }
+                    counter.inc();
+                  }
+                }));
+
+    pipeline.run();
+  }
+}
--- a/core/src/main/java/google/registry/beam/common/RegistryPipelineComponent.java
+++ b/core/src/main/java/google/registry/beam/common/RegistryPipelineComponent.java
@@ -0,0 +1,47 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.common;
+
+import dagger.Component;
+import dagger.Lazy;
+import google.registry.config.CredentialModule;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.config.RegistryConfig.ConfigModule;
+import google.registry.persistence.PersistenceModule;
+import google.registry.persistence.PersistenceModule.BeamJpaTm;
+import google.registry.persistence.transaction.JpaTransactionManager;
+import google.registry.privileges.secretmanager.SecretManagerModule;
+import google.registry.util.UtilsModule;
+import javax.inject.Singleton;
+
+/** Component that provides everything needed on a Pipeline worker. */
+@Singleton
+@Component(
+    modules = {
+      ConfigModule.class,
+      CredentialModule.class,
+      PersistenceModule.class,
+      SecretManagerModule.class,
+      UtilsModule.class
+    })
+public interface RegistryPipelineComponent {
+
+  /** Returns the GCP project ID. */
+  @Config("projectId")
+  String getProjectId();
+
+  @BeamJpaTm
+  Lazy<JpaTransactionManager> getJpaTransactionManager();
+}
--- a/core/src/main/java/google/registry/beam/common/RegistryPipelineOptions.java
+++ b/core/src/main/java/google/registry/beam/common/RegistryPipelineOptions.java
@@ -0,0 +1,58 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.common;
+
+import google.registry.config.RegistryEnvironment;
+import java.util.Objects;
+import javax.annotation.Nullable;
+import org.apache.beam.sdk.extensions.gcp.options.GcpOptions;
+import org.apache.beam.sdk.options.Description;
+
+/** Defines Nomulus-specific pipeline options. */
+public interface RegistryPipelineOptions extends GcpOptions {
+
+  @Description("The Registry environment.")
+  @Nullable
+  RegistryEnvironment getRegistryEnvironment();
+
+  void setRegistryEnvironment(RegistryEnvironment environment);
+
+  /**
+   * Validates the GCP project and Registry environment settings in {@code option}. If project is
+   * undefined, it is set according to the Registry environment; if project is defined but
+   * inconsistent with the Registry environment, an {@link IllegalArgumentException} will be thrown.
+   *
+   * <p>This method may modify the system property ("google.registry.environment" which is defined
+   * in {@link RegistryEnvironment}). Tests calling this method must restore the original
+   * environment on completion.
+   */
+  static void validateRegistryPipelineOptions(RegistryPipelineOptions option) {
+    RegistryEnvironment environment = option.getRegistryEnvironment();
+    if (environment == null) {
+      return;
+    }
+    environment.setup();
+    String projectByEnv = DaggerRegistryPipelineComponent.create().getProjectId();
+    if (Objects.equals(option.getProject(), projectByEnv)) {
+      return;
+    }
+    if (option.getProject() == null) {
+      option.setProject(projectByEnv);
+      return;
+    }
+    throw new IllegalArgumentException(
+        "Arguments for --project and --registryEnvironment do not match.");
+  }
+}
--- a/core/src/main/java/google/registry/beam/common/RegistryPipelineWorkerInitializer.java
+++ b/core/src/main/java/google/registry/beam/common/RegistryPipelineWorkerInitializer.java
@@ -0,0 +1,49 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.common;
+
+import com.google.auto.service.AutoService;
+import com.google.common.flogger.FluentLogger;
+import dagger.Lazy;
+import google.registry.config.RegistryEnvironment;
+import google.registry.persistence.transaction.JpaTransactionManager;
+import google.registry.persistence.transaction.TransactionManagerFactory;
+import org.apache.beam.sdk.harness.JvmInitializer;
+import org.apache.beam.sdk.options.PipelineOptions;
+
+/**
+ * Sets up Nomulus environment and initializes JPA on each pipeline worker.
+ *
+ * <p>This class only takes effect in portable beam pipeline runners (including the Cloud Dataflow
+ * runner). It is not invoked in test pipelines.
+ */
+@AutoService(JvmInitializer.class)
+public class RegistryPipelineWorkerInitializer implements JvmInitializer {
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  @Override
+  public void beforeProcessing(PipelineOptions options) {
+    RegistryEnvironment environment =
+        options.as(RegistryPipelineOptions.class).getRegistryEnvironment();
+    if (environment == null || environment.equals(RegistryEnvironment.UNITTEST)) {
+      return;
+    }
+    logger.atInfo().log("Setting up RegistryEnvironment: %s", environment);
+    environment.setup();
+    Lazy<JpaTransactionManager> transactionManagerLazy =
+        DaggerRegistryPipelineComponent.create().getJpaTransactionManager();
+    TransactionManagerFactory.setJpaTmOnBeamWorker(transactionManagerLazy::get);
+  }
+}
--- a/core/src/main/java/google/registry/beam/datastore/BulkDeletePipeline.java
+++ b/core/src/main/java/google/registry/beam/datastore/BulkDeletePipeline.java
@@ -0,0 +1,330 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.datastore;
+
+import static com.google.common.base.Preconditions.checkState;
+import static org.apache.beam.sdk.values.TypeDescriptors.kvs;
+import static org.apache.beam.sdk.values.TypeDescriptors.strings;
+
+import com.google.common.annotations.VisibleForTesting;
+import com.google.common.base.Splitter;
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableSortedSet;
+import com.google.common.flogger.FluentLogger;
+import com.google.datastore.v1.Entity;
+import java.util.Iterator;
+import java.util.Map;
+import org.apache.beam.sdk.Pipeline;
+import org.apache.beam.sdk.extensions.gcp.options.GcpOptions;
+import org.apache.beam.sdk.io.gcp.datastore.DatastoreIO;
+import org.apache.beam.sdk.options.Default;
+import org.apache.beam.sdk.options.Description;
+import org.apache.beam.sdk.options.PipelineOptionsFactory;
+import org.apache.beam.sdk.options.Validation;
+import org.apache.beam.sdk.transforms.Create;
+import org.apache.beam.sdk.transforms.DoFn;
+import org.apache.beam.sdk.transforms.GroupByKey;
+import org.apache.beam.sdk.transforms.MapElements;
+import org.apache.beam.sdk.transforms.PTransform;
+import org.apache.beam.sdk.transforms.ParDo;
+import org.apache.beam.sdk.transforms.Reshuffle;
+import org.apache.beam.sdk.transforms.View;
+import org.apache.beam.sdk.values.KV;
+import org.apache.beam.sdk.values.PBegin;
+import org.apache.beam.sdk.values.PCollection;
+import org.apache.beam.sdk.values.PCollectionTuple;
+import org.apache.beam.sdk.values.PCollectionView;
+import org.apache.beam.sdk.values.TupleTag;
+import org.apache.beam.sdk.values.TupleTagList;
+
+/**
+ * A BEAM pipeline that deletes Datastore entities in bulk.
+ *
+ * <p>This pipeline provides an alternative to the <a
+ * href="https://cloud.google.com/datastore/docs/bulk-delete">GCP builtin template</a> that performs
+ * the same task. It solves the following performance and usability problems in the builtin
+ * template:
+ *
+ * <ul>
+ *   <li>When deleting all data (by using the {@code select __key__} or {@code select *} queries),
+ *       the builtin template cannot parallelize the query, therefore has to query with a single
+ *       worker.
+ *   <li>When deleting all data, the builtin template also attempts to delete Datastore internal
+ *       tables which would cause permission-denied errors, which in turn MAY cause the pipeline to
+ *       abort before all data has been deleted.
+ *   <li>With the builtin template, it is possible to delete multiple entity types in one pipeline
+ *       ONLY if the user can come up with a single literal query that covers all of them. This is
+ *       not the case with most Nomulus entity types.
+ * </ul>
+ *
+ * <p>A user of this pipeline must specify the types of entities to delete using the {@code
+ * --kindsToDelete} command line argument. To delete specific entity types, give a comma-separated
+ * string of their kind names; to delete all data, give {@code "*"}.
+ *
+ * <p>When deleting all data, it is recommended for the user to specify the number of user entity
+ * types in the Datastore using the {@code --numOfKindsHint} argument. If the default value for this
+ * parameter is too low, performance will suffer.
+ */
+public class BulkDeletePipeline {
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  // This tool is not for use in our critical projects.
+  private static final ImmutableSet<String> FORBIDDEN_PROJECTS =
+      ImmutableSet.of("domain-registry", "domain-registry-sandbox");
+
+  private final BulkDeletePipelineOptions options;
+
+  private final Pipeline pipeline;
+
+  BulkDeletePipeline(BulkDeletePipelineOptions options) {
+    this.options = options;
+    pipeline = Pipeline.create(options);
+  }
+
+  public void run() {
+    setupPipeline();
+    pipeline.run();
+  }
+
+  @SuppressWarnings("deprecation") // org.apache.beam.sdk.transforms.Reshuffle
+  private void setupPipeline() {
+    checkState(
+        !FORBIDDEN_PROJECTS.contains(options.getProject()),
+        "Bulk delete is forbidden in %s",
+        options.getProject());
+
+    // Pre-allocated tags to label entities by kind. In the case of delete-all, we must use a guess.
+    TupleTagList deletionTags;
+    PCollection<String> kindsToDelete;
+
+    if (options.getKindsToDelete().equals("*")) {
+      deletionTags = getDeletionTags(options.getNumOfKindsHint());
+      kindsToDelete =
+          pipeline.apply("DiscoverEntityKinds", discoverEntityKinds(options.getProject()));
+    } else {
+      ImmutableList<String> kindsToDeleteParam = parseKindsToDelete(options);
+      checkState(
+          !kindsToDeleteParam.contains("*"),
+          "The --kindsToDelete argument should not contain both '*' and other kinds.");
+      deletionTags = getDeletionTags(kindsToDeleteParam.size());
+      kindsToDelete = pipeline.apply("UseProvidedKinds", Create.of(kindsToDeleteParam));
+    }
+
+    // Map each kind to a tag. The "SplitByKind" stage below will group entities by kind using
+    // this mapping. In practice, this has been effective at avoiding entity group contentions.
+    PCollectionView<Map<String, TupleTag<Entity>>> kindToTagMapping =
+        mapKindsToDeletionTags(kindsToDelete, deletionTags).apply("GetKindsToTagMap", View.asMap());
+
+    PCollectionTuple entities =
+        kindsToDelete
+            .apply("GenerateQueries", ParDo.of(new GenerateQueries()))
+            .apply("ReadEntities", DatastoreV1.read().withProjectId(options.getProject()))
+            .apply(
+                "SplitByKind",
+                ParDo.of(new SplitEntities(kindToTagMapping))
+                    .withSideInputs(kindToTagMapping)
+                    .withOutputTags(getOneDeletionTag("placeholder"), deletionTags));
+
+    for (TupleTag<?> tag : deletionTags.getAll()) {
+      entities
+          .get((TupleTag<Entity>) tag)
+          // Reshuffle calls GroupByKey which is one way to trigger load rebalance in the pipeline.
+          // Using the deprecated "Reshuffle" for convenience given the short life of this tool.
+          .apply("RebalanceLoad", Reshuffle.viaRandomKey())
+          .apply(
+              "DeleteEntities_" + tag.getId(),
+              DatastoreIO.v1().deleteEntity().withProjectId(options.getProject()));
+    }
+  }
+
+  private static String toKeyOnlyQueryForKind(String kind) {
+    return "select __key__ from `" + kind + "`";
+  }
+
+  /**
+   * Returns a {@link TupleTag} that retains the generic type parameter and may be used in a
+   * multi-output {@link ParDo} (e.g. {@link SplitEntities}).
+   *
+   * <p>This method is NOT needed in tests when creating tags for assertions. Simply create them
+   * with {@code new TupleTag<Entity>(String)}.
+   */
+  @VisibleForTesting
+  static TupleTag<Entity> getOneDeletionTag(String id) {
+    // The trailing {} is needed to retain generic param type.
+    return new TupleTag<Entity>(id) {};
+  }
+
+  @VisibleForTesting
+  static ImmutableList<String> parseKindsToDelete(BulkDeletePipelineOptions options) {
+    return ImmutableList.copyOf(
+        Splitter.on(",").omitEmptyStrings().trimResults().split(options.getKindsToDelete().trim()));
+  }
+
+  /**
+   * Returns a list of {@code n} {@link TupleTag TupleTags} numbered from {@code 0} to {@code n-1}.
+   */
+  @VisibleForTesting
+  static TupleTagList getDeletionTags(int n) {
+    ImmutableList.Builder<TupleTag<?>> builder = new ImmutableList.Builder<>();
+    for (int i = 0; i < n; i++) {
+      builder.add(getOneDeletionTag(String.valueOf(i)));
+    }
+    return TupleTagList.of(builder.build());
+  }
+
+  /** Returns a {@link PTransform} that finds all entity kinds in Datastore. */
+  @VisibleForTesting
+  static PTransform<PBegin, PCollection<String>> discoverEntityKinds(String project) {
+    return new PTransform<PBegin, PCollection<String>>() {
+      @Override
+      public PCollection<String> expand(PBegin input) {
+        // Use the __kind__ table to discover entity kinds. Data in the more informational
+        // __Stat_Kind__ table may be up to 48-hour stale.
+        return input
+            .apply(
+                "LoadEntityMetaData",
+                DatastoreIO.v1()
+                    .read()
+                    .withProjectId(project)
+                    .withLiteralGqlQuery("select * from __kind__"))
+            .apply(
+                "GetKindNames",
+                ParDo.of(
+                    new DoFn<Entity, String>() {
+                      @ProcessElement
+                      public void processElement(
+                          @Element Entity entity, OutputReceiver<String> out) {
+                        String kind = entity.getKey().getPath(0).getName();
+                        if (kind.startsWith("_")) {
+                          return;
+                        }
+                        out.output(kind);
+                      }
+                    }));
+      }
+    };
+  }
+
+  @VisibleForTesting
+  static PCollection<KV<String, TupleTag<Entity>>> mapKindsToDeletionTags(
+      PCollection<String> kinds, TupleTagList tags) {
+    // The first two stages send all strings in the 'kinds' PCollection to one worker which
+    // performs the mapping in the last stage.
+    return kinds
+        .apply(
+            "AssignSingletonKeyToKinds",
+            MapElements.into(kvs(strings(), strings())).via(kind -> KV.of("", kind)))
+        .apply("GatherKindsIntoCollection", GroupByKey.create())
+        .apply("MapKindsToTag", ParDo.of(new MapKindsToTags(tags)));
+  }
+
+  /** Transforms each {@code kind} string into a Datastore query for that kind. */
+  @VisibleForTesting
+  static class GenerateQueries extends DoFn<String, String> {
+    @ProcessElement
+    public void processElement(@Element String kind, OutputReceiver<String> out) {
+      out.output(toKeyOnlyQueryForKind(kind));
+    }
+  }
+
+  private static class MapKindsToTags
+      extends DoFn<KV<String, Iterable<String>>, KV<String, TupleTag<Entity>>> {
+    private final TupleTagList tupleTags;
+
+    MapKindsToTags(TupleTagList tupleTags) {
+      this.tupleTags = tupleTags;
+    }
+
+    @ProcessElement
+    public void processElement(
+        @Element KV<String, Iterable<String>> kv,
+        OutputReceiver<KV<String, TupleTag<Entity>>> out) {
+      // Sort kinds so that mapping is deterministic.
+      ImmutableSortedSet<String> sortedKinds = ImmutableSortedSet.copyOf(kv.getValue());
+      Iterator<String> kinds = sortedKinds.iterator();
+      Iterator<TupleTag<?>> tags = tupleTags.getAll().iterator();
+
+      while (kinds.hasNext() && tags.hasNext()) {
+        out.output(KV.of(kinds.next(), (TupleTag<Entity>) tags.next()));
+      }
+
+      if (kinds.hasNext()) {
+        logger.atWarning().log(
+            "There are more kinds to delete (%s) than our estimate (%s). "
+                + "Performance may suffer.",
+            sortedKinds.size(), tupleTags.size());
+      }
+      // Round robin assignment so that mapping is deterministic
+      while (kinds.hasNext()) {
+        tags = tupleTags.getAll().iterator();
+        while (kinds.hasNext() && tags.hasNext()) {
+          out.output(KV.of(kinds.next(), (TupleTag<Entity>) tags.next()));
+        }
+      }
+    }
+  }
+
+  /**
+   * {@link DoFn} that splits one {@link PCollection} of mixed kinds into multiple single-kind
+   * {@code PCollections}.
+   */
+  @VisibleForTesting
+  static class SplitEntities extends DoFn<Entity, Entity> {
+    private final PCollectionView<Map<String, TupleTag<Entity>>> kindToTagMapping;
+
+    SplitEntities(PCollectionView<Map<String, TupleTag<Entity>>> kindToTagMapping) {
+      super();
+      this.kindToTagMapping = kindToTagMapping;
+    }
+
+    @ProcessElement
+    public void processElement(ProcessContext context) {
+      Entity entity = context.element();
+      com.google.datastore.v1.Key entityKey = entity.getKey();
+      String kind = entityKey.getPath(entityKey.getPathCount() - 1).getKind();
+      TupleTag<Entity> tag = context.sideInput(kindToTagMapping).get(kind);
+      context.output(tag, entity);
+    }
+  }
+
+  public static void main(String[] args) {
+    BulkDeletePipelineOptions options =
+        PipelineOptionsFactory.fromArgs(args).withValidation().as(BulkDeletePipelineOptions.class);
+    BulkDeletePipeline pipeline = new BulkDeletePipeline(options);
+    pipeline.run();
+    System.exit(0);
+  }
+
+  public interface BulkDeletePipelineOptions extends GcpOptions {
+
+    @Description(
+        "The Datastore KINDs to be deleted. The format may be:\n"
+            + "\t- The list of kinds to be deleted as a comma-separated string, or\n"
+            + "\t- '*', which causes all kinds to be deleted.")
+    @Validation.Required
+    String getKindsToDelete();
+
+    void setKindsToDelete(String kinds);
+
+    @Description(
+        "An estimate of the number of KINDs to be deleted. "
+            + "This is recommended if --kindsToDelete is '*' and the default value is too low.")
+    @Default.Integer(30)
+    int getNumOfKindsHint();
+
+    void setNumOfKindsHint(int numOfKindsHint);
+  }
+}
--- a/core/src/main/java/google/registry/beam/datastore/DatastoreV1.java
+++ b/core/src/main/java/google/registry/beam/datastore/DatastoreV1.java
@@ -0,0 +1,765 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// This class is adapted from the Apache BEAM SDK. The original license may
+// be found at <a href="https://github.com/apache/beam/blob/master/LICENSE">
+// this link</a>.
+
+package google.registry.beam.datastore;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Verify.verify;
+import static com.google.datastore.v1.PropertyFilter.Operator.EQUAL;
+import static com.google.datastore.v1.PropertyOrder.Direction.DESCENDING;
+import static com.google.datastore.v1.QueryResultBatch.MoreResultsType.NOT_FINISHED;
+import static com.google.datastore.v1.client.DatastoreHelper.makeAndFilter;
+import static com.google.datastore.v1.client.DatastoreHelper.makeFilter;
+import static com.google.datastore.v1.client.DatastoreHelper.makeOrder;
+import static com.google.datastore.v1.client.DatastoreHelper.makeValue;
+
+import com.google.api.client.http.HttpRequestInitializer;
+import com.google.auth.Credentials;
+import com.google.auth.http.HttpCredentialsAdapter;
+import com.google.auto.value.AutoValue;
+import com.google.cloud.hadoop.util.ChainingHttpRequestInitializer;
+import com.google.common.base.Strings;
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.flogger.FluentLogger;
+import com.google.datastore.v1.Entity;
+import com.google.datastore.v1.EntityResult;
+import com.google.datastore.v1.GqlQuery;
+import com.google.datastore.v1.PartitionId;
+import com.google.datastore.v1.Query;
+import com.google.datastore.v1.QueryResultBatch;
+import com.google.datastore.v1.RunQueryRequest;
+import com.google.datastore.v1.RunQueryResponse;
+import com.google.datastore.v1.client.Datastore;
+import com.google.datastore.v1.client.DatastoreException;
+import com.google.datastore.v1.client.DatastoreFactory;
+import com.google.datastore.v1.client.DatastoreHelper;
+import com.google.datastore.v1.client.DatastoreOptions;
+import com.google.datastore.v1.client.QuerySplitter;
+import com.google.protobuf.Int32Value;
+import com.google.rpc.Code;
+import java.io.Serializable;
+import java.util.List;
+import java.util.NoSuchElementException;
+import javax.annotation.Nullable;
+import org.apache.beam.sdk.extensions.gcp.options.GcpOptions;
+import org.apache.beam.sdk.extensions.gcp.util.RetryHttpRequestInitializer;
+import org.apache.beam.sdk.metrics.Counter;
+import org.apache.beam.sdk.metrics.Metrics;
+import org.apache.beam.sdk.options.PipelineOptions;
+import org.apache.beam.sdk.transforms.DoFn;
+import org.apache.beam.sdk.transforms.PTransform;
+import org.apache.beam.sdk.transforms.ParDo;
+import org.apache.beam.sdk.transforms.Reshuffle;
+import org.apache.beam.sdk.transforms.display.DisplayData;
+import org.apache.beam.sdk.transforms.display.HasDisplayData;
+import org.apache.beam.sdk.util.BackOff;
+import org.apache.beam.sdk.util.BackOffUtils;
+import org.apache.beam.sdk.util.FluentBackoff;
+import org.apache.beam.sdk.util.Sleeper;
+import org.apache.beam.sdk.values.KV;
+import org.apache.beam.sdk.values.PCollection;
+import org.joda.time.Duration;
+
+/**
+ * Contains an adaptation of {@link org.apache.beam.sdk.io.gcp.datastore.DatastoreV1.Read}. See
+ * {@link MultiRead} for details.
+ */
+public class DatastoreV1 {
+
+  // A package-private constructor to prevent direct instantiation from outside of this package
+  DatastoreV1() {}
+
+  /**
+   * Non-retryable errors. See https://cloud.google.com/datastore/docs/concepts/errors#Error_Codes .
+   */
+  private static final ImmutableSet<Code> NON_RETRYABLE_ERRORS =
+      ImmutableSet.of(
+          Code.FAILED_PRECONDITION,
+          Code.INVALID_ARGUMENT,
+          Code.PERMISSION_DENIED,
+          Code.UNAUTHENTICATED);
+
+  /**
+   * Returns an empty {@link MultiRead} builder. Configure the source {@code projectId}, {@code
+   * query}, and optionally {@code namespace} and {@code numQuerySplits} using {@link
+   * MultiRead#withProjectId}, {@link MultiRead#withNamespace}, {@link
+   * MultiRead#withNumQuerySplits}.
+   */
+  public static MultiRead read() {
+    return new AutoValue_DatastoreV1_MultiRead.Builder().setNumQuerySplits(0).build();
+  }
+
+  /**
+   * A {@link PTransform} that executes every Cloud SQL queries in a {@link PCollection } and reads
+   * their result rows as {@code Entity} objects.
+   *
+   * <p>This class is adapted from {@link org.apache.beam.sdk.io.gcp.datastore.DatastoreV1.Read}. It
+   * uses literal GQL queries in the input {@link PCollection} instead of a constant query provided
+   * to the builder. Only the {@link #expand} method is modified from the original. Everything else
+   * including comments have been copied verbatim.
+   */
+  @AutoValue
+  public abstract static class MultiRead
+      extends PTransform<PCollection<String>, PCollection<Entity>> {
+    private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+    /** An upper bound on the number of splits for a query. */
+    public static final int NUM_QUERY_SPLITS_MAX = 50000;
+
+    /** A lower bound on the number of splits for a query. */
+    static final int NUM_QUERY_SPLITS_MIN = 12;
+
+    /** Default bundle size of 64MB. */
+    static final long DEFAULT_BUNDLE_SIZE_BYTES = 64L * 1024L * 1024L;
+
+    /**
+     * Maximum number of results to request per query.
+     *
+     * <p>Must be set, or it may result in an I/O error when querying Cloud Datastore.
+     */
+    static final int QUERY_BATCH_LIMIT = 500;
+
+    public abstract @Nullable String getProjectId();
+
+    public abstract @Nullable String getNamespace();
+
+    public abstract int getNumQuerySplits();
+
+    public abstract @Nullable String getLocalhost();
+
+    @Override
+    public abstract String toString();
+
+    abstract Builder toBuilder();
+
+    @AutoValue.Builder
+    abstract static class Builder {
+      abstract Builder setProjectId(String projectId);
+
+      abstract Builder setNamespace(String namespace);
+
+      abstract Builder setNumQuerySplits(int numQuerySplits);
+
+      abstract Builder setLocalhost(String localhost);
+
+      abstract MultiRead build();
+    }
+
+    /**
+     * Computes the number of splits to be performed on the given query by querying the estimated
+     * size from Cloud Datastore.
+     */
+    static int getEstimatedNumSplits(Datastore datastore, Query query, @Nullable String namespace) {
+      int numSplits;
+      try {
+        long estimatedSizeBytes = getEstimatedSizeBytes(datastore, query, namespace);
+        logger.atInfo().log("Estimated size bytes for the query is: %s", estimatedSizeBytes);
+        numSplits =
+            (int)
+                Math.min(
+                    NUM_QUERY_SPLITS_MAX,
+                    Math.round(((double) estimatedSizeBytes) / DEFAULT_BUNDLE_SIZE_BYTES));
+      } catch (Exception e) {
+        logger.atWarning().log("Failed the fetch estimatedSizeBytes for query: %s", query, e);
+        // Fallback in case estimated size is unavailable.
+        numSplits = NUM_QUERY_SPLITS_MIN;
+      }
+      return Math.max(numSplits, NUM_QUERY_SPLITS_MIN);
+    }
+
+    /**
+     * Cloud Datastore system tables with statistics are periodically updated. This method fetches
+     * the latest timestamp (in microseconds) of statistics update using the {@code __Stat_Total__}
+     * table.
+     */
+    private static long queryLatestStatisticsTimestamp(
+        Datastore datastore, @Nullable String namespace) throws DatastoreException {
+      Query.Builder query = Query.newBuilder();
+      // Note: namespace either being null or empty represents the default namespace, in which
+      // case we treat it as not provided by the user.
+      if (Strings.isNullOrEmpty(namespace)) {
+        query.addKindBuilder().setName("__Stat_Total__");
+      } else {
+        query.addKindBuilder().setName("__Stat_Ns_Total__");
+      }
+      query.addOrder(makeOrder("timestamp", DESCENDING));
+      query.setLimit(Int32Value.newBuilder().setValue(1));
+      RunQueryRequest request = makeRequest(query.build(), namespace);
+
+      RunQueryResponse response = datastore.runQuery(request);
+      QueryResultBatch batch = response.getBatch();
+      if (batch.getEntityResultsCount() == 0) {
+        throw new NoSuchElementException("Datastore total statistics unavailable");
+      }
+      Entity entity = batch.getEntityResults(0).getEntity();
+      return entity.getProperties().get("timestamp").getTimestampValue().getSeconds() * 1000000;
+    }
+
+    /** Retrieve latest table statistics for a given kind, namespace, and datastore. */
+    private static Entity getLatestTableStats(
+        String ourKind, @Nullable String namespace, Datastore datastore) throws DatastoreException {
+      long latestTimestamp = queryLatestStatisticsTimestamp(datastore, namespace);
+      logger.atInfo().log("Latest stats timestamp for kind %s is %s", ourKind, latestTimestamp);
+
+      Query.Builder queryBuilder = Query.newBuilder();
+      if (Strings.isNullOrEmpty(namespace)) {
+        queryBuilder.addKindBuilder().setName("__Stat_Kind__");
+      } else {
+        queryBuilder.addKindBuilder().setName("__Stat_Ns_Kind__");
+      }
+
+      queryBuilder.setFilter(
+          makeAndFilter(
+              makeFilter("kind_name", EQUAL, makeValue(ourKind).build()).build(),
+              makeFilter("timestamp", EQUAL, makeValue(latestTimestamp).build()).build()));
+
+      RunQueryRequest request = makeRequest(queryBuilder.build(), namespace);
+
+      long now = System.currentTimeMillis();
+      RunQueryResponse response = datastore.runQuery(request);
+      logger.atFine().log(
+          "Query for per-kind statistics took %sms", System.currentTimeMillis() - now);
+
+      QueryResultBatch batch = response.getBatch();
+      if (batch.getEntityResultsCount() == 0) {
+        throw new NoSuchElementException(
+            "Datastore statistics for kind " + ourKind + " unavailable");
+      }
+      return batch.getEntityResults(0).getEntity();
+    }
+
+    /**
+     * Get the estimated size of the data returned by the given query.
+     *
+     * <p>Cloud Datastore provides no way to get a good estimate of how large the result of a query
+     * entity kind being queried, using the __Stat_Kind__ system table, assuming exactly 1 kind is
+     * specified in the query.
+     *
+     * <p>See https://cloud.google.com/datastore/docs/concepts/stats.
+     */
+    static long getEstimatedSizeBytes(Datastore datastore, Query query, @Nullable String namespace)
+        throws DatastoreException {
+      String ourKind = query.getKind(0).getName();
+      Entity entity = getLatestTableStats(ourKind, namespace, datastore);
+      return entity.getProperties().get("entity_bytes").getIntegerValue();
+    }
+
+    private static PartitionId.Builder forNamespace(@Nullable String namespace) {
+      PartitionId.Builder partitionBuilder = PartitionId.newBuilder();
+      // Namespace either being null or empty represents the default namespace.
+      // Datastore Client libraries expect users to not set the namespace proto field in
+      // either of these cases.
+      if (!Strings.isNullOrEmpty(namespace)) {
+        partitionBuilder.setNamespaceId(namespace);
+      }
+      return partitionBuilder;
+    }
+
+    /** Builds a {@link RunQueryRequest} from the {@code query} and {@code namespace}. */
+    static RunQueryRequest makeRequest(Query query, @Nullable String namespace) {
+      return RunQueryRequest.newBuilder()
+          .setQuery(query)
+          .setPartitionId(forNamespace(namespace))
+          .build();
+    }
+
+    /** Builds a {@link RunQueryRequest} from the {@code GqlQuery} and {@code namespace}. */
+    private static RunQueryRequest makeRequest(GqlQuery gqlQuery, @Nullable String namespace) {
+      return RunQueryRequest.newBuilder()
+          .setGqlQuery(gqlQuery)
+          .setPartitionId(forNamespace(namespace))
+          .build();
+    }
+
+    /**
+     * A helper function to get the split queries, taking into account the optional {@code
+     * namespace}.
+     */
+    private static List<Query> splitQuery(
+        Query query,
+        @Nullable String namespace,
+        Datastore datastore,
+        QuerySplitter querySplitter,
+        int numSplits)
+        throws DatastoreException {
+      // If namespace is set, include it in the split request so splits are calculated accordingly.
+      return querySplitter.getSplits(query, forNamespace(namespace).build(), numSplits, datastore);
+    }
+
+    /**
+     * Translates a Cloud Datastore gql query string to {@link Query}.
+     *
+     * <p>Currently, the only way to translate a gql query string to a Query is to run the query
+     * against Cloud Datastore and extract the {@code Query} from the response. To prevent reading
+     * any data, we set the {@code LIMIT} to 0 but if the gql query already has a limit set, we
+     * catch the exception with {@code INVALID_ARGUMENT} error code and retry the translation
+     * without the zero limit.
+     *
+     * <p>Note: This may result in reading actual data from Cloud Datastore but the service has a
+     * cap on the number of entities returned for a single rpc request, so this should not be a
+     * problem in practice.
+     */
+    private static Query translateGqlQueryWithLimitCheck(
+        String gql, Datastore datastore, String namespace) throws DatastoreException {
+      String gqlQueryWithZeroLimit = gql + " LIMIT 0";
+      try {
+        Query translatedQuery = translateGqlQuery(gqlQueryWithZeroLimit, datastore, namespace);
+        // Clear the limit that we set.
+        return translatedQuery.toBuilder().clearLimit().build();
+      } catch (DatastoreException e) {
+        // Note: There is no specific error code or message to detect if the query already has a
+        // limit, so we just check for INVALID_ARGUMENT and assume that that the query might have
+        // a limit already set.
+        if (e.getCode() == Code.INVALID_ARGUMENT) {
+          logger.atWarning().log(
+              "Failed to translate Gql query '%s': %s", gqlQueryWithZeroLimit, e.getMessage());
+          logger.atWarning().log(
+              "User query might have a limit already set, so trying without zero limit");
+          // Retry without the zero limit.
+          return translateGqlQuery(gql, datastore, namespace);
+        } else {
+          throw e;
+        }
+      }
+    }
+
+    /** Translates a gql query string to {@link Query}. */
+    private static Query translateGqlQuery(String gql, Datastore datastore, String namespace)
+        throws DatastoreException {
+      logger.atInfo().log("Translating gql %s", gql);
+      GqlQuery gqlQuery = GqlQuery.newBuilder().setQueryString(gql).setAllowLiterals(true).build();
+      RunQueryRequest req = makeRequest(gqlQuery, namespace);
+      return datastore.runQuery(req).getQuery();
+    }
+
+    /**
+     * Returns a new {@link MultiRead} that reads from the Cloud Datastore for the specified
+     * project.
+     */
+    public MultiRead withProjectId(String projectId) {
+      checkArgument(projectId != null, "projectId can not be null");
+      return toBuilder().setProjectId(projectId).build();
+    }
+
+    /** Returns a new {@link MultiRead} that reads from the given namespace. */
+    public MultiRead withNamespace(String namespace) {
+      return toBuilder().setNamespace(namespace).build();
+    }
+
+    /**
+     * Returns a new {@link MultiRead} that reads by splitting the given {@code query} into {@code
+     * numQuerySplits}.
+     *
+     * <p>The semantics for the query splitting is defined below:
+     *
+     * <ul>
+     *   <li>Any value less than or equal to 0 will be ignored, and the number of splits will be
+     *       chosen dynamically at runtime based on the query data size.
+     *   <li>Any value greater than {@link MultiRead#NUM_QUERY_SPLITS_MAX} will be capped at {@code
+     *       NUM_QUERY_SPLITS_MAX}.
+     *   <li>If the {@code query} has a user limit set, then {@code numQuerySplits} will be ignored
+     *       and no split will be performed.
+     *   <li>Under certain cases Cloud Datastore is unable to split query to the requested number of
+     *       splits. In such cases we just use whatever the Cloud Datastore returns.
+     * </ul>
+     */
+    public MultiRead withNumQuerySplits(int numQuerySplits) {
+      return toBuilder()
+          .setNumQuerySplits(Math.min(Math.max(numQuerySplits, 0), NUM_QUERY_SPLITS_MAX))
+          .build();
+    }
+
+    /**
+     * Returns a new {@link MultiRead} that reads from a Datastore Emulator running at the given
+     * localhost address.
+     */
+    public MultiRead withLocalhost(String localhost) {
+      return toBuilder().setLocalhost(localhost).build();
+    }
+
+    /** Returns Number of entities available for reading. */
+    public long getNumEntities(
+        PipelineOptions options, String ourKind, @Nullable String namespace) {
+      try {
+        V1Options v1Options = V1Options.from(getProjectId(), getNamespace(), getLocalhost());
+        V1DatastoreFactory datastoreFactory = new V1DatastoreFactory();
+        Datastore datastore =
+            datastoreFactory.getDatastore(
+                options, v1Options.getProjectId(), v1Options.getLocalhost());
+
+        Entity entity = getLatestTableStats(ourKind, namespace, datastore);
+        return entity.getProperties().get("count").getIntegerValue();
+      } catch (Exception e) {
+        return -1;
+      }
+    }
+
+    @Override
+    public PCollection<Entity> expand(PCollection<String> gqlQueries) {
+      checkArgument(getProjectId() != null, "projectId cannot be null");
+
+      V1Options v1Options = V1Options.from(getProjectId(), getNamespace(), getLocalhost());
+
+      /*
+       * This composite transform involves the following steps:
+       *   1. Apply a {@link ParDo} that translates each query in {@code gqlQueries} into a {@code
+       *   query}.
+       *
+       *   2. A {@link ParDo} splits the resulting query into {@code numQuerySplits} and
+       *   assign each split query a unique {@code Integer} as the key. The resulting output is
+       *   of the type {@code PCollection<KV<Integer, Query>>}.
+       *
+       *   If the value of {@code numQuerySplits} is less than or equal to 0, then the number of
+       *   splits will be computed dynamically based on the size of the data for the {@code query}.
+       *
+       *   3. The resulting {@code PCollection} is sharded using a {@link GroupByKey} operation. The
+       *   queries are extracted from they {@code KV<Integer, Iterable<Query>>} and flattened to
+       *   output a {@code PCollection<Query>}.
+       *
+       *   4. In the third step, a {@code ParDo} reads entities for each query and outputs
+       *   a {@code PCollection<Entity>}.
+       */
+
+      PCollection<Query> inputQuery =
+          gqlQueries.apply(ParDo.of(new GqlQueryTranslateFn(v1Options)));
+
+      return inputQuery
+          .apply("Split", ParDo.of(new SplitQueryFn(v1Options, getNumQuerySplits())))
+          .apply("Reshuffle", Reshuffle.viaRandomKey())
+          .apply("Read", ParDo.of(new ReadFn(v1Options)));
+    }
+
+    @Override
+    public void populateDisplayData(DisplayData.Builder builder) {
+      super.populateDisplayData(builder);
+      builder
+          .addIfNotNull(DisplayData.item("projectId", getProjectId()).withLabel("ProjectId"))
+          .addIfNotNull(DisplayData.item("namespace", getNamespace()).withLabel("Namespace"));
+    }
+
+    private static class V1Options implements HasDisplayData, Serializable {
+      private final String project;
+      private final @Nullable String namespace;
+      private final @Nullable String localhost;
+
+      private V1Options(String project, @Nullable String namespace, @Nullable String localhost) {
+        this.project = project;
+        this.namespace = namespace;
+        this.localhost = localhost;
+      }
+
+      public static V1Options from(
+          String projectId, @Nullable String namespace, @Nullable String localhost) {
+        return new V1Options(projectId, namespace, localhost);
+      }
+
+      public String getProjectId() {
+        return project;
+      }
+
+      public @Nullable String getNamespace() {
+        return namespace;
+      }
+
+      public @Nullable String getLocalhost() {
+        return localhost;
+      }
+
+      @Override
+      public void populateDisplayData(DisplayData.Builder builder) {
+        builder
+            .addIfNotNull(DisplayData.item("projectId", getProjectId()).withLabel("ProjectId"))
+            .addIfNotNull(DisplayData.item("namespace", getNamespace()).withLabel("Namespace"));
+      }
+    }
+
+    /** A DoFn that translates a Cloud Datastore gql query string to {@code Query}. */
+    static class GqlQueryTranslateFn extends DoFn<String, Query> {
+      private final V1Options v1Options;
+      private transient Datastore datastore;
+      private final V1DatastoreFactory datastoreFactory;
+
+      GqlQueryTranslateFn(V1Options options) {
+        this(options, new V1DatastoreFactory());
+      }
+
+      GqlQueryTranslateFn(V1Options options, V1DatastoreFactory datastoreFactory) {
+        this.v1Options = options;
+        this.datastoreFactory = datastoreFactory;
+      }
+
+      @StartBundle
+      public void startBundle(StartBundleContext c) throws Exception {
+        datastore =
+            datastoreFactory.getDatastore(
+                c.getPipelineOptions(), v1Options.getProjectId(), v1Options.getLocalhost());
+      }
+
+      @ProcessElement
+      public void processElement(ProcessContext c) throws Exception {
+        String gqlQuery = c.element();
+        logger.atInfo().log("User query: '%s'", gqlQuery);
+        Query query =
+            translateGqlQueryWithLimitCheck(gqlQuery, datastore, v1Options.getNamespace());
+        logger.atInfo().log("User gql query translated to Query(%s)", query);
+        c.output(query);
+      }
+    }
+
+    /**
+     * A {@link DoFn} that splits a given query into multiple sub-queries, assigns them unique keys
+     * and outputs them as {@link KV}.
+     */
+    private static class SplitQueryFn extends DoFn<Query, Query> {
+      private final V1Options options;
+      // number of splits to make for a given query
+      private final int numSplits;
+
+      private final V1DatastoreFactory datastoreFactory;
+      // Datastore client
+      private transient Datastore datastore;
+      // Query splitter
+      private transient QuerySplitter querySplitter;
+
+      public SplitQueryFn(V1Options options, int numSplits) {
+        this(options, numSplits, new V1DatastoreFactory());
+      }
+
+      private SplitQueryFn(V1Options options, int numSplits, V1DatastoreFactory datastoreFactory) {
+        this.options = options;
+        this.numSplits = numSplits;
+        this.datastoreFactory = datastoreFactory;
+      }
+
+      @StartBundle
+      public void startBundle(StartBundleContext c) throws Exception {
+        datastore =
+            datastoreFactory.getDatastore(
+                c.getPipelineOptions(), options.getProjectId(), options.getLocalhost());
+        querySplitter = datastoreFactory.getQuerySplitter();
+      }
+
+      @ProcessElement
+      public void processElement(ProcessContext c) throws Exception {
+        Query query = c.element();
+
+        // If query has a user set limit, then do not split.
+        if (query.hasLimit()) {
+          c.output(query);
+          return;
+        }
+
+        int estimatedNumSplits;
+        // Compute the estimated numSplits if numSplits is not specified by the user.
+        if (numSplits <= 0) {
+          estimatedNumSplits = getEstimatedNumSplits(datastore, query, options.getNamespace());
+        } else {
+          estimatedNumSplits = numSplits;
+        }
+
+        logger.atInfo().log("Splitting the query into %s splits", estimatedNumSplits);
+        List<Query> querySplits;
+        try {
+          querySplits =
+              splitQuery(
+                  query, options.getNamespace(), datastore, querySplitter, estimatedNumSplits);
+        } catch (Exception e) {
+          logger.atWarning().log("Unable to parallelize the given query: %s", query, e);
+          querySplits = ImmutableList.of(query);
+        }
+
+        // assign unique keys to query splits.
+        for (Query subquery : querySplits) {
+          c.output(subquery);
+        }
+      }
+
+      @Override
+      public void populateDisplayData(DisplayData.Builder builder) {
+        super.populateDisplayData(builder);
+        builder.include("options", options);
+        if (numSplits > 0) {
+          builder.add(
+              DisplayData.item("numQuerySplits", numSplits)
+                  .withLabel("Requested number of Query splits"));
+        }
+      }
+    }
+
+    /** A {@link DoFn} that reads entities from Cloud Datastore for each query. */
+    private static class ReadFn extends DoFn<Query, Entity> {
+      private final V1Options options;
+      private final V1DatastoreFactory datastoreFactory;
+      // Datastore client
+      private transient Datastore datastore;
+      private final Counter rpcErrors = Metrics.counter(ReadFn.class, "datastoreRpcErrors");
+      private final Counter rpcSuccesses = Metrics.counter(ReadFn.class, "datastoreRpcSuccesses");
+      private static final int MAX_RETRIES = 5;
+      private static final FluentBackoff RUNQUERY_BACKOFF =
+          FluentBackoff.DEFAULT
+              .withMaxRetries(MAX_RETRIES)
+              .withInitialBackoff(Duration.standardSeconds(5));
+
+      public ReadFn(V1Options options) {
+        this(options, new V1DatastoreFactory());
+      }
+
+      private ReadFn(V1Options options, V1DatastoreFactory datastoreFactory) {
+        this.options = options;
+        this.datastoreFactory = datastoreFactory;
+      }
+
+      @StartBundle
+      public void startBundle(StartBundleContext c) throws Exception {
+        datastore =
+            datastoreFactory.getDatastore(
+                c.getPipelineOptions(), options.getProjectId(), options.getLocalhost());
+      }
+
+      private RunQueryResponse runQueryWithRetries(RunQueryRequest request) throws Exception {
+        Sleeper sleeper = Sleeper.DEFAULT;
+        BackOff backoff = RUNQUERY_BACKOFF.backoff();
+        while (true) {
+          try {
+            RunQueryResponse response = datastore.runQuery(request);
+            rpcSuccesses.inc();
+            return response;
+          } catch (DatastoreException exception) {
+            rpcErrors.inc();
+
+            if (NON_RETRYABLE_ERRORS.contains(exception.getCode())) {
+              throw exception;
+            }
+            if (!BackOffUtils.next(sleeper, backoff)) {
+              logger.atSevere().log("Aborting after %s retries.", MAX_RETRIES);
+              throw exception;
+            }
+          }
+        }
+      }
+
+      /** Read and output entities for the given query. */
+      @ProcessElement
+      public void processElement(ProcessContext context) throws Exception {
+        Query query = context.element();
+        String namespace = options.getNamespace();
+        int userLimit = query.hasLimit() ? query.getLimit().getValue() : Integer.MAX_VALUE;
+
+        boolean moreResults = true;
+        QueryResultBatch currentBatch = null;
+
+        while (moreResults) {
+          Query.Builder queryBuilder = query.toBuilder();
+          queryBuilder.setLimit(
+              Int32Value.newBuilder().setValue(Math.min(userLimit, QUERY_BATCH_LIMIT)));
+
+          if (currentBatch != null && !currentBatch.getEndCursor().isEmpty()) {
+            queryBuilder.setStartCursor(currentBatch.getEndCursor());
+          }
+
+          RunQueryRequest request = makeRequest(queryBuilder.build(), namespace);
+          RunQueryResponse response = runQueryWithRetries(request);
+
+          currentBatch = response.getBatch();
+
+          // MORE_RESULTS_AFTER_LIMIT is not implemented yet:
+          // https://groups.google.com/forum/#!topic/gcd-discuss/iNs6M1jA2Vw, so
+          // use result count to determine if more results might exist.
+          int numFetch = currentBatch.getEntityResultsCount();
+          if (query.hasLimit()) {
+            verify(
+                userLimit >= numFetch,
+                "Expected userLimit %s >= numFetch %s, because query limit %s must be <= userLimit",
+                userLimit,
+                numFetch,
+                query.getLimit());
+            userLimit -= numFetch;
+          }
+
+          // output all the entities from the current batch.
+          for (EntityResult entityResult : currentBatch.getEntityResultsList()) {
+            context.output(entityResult.getEntity());
+          }
+
+          // Check if we have more entities to be read.
+          moreResults =
+              // User-limit does not exist (so userLimit == MAX_VALUE) and/or has not been satisfied
+              (userLimit > 0)
+                  // All indications from the API are that there are/may be more results.
+                  && ((numFetch == QUERY_BATCH_LIMIT)
+                      || (currentBatch.getMoreResults() == NOT_FINISHED));
+        }
+      }
+
+      @Override
+      public void populateDisplayData(DisplayData.Builder builder) {
+        super.populateDisplayData(builder);
+        builder.include("options", options);
+      }
+    }
+  }
+
+  /**
+   * A wrapper factory class for Cloud Datastore singleton classes {@link DatastoreFactory} and
+   * {@link QuerySplitter}
+   *
+   * <p>{@link DatastoreFactory} and {@link QuerySplitter} are not java serializable, hence wrapping
+   * them under this class, which implements {@link Serializable}.
+   */
+  private static class V1DatastoreFactory implements Serializable {
+
+    /** Builds a Cloud Datastore client for the given pipeline options and project. */
+    public Datastore getDatastore(PipelineOptions pipelineOptions, String projectId) {
+      return getDatastore(pipelineOptions, projectId, null);
+    }
+
+    /**
+     * Builds a Cloud Datastore client for the given pipeline options, project and an optional
+     * locahost.
+     */
+    public Datastore getDatastore(
+        PipelineOptions pipelineOptions, String projectId, @Nullable String localhost) {
+      Credentials credential = pipelineOptions.as(GcpOptions.class).getGcpCredential();
+      HttpRequestInitializer initializer;
+      if (credential != null) {
+        initializer =
+            new ChainingHttpRequestInitializer(
+                new HttpCredentialsAdapter(credential), new RetryHttpRequestInitializer());
+      } else {
+        initializer = new RetryHttpRequestInitializer();
+      }
+
+      DatastoreOptions.Builder builder =
+          new DatastoreOptions.Builder().projectId(projectId).initializer(initializer);
+
+      if (localhost != null) {
+        builder.localHost(localhost);
+      } else {
+        builder.host("batch-datastore.googleapis.com");
+      }
+
+      return DatastoreFactory.get().create(builder.build());
+    }
+
+    /** Builds a Cloud Datastore {@link QuerySplitter}. */
+    public QuerySplitter getQuerySplitter() {
+      return DatastoreHelper.getQuerySplitter();
+    }
+  }
+}
--- a/core/src/main/java/google/registry/env/common/backend/WEB-INF/web.xml
+++ b/core/src/main/java/google/registry/env/common/backend/WEB-INF/web.xml
@@ -337,12 +337,18 @@
    <url-pattern>/_dr/task/refreshDnsOnHostRename</url-pattern>
  </servlet-mapping>

-  <!--  Mapreduce to expand recurring billing events into OneTimes. -->
+  <!-- Mapreduce to expand recurring billing events into OneTimes. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/expandRecurringBillingEvents</url-pattern>
  </servlet-mapping>

+  <!-- Background action to delete domains past end of autorenewal. -->
+  <servlet-mapping>
+    <servlet-name>backend-servlet</servlet-name>
+    <url-pattern>/_dr/task/deleteExpiredDomains</url-pattern>
+  </servlet-mapping>
+
  <!-- Mapreduce to import contacts from escrow file -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
--- a/core/src/main/java/google/registry/env/common/default/WEB-INF/datastore-indexes.xml
+++ b/core/src/main/java/google/registry/env/common/default/WEB-INF/datastore-indexes.xml
@@ -25,11 +25,6 @@
    <property name="tld" direction="asc"/>
    <property name="creationTime" direction="desc"/>
  </datastore-index>
-  <!-- For finding non-autorenewing domains to be deleted. -->
-  <datastore-index kind="DomainBase" ancestor="false" source="manual">
-    <property name="autorenewEndTime" direction="asc"/>
-    <property name="deletionTime" direction="asc"/>
-  </datastore-index>
  <!-- For finding host resources by registrar. -->
  <datastore-index kind="HostResource" ancestor="false" source="manual">
    <property name="currentSponsorClientId" direction="asc"/>
--- a/core/src/main/java/google/registry/env/production/default/WEB-INF/cron.xml
+++ b/core/src/main/java/google/registry/env/production/default/WEB-INF/cron.xml
@@ -280,7 +280,7 @@
  </cron>

  <cron>
-    <url><![CDATA[/_dr/task/icannReportingUpload]]></url>
+    <url><![CDATA[/_dr/cron/fanout?queue=retryable-cron-tasks&endpoint=/_dr/task/icannReportingUpload&runInEmpty]]></url>
    <description>
      Checks if the monthly ICANN reports have been successfully uploaded. If they have not, attempts to upload them again.
      Most of the time, this job should not do anything since the uploads are triggered when the reports are staged.
--- a/core/src/main/java/google/registry/export/BigqueryPollJobAction.java
+++ b/core/src/main/java/google/registry/export/BigqueryPollJobAction.java
@@ -45,13 +45,16 @@ import org.joda.time.Duration;
 /**
 * An action which polls the state of a bigquery job. If it is completed then it will log its
 * completion state; otherwise it will return a failure code so that the task will be retried.
+ *
+ * <p>Note that this is AUTH_INTERNAL_ONLY: we don't allow "admin" for this to mitigate a
+ * vulnerability, see b/177308043.
 */
@Action(
    service = Action.Service.BACKEND,
    path = BigqueryPollJobAction.PATH,
    method = {Action.Method.GET, Action.Method.POST},
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
+    auth = Auth.AUTH_INTERNAL_ONLY)
 public class BigqueryPollJobAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
--- a/core/src/main/java/google/registry/export/ExportPremiumTermsAction.java
+++ b/core/src/main/java/google/registry/export/ExportPremiumTermsAction.java
@@ -17,7 +17,6 @@ package google.registry.export;
 import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.base.Strings.isNullOrEmpty;
 import static com.google.common.net.MediaType.PLAIN_TEXT_UTF_8;
-import static google.registry.model.registry.label.PremiumListUtils.loadPremiumListEntries;
 import static google.registry.request.Action.Method.POST;
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static javax.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
@@ -32,7 +31,8 @@ import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.registry.Registry;
-import google.registry.model.registry.label.PremiumList;
+import google.registry.model.registry.label.PremiumList.PremiumListEntry;
+import google.registry.model.registry.label.PremiumListDualDao;
 import google.registry.request.Action;
 import google.registry.request.Parameter;
 import google.registry.request.RequestParameters;
@@ -137,11 +137,12 @@ public class ExportPremiumTermsAction implements Runnable {
  }

  private String getFormattedPremiumTerms(Registry registry) {
-    Optional<PremiumList> premiumList = PremiumList.getCached(registry.getPremiumList().getName());
-    checkState(premiumList.isPresent(), "Could not load premium list for " + tld);
+    String premiumListName = registry.getPremiumList().getName();
+    checkState(
+        PremiumListDualDao.exists(premiumListName), "Could not load premium list for " + tld);
    SortedSet<String> premiumTerms =
-        Streams.stream(loadPremiumListEntries(premiumList.get()))
-            .map(entry -> Joiner.on(",").join(entry.getLabel(), entry.getValue()))
+        Streams.stream(PremiumListDualDao.loadAllPremiumListEntries(premiumListName))
+            .map(PremiumListEntry::toString)
            .collect(ImmutableSortedSet.toImmutableSortedSet(String::compareTo));

    return Joiner.on("\n")
--- a/core/src/main/java/google/registry/flows/EppRequestHandler.java
+++ b/core/src/main/java/google/registry/flows/EppRequestHandler.java
@@ -25,6 +25,7 @@ import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
 import google.registry.model.eppoutput.EppOutput;
 import google.registry.request.Response;
+import google.registry.util.ProxyHttpHeaders;
 import javax.inject.Inject;

 /** Handle an EPP request and response. */
@@ -72,7 +73,7 @@ public class EppRequestHandler {
      // See: https://tools.ietf.org/html/rfc5734#section-2
      if (eppOutput.isResponse()
          && eppOutput.getResponse().getResult().getCode() == SUCCESS_AND_CLOSE) {
-        response.setHeader("Epp-Session", "close");
+        response.setHeader(ProxyHttpHeaders.EPP_SESSION, "close");
      }
      // If a login request returns a success, a logged-in header is added to the response to inform
      // the proxy that it is no longer necessary to send the full client certificate to the backend
@@ -80,7 +81,7 @@ public class EppRequestHandler {
      if (eppOutput.isResponse()
          && eppOutput.getResponse().isLoginResponse()
          && eppOutput.isSuccess()) {
-        response.setHeader("Logged-In", "true");
+        response.setHeader(ProxyHttpHeaders.LOGGED_IN, "true");
      }
    } catch (Exception e) {
      logger.atWarning().withCause(e).log("handleEppCommand general exception");
--- a/core/src/main/java/google/registry/flows/EppRequestSource.java
+++ b/core/src/main/java/google/registry/flows/EppRequestSource.java
@@ -22,5 +22,6 @@ public enum EppRequestSource {
  TLS,
  TOOL,
  CHECK_API,
-  UNIT_TEST
+  UNIT_TEST,
+  BACKEND
 }
--- a/core/src/main/java/google/registry/flows/ExtensionManager.java
+++ b/core/src/main/java/google/registry/flows/ExtensionManager.java
@@ -47,8 +47,8 @@ public final class ExtensionManager {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();

-  /** Blacklist of extension URIs that cause an error if they are used without being declared. */
-  private static final ImmutableSet<String> UNDECLARED_URIS_BLACKLIST = FEE_EXTENSION_URIS;
+  /** Denylist of extension URIs that cause an error if they are used without being declared. */
+  private static final ImmutableSet<String> UNDECLARED_URIS_DENYLIST = FEE_EXTENSION_URIS;

  private final ImmutableSet.Builder<Class<? extends CommandExtension>> implementedBuilder =
      new ImmutableSet.Builder<>();
@@ -95,7 +95,7 @@ public final class ExtensionManager {
    if (undeclaredUris.isEmpty()) {
      return;
    }
-    Set<String> undeclaredUrisThatError = intersection(undeclaredUris, UNDECLARED_URIS_BLACKLIST);
+    Set<String> undeclaredUrisThatError = intersection(undeclaredUris, UNDECLARED_URIS_DENYLIST);
    if (!undeclaredUrisThatError.isEmpty()) {
      throw new UndeclaredServiceExtensionException(undeclaredUrisThatError);
    }
@@ -104,11 +104,14 @@ public final class ExtensionManager {
        clientId, flowClass.getSimpleName(), undeclaredUris);
  }

+  private static final ImmutableSet<EppRequestSource> ALLOWED_METADATA_EPP_REQUEST_SOURCES =
+      ImmutableSet.of(EppRequestSource.TOOL, EppRequestSource.BACKEND);
+
  private void checkForRestrictedExtensions(
      ImmutableSet<Class<? extends CommandExtension>> suppliedExtensions)
      throws OnlyToolCanPassMetadataException, UnauthorizedForSuperuserExtensionException {
    if (suppliedExtensions.contains(MetadataExtension.class)
-        && !eppRequestSource.equals(EppRequestSource.TOOL)) {
+        && !ALLOWED_METADATA_EPP_REQUEST_SOURCES.contains(eppRequestSource)) {
      throw new OnlyToolCanPassMetadataException();
    }
    // Can't use suppliedExtension.contains() here because the SuperuserExtension has child classes.
--- a/core/src/main/java/google/registry/flows/ResourceFlowUtils.java
+++ b/core/src/main/java/google/registry/flows/ResourceFlowUtils.java
@@ -18,12 +18,11 @@ import static com.google.common.collect.Sets.intersection;
 import static google.registry.model.EppResourceUtils.getLinkedDomainKeys;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
 import static google.registry.model.index.ForeignKeyIndex.loadAndGetKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.persistence.transaction.TransactionManagerUtil.transactIfJpaTm;

 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Sets;
-import com.googlecode.objectify.Key;
 import google.registry.flows.EppException.AuthorizationErrorException;
 import google.registry.flows.EppException.InvalidAuthorizationInformationErrorException;
 import google.registry.flows.EppException.ObjectDoesNotExistException;
@@ -185,16 +184,15 @@ public final class ResourceFlowUtils {
      return;
    }
    // The roid should match one of the contacts.
-    Optional<Key<ContactResource>> foundContact =
+    Optional<VKey<ContactResource>> foundContact =
        domain.getReferencedContacts().stream()
-            .map(VKey::getOfyKey)
-            .filter(key -> key.getName().equals(authRepoId))
+            .filter(key -> key.getOfyKey().getName().equals(authRepoId))
            .findFirst();
    if (!foundContact.isPresent()) {
      throw new BadAuthInfoForResourceException();
    }
    // Check the authInfo against the contact.
-    verifyAuthInfo(authInfo, ofy().load().key(foundContact.get()).now());
+    verifyAuthInfo(authInfo, transactIfJpaTm(() -> tm().loadByKey(foundContact.get())));
  }

  /** Check that the given {@link AuthInfo} is valid for the given contact. */
--- a/core/src/main/java/google/registry/flows/TlsCredentials.java
+++ b/core/src/main/java/google/registry/flows/TlsCredentials.java
@@ -33,6 +33,8 @@ import google.registry.flows.certs.CertificateChecker.InsecureCertificateExcepti
 import google.registry.model.registrar.Registrar;
 import google.registry.request.Header;
 import google.registry.util.CidrAddressBlock;
+import google.registry.util.Clock;
+import google.registry.util.ProxyHttpHeaders;
 import java.io.ByteArrayInputStream;
 import java.net.InetAddress;
 import java.security.cert.CertificateException;
@@ -41,6 +43,7 @@ import java.util.Base64;
 import java.util.Optional;
 import javax.inject.Inject;
 import javax.servlet.http.HttpServletRequest;
+import org.joda.time.DateTime;

 /**
 * Container and validation for TLS certificate and IP-allow-listing.
@@ -63,25 +66,30 @@ import javax.servlet.http.HttpServletRequest;
 public class TlsCredentials implements TransportCredentials {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+  private static final DateTime CERT_ENFORCEMENT_START_TIME =
+      DateTime.parse("2021-03-01T16:00:00Z");

  private final boolean requireSslCertificates;
  private final Optional<String> clientCertificateHash;
  private final Optional<String> clientCertificate;
  private final Optional<InetAddress> clientInetAddr;
  private final CertificateChecker certificateChecker;
+  private final Clock clock;

  @Inject
  public TlsCredentials(
      @Config("requireSslCertificates") boolean requireSslCertificates,
-      @Header("X-SSL-Certificate") Optional<String> clientCertificateHash,
-      @Header("X-SSL-Full-Certificate") Optional<String> clientCertificate,
-      @Header("X-Forwarded-For") Optional<String> clientAddress,
-      CertificateChecker certificateChecker) {
+      @Header(ProxyHttpHeaders.CERTIFICATE_HASH) Optional<String> clientCertificateHash,
+      @Header(ProxyHttpHeaders.FULL_CERTIFICATE) Optional<String> clientCertificate,
+      @Header(ProxyHttpHeaders.IP_ADDRESS) Optional<String> clientAddress,
+      CertificateChecker certificateChecker,
+      Clock clock) {
    this.requireSslCertificates = requireSslCertificates;
    this.clientCertificateHash = clientCertificateHash;
    this.clientCertificate = clientCertificate;
    this.clientInetAddr = clientAddress.map(TlsCredentials::parseInetAddress);
    this.certificateChecker = certificateChecker;
+    this.clock = clock;
  }

  static InetAddress parseInetAddress(String asciiAddr) {
@@ -180,9 +188,12 @@ public class TlsCredentials implements TransportCredentials {
        try {
          certificateChecker.validateCertificate(passedCert);
        } catch (InsecureCertificateException e) {
+          // TODO(Sarahbot@): Remove this if statement after March 1. After March 1, exception
+          // should be thrown in all environments.
          // throw exception in unit tests and Sandbox
          if (RegistryEnvironment.get().equals(RegistryEnvironment.UNITTEST)
-              || RegistryEnvironment.get().equals(RegistryEnvironment.SANDBOX)) {
+              || RegistryEnvironment.get().equals(RegistryEnvironment.SANDBOX)
+              || clock.nowUtc().isAfter(CERT_ENFORCEMENT_START_TIME)) {
            throw new CertificateContainsSecurityViolationsException(e);
          }
          logger.atWarning().log(
@@ -204,6 +215,9 @@ public class TlsCredentials implements TransportCredentials {
  }

  private void validateCertificateHash(Registrar registrar) throws AuthenticationErrorException {
+    logger.atWarning().log(
+        "Error validating certificate for %s, attempting to validate using certificate hash.",
+        registrar.getClientId());
    // Check the certificate hash as a failover
    // TODO(sarahbot): Remove hash checks once certificate checks are working.
    if (!registrar.getClientCertificateHash().isPresent()
@@ -315,25 +329,25 @@ public class TlsCredentials implements TransportCredentials {
  public static final class EppTlsModule {

    @Provides
-    @Header("X-SSL-Certificate")
+    @Header(ProxyHttpHeaders.CERTIFICATE_HASH)
    static Optional<String> provideClientCertificateHash(HttpServletRequest req) {
      // Note: This header is actually required, we just want to handle its absence explicitly
      // by throwing an EPP exception rather than a generic Bad Request exception.
-      return extractOptionalHeader(req, "X-SSL-Certificate");
+      return extractOptionalHeader(req, ProxyHttpHeaders.CERTIFICATE_HASH);
    }

    @Provides
-    @Header("X-SSL-Full-Certificate")
+    @Header(ProxyHttpHeaders.FULL_CERTIFICATE)
    static Optional<String> provideClientCertificate(HttpServletRequest req) {
      // Note: This header is actually required, we just want to handle its absence explicitly
      // by throwing an EPP exception rather than a generic Bad Request exception.
-      return extractOptionalHeader(req, "X-SSL-Full-Certificate");
+      return extractOptionalHeader(req, ProxyHttpHeaders.FULL_CERTIFICATE);
    }

    @Provides
-    @Header("X-Forwarded-For")
-    static Optional<String> provideForwardedFor(HttpServletRequest req) {
-      return extractOptionalHeader(req, "X-Forwarded-For");
+    @Header(ProxyHttpHeaders.IP_ADDRESS)
+    static Optional<String> provideIpAddress(HttpServletRequest req) {
+      return extractOptionalHeader(req, ProxyHttpHeaders.IP_ADDRESS);
    }
  }
 }
--- a/core/src/main/java/google/registry/flows/domain/DomainCheckFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainCheckFlow.java
@@ -301,6 +301,7 @@ public final class DomainCheckFlow implements Flow {
          feeCheck.getItems().stream()
              .filter(fc -> fc.getCommandName() == CommandName.RESTORE)
              .map(FeeCheckCommandExtensionItem::getDomainName)
+              .distinct()
              .collect(toImmutableList());
    } else if (feeCheck.getItems().stream()
        .anyMatch(fc -> fc.getCommandName() == CommandName.RESTORE)) {
--- a/core/src/main/java/google/registry/flows/domain/DomainFlowUtils.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainFlowUtils.java
@@ -25,6 +25,9 @@ import static com.google.common.collect.Iterables.any;
 import static com.google.common.collect.Sets.difference;
 import static com.google.common.collect.Sets.intersection;
 import static com.google.common.collect.Sets.union;
+import static google.registry.model.DatabaseMigrationUtils.getPrimaryDatabase;
+import static google.registry.model.common.DatabaseTransitionSchedule.PrimaryDatabase.DATASTORE;
+import static google.registry.model.common.DatabaseTransitionSchedule.TransitionId.REPLAYED_ENTITIES;
 import static google.registry.model.domain.DomainBase.MAX_REGISTRATION_YEARS;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.model.registry.Registries.findTldForName;
@@ -38,6 +41,7 @@ import static google.registry.model.registry.label.ReservationType.FULLY_BLOCKED
 import static google.registry.model.registry.label.ReservationType.NAME_COLLISION;
 import static google.registry.model.registry.label.ReservationType.RESERVED_FOR_ANCHOR_TENANT;
 import static google.registry.model.registry.label.ReservationType.RESERVED_FOR_SPECIFIC_USE;
+import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.pricing.PricingEngineProxy.isDomainPremium;
 import static google.registry.util.CollectionUtils.nullToEmpty;
@@ -88,6 +92,7 @@ import google.registry.model.domain.DomainCommand.Create;
 import google.registry.model.domain.DomainCommand.CreateOrUpdate;
 import google.registry.model.domain.DomainCommand.InvalidReferencesException;
 import google.registry.model.domain.DomainCommand.Update;
+import google.registry.model.domain.DomainHistory;
 import google.registry.model.domain.ForeignKeyedDesignatedContact;
 import google.registry.model.domain.Period;
 import google.registry.model.domain.fee.BaseFee;
@@ -355,22 +360,23 @@ public class DomainFlowUtils {

  static void validateNoDuplicateContacts(Set<DesignatedContact> contacts)
      throws ParameterValuePolicyErrorException {
-    ImmutableMultimap<Type, Key<ContactResource>> contactsByType =
+    ImmutableMultimap<Type, VKey<ContactResource>> contactsByType =
        contacts.stream()
            .collect(
                toImmutableSetMultimap(
-                    DesignatedContact::getType, contact -> contact.getContactKey().getOfyKey()));
+                    DesignatedContact::getType, contact -> contact.getContactKey()));

    // If any contact type has multiple contacts:
    if (contactsByType.asMap().values().stream().anyMatch(v -> v.size() > 1)) {
      // Find the duplicates.
-      Map<Type, Collection<Key<ContactResource>>> dupeKeysMap =
+      Map<Type, Collection<VKey<ContactResource>>> dupeKeysMap =
          Maps.filterEntries(contactsByType.asMap(), e -> e.getValue().size() > 1);
-      ImmutableList<Key<ContactResource>> dupeKeys =
+      ImmutableList<VKey<ContactResource>> dupeKeys =
          dupeKeysMap.values().stream().flatMap(Collection::stream).collect(toImmutableList());
      // Load the duplicates in one batch.
-      Map<Key<ContactResource>, ContactResource> dupeContacts = ofy().load().keys(dupeKeys);
-      ImmutableMultimap.Builder<Type, Key<ContactResource>> typesMap =
+      Map<VKey<? extends ContactResource>, ContactResource> dupeContacts =
+          tm().loadByKeys(dupeKeys);
+      ImmutableMultimap.Builder<Type, VKey<ContactResource>> typesMap =
          new ImmutableMultimap.Builder<>();
      dupeKeysMap.forEach(typesMap::putAll);
      // Create an error message showing the type and contact IDs of the duplicates.
@@ -537,13 +543,13 @@ public class DomainFlowUtils {
    // If the resultant autorenew poll message would have no poll messages to deliver, then just
    // delete it. Otherwise save it with the new end time.
    if (isAtOrAfter(updatedAutorenewPollMessage.getEventTime(), newEndTime)) {
-      autorenewPollMessage.ifPresent(autorenew -> ofy().delete().entity(autorenew));
+      autorenewPollMessage.ifPresent(autorenew -> tm().delete(autorenew));
    } else {
-      ofy().save().entity(updatedAutorenewPollMessage);
+      tm().put(updatedAutorenewPollMessage);
    }

    Recurring recurring = tm().loadByKey(domain.getAutorenewBillingEvent());
-    ofy().save().entity(recurring.asBuilder().setRecurrenceEndTime(newEndTime).build());
+    tm().put(recurring.asBuilder().setRecurrenceEndTime(newEndTime).build());
  }

  /**
@@ -1045,18 +1051,11 @@ public class DomainFlowUtils {
      Duration maxSearchPeriod,
      final ImmutableSet<TransactionReportField> cancelableFields) {

-    List<HistoryEntry> recentHistoryEntries =
-        ofy()
-            .load()
-            .type(HistoryEntry.class)
-            .ancestor(domainBase)
-            .filter("modificationTime >=", now.minus(maxSearchPeriod))
-            .order("modificationTime")
-            .list();
-    Optional<HistoryEntry> entryToCancel =
+    List<? extends HistoryEntry> recentHistoryEntries =
+        findRecentHistoryEntries(domainBase, now, maxSearchPeriod);
+    Optional<? extends HistoryEntry> entryToCancel =
        Streams.findLast(
-            recentHistoryEntries
-                .stream()
+            recentHistoryEntries.stream()
                .filter(
                    historyEntry -> {
                      // Look for add and renew transaction records that have yet to be reported
@@ -1082,6 +1081,28 @@ public class DomainFlowUtils {
    return recordsBuilder.build();
  }

+  private static List<? extends HistoryEntry> findRecentHistoryEntries(
+      DomainBase domainBase, DateTime now, Duration maxSearchPeriod) {
+    if (getPrimaryDatabase(REPLAYED_ENTITIES).equals(DATASTORE)) {
+      return ofy()
+          .load()
+          .type(HistoryEntry.class)
+          .ancestor(domainBase)
+          .filter("modificationTime >=", now.minus(maxSearchPeriod))
+          .order("modificationTime")
+          .list();
+    } else {
+      return jpaTm()
+          .getEntityManager()
+          .createQuery(
+              "FROM DomainHistory WHERE modificationTime >= :beginning "
+                  + "ORDER BY modificationTime ASC",
+              DomainHistory.class)
+          .setParameter("beginning", now.minus(maxSearchPeriod))
+          .getResultList();
+    }
+  }
+
  /** Resource linked to this domain does not exist. */
  static class LinkedResourcesDoNotExistException extends ObjectDoesNotExistException {
    public LinkedResourcesDoNotExistException(Class<?> type, ImmutableSet<String> resourceIds) {
--- a/core/src/main/java/google/registry/flows/domain/DomainTransferRejectFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainTransferRejectFlow.java
@@ -25,7 +25,6 @@ import static google.registry.flows.domain.DomainFlowUtils.updateAutorenewRecurr
 import static google.registry.flows.domain.DomainTransferUtils.createGainingTransferPollMessage;
 import static google.registry.flows.domain.DomainTransferUtils.createTransferResponse;
 import static google.registry.model.ResourceTransferUtils.denyPendingTransfer;
-import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.model.reporting.DomainTransactionRecord.TransactionReportField.TRANSFER_NACKED;
 import static google.registry.model.reporting.DomainTransactionRecord.TransactionReportField.TRANSFER_SUCCESSFUL;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
@@ -41,7 +40,6 @@ import google.registry.flows.FlowModule.Superuser;
 import google.registry.flows.FlowModule.TargetId;
 import google.registry.flows.TransactionalFlow;
 import google.registry.flows.annotations.ReportingSpec;
-import google.registry.model.ImmutableObject;
 import google.registry.model.domain.DomainBase;
 import google.registry.model.domain.metadata.MetadataExtension;
 import google.registry.model.eppcommon.AuthInfo;
@@ -102,11 +100,11 @@ public final class DomainTransferRejectFlow implements TransactionalFlow {
    }
    DomainBase newDomain =
        denyPendingTransfer(existingDomain, TransferStatus.CLIENT_REJECTED, now, clientId);
-    ofy().save().<ImmutableObject>entities(
-        newDomain,
-        historyEntry,
-        createGainingTransferPollMessage(
-            targetId, newDomain.getTransferData(), null, historyEntry));
+    tm().putAll(
+            newDomain,
+            historyEntry,
+            createGainingTransferPollMessage(
+                targetId, newDomain.getTransferData(), null, historyEntry));
    // Reopen the autorenew event and poll message that we closed for the implicit transfer. This
    // may end up recreating the poll message if it was deleted upon the transfer request.
    updateAutorenewRecurrenceEndTime(existingDomain, END_OF_TIME);
--- a/core/src/main/java/google/registry/model/DatabaseMigrationUtils.java
+++ b/core/src/main/java/google/registry/model/DatabaseMigrationUtils.java
@@ -16,6 +16,9 @@ package google.registry.model;

 import com.google.common.flogger.FluentLogger;
 import google.registry.config.RegistryEnvironment;
+import google.registry.model.common.DatabaseTransitionSchedule;
+import google.registry.model.common.DatabaseTransitionSchedule.PrimaryDatabase;
+import google.registry.model.common.DatabaseTransitionSchedule.TransitionId;

 /** Utility methods related to migrating dual-read/dual-write entities. */
 public class DatabaseMigrationUtils {
@@ -34,5 +37,12 @@ public class DatabaseMigrationUtils {
    }
  }

+  /** Gets the value for the database currently considered primary. */
+  public static PrimaryDatabase getPrimaryDatabase(TransitionId transitionId) {
+    return DatabaseTransitionSchedule.getCached(transitionId)
+        .map(DatabaseTransitionSchedule::getPrimaryDatabase)
+        .orElse(PrimaryDatabase.DATASTORE);
+  }
+
  private DatabaseMigrationUtils() {}
 }
--- a/core/src/main/java/google/registry/model/EntityClasses.java
+++ b/core/src/main/java/google/registry/model/EntityClasses.java
@@ -17,6 +17,7 @@ package google.registry.model;
 import com.google.common.collect.ImmutableSet;
 import google.registry.model.billing.BillingEvent;
 import google.registry.model.common.Cursor;
+import google.registry.model.common.DatabaseTransitionSchedule;
 import google.registry.model.common.EntityGroupRoot;
 import google.registry.model.common.GaeUserIdConverter;
 import google.registry.model.contact.ContactHistory;
@@ -51,6 +52,7 @@ import google.registry.model.tmch.ClaimsListShard;
 import google.registry.model.tmch.ClaimsListShard.ClaimsListRevision;
 import google.registry.model.tmch.ClaimsListShard.ClaimsListSingleton;
 import google.registry.model.tmch.TmchCrl;
+import google.registry.schema.replay.LastSqlTransaction;

 /** Sets of classes of the Objectify-registered entities in use throughout the model. */
 public final class EntityClasses {
@@ -74,6 +76,7 @@ public final class EntityClasses {
          ContactHistory.class,
          ContactResource.class,
          Cursor.class,
+          DatabaseTransitionSchedule.class,
          DomainBase.class,
          DomainHistory.class,
          EntityGroupRoot.class,
@@ -88,6 +91,7 @@ public final class EntityClasses {
          HostResource.class,
          KmsSecret.class,
          KmsSecretRevision.class,
+          LastSqlTransaction.class,
          Lock.class,
          PollMessage.class,
          PollMessage.Autorenew.class,
--- a/core/src/main/java/google/registry/model/OteAccountBuilder.java
+++ b/core/src/main/java/google/registry/model/OteAccountBuilder.java
@@ -40,6 +40,7 @@ import google.registry.model.registrar.RegistrarContact;
 import google.registry.model.registry.Registry;
 import google.registry.model.registry.Registry.TldState;
 import google.registry.model.registry.label.PremiumList;
+import google.registry.model.registry.label.PremiumListDualDao;
 import google.registry.util.CidrAddressBlock;
 import java.util.Collection;
 import java.util.Optional;
@@ -288,7 +289,7 @@ public final class OteAccountBuilder {
      boolean isEarlyAccess,
      int roidSuffix) {
    String tldNameAlphaNumerical = tldName.replaceAll("[^a-z0-9]", "");
-    Optional<PremiumList> premiumList = PremiumList.getUncached(DEFAULT_PREMIUM_LIST);
+    Optional<PremiumList> premiumList = PremiumListDualDao.getLatestRevision(DEFAULT_PREMIUM_LIST);
    checkState(premiumList.isPresent(), "Couldn't find premium list %s.", DEFAULT_PREMIUM_LIST);
    Registry.Builder builder =
        new Registry.Builder()
--- a/core/src/main/java/google/registry/model/ResourceTransferUtils.java
+++ b/core/src/main/java/google/registry/model/ResourceTransferUtils.java
@@ -118,9 +118,7 @@ public final class ResourceTransferUtils {
    if (resource.getStatusValues().contains(StatusValue.PENDING_TRANSFER)) {
      TransferData oldTransferData = resource.getTransferData();
      tm().delete(oldTransferData.getServerApproveEntities());
-      ofy()
-          .save()
-          .entity(
+      tm().put(
              new PollMessage.OneTime.Builder()
                  .setClientId(oldTransferData.getGainingClientId())
                  .setEventTime(now)
--- a/core/src/main/java/google/registry/model/common/DatabaseTransitionSchedule.java
+++ b/core/src/main/java/google/registry/model/common/DatabaseTransitionSchedule.java
@@ -0,0 +1,161 @@
+// Copyright 2021 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.common;
+
+import static com.google.common.base.Preconditions.checkNotNull;
+import static google.registry.config.RegistryConfig.getSingletonCacheRefreshDuration;
+import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
+import static google.registry.persistence.transaction.TransactionManagerFactory.ofyTm;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+
+import com.google.common.cache.CacheBuilder;
+import com.google.common.cache.CacheLoader;
+import com.google.common.cache.LoadingCache;
+import com.google.common.collect.ImmutableSortedMap;
+import com.googlecode.objectify.Key;
+import com.googlecode.objectify.annotation.Embed;
+import com.googlecode.objectify.annotation.Entity;
+import com.googlecode.objectify.annotation.Id;
+import com.googlecode.objectify.annotation.Mapify;
+import com.googlecode.objectify.annotation.Parent;
+import google.registry.model.ImmutableObject;
+import google.registry.model.UpdateAutoTimestamp;
+import google.registry.model.common.TimedTransitionProperty.TimeMapper;
+import google.registry.model.common.TimedTransitionProperty.TimedTransition;
+import google.registry.model.registry.label.PremiumList;
+import google.registry.model.registry.label.ReservedList;
+import google.registry.model.smd.SignedMarkRevocationList;
+import google.registry.persistence.VKey;
+import google.registry.schema.replay.DatastoreOnlyEntity;
+import java.util.Optional;
+import javax.annotation.concurrent.Immutable;
+import org.joda.time.DateTime;
+
+@Entity
+@Immutable
+public class DatabaseTransitionSchedule extends ImmutableObject implements DatastoreOnlyEntity {
+
+  /**
+   * The name of the database to be treated as the primary database. The first entry in the schedule
+   * will always be Datastore.
+   */
+  public enum PrimaryDatabase {
+    CLOUD_SQL,
+    DATASTORE
+  }
+
+  /** The id of the transition schedule. */
+  public enum TransitionId {
+    /** The schedule for the migration of {@link PremiumList} and {@link ReservedList}. */
+    DOMAIN_LABEL_LISTS,
+    /** The schedule for the migration of the {@link SignedMarkRevocationList} entity. */
+    SIGNED_MARK_REVOCATION_LIST,
+    /** The schedule for all asynchronously-replayed entities, ones not dually-written. */
+    REPLAYED_ENTITIES,
+  }
+
+  /**
+   * The transition to a specified primary database at a specific point in time, for use in a
+   * TimedTransitionProperty.
+   */
+  @Embed
+  public static class PrimaryDatabaseTransition extends TimedTransition<PrimaryDatabase> {
+    private PrimaryDatabase primaryDatabase;
+
+    @Override
+    protected PrimaryDatabase getValue() {
+      return primaryDatabase;
+    }
+
+    @Override
+    protected void setValue(PrimaryDatabase primaryDatabase) {
+      this.primaryDatabase = primaryDatabase;
+    }
+  }
+
+  @Parent Key<EntityGroupRoot> parent = getCrossTldKey();
+
+  @Id String transitionId;
+
+  /** An automatically managed timestamp of when this schedule was last written to Datastore. */
+  UpdateAutoTimestamp lastUpdateTime = UpdateAutoTimestamp.create(null);
+
+  /** A property that tracks the primary database for a dual-read/dual-write database migration. */
+  @Mapify(TimeMapper.class)
+  TimedTransitionProperty<PrimaryDatabase, PrimaryDatabaseTransition> databaseTransitions =
+      TimedTransitionProperty.forMapify(PrimaryDatabase.DATASTORE, PrimaryDatabaseTransition.class);
+
+  /** A cache that loads the {@link DatabaseTransitionSchedule} for a given id. */
+  private static final LoadingCache<TransitionId, Optional<DatabaseTransitionSchedule>> CACHE =
+      CacheBuilder.newBuilder()
+          .expireAfterWrite(
+              java.time.Duration.ofMillis(getSingletonCacheRefreshDuration().getMillis()))
+          .build(
+              new CacheLoader<TransitionId, Optional<DatabaseTransitionSchedule>>() {
+                @Override
+                public Optional<DatabaseTransitionSchedule> load(TransitionId transitionId) {
+                  return DatabaseTransitionSchedule.get(transitionId);
+                }
+              });
+
+  public static DatabaseTransitionSchedule create(
+      TransitionId transitionId,
+      TimedTransitionProperty<PrimaryDatabase, PrimaryDatabaseTransition> databaseTransitions) {
+    checkNotNull(transitionId, "Id cannot be null");
+    checkNotNull(databaseTransitions, "databaseTransitions cannot be null");
+    databaseTransitions.checkValidity();
+    DatabaseTransitionSchedule instance = new DatabaseTransitionSchedule();
+    instance.transitionId = transitionId.name();
+    instance.databaseTransitions = databaseTransitions;
+    return instance;
+  }
+
+  /** Returns the database that is indicated as primary at the given time. */
+  public PrimaryDatabase getPrimaryDatabase() {
+    return databaseTransitions.getValueAtTime(tm().getTransactionTime());
+  }
+
+  /** Returns the database transitions as a map of start time to primary database. */
+  public ImmutableSortedMap<DateTime, PrimaryDatabase> getDatabaseTransitions() {
+    return databaseTransitions.toValueMap();
+  }
+
+  /**
+   * Returns the current cached schedule for the given id.
+   *
+   * <p>WARNING: The schedule returned by this method could be up to 10 minutes out of date.
+   */
+  public static Optional<DatabaseTransitionSchedule> getCached(TransitionId id) {
+    return CACHE.getUnchecked(id);
+  }
+
+  /** Returns the schedule for a given id. */
+  public static Optional<DatabaseTransitionSchedule> get(TransitionId transitionId) {
+    VKey<DatabaseTransitionSchedule> key =
+        VKey.create(
+            DatabaseTransitionSchedule.class,
+            transitionId,
+            Key.create(getCrossTldKey(), DatabaseTransitionSchedule.class, transitionId.name()));
+
+    return ofyTm().transact(() -> ofyTm().loadByKeyIfPresent(key));
+  }
+
+  @Override
+  public String toString() {
+    return String.format(
+        "%s(last updated at %s): %s",
+        transitionId, lastUpdateTime.getTimestamp(), databaseTransitions.toValueMap());
+  }
+}
--- a/core/src/main/java/google/registry/model/domain/DomainContent.java
+++ b/core/src/main/java/google/registry/model/domain/DomainContent.java
@@ -14,6 +14,7 @@

 package google.registry.model.domain;

+import static com.google.common.base.MoreObjects.firstNonNull;
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Strings.emptyToNull;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
@@ -50,7 +51,6 @@ import com.googlecode.objectify.condition.IfNull;
 import google.registry.flows.ResourceFlowUtils;
 import google.registry.model.EppResource;
 import google.registry.model.EppResource.ResourceWithTransferData;
-import google.registry.model.ImmutableObject.EmptySetToNull;
 import google.registry.model.billing.BillingEvent;
 import google.registry.model.common.EntityGroupRoot;
 import google.registry.model.contact.ContactResource;
@@ -66,6 +66,7 @@ import google.registry.model.transfer.DomainTransferData;
 import google.registry.model.transfer.TransferStatus;
 import google.registry.persistence.VKey;
 import google.registry.util.CollectionUtils;
+import google.registry.util.DateTimeUtils;
 import java.util.HashSet;
 import java.util.Objects;
 import java.util.Optional;
@@ -284,9 +285,10 @@ public class DomainContent extends EppResource
  /**
   * When the domain's autorenewal status will expire.
   *
-   * <p>This will be null for the vast majority of domains because all domains autorenew
-   * indefinitely by default and autorenew can only be countermanded by administrators, typically
-   * for reasons of the URS process or termination of a registrar for nonpayment.
+   * <p>This will be {@link DateTimeUtils#END_OF_TIME} for the vast majority of domains because all
+   * domains autorenew indefinitely by default and autorenew can only be countermanded by
+   * administrators, typically for reasons of the URS process or termination of a registrar for
+   * nonpayment.
   *
   * <p>When a domain is scheduled to not autorenew, this field is set to the current value of its
   * {@link #registrationExpirationTime}, after which point the next invocation of a periodic
@@ -295,10 +297,16 @@ public class DomainContent extends EppResource
   * difference domains that have reached their life and must be deleted now, and domains that
   * happen to be in the autorenew grace period now but should be deleted in roughly a year.
   */
-  @Nullable @Index DateTime autorenewEndTime;
+  @Index DateTime autorenewEndTime;

  @OnLoad
  void load() {
+    // Back fill with correct END_OF_TIME sentinel value.
+    // TODO(mcilwain): Remove this once back-filling is complete.
+    if (autorenewEndTime == null) {
+      autorenewEndTime = END_OF_TIME;
+    }
+
    // Reconstitute all of the contacts so that they have VKeys.
    allContacts =
        allContacts.stream().map(DesignatedContact::reconstitute).collect(toImmutableSet());
@@ -329,6 +337,10 @@ public class DomainContent extends EppResource
        nullToEmptyImmutableCopy(dsData).stream()
            .map(dsData -> dsData.cloneWithDomainRepoId(getRepoId()))
            .collect(toImmutableSet());
+
+    if (transferData != null) {
+      transferData.convertVKeys();
+    }
  }

  @PostLoad
@@ -403,8 +415,20 @@ public class DomainContent extends EppResource
    return smdId;
  }

+  /**
+   * Returns the autorenew end time if there is one, otherwise empty.
+   *
+   * <p>Note that {@link DateTimeUtils#END_OF_TIME} is used as a sentinel value in the database
+   * representation to signify that autorenew doesn't end, and is mapped to empty here for the
+   * purposes of more legible business logic.
+   */
  public Optional<DateTime> getAutorenewEndTime() {
-    return Optional.ofNullable(autorenewEndTime);
+    // TODO(mcilwain): Remove null handling for autorenewEndTime once data migration away from null
+    //                 is complete.
+    return Optional.ofNullable(
+        (autorenewEndTime == null || autorenewEndTime.equals(END_OF_TIME))
+            ? null
+            : autorenewEndTime);
  }

  @Override
@@ -779,6 +803,8 @@ public class DomainContent extends EppResource
      } else { // There are nameservers, so make sure INACTIVE isn't there.
        removeStatusValue(StatusValue.INACTIVE);
      }
+      // If there is no autorenew end time, set it to END_OF_TIME.
+      instance.autorenewEndTime = firstNonNull(getInstance().autorenewEndTime, END_OF_TIME);

      checkArgumentNotNull(emptyToNull(instance.fullyQualifiedDomainName), "Missing domainName");
      if (instance.getRegistrant() == null
@@ -958,8 +984,15 @@ public class DomainContent extends EppResource
      return thisCastToDerived();
    }

+    /**
+     * Sets the autorenew end time, or clears it if empty is passed.
+     *
+     * <p>Note that {@link DateTimeUtils#END_OF_TIME} is used as a sentinel value in the database
+     * representation to signify that autorenew doesn't end, and is mapped to empty here for the
+     * purposes of more legible business logic.
+     */
    public B setAutorenewEndTime(Optional<DateTime> autorenewEndTime) {
-      getInstance().autorenewEndTime = autorenewEndTime.orElse(null);
+      getInstance().autorenewEndTime = autorenewEndTime.orElse(END_OF_TIME);
      return thisCastToDerived();
    }

--- a/core/src/main/java/google/registry/model/ofy/DatastoreTransactionManager.java
+++ b/core/src/main/java/google/registry/model/ofy/DatastoreTransactionManager.java
@@ -131,6 +131,11 @@ public class DatastoreTransactionManager implements TransactionManager {
    saveEntity(entity);
  }

+  @Override
+  public void putAll(Object... entities) {
+    syncIfTransactionless(getOfy().save().entities(entities));
+  }
+
  @Override
  public void putAll(ImmutableCollection<?> entities) {
    syncIfTransactionless(getOfy().save().entities(entities));
--- a/core/src/main/java/google/registry/model/ofy/EntityWritePriorities.java
+++ b/core/src/main/java/google/registry/model/ofy/EntityWritePriorities.java
@@ -41,9 +41,9 @@ public class EntityWritePriorities {
   */
  static final ImmutableMap<String, Integer> CLASS_PRIORITIES =
      ImmutableMap.of(
+          "ContactResource", -15,
          "HistoryEntry", -10,
          "AllocationToken", -9,
-          "ContactResource", 5,
          "DomainBase", 10);

  // The beginning of the range of priority numbers reserved for delete.  This must be greater than
--- a/core/src/main/java/google/registry/model/ofy/Ofy.java
+++ b/core/src/main/java/google/registry/model/ofy/Ofy.java
@@ -116,7 +116,7 @@ public class Ofy {
    return ofy().getTransaction() != null;
  }

-  void assertInTransaction() {
+  public void assertInTransaction() {
    checkState(inTransaction(), "Must be called in a transaction");
  }

--- a/core/src/main/java/google/registry/model/poll/PollMessage.java
+++ b/core/src/main/java/google/registry/model/poll/PollMessage.java
@@ -295,7 +295,7 @@ public abstract class PollMessage extends ImmutableObject
    @Transient @ImmutableObject.DoNotCompare
    List<DomainPendingActionNotificationResponse> domainPendingActionNotificationResponses;

-    @Transient List<DomainTransferResponse> domainTransferResponses;
+    @Transient @ImmutableObject.DoNotCompare List<DomainTransferResponse> domainTransferResponses;

    @Transient List<HostPendingActionNotificationResponse> hostPendingActionNotificationResponses;

@@ -359,8 +359,13 @@ public abstract class PollMessage extends ImmutableObject
    }

    /** Converts an unspecialized VKey&lt;PollMessage&gt; to a VKey of the derived class. */
-    public static @Nullable VKey<OneTime> convertVKey(@Nullable VKey<OneTime> key) {
-      return key == null ? null : VKey.create(OneTime.class, key.getSqlKey(), key.getOfyKey());
+    public static @Nullable VKey<OneTime> convertVKey(@Nullable VKey<? extends PollMessage> key) {
+      if (key == null) {
+        return null;
+      }
+      Key<OneTime> ofyKey =
+          Key.create(key.getOfyKey().getParent(), OneTime.class, key.getOfyKey().getId());
+      return VKey.create(OneTime.class, key.getSqlKey(), ofyKey);
    }

    @Override
@@ -383,6 +388,7 @@ public abstract class PollMessage extends ImmutableObject
    @OnLoad
    void onLoad() {
      super.onLoad();
+      // Take the Objectify-specific fields and map them to the SQL-specific fields, if applicable
      if (!isNullOrEmpty(contactPendingActionNotificationResponses)) {
        pendingActionNotificationResponse = contactPendingActionNotificationResponses.get(0);
      }
@@ -390,33 +396,70 @@ public abstract class PollMessage extends ImmutableObject
        contactId = contactTransferResponses.get(0).getContactId();
        transferResponse = contactTransferResponses.get(0);
      }
+      if (!isNullOrEmpty(domainPendingActionNotificationResponses)) {
+        pendingActionNotificationResponse = domainPendingActionNotificationResponses.get(0);
+      }
+      if (!isNullOrEmpty(domainTransferResponses)) {
+        fullyQualifiedDomainName = domainTransferResponses.get(0).getFullyQualifiedDomainName();
+        transferResponse = domainTransferResponses.get(0);
+        extendedRegistrationExpirationTime =
+            domainTransferResponses.get(0).getExtendedRegistrationExpirationTime();
+      }
    }

    @Override
    @PostLoad
    void postLoad() {
      super.postLoad();
+      // Take the SQL-specific fields and map them to the Objectify-specific fields, if applicable
      if (pendingActionNotificationResponse != null) {
-        contactPendingActionNotificationResponses =
-            ImmutableList.of(
-                ContactPendingActionNotificationResponse.create(
-                    pendingActionNotificationResponse.nameOrId.value,
-                    pendingActionNotificationResponse.getActionResult(),
-                    pendingActionNotificationResponse.getTrid(),
-                    pendingActionNotificationResponse.processedDate));
+        if (contactId != null) {
+          contactPendingActionNotificationResponses =
+              ImmutableList.of(
+                  ContactPendingActionNotificationResponse.create(
+                      pendingActionNotificationResponse.nameOrId.value,
+                      pendingActionNotificationResponse.getActionResult(),
+                      pendingActionNotificationResponse.getTrid(),
+                      pendingActionNotificationResponse.processedDate));
+        } else if (fullyQualifiedDomainName != null) {
+          domainPendingActionNotificationResponses =
+              ImmutableList.of(
+                  DomainPendingActionNotificationResponse.create(
+                      pendingActionNotificationResponse.nameOrId.value,
+                      pendingActionNotificationResponse.getActionResult(),
+                      pendingActionNotificationResponse.getTrid(),
+                      pendingActionNotificationResponse.processedDate));
+        }
      }
-      if (contactId != null && transferResponse != null) {
-        contactTransferResponses =
-            ImmutableList.of(
-                new ContactTransferResponse.Builder()
-                    .setContactId(contactId)
-                    .setGainingClientId(transferResponse.getGainingClientId())
-                    .setLosingClientId(transferResponse.getLosingClientId())
-                    .setTransferStatus(transferResponse.getTransferStatus())
-                    .setTransferRequestTime(transferResponse.getTransferRequestTime())
-                    .setPendingTransferExpirationTime(
-                        transferResponse.getPendingTransferExpirationTime())
-                    .build());
+      if (transferResponse != null) {
+        // The transferResponse is currently an unspecialized TransferResponse instance, create the
+        // appropriate subclass so that the value is consistently specialized
+        if (contactId != null) {
+          transferResponse =
+              new ContactTransferResponse.Builder()
+                  .setContactId(contactId)
+                  .setGainingClientId(transferResponse.getGainingClientId())
+                  .setLosingClientId(transferResponse.getLosingClientId())
+                  .setTransferStatus(transferResponse.getTransferStatus())
+                  .setTransferRequestTime(transferResponse.getTransferRequestTime())
+                  .setPendingTransferExpirationTime(
+                      transferResponse.getPendingTransferExpirationTime())
+                  .build();
+          contactTransferResponses = ImmutableList.of((ContactTransferResponse) transferResponse);
+        } else if (fullyQualifiedDomainName != null) {
+          transferResponse =
+              new DomainTransferResponse.Builder()
+                  .setFullyQualifiedDomainName(fullyQualifiedDomainName)
+                  .setGainingClientId(transferResponse.getGainingClientId())
+                  .setLosingClientId(transferResponse.getLosingClientId())
+                  .setTransferStatus(transferResponse.getTransferStatus())
+                  .setTransferRequestTime(transferResponse.getTransferRequestTime())
+                  .setPendingTransferExpirationTime(
+                      transferResponse.getPendingTransferExpirationTime())
+                  .setExtendedRegistrationExpirationTime(extendedRegistrationExpirationTime)
+                  .build();
+          domainTransferResponses = ImmutableList.of((DomainTransferResponse) transferResponse);
+        }
      }
    }

@@ -438,10 +481,7 @@ public abstract class PollMessage extends ImmutableObject
                    .filter(ContactPendingActionNotificationResponse.class::isInstance)
                    .map(ContactPendingActionNotificationResponse.class::cast)
                    .collect(toImmutableList()));
-        if (getInstance().contactPendingActionNotificationResponses != null) {
-          getInstance().pendingActionNotificationResponse =
-              getInstance().contactPendingActionNotificationResponses.get(0);
-        }
+
        getInstance().contactTransferResponses =
            forceEmptyToNull(
                responseData
@@ -449,10 +489,6 @@ public abstract class PollMessage extends ImmutableObject
                    .filter(ContactTransferResponse.class::isInstance)
                    .map(ContactTransferResponse.class::cast)
                    .collect(toImmutableList()));
-        if (getInstance().contactTransferResponses != null) {
-          getInstance().contactId = getInstance().contactTransferResponses.get(0).getContactId();
-          getInstance().transferResponse = getInstance().contactTransferResponses.get(0);
-        }

        getInstance().domainPendingActionNotificationResponses =
            forceEmptyToNull(
@@ -468,13 +504,36 @@ public abstract class PollMessage extends ImmutableObject
                    .filter(DomainTransferResponse.class::isInstance)
                    .map(DomainTransferResponse.class::cast)
                    .collect(toImmutableList()));
+
        getInstance().hostPendingActionNotificationResponses =
            forceEmptyToNull(
-                responseData
-                    .stream()
+                responseData.stream()
                    .filter(HostPendingActionNotificationResponse.class::isInstance)
                    .map(HostPendingActionNotificationResponse.class::cast)
                    .collect(toImmutableList()));
+
+        // Set the generic pending-action field as appropriate
+        if (getInstance().contactPendingActionNotificationResponses != null) {
+          getInstance().pendingActionNotificationResponse =
+              getInstance().contactPendingActionNotificationResponses.get(0);
+        } else if (getInstance().domainPendingActionNotificationResponses != null) {
+          getInstance().pendingActionNotificationResponse =
+              getInstance().domainPendingActionNotificationResponses.get(0);
+        } else if (getInstance().hostPendingActionNotificationResponses != null) {
+          getInstance().pendingActionNotificationResponse =
+              getInstance().hostPendingActionNotificationResponses.get(0);
+        }
+        // Set the generic transfer response field as appropriate
+        if (getInstance().contactTransferResponses != null) {
+          getInstance().contactId = getInstance().contactTransferResponses.get(0).getContactId();
+          getInstance().transferResponse = getInstance().contactTransferResponses.get(0);
+        } else if (getInstance().domainTransferResponses != null) {
+          getInstance().fullyQualifiedDomainName =
+              getInstance().domainTransferResponses.get(0).getFullyQualifiedDomainName();
+          getInstance().transferResponse = getInstance().domainTransferResponses.get(0);
+          getInstance().extendedRegistrationExpirationTime =
+              getInstance().domainTransferResponses.get(0).getExtendedRegistrationExpirationTime();
+        }
        return this;
      }
    }
@@ -515,8 +574,13 @@ public abstract class PollMessage extends ImmutableObject
    }

    /** Converts an unspecialized VKey&lt;PollMessage&gt; to a VKey of the derived class. */
-    public static @Nullable VKey<Autorenew> convertVKey(VKey<Autorenew> key) {
-      return key == null ? null : VKey.create(Autorenew.class, key.getSqlKey(), key.getOfyKey());
+    public static @Nullable VKey<Autorenew> convertVKey(VKey<? extends PollMessage> key) {
+      if (key == null) {
+        return null;
+      }
+      Key<Autorenew> ofyKey =
+          Key.create(key.getOfyKey().getParent(), Autorenew.class, key.getOfyKey().getId());
+      return VKey.create(Autorenew.class, key.getSqlKey(), ofyKey);
    }

    @Override
--- a/core/src/main/java/google/registry/model/pricing/StaticPremiumListPricingEngine.java
+++ b/core/src/main/java/google/registry/model/pricing/StaticPremiumListPricingEngine.java
@@ -15,11 +15,11 @@
 package google.registry.model.pricing;

 import static com.google.common.base.Preconditions.checkNotNull;
-import static google.registry.model.registry.label.PremiumListUtils.getPremiumPrice;
 import static google.registry.util.DomainNameUtils.getTldFromDomainName;

 import com.google.common.net.InternetDomainName;
 import google.registry.model.registry.Registry;
+import google.registry.model.registry.label.PremiumListDualDao;
 import java.util.Optional;
 import javax.inject.Inject;
 import org.joda.money.Money;
@@ -38,7 +38,7 @@ public final class StaticPremiumListPricingEngine implements PremiumPricingEngin
    String tld = getTldFromDomainName(fullyQualifiedDomainName);
    String label = InternetDomainName.from(fullyQualifiedDomainName).parts().get(0);
    Registry registry = Registry.get(checkNotNull(tld, "tld"));
-    Optional<Money> premiumPrice = getPremiumPrice(label, registry);
+    Optional<Money> premiumPrice = PremiumListDualDao.getPremiumPrice(label, registry);
    return DomainPrices.create(
        premiumPrice.isPresent(),
        premiumPrice.orElse(registry.getStandardCreateCost()),
--- a/core/src/main/java/google/registry/model/registrar/Registrar.java
+++ b/core/src/main/java/google/registry/model/registrar/Registrar.java
@@ -996,6 +996,13 @@ public class Registrar extends ImmutableObject
    return CACHE_BY_CLIENT_ID.get().values();
  }

+  /** Loads all registrar keys using an in-memory cache. */
+  public static ImmutableSet<VKey<Registrar>> loadAllKeysCached() {
+    return CACHE_BY_CLIENT_ID.get().keySet().stream()
+        .map(Registrar::createVKey)
+        .collect(toImmutableSet());
+  }
+
  /** Loads and returns a registrar entity by its client id directly from Datastore. */
  public static Optional<Registrar> loadByClientId(String clientId) {
    checkArgument(!Strings.isNullOrEmpty(clientId), "clientId must be specified");
--- a/core/src/main/java/google/registry/model/registry/label/PremiumList.java
+++ b/core/src/main/java/google/registry/model/registry/label/PremiumList.java
@@ -18,23 +18,12 @@ import static com.google.common.base.Charsets.US_ASCII;
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.hash.Funnels.stringFunnel;
 import static com.google.common.hash.Funnels.unencodedCharsFunnel;
-import static google.registry.config.RegistryConfig.getDomainLabelListCacheDuration;
-import static google.registry.config.RegistryConfig.getSingletonCachePersistDuration;
-import static google.registry.config.RegistryConfig.getStaticPremiumListMaxCachedEntries;
-import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
 import static google.registry.model.ofy.ObjectifyService.allocateId;
-import static google.registry.model.ofy.ObjectifyService.ofy;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Splitter;
-import com.google.common.cache.CacheBuilder;
-import com.google.common.cache.CacheLoader;
-import com.google.common.cache.CacheLoader.InvalidCacheLoadException;
-import com.google.common.cache.LoadingCache;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.hash.BloomFilter;
-import com.google.common.util.concurrent.UncheckedExecutionException;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Entity;
 import com.googlecode.objectify.annotation.Id;
@@ -46,18 +35,14 @@ import google.registry.model.annotations.ReportedOn;
 import google.registry.model.registry.Registry;
 import google.registry.schema.replay.DatastoreOnlyEntity;
 import google.registry.schema.replay.NonReplicatedEntity;
-import google.registry.schema.tld.PremiumListDao;
-import google.registry.util.NonFinalForTesting;
+import google.registry.schema.tld.PremiumListSqlDao;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.math.BigDecimal;
 import java.util.List;
 import java.util.Map;
-import java.util.NoSuchElementException;
 import java.util.Objects;
-import java.util.Optional;
 import java.util.Set;
-import java.util.concurrent.ExecutionException;
 import javax.annotation.Nullable;
 import javax.persistence.CollectionTable;
 import javax.persistence.Column;
@@ -72,7 +57,6 @@ import javax.persistence.Transient;
 import org.hibernate.LazyInitializationException;
 import org.joda.money.CurrencyUnit;
 import org.joda.money.Money;
-import org.joda.time.Duration;

 /**
 * A premium list entity that is used to check domain label prices.
@@ -171,124 +155,11 @@ public final class PremiumList extends BaseDomainLabelList<Money, PremiumList.Pr
    }
  }

-  /**
-   * In-memory cache for premium lists.
-   *
-   * <p>This is cached for a shorter duration because we need to periodically reload this entity to
-   * check if a new revision has been published, and if so, then use that.
-   */
-  @NonFinalForTesting
-  static LoadingCache<String, PremiumList> cachePremiumLists =
-      createCachePremiumLists(getDomainLabelListCacheDuration());
-
-  @VisibleForTesting
-  public static void setPremiumListCacheForTest(Optional<Duration> expiry) {
-    Duration effectiveExpiry = expiry.orElse(getDomainLabelListCacheDuration());
-    cachePremiumLists = createCachePremiumLists(effectiveExpiry);
-  }
-
-  @VisibleForTesting
-  static LoadingCache<String, PremiumList> createCachePremiumLists(Duration cachePersistDuration) {
-    return CacheBuilder.newBuilder()
-        .expireAfterWrite(java.time.Duration.ofMillis(cachePersistDuration.getMillis()))
-        .build(
-            new CacheLoader<String, PremiumList>() {
-              @Override
-              public PremiumList load(final String name) {
-                return tm().doTransactionless(() -> loadPremiumList(name));
-              }
-            });
-  }
-
-  private static PremiumList loadPremiumList(String name) {
-    return tm().isOfy()
-        ? ofy().load().type(PremiumList.class).parent(getCrossTldKey()).id(name).now()
-        : PremiumListDao.getLatestRevision(name).orElseThrow(NoSuchElementException::new);
-  }
-
-  /**
-   * In-memory cache for {@link PremiumListRevision}s, used for retrieving Bloom filters quickly.
-   *
-   * <p>This is cached for a long duration (essentially indefinitely) because a given {@link
-   * PremiumListRevision} is immutable and cannot ever be changed once created, so its cache need
-   * not ever expire.
-   */
-  static final LoadingCache<Key<PremiumListRevision>, PremiumListRevision>
-      cachePremiumListRevisions =
-          CacheBuilder.newBuilder()
-              .expireAfterWrite(
-                  java.time.Duration.ofMillis(getSingletonCachePersistDuration().getMillis()))
-              .build(
-                  new CacheLoader<Key<PremiumListRevision>, PremiumListRevision>() {
-                    @Override
-                    public PremiumListRevision load(final Key<PremiumListRevision> revisionKey) {
-                      return tm().doTransactionless(() -> ofy().load().key(revisionKey).now());
-                    }
-                  });
-
-  /**
-   * In-memory cache for {@link PremiumListEntry}s for a given label and {@link PremiumListRevision}
-   *
-   * <p>Because the PremiumList itself makes up part of the PremiumListRevision's key, this is
-   * specific to a given premium list. Premium list entries might not be present, as indicated by
-   * the Optional wrapper, and we want to cache that as well.
-   *
-   * <p>This is cached for a long duration (essentially indefinitely) because a given {@link
-   * PremiumListRevision} and its child {@link PremiumListEntry}s are immutable and cannot ever be
-   * changed once created, so the cache need not ever expire.
-   *
-   * <p>A maximum size is set here on the cache because it can potentially grow too big to fit in
-   * memory if there are a large number of distinct premium list entries being queried (both those
-   * that exist, as well as those that might exist according to the Bloom filter, must be cached).
-   * The entries judged least likely to be accessed again will be evicted first.
-   */
-  @NonFinalForTesting
-  static LoadingCache<Key<PremiumListEntry>, Optional<PremiumListEntry>> cachePremiumListEntries =
-      createCachePremiumListEntries(getSingletonCachePersistDuration());
-
-  @VisibleForTesting
-  public static void setPremiumListEntriesCacheForTest(Optional<Duration> expiry) {
-    Duration effectiveExpiry = expiry.orElse(getSingletonCachePersistDuration());
-    cachePremiumListEntries = createCachePremiumListEntries(effectiveExpiry);
-  }
-
-  @VisibleForTesting
-  static LoadingCache<Key<PremiumListEntry>, Optional<PremiumListEntry>>
-      createCachePremiumListEntries(Duration cachePersistDuration) {
-    return CacheBuilder.newBuilder()
-        .expireAfterWrite(java.time.Duration.ofMillis(cachePersistDuration.getMillis()))
-        .maximumSize(getStaticPremiumListMaxCachedEntries())
-        .build(
-            new CacheLoader<Key<PremiumListEntry>, Optional<PremiumListEntry>>() {
-              @Override
-              public Optional<PremiumListEntry> load(final Key<PremiumListEntry> entryKey) {
-                return tm().doTransactionless(
-                        () -> Optional.ofNullable(ofy().load().key(entryKey).now()));
-              }
-            });
-  }
-
  @VisibleForTesting
  public Key<PremiumListRevision> getRevisionKey() {
    return revisionKey;
  }

-  /** Returns the PremiumList with the specified name, from cache. */
-  public static Optional<PremiumList> getCached(String name) {
-    try {
-      return Optional.of(cachePremiumLists.get(name));
-    } catch (InvalidCacheLoadException e) {
-      return Optional.empty();
-    } catch (ExecutionException e) {
-      throw new UncheckedExecutionException("Could not retrieve premium list named " + name, e);
-    }
-  }
-
-  /** Returns the PremiumList with the specified name, uncached. */
-  public static Optional<PremiumList> getUncached(String name) {
-    return Optional.ofNullable(loadPremiumList(name));
-  }
-
  /** Returns the {@link CurrencyUnit} used for this list. */
  public CurrencyUnit getCurrency() {
    return currency;
@@ -300,7 +171,7 @@ public final class PremiumList extends BaseDomainLabelList<Money, PremiumList.Pr
   * <p>Note that this is lazily loaded and thus will throw a {@link LazyInitializationException} if
   * used outside the transaction in which the given entity was loaded. You generally should not be
   * using this anyway as it's inefficient to load all of the PremiumEntry rows if you don't need
-   * them. To check prices, use {@link PremiumListDao#getPremiumPrice} instead.
+   * them. To check prices, use {@link PremiumListSqlDao#getPremiumPrice} instead.
   */
  @Nullable
  public ImmutableMap<String, BigDecimal> getLabelsToPrices() {
@@ -337,6 +208,12 @@ public final class PremiumList extends BaseDomainLabelList<Money, PremiumList.Pr
      return price;
    }

+    @Override
+    public String toString() {
+      // Don't include the comment so that we can use this when exporting the premium list
+      return String.format("%s,%s", label, price);
+    }
+
    @Override
    public Builder asBuilder() {
      return new Builder(clone(this));
--- a/core/src/main/java/google/registry/model/registry/label/PremiumListDatastoreDao.java
+++ b/core/src/main/java/google/registry/model/registry/label/PremiumListDatastoreDao.java
@@ -0,0 +1,365 @@
+// Copyright 2021 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.registry.label;
+
+import static com.google.common.base.Preconditions.checkState;
+import static com.google.common.collect.ImmutableSet.toImmutableSet;
+import static com.google.common.collect.Iterables.partition;
+import static google.registry.config.RegistryConfig.getDomainLabelListCacheDuration;
+import static google.registry.config.RegistryConfig.getSingletonCachePersistDuration;
+import static google.registry.config.RegistryConfig.getStaticPremiumListMaxCachedEntries;
+import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
+import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.BLOOM_FILTER_NEGATIVE;
+import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.CACHED_NEGATIVE;
+import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.CACHED_POSITIVE;
+import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.UNCACHED_NEGATIVE;
+import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.UNCACHED_POSITIVE;
+import static google.registry.persistence.transaction.TransactionManagerFactory.ofyTm;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static org.joda.time.DateTimeZone.UTC;
+
+import com.google.auto.value.AutoValue;
+import com.google.common.annotations.VisibleForTesting;
+import com.google.common.cache.CacheBuilder;
+import com.google.common.cache.CacheLoader;
+import com.google.common.cache.CacheLoader.InvalidCacheLoadException;
+import com.google.common.cache.LoadingCache;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Streams;
+import com.googlecode.objectify.Key;
+import google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome;
+import google.registry.model.registry.label.PremiumList.PremiumListEntry;
+import google.registry.model.registry.label.PremiumList.PremiumListRevision;
+import google.registry.persistence.VKey;
+import google.registry.util.NonFinalForTesting;
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.concurrent.ExecutionException;
+import org.joda.money.Money;
+import org.joda.time.DateTime;
+import org.joda.time.Duration;
+
+/**
+ * DAO for {@link PremiumList} objects stored in Datastore.
+ *
+ * <p>This class handles both the mapping from string to Datastore-level PremiumList objects as well
+ * as the mapping from PremiumList objects to the contents of those premium lists in the Datastore
+ * world. Specifically, this deals with retrieving the most recent revision for a given list and
+ * retrieving (or writing/deleting) all entries associated with that particular revision. The {@link
+ * PremiumList} object itself, in the Datastore world, does not store the premium pricing data.
+ */
+public class PremiumListDatastoreDao {
+
+  /** The number of premium list entry entities that are created and deleted per batch. */
+  private static final int TRANSACTION_BATCH_SIZE = 200;
+
+  /**
+   * In-memory cache for premium lists.
+   *
+   * <p>This is cached for a shorter duration because we need to periodically reload this entity to
+   * check if a new revision has been published, and if so, then use that.
+   *
+   * <p>We also cache the absence of premium lists with a given name to avoid unnecessary pointless
+   * lookups. Note that this cache is only applicable to PremiumList objects stored in Datastore.
+   */
+  @NonFinalForTesting
+  static LoadingCache<String, Optional<PremiumList>> premiumListCache =
+      createPremiumListCache(getDomainLabelListCacheDuration());
+
+  @VisibleForTesting
+  public static void setPremiumListCacheForTest(Optional<Duration> expiry) {
+    Duration effectiveExpiry = expiry.orElse(getSingletonCachePersistDuration());
+    premiumListCache = createPremiumListCache(effectiveExpiry);
+  }
+
+  @VisibleForTesting
+  public static LoadingCache<String, Optional<PremiumList>> createPremiumListCache(
+      Duration cachePersistDuration) {
+    return CacheBuilder.newBuilder()
+        .expireAfterWrite(java.time.Duration.ofMillis(cachePersistDuration.getMillis()))
+        .build(
+            new CacheLoader<String, Optional<PremiumList>>() {
+              @Override
+              public Optional<PremiumList> load(final String name) {
+                return tm().doTransactionless(() -> getLatestRevisionUncached(name));
+              }
+            });
+  }
+
+  /**
+   * In-memory cache for {@link PremiumListRevision}s, used for retrieving Bloom filters quickly.
+   *
+   * <p>This is cached for a long duration (essentially indefinitely) because a given {@link
+   * PremiumListRevision} is immutable and cannot ever be changed once created, so its cache need
+   * not ever expire.
+   */
+  static final LoadingCache<Key<PremiumListRevision>, PremiumListRevision>
+      premiumListRevisionsCache =
+          CacheBuilder.newBuilder()
+              .expireAfterWrite(
+                  java.time.Duration.ofMillis(getSingletonCachePersistDuration().getMillis()))
+              .build(
+                  new CacheLoader<Key<PremiumListRevision>, PremiumListRevision>() {
+                    @Override
+                    public PremiumListRevision load(final Key<PremiumListRevision> revisionKey) {
+                      return ofyTm().doTransactionless(() -> ofy().load().key(revisionKey).now());
+                    }
+                  });
+
+  /**
+   * In-memory cache for {@link PremiumListEntry}s for a given label and {@link PremiumListRevision}
+   *
+   * <p>Because the PremiumList itself makes up part of the PremiumListRevision's key, this is
+   * specific to a given premium list. Premium list entries might not be present, as indicated by
+   * the Optional wrapper, and we want to cache that as well.
+   *
+   * <p>This is cached for a long duration (essentially indefinitely) because a given {@link
+   * PremiumListRevision} and its child {@link PremiumListEntry}s are immutable and cannot ever be
+   * changed once created, so the cache need not ever expire.
+   *
+   * <p>A maximum size is set here on the cache because it can potentially grow too big to fit in
+   * memory if there are a large number of distinct premium list entries being queried (both those
+   * that exist, as well as those that might exist according to the Bloom filter, must be cached).
+   * The entries judged least likely to be accessed again will be evicted first.
+   */
+  @NonFinalForTesting
+  static LoadingCache<Key<PremiumListEntry>, Optional<PremiumListEntry>> premiumListEntriesCache =
+      createPremiumListEntriesCache(getSingletonCachePersistDuration());
+
+  @VisibleForTesting
+  public static void setPremiumListEntriesCacheForTest(Optional<Duration> expiry) {
+    Duration effectiveExpiry = expiry.orElse(getSingletonCachePersistDuration());
+    premiumListEntriesCache = createPremiumListEntriesCache(effectiveExpiry);
+  }
+
+  @VisibleForTesting
+  static LoadingCache<Key<PremiumListEntry>, Optional<PremiumListEntry>>
+      createPremiumListEntriesCache(Duration cachePersistDuration) {
+    return CacheBuilder.newBuilder()
+        .expireAfterWrite(java.time.Duration.ofMillis(cachePersistDuration.getMillis()))
+        .maximumSize(getStaticPremiumListMaxCachedEntries())
+        .build(
+            new CacheLoader<Key<PremiumListEntry>, Optional<PremiumListEntry>>() {
+              @Override
+              public Optional<PremiumListEntry> load(final Key<PremiumListEntry> entryKey) {
+                return ofyTm()
+                    .doTransactionless(() -> Optional.ofNullable(ofy().load().key(entryKey).now()));
+              }
+            });
+  }
+
+  public static Optional<PremiumList> getLatestRevision(String name) {
+    return premiumListCache.getUnchecked(name);
+  }
+
+  /**
+   * Returns the premium price for the specified list, label, and TLD, or absent if the label is not
+   * premium.
+   */
+  public static Optional<Money> getPremiumPrice(String premiumListName, String label, String tld) {
+    DateTime startTime = DateTime.now(UTC);
+    Optional<PremiumList> maybePremumList = getLatestRevision(premiumListName);
+    if (!maybePremumList.isPresent()) {
+      return Optional.empty();
+    }
+    PremiumList premiumList = maybePremumList.get();
+    // If we're dealing with a list from SQL, reload from Datastore if necessary
+    if (premiumList.getRevisionKey() == null) {
+      Optional<PremiumList> fromDatastore = getLatestRevision(premiumList.getName());
+      if (fromDatastore.isPresent()) {
+        premiumList = fromDatastore.get();
+      } else {
+        return Optional.empty();
+      }
+    }
+    PremiumListRevision revision;
+    try {
+      revision = premiumListRevisionsCache.get(premiumList.getRevisionKey());
+    } catch (InvalidCacheLoadException | ExecutionException e) {
+      throw new RuntimeException(
+          "Could not load premium list revision " + premiumList.getRevisionKey(), e);
+    }
+    checkState(
+        revision.getProbablePremiumLabels() != null,
+        "Probable premium labels Bloom filter is null on revision '%s'",
+        premiumList.getRevisionKey());
+
+    CheckResults checkResults = checkStatus(revision, label);
+    DomainLabelMetrics.recordPremiumListCheckOutcome(
+        tld,
+        premiumList.getName(),
+        checkResults.checkOutcome(),
+        DateTime.now(UTC).getMillis() - startTime.getMillis());
+
+    return checkResults.premiumPrice();
+  }
+
+  /**
+   * Persists a new or updated PremiumList object and its descendant entities to Datastore.
+   *
+   * <p>The flow here is: save the new premium list entries parented on that revision entity,
+   * save/update the PremiumList, and then delete the old premium list entries associated with the
+   * old revision.
+   *
+   * <p>This is the only valid way to save these kinds of entities!
+   */
+  public static PremiumList save(String name, List<String> inputData) {
+    PremiumList premiumList = new PremiumList.Builder().setName(name).build();
+    ImmutableMap<String, PremiumListEntry> premiumListEntries = premiumList.parse(inputData);
+    final Optional<PremiumList> oldPremiumList = getLatestRevisionUncached(premiumList.getName());
+
+    // Create the new revision (with its Bloom filter) and parent the entries on it.
+    final PremiumListRevision newRevision =
+        PremiumListRevision.create(premiumList, premiumListEntries.keySet());
+    final Key<PremiumListRevision> newRevisionKey = Key.create(newRevision);
+    ImmutableSet<PremiumListEntry> parentedEntries =
+        parentPremiumListEntriesOnRevision(premiumListEntries.values(), newRevisionKey);
+
+    // Save the new child entities in a series of transactions.
+    for (final List<PremiumListEntry> batch : partition(parentedEntries, TRANSACTION_BATCH_SIZE)) {
+      ofyTm().transactNew(() -> ofy().save().entities(batch));
+    }
+
+    // Save the new PremiumList and revision itself.
+    return ofyTm()
+        .transactNew(
+            () -> {
+              DateTime now = ofyTm().getTransactionTime();
+              // Assert that the premium list hasn't been changed since we started this process.
+              Key<PremiumList> key =
+                  Key.create(getCrossTldKey(), PremiumList.class, premiumList.getName());
+              Optional<PremiumList> existing =
+                  ofyTm().loadByKeyIfPresent(VKey.createOfy(PremiumList.class, key));
+              checkOfyFieldsEqual(existing, oldPremiumList);
+              PremiumList newList =
+                  premiumList
+                      .asBuilder()
+                      .setLastUpdateTime(now)
+                      .setCreationTime(
+                          oldPremiumList.isPresent() ? oldPremiumList.get().creationTime : now)
+                      .setRevision(newRevisionKey)
+                      .build();
+              ofy().save().entities(newList, newRevision);
+              premiumListCache.invalidate(premiumList.getName());
+              return newList;
+            });
+  }
+
+  public static void delete(PremiumList premiumList) {
+    ofyTm().transactNew(() -> ofy().delete().entity(premiumList));
+    if (premiumList.getRevisionKey() == null) {
+      return;
+    }
+    for (final List<Key<PremiumListEntry>> batch :
+        partition(
+            ofy().load().type(PremiumListEntry.class).ancestor(premiumList.revisionKey).keys(),
+            TRANSACTION_BATCH_SIZE)) {
+      ofyTm().transactNew(() -> ofy().delete().keys(batch));
+      batch.forEach(premiumListEntriesCache::invalidate);
+    }
+    ofyTm().transactNew(() -> ofy().delete().key(premiumList.getRevisionKey()));
+    premiumListCache.invalidate(premiumList.getName());
+    premiumListRevisionsCache.invalidate(premiumList.getRevisionKey());
+  }
+
+  /** Re-parents the given {@link PremiumListEntry}s on the given {@link PremiumListRevision}. */
+  @VisibleForTesting
+  public static ImmutableSet<PremiumListEntry> parentPremiumListEntriesOnRevision(
+      Iterable<PremiumListEntry> entries, final Key<PremiumListRevision> revisionKey) {
+    return Streams.stream(entries)
+        .map((PremiumListEntry entry) -> entry.asBuilder().setParent(revisionKey).build())
+        .collect(toImmutableSet());
+  }
+
+  /**
+   * Returns all {@link PremiumListEntry PremiumListEntries} in the given {@code premiumList}.
+   *
+   * <p>This is an expensive operation and should only be used when the entire list is required.
+   */
+  public static Iterable<PremiumListEntry> loadPremiumListEntriesUncached(PremiumList premiumList) {
+    return ofy().load().type(PremiumListEntry.class).ancestor(premiumList.revisionKey).iterable();
+  }
+
+  private static Optional<PremiumList> getLatestRevisionUncached(String name) {
+    return Optional.ofNullable(
+        ofy().load().key(Key.create(getCrossTldKey(), PremiumList.class, name)).now());
+  }
+
+  private static void checkOfyFieldsEqual(
+      Optional<PremiumList> oneOptional, Optional<PremiumList> twoOptional) {
+    if (!oneOptional.isPresent()) {
+      checkState(!twoOptional.isPresent(), "Premium list concurrently deleted");
+      return;
+    } else {
+      checkState(twoOptional.isPresent(), "Premium list concurrently deleted");
+    }
+    PremiumList one = oneOptional.get();
+    PremiumList two = twoOptional.get();
+    checkState(
+        Objects.equals(one.revisionKey, two.revisionKey),
+        "Premium list revision key concurrently edited");
+    checkState(Objects.equals(one.name, two.name), "Premium list name concurrently edited");
+    checkState(Objects.equals(one.parent, two.parent), "Premium list parent concurrently edited");
+    checkState(
+        Objects.equals(one.creationTime, two.creationTime),
+        "Premium list creation time concurrently edited");
+  }
+
+  private static CheckResults checkStatus(PremiumListRevision premiumListRevision, String label) {
+    if (!premiumListRevision.getProbablePremiumLabels().mightContain(label)) {
+      return CheckResults.create(BLOOM_FILTER_NEGATIVE, Optional.empty());
+    }
+
+    Key<PremiumListEntry> entryKey =
+        Key.create(Key.create(premiumListRevision), PremiumListEntry.class, label);
+    try {
+      // getIfPresent() returns null if the key is not in the cache
+      Optional<PremiumListEntry> entry = premiumListEntriesCache.getIfPresent(entryKey);
+      if (entry != null) {
+        if (entry.isPresent()) {
+          return CheckResults.create(CACHED_POSITIVE, Optional.of(entry.get().getValue()));
+        } else {
+          return CheckResults.create(CACHED_NEGATIVE, Optional.empty());
+        }
+      }
+
+      entry = premiumListEntriesCache.get(entryKey);
+      if (entry.isPresent()) {
+        return CheckResults.create(UNCACHED_POSITIVE, Optional.of(entry.get().getValue()));
+      } else {
+        return CheckResults.create(UNCACHED_NEGATIVE, Optional.empty());
+      }
+    } catch (InvalidCacheLoadException | ExecutionException e) {
+      throw new RuntimeException("Could not load premium list entry " + entryKey, e);
+    }
+  }
+
+  /** Value type class used by {@link #checkStatus} to return the results of a premiumness check. */
+  @AutoValue
+  abstract static class CheckResults {
+    static CheckResults create(PremiumListCheckOutcome checkOutcome, Optional<Money> premiumPrice) {
+      return new AutoValue_PremiumListDatastoreDao_CheckResults(checkOutcome, premiumPrice);
+    }
+
+    abstract PremiumListCheckOutcome checkOutcome();
+
+    abstract Optional<Money> premiumPrice();
+  }
+
+  private PremiumListDatastoreDao() {}
+}
--- a/core/src/main/java/google/registry/model/registry/label/PremiumListDualDao.java
+++ b/core/src/main/java/google/registry/model/registry/label/PremiumListDualDao.java
@@ -0,0 +1,199 @@
+// Copyright 2021 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.registry.label;
+
+import static com.google.common.collect.ImmutableList.toImmutableList;
+import static google.registry.model.DatabaseMigrationUtils.suppressExceptionUnlessInTest;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+
+import com.google.common.collect.Streams;
+import google.registry.model.registry.Registry;
+import google.registry.model.registry.label.PremiumList.PremiumListEntry;
+import google.registry.schema.tld.PremiumListSqlDao;
+import java.util.List;
+import java.util.Optional;
+import org.joda.money.CurrencyUnit;
+import org.joda.money.Money;
+
+/**
+ * DAO for {@link PremiumList} objects that handles the branching paths for SQL and Datastore.
+ *
+ * <p>For write actions, this class will perform the action against the primary database then, after
+ * that success or failure, against the secondary database. If the secondary database fails, an
+ * error is logged (but not thrown).
+ *
+ * <p>For read actions, when retrieving a price, we will log if the primary and secondary databases
+ * have different values (or if the retrieval from the second database fails).
+ *
+ * <p>TODO (gbrodman): Change the isOfy() calls to the runtime selection of DBs when available
+ */
+public class PremiumListDualDao {
+
+  /**
+   * Retrieves from the appropriate DB and returns the most recent premium list with the given name,
+   * or absent if no such list exists.
+   */
+  public static Optional<PremiumList> getLatestRevision(String premiumListName) {
+    // TODO(gbrodman): Use Sarah's DB scheduler instead of this isOfy check
+    if (tm().isOfy()) {
+      return PremiumListDatastoreDao.getLatestRevision(premiumListName);
+    } else {
+      return PremiumListSqlDao.getLatestRevision(premiumListName);
+    }
+  }
+
+  /**
+   * Returns the premium price for the specified label and registry.
+   *
+   * <p>Returns absent if the label is not premium or there is no premium list for this registry.
+   *
+   * <p>Retrieves the price from both primary and secondary databases, and logs in the event of a
+   * failure in the secondary (but does not throw an exception).
+   */
+  public static Optional<Money> getPremiumPrice(String label, Registry registry) {
+    if (registry.getPremiumList() == null) {
+      return Optional.empty();
+    }
+    String premiumListName = registry.getPremiumList().getName();
+    Optional<Money> primaryResult;
+    // TODO(gbrodman): Use Sarah's DB scheduler instead of this isOfy check
+    if (tm().isOfy()) {
+      primaryResult =
+          PremiumListDatastoreDao.getPremiumPrice(premiumListName, label, registry.getTldStr());
+    } else {
+      primaryResult = PremiumListSqlDao.getPremiumPrice(premiumListName, label);
+    }
+    // Also load the value from the secondary DB, compare the two results, and log if different.
+    // TODO(gbrodman): Use Sarah's DB scheduler instead of this isOfy check
+    if (tm().isOfy()) {
+      suppressExceptionUnlessInTest(
+          () -> {
+            Optional<Money> secondaryResult =
+                PremiumListSqlDao.getPremiumPrice(premiumListName, label);
+            if (!primaryResult.equals(secondaryResult)) {
+              throw new IllegalStateException(
+                  String.format(
+                      "Unequal prices for domain %s.%s from primary Datastore DB (%s) and "
+                          + "secondary SQL db (%s).",
+                      label, registry.getTldStr(), primaryResult, secondaryResult));
+            }
+          },
+          String.format(
+              "Error loading price of domain %s.%s from Cloud SQL.", label, registry.getTldStr()));
+    } else {
+      suppressExceptionUnlessInTest(
+          () -> {
+            Optional<Money> secondaryResult =
+                PremiumListDatastoreDao.getPremiumPrice(
+                    premiumListName, label, registry.getTldStr());
+            if (!primaryResult.equals(secondaryResult)) {
+              throw new IllegalStateException(
+                  String.format(
+                      "Unequal prices for domain %s.%s from primary SQL DB (%s) and secondary "
+                          + "Datastore db (%s).",
+                      label, registry.getTldStr(), primaryResult, secondaryResult));
+            }
+          },
+          String.format(
+              "Error loading price of domain %s.%s from Datastore.", label, registry.getTldStr()));
+    }
+    return primaryResult;
+  }
+
+  /**
+   * Saves the given list data to both primary and secondary databases.
+   *
+   * <p>Logs but doesn't throw an exception in the event of a failure when writing to the secondary
+   * database.
+   */
+  public static PremiumList save(String name, List<String> inputData) {
+    PremiumList result;
+    // TODO(gbrodman): Use Sarah's DB scheduler instead of this isOfy check
+    if (tm().isOfy()) {
+      result = PremiumListDatastoreDao.save(name, inputData);
+      suppressExceptionUnlessInTest(
+          () -> PremiumListSqlDao.save(name, inputData), "Error when saving premium list to SQL.");
+    } else {
+      result = PremiumListSqlDao.save(name, inputData);
+      suppressExceptionUnlessInTest(
+          () -> PremiumListDatastoreDao.save(name, inputData),
+          "Error when saving premium list to Datastore.");
+    }
+    return result;
+  }
+
+  /**
+   * Deletes the premium list.
+   *
+   * <p>Logs but doesn't throw an exception in the event of a failure when deleting from the
+   * secondary database.
+   */
+  public static void delete(PremiumList premiumList) {
+    // TODO(gbrodman): Use Sarah's DB scheduler instead of this isOfy check
+    if (tm().isOfy()) {
+      PremiumListDatastoreDao.delete(premiumList);
+      suppressExceptionUnlessInTest(
+          () -> PremiumListSqlDao.delete(premiumList),
+          "Error when deleting premium list from SQL.");
+    } else {
+      PremiumListSqlDao.delete(premiumList);
+      suppressExceptionUnlessInTest(
+          () -> PremiumListDatastoreDao.delete(premiumList),
+          "Error when deleting premium list from Datastore.");
+    }
+  }
+
+  /** Returns whether or not there exists a premium list with the given name. */
+  public static boolean exists(String premiumListName) {
+    // It may seem like overkill, but loading the list has ways been the way we check existence and
+    // given that we usually load the list around the time we check existence, we'll hit the cache
+    // TODO(gbrodman): Use Sarah's DB scheduler instead of this isOfy check
+    if (tm().isOfy()) {
+      return PremiumListDatastoreDao.getLatestRevision(premiumListName).isPresent();
+    } else {
+      return PremiumListSqlDao.getLatestRevision(premiumListName).isPresent();
+    }
+  }
+
+  /**
+   * Returns all {@link PremiumListEntry PremiumListEntries} in the list with the given name.
+   *
+   * <p>This is an expensive operation and should only be used when the entire list is required.
+   */
+  public static Iterable<PremiumListEntry> loadAllPremiumListEntries(String premiumListName) {
+    PremiumList premiumList =
+        getLatestRevision(premiumListName)
+            .orElseThrow(
+                () ->
+                    new IllegalArgumentException(
+                        String.format("No premium list with name %s.", premiumListName)));
+    // TODO(gbrodman): Use Sarah's DB scheduler instead of this isOfy check
+    if (tm().isOfy()) {
+      return PremiumListDatastoreDao.loadPremiumListEntriesUncached(premiumList);
+    } else {
+      CurrencyUnit currencyUnit = premiumList.getCurrency();
+      return Streams.stream(PremiumListSqlDao.loadPremiumListEntriesUncached(premiumList))
+          .map(
+              premiumEntry ->
+                  new PremiumListEntry.Builder()
+                      .setPrice(Money.of(currencyUnit, premiumEntry.getPrice()))
+                      .setLabel(premiumEntry.getDomainLabel())
+                      .build())
+          .collect(toImmutableList());
+    }
+  }
+
+  private PremiumListDualDao() {}
+}
--- a/core/src/main/java/google/registry/model/registry/label/PremiumListUtils.java
+++ b/core/src/main/java/google/registry/model/registry/label/PremiumListUtils.java
@@ -1,255 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model.registry.label;
-
-import static com.google.common.base.Preconditions.checkState;
-import static com.google.common.collect.ImmutableSet.toImmutableSet;
-import static com.google.common.collect.Iterables.partition;
-import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
-import static google.registry.model.ofy.ObjectifyService.ofy;
-import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.BLOOM_FILTER_NEGATIVE;
-import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.CACHED_NEGATIVE;
-import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.CACHED_POSITIVE;
-import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.UNCACHED_NEGATIVE;
-import static google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome.UNCACHED_POSITIVE;
-import static google.registry.model.registry.label.PremiumList.cachePremiumListEntries;
-import static google.registry.model.registry.label.PremiumList.cachePremiumListRevisions;
-import static google.registry.model.registry.label.PremiumList.cachePremiumLists;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static org.joda.time.DateTimeZone.UTC;
-
-import com.google.auto.value.AutoValue;
-import com.google.common.annotations.VisibleForTesting;
-import com.google.common.cache.CacheLoader.InvalidCacheLoadException;
-import com.google.common.collect.ImmutableMap;
-import com.google.common.collect.ImmutableSet;
-import com.google.common.collect.Streams;
-import com.google.common.flogger.FluentLogger;
-import com.googlecode.objectify.Key;
-import google.registry.model.registry.Registry;
-import google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome;
-import google.registry.model.registry.label.PremiumList.PremiumListEntry;
-import google.registry.model.registry.label.PremiumList.PremiumListRevision;
-import google.registry.schema.tld.PremiumListDao;
-import java.util.List;
-import java.util.Objects;
-import java.util.Optional;
-import java.util.concurrent.ExecutionException;
-import org.joda.money.Money;
-import org.joda.time.DateTime;
-
-/** Static helper methods for working with {@link PremiumList}s. */
-public final class PremiumListUtils {
-
-  /** The number of premium list entry entities that are created and deleted per batch. */
-  private static final int TRANSACTION_BATCH_SIZE = 200;
-
-  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
-
-  /** Value type class used by {@link #checkStatus} to return the results of a premiumness check. */
-  @AutoValue
-  abstract static class CheckResults {
-    static CheckResults create(PremiumListCheckOutcome checkOutcome, Optional<Money> premiumPrice) {
-      return new AutoValue_PremiumListUtils_CheckResults(checkOutcome, premiumPrice);
-    }
-
-    abstract PremiumListCheckOutcome checkOutcome();
-    abstract Optional<Money> premiumPrice();
-  }
-
-  /**
-   * Returns the premium price for the specified label and registry, or absent if the label is not
-   * premium.
-   */
-  public static Optional<Money> getPremiumPrice(String label, Registry registry) {
-    // If the registry has no configured premium list, then no labels are premium.
-    if (registry.getPremiumList() == null) {
-      return Optional.empty();
-    }
-    DateTime startTime = DateTime.now(UTC);
-    String listName = registry.getPremiumList().getName();
-    Optional<PremiumList> optionalPremiumList = PremiumList.getCached(listName);
-    checkState(optionalPremiumList.isPresent(), "Could not load premium list '%s'", listName);
-    PremiumList premiumList = optionalPremiumList.get();
-    PremiumListRevision revision;
-    try {
-      revision = cachePremiumListRevisions.get(premiumList.getRevisionKey());
-    } catch (InvalidCacheLoadException | ExecutionException e) {
-      throw new RuntimeException(
-          "Could not load premium list revision " + premiumList.getRevisionKey(), e);
-    }
-    checkState(
-        revision.getProbablePremiumLabels() != null,
-        "Probable premium labels Bloom filter is null on revision '%s'",
-        premiumList.getRevisionKey());
-
-    CheckResults checkResults = checkStatus(revision, label);
-    DomainLabelMetrics.recordPremiumListCheckOutcome(
-        registry.getTldStr(),
-        listName,
-        checkResults.checkOutcome(),
-        DateTime.now(UTC).getMillis() - startTime.getMillis());
-
-    // Also load the value from Cloud SQL, compare the two results, and log if different.
-    try {
-      Optional<Money> priceFromSql = PremiumListDao.getPremiumPrice(label, registry);
-      if (!priceFromSql.equals(checkResults.premiumPrice())) {
-        logger.atWarning().log(
-            "Unequal prices for domain %s.%s from Datastore (%s) and Cloud SQL (%s).",
-            label, registry.getTldStr(), checkResults.premiumPrice(), priceFromSql);
-      }
-    } catch (Throwable t) {
-      logger.atSevere().withCause(t).log(
-          "Error loading price of domain %s.%s from Cloud SQL.", label, registry.getTldStr());
-    }
-    return checkResults.premiumPrice();
-  }
-
-  private static CheckResults checkStatus(PremiumListRevision premiumListRevision, String label) {
-    if (!premiumListRevision.getProbablePremiumLabels().mightContain(label)) {
-      return CheckResults.create(BLOOM_FILTER_NEGATIVE, Optional.empty());
-    }
-
-    Key<PremiumListEntry> entryKey =
-        Key.create(Key.create(premiumListRevision), PremiumListEntry.class, label);
-    try {
-      // getIfPresent() returns null if the key is not in the cache
-      Optional<PremiumListEntry> entry = cachePremiumListEntries.getIfPresent(entryKey);
-      if (entry != null) {
-        if (entry.isPresent()) {
-          return CheckResults.create(CACHED_POSITIVE, Optional.of(entry.get().getValue()));
-        } else {
-          return CheckResults.create(CACHED_NEGATIVE, Optional.empty());
-        }
-      }
-
-      entry = cachePremiumListEntries.get(entryKey);
-      if (entry.isPresent()) {
-        return CheckResults.create(UNCACHED_POSITIVE, Optional.of(entry.get().getValue()));
-      } else {
-        return CheckResults.create(UNCACHED_NEGATIVE, Optional.empty());
-      }
-    } catch (InvalidCacheLoadException | ExecutionException e) {
-      throw new RuntimeException("Could not load premium list entry " + entryKey, e);
-    }
-  }
-
-  /**
-   * Persists a new or updated PremiumList object and its descendant entities to Datastore.
-   *
-   * <p>The flow here is: save the new premium list entries parented on that revision entity,
-   * save/update the PremiumList, and then delete the old premium list entries associated with the
-   * old revision.
-   *
-   * <p>This is the only valid way to save these kinds of entities!
-   */
-  public static PremiumList savePremiumListAndEntries(
-      final PremiumList premiumList,
-      ImmutableMap<String, PremiumListEntry> premiumListEntries) {
-    final Optional<PremiumList> oldPremiumList = PremiumList.getUncached(premiumList.getName());
-
-    // Create the new revision (with its Bloom filter) and parent the entries on it.
-    final PremiumListRevision newRevision =
-        PremiumListRevision.create(premiumList, premiumListEntries.keySet());
-    final Key<PremiumListRevision> newRevisionKey = Key.create(newRevision);
-    ImmutableSet<PremiumListEntry> parentedEntries =
-        parentPremiumListEntriesOnRevision(premiumListEntries.values(), newRevisionKey);
-
-    // Save the new child entities in a series of transactions.
-    for (final List<PremiumListEntry> batch : partition(parentedEntries, TRANSACTION_BATCH_SIZE)) {
-      tm().transactNew(() -> ofy().save().entities(batch));
-    }
-
-    // Save the new PremiumList and revision itself.
-    PremiumList updated = tm().transactNew(() -> {
-      DateTime now = tm().getTransactionTime();
-      // Assert that the premium list hasn't been changed since we started this process.
-      PremiumList existing = ofy().load()
-          .type(PremiumList.class)
-          .parent(getCrossTldKey())
-          .id(premiumList.getName())
-          .now();
-      checkState(
-          Objects.equals(existing, oldPremiumList.orElse(null)),
-          "PremiumList was concurrently edited");
-      PremiumList newList = premiumList.asBuilder()
-          .setLastUpdateTime(now)
-          .setCreationTime(oldPremiumList.isPresent() ? oldPremiumList.get().creationTime : now)
-          .setRevision(newRevisionKey)
-          .build();
-      ofy().save().entities(newList, newRevision);
-      return newList;
-    });
-
-    // Invalidate the cache on this premium list so the change will take effect instantly. This only
-    // clears the cache on the same instance that the update was run on, which will typically be the
-    // only tools instance.
-    PremiumList.cachePremiumLists.invalidate(premiumList.getName());
-
-    // TODO(b/79888775): Enqueue the oldPremiumList for deletion after at least
-    // RegistryConfig.getDomainLabelListCacheDuration() has elapsed.
-    return updated;
-  }
-
-  public static PremiumList savePremiumListAndEntries(
-      PremiumList premiumList, Iterable<String> premiumListLines) {
-    return savePremiumListAndEntries(premiumList, premiumList.parse(premiumListLines));
-  }
-
-  /** Re-parents the given {@link PremiumListEntry}s on the given {@link PremiumListRevision}. */
-  @VisibleForTesting
-  public static ImmutableSet<PremiumListEntry> parentPremiumListEntriesOnRevision(
-      Iterable<PremiumListEntry> entries, final Key<PremiumListRevision> revisionKey) {
-    return Streams.stream(entries)
-        .map((PremiumListEntry entry) -> entry.asBuilder().setParent(revisionKey).build())
-        .collect(toImmutableSet());
-  }
-
-  /** Deletes the PremiumList and all of its child entities. */
-  public static void deletePremiumList(final PremiumList premiumList) {
-    tm().transactNew(() -> ofy().delete().entity(premiumList));
-    deleteRevisionAndEntriesOfPremiumList(premiumList);
-    cachePremiumLists.invalidate(premiumList.getName());
-  }
-
-  static void deleteRevisionAndEntriesOfPremiumList(final PremiumList premiumList) {
-    if (premiumList.getRevisionKey() == null) {
-      return;
-    }
-    for (final List<Key<PremiumListEntry>> batch :
-        partition(
-            ofy().load().type(PremiumListEntry.class).ancestor(premiumList.revisionKey).keys(),
-            TRANSACTION_BATCH_SIZE)) {
-      tm().transactNew(() -> ofy().delete().keys(batch));
-    }
-    tm().transactNew(() -> ofy().delete().key(premiumList.getRevisionKey()));
-  }
-
-  /**
-   * Returns all {@link PremiumListEntry PremiumListEntries} in the given {@code premiumList}.
-   *
-   * <p>This is an expensive operation and should only be used when the entire list is required.
-   */
-  public static Iterable<PremiumListEntry> loadPremiumListEntries(PremiumList premiumList) {
-    return ofy().load().type(PremiumListEntry.class).ancestor(premiumList.revisionKey).iterable();
-  }
-
-  /** Returns whether a PremiumList of the given name exists, bypassing the cache. */
-  public static boolean doesPremiumListExist(String name) {
-    return ofy().load().key(Key.create(getCrossTldKey(), PremiumList.class, name)).now() != null;
-  }
-
-  private PremiumListUtils() {}
-}
--- a/core/src/main/java/google/registry/model/smd/SignedMarkRevocationList.java
+++ b/core/src/main/java/google/registry/model/smd/SignedMarkRevocationList.java
@@ -15,24 +15,13 @@
 package google.registry.model.smd;

 import static com.google.common.base.Preconditions.checkNotNull;
-import static com.google.common.base.Preconditions.checkState;
-import static com.google.common.collect.ImmutableList.toImmutableList;
-import static com.google.common.collect.Iterables.isEmpty;
 import static google.registry.model.CacheUtils.memoizeWithShortExpiration;
-import static google.registry.model.DatabaseMigrationUtils.suppressExceptionUnlessInTest;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
-import static google.registry.model.ofy.ObjectifyService.allocateId;
-import static google.registry.model.ofy.ObjectifyService.ofy;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static google.registry.util.DateTimeUtils.isBeforeOrAt;

 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Supplier;
 import com.google.common.collect.ImmutableMap;
-import com.google.common.collect.Iterables;
-import com.google.common.collect.MapDifference;
-import com.google.common.collect.Maps;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.EmbedMap;
 import com.googlecode.objectify.annotation.Entity;
@@ -45,9 +34,7 @@ import google.registry.model.annotations.NotBackedUp;
 import google.registry.model.annotations.NotBackedUp.Reason;
 import google.registry.model.common.EntityGroupRoot;
 import google.registry.schema.replay.NonReplicatedEntity;
-import google.registry.util.CollectionUtils;
 import java.util.Map;
-import java.util.Optional;
 import javax.persistence.CollectionTable;
 import javax.persistence.Column;
 import javax.persistence.ElementCollection;
@@ -116,16 +103,7 @@ public class SignedMarkRevocationList extends ImmutableObject implements NonRepl
   * single {@link SignedMarkRevocationList} object.
   */
  private static final Supplier<SignedMarkRevocationList> CACHE =
-      memoizeWithShortExpiration(
-          () -> {
-            SignedMarkRevocationList datastoreList = loadFromDatastore();
-            suppressExceptionUnlessInTest(
-                () -> {
-                  loadAndCompareCloudSqlList(datastoreList);
-                },
-                "Error comparing signed mark revocation lists.");
-            return datastoreList;
-          });
+      memoizeWithShortExpiration(SignedMarkRevocationListDao::load);

  /** Return a single logical instance that combines all Datastore shards. */
  public static SignedMarkRevocationList get() {
@@ -159,98 +137,10 @@ public class SignedMarkRevocationList extends ImmutableObject implements NonRepl

  /** Save this list to Datastore in sharded form and to Cloud SQL. Returns {@code this}. */
  public SignedMarkRevocationList save() {
-    saveToDatastore();
-    SignedMarkRevocationListDao.trySave(this);
+    SignedMarkRevocationListDao.save(this);
    return this;
  }

-  /** Loads the shards from Datastore and combines them into one list. */
-  private static SignedMarkRevocationList loadFromDatastore() {
-    return tm().transactNewReadOnly(
-            () -> {
-              Iterable<SignedMarkRevocationList> shards =
-                  ofy().load().type(SignedMarkRevocationList.class).ancestor(getCrossTldKey());
-              DateTime creationTime =
-                  isEmpty(shards)
-                      ? START_OF_TIME
-                      : checkNotNull(Iterables.get(shards, 0).creationTime, "creationTime");
-              ImmutableMap.Builder<String, DateTime> revokes = new ImmutableMap.Builder<>();
-              for (SignedMarkRevocationList shard : shards) {
-                revokes.putAll(shard.revokes);
-                checkState(
-                    creationTime.equals(shard.creationTime),
-                    "Inconsistent creation times: %s vs. %s",
-                    creationTime,
-                    shard.creationTime);
-              }
-              return create(creationTime, revokes.build());
-            });
-  }
-
-  /** Save this list to Datastore in sharded form. */
-  private SignedMarkRevocationList saveToDatastore() {
-    tm().transact(
-            () -> {
-              ofy()
-                  .deleteWithoutBackup()
-                  .keys(
-                      ofy()
-                          .load()
-                          .type(SignedMarkRevocationList.class)
-                          .ancestor(getCrossTldKey())
-                          .keys());
-              ofy()
-                  .saveWithoutBackup()
-                  .entities(
-                      CollectionUtils.partitionMap(revokes, SHARD_SIZE).stream()
-                          .map(
-                              shardRevokes -> {
-                                SignedMarkRevocationList shard = create(creationTime, shardRevokes);
-                                shard.id = allocateId();
-                                shard.isShard =
-                                    true; // Avoid the exception in disallowUnshardedSaves().
-                                return shard;
-                              })
-                          .collect(toImmutableList()));
-            });
-    return this;
-  }
-
-  private static void loadAndCompareCloudSqlList(SignedMarkRevocationList datastoreList) {
-    // Lifted with some modifications from ClaimsListShard
-    Optional<SignedMarkRevocationList> maybeCloudSqlList =
-        SignedMarkRevocationListDao.getLatestRevision();
-    if (maybeCloudSqlList.isPresent()) {
-      SignedMarkRevocationList cloudSqlList = maybeCloudSqlList.get();
-      MapDifference<String, DateTime> diff =
-          Maps.difference(datastoreList.revokes, cloudSqlList.revokes);
-      if (!diff.areEqual()) {
-        if (diff.entriesDiffering().size() > 10) {
-          String message =
-              String.format(
-                  "Unequal SM revocation lists detected, Cloud SQL list with revision id %d has %d"
-                      + " different records than the current Datastore list.",
-                  cloudSqlList.revisionId, diff.entriesDiffering().size());
-          throw new RuntimeException(message);
-        } else {
-          StringBuilder diffMessage = new StringBuilder("Unequal SM revocation lists detected:\n");
-          diff.entriesDiffering()
-              .forEach(
-                  (label, valueDiff) ->
-                      diffMessage.append(
-                          String.format(
-                              "SMD %s has key %s in Datastore and key %s in Cloud SQL.\n",
-                              label, valueDiff.leftValue(), valueDiff.rightValue())));
-          throw new RuntimeException(diffMessage.toString());
-        }
-      }
-    } else {
-      if (datastoreList.size() != 0) {
-        throw new RuntimeException("Signed mark revocation list in Cloud SQL is empty.");
-      }
-    }
-  }
-
  /** As a safety mechanism, fail if someone tries to save this class directly. */
  @OnSave
  void disallowUnshardedSaves() {
--- a/core/src/main/java/google/registry/model/smd/SignedMarkRevocationListDao.java
+++ b/core/src/main/java/google/registry/model/smd/SignedMarkRevocationListDao.java
@@ -14,28 +14,142 @@

 package google.registry.model.smd;

-import static google.registry.model.CacheUtils.memoizeWithShortExpiration;
+import static com.google.common.base.Preconditions.checkNotNull;
+import static com.google.common.base.Preconditions.checkState;
+import static com.google.common.collect.ImmutableList.toImmutableList;
+import static com.google.common.collect.Iterables.isEmpty;
 import static google.registry.model.DatabaseMigrationUtils.suppressExceptionUnlessInTest;
+import static google.registry.model.common.DatabaseTransitionSchedule.PrimaryDatabase.DATASTORE;
+import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
+import static google.registry.model.ofy.ObjectifyService.allocateId;
+import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.smd.SignedMarkRevocationList.SHARD_SIZE;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.util.CollectionUtils.isNullOrEmpty;
+import static google.registry.util.DateTimeUtils.START_OF_TIME;

-import com.google.common.base.Supplier;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.Iterables;
+import com.google.common.collect.MapDifference;
+import com.google.common.collect.Maps;
 import com.google.common.flogger.FluentLogger;
+import google.registry.model.DatabaseMigrationUtils;
+import google.registry.model.common.DatabaseTransitionSchedule.PrimaryDatabase;
+import google.registry.model.common.DatabaseTransitionSchedule.TransitionId;
+import google.registry.util.CollectionUtils;
+import java.util.Map;
 import java.util.Optional;
 import javax.persistence.EntityManager;
+import org.joda.time.DateTime;

 public class SignedMarkRevocationListDao {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();

-  private static final Supplier<Optional<SignedMarkRevocationList>> CACHE =
-      memoizeWithShortExpiration(SignedMarkRevocationListDao::getLatestRevision);
-
-  /** Returns the most recent revision of the {@link SignedMarkRevocationList}, from cache. */
-  public static Optional<SignedMarkRevocationList> getLatestRevisionCached() {
-    return CACHE.get();
+  /**
+   * Loads the {@link SignedMarkRevocationList}.
+   *
+   * <p>Loads the list from the specified primary database, and attempts to load from the secondary
+   * database. If the load the secondary database fails, or the list from the secondary database
+   * does not match the list from the primary database, the error will be logged but no exception
+   * will be thrown.
+   */
+  static SignedMarkRevocationList load() {
+    PrimaryDatabase primaryDatabase =
+        tm().transactNew(
+                () ->
+                    DatabaseMigrationUtils.getPrimaryDatabase(
+                        TransitionId.SIGNED_MARK_REVOCATION_LIST));
+    Optional<SignedMarkRevocationList> primaryList =
+        primaryDatabase.equals(DATASTORE) ? loadFromDatastore() : loadFromCloudSql();
+    if (!primaryList.isPresent()) {
+      throw new IllegalStateException(
+          String.format(
+              "SignedMarkRevocationList not found in the primary database (%s).",
+              primaryDatabase.name()));
+    }
+    suppressExceptionUnlessInTest(
+        () -> loadAndCompare(primaryDatabase, primaryList.get()),
+        String.format(
+            "Error loading and comparing the SignedMarkRevocationList from the secondary database"
+                + " (%s).",
+            primaryDatabase.equals(DATASTORE) ? "Cloud SQL" : "Datastore"));
+    return primaryList.get();
  }

-  public static Optional<SignedMarkRevocationList> getLatestRevision() {
+  /**
+   * Loads the list from the secondary database and compares it to the list from the primary
+   * database.
+   */
+  private static void loadAndCompare(
+      PrimaryDatabase primaryDatabase, SignedMarkRevocationList primaryList) {
+    Optional<SignedMarkRevocationList> secondaryList =
+        primaryDatabase.equals(DATASTORE) ? loadFromCloudSql() : loadFromDatastore();
+    if (secondaryList.isPresent() && !isNullOrEmpty(secondaryList.get().revokes)) {
+      MapDifference<String, DateTime> diff =
+          Maps.difference(primaryList.revokes, secondaryList.get().revokes);
+      if (!diff.areEqual()) {
+        if (diff.entriesDiffering().size() > 10) {
+          String message =
+              String.format(
+                  "Unequal SignedMarkRevocationList detected, %s list with revision id"
+                      + " %d has %d different records than the current primary database list.",
+                  primaryDatabase.equals(DATASTORE) ? "Cloud SQL" : "Datastore",
+                  secondaryList.get().revisionId,
+                  diff.entriesDiffering().size());
+          throw new IllegalStateException(message);
+        } else {
+          StringBuilder diffMessage =
+              new StringBuilder("Unequal SignedMarkRevocationList detected:\n");
+          diff.entriesDiffering()
+              .forEach(
+                  (label, valueDiff) ->
+                      diffMessage.append(
+                          String.format(
+                              "SMD %s has key %s in %s and key %s in secondary database.\n",
+                              label,
+                              valueDiff.leftValue(),
+                              primaryDatabase.name(),
+                              valueDiff.rightValue())));
+          throw new IllegalStateException(diffMessage.toString());
+        }
+      }
+    } else {
+      if (primaryList.size() != 0) {
+        throw new IllegalStateException(
+            String.format(
+                "SignedMarkRevocationList in %s is empty while it is not empty in the primary"
+                    + " database.",
+                primaryDatabase.equals(DATASTORE) ? "Cloud SQL" : "Datastore"));
+      }
+    }
+  }
+
+  /** Loads the shards from Datastore and combines them into one list. */
+  private static Optional<SignedMarkRevocationList> loadFromDatastore() {
+    return tm().transactNewReadOnly(
+            () -> {
+              Iterable<SignedMarkRevocationList> shards =
+                  ofy().load().type(SignedMarkRevocationList.class).ancestor(getCrossTldKey());
+              DateTime creationTime =
+                  isEmpty(shards)
+                      ? START_OF_TIME
+                      : checkNotNull(Iterables.get(shards, 0).creationTime, "creationTime");
+              ImmutableMap.Builder<String, DateTime> revokes = new ImmutableMap.Builder<>();
+              for (SignedMarkRevocationList shard : shards) {
+                revokes.putAll(shard.revokes);
+                checkState(
+                    creationTime.equals(shard.creationTime),
+                    "Inconsistent creation times in Datastore shard: %s vs. %s",
+                    creationTime,
+                    shard.creationTime);
+              }
+              return Optional.of(SignedMarkRevocationList.create(creationTime, revokes.build()));
+            });
+  }
+
+  private static Optional<SignedMarkRevocationList> loadFromCloudSql() {
    return jpaTm()
        .transact(
            () -> {
@@ -54,24 +168,65 @@ public class SignedMarkRevocationListDao {
  }

  /**
-   * Try to save the given {@link SignedMarkRevocationList} into Cloud SQL. If the save fails, the
-   * error will be logged but no exception will be thrown.
+   * Save the given {@link SignedMarkRevocationList}
   *
-   * <p>This method is used during the dual-write phase of database migration as Datastore is still
-   * the authoritative database.
+   * <p>Saves the list to the specified primary database, and attempts to save to the secondary
+   * database. If the save to the secondary database fails, the error will be logged but no
+   * exception will be thrown.
   */
-  static void trySave(SignedMarkRevocationList signedMarkRevocationList) {
-    suppressExceptionUnlessInTest(
-        () -> {
-          SignedMarkRevocationListDao.save(signedMarkRevocationList);
-          logger.atInfo().log(
-              "Inserted %,d signed mark revocations into Cloud SQL.",
-              signedMarkRevocationList.revokes.size());
-        },
-        "Error inserting signed mark revocations into Cloud SQL.");
+  static void save(SignedMarkRevocationList signedMarkRevocationList) {
+    PrimaryDatabase primaryDatabase =
+        tm().transactNew(
+                () ->
+                    DatabaseMigrationUtils.getPrimaryDatabase(
+                        TransitionId.SIGNED_MARK_REVOCATION_LIST));
+    if (primaryDatabase.equals(DATASTORE)) {
+      saveToDatastore(signedMarkRevocationList.revokes, signedMarkRevocationList.creationTime);
+      suppressExceptionUnlessInTest(
+          () -> SignedMarkRevocationListDao.saveToCloudSql(signedMarkRevocationList),
+          "Error inserting signed mark revocations into secondary database (Cloud SQL).");
+    } else {
+      SignedMarkRevocationListDao.saveToCloudSql(signedMarkRevocationList);
+      suppressExceptionUnlessInTest(
+          () ->
+              saveToDatastore(
+                  signedMarkRevocationList.revokes, signedMarkRevocationList.creationTime),
+          "Error inserting signed mark revocations into secondary database (Datastore).");
+    }
  }

-  private static void save(SignedMarkRevocationList signedMarkRevocationList) {
+  private static void saveToCloudSql(SignedMarkRevocationList signedMarkRevocationList) {
    jpaTm().transact(() -> jpaTm().getEntityManager().persist(signedMarkRevocationList));
+    logger.atInfo().log(
+        "Inserted %,d signed mark revocations into Cloud SQL.",
+        signedMarkRevocationList.revokes.size());
+  }
+
+  private static void saveToDatastore(Map<String, DateTime> revokes, DateTime creationTime) {
+    tm().transact(
+            () -> {
+              ofy()
+                  .deleteWithoutBackup()
+                  .keys(
+                      ofy()
+                          .load()
+                          .type(SignedMarkRevocationList.class)
+                          .ancestor(getCrossTldKey())
+                          .keys());
+              ofy()
+                  .saveWithoutBackup()
+                  .entities(
+                      CollectionUtils.partitionMap(revokes, SHARD_SIZE).stream()
+                          .map(
+                              shardRevokes -> {
+                                SignedMarkRevocationList shard =
+                                    SignedMarkRevocationList.create(creationTime, shardRevokes);
+                                shard.id = allocateId();
+                                shard.isShard =
+                                    true; // Avoid the exception in disallowUnshardedSaves().
+                                return shard;
+                              })
+                          .collect(toImmutableList()));
+            });
  }
 }
--- a/core/src/main/java/google/registry/model/transfer/DomainTransferData.java
+++ b/core/src/main/java/google/registry/model/transfer/DomainTransferData.java
@@ -14,7 +14,10 @@

 package google.registry.model.transfer;

+import static google.registry.util.CollectionUtils.forceEmptyToNull;
+
 import com.google.common.annotations.VisibleForTesting;
+import com.google.common.collect.ImmutableSet;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.AlsoLoad;
 import com.googlecode.objectify.annotation.Embed;
@@ -34,6 +37,7 @@ import javax.persistence.AttributeOverrides;
 import javax.persistence.Column;
 import javax.persistence.Embeddable;
 import javax.persistence.Embedded;
+import javax.persistence.PostLoad;
 import org.joda.time.DateTime;

 /** Transfer data for domain. */
@@ -144,6 +148,16 @@ public class DomainTransferData extends TransferData<DomainTransferData.Builder>
            rootKey, serverApproveAutorenewPollMessage, serverApproveAutorenewPollMessageHistoryId);
  }

+  /**
+   * Fix the VKey "kind" for the PollMessage keys.
+   *
+   * <p>For use by DomainBase/DomainHistory OnLoad methods ONLY.
+   */
+  public void convertVKeys() {
+    serverApproveAutorenewPollMessage =
+        PollMessage.Autorenew.convertVKey(serverApproveAutorenewPollMessage);
+  }
+
  @SuppressWarnings("unused") // For Hibernate.
  private void loadServerApproveBillingEventHistoryId(
      @AlsoLoad("serverApproveBillingEvent") VKey<BillingEvent.OneTime> val) {
@@ -204,6 +218,28 @@ public class DomainTransferData extends TransferData<DomainTransferData.Builder>
    return serverApproveAutorenewPollMessageHistoryId;
  }

+  @PostLoad
+  @Override
+  void postLoad() {
+    // The superclass's serverApproveEntities should include the billing events if present
+    super.postLoad();
+    ImmutableSet.Builder<VKey<? extends TransferServerApproveEntity>> serverApproveEntitiesBuilder =
+        new ImmutableSet.Builder<>();
+    if (serverApproveEntities != null) {
+      serverApproveEntitiesBuilder.addAll(serverApproveEntities);
+    }
+    if (serverApproveBillingEvent != null) {
+      serverApproveEntitiesBuilder.add(serverApproveBillingEvent);
+    }
+    if (serverApproveAutorenewEvent != null) {
+      serverApproveEntitiesBuilder.add(serverApproveAutorenewEvent);
+    }
+    if (serverApproveAutorenewPollMessage != null) {
+      serverApproveEntitiesBuilder.add(serverApproveAutorenewPollMessage);
+    }
+    serverApproveEntities = forceEmptyToNull(serverApproveEntitiesBuilder.build());
+  }
+
  @Override
  public boolean isEmpty() {
    return EMPTY.equals(this);
--- a/core/src/main/java/google/registry/model/transfer/TransferData.java
+++ b/core/src/main/java/google/registry/model/transfer/TransferData.java
@@ -76,6 +76,7 @@ public abstract class TransferData<
   * be deleted.
   */
  @Transient
+  @DoNotCompare
  @IgnoreSave(IfNull.class)
  Set<VKey<? extends TransferServerApproveEntity>> serverApproveEntities;

@@ -93,6 +94,9 @@ public abstract class TransferData<
  // the transfer request flow, when the instance is loaded from Datastore, we cannot make this
  // distinction because they are just VKeys. Also, the only way we use serverApproveEntities is to
  // just delete all the entities referenced by the VKeys, so we don't need to make the distinction.
+  //
+  // In addition, there may be a third poll message for the autorenew poll message on domain
+  // transfer if applicable.
  @Ignore
  @Column(name = "transfer_poll_message_id_1")
  Long pollMessageId1;
@@ -101,6 +105,10 @@ public abstract class TransferData<
  @Column(name = "transfer_poll_message_id_2")
  Long pollMessageId2;

+  @Ignore
+  @Column(name = "transfer_poll_message_id_3")
+  Long pollMessageId3;
+
  public abstract boolean isEmpty();

  @Nullable
@@ -159,7 +167,7 @@ public abstract class TransferData<
      return;
    }
    Key<? extends EppResource> eppKey;
-    if (getClass().equals(DomainBase.class)) {
+    if (getClass().equals(DomainTransferData.class)) {
      eppKey = Key.create(DomainBase.class, repoId);
    } else {
      eppKey = Key.create(ContactResource.class, repoId);
@@ -175,6 +183,10 @@ public abstract class TransferData<
      Key<PollMessage> ofyKey = Key.create(historyEntryKey, PollMessage.class, pollMessageId2);
      entityKeysBuilder.add(PollMessage.createVKey(ofyKey));
    }
+    if (pollMessageId3 != null) {
+      Key<PollMessage> ofyKey = Key.create(historyEntryKey, PollMessage.class, pollMessageId3);
+      entityKeysBuilder.add(PollMessage.createVKey(ofyKey));
+    }
    serverApproveEntities = entityKeysBuilder.build();
  }

@@ -187,6 +199,7 @@ public abstract class TransferData<
      transferData.repoId = null;
      transferData.pollMessageId1 = null;
      transferData.pollMessageId2 = null;
+      transferData.pollMessageId3 = null;
      return;
    }
    // Each element in serverApproveEntities should have the exact same Key<HistoryEntry> as its
@@ -202,6 +215,9 @@ public abstract class TransferData<
    if (sortedPollMessageIds.size() >= 2) {
      transferData.pollMessageId2 = sortedPollMessageIds.get(1);
    }
+    if (sortedPollMessageIds.size() >= 3) {
+      transferData.pollMessageId3 = sortedPollMessageIds.get(2);
+    }
  }

  /**
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Weimin Yu	1f4cf5bdb6	Fix flyway invocation in Gradle script (#993 ) * Fix flyway invocation in Gradle script Script wrongly assumed that Flyway task is invoked if --environment is set. Bug was introduced in go/r3pr/940	2021-03-08 13:59:28 -05:00
gbrodman	4176f7dd9c	Convert DomainTransferRejectFlow to use tm() methods (#977 ) * Convert DomainTransferRejectFlow to use tm() methods This change includes a few other necessary dependencies to converting DomainTransferRejectFlowTest to be a dual-database test. Namely: - The basic "use tm() instead of ofy()" and "branching database selection on what were previously raw ofy queries" - Modification of the PollMessage convertVKey methods to do what they say they do - Filling the generic pending / response fields in PollMessage based on what type of poll message it is (this has to be done because SQL is not very good at storing ambiguous superclasses) - Setting the generic pending / repsonse fields in PollMessage upon build - Filling out the serverApproveEntities field in DomainTransferData with all necessary poll messages / billing events that should be cancelled on rejection - Scattered changes in DatabaseHelper to make sure that we're saving and loading entities correctly where we weren't before	2021-03-08 13:24:30 -05:00
Michael Muller	e07139665e	Disable whois caching in nomulus tool (#980 ) * Disable whois caching in nomulus tool The whois commands previously served output generated from cached EppResource objects in most cases. While this is entirely appropriate from server-side, it is less useful when these commands are run from nomulus tool and, in fact, when run from the "shell" command this results in changes that have been applied from the shell not being visible from a subsequent "whois". The command may instead serve information on an earlier, cached version of the resource instead of the latest version. This implementation uses dagger for parameterization of cached/non-cached modes. I did consider the possibility of simply parameterizing the query commands in all cases as discussed, however, having gone down the daggerization path and having gotten it to work, I have to say I find this approach preferrable. There's really no case for identifying cached/non-cached on a per-command basis and doing so would require propagating the flag throughout all levels of the API and all callsites. Tested: In addition to the new unit test which explicitly verifies the caching/noncaching behavior of the new commands, tested the actual failing sequence from "nomulus -e sandbox shell" and verified that the correct results are served after a mutation. * Fixed copyright year * More copyright date fixes * Added WhoisCommandFactoryTest to fragile tests I suspect that this test has some contention with other tests, it's not clear why.	2021-03-08 12:33:23 -05:00
Michael Muller	b75eb0ad95	Replay Cloud SQL transactions against datastore (#738 ) * Replay Cloud SQL transactions against datastore Implement the ReplicateToDatastore cron job that will apply all Cloud SQL transactions to the datastore. The last transaction id is stored in a LastSqlTransaction entity in datastore. Note that this will not be activated in production until a) the cron configuration is updated and b) the cloudSql.replicateTransactions flag is set to true in the nomulus config file. * Post-review changes Fixed immutability issues with LastSqlTransaction, write a single transaction at a time to datastore. * Changes requested in review * Get a batch of SQL transactions Read a batch of SQL transactions at a time and then process them transactionally against datastore. * Bring this up-to-date with the codebase * Changes requested in review * Fixed date in copyright	2021-03-05 10:35:30 -05:00
Weimin Yu	63f8fcef18	Clean up Gradle Flyway tasks in :db (#990 ) * Clean up Gradle Flyway tasks in :db Simplified the command line by revising the semantics of some properties. Added examples of Flyway task invocations. This script still uses the GCS file-based credential. We will migrate it to the Secret Manager soon.	2021-03-04 19:58:09 -05:00
Michael Muller	8d563c4516	Add replay & compare to more flow tests (#975 ) * Add replay & compare to more flow tests Add replay and comparison testing to another batch of flow tests, apply fixes as needed.	2021-03-04 08:25:47 -05:00
Lai Jiang	a58c4a6492	Log forbidden HTTP request method at warning (#983 ) * Log forbidden HTTP request method at warning This seems like more reasonable. It will potential issues with how requests are generated more discoverable in the log.	2021-03-03 21:02:06 -05:00
Weimin Yu	e59475a5f6	Allow AppEngine deployment to qa environment (#986 ) * Allow AppEngine deployment to qa environment	2021-03-03 19:31:08 -05:00
sarahcaseybot	c35f92f54b	Reject handshakes with bad TLS protocols and ciphers (#970 ) * Reject handshakes with bad TLS protocols and ciphers * Fix protocols * make cipher suite list static and fix tests * Delete unnecessary line * Add start time configuration for enforcement * small format fix * Add multiple ciphersuite test * fix gradle lint * fix indentation	2021-03-03 15:47:42 -05:00
Ben McIlwain	cd415fe846	Actually log the error in DeleteExpiredDomainsAction (#985 ) * Actually log the error in DeleteExpiredDomainsAction	2021-03-03 15:21:13 -05:00
Lai Jiang	4ca2c11b20	Use fanout action to run ICANN report upload job in cron (#984 ) GAE cron only issuse HTTP GET requests to the endpoint in question. This particular only allows POSTs. As a result this cron job never succeeded. This is not a big problem as this job is meant to catch up any unforeseen upload failures and in case it needs to catch up but fails, every month the staging job (which is enqueued corrected by cron) will eventually catch everything to date.	2021-03-03 09:00:34 -05:00
Lai Jiang	4e44a98139	Update a few plugins for Java 11 compatibility (#966 ) * Update a few plugins for Java 11 compatibility Guice 5.0.1 is now compatible with Java 11. However we don't directly depend on Guice. Rather Soy depends on Guice. So I added a direct dependency on Guice 5.0 just before Soy in order to frontload Soy and pull in the newer version. Mockito 3.7.7 is now compatible with Java 11. The complication is that we need to use the inline version of Mockito, which among other things also allows mocking for final classes (hooray!). It will eventually become the default Mockito mock maker but for now it needs to be manually activated. Note that the inline version now introduces another warning: ``` OpenJDK 64-Bit Server VM warning: Sharing is only supported for boot loader classes because bootstrap classpath has been appended ``` Which I think is WAI due to how the inline mock maker works. Waiting on the author to confirm. After these to changes the only illegal reflective access is caused by App Engine SDK tools, which we will rid ourselves of when we migrate off of GAE. * Restore package-lock.json	2021-03-02 21:01:30 -05:00
gbrodman	d4371a880e	Add GetPremiumListCommand (#972 ) * Add GetPremiumListCommand When testing the premium list refactor, it would have been nice and convenient to have this. Currently we have no way of inspecting premium list contents that I'm aware of.	2021-03-02 19:59:12 -05:00
gbrodman	7312bc9e60	Add SQL searching to RdapEntitySearchAction and RdapSearchActionBase (#969 ) - Adds a CriteriaQueryBuilder class that allows us to build CriteriaQuery objects with sane and modular WHERE and ORDER BY clauses. CriteriaQuery requires that all WHERE and ORDER BY clauses be specified at the same time (else later ones will overwrite the earlier ones) so in order to have a proper builder pattern we need to wait to build the query object until we are done adding clauses. - In addition, encapsulating the query logic in the CriteriaQueryBuilder class means that we don't need to deal with the complicated Root/Path branching, otherwise we'd have to keep track of CriteriaQuery and Root objects everywhere. - Added a REPLAYED_ENTITIES TransitionId that will represent all replayed entities, e.g. EppResources. Also sets this, by default, to always be CLOUD_SQL if we're using the SQL transaction manager in tests. - Added branching logic in RdapEntitySearchAction based on that transition ID that determines whether we do the existing ofy query logic or JPA logic.	2021-03-02 13:13:55 -05:00
Michael Muller	83ca9d82df	Add replay & compare to ContactCreateFlowTest test (#976 ) * Add replay & compare to ContactCreateFlowTest test This test exposed a write priority issue between ContactResource and ContactHistory entries.	2021-03-02 11:50:03 -05:00
Lai Jiang	8724ef6c70	Upgrade to Gradle 6.8.3 (#979 ) * Upgrade to Gradle 6.8.3	2021-03-01 21:11:06 -05:00
gbrodman	31bf4bd76d	Add a third poll message column in TransferData for domain transfers (#974 ) Because we don't store serverApproveEntities specifically as a set in the SQL world, we need to make sure that the entities are all separated and stored if they exist. For domain transfers, there exist three separate poll messages (client losing, client gaining, autorenew) so we need to store and retrieve that one. Founnd this while converting domain transfer flows to SQL.	2021-02-25 17:22:53 -05:00
gbrodman	cc69d63802	Fix a few Java 9+isms and ignore IML files (#973 ) This allows us to run tests in IDEA which is significantly quicker. We shouldn't be using anything past Java 8 anyway since that's what GAE runs with.	2021-02-25 14:59:00 -05:00
gbrodman	d73a15c697	Partially convert RDAP ofy calls to tm calls (#964 ) * Partially convert RDAP ofy calls to tm calls This converts the simple retrieval actions but does not touch the more complicated search actions -- those use some ofy() query searching logic and will likely end up being significantly more complicated than this change. Here, though, we are just changing the calls that can be converted easily to tm() lookups. To change in future PRs: - RdapDomainSearchAction - RdapEntitySearchAction - RdapNameserverSearchAction - RdapSearchActionBase	2021-02-23 11:28:10 -05:00
gbrodman	f35eda6dc1	Update NPM plugin and hardcode versions of Node / NPM to use (#971 ) * Update NPM plugin and hardcode versions of Node / NPM to use The plugin we were using before was a bit old (last updated in March 2019) and this one is newer, updated, and updates the package-lock file with the new dependency upgrades	2021-02-23 11:27:34 -05:00
gbrodman	a07fbb27c5	Refactor PremiumList storage and retrieval for dual-database setup (#950 ) * Refactor PremiumList storage and retrieval for dual-database setup Previously, the storage and retrieval code was scattered across various places haphazardly and there was no good way to set up dual database access. This reorganizes the code so that retrieval is simpler and it allows for dual-write and dual-read. This includes the following changes: - Move all static / object retrieval code out of PremiumList -- the class should solely consist of its data and methods on its data and it shouldn't have to worry about complicated caching or retrieval - Split all PremiumList retrieval methods into PremiumListDatastoreDao and PremiumListSqlDao that handle retrieval of the premium list entry objects from the corresponding databases (since the way the actual data itself is stored is not the same between the two - Create a dual-DAO for PremiumList retrieval that branches between SQL/Datastore depending on which is appropriate -- it will read from and write to both but only log errors for the secondary DB - Cache the mapping from name to premium list in the dual-DAO. This is a common code path regardless of database so we can cache it at a high level - Cache the ways to go from premium list -> premium entries in the Datastore and SQL DAOs. These caches are specific to the corresponding DB and should thus be stored in the corresponding DAO. - Moves the database-choosing code from the actions to the lower-level dual-DAO. This is because we will often wish to access this premium list data in flows and all accesses should use the proper DB-selecting code	2021-02-22 21:19:48 -05:00
Weimin Yu	ffe3124ee1	Properly set up JPA in BEAM workers (#965 ) * Properly set up JPA in BEAM workers Sets up a singleton JpaTransactionManger on each worker JVM for all pipeline nodes to share. Also added/updated relevant dependencies. The BEAM SDK version change caused the InitSqlPipeline's graph to change.	2021-02-22 18:11:32 -05:00
Michael Muller	8f90b5746a	Fix ContactTransferData SQL loads (#967 ) * Fix ContactTransferData SQL loads ContactTransferData is currently loaded back from SQL as an unspecialized TransferData object. Replace it with the ContactTransferData object that we use it to reconstitute. It's likely that this could be done more straightforwardly with a schema change. * Changes requested in review	2021-02-22 13:42:20 -05:00
Ben McIlwain	a26905d39a	Note that immediate deletion is for exceptional circumstances only (#962 ) * Note that immediate deletion is for exceptional circumstances only	2021-02-17 13:10:12 -05:00
Ben McIlwain	4ce790d29e	Fix obscure bug when checking restore prices of duplicate domain names (#968 ) * Fix obscure bug when checking restore prices of duplicate domain names There were instances of "java.lang.IllegalArgumentException: Multiple entries with same key" in the logs, caused by attempting to construct an ImmutableMap containing duplicate keys. It turns out this was happening in the domain check flow when the following conditions were all simultaneously met: 1. The older v06 fee extension is used 2. The same domain name is being queried multiple times in a single check command (which is valid per the spec but doesn't actually make any sense) 3. Said domain exists 4. The cost of a restore (an uncommon operation) is being checked When all of those conditions were met, an error was being thrown when the dupe-containing list of domain names was used as the keys of a new Map. This fixes that bug by calling .distinct() first. Give enough registrars enough typewriters ... BUG=179052195	2021-02-17 12:09:19 -05:00
sarahcaseybot	bcc1924b24	Refactor SignedMarkRevocationListDao for easy primary database cutover (#943 ) * Refactor SignedMarkRevocationListDao for easy primary database cutover * Fix javadoc comments * Use PrimaryDatabase enum * format fix * fix up tests * Fix punctuation * Remove unnecessary else ifs * Fix error messages * spell out class name	2021-02-14 09:58:08 -05:00
Weimin Yu	f86936788e	Revert BEAM pipeline back to SQL credential file (#961 ) * Revert BEAM pipeline back to SQL credential file Stop using the SecretManager for SQL credential in BEAM for now. The SecretManager cannot be injected into the code on pipeline workers because RegistryEnvironment is not set. See b/179839014 for details.	2021-02-11 14:06:13 -05:00
sarahcaseybot	13f61dd7b9	Add string constants for HTTP header names (#956 ) * Add string constants for HTTP header names * revert package-lock changes * Clarify names * add CONTENT_TYPE * Fix formatting * Move X-FORWARDED-FOR to ProxyHttpHeaders	2021-02-11 12:02:51 -05:00
Michael Muller	17cd9ba4f1	Add db-compare tests to three more flows (#963 ) * Add db-compare tests to three more flows Add database comparison to the replay tests for DomainDeleteFlowTest, DomainRenewFlowTest and DomainUpdateFlowTest.	2021-02-11 11:35:13 -05:00
Weimin Yu	f983d564f8	Use Cloud SQL passwords from the Secret Manager (#959 ) * Use Cloud SQL passwords from the Secret Manager Continue fetching passwords from Keyring until this change is deployed.	2021-02-08 21:59:00 -05:00
sarahcaseybot	bdf9124e87	Add databaseTransitionSchedule entity and tool for updating (#926 ) * Add databaseTransitionSchedule entitiy * add UpdateDatabaseTransitionScheduleCommand * small fixes * change entity structure to no longer be singleton * add get command * fix getCache * Change id to TransitionId enum * more fixes * Cleanup tests * Add link to javadoc * Add lastUpdateTime * fix datatype of getCached	2021-02-08 17:22:00 -05:00
Ben McIlwain	d73e557acc	Rename some overlooked uses of "white-list" and "blacklist" (#960 ) * Rename some overlooked uses of "white-list" and "blacklist"	2021-02-08 16:01:18 -05:00
Lai Jiang	0e74df82df	Update testcontainers to 1.51.1 (#958 ) Per release note (https://github.com/testcontainers/testcontainers-java/releases/tag/1.15.1), this version is needed to support docker version 20.10 and above.	2021-02-08 14:31:17 -05:00
Lai Jiang	b59d2ae419	Upgrade to Gradle 6.8.2 (#957 )	2021-02-08 09:35:43 -05:00
Weimin Yu	d7e65d95e6	Add a presubmit check to require use of templated SQL string literals (#954 ) * Add a presubmit check to require use of templated SQL string literals This PR proposes a coding style convention that helps prevent SQL-injection attacks, and is easy to enforce in the presubmit check. SQL-injections can be effectively prevented if all parameterized queries are generated using the proper param-binding methods. In our project which uses Hibernate exclusively, this can be achieved if we all follow a simple convention: only use constant sql templates assigned to static final String variables as the first parameter to creat(Native)Query methods. This PR adds a presubmit check to enforce the proposed rule, and modified one class as a demo. If the team agrees with this proposal, we will change all other use cases.	2021-02-06 19:28:38 -05:00
Michael Muller	1d96de98c9	Remove dual-write of registrar from tool commands (#952 ) * Remove dual-write of registrar from tool commands As discussed, we're keeping registrar in the "replicated" category.	2021-02-05 11:06:14 -05:00
Michael Muller	29bf0f3965	Make BiqueryPollJobAction endpoint internal only (#955 ) * Make BiqueryPollJobAction endpoint internal only This endpoint makes use of java object deserialization, which allows a malicious actor to craft a request that can initiate overly broad actions on the server. Since this endpoint is not widely used for operational purposes, limit its authorization to "internal only" so that no user agents (even with admin privs) can access it.	2021-02-05 07:50:51 -05:00
sarahcaseybot	5100057dd5	Add cert enforcement in production start date (#953 ) * Add start date for cert enforcement in production * Add TODO to remove start date check after start date * revert changes to package-lock.json * Make start time a constant	2021-02-04 16:30:23 -05:00
Ben McIlwain	1e7260e022	Wire up DeleteExpiredDomainsAction so that it can actually be called (#951 ) * Wire up DeleteExpiredDomainsAction so that it can actually be called For now I'm just going to be calling it manually (and on sandbox for starters), but in a few weeks, if all looks good, I'll add the cron job to regularly call it in production, and this feature will thus be done.	2021-02-03 17:34:36 -05:00
Weimin Yu	73ba96a5d4	A better Datastore bulk delete tool (#947 ) * A better Datastore bulk delete tool Implements an alternative to GCP builtin tool with better performance and usability.	2021-02-02 22:46:38 -05:00
Ben McIlwain	90db60643e	Add delete expired domains action (#836 ) * Add delete expired domains action This will be scheduled to run daily via App Engine cron in a subsequent PR. * Add test	2021-02-02 18:46:15 -05:00
Ben McIlwain	98283a67ac	Use END_OF_TIME as sentinel value for domain's autorenewEndTime (#949 ) * Use END_OF_TIME as sentinel value for domain's autorenewEndTime Datastore inequality queries don't work correctly for null; null is treated as the lowest value possible which is definitely the opposite of the intended meaning here. This includes an @OnLoad for backfilling purposes using the ResaveAll mapreduce.	2021-02-01 15:29:51 -05:00