Mitigate Cloud task retry problem (#2116 )

* Mitigate Cloud task retry problem Increase PublishSpec11Action start delay to avoid the need to retry. The only other use case is invoice, which typically does not retry: delay is 10 minutes, pipeline finishes within 7 minutes.
Add logging about Spec11 email sending (#2115 )
2026-05-19 14:21:48 +00:00 · 2023-08-18 17:14:03 -04:00 · 2023-08-18 15:02:03 -04:00 · 2023-08-18 12:30:35 -04:00 · 2023-08-17 22:40:54 -04:00 · 2023-08-17 15:51:21 -04:00
150 changed files with 5545 additions and 3820 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -31,6 +31,7 @@ tmp/
 local.properties
 .settings/
 .loadpath
+.DS_Store

 # Eclipse Core
 .project
@@ -78,6 +79,7 @@ autogenerated/
 **/*.iml
 nomulus.ipr
 nomulus.iws
+**/classpath.index

 # Auto-generated java classes by Intellij
 */src/main/generated/
--- a/build.gradle
+++ b/build.gradle
@@ -37,8 +37,10 @@ buildscript {

 plugins {
  // Java static analysis plugins. Keep versions consistent with
-  // ./buildSrc/build.gradle
-  id 'nebula.lint' version '16.0.2'
+  // ./buildSrc/build.gradle.kts
+
+  // Re-enable when compatible with Gradle 8
+  // id 'nebula.lint' version '16.0.2'
  id 'net.ltgt.errorprone' version '2.0.2'
  id 'checkstyle'
  id 'com.github.johnrengelman.shadow' version '5.1.0'
@@ -47,7 +49,7 @@ plugins {
  id "com.github.node-gradle.node" version "3.0.1"

  id 'idea'
-  id 'com.diffplug.gradle.spotless' version '3.25.0'
+  id 'com.diffplug.spotless' version '6.20.0'

  id 'jacoco'
  id 'com.dorongold.task-tree' version '2.1.0'
@@ -110,7 +112,8 @@ tasks.build.dependsOn(tasks.checkLicense)
 // Provide defaults for all of the project properties.

 // Only do linting if the build is successful.
-gradleLint.autoLintAfterFailure = false
+// Re-enable when compatible with Gradle 8
+// gradleLint.autoLintAfterFailure = false

 // Paths to main and test sources.
 ext.projectRootDir = "${rootDir}"
@@ -269,14 +272,14 @@ subprojects {
    project.tasks.create(
        taskName, com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar) {
      mergeServiceFiles()
-      baseName = binaryName
+      archiveBaseName = binaryName
      if (mainClass != '') {
        manifest {
          attributes 'Main-Class': mainClass
        }
      }
      zip64 = true
-      classifier = ''
+      archiveClassifier = ''
      archiveVersion = ''
      configurations = configs
      from srcOutput
--- a/buildSrc/build.gradle.kts
+++ b/buildSrc/build.gradle.kts
@@ -32,10 +32,13 @@ buildscript {

 plugins {
  // Java static analysis plugins. Keep versions consistent with ../build.gradle
-  // id("nebula.lint") version "16.0.2"  // unsupported for kotlin
+
+  // We don't anticipate enabling the Gradle lint plugin because they will not support Kotlin
+  // See https://github.com/nebula-plugins/gradle-lint-plugin/issues/166
+  // id 'nebula.lint' version '16.0.2'
  id("net.ltgt.errorprone") version "2.0.2"
  checkstyle
-  id("com.diffplug.gradle.spotless") version "3.25.0"
+  id("com.diffplug.spotless") version "6.20.0"
 }

 checkstyle {
@@ -84,12 +87,8 @@ project.the<SourceSetContainer>()["main"].java {
  srcDir("${project.buildDir}/generated/source/apt/main")
 }

-// checkstyle {
-//   configDir file("../config/checkstyle")
-// }
-
 dependencies {
-  val deps = project.ext["dependencyMap"] as Map<String, String>
+  val deps = project.ext["dependencyMap"] as Map<*, *>
  val implementation by configurations
  val testImplementation by configurations
  val annotationProcessor by configurations
@@ -119,13 +118,6 @@ gradle.projectsEvaluated {
 }

 tasks.register("exportDependencies") {
-  val outputFileProperty = "dependencyExportFile"
-  val output = if (project.hasProperty(outputFileProperty)) {
-        PrintStream(file(project.ext.properties[outputFileProperty]))
-      } else {
-        System.out
-      }
-
  doLast {
    project.configurations.forEach {
      println("dependency is $it")
--- a/buildSrc/buildscript-gradle.lockfile
+++ b/buildSrc/buildscript-gradle.lockfile
@@ -4,21 +4,26 @@
 com.diffplug.durian:durian-collect:1.2.0=classpath
 com.diffplug.durian:durian-core:1.2.0=classpath
 com.diffplug.durian:durian-io:1.2.0=classpath
-com.diffplug.gradle.spotless:com.diffplug.gradle.spotless.gradle.plugin:3.25.0=classpath
-com.diffplug.spotless:spotless-lib-extra:1.25.0=classpath
-com.diffplug.spotless:spotless-lib:1.25.0=classpath
-com.diffplug.spotless:spotless-plugin-gradle:3.25.0=classpath
+com.diffplug.durian:durian-swt.os:4.2.0=classpath
+com.diffplug.spotless:com.diffplug.spotless.gradle.plugin:6.20.0=classpath
+com.diffplug.spotless:spotless-lib-extra:2.40.0=classpath
+com.diffplug.spotless:spotless-lib:2.40.0=classpath
+com.diffplug.spotless:spotless-plugin-gradle:6.20.0=classpath
 com.googlecode.concurrent-trees:concurrent-trees:2.6.1=classpath
-com.googlecode.javaewah:JavaEWAH:1.1.6=classpath
-com.jcraft:jsch:0.1.55=classpath
-com.jcraft:jzlib:1.1.1=classpath
+com.googlecode.javaewah:JavaEWAH:1.2.3=classpath
+com.squareup.okhttp3:okhttp:4.10.0=classpath
+com.squareup.okio:okio-jvm:3.0.0=classpath
+com.squareup.okio:okio:3.0.0=classpath
+dev.equo.ide:solstice:1.3.1=classpath
 net.ltgt.errorprone:net.ltgt.errorprone.gradle.plugin:2.0.2=classpath
 net.ltgt.gradle:gradle-errorprone-plugin:2.0.2=classpath
-org.bouncycastle:bcpg-jdk15on:1.61=classpath
-org.bouncycastle:bcpkix-jdk15on:1.61=classpath
-org.bouncycastle:bcprov-jdk15on:1.61=classpath
-org.codehaus.groovy:groovy-xml:2.4.7=classpath
-org.codehaus.groovy:groovy:2.4.7=classpath
-org.eclipse.jgit:org.eclipse.jgit:5.5.0.201909110433-r=classpath
-org.slf4j:slf4j-api:1.7.2=classpath
+org.eclipse.jgit:org.eclipse.jgit:6.6.0.202305301015-r=classpath
+org.eclipse.platform:org.eclipse.osgi:3.18.300=classpath
+org.jetbrains.kotlin:kotlin-stdlib-common:1.8.20=classpath
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.8.20=classpath
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.8.20=classpath
+org.jetbrains.kotlin:kotlin-stdlib:1.8.20=classpath
+org.jetbrains:annotations:13.0=classpath
+org.slf4j:slf4j-api:1.7.36=classpath
+org.tukaani:xz:1.9=classpath
 empty=
--- a/buildSrc/gradle.lockfile
+++ b/buildSrc/gradle.lockfile
@@ -1,148 +1,110 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-antlr:antlr:2.7.7=checkstyle
-aopalliance:aopalliance:1.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-args4j:args4j:2.0.23=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.14.2=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.14.2=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.ben-manes.caffeine:caffeine:2.7.0=annotationProcessor,testAnnotationProcessor
-com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,testAnnotationProcessor
-com.google.android:annotations:4.1.1.4=testRuntimeClasspath
-com.google.api-client:google-api-client:2.2.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.23.0-alpha=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.23.0-alpha=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.23.0-alpha=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-common-protos:2.20.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-iam-v1:1.15.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:api-common:2.12.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-grpc:2.29.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-httpjson:0.114.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax:2.29.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20230617-2.0.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-credentials:1.17.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-oauth2-http:1.17.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auto.value:auto-value-annotations:1.10.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
+aopalliance:aopalliance:1.0=buildScriptClasspath,compileClasspath
+args4j:args4j:2.0.23=buildScriptClasspath,compileClasspath
+com.fasterxml.jackson.core:jackson-core:2.14.2=buildScriptClasspath,compileClasspath
+com.fasterxml.jackson:jackson-bom:2.14.2=buildScriptClasspath,compileClasspath
+com.github.ben-manes.caffeine:caffeine:2.7.0=annotationProcessor
+com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor
+com.google.android:annotations:4.1.1.4=buildScriptClasspath
+com.google.api-client:google-api-client:2.2.0=buildScriptClasspath,compileClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.22.6-alpha=buildScriptClasspath,compileClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.22.6-alpha=buildScriptClasspath,compileClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.22.6-alpha=buildScriptClasspath,compileClasspath
+com.google.api.grpc:proto-google-common-protos:2.22.0=buildScriptClasspath,compileClasspath
+com.google.api.grpc:proto-google-iam-v1:1.17.0=buildScriptClasspath,compileClasspath
+com.google.api:api-common:2.14.0=buildScriptClasspath,compileClasspath
+com.google.api:gax-grpc:2.31.0=buildScriptClasspath,compileClasspath
+com.google.api:gax-httpjson:2.31.0=buildScriptClasspath,compileClasspath
+com.google.api:gax:2.31.0=buildScriptClasspath,compileClasspath
+com.google.apis:google-api-services-storage:v1-rev20230301-2.0.0=buildScriptClasspath,compileClasspath
+com.google.auth:google-auth-library-credentials:1.19.0=buildScriptClasspath,compileClasspath
+com.google.auth:google-auth-library-oauth2-http:1.19.0=buildScriptClasspath,compileClasspath
+com.google.auto.value:auto-value-annotations:1.10.1=buildScriptClasspath,compileClasspath
 com.google.auto.value:auto-value:1.10.2=annotationProcessor
-com.google.auto:auto-common:0.10=annotationProcessor,testAnnotationProcessor
-com.google.cloud:google-cloud-core-grpc:2.19.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-http:2.19.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core:2.19.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage:2.23.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.code.findbugs:jFormatString:3.0.0=annotationProcessor,testAnnotationProcessor
-com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.code.gson:gson:2.10.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.common.html.types:types:1.0.6=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.errorprone:error_prone_annotation:2.3.4=annotationProcessor,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.18.0=compileClasspath
-com.google.errorprone:error_prone_annotations:2.19.1=testCompileClasspath,testRuntimeClasspath
-com.google.errorprone:error_prone_annotations:2.3.4=annotationProcessor,checkstyle,testAnnotationProcessor
-com.google.errorprone:error_prone_check_api:2.3.4=annotationProcessor,testAnnotationProcessor
-com.google.errorprone:error_prone_core:2.3.4=annotationProcessor,testAnnotationProcessor
-com.google.errorprone:error_prone_type_annotations:2.3.4=annotationProcessor,testAnnotationProcessor
-com.google.escapevelocity:escapevelocity:0.9.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.guava:failureaccess:1.0.1=annotationProcessor,checkstyle,compileClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.guava:guava-parent:32.1.1-jre=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.guava:guava:27.0.1-jre=annotationProcessor,testAnnotationProcessor
-com.google.guava:guava:29.0-jre=checkstyle
-com.google.guava:guava:32.1.1-jre=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,testAnnotationProcessor
-com.google.http-client:google-http-client-apache-v2:1.43.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-appengine:1.43.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-gson:1.43.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-jackson2:1.43.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client:1.43.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.inject.extensions:guice-multibindings:4.1.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.inject:guice:4.1.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.j2objc:j2objc-annotations:1.1=annotationProcessor,testAnnotationProcessor
-com.google.j2objc:j2objc-annotations:1.3=checkstyle
-com.google.j2objc:j2objc-annotations:2.8=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.jsinterop:jsinterop-annotations:1.0.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.oauth-client:google-oauth-client:1.34.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.protobuf:protobuf-java-util:3.23.2=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.protobuf:protobuf-java:3.23.2=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.protobuf:protobuf-java:3.4.0=annotationProcessor,testAnnotationProcessor
-com.google.re2j:re2j:1.7=testRuntimeClasspath
-com.google.template:soy:2021-02-01=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.truth.extensions:truth-java8-extension:1.1.3=testCompileClasspath,testRuntimeClasspath
-com.google.truth:truth:1.1.5=testCompileClasspath,testRuntimeClasspath
-com.googlecode.java-diff-utils:diffutils:1.3.0=annotationProcessor,testAnnotationProcessor
-com.ibm.icu:icu4j:57.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.puppycrawl.tools:checkstyle:8.37=checkstyle
-commons-beanutils:commons-beanutils:1.9.4=checkstyle
-commons-codec:commons-codec:1.15=compileClasspath,testCompileClasspath,testRuntimeClasspath
-commons-collections:commons-collections:3.2.2=checkstyle
-commons-logging:commons-logging:1.2=compileClasspath,testCompileClasspath,testRuntimeClasspath
-info.picocli:picocli:4.5.2=checkstyle
-io.grpc:grpc-alts:1.56.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.56.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-auth:1.56.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.56.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-core:1.56.0=testRuntimeClasspath
-io.grpc:grpc-googleapis:1.56.0=testRuntimeClasspath
-io.grpc:grpc-grpclb:1.56.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-netty-shaded:1.56.0=testRuntimeClasspath
-io.grpc:grpc-protobuf-lite:1.56.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf:1.56.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-rls:1.56.0=testRuntimeClasspath
-io.grpc:grpc-services:1.56.0=testRuntimeClasspath
-io.grpc:grpc-stub:1.56.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-xds:1.56.0=testRuntimeClasspath
-io.opencensus:opencensus-api:0.31.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-contrib-http-util:0.31.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-proto:0.2.0=testRuntimeClasspath
-io.perfmark:perfmark-api:0.26.0=testRuntimeClasspath
-javax.annotation:javax.annotation-api:1.3.2=compileClasspath,testCompileClasspath,testRuntimeClasspath
-javax.annotation:jsr250-api:1.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-javax.inject:javax.inject:1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-junit:junit:4.13.2=testCompileClasspath,testRuntimeClasspath
-net.bytebuddy:byte-buddy-agent:1.12.19=testCompileClasspath,testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.12.19=testCompileClasspath,testRuntimeClasspath
-net.sf.saxon:Saxon-HE:10.3=checkstyle
-org.antlr:antlr4-runtime:4.8-1=checkstyle
-org.apache.commons:commons-lang3:3.12.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-text:1.10.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.httpcomponents:httpcore:4.4.16=compileClasspath,testCompileClasspath,testRuntimeClasspath
-org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
-org.checkerframework:checker-qual:2.11.1=checkstyle
-org.checkerframework:checker-qual:3.0.0=annotationProcessor,testAnnotationProcessor
-org.checkerframework:checker-qual:3.33.0=compileClasspath
-org.checkerframework:checker-qual:3.35.0=testCompileClasspath,testRuntimeClasspath
-org.checkerframework:dataflow:3.0.0=annotationProcessor,testAnnotationProcessor
-org.checkerframework:javacutil:3.0.0=annotationProcessor,testAnnotationProcessor
-org.codehaus.mojo:animal-sniffer-annotations:1.17=annotationProcessor,testAnnotationProcessor
-org.codehaus.mojo:animal-sniffer-annotations:1.23=testRuntimeClasspath
-org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,testCompileClasspath,testRuntimeClasspath
-org.hamcrest:hamcrest-core:1.3=testCompileClasspath,testRuntimeClasspath
-org.jacoco:org.jacoco.agent:0.8.7=jacocoAgent,jacocoAnt
-org.jacoco:org.jacoco.ant:0.8.7=jacocoAnt
-org.jacoco:org.jacoco.core:0.8.7=jacocoAnt
-org.jacoco:org.jacoco.report:0.8.7=jacocoAnt
-org.javassist:javassist:3.26.0-GA=checkstyle
-org.json:json:20160212=compileClasspath,testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-engine:5.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-engine:1.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit:junit-bom:5.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.mockito:mockito-core:4.11.0=testCompileClasspath,testRuntimeClasspath
-org.objenesis:objenesis:3.3=testRuntimeClasspath
-org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
-org.ow2.asm:asm-analysis:7.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-org.ow2.asm:asm-analysis:9.1=jacocoAnt
-org.ow2.asm:asm-commons:7.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-org.ow2.asm:asm-commons:9.1=jacocoAnt
-org.ow2.asm:asm-tree:7.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-org.ow2.asm:asm-tree:9.1=jacocoAnt
-org.ow2.asm:asm-util:7.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-org.ow2.asm:asm:7.0=compileClasspath
-org.ow2.asm:asm:9.1=jacocoAnt
-org.ow2.asm:asm:9.5=testCompileClasspath,testRuntimeClasspath
-org.pcollections:pcollections:2.1.2=annotationProcessor,testAnnotationProcessor
-org.plumelib:plume-util:1.0.6=annotationProcessor,testAnnotationProcessor
-org.plumelib:reflection-util:0.0.2=annotationProcessor,testAnnotationProcessor
-org.plumelib:require-javadoc:0.1.0=annotationProcessor,testAnnotationProcessor
-org.reflections:reflections:0.9.12=checkstyle
-org.threeten:threetenbp:1.6.8=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auto:auto-common:0.10=annotationProcessor
+com.google.cloud:google-cloud-core-grpc:2.21.0=buildScriptClasspath,compileClasspath
+com.google.cloud:google-cloud-core-http:2.21.0=buildScriptClasspath,compileClasspath
+com.google.cloud:google-cloud-core:2.21.0=buildScriptClasspath,compileClasspath
+com.google.cloud:google-cloud-storage:2.22.6=buildScriptClasspath,compileClasspath
+com.google.code.findbugs:jFormatString:3.0.0=annotationProcessor
+com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,buildScriptClasspath,compileClasspath
+com.google.code.gson:gson:2.10.1=buildScriptClasspath,compileClasspath
+com.google.common.html.types:types:1.0.6=buildScriptClasspath,compileClasspath
+com.google.errorprone:error_prone_annotation:2.3.4=annotationProcessor
+com.google.errorprone:error_prone_annotations:2.18.0=buildScriptClasspath,compileClasspath
+com.google.errorprone:error_prone_annotations:2.3.4=annotationProcessor
+com.google.errorprone:error_prone_check_api:2.3.4=annotationProcessor
+com.google.errorprone:error_prone_core:2.3.4=annotationProcessor
+com.google.errorprone:error_prone_type_annotations:2.3.4=annotationProcessor
+com.google.escapevelocity:escapevelocity:0.9.1=buildScriptClasspath,compileClasspath
+com.google.guava:failureaccess:1.0.1=annotationProcessor,buildScriptClasspath,compileClasspath
+com.google.guava:guava-parent:32.1.1-jre=buildScriptClasspath,compileClasspath
+com.google.guava:guava:27.0.1-jre=annotationProcessor
+com.google.guava:guava:32.1.1-jre=buildScriptClasspath,compileClasspath
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor
+com.google.http-client:google-http-client-apache-v2:1.43.3=buildScriptClasspath,compileClasspath
+com.google.http-client:google-http-client-appengine:1.43.3=buildScriptClasspath,compileClasspath
+com.google.http-client:google-http-client-gson:1.43.3=buildScriptClasspath,compileClasspath
+com.google.http-client:google-http-client-jackson2:1.43.3=buildScriptClasspath,compileClasspath
+com.google.http-client:google-http-client:1.43.3=buildScriptClasspath,compileClasspath
+com.google.inject.extensions:guice-multibindings:4.1.0=buildScriptClasspath,compileClasspath
+com.google.inject:guice:4.1.0=buildScriptClasspath,compileClasspath
+com.google.j2objc:j2objc-annotations:1.1=annotationProcessor
+com.google.j2objc:j2objc-annotations:2.8=buildScriptClasspath,compileClasspath
+com.google.jsinterop:jsinterop-annotations:1.0.1=buildScriptClasspath,compileClasspath
+com.google.oauth-client:google-oauth-client:1.34.1=buildScriptClasspath,compileClasspath
+com.google.protobuf:protobuf-java-util:3.23.2=buildScriptClasspath,compileClasspath
+com.google.protobuf:protobuf-java:3.23.2=buildScriptClasspath,compileClasspath
+com.google.protobuf:protobuf-java:3.4.0=annotationProcessor
+com.google.re2j:re2j:1.6=buildScriptClasspath
+com.google.template:soy:2021-02-01=buildScriptClasspath,compileClasspath
+com.googlecode.java-diff-utils:diffutils:1.3.0=annotationProcessor
+com.ibm.icu:icu4j:57.1=buildScriptClasspath,compileClasspath
+commons-codec:commons-codec:1.15=buildScriptClasspath,compileClasspath
+commons-logging:commons-logging:1.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-alts:1.55.3=buildScriptClasspath,compileClasspath
+io.grpc:grpc-api:1.55.3=buildScriptClasspath,compileClasspath
+io.grpc:grpc-auth:1.55.3=buildScriptClasspath,compileClasspath
+io.grpc:grpc-context:1.55.3=buildScriptClasspath,compileClasspath
+io.grpc:grpc-core:1.55.3=buildScriptClasspath
+io.grpc:grpc-googleapis:1.55.3=buildScriptClasspath
+io.grpc:grpc-grpclb:1.55.3=buildScriptClasspath,compileClasspath
+io.grpc:grpc-netty-shaded:1.55.3=buildScriptClasspath
+io.grpc:grpc-protobuf-lite:1.55.3=buildScriptClasspath,compileClasspath
+io.grpc:grpc-protobuf:1.55.3=buildScriptClasspath,compileClasspath
+io.grpc:grpc-rls:1.55.3=buildScriptClasspath
+io.grpc:grpc-services:1.55.3=buildScriptClasspath
+io.grpc:grpc-stub:1.55.3=buildScriptClasspath,compileClasspath
+io.grpc:grpc-xds:1.55.3=buildScriptClasspath
+io.opencensus:opencensus-api:0.31.1=buildScriptClasspath,compileClasspath
+io.opencensus:opencensus-contrib-http-util:0.31.1=buildScriptClasspath,compileClasspath
+io.opencensus:opencensus-proto:0.2.0=buildScriptClasspath
+io.perfmark:perfmark-api:0.26.0=buildScriptClasspath
+javax.annotation:javax.annotation-api:1.3.2=buildScriptClasspath,compileClasspath
+javax.annotation:jsr250-api:1.0=buildScriptClasspath,compileClasspath
+javax.inject:javax.inject:1=buildScriptClasspath,compileClasspath
+org.apache.commons:commons-lang3:3.12.0=buildScriptClasspath,compileClasspath
+org.apache.commons:commons-text:1.10.0=buildScriptClasspath,compileClasspath
+org.apache.httpcomponents:httpclient:4.5.14=buildScriptClasspath,compileClasspath
+org.apache.httpcomponents:httpcore:4.4.16=buildScriptClasspath,compileClasspath
+org.checkerframework:checker-qual:3.0.0=annotationProcessor
+org.checkerframework:checker-qual:3.33.0=buildScriptClasspath,compileClasspath
+org.checkerframework:dataflow:3.0.0=annotationProcessor
+org.checkerframework:javacutil:3.0.0=annotationProcessor
+org.codehaus.mojo:animal-sniffer-annotations:1.17=annotationProcessor
+org.codehaus.mojo:animal-sniffer-annotations:1.23=buildScriptClasspath
+org.conscrypt:conscrypt-openjdk-uber:2.5.2=buildScriptClasspath,compileClasspath
+org.json:json:20160212=buildScriptClasspath,compileClasspath
+org.ow2.asm:asm-analysis:7.0=buildScriptClasspath,compileClasspath
+org.ow2.asm:asm-commons:7.0=buildScriptClasspath,compileClasspath
+org.ow2.asm:asm-tree:7.0=buildScriptClasspath,compileClasspath
+org.ow2.asm:asm-util:7.0=buildScriptClasspath,compileClasspath
+org.ow2.asm:asm:7.0=buildScriptClasspath,compileClasspath
+org.pcollections:pcollections:2.1.2=annotationProcessor
+org.plumelib:plume-util:1.0.6=annotationProcessor
+org.plumelib:reflection-util:0.0.2=annotationProcessor
+org.plumelib:require-javadoc:0.1.0=annotationProcessor
+org.threeten:threetenbp:1.6.8=buildScriptClasspath,compileClasspath
 empty=
--- a/buildSrc/src/main/java/google/registry/gradle/plugin/ReportUploader.java
+++ b/buildSrc/src/main/java/google/registry/gradle/plugin/ReportUploader.java
@@ -143,7 +143,7 @@ public class ReportUploader extends DefaultTask {
          .getAsMap()
          .forEach(
              (type, report) -> {
-                File destination = report.getDestination();
+                File destination = report.getOutputLocation().get().getAsFile();
                // The destination could be a file, or a directory. If it's a directory - the Report
                // could have created multiple files - and we need to know to which one of those to
                // link.
--- a/buildscript-gradle.lockfile
+++ b/buildscript-gradle.lockfile
@@ -4,10 +4,11 @@
 com.diffplug.durian:durian-collect:1.2.0=classpath
 com.diffplug.durian:durian-core:1.2.0=classpath
 com.diffplug.durian:durian-io:1.2.0=classpath
-com.diffplug.gradle.spotless:com.diffplug.gradle.spotless.gradle.plugin:3.25.0=classpath
-com.diffplug.spotless:spotless-lib-extra:1.25.0=classpath
-com.diffplug.spotless:spotless-lib:1.25.0=classpath
-com.diffplug.spotless:spotless-plugin-gradle:3.25.0=classpath
+com.diffplug.durian:durian-swt.os:4.2.0=classpath
+com.diffplug.spotless:com.diffplug.spotless.gradle.plugin:6.20.0=classpath
+com.diffplug.spotless:spotless-lib-extra:2.40.0=classpath
+com.diffplug.spotless:spotless-lib:2.40.0=classpath
+com.diffplug.spotless:spotless-plugin-gradle:6.20.0=classpath
 com.dorongold.plugins:task-tree:2.1.0=classpath
 com.dorongold.task-tree:com.dorongold.task-tree.gradle.plugin:2.1.0=classpath
 com.github.jengelman.gradle.plugins:shadow:5.1.0=classpath
@@ -24,56 +25,39 @@ com.google.guava:guava:28.2-jre=classpath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=classpath
 com.google.j2objc:j2objc-annotations:1.3=classpath
 com.googlecode.concurrent-trees:concurrent-trees:2.6.1=classpath
-com.googlecode.javaewah:JavaEWAH:1.1.6=classpath
-com.jcraft:jsch:0.1.55=classpath
-com.jcraft:jzlib:1.1.1=classpath
-com.netflix.nebula:gradle-lint-plugin:16.0.2=classpath
-com.netflix.nebula:nebula-gradle-interop:1.0.11=classpath
+com.googlecode.javaewah:JavaEWAH:1.2.3=classpath
+com.squareup.okhttp3:okhttp:4.10.0=classpath
+com.squareup.okio:okio-jvm:3.0.0=classpath
+com.squareup.okio:okio:3.0.0=classpath
 commons-io:commons-io:2.6=classpath
-commons-lang:commons-lang:2.6=classpath
-javax.inject:javax.inject:1=classpath
-junit:junit:4.12=classpath
-nebula.lint:nebula.lint.gradle.plugin:16.0.2=classpath
+dev.equo.ide:solstice:1.3.1=classpath
 net.ltgt.errorprone:net.ltgt.errorprone.gradle.plugin:2.0.2=classpath
 net.ltgt.gradle:gradle-errorprone-plugin:2.0.2=classpath
 org.apache.ant:ant-launcher:1.9.7=classpath
 org.apache.ant:ant:1.9.7=classpath
 org.apache.commons:commons-compress:1.20=classpath
-org.apache.commons:commons-lang3:3.8.1=classpath
-org.apache.maven:maven-artifact:3.6.2=classpath
-org.apache.maven:maven-builder-support:3.6.2=classpath
-org.apache.maven:maven-model-builder:3.6.2=classpath
-org.apache.maven:maven-model:3.6.2=classpath
-org.bouncycastle:bcpg-jdk15on:1.61=classpath
-org.bouncycastle:bcpkix-jdk15on:1.61=classpath
-org.bouncycastle:bcprov-jdk15on:1.61=classpath
+org.apache.commons:commons-lang3:3.5=classpath
 org.checkerframework:checker-qual:2.10.0=classpath
-org.codehaus.gpars:gpars:1.2.1=classpath
-org.codehaus.groovy:groovy-xml:2.4.7=classpath
-org.codehaus.groovy:groovy:2.4.7=classpath
-org.codehaus.jsr166-mirror:jsr166y:1.7.0=classpath
-org.codehaus.plexus:plexus-interpolation:1.25=classpath
-org.codehaus.plexus:plexus-utils:3.2.1=classpath
-org.eclipse.jgit:org.eclipse.jgit:5.5.0.201909110433-r=classpath
-org.eclipse.sisu:org.eclipse.sisu.inject:0.3.3=classpath
+org.codehaus.plexus:plexus-utils:3.0.24=classpath
+org.eclipse.jgit:org.eclipse.jgit:6.6.0.202305301015-r=classpath
+org.eclipse.platform:org.eclipse.osgi:3.18.300=classpath
 org.glassfish:javax.json:1.0.4=classpath
-org.hamcrest:hamcrest-core:1.3=classpath
 org.jdom:jdom2:2.0.6=classpath
-org.jetbrains.kotlin:kotlin-stdlib-common:1.3.50=classpath
-org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.3.50=classpath
-org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.3.50=classpath
-org.jetbrains.kotlin:kotlin-stdlib:1.3.50=classpath
+org.jetbrains.kotlin:kotlin-stdlib-common:1.6.20=classpath
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.5.31=classpath
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.5.31=classpath
+org.jetbrains.kotlin:kotlin-stdlib:1.6.20=classpath
 org.jetbrains:annotations:13.0=classpath
-org.multiverse:multiverse-core:0.7.0=classpath
-org.ow2.asm:asm-analysis:7.1=classpath
-org.ow2.asm:asm-commons:7.1=classpath
-org.ow2.asm:asm-tree:7.1=classpath
-org.ow2.asm:asm:7.1=classpath
-org.slf4j:slf4j-api:1.7.2=classpath
+org.ow2.asm:asm-analysis:7.0-beta=classpath
+org.ow2.asm:asm-commons:7.0-beta=classpath
+org.ow2.asm:asm-tree:7.0-beta=classpath
+org.ow2.asm:asm:7.0-beta=classpath
+org.slf4j:slf4j-api:1.7.36=classpath
 org.sonatype.aether:aether-api:1.13.1=classpath
 org.sonatype.aether:aether-impl:1.13.1=classpath
 org.sonatype.aether:aether-spi:1.13.1=classpath
 org.sonatype.aether:aether-util:1.13.1=classpath
+org.tukaani:xz:1.9=classpath
 org.vafer:jdependency:2.1.1=classpath
 org.yaml:snakeyaml:1.21=classpath
 empty=
--- a/common/gradle.lockfile
+++ b/common/gradle.lockfile
@@ -1,70 +1,69 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-antlr:antlr:2.7.7=checkstyle
 com.github.ben-manes.caffeine:caffeine:2.7.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.github.ben-manes.caffeine:caffeine:2.9.3=compileClasspath,default,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.github.ben-manes.caffeine:caffeine:2.9.3=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.google.auto.value:auto-value-annotations:1.8.1=compileClasspath,default,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.auto.value:auto-value-annotations:1.10.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.google.auto:auto-common:0.10=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.code.findbugs:jFormatString:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,default,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
+com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
 com.google.errorprone:error_prone_annotation:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.18.0=compileClasspath,default,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-com.google.errorprone:error_prone_annotations:2.3.4=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.google.errorprone:error_prone_annotations:2.19.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.errorprone:error_prone_annotations:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.google.errorprone:error_prone_annotations:2.7.1=checkstyle
 com.google.errorprone:error_prone_check_api:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.errorprone:error_prone_core:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.errorprone:error_prone_type_annotations:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.google.flogger:flogger:0.7.4=compileClasspath,default,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-com.google.guava:failureaccess:1.0.1=annotationProcessor,checkstyle,compileClasspath,default,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
-com.google.guava:guava-parent:32.1.1-jre=compileClasspath,default,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.flogger:flogger:0.7.4=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.guava:failureaccess:1.0.1=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
+com.google.guava:guava-parent:32.1.2-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.google.guava:guava:27.0.1-jre=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.google.guava:guava:29.0-jre=checkstyle
-com.google.guava:guava:32.1.1-jre=compileClasspath,default,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.google.guava:guava:31.0.1-jre=checkstyle
+com.google.guava:guava:32.1.2-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
 com.google.j2objc:j2objc-annotations:1.1=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.j2objc:j2objc-annotations:1.3=checkstyle
 com.google.j2objc:j2objc-annotations:2.8=compileClasspath,testCompileClasspath,testingCompileClasspath
 com.google.protobuf:protobuf-java:3.4.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.google.truth:truth:1.1.3=compileClasspath,default,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.truth:truth:1.1.5=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.googlecode.java-diff-utils:diffutils:1.3.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.puppycrawl.tools:checkstyle:8.37=checkstyle
+com.puppycrawl.tools:checkstyle:9.3=checkstyle
 commons-beanutils:commons-beanutils:1.9.4=checkstyle
 commons-collections:commons-collections:3.2.2=checkstyle
-info.picocli:picocli:4.5.2=checkstyle
-io.github.java-diff-utils:java-diff-utils:4.12=compileClasspath,default,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-javax.inject:javax.inject:1=compileClasspath,default,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-joda-time:joda-time:2.12.5=compileClasspath,default,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-junit:junit:4.13.2=default,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-net.sf.saxon:Saxon-HE:10.3=checkstyle
-org.antlr:antlr4-runtime:4.8-1=checkstyle
+info.picocli:picocli:4.6.2=checkstyle
+io.github.java-diff-utils:java-diff-utils:4.12=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+javax.inject:javax.inject:1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+joda-time:joda-time:2.12.5=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+junit:junit:4.13.2=testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+net.sf.saxon:Saxon-HE:10.6=checkstyle
+org.antlr:antlr4-runtime:4.9.3=checkstyle
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
-org.checkerframework:checker-compat-qual:2.5.3=compileClasspath,default,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-org.checkerframework:checker-qual:2.11.1=checkstyle
+org.checkerframework:checker-compat-qual:2.5.3=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 org.checkerframework:checker-qual:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-org.checkerframework:checker-qual:3.33.0=compileClasspath,default,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+org.checkerframework:checker-qual:3.12.0=checkstyle
+org.checkerframework:checker-qual:3.35.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 org.checkerframework:dataflow:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 org.checkerframework:javacutil:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 org.codehaus.mojo:animal-sniffer-annotations:1.17=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-org.hamcrest:hamcrest-core:1.3=default,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-org.jacoco:org.jacoco.agent:0.8.7=jacocoAgent,jacocoAnt
-org.jacoco:org.jacoco.ant:0.8.7=jacocoAnt
-org.jacoco:org.jacoco.core:0.8.7=jacocoAnt
-org.jacoco:org.jacoco.report:0.8.7=jacocoAnt
-org.javassist:javassist:3.26.0-GA=checkstyle
-org.junit.jupiter:junit-jupiter-api:5.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-engine:5.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-engine:1.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit:junit-bom:5.10.0-RC1=testCompileClasspath,testRuntimeClasspath
+org.hamcrest:hamcrest-core:1.3=testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+org.jacoco:org.jacoco.agent:0.8.9=jacocoAgent,jacocoAnt
+org.jacoco:org.jacoco.ant:0.8.9=jacocoAnt
+org.jacoco:org.jacoco.core:0.8.9=jacocoAnt
+org.jacoco:org.jacoco.report:0.8.9=jacocoAnt
+org.javassist:javassist:3.28.0-GA=checkstyle
+org.junit.jupiter:junit-jupiter-api:5.10.0=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-engine:5.10.0=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.10.0=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-engine:1.10.0=testCompileClasspath,testRuntimeClasspath
+org.junit:junit-bom:5.10.0=testCompileClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
-org.ow2.asm:asm-analysis:9.1=jacocoAnt
-org.ow2.asm:asm-commons:9.1=jacocoAnt
-org.ow2.asm:asm-tree:9.1=jacocoAnt
-org.ow2.asm:asm:9.1=compileClasspath,default,deploy_jar,jacocoAnt,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+org.ow2.asm:asm-commons:9.5=jacocoAnt
+org.ow2.asm:asm-tree:9.5=jacocoAnt
+org.ow2.asm:asm:9.5=compileClasspath,deploy_jar,jacocoAnt,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 org.pcollections:pcollections:2.1.2=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 org.plumelib:plume-util:1.0.6=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 org.plumelib:reflection-util:0.0.2=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 org.plumelib:require-javadoc:0.1.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-org.reflections:reflections:0.9.12=checkstyle
-empty=archives,errorproneJavac,testingCompile,testingRuntime,testingRuntimeClasspath
+org.reflections:reflections:0.10.2=checkstyle
+empty=errorproneJavac,testingCompile,testingRuntime,testingRuntimeClasspath
--- a/config/presubmits.py
+++ b/config/presubmits.py
@@ -109,13 +109,6 @@ PRESUBMITS = {
        "System.(out|err).println is only allowed in tools/ packages. Please "
        "use a logger instead.",

-    # PostgreSQLContainer instantiation must specify docker tag
-    # TODO(b/204572437): Fix the pattern to pass DatabaseSnapshotTest.java
-    PresubmitCheck(
-        r"[\s\S]*new\s+PostgreSQLContainer(<[\s\S]*>)?\(\s*\)[\s\S]*",
-        "java", {"DatabaseSnapshotTest.java"}):
-      "PostgreSQLContainer instantiation must specify docker tag.",
-
    # Various Soy linting checks
    PresubmitCheck(
        r".* (/\*)?\* {?@param ",
--- a/console-webapp/dev-proxy.config.json
+++ b/console-webapp/dev-proxy.config.json
@@ -2,6 +2,8 @@
  "/console-api":
  {
    "target": "http://localhost:8080",
-    "secure": true
+    "secure": false,
+    "logLevel": "debug",
+    "changeOrigin": true
  }
 }
--- a/console-webapp/gradle.lockfile
+++ b/console-webapp/gradle.lockfile
@@ -1,48 +1,47 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-antlr:antlr:2.7.7=checkstyle
 com.github.ben-manes.caffeine:caffeine:2.7.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.auto:auto-common:0.10=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.code.findbugs:jFormatString:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_annotation:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.3.4=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor
+com.google.errorprone:error_prone_annotations:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.errorprone:error_prone_annotations:2.7.1=checkstyle
 com.google.errorprone:error_prone_check_api:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_type_annotations:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.guava:failureaccess:1.0.1=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor
 com.google.guava:guava:27.0.1-jre=annotationProcessor,errorprone,testAnnotationProcessor
-com.google.guava:guava:29.0-jre=checkstyle
+com.google.guava:guava:31.0.1-jre=checkstyle
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor
 com.google.j2objc:j2objc-annotations:1.1=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.j2objc:j2objc-annotations:1.3=checkstyle
 com.google.protobuf:protobuf-java:3.4.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.googlecode.java-diff-utils:diffutils:1.3.0=annotationProcessor,errorprone,testAnnotationProcessor
-com.puppycrawl.tools:checkstyle:8.37=checkstyle
+com.puppycrawl.tools:checkstyle:9.3=checkstyle
 commons-beanutils:commons-beanutils:1.9.4=checkstyle
 commons-collections:commons-collections:3.2.2=checkstyle
-info.picocli:picocli:4.5.2=checkstyle
-net.sf.saxon:Saxon-HE:10.3=checkstyle
-org.antlr:antlr4-runtime:4.8-1=checkstyle
-org.checkerframework:checker-qual:2.11.1=checkstyle
+info.picocli:picocli:4.6.2=checkstyle
+net.sf.saxon:Saxon-HE:10.6=checkstyle
+org.antlr:antlr4-runtime:4.9.3=checkstyle
 org.checkerframework:checker-qual:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
+org.checkerframework:checker-qual:3.12.0=checkstyle
 org.checkerframework:dataflow:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
 org.checkerframework:javacutil:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
 org.codehaus.mojo:animal-sniffer-annotations:1.17=annotationProcessor,errorprone,testAnnotationProcessor
-org.jacoco:org.jacoco.agent:0.8.7=jacocoAgent,jacocoAnt
-org.jacoco:org.jacoco.ant:0.8.7=jacocoAnt
-org.jacoco:org.jacoco.core:0.8.7=jacocoAnt
-org.jacoco:org.jacoco.report:0.8.7=jacocoAnt
-org.javassist:javassist:3.26.0-GA=checkstyle
-org.ow2.asm:asm-analysis:9.1=jacocoAnt
-org.ow2.asm:asm-commons:9.1=jacocoAnt
-org.ow2.asm:asm-tree:9.1=jacocoAnt
-org.ow2.asm:asm:9.1=jacocoAnt
+org.jacoco:org.jacoco.agent:0.8.9=jacocoAgent,jacocoAnt
+org.jacoco:org.jacoco.ant:0.8.9=jacocoAnt
+org.jacoco:org.jacoco.core:0.8.9=jacocoAnt
+org.jacoco:org.jacoco.report:0.8.9=jacocoAnt
+org.javassist:javassist:3.28.0-GA=checkstyle
+org.ow2.asm:asm-commons:9.5=jacocoAnt
+org.ow2.asm:asm-tree:9.5=jacocoAnt
+org.ow2.asm:asm:9.5=jacocoAnt
 org.pcollections:pcollections:2.1.2=annotationProcessor,errorprone,testAnnotationProcessor
 org.plumelib:plume-util:1.0.6=annotationProcessor,errorprone,testAnnotationProcessor
 org.plumelib:reflection-util:0.0.2=annotationProcessor,errorprone,testAnnotationProcessor
 org.plumelib:require-javadoc:0.1.0=annotationProcessor,errorprone,testAnnotationProcessor
-org.reflections:reflections:0.9.12=checkstyle
-empty=archives,compileClasspath,default,deploy_jar,errorproneJavac,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.reflections:reflections:0.10.2=checkstyle
+empty=compileClasspath,deploy_jar,errorproneJavac,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
--- a/console-webapp/package.json
+++ b/console-webapp/package.json
@@ -3,7 +3,7 @@
  "version": "0.0.0",
  "scripts": {
    "ng": "ng",
-    "start": "ng serve",
+    "start": "ng serve --proxy-config dev-proxy.config.json",
    "build": "ng build --base-href=/console/",
    "build:local": "ng build --base-href=/default/console/",
    "watch": "ng build --watch --configuration development",
--- a/console-webapp/src/app/app.component.html
+++ b/console-webapp/src/app/app.component.html
@@ -1,6 +1,6 @@
 <div class="console-app">
  <app-header (toggleNavOpen)="sidenav.toggle()"></app-header>
-  <mat-sidenav-container class="console-app__content-wrapper">
+  <mat-sidenav-container class="console-app__container">
    <mat-sidenav #sidenav class="console-app__sidebar">
      <mat-nav-list>
        <a mat-list-item [routerLink]="'/home'" routerLinkActive="active">
@@ -17,8 +17,10 @@
        </a>
      </mat-nav-list>
    </mat-sidenav>
-    <mat-sidenav-content class="console-app__content">
-      <router-outlet></router-outlet>
+    <mat-sidenav-content class="console-app__content-wrapper">
+      <div class="console-app__content">
+        <router-outlet></router-outlet>
+      </div>
    </mat-sidenav-content>
  </mat-sidenav-container>
 </div>
--- a/console-webapp/src/app/app.component.less
+++ b/console-webapp/src/app/app.component.less
@@ -26,7 +26,7 @@
  display: flex;
  flex-direction: column;
  height: 100%;
-  &__content-wrapper {
+  &__container {
    flex: 1;
    margin-top: -12px;
    padding-bottom: 36px;
@@ -40,7 +40,11 @@
      background: #eae1e1;
    }
  }
-  &__content {
+  &__content-wrapper {
    margin: 12px 24px;
  }
+  &__content {
+    max-width: 1340px;
+    margin: 0 auto;
+  }
 }
--- a/console-webapp/src/app/app.component.spec.ts
+++ b/console-webapp/src/app/app.component.spec.ts
@@ -15,11 +15,13 @@
 import { TestBed } from '@angular/core/testing';
 import { RouterTestingModule } from '@angular/router/testing';
 import { AppComponent } from './app.component';
+import { BrowserAnimationsModule } from '@angular/platform-browser/animations';
+import { MaterialModule } from './material.module';

 describe('AppComponent', () => {
  beforeEach(async () => {
    await TestBed.configureTestingModule({
-      imports: [RouterTestingModule],
+      imports: [RouterTestingModule, MaterialModule, BrowserAnimationsModule],
      declarations: [AppComponent],
    }).compileComponents();
  });
--- a/console-webapp/src/app/app.module.ts
+++ b/console-webapp/src/app/app.module.ts
@@ -33,6 +33,7 @@ import SettingsContactComponent, {
 import { HttpClientModule } from '@angular/common/http';
 import { RegistrarComponent } from './registrar/registrar.component';
 import { RegistrarGuard } from './registrar/registrar.guard';
+import SecurityComponent from './settings/security/security.component';

@NgModule({
  declarations: [
@@ -44,6 +45,7 @@ import { RegistrarGuard } from './registrar/registrar.guard';
    SettingsContactComponent,
    ContactDetailsDialogComponent,
    RegistrarComponent,
+    SecurityComponent,
  ],
  imports: [
    HttpClientModule,
--- a/console-webapp/src/app/header/header.component.spec.ts
+++ b/console-webapp/src/app/header/header.component.spec.ts
@@ -15,6 +15,8 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';

 import { HeaderComponent } from './header.component';
+import { BrowserAnimationsModule } from '@angular/platform-browser/animations';
+import { MaterialModule } from '../material.module';

 describe('HeaderComponent', () => {
  let component: HeaderComponent;
@@ -22,6 +24,7 @@ describe('HeaderComponent', () => {

  beforeEach(async () => {
    await TestBed.configureTestingModule({
+      imports: [MaterialModule, BrowserAnimationsModule],
      declarations: [HeaderComponent],
    }).compileComponents();

--- a/console-webapp/src/app/registrar/registrar.component.spec.ts
+++ b/console-webapp/src/app/registrar/registrar.component.spec.ts
@@ -18,6 +18,8 @@ import { RegistrarComponent } from './registrar.component';
 import { BackendService } from '../shared/services/backend.service';
 import { ActivatedRoute } from '@angular/router';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
+import { BrowserAnimationsModule } from '@angular/platform-browser/animations';
+import { MaterialModule } from '../material.module';

 describe('RegistrarComponent', () => {
  let component: RegistrarComponent;
@@ -26,7 +28,11 @@ describe('RegistrarComponent', () => {
  beforeEach(async () => {
    await TestBed.configureTestingModule({
      declarations: [RegistrarComponent],
-      imports: [HttpClientTestingModule],
+      imports: [
+        HttpClientTestingModule,
+        MaterialModule,
+        BrowserAnimationsModule,
+      ],
      providers: [
        BackendService,
        { provide: ActivatedRoute, useValue: {} as ActivatedRoute },
--- a/console-webapp/src/app/settings/contact/contact-details.component.html
+++ b/console-webapp/src/app/settings/contact/contact-details.component.html
@@ -97,7 +97,7 @@
      >
    </section>
    <mat-dialog-actions>
-      <button mat-button (click)="onClose()">Cancel</button>
+      <button mat-button (click)="onClose($event)">Cancel</button>
      <button type="submit" mat-button>Save</button>
    </mat-dialog-actions>
  </form>
--- a/console-webapp/src/app/settings/contact/contact.component.ts
+++ b/console-webapp/src/app/settings/contact/contact.component.ts
@@ -80,11 +80,11 @@ class ContactDetailsEventsResponder {
  styleUrls: ['./contact.component.less'],
 })
 export class ContactDetailsDialogComponent {
-  onClose!: Function;
  contact: Contact;
  contactTypes = contactTypes;
  operation: Operations;
  contactIndex: number;
+  onCloseCallback: Function;

  constructor(
    public contactService: ContactService,
@@ -96,7 +96,7 @@ export class ContactDetailsDialogComponent {
      operation: Operations;
    }
  ) {
-    this.onClose = data.onClose;
+    this.onCloseCallback = data.onClose;
    this.contactIndex = contactService.contacts.findIndex(
      (c) => c === data.contact
    );
@@ -104,9 +104,14 @@ export class ContactDetailsDialogComponent {
    this.operation = data.operation;
  }

-  saveAndClose(e: any) {
+  onClose(e: MouseEvent) {
    e.preventDefault();
-    if (!e.target.checkValidity()) {
+    this.onCloseCallback.call(this);
+  }
+
+  saveAndClose(e: SubmitEvent) {
+    e.preventDefault();
+    if (!(e.target as HTMLFormElement).checkValidity()) {
      return;
    }
    let operationObservable;
@@ -122,7 +127,7 @@ export class ContactDetailsDialogComponent {
    }

    operationObservable.subscribe({
-      complete: this.onClose.bind(this),
+      complete: this.onCloseCallback.bind(this),
      error: (err: HttpErrorResponse) => {
        this._snackBar.open(err.statusText, undefined, {
          duration: 1500,
@@ -169,7 +174,7 @@ export default class ContactComponent {
    }
  }

-  openCreateNew(e: Event) {
+  openCreateNew(e: MouseEvent) {
    const newContact: Contact = {
      name: '',
      phoneNumber: '',
@@ -180,7 +185,7 @@ export default class ContactComponent {
  }

  openDetails(
-    e: Event,
+    e: MouseEvent,
    contact: Contact,
    operation: Operations = Operations.UPDATE
  ) {
--- a/console-webapp/src/app/settings/security/security.component.html
+++ b/console-webapp/src/app/settings/security/security.component.html
@@ -1 +1,96 @@
-<p>security works!</p>
+<div *ngIf="loading" class="settings-security__loading">
+  <mat-progress-bar mode="indeterminate"></mat-progress-bar>
+</div>
+<div class="settings-security" *ngIf="!loading">
+  <div class="settings-security__section">
+    <div class="settings-security__section-description">
+      <h2>IP Allowlist</h2>
+      <p>
+        Restrict access to EPP production servers to the following IP/IPv6
+        addresses, or ranges like 1.1.1.0/24
+      </p>
+    </div>
+    <div class="settings-security__section-form">
+      <div
+        *ngIf="
+          dataSource.ipAddressAllowList &&
+          dataSource.ipAddressAllowList.length > 0
+        "
+      >
+        <div *ngFor="let item of dataSource.ipAddressAllowList; index as index">
+          <div>{{ item.value }}</div>
+          <mat-form-field>
+            <input
+              matInput
+              type="text"
+              class="settings-security__ip-allowlist"
+              [(ngModel)]="item.value"
+              [disabled]="!inEdit"
+            />
+            <button
+              *ngIf="inEdit"
+              matSuffix
+              mat-icon-button
+              aria-label="Remove"
+              (click)="removeIpEntry(index)"
+            >
+              <mat-icon>close</mat-icon>
+            </button>
+          </mat-form-field>
+        </div>
+      </div>
+      <button mat-stroked-button (click)="enableEdit(); createIpEntry()">
+        Add IP
+      </button>
+    </div>
+  </div>
+  <div class="settings-security__section">
+    <div class="settings-security__section-description">
+      <h2>SSL Certificate</h2>
+      <p>X.509 PEM certificate for EPP production access.</p>
+    </div>
+    <div class="settings-security__section-form">
+      <textarea
+        matInput
+        class="settings-security__clientCertificate"
+        [(ngModel)]="dataSource.clientCertificate"
+        [disabled]="!inEdit"
+      ></textarea>
+    </div>
+  </div>
+  <div class="settings-security__section">
+    <div class="settings-security__section-description">
+      <h2>Failover SSL Certificate</h2>
+      <p>X.509 PEM backup certificate for EPP Production Access.</p>
+    </div>
+    <div class="settings-security__section-form">
+      <textarea
+        matInput
+        [(ngModel)]="dataSource.failoverClientCertificate"
+        [disabled]="!inEdit"
+      ></textarea>
+    </div>
+  </div>
+  <div class="settings-security__actions">
+    <ng-template [ngIf]="inEdit" [ngIfElse]="inView">
+      <button
+        class="settings-security__actions-save"
+        mat-raised-button
+        color="primary"
+        (click)="save()"
+      >
+        Save
+      </button>
+      <button
+        class="settings-security__actions-cancel"
+        mat-stroked-button
+        (click)="cancel()"
+      >
+        Cancel
+      </button>
+    </ng-template>
+    <ng-template #inView>
+      <button #elseBlock mat-raised-button (click)="enableEdit()">Edit</button>
+    </ng-template>
+  </div>
+</div>
--- a/console-webapp/src/app/settings/security/security.component.less
+++ b/console-webapp/src/app/settings/security/security.component.less
@@ -11,3 +11,40 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
+
+.settings-security {
+  margin-top: 1.5rem;
+  h1 {
+    margin: 0;
+  }
+  &__section {
+    display: flex;
+    align-items: stretch;
+    margin-bottom: 3rem;
+    flex-wrap: wrap;
+  }
+  &__section-description {
+    flex: 1;
+    min-width: 300px;
+  }
+  &__section-form {
+    flex: 1;
+    min-width: 300px;
+    textarea {
+      min-height: 100%;
+      min-width: 100%;
+      box-sizing: border-box;
+      min-height: 100px;
+    }
+  }
+  &__actions {
+    display: flex;
+    justify-content: flex-end;
+    button {
+      margin-left: 20px;
+    }
+  }
+  &__loading {
+    margin: 2rem 0;
+  }
+}
--- a/console-webapp/src/app/settings/security/security.component.spec.ts
+++ b/console-webapp/src/app/settings/security/security.component.spec.ts
@@ -12,18 +12,56 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { ComponentFixture, TestBed, waitForAsync } from '@angular/core/testing';

 import SecurityComponent from './security.component';
+import { SecurityService } from './security.service';
+import { BackendService } from 'src/app/shared/services/backend.service';
+import { HttpClientTestingModule } from '@angular/common/http/testing';
+import { MaterialModule } from 'src/app/material.module';
+import { BrowserAnimationsModule } from '@angular/platform-browser/animations';
+import { of } from 'rxjs';
+import { FormsModule } from '@angular/forms';

 describe('SecurityComponent', () => {
  let component: SecurityComponent;
  let fixture: ComponentFixture<SecurityComponent>;
+  let fetchSecurityDetailsSpy: Function;
+  let saveSpy: Function;

  beforeEach(async () => {
+    const securityServiceSpy = jasmine.createSpyObj(SecurityService, [
+      'fetchSecurityDetails',
+      'saveChanges',
+    ]);
+
+    fetchSecurityDetailsSpy =
+      securityServiceSpy.fetchSecurityDetails.and.returnValue(of());
+
+    saveSpy = securityServiceSpy.saveChanges;
+
+    securityServiceSpy.securitySettings = {
+      ipAddressAllowList: [{ value: '123.123.123.123' }],
+    };
+
    await TestBed.configureTestingModule({
+      imports: [
+        HttpClientTestingModule,
+        MaterialModule,
+        BrowserAnimationsModule,
+        FormsModule,
+      ],
      declarations: [SecurityComponent],
-    }).compileComponents();
+      providers: [BackendService],
+    })
+      .overrideComponent(SecurityComponent, {
+        set: {
+          providers: [
+            { provide: SecurityService, useValue: securityServiceSpy },
+          ],
+        },
+      })
+      .compileComponents();

    fixture = TestBed.createComponent(SecurityComponent);
    component = fixture.componentInstance;
@@ -33,4 +71,86 @@ describe('SecurityComponent', () => {
  it('should create', () => {
    expect(component).toBeTruthy();
  });
+
+  it('should call fetch spy', () => {
+    expect(fetchSecurityDetailsSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('should render ip allow list', waitForAsync(() => {
+    component.enableEdit();
+    fixture.whenStable().then(() => {
+      expect(
+        Array.from(
+          fixture.nativeElement.querySelectorAll(
+            '.settings-security__ip-allowlist'
+          )
+        )
+      ).toHaveSize(1);
+      expect(
+        fixture.nativeElement.querySelector('.settings-security__ip-allowlist')
+          .value
+      ).toBe('123.123.123.123');
+    });
+  }));
+
+  it('should remove ip', waitForAsync(() => {
+    expect(
+      Array.from(
+        fixture.nativeElement.querySelectorAll(
+          '.settings-security__ip-allowlist'
+        )
+      )
+    ).toHaveSize(1);
+    component.removeIpEntry(0);
+    fixture.whenStable().then(() => {
+      fixture.detectChanges();
+      expect(
+        Array.from(
+          fixture.nativeElement.querySelectorAll(
+            '.settings-security__ip-allowlist'
+          )
+        )
+      ).toHaveSize(0);
+    });
+  }));
+
+  it('should toggle inEdit', () => {
+    expect(component.inEdit).toBeFalse();
+    component.enableEdit();
+    expect(component.inEdit).toBeTrue();
+  });
+
+  it('should create temporary data structure', () => {
+    expect(component.dataSource).toBe(
+      component.securityService.securitySettings
+    );
+    component.enableEdit();
+    expect(component.dataSource).not.toBe(
+      component.securityService.securitySettings
+    );
+    component.cancel();
+    expect(component.dataSource).toBe(
+      component.securityService.securitySettings
+    );
+  });
+
+  it('should call save', waitForAsync(async () => {
+    component.enableEdit();
+    fixture.detectChanges();
+    await fixture.whenStable();
+    const el = fixture.nativeElement.querySelector(
+      '.settings-security__clientCertificate'
+    );
+    el.value = 'test';
+    el.dispatchEvent(new Event('input'));
+    fixture.detectChanges();
+    await fixture.whenStable();
+    fixture.nativeElement
+      .querySelector('.settings-security__actions-save')
+      .click();
+    expect(saveSpy).toHaveBeenCalledOnceWith({
+      ipAddressAllowList: [{ value: '123.123.123.123' }],
+      clientCertificate: 'test',
+    });
+  }));
 });
--- a/console-webapp/src/app/settings/security/security.component.ts
+++ b/console-webapp/src/app/settings/security/security.component.ts
@@ -13,10 +13,79 @@
 // limitations under the License.

 import { Component } from '@angular/core';
+import { SecurityService, SecuritySettings } from './security.service';
+import { HttpErrorResponse } from '@angular/common/http';
+import { MatSnackBar } from '@angular/material/snack-bar';

@Component({
  selector: 'app-security',
  templateUrl: './security.component.html',
  styleUrls: ['./security.component.less'],
+  providers: [SecurityService],
 })
-export default class SecurityComponent {}
+export default class SecurityComponent {
+  loading: boolean = false;
+  inEdit: boolean = false;
+  dataSource: SecuritySettings = {};
+
+  constructor(
+    public securityService: SecurityService,
+    private _snackBar: MatSnackBar
+  ) {
+    this.loading = true;
+    this.securityService.fetchSecurityDetails().subscribe({
+      complete: () => {
+        this.dataSource = this.securityService.securitySettings;
+        this.loading = false;
+      },
+      error: (err: HttpErrorResponse) => {
+        this._snackBar.open(err.error, undefined, {
+          duration: 1500,
+        });
+        this.loading = false;
+      },
+    });
+  }
+
+  enableEdit() {
+    this.inEdit = true;
+    this.dataSource = JSON.parse(
+      JSON.stringify(this.securityService.securitySettings)
+    );
+  }
+
+  disableEdit() {
+    this.inEdit = false;
+    this.dataSource = this.securityService.securitySettings;
+  }
+
+  createIpEntry() {
+    this.dataSource.ipAddressAllowList?.push({ value: '' });
+  }
+
+  save() {
+    this.loading = true;
+    this.securityService.saveChanges(this.dataSource).subscribe({
+      complete: () => {
+        this.loading = false;
+        this.dataSource = this.securityService.securitySettings;
+      },
+      error: (err: HttpErrorResponse) => {
+        this._snackBar.open(err.error, undefined, {
+          duration: 1500,
+        });
+      },
+    });
+    this.disableEdit();
+  }
+
+  cancel() {
+    this.dataSource = this.securityService.securitySettings;
+    this.inEdit = false;
+  }
+
+  removeIpEntry(index: number) {
+    this.dataSource.ipAddressAllowList =
+      this.dataSource.ipAddressAllowList?.filter((_, i) => i != index);
+  }
+}
--- a/console-webapp/src/app/settings/security/security.service.spec.ts
+++ b/console-webapp/src/app/settings/security/security.service.spec.ts
@@ -0,0 +1,62 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { TestBed } from '@angular/core/testing';
+
+import {
+  SecurityService,
+  SecuritySettings,
+  SecuritySettingsBackendModel,
+  apiToUiConverter,
+  uiToApiConverter,
+} from './security.service';
+import { HttpClientTestingModule } from '@angular/common/http/testing';
+import SecurityComponent from './security.component';
+import { BackendService } from 'src/app/shared/services/backend.service';
+
+describe('SecurityService', () => {
+  const uiMockData: SecuritySettings = {
+    clientCertificate: 'clientCertificateTest',
+    failoverClientCertificate: 'failoverClientCertificateTest',
+    ipAddressAllowList: [{ value: '123.123.123.123' }],
+  };
+  const apiMockData: SecuritySettingsBackendModel = {
+    clientCertificate: 'clientCertificateTest',
+    failoverClientCertificate: 'failoverClientCertificateTest',
+    ipAddressAllowList: ['123.123.123.123'],
+  };
+
+  let service: SecurityService;
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({
+      imports: [HttpClientTestingModule],
+      declarations: [SecurityComponent],
+      providers: [SecurityService, BackendService],
+    });
+    service = TestBed.inject(SecurityService);
+  });
+
+  it('should be created', () => {
+    expect(service).toBeTruthy();
+  });
+
+  it('should convert from api to ui', () => {
+    expect(apiToUiConverter(apiMockData)).toEqual(uiMockData);
+  });
+
+  it('should convert from ui to api', () => {
+    expect(uiToApiConverter(uiMockData)).toEqual(apiMockData);
+  });
+});
--- a/console-webapp/src/app/settings/security/security.service.ts
+++ b/console-webapp/src/app/settings/security/security.service.ts
@@ -0,0 +1,86 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { Injectable } from '@angular/core';
+import { tap } from 'rxjs';
+import { RegistrarService } from 'src/app/registrar/registrar.service';
+import { BackendService } from 'src/app/shared/services/backend.service';
+
+interface ipAllowListItem {
+  value: string;
+}
+export interface SecuritySettings {
+  clientCertificate?: string;
+  failoverClientCertificate?: string;
+  ipAddressAllowList?: Array<ipAllowListItem>;
+}
+
+export interface SecuritySettingsBackendModel {
+  clientCertificate?: string;
+  failoverClientCertificate?: string;
+  ipAddressAllowList?: Array<string>;
+}
+
+export function apiToUiConverter(
+  securitySettings: SecuritySettingsBackendModel = {}
+): SecuritySettings {
+  return Object.assign({}, securitySettings, {
+    ipAddressAllowList: (securitySettings.ipAddressAllowList || []).map(
+      (value) => ({ value })
+    ),
+  });
+}
+
+export function uiToApiConverter(
+  securitySettings: SecuritySettings
+): SecuritySettingsBackendModel {
+  return Object.assign({}, securitySettings, {
+    ipAddressAllowList: (securitySettings.ipAddressAllowList || [])
+      .filter((s) => s.value)
+      .map((ipAllowItem: ipAllowListItem) => ipAllowItem.value),
+  });
+}
+
+@Injectable()
+export class SecurityService {
+  securitySettings: SecuritySettings = {};
+
+  constructor(
+    private backend: BackendService,
+    private registrarService: RegistrarService
+  ) {}
+
+  fetchSecurityDetails() {
+    return this.backend
+      .getSecuritySettings(this.registrarService.activeRegistrarId)
+      .pipe(
+        tap((securitySettings: SecuritySettingsBackendModel) => {
+          this.securitySettings = apiToUiConverter(securitySettings);
+        })
+      );
+  }
+
+  saveChanges(newSecuritySettings: SecuritySettings) {
+    return this.backend
+      .postSecuritySettings(
+        this.registrarService.activeRegistrarId,
+        uiToApiConverter(newSecuritySettings)
+      )
+      .pipe(
+        tap((_) => {
+          this.securitySettings = newSecuritySettings;
+        })
+      );
+  }
+}
--- a/console-webapp/src/app/settings/settings.component.spec.ts
+++ b/console-webapp/src/app/settings/settings.component.spec.ts
@@ -15,6 +15,8 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';

 import { SettingsComponent } from './settings.component';
+import { MaterialModule } from '../material.module';
+import { BrowserAnimationsModule } from '@angular/platform-browser/animations';

 describe('SettingsComponent', () => {
  let component: SettingsComponent;
@@ -22,6 +24,7 @@ describe('SettingsComponent', () => {

  beforeEach(async () => {
    await TestBed.configureTestingModule({
+      imports: [MaterialModule, BrowserAnimationsModule],
      declarations: [SettingsComponent],
    }).compileComponents();

--- a/console-webapp/src/app/shared/services/backend.service.ts
+++ b/console-webapp/src/app/shared/services/backend.service.ts
@@ -12,9 +12,11 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-import { Injectable } from '@angular/core';
 import { HttpClient, HttpErrorResponse } from '@angular/common/http';
-import { Observable, catchError, of } from 'rxjs';
+import { Injectable } from '@angular/core';
+import { catchError, Observable, of } from 'rxjs';
+import { SecuritySettingsBackendModel } from 'src/app/settings/security/security.service';
+
 import { Contact } from '../../settings/contact/contact.service';

@Injectable()
@@ -54,7 +56,7 @@ export class BackendService {
  ): Observable<Contact[]> {
    return this.http.post<Contact[]>(
      `/console-api/settings/contacts?registrarId=${registrarId}`,
-      { contacts }
+      contacts
    );
  }

@@ -63,4 +65,28 @@ export class BackendService {
      .get<string[]>('/console-api/registrars')
      .pipe(catchError((err) => this.errorCatcher<string[]>(err)));
  }
+
+  getSecuritySettings(
+    registrarId: string
+  ): Observable<SecuritySettingsBackendModel> {
+    return this.http
+      .get<SecuritySettingsBackendModel>(
+        `/console-api/settings/security?registrarId=${registrarId}`
+      )
+      .pipe(
+        catchError((err) =>
+          this.errorCatcher<SecuritySettingsBackendModel>(err)
+        )
+      );
+  }
+
+  postSecuritySettings(
+    registrarId: string,
+    securitySettings: SecuritySettingsBackendModel
+  ): Observable<SecuritySettingsBackendModel> {
+    return this.http.post<SecuritySettingsBackendModel>(
+      `/console-api/settings/security?registrarId=${registrarId}`,
+      securitySettings
+    );
+  }
 }
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -146,18 +146,6 @@ configurations {
  }
 }

-// Known issues:
-// - The (test/)compile/runtime labels are deprecated. We continue using these
-//   labels due to nebula-lint.
-//   TODO(weiminyu): switch to api/implementation labels.
-//   See https://github.com/nebula-plugins/gradle-lint-plugin/issues/130 for
-//   issue status.
-// - Nebula-lint's conflict between unused and undeclared dependency check.
-//   If an undeclared dependency is added, the unused-dependency check will flag
-//   it. For now we wrap affected dependency in gradleLint.ignore block.
-//   TODO(weiminyu): drop gradleLint.ignore block when issue is fixed.
-//   See https://github.com/nebula-plugins/gradle-lint-plugin/issues/181 for
-//   issue status.
 dependencies {
  def deps = rootProject.dependencyMap

@@ -203,9 +191,10 @@ dependencies {
  runtime deps['com.google.flogger:flogger-system-backend']
  implementation deps['com.google.guava:guava']
  implementation deps['com.google.protobuf:protobuf-java']
-  gradleLint.ignore('unused-dependency') {
-    implementation deps['com.google.gwt:gwt-user']
-  }
+  // Might need to add this back if we re-add nebula-lint
+  // gradleLint.ignore('unused-dependency') {
+  implementation deps['com.google.gwt:gwt-user']
+  // }
  implementation deps['com.google.cloud:google-cloud-core']
  implementation deps['com.google.cloud:google-cloud-storage']
  implementation deps['com.google.cloud:google-cloud-tasks']
@@ -618,7 +607,7 @@ compileProdJS.dependsOn soyToJS
 // Make testing artifacts available to be depended up on by other projects.
 // TODO: factor out google.registry.testing to be a separate project.
 task testJar(type: Jar) {
-  classifier = 'test'
+  archiveClassifier = 'test'
  from sourceSets.test.output
 }

--- a/core/gradle.lockfile
+++ b/core/gradle.lockfile
@@ -1,243 +1,236 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-antlr:antlr:2.7.7=checkstyle,compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-aopalliance:aopalliance:1.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-args4j:args4j:2.0.23=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
+antlr:antlr:2.7.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+aopalliance:aopalliance:1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
+args4j:args4j:2.0.23=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 args4j:args4j:2.0.26=css
 cglib:cglib-nodep:2.2=css
-com.101tec:zkclient:0.10=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.beust:jcommander:1.60=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.14.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.14.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.14.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.14.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-joda:2.14.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.14.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.14.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml:classmate:1.5.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.101tec:zkclient:0.10=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.beust:jcommander:1.60=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.14.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.14.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.14.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.14.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.14.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-joda:2.14.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.14.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.14.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml:classmate:1.5.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.ben-manes.caffeine:caffeine:2.7.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-com.github.ben-manes.caffeine:caffeine:2.9.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.docker-java:docker-java-api:3.3.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.docker-java:docker-java-transport-zerodep:3.3.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.docker-java:docker-java-transport:3.3.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jffi:1.3.10=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-a64asm:1.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-constants:0.10.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-enxio:0.32.14=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-ffi:2.2.13=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-posix:3.1.16=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-unixsocket:0.38.19=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-x86asm:1.0.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.ben-manes.caffeine:caffeine:2.9.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.docker-java:docker-java-api:3.3.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.docker-java:docker-java-transport-zerodep:3.3.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.docker-java:docker-java-transport:3.3.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jffi:1.3.11=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-a64asm:1.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-constants:0.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-enxio:0.32.15=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-ffi:2.2.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-posix:3.1.17=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-unixsocket:0.38.20=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-x86asm:1.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.android:annotations:4.1.1.4=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-appengine:1.35.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-jackson2:1.32.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-java6:1.35.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-servlet:1.35.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client:1.35.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.22.5-alpha=testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.23.0-alpha=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:2.36.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.160.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.160.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.22.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.105.11=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.12.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.41.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.41.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-v1:6.41.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.22.5-alpha=testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.23.0-alpha=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.api.grpc:grpc-google-common-protos:2.17.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:2.36.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.160.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.160.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.22.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-v2:2.22.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.105.5=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-firestore-v1:3.10.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.android:annotations:4.1.1.4=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-appengine:1.35.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-jackson2:1.32.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-java6:1.35.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-servlet:1.35.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client:1.35.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.22.6-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:2.38.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.162.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.162.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.23.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.105.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.12.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-v1:6.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.22.6-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-common-protos:2.20.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:2.38.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.162.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.162.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.23.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigtable-v2:2.23.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.106.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-firestore-v1:3.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-monitoring-v3:1.64.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-monitoring-v3:3.17.0=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.105.11=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.12.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.20.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:2.20.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.41.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.41.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-v1:6.41.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.22.5-alpha=testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.23.0-alpha=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2:2.20.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.110.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.110.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-common-protos:2.21.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-iam-v1:1.16.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:api-common:2.13.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-grpc:2.30.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-httpjson:2.30.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax:2.30.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-admin-directory:directory_v1-rev118-1.25.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-appengine:v1-rev20230601-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-bigquery:v2-rev20220924-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20220828-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-dataflow:v1b3-rev20220920-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-dns:v2beta1-rev99-1.25.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-drive:v2-rev393-1.25.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-gmail:v1-rev20220404-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-groupssettings:v1-rev20210624-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-healthcare:v1-rev20220818-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-iamcredentials:v1-rev20210326-1.32.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-monitoring:v3-rev20230529-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20230526-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sqladmin:v1beta4-rev20230403-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20230617-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.appengine:appengine-api-1.0-sdk:1.9.86=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:proto-google-cloud-monitoring-v3:3.20.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.105.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.12.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.22.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:2.22.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-v1:6.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.22.6-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2:2.22.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.112.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.112.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-common-protos:2.22.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.17.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:api-common:2.14.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-grpc:2.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-httpjson:2.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax:2.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-admin-directory:directory_v1-rev118-1.25.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-appengine:v1-rev20230601-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-bigquery:v2-rev20220924-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20220828-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-dataflow:v1b3-rev20220920-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-dns:v2beta1-rev99-1.25.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-drive:v2-rev393-1.25.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-gmail:v1-rev20220404-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-groupssettings:v1-rev20210624-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-healthcare:v1-rev20220818-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-iamcredentials:v1-rev20210326-1.32.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-monitoring:v3-rev20230529-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20230526-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20230607-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20230301-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20230617-2.0.0=testCompileClasspath,testRuntimeClasspath
+com.google.appengine:appengine-api-1.0-sdk:1.9.86=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.appengine:appengine-api-1.0-sdk:2.0.16=testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-stubs:2.0.16=testCompileClasspath,testRuntimeClasspath
-com.google.appengine:appengine-testing:1.9.86=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-credentials:1.18.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-oauth2-http:1.18.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auto.service:auto-service-annotations:1.1.1=annotationProcessor,compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.appengine:appengine-testing:1.9.86=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-credentials:1.19.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-oauth2-http:1.19.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auto.service:auto-service-annotations:1.1.1=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service:1.1.1=annotationProcessor
-com.google.auto.value:auto-value-annotations:1.10.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auto.value:auto-value:1.10.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auto.value:auto-value-annotations:1.10.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auto.value:auto-value:1.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.value:auto-value:1.10.2=annotationProcessor,testAnnotationProcessor
 com.google.auto:auto-common:0.10=errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.auto:auto-common:1.2.1=annotationProcessor
 com.google.closure-stylesheets:closure-stylesheets:1.5.0=css
-com.google.cloud.bigdataoss:gcsio:2.2.6=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.bigdataoss:util:2.2.6=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.bigtable:bigtable-client-core-config:1.28.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.datastore:datastore-v1-proto-client:2.9.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:jdbc-socket-factory-core:1.12.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.12.0=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-bigquerystorage:2.36.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-bigtable-stats:2.22.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-bigtable:2.22.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.19.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.20.0=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-http:2.19.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.cloud:google-cloud-core-http:2.20.0=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core:2.19.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.cloud:google-cloud-core:2.20.0=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-firestore:3.10.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.bigdataoss:gcsio:2.2.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.bigdataoss:util:2.2.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.bigtable:bigtable-client-core-config:1.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.datastore:datastore-v1-proto-client:2.15.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:jdbc-socket-factory-core:1.13.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.13.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-bigquerystorage:2.38.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-bigtable-stats:2.23.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-bigtable:2.23.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core:2.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-firestore:3.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-monitoring:1.82.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-monitoring:3.17.0=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-nio:0.126.18=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-pubsub:1.123.11=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-pubsublite:1.12.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-secretmanager:2.20.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-spanner:6.41.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage:2.22.5=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage:2.23.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.cloud:google-cloud-tasks:2.20.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:grpc-gcp:1.4.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.10.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-monitoring:3.20.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-nio:0.126.19=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-pubsub:1.123.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-pubsublite:1.12.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-secretmanager:2.22.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-spanner:6.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage:2.22.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-tasks:2.22.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:grpc-gcp:1.4.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.code.findbugs:jFormatString:3.0.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.code.findbugs:jsr305:3.0.1=css
-com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,default,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.code.gson:gson:2.10.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.code.gson:gson:2.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.code.gson:gson:2.7=css,soy
-com.google.common.html.types:types:1.0.6=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-com.google.dagger:dagger-compiler:2.46.1=annotationProcessor,testAnnotationProcessor
-com.google.dagger:dagger-producers:2.46.1=annotationProcessor,testAnnotationProcessor
-com.google.dagger:dagger-spi:2.46.1=annotationProcessor,testAnnotationProcessor
-com.google.dagger:dagger:2.46.1=annotationProcessor,compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.common.html.types:types:1.0.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
+com.google.dagger:dagger-compiler:2.47=annotationProcessor,testAnnotationProcessor
+com.google.dagger:dagger-producers:2.47=annotationProcessor,testAnnotationProcessor
+com.google.dagger:dagger-spi:2.47=annotationProcessor,testAnnotationProcessor
+com.google.dagger:dagger:2.47=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.devtools.ksp:symbol-processing-api:1.8.0-1.0.9=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotation:2.3.4=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.18.0=annotationProcessor,compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor
+com.google.errorprone:error_prone_annotations:2.18.0=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.19.1=testCompileClasspath,testRuntimeClasspath
-com.google.errorprone:error_prone_annotations:2.3.4=checkstyle,errorprone,nonprodAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.7.1=soy
+com.google.errorprone:error_prone_annotations:2.3.4=errorprone,nonprodAnnotationProcessor
+com.google.errorprone:error_prone_annotations:2.7.1=checkstyle,soy
 com.google.errorprone:error_prone_check_api:2.3.4=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.3.4=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_type_annotations:2.3.4=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:javac-shaded:9-dev-r4023-3=annotationProcessor,testAnnotationProcessor
-com.google.escapevelocity:escapevelocity:0.9.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-com.google.flatbuffers:flatbuffers-java:1.12.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.flogger:flogger-system-backend:0.7.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.flogger:flogger:0.7.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.flogger:google-extensions:0.7.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.escapevelocity:escapevelocity:0.9.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
+com.google.flatbuffers:flatbuffers-java:1.12.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.flogger:flogger-system-backend:0.7.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.flogger:flogger:0.7.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.flogger:google-extensions:0.7.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.googlejavaformat:google-java-format:1.5=annotationProcessor,testAnnotationProcessor
-com.google.guava:failureaccess:1.0.1=annotationProcessor,checkstyle,compileClasspath,default,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.guava:guava-parent:32.1.1-jre=annotationProcessor,compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.guava:guava-testlib:32.1.1-jre=testCompileClasspath,testRuntimeClasspath
+com.google.guava:failureaccess:1.0.1=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava-parent:32.1.1-jre=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.guava:guava-parent:32.1.2-jre=annotationProcessor,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava-testlib:32.1.2-jre=testCompileClasspath,testRuntimeClasspath
 com.google.guava:guava:20.0=css
 com.google.guava:guava:27.0.1-jre=errorprone,nonprodAnnotationProcessor
-com.google.guava:guava:29.0-jre=checkstyle
-com.google.guava:guava:31.0.1-jre=soy
-com.google.guava:guava:32.1.1-jre=annotationProcessor,compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=checkstyle,errorprone,nonprodAnnotationProcessor,soy
-com.google.gwt:gwt-user:2.10.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.43.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.43.3=testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-appengine:1.43.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.http-client:google-http-client-appengine:1.43.3=testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-gson:1.43.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-jackson2:1.43.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.http-client:google-http-client-jackson2:1.43.3=testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-protobuf:1.41.8=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client:1.43.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.inject.extensions:guice-multibindings:4.1.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-com.google.inject:guice:4.1.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava:31.0.1-jre=checkstyle,soy
+com.google.guava:guava:32.1.1-jre=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.guava:guava:32.1.2-jre=annotationProcessor,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,errorprone,nonprodAnnotationProcessor,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.gwt:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-appengine:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-gson:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-jackson2:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-protobuf:1.43.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.inject.extensions:guice-multibindings:4.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
+com.google.inject:guice:4.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject:guice:7.0.0=soy
 com.google.j2objc:j2objc-annotations:1.1=errorprone,nonprodAnnotationProcessor
 com.google.j2objc:j2objc-annotations:1.3=checkstyle,soy
-com.google.j2objc:j2objc-annotations:2.8=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.j2objc:j2objc-annotations:2.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.javascript:closure-compiler-externs:v20160713=css
 com.google.javascript:closure-compiler-unshaded:v20160713=css
 com.google.javascript:closure-compiler:v20210505=closureCompiler
 com.google.jsinterop:jsinterop-annotations:1.0.1=soy
-com.google.jsinterop:jsinterop-annotations:2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.jsinterop:jsinterop-annotations:2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.monitoring-client:contrib:1.0.7=testCompileClasspath,testRuntimeClasspath
-com.google.monitoring-client:metrics:1.0.7=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.monitoring-client:stackdriver:1.0.7=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.oauth-client:google-oauth-client-appengine:1.34.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.oauth-client:google-oauth-client-java6:1.34.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.oauth-client:google-oauth-client-jetty:1.34.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.oauth-client:google-oauth-client-servlet:1.34.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.oauth-client:google-oauth-client:1.34.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.protobuf:protobuf-java-util:3.23.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.monitoring-client:metrics:1.0.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.monitoring-client:stackdriver:1.0.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.oauth-client:google-oauth-client-appengine:1.34.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.oauth-client:google-oauth-client-java6:1.34.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.oauth-client:google-oauth-client-jetty:1.34.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.oauth-client:google-oauth-client-servlet:1.34.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.oauth-client:google-oauth-client:1.34.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.protobuf:protobuf-java-util:3.23.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java:2.5.0=css
-com.google.protobuf:protobuf-java:3.23.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.protobuf:protobuf-java:3.23.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java:3.4.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.protobuf:protobuf-java:4.0.0-rc-2=soy
-com.google.re2j:re2j:1.6=compileClasspath,nonprodCompileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.re2j:re2j:1.7=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-com.google.template:soy:2021-02-01=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-com.google.truth.extensions:truth-java8-extension:1.1.3=testCompileClasspath,testRuntimeClasspath
-com.google.truth:truth:1.1.3=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+com.google.re2j:re2j:1.6=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.re2j:re2j:1.7=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.template:soy:2021-02-01=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
+com.google.truth.extensions:truth-java8-extension:1.1.5=testCompileClasspath,testRuntimeClasspath
+com.google.truth:truth:1.1.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
 com.google.truth:truth:1.1.5=testCompileClasspath,testRuntimeClasspath
 com.googlecode.java-diff-utils:diffutils:1.3.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-com.googlecode.json-simple:json-simple:1.1.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.googlecode.json-simple:json-simple:1.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.ibm.icu:icu4j:57.1=compileClasspath,nonprodCompileClasspath,soy,testCompileClasspath
-com.ibm.icu:icu4j:73.2=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.jcraft:jsch:0.1.55=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.lmax:disruptor:3.4.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.puppycrawl.tools:checkstyle:8.37=checkstyle
+com.ibm.icu:icu4j:73.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.jcraft:jsch:0.1.55=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.lmax:disruptor:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.puppycrawl.tools:checkstyle:9.3=checkstyle
 com.squareup.okhttp3:okhttp:3.11.0=testCompileClasspath,testRuntimeClasspath
 com.squareup.okio:okio:1.14.0=testCompileClasspath,testRuntimeClasspath
 com.squareup:javapoet:1.13.0=annotationProcessor,testAnnotationProcessor
 com.squareup:kotlinpoet:1.11.0=annotationProcessor,testAnnotationProcessor
 com.sun.activation:jakarta.activation:1.2.2=jaxb
 com.sun.activation:javax.activation:1.2.0=jaxb
-com.sun.istack:istack-commons-runtime:3.0.7=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.sun.istack:istack-commons-runtime:3.0.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.sun.istack:istack-commons-runtime:4.1.2=nonprodRuntime,runtime
 com.sun.xml.bind:jaxb-impl:2.3.3=jaxb
 com.sun.xml.bind:jaxb-osgi:4.0.3=jaxb
 com.sun.xml.bind:jaxb-xjc:2.3.3=jaxb
-com.sun.xml.fastinfoset:FastInfoset:1.2.15=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.thoughtworks.paranamer:paranamer:2.7=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.sun.xml.fastinfoset:FastInfoset:1.2.15=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.thoughtworks.paranamer:paranamer:2.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.thoughtworks.qdox:qdox:1.12.1=testCompileClasspath,testRuntimeClasspath
-com.zaxxer:HikariCP:3.4.5=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.zaxxer:HikariCP:3.4.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 commons-beanutils:commons-beanutils:1.9.4=checkstyle
-commons-codec:commons-codec:1.15=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+commons-codec:commons-codec:1.15=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 commons-collections:commons-collections:3.2.2=checkstyle
-commons-logging:commons-logging:1.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-dev.failsafe:failsafe:3.3.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-dnsjava:dnsjava:3.5.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+commons-logging:commons-logging:1.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+dev.failsafe:failsafe:3.3.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+dnsjava:dnsjava:3.5.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 guru.nidi.com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0=nonprodRuntime,runtime,testRuntimeClasspath
 guru.nidi.com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0=nonprodRuntime,runtime,testRuntimeClasspath
 guru.nidi.com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0=nonprodRuntime,runtime,testRuntimeClasspath
@@ -245,212 +238,199 @@ guru.nidi.com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0=nonprodRuntime,runtime,
 guru.nidi.com.kitfox:svgSalamander:1.1.3=nonprodRuntime,runtime,testRuntimeClasspath
 guru.nidi:graphviz-java-all-j2v8:0.18.1=nonprodRuntime,runtime,testRuntimeClasspath
 guru.nidi:graphviz-java:0.18.1=nonprodRuntime,runtime,testRuntimeClasspath
-info.picocli:picocli:4.5.2=checkstyle
-io.confluent:common-config:5.3.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.confluent:common-utils:5.3.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.confluent:kafka-avro-serializer:5.3.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.confluent:kafka-schema-registry-client:5.3.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.github.classgraph:classgraph:4.8.104=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.github.java-diff-utils:java-diff-utils:4.12=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-alts:1.55.1=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-alts:1.56.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-api:1.55.1=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.56.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-auth:1.55.1=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-auth:1.56.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-census:1.54.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.55.1=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.56.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-core:1.55.1=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-core:1.56.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-googleapis:1.55.1=testRuntimeClasspath
-io.grpc:grpc-googleapis:1.56.0=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-grpclb:1.55.1=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-grpclb:1.56.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-netty-shaded:1.55.1=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-netty-shaded:1.56.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-netty:1.54.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf-lite:1.55.1=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf-lite:1.56.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-protobuf:1.55.1=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf:1.56.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-rls:1.55.1=testRuntimeClasspath
-io.grpc:grpc-rls:1.56.0=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-services:1.54.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-services:1.55.1=testRuntimeClasspath
-io.grpc:grpc-services:1.56.0=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-stub:1.55.1=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-stub:1.56.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-xds:1.54.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-xds:1.55.1=testRuntimeClasspath
-io.grpc:grpc-xds:1.56.0=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-io.netty:netty-buffer:4.1.87.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-codec-http2:4.1.87.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-codec-http:4.1.87.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-codec-socks:4.1.87.Final=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-codec:4.1.87.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-common:4.1.87.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-handler-proxy:4.1.87.Final=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-handler:4.1.87.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-resolver:4.1.87.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-tcnative-boringssl-static:2.0.52.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-tcnative-classes:2.0.52.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-transport-native-unix-common:4.1.87.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-transport:4.1.87.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-api:0.31.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-contrib-exemplar-util:0.31.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-contrib-grpc-metrics:0.31.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-contrib-grpc-util:0.31.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-contrib-http-util:0.31.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-contrib-resource-util:0.31.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-exporter-metrics-util:0.31.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-exporter-stats-stackdriver:0.31.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-impl-core:0.31.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-impl:0.31.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-proto:0.2.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.perfmark:perfmark-api:0.26.0=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+info.picocli:picocli:4.6.2=checkstyle
+io.confluent:common-config:5.3.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.confluent:common-utils:5.3.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.confluent:kafka-avro-serializer:5.3.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.confluent:kafka-schema-registry-client:5.3.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.github.classgraph:classgraph:4.8.104=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.github.java-diff-utils:java-diff-utils:4.12=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-alts:1.56.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.56.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-auth:1.56.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-census:1.55.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.56.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-core:1.56.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-googleapis:1.56.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-grpclb:1.56.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-netty-shaded:1.56.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-netty:1.55.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf-lite:1.56.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf:1.56.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-rls:1.55.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-services:1.55.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-services:1.56.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-stub:1.56.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-xds:1.55.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-xds:1.56.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.netty:netty-buffer:4.1.87.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-http2:4.1.87.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-http:4.1.87.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-socks:4.1.87.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.netty:netty-codec:4.1.87.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-common:4.1.87.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-handler-proxy:4.1.87.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.netty:netty-handler:4.1.87.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-resolver:4.1.87.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-tcnative-boringssl-static:2.0.52.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-tcnative-classes:2.0.52.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-transport-native-unix-common:4.1.87.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-transport:4.1.87.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-api:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-contrib-exemplar-util:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-contrib-grpc-metrics:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-contrib-grpc-util:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-contrib-http-util:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-contrib-resource-util:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-exporter-metrics-util:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-exporter-stats-stackdriver:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-impl-core:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-impl:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-proto:0.2.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.perfmark:perfmark-api:0.26.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 jakarta.activation:jakarta.activation-api:2.1.0=jaxb
 jakarta.activation:jakarta.activation-api:2.1.2=nonprodRuntime,runtime
 jakarta.inject:jakarta.inject-api:2.0.1=soy
 jakarta.xml.bind:jakarta.xml.bind-api:4.0.0=jaxb,nonprodRuntime,runtime
 javacc:javacc:4.1=css
-javax.activation:activation:1.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-javax.activation:javax.activation-api:1.2.0=compileClasspath,default,deploy_jar,jaxb,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-javax.annotation:javax.annotation-api:1.3.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-javax.annotation:jsr250-api:1.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-javax.inject:javax.inject:1=annotationProcessor,compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-javax.jdo:jdo2-api:2.3-20090302111651=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-javax.mail:mail:1.5.0-b01=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-javax.persistence:javax.persistence-api:2.2=annotationProcessor,compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-javax.servlet:servlet-api:2.5=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-javax.validation:validation-api:1.0.0.GA=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-javax.xml.bind:jaxb-api:2.3.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+javax.activation:activation:1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+javax.activation:javax.activation-api:1.2.0=compileClasspath,deploy_jar,jaxb,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+javax.annotation:javax.annotation-api:1.3.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+javax.annotation:jsr250-api:1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
+javax.inject:javax.inject:1=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+javax.jdo:jdo2-api:2.3-20090302111651=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+javax.mail:mail:1.5.0-b01=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+javax.persistence:javax.persistence-api:2.2=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+javax.servlet:servlet-api:2.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+javax.validation:validation-api:1.0.0.GA=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+javax.xml.bind:jaxb-api:2.3.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 javax.xml.bind:jaxb-api:2.4.0-b180830.0359=jaxb
-jline:jline:1.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-joda-time:joda-time:2.10.10=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-junit:junit:4.13.2=default,nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
+jline:jline:1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+joda-time:joda-time:2.10.10=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+junit:junit:4.13.2=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.arnx:nashorn-promise:0.1.1=nonprodRuntime,runtime,testRuntimeClasspath
 net.bytebuddy:byte-buddy-agent:1.14.5=testCompileClasspath,testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.12.18=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+net.bytebuddy:byte-buddy:1.12.18=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 net.bytebuddy:byte-buddy:1.14.5=testCompileClasspath,testRuntimeClasspath
 net.java.dev.javacc:javacc:4.1=css
-net.java.dev.jna:jna:5.12.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+net.java.dev.jna:jna:5.12.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.ltgt.gradle.incap:incap:0.2=annotationProcessor,testAnnotationProcessor
-net.sf.saxon:Saxon-HE:10.3=checkstyle
-org.antlr:antlr4-runtime:4.8-1=checkstyle
-org.apache.arrow:arrow-format:5.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.arrow:arrow-memory-core:5.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.arrow:arrow-vector:5.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.avro:avro:1.8.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-fn-execution:2.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-job-management:2.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-pipeline:2.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-core-construction-java:2.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-core-java:2.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-direct-java:2.48.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-java-fn-execution:2.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-core:2.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-expansion-service:2.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-arrow:2.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-avro:2.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-fn-execution:2.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-io-kafka:2.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-vendor-grpc-1_54_0:0.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-vendor-guava-26_0-jre:0.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-compress:1.23.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-csv:1.10.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+net.sf.saxon:Saxon-HE:10.6=checkstyle
+org.antlr:antlr4-runtime:4.9.3=checkstyle
+org.apache.arrow:arrow-format:5.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.arrow:arrow-memory-core:5.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.arrow:arrow-vector:5.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.avro:avro:1.8.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-fn-execution:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-job-management:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-pipeline:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-core-construction-java:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-core-java:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-direct-java:2.49.0=testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-java-fn-execution:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-core:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-expansion-service:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-arrow:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-avro:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-fn-execution:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-harness:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-io-kafka:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-vendor-grpc-1_54_0:0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-compress:1.23.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-csv:1.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-exec:1.3=nonprodRuntime,runtime,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-lang3:3.12.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-lang3:3.12.0=testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-lang3:3.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 org.apache.commons:commons-text:1.10.0=testCompileClasspath,testRuntimeClasspath
 org.apache.ftpserver:ftplet-api:1.2.0=testCompileClasspath,testRuntimeClasspath
 org.apache.ftpserver:ftpserver-core:1.2.0=testCompileClasspath,testRuntimeClasspath
-org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.httpcomponents:httpcore:4.4.16=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.httpcomponents:httpcore:4.4.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.mina:mina-core:2.1.6=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-core:2.0.0=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-scp:2.0.0=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-sftp:2.0.0=testCompileClasspath,testRuntimeClasspath
-org.apache.tomcat:tomcat-annotations-api:11.0.0-M7=testCompileClasspath,testRuntimeClasspath
+org.apache.tomcat:tomcat-annotations-api:11.0.0-M9=testCompileClasspath,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
-org.bouncycastle:bcpg-jdk15on:1.67=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcpkix-jdk15on:1.67=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcprov-jdk15on:1.67=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpg-jdk15on:1.67=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpkix-jdk15on:1.67=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcprov-jdk15on:1.67=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.checkerframework:checker-compat-qual:2.5.3=compileClasspath,nonprodCompileClasspath,nonprodRuntime,runtime,testCompileClasspath
-org.checkerframework:checker-compat-qual:2.5.5=annotationProcessor,default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
-org.checkerframework:checker-qual:2.11.1=checkstyle
+org.checkerframework:checker-compat-qual:2.5.5=annotationProcessor,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
 org.checkerframework:checker-qual:3.0.0=errorprone,nonprodAnnotationProcessor
-org.checkerframework:checker-qual:3.12.0=soy
+org.checkerframework:checker-qual:3.12.0=checkstyle,soy
 org.checkerframework:checker-qual:3.31.0=nonprodRuntime,runtime
-org.checkerframework:checker-qual:3.33.0=annotationProcessor,compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor
+org.checkerframework:checker-qual:3.33.0=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor
 org.checkerframework:checker-qual:3.35.0=testCompileClasspath,testRuntimeClasspath
 org.checkerframework:dataflow:3.0.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 org.checkerframework:javacutil:3.0.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-org.codehaus.jackson:jackson-core-asl:1.9.13=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.codehaus.jackson:jackson-mapper-asl:1.9.13=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.codehaus.jackson:jackson-core-asl:1.9.13=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.codehaus.jackson:jackson-mapper-asl:1.9.13=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.codehaus.mojo:animal-sniffer-annotations:1.17=errorprone,nonprodAnnotationProcessor
-org.codehaus.mojo:animal-sniffer-annotations:1.23=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.codehaus.mojo:animal-sniffer-annotations:1.23=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.easymock:easymock:3.0=css
 org.eclipse.angus:angus-activation:2.0.1=nonprodRuntime,runtime
-org.eclipse.jetty:jetty-http:9.4.49.v20220914=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-io:9.4.49.v20220914=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-security:9.4.49.v20220914=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-server:9.4.49.v20220914=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-servlet:9.4.49.v20220914=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-util-ajax:9.4.49.v20220914=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-util:9.4.49.v20220914=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-core:9.20.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-http:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-io:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-security:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-server:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-servlet:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util-ajax:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-core:9.21.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-core:4.0.3=nonprodRuntime,runtime
-org.glassfish.jaxb:jaxb-runtime:2.3.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.glassfish.jaxb:jaxb-runtime:2.3.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-runtime:4.0.3=nonprodRuntime,runtime
-org.glassfish.jaxb:txw2:2.3.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.glassfish.jaxb:txw2:2.3.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:txw2:4.0.3=nonprodRuntime,runtime
-org.gwtproject:gwt-user:2.10.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.gwtproject:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.hamcrest:hamcrest-core:1.1=css
-org.hamcrest:hamcrest-core:1.3=default,nonprodCompileClasspath,nonprodRuntimeClasspath
+org.hamcrest:hamcrest-core:1.3=nonprodCompileClasspath,nonprodRuntimeClasspath
 org.hamcrest:hamcrest-core:2.2=testCompileClasspath,testRuntimeClasspath
 org.hamcrest:hamcrest-library:2.2=testCompileClasspath,testRuntimeClasspath
-org.hamcrest:hamcrest:2.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+org.hamcrest:hamcrest:2.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 org.hamcrest:hamcrest:2.2=testCompileClasspath,testRuntimeClasspath
-org.hibernate.common:hibernate-commons-annotations:5.1.2.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.hibernate:hibernate-core:5.6.15.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.hibernate:hibernate-hikaricp:5.6.15.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jacoco:org.jacoco.agent:0.8.7=jacocoAgent,jacocoAnt
-org.jacoco:org.jacoco.ant:0.8.7=jacocoAnt
-org.jacoco:org.jacoco.core:0.8.7=jacocoAnt
-org.jacoco:org.jacoco.report:0.8.7=jacocoAnt
-org.javassist:javassist:3.26.0-GA=checkstyle
-org.jboss.logging:jboss-logging:3.4.3.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jboss:jandex:2.4.2.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.hibernate:hibernate-core:5.6.15.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.hibernate:hibernate-hikaricp:5.6.15.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jacoco:org.jacoco.agent:0.8.9=jacocoAgent,jacocoAnt
+org.jacoco:org.jacoco.ant:0.8.9=jacocoAnt
+org.jacoco:org.jacoco.core:0.8.9=jacocoAnt
+org.jacoco:org.jacoco.report:0.8.9=jacocoAnt
+org.javassist:javassist:3.28.0-GA=checkstyle
+org.jboss.logging:jboss-logging:3.4.3.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jboss:jandex:2.4.2.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-reflect:1.6.10=annotationProcessor,testAnnotationProcessor
-org.jetbrains.kotlin:kotlin-stdlib-common:1.8.0=annotationProcessor,testAnnotationProcessor
+org.jetbrains.kotlin:kotlin-stdlib-common:1.8.20=annotationProcessor,testAnnotationProcessor
 org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.6.10=annotationProcessor,testAnnotationProcessor
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.6.10=annotationProcessor,testAnnotationProcessor
-org.jetbrains.kotlin:kotlin-stdlib:1.8.0=annotationProcessor,testAnnotationProcessor
+org.jetbrains.kotlin:kotlin-stdlib:1.8.20=annotationProcessor,testAnnotationProcessor
 org.jetbrains:annotations:13.0=annotationProcessor,testAnnotationProcessor
-org.jetbrains:annotations:17.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.joda:joda-money:1.0.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jetbrains:annotations:17.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.joda:joda-money:1.0.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.json:json:20160212=soy
-org.json:json:20230227=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jsoup:jsoup:1.16.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.json:json:20230227=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jsoup:jsoup:1.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.junit-pioneer:junit-pioneer:2.0.1=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-engine:5.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-migrationsupport:5.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-params:5.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-engine:1.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-launcher:1.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-runner:1.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-suite-api:1.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-suite-commons:1.10.0-RC1=testRuntimeClasspath
-org.junit:junit-bom:5.10.0-RC1=testCompileClasspath,testRuntimeClasspath
-org.jvnet.staxex:stax-ex:1.8=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-api:5.10.0=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-engine:5.10.0=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-migrationsupport:5.10.0=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-params:5.10.0=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.10.0=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-engine:1.10.0=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-launcher:1.10.0=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-runner:1.10.0=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-suite-api:1.10.0=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-suite-commons:1.10.0=testRuntimeClasspath
+org.junit:junit-bom:5.10.0=testCompileClasspath,testRuntimeClasspath
+org.jvnet.staxex:stax-ex:1.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.mockito:mockito-core:1.10.19=css
 org.mockito:mockito-core:5.4.0=testCompileClasspath,testRuntimeClasspath
 org.mockito:mockito-junit-jupiter:5.4.0=testCompileClasspath,testRuntimeClasspath
@@ -460,26 +440,23 @@ org.objenesis:objenesis:2.1=css
 org.objenesis:objenesis:3.3=testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm-analysis:7.0=soy
-org.ow2.asm:asm-analysis:9.1=jacocoAnt
-org.ow2.asm:asm-analysis:9.5=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.ow2.asm:asm-analysis:9.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm-commons:7.0=soy
-org.ow2.asm:asm-commons:9.1=jacocoAnt
-org.ow2.asm:asm-commons:9.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.ow2.asm:asm-commons:9.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.ow2.asm:asm-commons:9.5=jacocoAnt
 org.ow2.asm:asm-tree:7.0=soy
-org.ow2.asm:asm-tree:9.1=jacocoAnt
-org.ow2.asm:asm-tree:9.5=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.ow2.asm:asm-tree:9.5=compileClasspath,deploy_jar,jacocoAnt,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm-util:7.0=soy
-org.ow2.asm:asm-util:9.5=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.ow2.asm:asm-util:9.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm:7.0=soy
-org.ow2.asm:asm:9.1=jacocoAnt
-org.ow2.asm:asm:9.5=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.ow2.asm:asm:9.5=compileClasspath,deploy_jar,jacocoAnt,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.pcollections:pcollections:2.1.2=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 org.plumelib:plume-util:1.0.6=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 org.plumelib:reflection-util:0.0.2=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 org.plumelib:require-javadoc:0.1.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-org.postgresql:postgresql:42.6.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.reflections:reflections:0.9.12=checkstyle
-org.rnorth.duct-tape:duct-tape:1.0.8=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.postgresql:postgresql:42.6.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.reflections:reflections:0.10.2=checkstyle
+org.rnorth.duct-tape:duct-tape:1.0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.seleniumhq.selenium:selenium-api:3.141.59=testCompileClasspath,testRuntimeClasspath
 org.seleniumhq.selenium:selenium-chrome-driver:3.141.59=testCompileClasspath,testRuntimeClasspath
 org.seleniumhq.selenium:selenium-edge-driver:3.141.59=testCompileClasspath,testRuntimeClasspath
@@ -494,28 +471,28 @@ org.slf4j:jcl-over-slf4j:1.7.30=nonprodRuntime,runtime,testRuntimeClasspath
 org.slf4j:jul-to-slf4j:1.7.30=nonprodRuntime,runtime,testRuntimeClasspath
 org.slf4j:slf4j-api:1.7.30=nonprodRuntime,runtime
 org.slf4j:slf4j-api:1.7.36=compileClasspath,nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath
-org.slf4j:slf4j-api:2.0.7=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
-org.slf4j:slf4j-jdk14:2.0.7=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
-org.springframework:spring-core:5.3.25=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.springframework:spring-expression:5.3.25=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.springframework:spring-jcl:5.3.25=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:database-commons:1.18.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:jdbc:1.18.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.slf4j:slf4j-api:2.0.7=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.slf4j:slf4j-jdk14:2.0.7=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.springframework:spring-core:5.3.27=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.springframework:spring-expression:5.3.27=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.springframework:spring-jcl:5.3.27=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:database-commons:1.18.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:jdbc:1.18.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.testcontainers:junit-jupiter:1.18.3=testCompileClasspath,testRuntimeClasspath
-org.testcontainers:postgresql:1.18.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:postgresql:1.18.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.testcontainers:selenium:1.18.3=testCompileClasspath,testRuntimeClasspath
-org.testcontainers:testcontainers:1.18.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.threeten:threetenbp:1.6.8=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.tukaani:xz:1.5=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.w3c.css:sac:1.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:testcontainers:1.18.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.threeten:threetenbp:1.6.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.tukaani:xz:1.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.w3c.css:sac:1.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.webjars.npm:viz.js-graphviz-java:2.1.3=nonprodRuntime,runtime,testRuntimeClasspath
-org.xerial.snappy:snappy-java:1.1.8.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.yaml:snakeyaml:1.33=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-api:16.10.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-diagram:16.10.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-tools:16.10.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-utility:16.10.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler:16.10.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-xerces:xmlParserAPIs:2.6.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-xpp3:xpp3:1.1.4c=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-empty=archives,devtool,errorproneJavac,nomulus_test
+org.xerial.snappy:snappy-java:1.1.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.yaml:snakeyaml:1.33=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-api:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-diagram:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-tools:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-utility:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+xerces:xmlParserAPIs:2.6.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+xpp3:xpp3:1.1.4c=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+empty=devtool,errorproneJavac,nomulus_test
--- a/core/src/main/java/google/registry/batch/AsyncTaskEnqueuer.java
+++ b/core/src/main/java/google/registry/batch/AsyncTaskEnqueuer.java
@@ -50,12 +50,6 @@ public final class AsyncTaskEnqueuer {
    this.cloudTasksUtils = cloudTasksUtils;
  }

-  /** Enqueues a task to asynchronously re-save an entity at some point in the future. */
-  public void enqueueAsyncResave(
-      VKey<? extends EppResource> entityToResave, DateTime now, DateTime whenToResave) {
-    enqueueAsyncResave(entityToResave, now, ImmutableSortedSet.of(whenToResave));
-  }
-
  /**
   * Enqueues a task to asynchronously re-save an entity at some point(s) in the future.
   *
--- a/core/src/main/java/google/registry/batch/CannedScriptExecutionAction.java
+++ b/core/src/main/java/google/registry/batch/CannedScriptExecutionAction.java
@@ -71,7 +71,7 @@ public class CannedScriptExecutionAction implements Runnable {
      GmailClient gmailClient,
      @Config("projectId") String projectId,
      @Config("gSuiteDomainName") String gSuiteDomainName,
-      @Config("alertRecipientEmailAddress") InternetAddress recipientAddress) {
+      @Config("newAlertRecipientEmailAddress") InternetAddress recipientAddress) {
    this.groupsConnection = groupsConnection;
    this.gmailClient = gmailClient;
    this.gSuiteDomainName = gSuiteDomainName;
@@ -116,6 +116,8 @@ public class CannedScriptExecutionAction implements Runnable {
        try {
          Set<String> currentMembers = groupsConnection.getMembersOfGroup(groupKey);
          logger.atInfo().log("%s has %s members.", groupKey, currentMembers.size());
+          // One success is enough for validation.
+          return;
        } catch (IOException e) {
          logger.atWarning().withCause(e).log("Failed to check %s", groupKey);
        }
--- a/core/src/main/java/google/registry/beam/common/DatabaseSnapshot.java
+++ b/core/src/main/java/google/registry/beam/common/DatabaseSnapshot.java
@@ -1,88 +0,0 @@
-// Copyright 2021 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.beam.common;
-
-import static com.google.common.base.Preconditions.checkState;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-
-import com.google.common.flogger.FluentLogger;
-import java.util.List;
-import javax.persistence.EntityManager;
-import javax.persistence.EntityTransaction;
-
-/**
- * A database snapshot shareable by concurrent queries from multiple database clients. A snapshot is
- * uniquely identified by its {@link #getSnapshotId snapshotId}, and must stay open until all
- * concurrent queries to this snapshot have attached to it by calling {@link
- * google.registry.persistence.transaction.JpaTransactionManager#setDatabaseSnapshot}. However, it
- * can be closed before those queries complete.
- *
- * <p>This feature is <em>Postgresql-only</em>.
- *
- * <p>To support large queries, transaction isolation level is fixed at the REPEATABLE_READ to avoid
- * exhausting predicate locks at the SERIALIZABLE level.
- */
-// TODO(b/193662898): vendor-independent support for richer transaction semantics.
-public class DatabaseSnapshot implements AutoCloseable {
-
-  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
-
-  private String snapshotId;
-  private EntityManager entityManager;
-  private EntityTransaction transaction;
-
-  private DatabaseSnapshot() {}
-
-  public String getSnapshotId() {
-    checkState(entityManager != null, "Snapshot not opened yet.");
-    checkState(entityManager.isOpen(), "Snapshot already closed.");
-    return snapshotId;
-  }
-
-  private DatabaseSnapshot open() {
-    entityManager = tm().getStandaloneEntityManager();
-    transaction = entityManager.getTransaction();
-    transaction.setRollbackOnly();
-    transaction.begin();
-
-    entityManager
-        .createNativeQuery("SET TRANSACTION ISOLATION LEVEL REPEATABLE READ")
-        .executeUpdate();
-
-    List<?> snapshotIds =
-        entityManager.createNativeQuery("SELECT pg_export_snapshot();").getResultList();
-    checkState(snapshotIds.size() == 1, "Unexpected number of snapshots: %s", snapshotIds.size());
-    snapshotId = (String) snapshotIds.get(0);
-    return this;
-  }
-
-  @Override
-  public void close() {
-    if (transaction != null && transaction.isActive()) {
-      try {
-        transaction.rollback();
-      } catch (Exception e) {
-        logger.atWarning().withCause(e).log("Failed to close a Database Snapshot");
-      }
-    }
-    if (entityManager != null && entityManager.isOpen()) {
-      entityManager.close();
-    }
-  }
-
-  public static DatabaseSnapshot createSnapshot() {
-    return new DatabaseSnapshot().open();
-  }
-}
--- a/core/src/main/java/google/registry/beam/common/RegistryJpaIO.java
+++ b/core/src/main/java/google/registry/beam/common/RegistryJpaIO.java
@@ -122,6 +122,7 @@ public final class RegistryJpaIO {
  @AutoValue
  public abstract static class Read<R, T> extends PTransform<PBegin, PCollection<T>> {

+    private static final long serialVersionUID = 6906842877429561700L;
    public static final String DEFAULT_NAME = "RegistryJpaIO.Read";

    abstract String name();
@@ -133,9 +134,6 @@ public final class RegistryJpaIO {
    @Nullable
    abstract Coder<T> coder();

-    @Nullable
-    abstract String snapshotId();
-
    abstract Builder<R, T> toBuilder();

    @Override
@@ -145,8 +143,7 @@ public final class RegistryJpaIO {
          input
              .apply("Starting " + name(), Create.of((Void) null))
              .apply(
-                  "Run query for " + name(),
-                  ParDo.of(new QueryRunner<>(query(), resultMapper(), snapshotId())));
+                  "Run query for " + name(), ParDo.of(new QueryRunner<>(query(), resultMapper())));
      if (coder() != null) {
        output = output.setCoder(coder());
      }
@@ -165,18 +162,6 @@ public final class RegistryJpaIO {
      return toBuilder().coder(coder).build();
    }

-    /**
-     * Specifies the database snapshot to use for this query.
-     *
-     * <p>This feature is <em>Postgresql-only</em>. User is responsible for keeping the snapshot
-     * available until all JVM workers have started using it by calling {@link
-     * JpaTransactionManager#setDatabaseSnapshot}.
-     */
-    // TODO(b/193662898): vendor-independent support for richer transaction semantics.
-    public Read<R, T> withSnapshot(@Nullable String snapshotId) {
-      return toBuilder().snapshotId(snapshotId).build();
-    }
-
    static <R, T> Builder<R, T> builder() {
      return new AutoValue_RegistryJpaIO_Read.Builder<R, T>().name(DEFAULT_NAME);
    }
@@ -192,8 +177,6 @@ public final class RegistryJpaIO {

      abstract Builder<R, T> coder(Coder<T> coder);

-      abstract Builder<R, T> snapshotId(@Nullable String sharedSnapshotId);
-
      abstract Read<R, T> build();

      Builder<R, T> criteriaQuery(CriteriaQuerySupplier<R> criteriaQuery) {
@@ -214,27 +197,20 @@ public final class RegistryJpaIO {
    }

    static class QueryRunner<R, T> extends DoFn<Void, T> {
+
+      private static final long serialVersionUID = 7293891513058653334L;
      private final RegistryQuery<R> query;
      private final SerializableFunction<R, T> resultMapper;
-      // java.util.Optional is not serializable. Use of Guava Optional is discouraged.
-      @Nullable private final String snapshotId;

-      QueryRunner(
-          RegistryQuery<R> query,
-          SerializableFunction<R, T> resultMapper,
-          @Nullable String snapshotId) {
+      QueryRunner(RegistryQuery<R> query, SerializableFunction<R, T> resultMapper) {
        this.query = query;
        this.resultMapper = resultMapper;
-        this.snapshotId = snapshotId;
      }

      @ProcessElement
      public void processElement(OutputReceiver<T> outputReceiver) {
        tm().transactNoRetry(
                () -> {
-                  if (snapshotId != null) {
-                    tm().setDatabaseSnapshot(snapshotId);
-                  }
                  query.stream().map(resultMapper::apply).forEach(outputReceiver::output);
                });
      }
@@ -256,8 +232,8 @@ public final class RegistryJpaIO {
  @AutoValue
  public abstract static class Write<T> extends PTransform<PCollection<T>, PCollection<Void>> {

+    private static final long serialVersionUID = -4023583243078410323L;
    public static final String DEFAULT_NAME = "RegistryJpaIO.Write";
-
    public static final int DEFAULT_BATCH_SIZE = 1;

    public abstract String name();
@@ -321,6 +297,8 @@ public final class RegistryJpaIO {

  /** Writes a batch of entities to a SQL database through a {@link JpaTransactionManager}. */
  private static class SqlBatchWriter<T> extends DoFn<KV<ShardedKey<Integer>, Iterable<T>>, Void> {
+
+    private static final long serialVersionUID = -7519944406319472690L;
    private final Counter counter;
    private final SerializableFunction<T, Object> jpaConverter;

@@ -337,7 +315,7 @@ public final class RegistryJpaIO {
    private void actuallyProcessElement(@Element KV<ShardedKey<Integer>, Iterable<T>> kv) {
      ImmutableList<Object> entities =
          Streams.stream(kv.getValue())
-              .map(this.jpaConverter::apply)
+              .map(jpaConverter::apply)
              // TODO(b/177340730): post migration delete the line below.
              .filter(Objects::nonNull)
              .collect(ImmutableList.toImmutableList());
@@ -373,7 +351,7 @@ public final class RegistryJpaIO {
    }

    /** Returns this entity's primary key field(s) in a string. */
-    private String toEntityKeyString(Object entity) {
+    private static String toEntityKeyString(Object entity) {
      try {
        return tm().transact(
                () ->
--- a/core/src/main/java/google/registry/config/CredentialModule.java
+++ b/core/src/main/java/google/registry/config/CredentialModule.java
@@ -93,13 +93,56 @@ public abstract class CredentialModule {
  @AdcDelegatedCredential
  @Provides
  @Singleton
-  public static GoogleCredentialsBundle provideSelfSignedDelegatedCredential(
+  public static GoogleCredentialsBundle provideSelfSignedAdminDelegatedCredential(
      @Config("defaultCredentialOauthScopes") ImmutableList<String> defaultScopes,
      @Config("delegatedCredentialOauthScopes") ImmutableList<String> delegationScopes,
      @ApplicationDefaultCredential GoogleCredentialsBundle credentialsBundle,
      @Config("gSuiteAdminAccountEmailAddress") String gSuiteAdminAccountEmailAddress,
      @Config("tokenRefreshDelay") Duration tokenRefreshDelay,
      Clock clock) {
+    return createSelfSignedDelegatedCredential(
+        defaultScopes,
+        delegationScopes,
+        credentialsBundle,
+        gSuiteAdminAccountEmailAddress,
+        tokenRefreshDelay,
+        clock);
+  }
+
+  /**
+   * Provides a {@link GoogleCredentialsBundle} for sending emails through Google Workspace.
+   *
+   * <p>The Workspace domain must grant delegated admin access to the default service account user
+   * (project-id@appspot.gserviceaccount.com on AppEngine) with all scopes in {@code defaultScopes}
+   * and {@code delegationScopes}. In addition, the user {@code gSuiteOutgoingEmailAddress} must
+   * have the permission to send emails.
+   */
+  @GmailDelegatedCredential
+  @Provides
+  @Singleton
+  public static GoogleCredentialsBundle provideSelfSignedGmailDelegatedCredential(
+      @Config("defaultCredentialOauthScopes") ImmutableList<String> defaultScopes,
+      @Config("delegatedCredentialOauthScopes") ImmutableList<String> delegationScopes,
+      @ApplicationDefaultCredential GoogleCredentialsBundle credentialsBundle,
+      @Config("gSuiteNewOutgoingEmailAddress") String gSuiteOutgoingEmailAddress,
+      @Config("tokenRefreshDelay") Duration tokenRefreshDelay,
+      Clock clock) {
+    return createSelfSignedDelegatedCredential(
+        defaultScopes,
+        delegationScopes,
+        credentialsBundle,
+        gSuiteOutgoingEmailAddress,
+        tokenRefreshDelay,
+        clock);
+  }
+
+  public static GoogleCredentialsBundle createSelfSignedDelegatedCredential(
+      ImmutableList<String> defaultScopes,
+      ImmutableList<String> delegationScopes,
+      GoogleCredentialsBundle credentialsBundle,
+      String gSuiteUserEmailAddress,
+      Duration tokenRefreshDelay,
+      Clock clock) {
    GoogleCredentials signer = credentialsBundle.getGoogleCredentials();

    checkArgument(
@@ -118,7 +161,7 @@ public abstract class CredentialModule {
        DelegatedCredentials.createSelfSignedDelegatedCredential(
            (ServiceAccountSigner) signer,
            ImmutableList.<String>builder().addAll(defaultScopes).addAll(delegationScopes).build(),
-            gSuiteAdminAccountEmailAddress,
+            gSuiteUserEmailAddress,
            clock,
            tokenRefreshDelay);
    return GoogleCredentialsBundle.create(credential);
@@ -136,6 +179,15 @@ public abstract class CredentialModule {
  @Retention(RetentionPolicy.RUNTIME)
  public @interface GoogleWorkspaceCredential {}

+  /**
+   * Dagger qualifier for a credential with delegated Email-sending permission for a dasher domain
+   * (for Google Workspace) backed by the application default credential (ADC).
+   */
+  @Qualifier
+  @Documented
+  @Retention(RetentionPolicy.RUNTIME)
+  public @interface GmailDelegatedCredential {}
+
  /**
   * Dagger qualifier for a credential with delegated admin access for a dasher domain (for Google
   * Workspace) backed by the application default credential (ADC).
--- a/core/src/main/java/google/registry/config/RegistryConfig.java
+++ b/core/src/main/java/google/registry/config/RegistryConfig.java
@@ -158,6 +158,12 @@ public final class RegistryConfig {
      return config.registryPolicy.contactAndHostRoidSuffix;
    }

+    @Provides
+    @Config("isEmailSendingEnabled")
+    public static boolean provideIsEmailSendingEnabled(RegistryConfigSettings config) {
+      return config.misc.isEmailSendingEnabled;
+    }
+
    /**
     * The e-mail address for questions about integrating with the registry. Used in the
     * "contact-us" section of the registrar console.
@@ -538,6 +544,13 @@ public final class RegistryConfig {
      return parseEmailAddress(config.gSuite.outgoingEmailAddress);
    }

+    // TODO(b/279671974): reuse the 'gSuiteOutgoingEmailAddress' annotation after migration
+    @Provides
+    @Config("gSuiteNewOutgoingEmailAddress")
+    public static String provideGSuiteNewOutgoingEmailAddress(RegistryConfigSettings config) {
+      return config.gSuite.newOutgoingEmailAddress;
+    }
+
    /**
     * The display name that is used on outgoing emails sent by Nomulus.
     *
@@ -549,6 +562,16 @@ public final class RegistryConfig {
      return config.gSuite.outgoingEmailDisplayName;
    }

+    /**
+     * Provides the `reply-to` address for outgoing email messages. This address may be outside the
+     * GSuite domain.
+     */
+    @Provides
+    @Config("replyToEmailAddress")
+    public static InternetAddress provideReplyToEmailAddress(RegistryConfigSettings config) {
+      return parseEmailAddress(config.gSuite.replyToEmailAddress);
+    }
+
    /**
     * Returns whether an SSL certificate hash is required to log in via EPP and run flows.
     *
@@ -859,6 +882,14 @@ public final class RegistryConfig {
      return parseEmailAddress(config.misc.alertRecipientEmailAddress);
    }

+    // TODO(b/279671974): remove below method after migration
+    @Provides
+    @Config("newAlertRecipientEmailAddress")
+    public static InternetAddress provideNewAlertRecipientEmailAddress(
+        RegistryConfigSettings config) {
+      return parseEmailAddress(config.misc.newAlertRecipientEmailAddress);
+    }
+
    /**
     * Returns the email address to which spec 11 email should be replied.
     *
--- a/core/src/main/java/google/registry/config/RegistryConfigSettings.java
+++ b/core/src/main/java/google/registry/config/RegistryConfigSettings.java
@@ -77,6 +77,9 @@ public class RegistryConfigSettings {
  public static class GSuite {
    public String domainName;
    public String outgoingEmailAddress;
+    // TODO(b/279671974): remove below field after migration
+    public String newOutgoingEmailAddress;
+    public String replyToEmailAddress;
    public String outgoingEmailDisplayName;
    public String adminAccountEmailAddress;
    public String supportGroupEmailAddress;
@@ -202,7 +205,10 @@ public class RegistryConfigSettings {
  /** Miscellaneous configuration that doesn't quite fit in anywhere else. */
  public static class Misc {
    public String sheetExportId;
+    public boolean isEmailSendingEnabled;
    public String alertRecipientEmailAddress;
+    // TODO(b/279671974): remove below field after migration
+    public String newAlertRecipientEmailAddress;
    public String spec11OutgoingEmailAddress;
    public List<String> spec11BccEmailAddresses;
    public int transientFailureRetries;
--- a/core/src/main/java/google/registry/config/files/default-config.yaml
+++ b/core/src/main/java/google/registry/config/files/default-config.yaml
@@ -33,6 +33,9 @@ gSuite:
  # https://cloud.google.com/appengine/docs/standard/java/mail/#who_can_send_mail
  outgoingEmailDisplayName: Example Registry
  outgoingEmailAddress: noreply@project-id.appspotmail.com
+  # TODO(b/279671974): reuse `outgoingEmailAddress` after migration
+  newOutgoingEmailAddress: noreply@example.com
+  replyToEmailAddress: reply-to@example.com

  # Email address of the admin account on the G Suite app. This is used for
  # logging in to perform administrative actions, not sending emails.
@@ -429,9 +432,15 @@ misc:
  # to. Leave this null to disable syncing.
  sheetExportId: null

+  # Whether emails may be sent. For Prod and Sandbox this should be true.
+  isEmailSendingEnabled: false
+
  # Address we send alert summary emails to.
  alertRecipientEmailAddress: email@example.com

+  # TODO(b/279671974): reuse `alertRecipientEmailAddress` after migration
+  newAlertRecipientEmailAddress: email@example.com
+
  # Address from which Spec 11 emails to registrars are sent. This needs
  # to be a deliverable email address to handle replies from registrars as well.
  spec11OutgoingEmailAddress: abuse@example.com
--- a/core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml
@@ -7,7 +7,7 @@
  <sessions-enabled>true</sessions-enabled>
  <instance-class>B4_1G</instance-class>
  <manual-scaling>
-    <instances>12</instances>
+    <instances>24</instances>
  </manual-scaling>

  <system-properties>
--- a/core/src/main/java/google/registry/flows/FlowRunner.java
+++ b/core/src/main/java/google/registry/flows/FlowRunner.java
@@ -72,22 +72,21 @@ public class FlowRunner {
    }
    eppMetricBuilder.setCommandNameFromFlow(flowClass.getSimpleName());
    if (!isTransactional) {
-      EppOutput eppOutput = EppOutput.create(flowProvider.get().run());
-      if (flowClass.equals(LoginFlow.class)) {
-        // In LoginFlow, registrarId isn't known until after the flow executes, so save it then.
-        eppMetricBuilder.setRegistrarId(sessionMetadata.getRegistrarId());
-      }
-      return eppOutput;
+      return EppOutput.create(flowProvider.get().run());
    }
    try {
-      return tm()
-          .transact(
+      return tm().transact(
              () -> {
                try {
                  EppOutput output = EppOutput.create(flowProvider.get().run());
                  if (isDryRun) {
                    throw new DryRunException(output);
                  }
+                  if (flowClass.equals(LoginFlow.class)) {
+                    // In LoginFlow, registrarId isn't known until after the flow executes, so save
+                    // it then.
+                    eppMetricBuilder.setRegistrarId(sessionMetadata.getRegistrarId());
+                  }
                  return output;
                } catch (EppException e) {
                  throw new EppRuntimeException(e);
--- a/core/src/main/java/google/registry/flows/domain/DomainInfoFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainInfoFlow.java
@@ -41,10 +41,10 @@ import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainCommand.Info;
 import google.registry.model.domain.DomainCommand.Info.HostsRequest;
 import google.registry.model.domain.DomainInfoData;
+import google.registry.model.domain.bulktoken.BulkTokenExtension;
+import google.registry.model.domain.bulktoken.BulkTokenResponseExtension;
 import google.registry.model.domain.fee06.FeeInfoCommandExtensionV06;
 import google.registry.model.domain.fee06.FeeInfoResponseExtensionV06;
-import google.registry.model.domain.packagetoken.PackageTokenExtension;
-import google.registry.model.domain.packagetoken.PackageTokenResponseExtension;
 import google.registry.model.domain.rgp.GracePeriodStatus;
 import google.registry.model.domain.rgp.RgpInfoExtension;
 import google.registry.model.eppcommon.AuthInfo;
@@ -95,7 +95,7 @@ public final class DomainInfoFlow implements Flow {

  @Override
  public EppResponse run() throws EppException {
-    extensionManager.register(FeeInfoCommandExtensionV06.class, PackageTokenExtension.class);
+    extensionManager.register(FeeInfoCommandExtensionV06.class, BulkTokenExtension.class);
    flowCustomLogic.beforeValidation();
    validateRegistrarIsLoggedIn(registrarId);
    extensionManager.validate();
@@ -155,13 +155,13 @@ public final class DomainInfoFlow implements Flow {
    if (!gracePeriodStatuses.isEmpty()) {
      extensions.add(RgpInfoExtension.create(gracePeriodStatuses));
    }
-    Optional<PackageTokenExtension> packageInfo =
-        eppInput.getSingleExtension(PackageTokenExtension.class);
+    Optional<BulkTokenExtension> packageInfo =
+        eppInput.getSingleExtension(BulkTokenExtension.class);
    if (packageInfo.isPresent()) {
      // Package info was requested.
      if (isSuperuser || registrarId.equals(domain.getCurrentSponsorRegistrarId())) {
        // Only show package info to owning registrar or superusers
-        extensions.add(PackageTokenResponseExtension.create(domain.getCurrentPackageToken()));
+        extensions.add(BulkTokenResponseExtension.create(domain.getCurrentPackageToken()));
      }
    }
    Optional<FeeInfoCommandExtensionV06> feeInfo =
--- a/core/src/main/java/google/registry/flows/domain/DomainPricingLogic.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainPricingLogic.java
@@ -192,7 +192,7 @@ public final class DomainPricingLogic {
        new FeesAndCredits.Builder()
            .setCurrency(tld.getCurrency())
            .addFeeOrCredit(
-                Fee.create(tld.getStandardRestoreCost().getAmount(), FeeType.RESTORE, false));
+                Fee.create(tld.getRestoreBillingCost().getAmount(), FeeType.RESTORE, false));
    if (isExpired) {
      feesAndCredits.addFeeOrCredit(
          Fee.create(
--- a/core/src/main/java/google/registry/flows/domain/DomainRenewFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainRenewFlow.java
@@ -53,6 +53,8 @@ import google.registry.flows.custom.DomainRenewFlowCustomLogic.BeforeResponseRet
 import google.registry.flows.custom.DomainRenewFlowCustomLogic.BeforeSaveParameters;
 import google.registry.flows.custom.EntityChanges;
 import google.registry.flows.domain.token.AllocationTokenFlowUtils;
+import google.registry.flows.domain.token.AllocationTokenFlowUtils.MissingRemoveDomainTokenOnPackageDomainException;
+import google.registry.flows.domain.token.AllocationTokenFlowUtils.RemoveDomainTokenOnNonPackageDomainException;
 import google.registry.model.ImmutableObject;
 import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingEvent;
@@ -119,10 +121,8 @@ import org.joda.time.Duration;
 * @error {@link DomainFlowUtils.RegistrarMustBeActiveForThisOperationException}
 * @error {@link DomainFlowUtils.UnsupportedFeeAttributeException}
 * @error {@link DomainRenewFlow.IncorrectCurrentExpirationDateException}
- * @error {@link
- *     google.registry.flows.domain.token.AllocationTokenFlowUtils.MissingRemovePackageTokenOnPackageDomainException}
- * @error {@link
- *     google.registry.flows.domain.token.AllocationTokenFlowUtils.RemovePackageTokenOnNonPackageDomainException}
+ * @error {@link MissingRemoveDomainTokenOnPackageDomainException}
+ * @error {@link RemoveDomainTokenOnNonPackageDomainException}
 * @error {@link
 *     google.registry.flows.domain.token.AllocationTokenFlowUtils.AllocationTokenNotValidForDomainException}
 * @error {@link
--- a/core/src/main/java/google/registry/flows/domain/DomainTransferRequestFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainTransferRequestFlow.java
@@ -38,6 +38,7 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.

 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableSortedSet;
 import google.registry.batch.AsyncTaskEnqueuer;
 import google.registry.flows.EppException;
 import google.registry.flows.ExtensionManager;
@@ -286,7 +287,8 @@ public final class DomainTransferRequestFlow implements TransactionalFlow {
            .build();
    DomainHistory domainHistory = buildDomainHistory(newDomain, tld, now, period);

-    asyncTaskEnqueuer.enqueueAsyncResave(newDomain.createVKey(), now, automaticTransferTime);
+    asyncTaskEnqueuer.enqueueAsyncResave(
+        newDomain.createVKey(), now, ImmutableSortedSet.of(automaticTransferTime));
    tm().putAll(
            new ImmutableSet.Builder<>()
                .add(newDomain, domainHistory, requestPollMessage)
--- a/core/src/main/java/google/registry/flows/domain/DomainUpdateFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainUpdateFlow.java
@@ -337,7 +337,7 @@ public final class DomainUpdateFlow implements TransactionalFlow {
                  .setReason(Reason.SERVER_STATUS)
                  .setTargetId(targetId)
                  .setRegistrarId(registrarId)
-                  .setCost(Tld.get(existingDomain.getTld()).getServerStatusChangeCost())
+                  .setCost(Tld.get(existingDomain.getTld()).getServerStatusChangeBillingCost())
                  .setEventTime(now)
                  .setBillingTime(now)
                  .setDomainHistory(historyEntry)
--- a/core/src/main/java/google/registry/flows/domain/token/AllocationTokenFlowUtils.java
+++ b/core/src/main/java/google/registry/flows/domain/token/AllocationTokenFlowUtils.java
@@ -243,21 +243,21 @@ public class AllocationTokenFlowUtils {
      Domain domain, Optional<AllocationToken> allocationToken) throws EppException {

    boolean domainHasPackageToken = domain.getCurrentPackageToken().isPresent();
-    boolean hasRemovePackageToken =
+    boolean hasRemoveDomainToken =
        allocationToken.isPresent()
-            && TokenBehavior.REMOVE_PACKAGE.equals(allocationToken.get().getTokenBehavior());
+            && TokenBehavior.REMOVE_DOMAIN.equals(allocationToken.get().getTokenBehavior());

-    if (hasRemovePackageToken && !domainHasPackageToken) {
-      throw new RemovePackageTokenOnNonPackageDomainException();
-    } else if (!hasRemovePackageToken && domainHasPackageToken) {
-      throw new MissingRemovePackageTokenOnPackageDomainException();
+    if (hasRemoveDomainToken && !domainHasPackageToken) {
+      throw new RemoveDomainTokenOnNonPackageDomainException();
+    } else if (!hasRemoveDomainToken && domainHasPackageToken) {
+      throw new MissingRemoveDomainTokenOnPackageDomainException();
    }
  }

  public static Domain maybeApplyPackageRemovalToken(
      Domain domain, Optional<AllocationToken> allocationToken) {
    if (!allocationToken.isPresent()
-        || !TokenBehavior.REMOVE_PACKAGE.equals(allocationToken.get().getTokenBehavior())) {
+        || !TokenBehavior.REMOVE_DOMAIN.equals(allocationToken.get().getTokenBehavior())) {
      return domain;
    }

@@ -338,19 +338,19 @@ public class AllocationTokenFlowUtils {
    }
  }

-  /** The __REMOVEPACKAGE__ token is missing on a package domain command */
-  public static class MissingRemovePackageTokenOnPackageDomainException
+  /** The __REMOVEDOMAIN__ token is missing on a package domain command */
+  public static class MissingRemoveDomainTokenOnPackageDomainException
      extends AssociationProhibitsOperationException {
-    MissingRemovePackageTokenOnPackageDomainException() {
+    MissingRemoveDomainTokenOnPackageDomainException() {
      super("Domains that are inside packages cannot be explicitly renewed or transferred");
    }
  }

-  /** The __REMOVEPACKAGE__ token is not allowed on non package domains */
-  public static class RemovePackageTokenOnNonPackageDomainException
+  /** The __REMOVEDOMAIN__ token is not allowed on non package domains */
+  public static class RemoveDomainTokenOnNonPackageDomainException
      extends AssociationProhibitsOperationException {
-    RemovePackageTokenOnNonPackageDomainException() {
-      super("__REMOVEPACKAGE__ token is not allowed on non package domains");
+    RemoveDomainTokenOnNonPackageDomainException() {
+      super("__REMOVEDOMAIN__ token is not allowed on non package domains");
    }
  }
 }
--- a/core/src/main/java/google/registry/flows/session/LoginFlow.java
+++ b/core/src/main/java/google/registry/flows/session/LoginFlow.java
@@ -15,6 +15,7 @@
 package google.registry.flows.session;

 import static com.google.common.collect.Sets.difference;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.CollectionUtils.nullToEmpty;

 import com.google.common.collect.ImmutableSet;
@@ -27,11 +28,10 @@ import google.registry.flows.EppException.CommandUseErrorException;
 import google.registry.flows.EppException.ParameterValuePolicyErrorException;
 import google.registry.flows.EppException.UnimplementedExtensionException;
 import google.registry.flows.EppException.UnimplementedObjectServiceException;
-import google.registry.flows.EppException.UnimplementedOptionException;
 import google.registry.flows.ExtensionManager;
-import google.registry.flows.Flow;
 import google.registry.flows.FlowModule.RegistrarId;
 import google.registry.flows.SessionMetadata;
+import google.registry.flows.TransactionalFlow;
 import google.registry.flows.TransportCredentials;
 import google.registry.model.eppcommon.ProtocolDefinition;
 import google.registry.model.eppcommon.ProtocolDefinition.ServiceExtension;
@@ -51,6 +51,7 @@ import javax.inject.Inject;
 * @error {@link google.registry.flows.EppException.UnimplementedExtensionException}
 * @error {@link google.registry.flows.EppException.UnimplementedObjectServiceException}
 * @error {@link google.registry.flows.EppException.UnimplementedProtocolVersionException}
+ * @error {@link google.registry.flows.FlowUtils.GenericXmlSyntaxErrorException}
 * @error {@link google.registry.flows.TlsCredentials.BadRegistrarCertificateException}
 * @error {@link google.registry.flows.TlsCredentials.BadRegistrarIpAddressException}
 * @error {@link google.registry.flows.TlsCredentials.MissingRegistrarCertificateException}
@@ -58,11 +59,10 @@ import javax.inject.Inject;
 * @error {@link LoginFlow.AlreadyLoggedInException}
 * @error {@link BadRegistrarIdException}
 * @error {@link LoginFlow.TooManyFailedLoginsException}
- * @error {@link LoginFlow.PasswordChangesNotSupportedException}
 * @error {@link LoginFlow.RegistrarAccountNotActiveException}
 * @error {@link LoginFlow.UnsupportedLanguageException}
 */
-public class LoginFlow implements Flow {
+public class LoginFlow implements TransactionalFlow {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();

@@ -134,8 +134,13 @@ public class LoginFlow implements Flow {
    if (!registrar.get().isLive()) {
      throw new RegistrarAccountNotActiveException();
    }
-    if (login.getNewPassword() != null) {  // We don't support in-band password changes.
-      throw new PasswordChangesNotSupportedException();
+    if (login.getNewPassword().isPresent()) {
+      // Load fresh from database (bypassing the cache) to ensure we don't save stale data.
+      Optional<Registrar> freshRegistrar = Registrar.loadByRegistrarId(login.getClientId());
+      if (!freshRegistrar.isPresent()) {
+        throw new BadRegistrarIdException(login.getClientId());
+      }
+      tm().put(freshRegistrar.get().asBuilder().setPassword(login.getNewPassword().get()).build());
    }

    // We are in!
@@ -179,11 +184,4 @@ public class LoginFlow implements Flow {
      super("Specified language is not supported");
    }
  }
-
-  /** In-band password changes are not supported. */
-  static class PasswordChangesNotSupportedException extends UnimplementedOptionException {
-    public PasswordChangesNotSupportedException() {
-      super("In-band password changes are not supported");
-    }
-  }
 }
--- a/core/src/main/java/google/registry/groups/GmailClient.java
+++ b/core/src/main/java/google/registry/groups/GmailClient.java
@@ -14,17 +14,24 @@

 package google.registry.groups;

+import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.collect.Iterables.toArray;

+import com.google.api.client.http.HttpResponseException;
 import com.google.api.services.gmail.Gmail;
 import com.google.api.services.gmail.model.Message;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
-import com.google.errorprone.annotations.CanIgnoreReturnValue;
+import google.registry.config.RegistryConfig.Config;
 import google.registry.util.EmailMessage;
 import google.registry.util.EmailMessage.Attachment;
+import google.registry.util.Retrier;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.io.UnsupportedEncodingException;
 import java.util.Properties;
+import java.util.function.Predicate;
 import javax.inject.Inject;
 import javax.mail.Address;
 import javax.mail.BodyPart;
@@ -36,16 +43,37 @@ import javax.mail.internet.InternetAddress;
 import javax.mail.internet.MimeBodyPart;
 import javax.mail.internet.MimeMessage;
 import javax.mail.internet.MimeMultipart;
-import org.apache.commons.codec.binary.Base64;

 /** Sends {@link EmailMessage EmailMessages} through Google Workspace using {@link Gmail}. */
 public final class GmailClient {

+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
  private final Gmail gmail;
+  private final Retrier retrier;
+  private final boolean isEmailSendingEnabled;
+  private final InternetAddress outgoingEmailAddressWithUsername;
+  private final InternetAddress replyToEmailAddress;

  @Inject
-  GmailClient(Gmail gmail) {
+  GmailClient(
+      Gmail gmail,
+      Retrier retrier,
+      @Config("isEmailSendingEnabled") boolean isEmailSendingEnabled,
+      @Config("gSuiteNewOutgoingEmailAddress") String gSuiteOutgoingEmailAddress,
+      @Config("gSuiteOutgoingEmailDisplayName") String gSuiteOutgoingEmailDisplayName,
+      @Config("replyToEmailAddress") InternetAddress replyToEmailAddress) {
+
    this.gmail = gmail;
+    this.retrier = retrier;
+    this.isEmailSendingEnabled = isEmailSendingEnabled;
+    this.replyToEmailAddress = replyToEmailAddress;
+    try {
+      this.outgoingEmailAddressWithUsername =
+          new InternetAddress(gSuiteOutgoingEmailAddress, gSuiteOutgoingEmailDisplayName);
+    } catch (UnsupportedEncodingException e) {
+      throw new RuntimeException(e);
+    }
  }

  /**
@@ -54,14 +82,25 @@ public final class GmailClient {
   * <p>If the sender as specified by {@link EmailMessage#from} differs from the caller's identity,
   * the caller must have delegated `send` authority to the sender.
   */
-  @CanIgnoreReturnValue
-  public Message sendEmail(EmailMessage emailMessage) {
-    Message message = toGmailMessage(toMimeMessage(emailMessage));
-    try {
-      return gmail.users().messages().send("me", message).execute();
-    } catch (IOException e) {
-      throw new EmailException(e);
+  public void sendEmail(EmailMessage emailMessage) {
+    if (!isEmailSendingEnabled) {
+      logger.atInfo().log(
+          String.format(
+              "Email with subject %s would have been sent to recipients %s",
+              emailMessage.subject().substring(0, Math.min(emailMessage.subject().length(), 15)),
+              String.join(
+                  " , ",
+                  emailMessage.recipients().stream()
+                      .map(ia -> ia.toString())
+                      .collect(toImmutableSet()))));
+      return;
    }
+    Message message = toGmailMessage(toMimeMessage(emailMessage));
+    // Unlike other Cloud APIs such as GCS and SecretManager, Gmail does not retry on errors.
+    retrier.callWithRetry(
+        // "me" is reserved word for the authorized user of the Gmail API.
+        () -> this.gmail.users().messages().send("me", message).execute(),
+        RetriableGmailExceptionPredicate.INSTANCE);
  }

  static Message toGmailMessage(MimeMessage message) {
@@ -69,20 +108,18 @@ public final class GmailClient {
      ByteArrayOutputStream buffer = new ByteArrayOutputStream();
      message.writeTo(buffer);
      byte[] rawMessageBytes = buffer.toByteArray();
-      String encodedEmail = Base64.encodeBase64URLSafeString(rawMessageBytes);
-      Message gmailMessage = new Message();
-      gmailMessage.setRaw(encodedEmail);
-      return gmailMessage;
+      return new Message().encodeRaw(rawMessageBytes);
    } catch (MessagingException | IOException e) {
      throw new EmailException(e);
    }
  }

-  static MimeMessage toMimeMessage(EmailMessage emailMessage) {
+  MimeMessage toMimeMessage(EmailMessage emailMessage) {
    try {
      MimeMessage msg =
          new MimeMessage(Session.getDefaultInstance(new Properties(), /* authenticator= */ null));
-      msg.setFrom(emailMessage.from());
+      msg.setFrom(this.outgoingEmailAddressWithUsername);
+      msg.setReplyTo(new InternetAddress[] {replyToEmailAddress});
      msg.addRecipients(
          RecipientType.TO, toArray(emailMessage.recipients(), InternetAddress.class));
      msg.setSubject(emailMessage.subject());
@@ -117,4 +154,41 @@ public final class GmailClient {
      super(cause);
    }
  }
+
+  /**
+   * Determines if a Gmail API exception may be retried.
+   *
+   * <p>See <a href="https://developers.google.com/gmail/api/guides/handle-errors">online doc</a>
+   * for details.
+   */
+  static class RetriableGmailExceptionPredicate implements Predicate<Throwable> {
+
+    static RetriableGmailExceptionPredicate INSTANCE = new RetriableGmailExceptionPredicate();
+
+    private static final int USAGE_LIMIT_EXCEEDED = 403;
+    private static final int TOO_MANY_REQUESTS = 429;
+    private static final int BACKEND_ERROR = 500;
+
+    private static final ImmutableSet<String> TRANSIENT_OVERAGE_REASONS =
+        ImmutableSet.of("userRateLimitExceeded", "rateLimitExceeded");
+
+    @Override
+    public boolean test(Throwable e) {
+      if (e instanceof HttpResponseException) {
+        return testHttpResponse((HttpResponseException) e);
+      }
+      return true;
+    }
+
+    private boolean testHttpResponse(HttpResponseException e) {
+      int statusCode = e.getStatusCode();
+      if (statusCode == TOO_MANY_REQUESTS || statusCode == BACKEND_ERROR) {
+        return true;
+      }
+      if (statusCode == USAGE_LIMIT_EXCEEDED) {
+        return TRANSIENT_OVERAGE_REASONS.contains(e.getStatusMessage());
+      }
+      return false;
+    }
+  }
 }
--- a/core/src/main/java/google/registry/groups/GmailModule.java
+++ b/core/src/main/java/google/registry/groups/GmailModule.java
@@ -17,7 +17,7 @@ package google.registry.groups;
 import com.google.api.services.gmail.Gmail;
 import dagger.Module;
 import dagger.Provides;
-import google.registry.config.CredentialModule.AdcDelegatedCredential;
+import google.registry.config.CredentialModule.GmailDelegatedCredential;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.util.GoogleCredentialsBundle;
 import javax.inject.Singleton;
@@ -29,7 +29,7 @@ public class GmailModule {
  @Provides
  @Singleton
  Gmail provideGmail(
-      @AdcDelegatedCredential GoogleCredentialsBundle credentialsBundle,
+      @GmailDelegatedCredential GoogleCredentialsBundle credentialsBundle,
      @Config("projectId") String projectId) {
    return new Gmail.Builder(
            credentialsBundle.getHttpTransport(),
--- a/core/src/main/java/google/registry/model/EntityYamlUtils.java
+++ b/core/src/main/java/google/registry/model/EntityYamlUtils.java
@@ -0,0 +1,308 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.model;
+
+import static com.google.common.collect.ImmutableSortedMap.toImmutableSortedMap;
+import static com.google.common.collect.Ordering.natural;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.SerializationFeature;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.deser.std.StdDeserializer;
+import com.fasterxml.jackson.databind.module.SimpleModule;
+import com.fasterxml.jackson.databind.ser.std.StdSerializer;
+import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
+import com.fasterxml.jackson.dataformat.yaml.YAMLGenerator.Feature;
+import google.registry.model.common.TimedTransitionProperty;
+import google.registry.model.domain.token.AllocationToken;
+import google.registry.model.tld.Tld.TldState;
+import google.registry.persistence.VKey;
+import java.io.IOException;
+import java.math.BigDecimal;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Optional;
+import java.util.SortedMap;
+import org.joda.money.CurrencyUnit;
+import org.joda.money.Money;
+import org.joda.time.DateTime;
+import org.joda.time.Duration;
+
+/** A collection of static utility classes/functions to convert entities to/from YAML files. */
+public class EntityYamlUtils {
+
+  /**
+   * Returns a new {@link ObjectMapper} object that can be used to convert an entity to/from YAML.
+   */
+  public static ObjectMapper createObjectMapper() {
+    SimpleModule module = new SimpleModule();
+    module.addSerializer(Money.class, new MoneySerializer());
+    module.addDeserializer(Money.class, new MoneyDeserializer());
+    ObjectMapper mapper =
+        new ObjectMapper(new YAMLFactory().disable(Feature.WRITE_DOC_START_MARKER))
+            .disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)
+            .registerModule(module);
+    mapper.findAndRegisterModules();
+    return mapper;
+  }
+
+  /** A custom JSON serializer for {@link Money}. */
+  public static class MoneySerializer extends StdSerializer<Money> {
+
+    public MoneySerializer() {
+      this(null);
+    }
+
+    public MoneySerializer(Class<Money> t) {
+      super(t);
+    }
+
+    @Override
+    public void serialize(Money value, JsonGenerator gen, SerializerProvider provider)
+        throws IOException {
+      gen.writeStartObject();
+      gen.writeStringField("currency", String.valueOf(value.getCurrencyUnit()));
+      gen.writeNumberField("amount", value.getAmount());
+      gen.writeEndObject();
+    }
+  }
+
+  /** A custom JSON deserializer for {@link Money}. */
+  public static class MoneyDeserializer extends StdDeserializer<Money> {
+
+    public MoneyDeserializer() {
+      this(null);
+    }
+
+    public MoneyDeserializer(Class<Money> t) {
+      super(t);
+    }
+
+    static class MoneyJson {
+      public String currency;
+      public BigDecimal amount;
+    }
+
+    @Override
+    public Money deserialize(JsonParser jp, DeserializationContext context) throws IOException {
+      MoneyJson json = jp.readValueAs(MoneyJson.class);
+      CurrencyUnit currencyUnit = CurrencyUnit.of(json.currency);
+      return Money.of(currencyUnit, json.amount);
+    }
+  }
+
+  /** A custom JSON serializer for {@link CurrencyUnit}. */
+  public static class CurrencySerializer extends StdSerializer<CurrencyUnit> {
+
+    public CurrencySerializer() {
+      this(null);
+    }
+
+    public CurrencySerializer(Class<CurrencyUnit> t) {
+      super(t);
+    }
+
+    @Override
+    public void serialize(CurrencyUnit value, JsonGenerator gen, SerializerProvider provider)
+        throws IOException {
+      gen.writeString(value.getCode());
+    }
+  }
+
+  /** A custom JSON deserializer for {@link CurrencyUnit}. */
+  public static class CurrencyDeserializer extends StdDeserializer<CurrencyUnit> {
+
+    public CurrencyDeserializer() {
+      this(null);
+    }
+
+    public CurrencyDeserializer(Class<CurrencyUnit> t) {
+      super(t);
+    }
+
+    @Override
+    public CurrencyUnit deserialize(JsonParser jp, DeserializationContext context)
+        throws IOException {
+      String currencyCode = jp.readValueAs(String.class);
+      return CurrencyUnit.of(currencyCode);
+    }
+  }
+
+  /** A custom JSON serializer for an Optional of a {@link Duration} object. */
+  public static class OptionalDurationSerializer extends StdSerializer<Optional<Duration>> {
+
+    public OptionalDurationSerializer() {
+      this(null);
+    }
+
+    public OptionalDurationSerializer(Class<Optional<Duration>> t) {
+      super(t);
+    }
+
+    @Override
+    public void serialize(Optional<Duration> value, JsonGenerator gen, SerializerProvider provider)
+        throws IOException {
+      if (value.isPresent()) {
+        gen.writeNumber(value.get().getMillis());
+      } else {
+        gen.writeNull();
+      }
+    }
+  }
+
+  /** A custom JSON serializer for an Optional String. */
+  public static class OptionalStringSerializer extends StdSerializer<Optional<String>> {
+
+    public OptionalStringSerializer() {
+      this(null);
+    }
+
+    public OptionalStringSerializer(Class<Optional<String>> t) {
+      super(t);
+    }
+
+    @Override
+    public void serialize(Optional<String> value, JsonGenerator gen, SerializerProvider provider)
+        throws IOException {
+      if (value.isPresent()) {
+        gen.writeString(value.get());
+      } else {
+        gen.writeNull();
+      }
+    }
+  }
+
+  /** A custom JSON serializer for a list of {@link AllocationToken} VKeys. */
+  public static class TokenVKeyListSerializer extends StdSerializer<List<VKey<AllocationToken>>> {
+
+    public TokenVKeyListSerializer() {
+      this(null);
+    }
+
+    public TokenVKeyListSerializer(Class<List<VKey<AllocationToken>>> t) {
+      super(t);
+    }
+
+    @Override
+    public void serialize(
+        List<VKey<AllocationToken>> list, JsonGenerator gen, SerializerProvider provider)
+        throws IOException {
+      gen.writeStartArray();
+      for (VKey<AllocationToken> vkey : list) {
+        gen.writeString(vkey.getKey().toString());
+      }
+      gen.writeEndArray();
+    }
+  }
+
+  /** A custom JSON deserializer for a list of {@link AllocationToken} VKeys. */
+  public static class TokenVKeyListDeserializer
+      extends StdDeserializer<List<VKey<AllocationToken>>> {
+
+    public TokenVKeyListDeserializer() {
+      this(null);
+    }
+
+    public TokenVKeyListDeserializer(Class<VKey<AllocationToken>> t) {
+      super(t);
+    }
+
+    @Override
+    public List<VKey<AllocationToken>> deserialize(JsonParser jp, DeserializationContext context)
+        throws IOException {
+      List<VKey<AllocationToken>> tokens = new ArrayList<>();
+      String[] keyStrings = jp.readValueAs(String[].class);
+      for (String token : keyStrings) {
+        tokens.add(VKey.create(AllocationToken.class, token));
+      }
+      return tokens;
+    }
+  }
+
+  /** A custom JSON deserializer for a {@link TimedTransitionProperty} of {@link TldState}. */
+  public static class TimedTransitionPropertyTldStateDeserializer
+      extends StdDeserializer<TimedTransitionProperty<TldState>> {
+
+    public TimedTransitionPropertyTldStateDeserializer() {
+      this(null);
+    }
+
+    public TimedTransitionPropertyTldStateDeserializer(Class<TimedTransitionProperty<TldState>> t) {
+      super(t);
+    }
+
+    @Override
+    public TimedTransitionProperty<TldState> deserialize(
+        JsonParser jp, DeserializationContext context) throws IOException {
+      SortedMap<String, String> valueMap = jp.readValueAs(SortedMap.class);
+      return TimedTransitionProperty.fromValueMap(
+          valueMap.keySet().stream()
+              .collect(
+                  toImmutableSortedMap(
+                      natural(), DateTime::parse, key -> TldState.valueOf(valueMap.get(key)))));
+    }
+  }
+
+  /** A custom JSON deserializer for a {@link TimedTransitionProperty} of {@link Money}. */
+  public static class TimedTransitionPropertyMoneyDeserializer
+      extends StdDeserializer<TimedTransitionProperty<Money>> {
+
+    public TimedTransitionPropertyMoneyDeserializer() {
+      this(null);
+    }
+
+    public TimedTransitionPropertyMoneyDeserializer(Class<TimedTransitionProperty<Money>> t) {
+      super(t);
+    }
+
+    @Override
+    public TimedTransitionProperty<Money> deserialize(JsonParser jp, DeserializationContext context)
+        throws IOException {
+      SortedMap<String, LinkedHashMap> valueMap = jp.readValueAs(SortedMap.class);
+      return TimedTransitionProperty.fromValueMap(
+          valueMap.keySet().stream()
+              .collect(
+                  toImmutableSortedMap(
+                      natural(),
+                      DateTime::parse,
+                      key ->
+                          Money.of(
+                              CurrencyUnit.of(valueMap.get(key).get("currency").toString()),
+                              (double) valueMap.get(key).get("amount")))));
+    }
+  }
+
+  /** A custom JSON deserializer for a {@link CreateAutoTimestamp}. */
+  public static class CreateAutoTimestampDeserializer extends StdDeserializer<CreateAutoTimestamp> {
+
+    public CreateAutoTimestampDeserializer() {
+      this(null);
+    }
+
+    public CreateAutoTimestampDeserializer(Class<CreateAutoTimestamp> t) {
+      super(t);
+    }
+
+    @Override
+    public CreateAutoTimestamp deserialize(JsonParser jp, DeserializationContext context)
+        throws IOException {
+      DateTime creationTime = jp.readValueAs(DateTime.class);
+      return CreateAutoTimestamp.create(creationTime);
+    }
+  }
+}
--- a/core/src/main/java/google/registry/model/ModelModule.java
+++ b/core/src/main/java/google/registry/model/ModelModule.java
@@ -0,0 +1,30 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import dagger.Module;
+import dagger.Provides;
+
+/** Dagger module for the entity (model) classes. */
+@Module
+public final class ModelModule {
+
+  /** Returns an {@link ObjectMapper} object that can be used to convert an entity to/from YAML. */
+  @Provides
+  public static ObjectMapper provideObjectMapper() {
+    return EntityYamlUtils.createObjectMapper();
+  }
+}
--- a/core/src/main/java/google/registry/model/adapters/CurrencyJsonAdapter.java
+++ b/core/src/main/java/google/registry/model/adapters/CurrencyJsonAdapter.java
@@ -0,0 +1,32 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.adapters;
+
+import google.registry.model.adapters.CurrencyUnitAdapter.UnknownCurrencyException;
+import google.registry.util.StringBaseTypeAdapter;
+import java.io.IOException;
+import org.joda.money.CurrencyUnit;
+
+public class CurrencyJsonAdapter extends StringBaseTypeAdapter<CurrencyUnit> {
+
+  @Override
+  protected CurrencyUnit fromString(String stringValue) throws IOException {
+    try {
+      return CurrencyUnitAdapter.convertFromString(stringValue);
+    } catch (UnknownCurrencyException e) {
+      throw new IOException("Unknown currency");
+    }
+  }
+}
--- a/core/src/main/java/google/registry/model/adapters/CurrencyUnitAdapter.java
+++ b/core/src/main/java/google/registry/model/adapters/CurrencyUnitAdapter.java
@@ -1,4 +1,4 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -22,9 +22,7 @@ import org.joda.money.CurrencyUnit;
 /** Adapter to use Joda {@link CurrencyUnit} when marshalling strings. */
 public class CurrencyUnitAdapter extends XmlAdapter<String, CurrencyUnit> {

-  /** Parses a string into a {@link CurrencyUnit} object. */
-  @Override
-  public CurrencyUnit unmarshal(String currency) throws UnknownCurrencyException {
+  public static CurrencyUnit convertFromString(String currency) throws UnknownCurrencyException {
    try {
      return CurrencyUnit.of(nullToEmpty(currency).trim());
    } catch (IllegalArgumentException e) {
@@ -32,10 +30,20 @@ public class CurrencyUnitAdapter extends XmlAdapter<String, CurrencyUnit> {
    }
  }

+  public static String convertFromCurrency(CurrencyUnit currency) {
+    return currency == null ? null : currency.toString();
+  }
+
+  /** Parses a string into a {@link CurrencyUnit} object. */
+  @Override
+  public CurrencyUnit unmarshal(String currency) throws UnknownCurrencyException {
+    return convertFromString(currency);
+  }
+
  /** Converts {@link CurrencyUnit} to a string. */
  @Override
  public String marshal(CurrencyUnit currency) {
-    return currency == null ? null : currency.toString();
+    return convertFromCurrency(currency);
  }

  /** Exception to throw when failing to parse a currency. */
--- a/core/src/main/java/google/registry/model/domain/packagetoken/PackageTokenExtension.java
+++ b/core/src/main/java/google/registry/model/domain/packagetoken/PackageTokenExtension.java
@@ -12,12 +12,12 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-package google.registry.model.domain.packagetoken;
+package google.registry.model.domain.bulktoken;

 import google.registry.model.ImmutableObject;
 import google.registry.model.eppinput.EppInput.CommandExtension;
 import javax.xml.bind.annotation.XmlRootElement;

-/** A package token extension that may be present on EPP domain commands. */
+/** A bulk token extension that may be present on EPP domain commands. */
@XmlRootElement(name = "info")
-public class PackageTokenExtension extends ImmutableObject implements CommandExtension {}
+public class BulkTokenExtension extends ImmutableObject implements CommandExtension {}
--- a/core/src/main/java/google/registry/model/domain/packagetoken/PackageTokenResponseExtension.java
+++ b/core/src/main/java/google/registry/model/domain/packagetoken/PackageTokenResponseExtension.java
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-package google.registry.model.domain.packagetoken;
+package google.registry.model.domain.bulktoken;

 import google.registry.model.ImmutableObject;
 import google.registry.model.domain.token.AllocationToken;
@@ -24,18 +24,18 @@ import javax.xml.bind.annotation.XmlRootElement;
 import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;

 /**
- * An XML data object that represents a package token extension that may be present on the response
- * to EPP domain info commands.
+ * An XML data object that represents a bulk token extension that may be present on the response to
+ * EPP domain info commands.
 */
-@XmlRootElement(name = "packageData")
-public class PackageTokenResponseExtension extends ImmutableObject implements ResponseExtension {
+@XmlRootElement(name = "bulkData")
+public class BulkTokenResponseExtension extends ImmutableObject implements ResponseExtension {

  /** Token string of the PACKAGE token the name belongs to. */
  @XmlJavaTypeAdapter(TrimWhitespaceAdapter.class)
  String token;

-  public static PackageTokenResponseExtension create(Optional<VKey<AllocationToken>> tokenKey) {
-    PackageTokenResponseExtension instance = new PackageTokenResponseExtension();
+  public static BulkTokenResponseExtension create(Optional<VKey<AllocationToken>> tokenKey) {
+    BulkTokenResponseExtension instance = new BulkTokenResponseExtension();
    instance.token = "";
    if (tokenKey.isPresent()) {
      instance.token = tokenKey.get().getKey().toString();
--- a/core/src/main/java/google/registry/model/domain/packagetoken/package-info.java
+++ b/core/src/main/java/google/registry/model/domain/packagetoken/package-info.java
@@ -13,12 +13,11 @@
 // limitations under the License.

@XmlSchema(
-    namespace = "urn:google:params:xml:ns:packageToken-1.0",
-    xmlns =
-        @XmlNs(prefix = "packageToken", namespaceURI = "urn:google:params:xml:ns:packageToken-1.0"),
+    namespace = "urn:google:params:xml:ns:bulkToken-1.0",
+    xmlns = @XmlNs(prefix = "bulkToken", namespaceURI = "urn:google:params:xml:ns:bulkToken-1.0"),
    elementFormDefault = XmlNsForm.QUALIFIED)
@XmlAccessorType(XmlAccessType.FIELD)
-package google.registry.model.domain.packagetoken;
+package google.registry.model.domain.bulktoken;

 import javax.xml.bind.annotation.XmlAccessType;
 import javax.xml.bind.annotation.XmlAccessorType;
--- a/core/src/main/java/google/registry/model/domain/token/AllocationToken.java
+++ b/core/src/main/java/google/registry/model/domain/token/AllocationToken.java
@@ -77,10 +77,10 @@ import org.joda.time.DateTime;
 public class AllocationToken extends UpdateAutoTimestampEntity implements Buildable {

  private static final long serialVersionUID = -3954475393220876903L;
-  private static final String REMOVE_PACKAGE = "__REMOVEPACKAGE__";
+  private static final String REMOVE_DOMAIN = "__REMOVEDOMAIN__";

  private static final ImmutableMap<String, TokenBehavior> STATIC_TOKEN_BEHAVIORS =
-      ImmutableMap.of(REMOVE_PACKAGE, TokenBehavior.REMOVE_PACKAGE);
+      ImmutableMap.of(REMOVE_DOMAIN, TokenBehavior.REMOVE_DOMAIN);

  // Promotions should only move forward, and ENDED / CANCELLED are terminal states.
  private static final ImmutableMultimap<TokenStatus, TokenStatus> VALID_TOKEN_STATUS_TRANSITIONS =
@@ -91,10 +91,10 @@ public class AllocationToken extends UpdateAutoTimestampEntity implements Builda

  private static final ImmutableMap<String, AllocationToken> BEHAVIORAL_TOKENS =
      ImmutableMap.of(
-          REMOVE_PACKAGE,
+          REMOVE_DOMAIN,
          new AllocationToken.Builder()
              .setTokenType(TokenType.UNLIMITED_USE)
-              .setToken(REMOVE_PACKAGE)
+              .setToken(REMOVE_DOMAIN)
              .build());

  public static Optional<AllocationToken> maybeGetStaticTokenInstance(String name) {
@@ -137,10 +137,10 @@ public class AllocationToken extends UpdateAutoTimestampEntity implements Builda
    /** No special behavior */
    DEFAULT,
    /**
-     * REMOVE_PACKAGE triggers domain removal from promotional package, bypasses DEFAULT token
-     * validations.
+     * REMOVE_DOMAIN triggers domain removal from promotional bulk (package) pricing, bypasses
+     * DEFAULT token validations.
     */
-    REMOVE_PACKAGE
+    REMOVE_DOMAIN
  }

  /** The status of this token with regard to any potential promotion. */
--- a/core/src/main/java/google/registry/model/eppcommon/Address.java
+++ b/core/src/main/java/google/registry/model/eppcommon/Address.java
@@ -20,6 +20,7 @@ import static google.registry.util.CollectionUtils.nullToEmptyImmutableCopy;

 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableList;
+import com.google.gson.annotations.Expose;
 import google.registry.model.Buildable;
 import google.registry.model.ImmutableObject;
 import google.registry.model.JsonMapBuilder;
@@ -87,6 +88,7 @@ public class Address extends ImmutableObject implements Jsonifiable, UnsafeSeria
   */
  @XmlJavaTypeAdapter(NormalizedStringAdapter.class)
  @Transient
+  @Expose
  protected List<String> street;

  @XmlTransient @IgnoredInDiffableMap protected String streetLine1;
@@ -96,18 +98,22 @@ public class Address extends ImmutableObject implements Jsonifiable, UnsafeSeria
  @XmlTransient @IgnoredInDiffableMap protected String streetLine3;

  @XmlJavaTypeAdapter(NormalizedStringAdapter.class)
+  @Expose
  protected String city;

  @XmlElement(name = "sp")
  @XmlJavaTypeAdapter(NormalizedStringAdapter.class)
+  @Expose
  protected String state;

  @XmlElement(name = "pc")
  @XmlJavaTypeAdapter(CollapsedStringAdapter.class)
+  @Expose
  protected String zip;

  @XmlElement(name = "cc")
  @XmlJavaTypeAdapter(CollapsedStringAdapter.class)
+  @Expose
  protected String countryCode;

  public ImmutableList<String> getStreet() {
--- a/core/src/main/java/google/registry/model/eppcommon/EppXmlTransformer.java
+++ b/core/src/main/java/google/registry/model/eppcommon/EppXmlTransformer.java
@@ -51,7 +51,7 @@ public class EppXmlTransformer  {
          "allocate.xsd",
          "superuser.xsd",
          "allocationToken-1.0.xsd",
-          "packageToken.xsd");
+          "bulkToken.xsd");

  private static final XmlTransformer INPUT_TRANSFORMER =
      new XmlTransformer(SCHEMAS, EppInput.class);
--- a/core/src/main/java/google/registry/model/eppinput/EppInput.java
+++ b/core/src/main/java/google/registry/model/eppinput/EppInput.java
@@ -23,6 +23,7 @@ import com.google.common.collect.ImmutableSet;
 import google.registry.model.ImmutableObject;
 import google.registry.model.contact.ContactCommand;
 import google.registry.model.domain.DomainCommand;
+import google.registry.model.domain.bulktoken.BulkTokenExtension;
 import google.registry.model.domain.fee06.FeeCheckCommandExtensionV06;
 import google.registry.model.domain.fee06.FeeCreateCommandExtensionV06;
 import google.registry.model.domain.fee06.FeeInfoCommandExtensionV06;
@@ -45,7 +46,6 @@ import google.registry.model.domain.launch.LaunchDeleteExtension;
 import google.registry.model.domain.launch.LaunchInfoExtension;
 import google.registry.model.domain.launch.LaunchUpdateExtension;
 import google.registry.model.domain.metadata.MetadataExtension;
-import google.registry.model.domain.packagetoken.PackageTokenExtension;
 import google.registry.model.domain.rgp.RgpUpdateExtension;
 import google.registry.model.domain.secdns.SecDnsCreateExtension;
 import google.registry.model.domain.secdns.SecDnsUpdateExtension;
@@ -291,8 +291,8 @@ public class EppInput extends ImmutableObject {
      return password;
    }

-    public String getNewPassword() {
-      return newPassword;
+    public Optional<String> getNewPassword() {
+      return Optional.ofNullable(newPassword);
    }

    public Options getOptions() {
@@ -362,8 +362,8 @@ public class EppInput extends ImmutableObject {

      // Other extensions
      @XmlElementRef(type = AllocationTokenExtension.class),
+      @XmlElementRef(type = BulkTokenExtension.class),
      @XmlElementRef(type = MetadataExtension.class),
-      @XmlElementRef(type = PackageTokenExtension.class),
      @XmlElementRef(type = RgpUpdateExtension.class),
      @XmlElementRef(type = SecDnsCreateExtension.class),
      @XmlElementRef(type = SecDnsUpdateExtension.class)
--- a/core/src/main/java/google/registry/model/eppoutput/EppResponse.java
+++ b/core/src/main/java/google/registry/model/eppoutput/EppResponse.java
@@ -23,6 +23,7 @@ import google.registry.model.ImmutableObject;
 import google.registry.model.contact.ContactInfoData;
 import google.registry.model.domain.DomainInfoData;
 import google.registry.model.domain.DomainRenewData;
+import google.registry.model.domain.bulktoken.BulkTokenResponseExtension;
 import google.registry.model.domain.fee06.FeeCheckResponseExtensionV06;
 import google.registry.model.domain.fee06.FeeCreateResponseExtensionV06;
 import google.registry.model.domain.fee06.FeeDeleteResponseExtensionV06;
@@ -43,7 +44,6 @@ import google.registry.model.domain.fee12.FeeRenewResponseExtensionV12;
 import google.registry.model.domain.fee12.FeeTransferResponseExtensionV12;
 import google.registry.model.domain.fee12.FeeUpdateResponseExtensionV12;
 import google.registry.model.domain.launch.LaunchCheckResponseExtension;
-import google.registry.model.domain.packagetoken.PackageTokenResponseExtension;
 import google.registry.model.domain.rgp.RgpInfoExtension;
 import google.registry.model.domain.secdns.SecDnsInfoExtension;
 import google.registry.model.eppcommon.Trid;
@@ -122,6 +122,7 @@ public class EppResponse extends ImmutableObject implements ResponseOrGreeting {

  /** Zero or more response extensions. */
  @XmlElementRefs({
+    @XmlElementRef(type = BulkTokenResponseExtension.class),
    @XmlElementRef(type = FeeCheckResponseExtensionV06.class),
    @XmlElementRef(type = FeeInfoResponseExtensionV06.class),
    @XmlElementRef(type = FeeCreateResponseExtensionV06.class),
@@ -142,7 +143,6 @@ public class EppResponse extends ImmutableObject implements ResponseOrGreeting {
    @XmlElementRef(type = FeeTransferResponseExtensionV12.class),
    @XmlElementRef(type = FeeUpdateResponseExtensionV12.class),
    @XmlElementRef(type = LaunchCheckResponseExtension.class),
-    @XmlElementRef(type = PackageTokenResponseExtension.class),
    @XmlElementRef(type = RgpInfoExtension.class),
    @XmlElementRef(type = SecDnsInfoExtension.class)
  })
--- a/core/src/main/java/google/registry/model/pricing/StaticPremiumListPricingEngine.java
+++ b/core/src/main/java/google/registry/model/pricing/StaticPremiumListPricingEngine.java
@@ -42,7 +42,7 @@ public final class StaticPremiumListPricingEngine implements PremiumPricingEngin
        tld.getPremiumListName().flatMap(pl -> PremiumListDao.getPremiumPrice(pl, label));
    return DomainPrices.create(
        premiumPrice.isPresent(),
-        premiumPrice.orElse(tld.getStandardCreateCost()),
+        premiumPrice.orElse(tld.getCreateBillingCost()),
        premiumPrice.orElse(tld.getStandardRenewCost(priceTime)));
  }
 }
--- a/core/src/main/java/google/registry/model/registrar/Registrar.java
+++ b/core/src/main/java/google/registry/model/registrar/Registrar.java
@@ -211,6 +211,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
   */
  @Id
  @Column(nullable = false)
+  @Expose
  String registrarId;

  /**
@@ -224,6 +225,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
   * @see <a href="http://www.icann.org/registrar-reports/accredited-list.html">ICANN-Accredited
   *     Registrars</a>
   */
+  @Expose
  @Column(nullable = false)
  String registrarName;

@@ -237,7 +239,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
  State state;

  /** The set of TLDs which this registrar is allowed to access. */
-  Set<String> allowedTlds;
+  @Expose Set<String> allowedTlds;

  /** Host name of WHOIS server. */
  String whoisServer;
@@ -287,6 +289,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
   * unrestricted UTF-8.
   */
  @Embedded
+  @Expose
  @AttributeOverrides({
    @AttributeOverride(
        name = "streetLine1",
@@ -329,7 +332,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
  String faxNumber;

  /** Email address. */
-  String emailAddress;
+  @Expose String emailAddress;

  // External IDs.

@@ -345,7 +348,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
   * @see <a href="http://www.iana.org/assignments/registrar-ids/registrar-ids.txt">Registrar
   *     IDs</a>
   */
-  @Nullable Long ianaIdentifier;
+  @Expose @Nullable Long ianaIdentifier;

  /** Purchase Order number used for invoices in external billing system, if applicable. */
  @Nullable String poNumber;
@@ -358,7 +361,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
   * accessed by {@link #getBillingAccountMap}, a sorted map is returned to guarantee deterministic
   * behavior when serializing the map, for display purpose for instance.
   */
-  @Nullable Map<CurrencyUnit, String> billingAccountMap;
+  @Expose @Nullable Map<CurrencyUnit, String> billingAccountMap;

  /** URL of registrar's website. */
  String url;
@@ -369,10 +372,10 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
   * <p>This value is specified in the initial registrar contact. It can't be edited in the web GUI,
   * and it must be specified when the registrar account is created.
   */
-  String icannReferralEmail;
+  @Expose String icannReferralEmail;

  /** Id of the folder in drive used to publish information for this registrar. */
-  String driveFolderId;
+  @Expose String driveFolderId;

  // Metadata.

@@ -400,7 +403,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
  boolean contactsRequireSyncing = true;

  /** Whether or not registry lock is allowed for this registrar. */
-  boolean registryLockAllowed = false;
+  @Expose boolean registryLockAllowed = false;

  public String getRegistrarId() {
    return registrarId;
--- a/core/src/main/java/google/registry/model/tld/Tld.java
+++ b/core/src/main/java/google/registry/model/tld/Tld.java
@@ -26,6 +26,10 @@ import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 import static org.joda.money.CurrencyUnit.USD;

+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
 import com.github.benmanes.caffeine.cache.CacheLoader;
 import com.github.benmanes.caffeine.cache.LoadingCache;
 import com.google.common.annotations.VisibleForTesting;
@@ -41,6 +45,15 @@ import com.google.common.net.InternetDomainName;
 import google.registry.model.Buildable;
 import google.registry.model.CacheUtils;
 import google.registry.model.CreateAutoTimestamp;
+import google.registry.model.EntityYamlUtils.CreateAutoTimestampDeserializer;
+import google.registry.model.EntityYamlUtils.CurrencyDeserializer;
+import google.registry.model.EntityYamlUtils.CurrencySerializer;
+import google.registry.model.EntityYamlUtils.OptionalDurationSerializer;
+import google.registry.model.EntityYamlUtils.OptionalStringSerializer;
+import google.registry.model.EntityYamlUtils.TimedTransitionPropertyMoneyDeserializer;
+import google.registry.model.EntityYamlUtils.TimedTransitionPropertyTldStateDeserializer;
+import google.registry.model.EntityYamlUtils.TokenVKeyListDeserializer;
+import google.registry.model.EntityYamlUtils.TokenVKeyListSerializer;
 import google.registry.model.ImmutableObject;
 import google.registry.model.UnsafeSerializable;
 import google.registry.model.common.TimedTransitionProperty;
@@ -281,6 +294,7 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
   *
   * <p>When this field is null, the "dnsDefaultATtl" value from the config file will be used.
   */
+  @JsonSerialize(using = OptionalDurationSerializer.class)
  Duration dnsAPlusAaaaTtl;

  /**
@@ -288,6 +302,7 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
   *
   * <p>When this field is null, the "dnsDefaultNsTtl" value from the config file will be used.
   */
+  @JsonSerialize(using = OptionalDurationSerializer.class)
  Duration dnsNsTtl;

  /**
@@ -295,6 +310,7 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
   *
   * <p>When this field is null, the "dnsDefaultDsTtl" value from the config file will be used.
   */
+  @JsonSerialize(using = OptionalDurationSerializer.class)
  Duration dnsDsTtl;
  /**
   * The unicode-aware representation of the TLD associated with this {@link Tld}.
@@ -328,11 +344,13 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl

  /** A property that transitions to different {@link TldState}s at different times. */
  @Column(nullable = false)
+  @JsonDeserialize(using = TimedTransitionPropertyTldStateDeserializer.class)
  TimedTransitionProperty<TldState> tldStateTransitions =
      TimedTransitionProperty.withInitialValue(DEFAULT_TLD_STATE);

  /** An automatically managed creation timestamp. */
  @Column(nullable = false)
+  @JsonDeserialize(using = CreateAutoTimestampDeserializer.class)
  CreateAutoTimestamp creationTime = CreateAutoTimestamp.create(null);

  /** The set of reserved list names that are applicable to this tld. */
@@ -359,6 +377,7 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
   * the database should be queried for the entity with this name that has the largest revision ID.
   */
  @Column(name = "premium_list_name")
+  @JsonSerialize(using = OptionalStringSerializer.class)
  String premiumListName;

  /** Should RDE upload a nightly escrow deposit for this TLD? */
@@ -408,6 +427,8 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl

  /** The currency unit for all costs associated with this TLD. */
  @Column(nullable = false)
+  @JsonSerialize(using = CurrencySerializer.class)
+  @JsonDeserialize(using = CurrencyDeserializer.class)
  CurrencyUnit currency = DEFAULT_CURRENCY;

  /** The per-year billing cost for registering a new domain name. */
@@ -454,11 +475,13 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
   * renewal to ensure transfers have a cost.
   */
  @Column(nullable = false)
+  @JsonDeserialize(using = TimedTransitionPropertyMoneyDeserializer.class)
  TimedTransitionProperty<Money> renewBillingCostTransitions =
      TimedTransitionProperty.withInitialValue(DEFAULT_RENEW_BILLING_COST);

  /** A property that tracks the EAP fee schedule (if any) for the TLD. */
  @Column(nullable = false)
+  @JsonDeserialize(using = TimedTransitionPropertyMoneyDeserializer.class)
  TimedTransitionProperty<Money> eapFeeSchedule =
      TimedTransitionProperty.withInitialValue(DEFAULT_EAP_BILLING_COST);

@@ -475,6 +498,11 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
  /** An allowlist of hosts allowed to be used on domains on this TLD (ignored if empty). */
  @Nullable Set<String> allowedFullyQualifiedHostNames;

+  /**
+   * Indicates when the TLD is being modified using locally modified files to override the source
+   * control procedures. This field is ignored in Tld YAML files.
+   */
+  @JsonIgnore
  @Column(nullable = false)
  boolean breakglassMode = false;

@@ -488,6 +516,8 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
   * (ex: add a token to the list or remove a token from the list) should not be allowed without
   * resetting the entire list contents.
   */
+  @JsonSerialize(using = TokenVKeyListSerializer.class)
+  @JsonDeserialize(using = TokenVKeyListDeserializer.class)
  List<VKey<AllocationToken>> defaultPromoTokens;

  /** A set of allowed {@link IdnTableEnum}s for this TLD, or empty if we should use the default. */
@@ -502,6 +532,7 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
  }

  /** Retrieve the actual domain name representing the TLD for which this registry operates. */
+  @JsonIgnore
  public InternetDomainName getTld() {
    return InternetDomainName.from(tldStr);
  }
@@ -511,6 +542,11 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
    return tldType;
  }

+  /** Retrieve whether invoicing is enabled. */
+  public boolean isInvoicingEnabled() {
+    return invoicingEnabled;
+  }
+
  /**
   * Retrieve the TLD state at the given time. Defaults to {@link TldState#PREDELEGATION}.
   *
@@ -588,7 +624,7 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
   * domain create.
   */
  @VisibleForTesting
-  public Money getStandardCreateCost() {
+  public Money getCreateBillingCost() {
    return createBillingCost;
  }

@@ -596,7 +632,7 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
   * Returns the add-on cost of a domain restore (the flat tld-wide fee charged in addition to one
   * year of renewal for that name).
   */
-  public Money getStandardRestoreCost() {
+  public Money getRestoreBillingCost() {
    return restoreBillingCost;
  }

@@ -610,7 +646,7 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
  }

  /** Returns the cost of a server status change (i.e. lock). */
-  public Money getServerStatusChangeCost() {
+  public Money getServerStatusChangeBillingCost() {
    return serverStatusChangeBillingCost;
  }

@@ -648,6 +684,7 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
  }

  @VisibleForTesting
+  @JsonProperty("eapFeeSchedule")
  public ImmutableSortedMap<DateTime, Money> getEapFeeScheduleAsMap() {
    return eapFeeSchedule.toValueMap();
  }
@@ -660,7 +697,7 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
    return claimsPeriodEnd;
  }

-  public String getPremiumPricingEngineClassName() {
+  public String getPricingEngineClassName() {
    return pricingEngineClassName;
  }

@@ -688,6 +725,11 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
    return Optional.ofNullable(dnsDsTtl);
  }

+  /** Retrieve the TLD unicode representation. */
+  public String getTldUnicode() {
+    return tldUnicode;
+  }
+
  public ImmutableSet<String> getAllowedRegistrantContactIds() {
    return nullToEmptyImmutableCopy(allowedRegistrantContactIds);
  }
@@ -1037,13 +1079,13 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
      // All costs must be in the expected currency.
      checkArgumentNotNull(instance.getCurrency(), "Currency must be set");
      checkArgument(
-          instance.getStandardCreateCost().getCurrencyUnit().equals(instance.currency),
+          instance.getCreateBillingCost().getCurrencyUnit().equals(instance.currency),
          "Create cost must be in the tld's currency");
      checkArgument(
-          instance.getStandardRestoreCost().getCurrencyUnit().equals(instance.currency),
+          instance.getRestoreBillingCost().getCurrencyUnit().equals(instance.currency),
          "Restore cost must be in the TLD's currency");
      checkArgument(
-          instance.getServerStatusChangeCost().getCurrencyUnit().equals(instance.currency),
+          instance.getServerStatusChangeBillingCost().getCurrencyUnit().equals(instance.currency),
          "Server status change cost must be in the TLD's currency");
      checkArgument(
          instance.getRegistryLockOrUnlockBillingCost().getCurrencyUnit().equals(instance.currency),
--- a/core/src/main/java/google/registry/monitoring/whitebox/StackdriverModule.java
+++ b/core/src/main/java/google/registry/monitoring/whitebox/StackdriverModule.java
@@ -25,17 +25,31 @@ import dagger.Module;
 import dagger.Provides;
 import google.registry.config.CredentialModule.ApplicationDefaultCredential;
 import google.registry.config.RegistryConfig.Config;
+import google.registry.util.Clock;
 import google.registry.util.GoogleCredentialsBundle;
+import javax.inject.Named;
+import javax.inject.Singleton;
 import org.joda.time.Duration;

 /** Dagger module for Google Stackdriver service connection objects. */
@Module
 public final class StackdriverModule {

+  private StackdriverModule() {}
+
  // We need a fake GCE zone to appease Stackdriver's resource model.
  // TODO(b/265973059): Switch to resource type "gke_container".
  private static final String SPOOFED_GCE_ZONE = "us-central1-f";
-  private static final String SPOOFED_GCE_INSTANCE = "fake-instance";
+
+  // We cannot use a static fake intance ID which is shared by all instances, because metrics might
+  // be flushed to stackdriver with delays, which lead to time inversion erros when another instance
+  // has already written a data point at a later time.
+  @Singleton
+  @Provides
+  @Named("spoofedGceInstanceId")
+  static String providesSpoofedGceInstanceId(Clock clock) {
+    return clock.nowUtc().toString();
+  }

  @Provides
  static Monitoring provideMonitoring(
@@ -54,7 +68,8 @@ public final class StackdriverModule {
      Monitoring monitoringClient,
      @Config("projectId") String projectId,
      @Config("stackdriverMaxQps") int maxQps,
-      @Config("stackdriverMaxPointsPerRequest") int maxPointsPerRequest) {
+      @Config("stackdriverMaxPointsPerRequest") int maxPointsPerRequest,
+      @Named("spoofedGceInstanceId") String instanceId) {
    // The MonitoredResource for GAE apps is not writable (and missing fields anyway) so we just
    // use the gce_instance resource type instead.
    return new StackdriverWriter(
@@ -65,7 +80,7 @@ public final class StackdriverModule {
            .setLabels(
                ImmutableMap.of(
                    // The "zone" field MUST be a valid GCE zone, so we fake one.
-                    "zone", SPOOFED_GCE_ZONE, "instance_id", SPOOFED_GCE_INSTANCE)),
+                    "zone", SPOOFED_GCE_ZONE, "instance_id", instanceId)),
        maxQps,
        maxPointsPerRequest);
  }
--- a/core/src/main/java/google/registry/persistence/transaction/JpaTransactionManager.java
+++ b/core/src/main/java/google/registry/persistence/transaction/JpaTransactionManager.java
@@ -31,21 +31,6 @@ public interface JpaTransactionManager extends TransactionManager {
   */
  EntityManager getStandaloneEntityManager();

-  /**
-   * Specifies a database snapshot exported by another transaction to use in the current
-   * transaction.
-   *
-   * <p>This is a Postgresql-specific feature. This method must be called before any other SQL
-   * commands in a transaction.
-   *
-   * <p>To support large queries, transaction isolation level is fixed at the REPEATABLE_READ to
-   * avoid exhausting predicate locks at the SERIALIZABLE level.
-   *
-   * @see google.registry.beam.common.DatabaseSnapshot
-   */
-  // TODO(b/193662898): vendor-independent support for richer transaction semantics.
-  JpaTransactionManager setDatabaseSnapshot(String snapshotId);
-
  /**
   * Returns the {@link EntityManager} for the current request.
   *
@@ -56,8 +41,8 @@ public interface JpaTransactionManager extends TransactionManager {
  /**
   * Creates a JPA SQL query for the given query string and result class.
   *
-   * <p>This is a convenience method for the longer <code>
-   * jpaTm().getEntityManager().createQuery(...)</code>.
+   * <p>This is a convenience method for the longer {@code
+   * jpaTm().getEntityManager().createQuery(...)}.
   */
  <T> TypedQuery<T> query(String sqlString, Class<T> resultClass);

@@ -67,8 +52,8 @@ public interface JpaTransactionManager extends TransactionManager {
  /**
   * Creates a JPA SQL query for the given query string.
   *
-   * <p>This is a convenience method for the longer <code>
-   * jpaTm().getEntityManager().createQuery(...)</code>.
+   * <p>This is a convenience method for the longer {@code
+   * jpaTm().getEntityManager().createQuery(...)}.
   *
   * <p>Note that while this method can legally be used for queries that return results, <u>it
   * should not be</u>, as it does not correctly detach entities as must be done for nomulus model
--- a/core/src/main/java/google/registry/persistence/transaction/JpaTransactionManagerImpl.java
+++ b/core/src/main/java/google/registry/persistence/transaction/JpaTransactionManagerImpl.java
@@ -109,22 +109,6 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
    return entityManager;
  }

-  @Override
-  public JpaTransactionManager setDatabaseSnapshot(String snapshotId) {
-    // Postgresql-specific: 'set transaction' command must be called inside a transaction
-    assertInTransaction();
-
-    EntityManager entityManager = getEntityManager();
-    // Isolation is hardcoded to REPEATABLE READ, as specified by parent's Javadoc.
-    entityManager
-        .createNativeQuery("SET TRANSACTION ISOLATION LEVEL REPEATABLE READ")
-        .executeUpdate();
-    entityManager
-        .createNativeQuery(String.format("SET TRANSACTION SNAPSHOT '%s'", snapshotId))
-        .executeUpdate();
-    return this;
-  }
-
  @Override
  public <T> TypedQuery<T> query(String sqlString, Class<T> resultClass) {
    return new DetachingTypedQuery<>(getEntityManager().createQuery(sqlString, resultClass));
--- a/core/src/main/java/google/registry/pricing/PricingEngineProxy.java
+++ b/core/src/main/java/google/registry/pricing/PricingEngineProxy.java
@@ -58,7 +58,7 @@ public final class PricingEngineProxy {
   */
  public static DomainPrices getPricesForDomainName(String domainName, DateTime priceTime) {
    String tld = getTldFromDomainName(domainName);
-    String clazz = Tld.get(tld).getPremiumPricingEngineClassName();
+    String clazz = Tld.get(tld).getPricingEngineClassName();
    PremiumPricingEngine engine = premiumPricingEngines.get(clazz);
    checkState(engine != null, "Could not load pricing engine %s for TLD %s", clazz, tld);
    return engine.getDomainPrices(domainName, priceTime);
--- a/core/src/main/java/google/registry/reporting/spec11/GenerateSpec11ReportAction.java
+++ b/core/src/main/java/google/registry/reporting/spec11/GenerateSpec11ReportAction.java
@@ -141,7 +141,8 @@ public class GenerateSpec11ReportAction implements Runnable {
                    jobId,
                    ReportingModule.PARAM_DATE,
                    date.toString()),
-                Duration.standardMinutes(ReportingModule.ENQUEUE_DELAY_MINUTES)));
+                // TODO(b/296582836): mitigating retry problem. Remove `+10` when bug is fixed.
+                Duration.standardMinutes(ReportingModule.ENQUEUE_DELAY_MINUTES + 10)));
      }
      response.setStatus(SC_OK);
      response.setPayload(String.format("Launched Spec11 pipeline: %s", jobId));
--- a/core/src/main/java/google/registry/reporting/spec11/Spec11EmailUtils.java
+++ b/core/src/main/java/google/registry/reporting/spec11/Spec11EmailUtils.java
@@ -31,12 +31,12 @@ import com.google.template.soy.tofu.SoyTofu;
 import com.google.template.soy.tofu.SoyTofu.Renderer;
 import google.registry.beam.spec11.ThreatMatch;
 import google.registry.config.RegistryConfig.Config;
+import google.registry.groups.GmailClient;
 import google.registry.model.domain.Domain;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
 import google.registry.reporting.spec11.soy.Spec11EmailSoyInfo;
 import google.registry.util.EmailMessage;
-import google.registry.util.SendEmailService;
 import java.util.List;
 import java.util.Map;
 import javax.inject.Inject;
@@ -56,8 +56,7 @@ public class Spec11EmailUtils {
                  Spec11EmailSoyInfo.getInstance().getFileName()))
          .build()
          .compileToTofu();
-
-  private final SendEmailService emailService;
+  private final GmailClient gmailClient;
  private final InternetAddress outgoingEmailAddress;
  private final ImmutableList<InternetAddress> spec11BccEmailAddresses;
  private final InternetAddress alertRecipientAddress;
@@ -66,13 +65,13 @@ public class Spec11EmailUtils {

  @Inject
  Spec11EmailUtils(
-      SendEmailService emailService,
-      @Config("alertRecipientEmailAddress") InternetAddress alertRecipientAddress,
+      GmailClient gmailClient,
+      @Config("newAlertRecipientEmailAddress") InternetAddress alertRecipientAddress,
      @Config("spec11OutgoingEmailAddress") InternetAddress spec11OutgoingEmailAddress,
      @Config("spec11BccEmailAddresses") ImmutableList<InternetAddress> spec11BccEmailAddresses,
      @Config("spec11WebResources") ImmutableList<String> spec11WebResources,
      @Config("registryName") String registryName) {
-    this.emailService = emailService;
+    this.gmailClient = gmailClient;
    this.outgoingEmailAddress = spec11OutgoingEmailAddress;
    this.spec11BccEmailAddresses = spec11BccEmailAddresses;
    this.alertRecipientAddress = alertRecipientAddress;
@@ -91,6 +90,7 @@ public class Spec11EmailUtils {
      ImmutableSet<RegistrarThreatMatches> registrarThreatMatchesSet) {
    ImmutableMap.Builder<RegistrarThreatMatches, Throwable> failedMatchesBuilder =
        ImmutableMap.builder();
+    int numRegistrarsEmailed = 0;
    for (RegistrarThreatMatches registrarThreatMatches : registrarThreatMatchesSet) {
      RegistrarThreatMatches filteredMatches = filterOutNonPublishedMatches(registrarThreatMatches);
      if (!filteredMatches.threatMatches().isEmpty()) {
@@ -98,11 +98,13 @@ public class Spec11EmailUtils {
          // Handle exceptions individually per registrar so that one failed email doesn't prevent
          // the rest from being sent.
          emailRegistrar(date, soyTemplateInfo, subject, filteredMatches);
+          numRegistrarsEmailed++;
        } catch (Throwable e) {
          failedMatchesBuilder.put(registrarThreatMatches, getRootCause(e));
        }
      }
    }
+    logger.atInfo().log("Emailed daily diffs to %s registrars.", numRegistrarsEmailed);
    ImmutableMap<RegistrarThreatMatches, Throwable> failedMatches = failedMatchesBuilder.build();
    if (!failedMatches.isEmpty()) {
      ImmutableList<Map.Entry<RegistrarThreatMatches, Throwable>> failedMatchesList =
@@ -151,7 +153,7 @@ public class Spec11EmailUtils {
      String subject,
      RegistrarThreatMatches registrarThreatMatches)
      throws MessagingException {
-    emailService.sendEmail(
+    gmailClient.sendEmail(
        EmailMessage.newBuilder()
            .setSubject(subject)
            .setBody(getContent(date, soyTemplateInfo, registrarThreatMatches))
@@ -191,7 +193,7 @@ public class Spec11EmailUtils {
  /** Sends an e-mail indicating the state of the spec11 pipeline, with a given subject and body. */
  void sendAlertEmail(String subject, String body) {
    try {
-      emailService.sendEmail(
+      gmailClient.sendEmail(
          EmailMessage.newBuilder()
              .setFrom(outgoingEmailAddress)
              .addRecipient(alertRecipientAddress)
--- a/core/src/main/java/google/registry/request/RequestModule.java
+++ b/core/src/main/java/google/registry/request/RequestModule.java
@@ -31,21 +31,28 @@ import com.google.common.io.ByteStreams;
 import com.google.common.io.CharStreams;
 import com.google.common.net.MediaType;
 import com.google.gson.Gson;
-import com.google.gson.JsonObject;
+import com.google.gson.GsonBuilder;
+import com.google.gson.JsonElement;
 import com.google.protobuf.ByteString;
 import dagger.Module;
 import dagger.Provides;
+import google.registry.model.adapters.CurrencyJsonAdapter;
 import google.registry.request.HttpException.BadRequestException;
 import google.registry.request.HttpException.UnsupportedMediaTypeException;
 import google.registry.request.auth.AuthResult;
 import google.registry.request.lock.LockHandler;
 import google.registry.request.lock.LockHandlerImpl;
+import google.registry.util.CidrAddressBlock;
+import google.registry.util.CidrAddressBlock.CidrAddressBlockAdapter;
+import google.registry.util.DateTimeTypeAdapter;
 import java.io.IOException;
 import java.util.Map;
 import java.util.Optional;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
+import org.joda.money.CurrencyUnit;
+import org.joda.time.DateTime;
 import org.json.simple.JSONValue;
 import org.json.simple.parser.ParseException;

@@ -69,6 +76,18 @@ public final class RequestModule {
    this.authResult = authResult;
  }

+  @RequestScope
+  @VisibleForTesting
+  @Provides
+  public static Gson provideGson() {
+    return new GsonBuilder()
+        .registerTypeAdapter(DateTime.class, new DateTimeTypeAdapter())
+        .registerTypeAdapter(CidrAddressBlock.class, new CidrAddressBlockAdapter())
+        .registerTypeAdapter(CurrencyUnit.class, new CurrencyJsonAdapter())
+        .excludeFieldsWithoutExposeAnnotation()
+        .create();
+  }
+
  @Provides
  @Parameter(RequestParameters.PARAM_TLD)
  static String provideTld(HttpServletRequest req) {
@@ -244,11 +263,10 @@ public final class RequestModule {

  @Provides
  @OptionalJsonPayload
-  public static Optional<JsonObject> provideJsonBody(HttpServletRequest req, Gson gson) {
+  public static Optional<JsonElement> provideJsonBody(HttpServletRequest req, Gson gson) {
    try {
-      JsonObject body = gson.fromJson(req.getReader(), JsonObject.class);
-      return Optional.of(body);
-    } catch (Exception e) {
+      return Optional.of(gson.fromJson(req.getReader(), JsonElement.class));
+    } catch (IOException e) {
      return Optional.empty();
    }
  }
--- a/core/src/main/java/google/registry/tools/GetTldCommand.java
+++ b/core/src/main/java/google/registry/tools/GetTldCommand.java
@@ -15,11 +15,17 @@
 package google.registry.tools;

 import static google.registry.model.tld.Tlds.assertTldsExist;
+import static java.nio.charset.StandardCharsets.UTF_8;

 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import google.registry.model.tld.Tld;
+import java.io.PrintStream;
+import java.io.UnsupportedEncodingException;
 import java.util.List;
+import javax.inject.Inject;

 /** Command to show a TLD record. */
@Parameters(separators = " =", commandDescription = "Show TLD record(s)")
@@ -30,10 +36,14 @@ final class GetTldCommand implements Command {
      required = true)
  private List<String> mainParameters;

+  @Inject ObjectMapper objectMapper;
+
  @Override
-  public void run() {
-    for (String tld : assertTldsExist(mainParameters)) {
-      System.out.println(Tld.get(tld));
+  public void run() throws JsonProcessingException, UnsupportedEncodingException {
+    try (PrintStream printStream = new PrintStream(System.out, false, UTF_8.name())) {
+      for (String tld : assertTldsExist(mainParameters)) {
+        printStream.println(objectMapper.writeValueAsString(Tld.get(tld)));
+      }
    }
  }
 }
--- a/core/src/main/java/google/registry/tools/RegistryToolComponent.java
+++ b/core/src/main/java/google/registry/tools/RegistryToolComponent.java
@@ -30,10 +30,12 @@ import google.registry.keyring.KeyringModule;
 import google.registry.keyring.api.DummyKeyringModule;
 import google.registry.keyring.api.KeyModule;
 import google.registry.keyring.secretmanager.SecretManagerKeyringModule;
+import google.registry.model.ModelModule;
 import google.registry.persistence.PersistenceModule;
 import google.registry.persistence.PersistenceModule.NomulusToolJpaTm;
 import google.registry.persistence.PersistenceModule.ReadOnlyReplicaJpaTm;
 import google.registry.persistence.transaction.JpaTransactionManager;
+import google.registry.privileges.secretmanager.SecretManagerModule;
 import google.registry.rde.RdeModule;
 import google.registry.request.Modules.GsonModule;
 import google.registry.request.Modules.UrlConnectionServiceModule;
@@ -66,13 +68,14 @@ import javax.inject.Singleton;
      GsonModule.class,
      KeyModule.class,
      KeyringModule.class,
-      SecretManagerKeyringModule.class,
      LocalCredentialModule.class,
+      ModelModule.class,
      PersistenceModule.class,
      RdeModule.class,
      RegistryToolDataflowModule.class,
      RequestFactoryModule.class,
-      google.registry.privileges.secretmanager.SecretManagerModule.class,
+      SecretManagerKeyringModule.class,
+      SecretManagerModule.class,
      UrlConnectionServiceModule.class,
      UrlFetchServiceModule.class,
      UserServiceModule.class,
--- a/core/src/main/java/google/registry/ui/server/console/RegistrarsAction.java
+++ b/core/src/main/java/google/registry/ui/server/console/RegistrarsAction.java
@@ -14,7 +14,11 @@

 package google.registry.ui.server.console;

+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Strings.isNullOrEmpty;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.request.Action.Method.GET;
+import static google.registry.request.Action.Method.POST;

 import com.google.api.client.http.HttpStatusCodes;
 import com.google.common.collect.ImmutableList;
@@ -23,46 +27,155 @@ import com.google.gson.Gson;
 import google.registry.model.console.ConsolePermission;
 import google.registry.model.console.User;
 import google.registry.model.registrar.Registrar;
+import google.registry.model.registrar.Registrar.State;
+import google.registry.model.registrar.RegistrarPoc;
 import google.registry.request.Action;
+import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import google.registry.request.auth.AuthResult;
 import google.registry.ui.server.registrar.JsonGetAction;
+import google.registry.util.StringGenerator;
+import java.util.Optional;
 import javax.inject.Inject;
+import javax.inject.Named;
+import javax.servlet.http.HttpServletRequest;

@Action(
    service = Action.Service.DEFAULT,
    path = RegistrarsAction.PATH,
-    method = {GET},
+    method = {GET, POST},
    auth = Auth.AUTH_PUBLIC_LOGGED_IN)
 public class RegistrarsAction implements JsonGetAction {
+  private static final int PASSWORD_LENGTH = 16;
+  private static final int PASSCODE_LENGTH = 5;
  static final String PATH = "/console-api/registrars";
-
  private final AuthResult authResult;
  private final Response response;
  private final Gson gson;
+  private final HttpServletRequest req;
+  private Optional<Registrar> registrar;
+  private StringGenerator passwordGenerator;
+  private StringGenerator passcodeGenerator;

  @Inject
-  public RegistrarsAction(AuthResult authResult, Response response, Gson gson) {
+  public RegistrarsAction(
+      HttpServletRequest req,
+      AuthResult authResult,
+      Response response,
+      Gson gson,
+      @Parameter("registrar") Optional<Registrar> registrar,
+      @Named("base58StringGenerator") StringGenerator passwordGenerator,
+      @Named("digitOnlyStringGenerator") StringGenerator passcodeGenerator) {
    this.authResult = authResult;
    this.response = response;
    this.gson = gson;
+    this.registrar = registrar;
+    this.req = req;
+    this.passcodeGenerator = passcodeGenerator;
+    this.passwordGenerator = passwordGenerator;
  }

+
  @Override
  public void run() {
    User user = authResult.userAuthInfo().get().consoleUser().get();
+    if (req.getMethod().equals(GET.toString())) {
+      getHandler(user);
+    } else {
+      postHandler(user);
+    }
+  }
+
+  private void getHandler(User user) {
    if (!user.getUserRoles().hasGlobalPermission(ConsolePermission.VIEW_REGISTRARS)) {
      response.setStatus(HttpStatusCodes.STATUS_CODE_FORBIDDEN);
      return;
    }
-    ImmutableList<String> registrarIds =
+    ImmutableList<Registrar> registrars =
        Streams.stream(Registrar.loadAllCached())
            .filter(r -> r.getType() == Registrar.Type.REAL)
-            .map(Registrar::getRegistrarId)
            .collect(ImmutableList.toImmutableList());

-    response.setPayload(gson.toJson(registrarIds));
+    response.setPayload(gson.toJson(registrars));
    response.setStatus(HttpStatusCodes.STATUS_CODE_OK);
  }
+
+  private void postHandler(User user) {
+    if (!user.getUserRoles().isAdmin()) {
+      response.setStatus(HttpStatusCodes.STATUS_CODE_FORBIDDEN);
+      return;
+    }
+
+    if (!registrar.isPresent()) {
+      response.setStatus(HttpStatusCodes.STATUS_CODE_BAD_REQUEST);
+      response.setPayload(gson.toJson("'registrar' parameter is not present"));
+      return;
+    }
+
+    Registrar registrarParam = registrar.get();
+    String errorMsg = "Missing value for %s";
+    try {
+      checkArgument(!isNullOrEmpty(registrarParam.getRegistrarId()), errorMsg, "registrarId");
+      checkArgument(!isNullOrEmpty(registrarParam.getRegistrarName()), errorMsg, "name");
+      checkArgument(!registrarParam.getBillingAccountMap().isEmpty(), errorMsg, "billingAccount");
+      checkArgument(registrarParam.getIanaIdentifier() != null, String.format(errorMsg, "ianaId"));
+      checkArgument(
+          !isNullOrEmpty(registrarParam.getIcannReferralEmail()), errorMsg, "referralEmail");
+      checkArgument(!isNullOrEmpty(registrarParam.getDriveFolderId()), errorMsg, "driveId");
+      checkArgument(!isNullOrEmpty(registrarParam.getEmailAddress()), errorMsg, "consoleUserEmail");
+      checkArgument(
+          registrarParam.getLocalizedAddress() != null
+              && !isNullOrEmpty(registrarParam.getLocalizedAddress().getState())
+              && !isNullOrEmpty(registrarParam.getLocalizedAddress().getCity())
+              && !isNullOrEmpty(registrarParam.getLocalizedAddress().getZip())
+              && !isNullOrEmpty(registrarParam.getLocalizedAddress().getCountryCode())
+              && !registrarParam.getLocalizedAddress().getStreet().isEmpty(),
+          errorMsg,
+          "address");
+
+      String password = passwordGenerator.createString(PASSWORD_LENGTH);
+      String phonePasscode = passcodeGenerator.createString(PASSCODE_LENGTH);
+
+      Registrar registrar =
+          new Registrar.Builder()
+              .setRegistrarId(registrarParam.getRegistrarId())
+              .setRegistrarName(registrarParam.getRegistrarName())
+              .setBillingAccountMap(registrarParam.getBillingAccountMap())
+              .setIanaIdentifier(Long.valueOf(registrarParam.getIanaIdentifier()))
+              .setIcannReferralEmail(registrarParam.getIcannReferralEmail())
+              .setEmailAddress(registrarParam.getIcannReferralEmail())
+              .setDriveFolderId(registrarParam.getDriveFolderId())
+              .setType(Registrar.Type.REAL)
+              .setPassword(password)
+              .setPhonePasscode(phonePasscode)
+              .setState(State.PENDING)
+              .setLocalizedAddress(registrarParam.getLocalizedAddress())
+              .build();
+
+      RegistrarPoc contact =
+          new RegistrarPoc.Builder()
+              .setRegistrar(registrar)
+              .setName(registrarParam.getEmailAddress())
+              .setEmailAddress(registrarParam.getEmailAddress())
+              .setLoginEmailAddress(registrarParam.getEmailAddress())
+              .build();
+
+      tm().transact(
+              () -> {
+                checkArgument(
+                    !Registrar.loadByRegistrarId(registrar.getRegistrarId()).isPresent(),
+                    "Registrar with registrarId %s already exists",
+                    registrar.getRegistrarId());
+                tm().putAll(registrar, contact);
+              });
+
+    } catch (IllegalArgumentException e) {
+      response.setStatus(HttpStatusCodes.STATUS_CODE_BAD_REQUEST);
+      response.setPayload(gson.toJson(e.getMessage()));
+    } catch (Throwable e) {
+      response.setStatus(HttpStatusCodes.STATUS_CODE_SERVER_ERROR);
+      response.setPayload(gson.toJson(e.getMessage()));
+    }
+  }
 }
--- a/core/src/main/java/google/registry/ui/server/console/settings/SecurityAction.java
+++ b/core/src/main/java/google/registry/ui/server/console/settings/SecurityAction.java
@@ -15,7 +15,6 @@
 package google.registry.ui.server.console.settings;

 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.request.Action.Method.GET;
 import static google.registry.request.Action.Method.POST;

 import avro.shaded.com.google.common.collect.ImmutableList;
@@ -36,28 +35,25 @@ import google.registry.request.auth.AuthenticatedRegistrarAccessor.RegistrarAcce
 import google.registry.ui.server.registrar.JsonGetAction;
 import java.util.Optional;
 import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;

@Action(
    service = Action.Service.DEFAULT,
    path = SecurityAction.PATH,
-    method = {GET, POST},
+    method = {POST},
    auth = Auth.AUTH_PUBLIC_LOGGED_IN)
 public class SecurityAction implements JsonGetAction {

  static final String PATH = "/console-api/settings/security";
-  private final HttpServletRequest req;
  private final AuthResult authResult;
  private final Response response;
  private final Gson gson;
  private final String registrarId;
-  private AuthenticatedRegistrarAccessor registrarAccessor;
-  private Optional<Registrar> registrar;
-  private CertificateChecker certificateChecker;
+  private final AuthenticatedRegistrarAccessor registrarAccessor;
+  private final Optional<Registrar> registrar;
+  private final CertificateChecker certificateChecker;

  @Inject
  public SecurityAction(
-      HttpServletRequest req,
      AuthResult authResult,
      Response response,
      Gson gson,
@@ -65,7 +61,6 @@ public class SecurityAction implements JsonGetAction {
      AuthenticatedRegistrarAccessor registrarAccessor,
      @Parameter("registrarId") String registrarId,
      @Parameter("registrar") Optional<Registrar> registrar) {
-    this.req = req;
    this.authResult = authResult;
    this.response = response;
    this.gson = gson;
@@ -77,25 +72,6 @@ public class SecurityAction implements JsonGetAction {

  @Override
  public void run() {
-    if (req.getMethod().equals(GET.toString())) {
-      getHandler();
-    } else {
-      postHandler();
-    }
-  }
-
-  private void getHandler() {
-    try {
-      Registrar registrar = registrarAccessor.getRegistrar(registrarId);
-      response.setStatus(HttpStatusCodes.STATUS_CODE_OK);
-      response.setPayload(gson.toJson(registrar));
-    } catch (RegistrarAccessDeniedException e) {
-      response.setStatus(HttpStatusCodes.STATUS_CODE_FORBIDDEN);
-      response.setPayload(e.getMessage());
-    }
-  }
-
-  private void postHandler() {
    User user = authResult.userAuthInfo().get().consoleUser().get();
    if (!user.getUserRoles().hasPermission(registrarId, ConsolePermission.EDIT_REGISTRAR_DETAILS)) {
      response.setStatus(HttpStatusCodes.STATUS_CODE_FORBIDDEN);
@@ -153,17 +129,15 @@ public class SecurityAction implements JsonGetAction {
    registrarParameter
        .getClientCertificate()
        .ifPresent(
-            newClientCert -> {
-              updatedRegistrar.setClientCertificate(newClientCert, tm().getTransactionTime());
-            });
+            newClientCert ->
+                updatedRegistrar.setClientCertificate(newClientCert, tm().getTransactionTime()));

    registrarParameter
        .getFailoverClientCertificate()
        .ifPresent(
-            failoverCert -> {
-              updatedRegistrar.setFailoverClientCertificate(
-                  failoverCert, tm().getTransactionTime());
-            });
+            failoverCert ->
+                updatedRegistrar.setFailoverClientCertificate(
+                    failoverCert, tm().getTransactionTime()));

    tm().put(updatedRegistrar.build());
    response.setStatus(HttpStatusCodes.STATUS_CODE_OK);
--- a/core/src/main/java/google/registry/ui/server/registrar/RegistrarConsoleModule.java
+++ b/core/src/main/java/google/registry/ui/server/registrar/RegistrarConsoleModule.java
@@ -21,7 +21,7 @@ import static google.registry.request.RequestParameters.extractRequiredParameter

 import com.google.common.collect.ImmutableSet;
 import com.google.gson.Gson;
-import com.google.gson.JsonObject;
+import com.google.gson.JsonElement;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.model.registrar.Registrar;
@@ -172,15 +172,8 @@ public final class RegistrarConsoleModule {
  @Provides
  @Parameter("contacts")
  public static Optional<ImmutableSet<RegistrarPoc>> provideContacts(
-      Gson gson, @OptionalJsonPayload Optional<JsonObject> payload) {
-
-    if (payload.isPresent() && payload.get().has("contacts")) {
-      return Optional.of(
-          ImmutableSet.copyOf(
-              gson.fromJson(payload.get().get("contacts").getAsJsonArray(), RegistrarPoc[].class)));
-    }
-
-    return Optional.empty();
+      Gson gson, @OptionalJsonPayload Optional<JsonElement> payload) {
+    return payload.map(s -> ImmutableSet.copyOf(gson.fromJson(s, RegistrarPoc[].class)));
  }

  @Provides
@@ -192,11 +185,7 @@ public final class RegistrarConsoleModule {
  @Provides
  @Parameter("registrar")
  public static Optional<Registrar> provideRegistrar(
-      Gson gson, @OptionalJsonPayload Optional<JsonObject> payload) {
-    if (payload.isPresent() && payload.get().has("registrar")) {
-      return Optional.of(gson.fromJson(payload.get().get("registrar"), Registrar.class));
-    }
-
-    return Optional.empty();
+      Gson gson, @OptionalJsonPayload Optional<JsonElement> payload) {
+    return payload.map(s -> gson.fromJson(s, Registrar.class));
  }
 }
--- a/core/src/main/java/google/registry/xml/xsd/bulkToken.xsd
+++ b/core/src/main/java/google/registry/xml/xsd/bulkToken.xsd
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<schema targetNamespace="urn:google:params:xml:ns:bulkToken-1.0"
+    xmlns:bulkToken="urn:google:params:xml:ns:bulkToken-1.0"
+    xmlns="http://www.w3.org/2001/XMLSchema"
+    elementFormDefault="qualified">
+
+  <annotation>
+    <documentation>
+      Extensible Provisioning Protocol v1.0
+      Bulk Token Extension.
+    </documentation>
+  </annotation>
+
+  <!-- Element used in info command request to get a bulk pricing token for a domain. -->
+  <element name="info"
+      type="bulkToken:infoType"/>
+
+  <complexType name="infoType"/>
+
+  <!-- Element returned in an info command response with a bulk token for a domain with bulk pricing. -->
+  <element name="bulkData"
+      type="bulkToken:bulkDataType"/>
+
+  <complexType name="bulkDataType">
+    <sequence>
+      <element name="token" type="bulkToken:tokenType" maxOccurs="unbounded"/>
+    </sequence>
+  </complexType>
+
+  <simpleType name="tokenType">
+    <restriction base="string">
+    </restriction>
+  </simpleType>
+
+
+  <!-- End of schema.-->
+</schema>
--- a/core/src/main/java/google/registry/xml/xsd/packageToken.xsd
+++ b/core/src/main/java/google/registry/xml/xsd/packageToken.xsd
@@ -1,38 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-
-<schema targetNamespace="urn:google:params:xml:ns:packageToken-1.0"
-    xmlns:packageToken="urn:google:params:xml:ns:packageToken-1.0"
-    xmlns="http://www.w3.org/2001/XMLSchema"
-    elementFormDefault="qualified">
-
-  <annotation>
-    <documentation>
-      Extensible Provisioning Protocol v1.0
-      Package Token Extension.
-    </documentation>
-  </annotation>
-
-  <!-- Element used in info command request to get a package token for a domain. -->
-  <element name="info"
-      type="packageToken:infoType"/>
-
-  <complexType name="infoType"/>
-
-  <!-- Element returned in an info command response with a package token for a package domain. -->
-  <element name="packageData"
-      type="packageToken:packageDataType"/>
-
-  <complexType name="packageDataType">
-    <sequence>
-      <element name="token" type="packageToken:tokenType" maxOccurs="unbounded"/>
-    </sequence>
-  </complexType>
-
-  <simpleType name="tokenType">
-    <restriction base="string">
-    </restriction>
-  </simpleType>
-
-
-  <!-- End of schema.-->
-</schema>
--- a/core/src/main/resources/google/registry/reporting/icann/sql/cloud_sql_activity_report_aggregation.sql
+++ b/core/src/main/resources/google/registry/reporting/icann/sql/cloud_sql_activity_report_aggregation.sql
@@ -58,7 +58,8 @@ SELECT
  SUM(IF(metricName = 'srs-cont-transfer-query', count, 0)) AS srs_cont_transfer_query,
  SUM(IF(metricName = 'srs-cont-transfer-reject', count, 0)) AS srs_cont_transfer_reject,
  SUM(IF(metricName = 'srs-cont-transfer-request', count, 0)) AS srs_cont_transfer_request,
-  SUM(IF(metricName = 'srs-cont-update', count, 0)) AS srs_cont_update
+  SUM(IF(metricName = 'srs-cont-update', count, 0)) AS srs_cont_update,
+  SUM(IF(metricName = 'rdap-queries', count, 0)) AS rdap_queries
  -- Cross join a list of all TLDs against TLD-specific metrics and then
  -- filter so that only metrics with that TLD or a NULL TLD are counted
  -- towards a given TLD.
--- a/core/src/main/resources/google/registry/reporting/icann/sql/cloud_sql_transaction_counts.sql
+++ b/core/src/main/resources/google/registry/reporting/icann/sql/cloud_sql_transaction_counts.sql
@@ -56,7 +56,7 @@ FROM (
            -- should have negligible impact as the edge cage happens very rarely, more specifically
            -- when a cancellation happens during grace period by a registrar other than the the
            -- owning one. All the numbers here should be positive to pass ICANN validation.
-            MAX(report_amount, 0) AS amount,
+            GREATEST(report_amount, 0) AS amount,
            reporting_time AS reportingTime
            FROM EXTERNAL_QUERY("projects/%PROJECT_ID%/locations/us/connections/%PROJECT_ID%-sql",
            ''' SELECT history_type, history_other_registrar_id, history_registrar_id, domain_repo_id, history_revision_id FROM "DomainHistory";''') AS dh
--- a/core/src/main/resources/google/registry/reporting/icann/sql/whois_counts.sql
+++ b/core/src/main/resources/google/registry/reporting/icann/sql/whois_counts.sql
@@ -23,6 +23,7 @@ SELECT
  CASE
    WHEN requestPath = '/_dr/whois' THEN 'whois-43-queries'
    WHEN SUBSTR(requestPath, 0, 7) = '/whois/' THEN 'web-whois-queries'
+    WHEN SUBSTR(requestPath, 0, 6) = '/rdap/' THEN 'rdap-queries'
  END AS metricName,
  COUNT(requestPath) AS count
 FROM
--- a/core/src/test/java/google/registry/batch/AsyncTaskEnqueuerTest.java
+++ b/core/src/test/java/google/registry/batch/AsyncTaskEnqueuerTest.java
@@ -69,7 +69,7 @@ public class AsyncTaskEnqueuerTest {
  void test_enqueueAsyncResave_success() {
    Contact contact = persistActiveContact("jd23456");
    asyncTaskEnqueuer.enqueueAsyncResave(
-        contact.createVKey(), clock.nowUtc(), clock.nowUtc().plusDays(5));
+        contact.createVKey(), clock.nowUtc(), ImmutableSortedSet.of(clock.nowUtc().plusDays(5)));
    cloudTasksHelper.assertTasksEnqueued(
        QUEUE_ASYNC_ACTIONS,
        new CloudTasksHelper.TaskMatcher()
@@ -108,7 +108,7 @@ public class AsyncTaskEnqueuerTest {
  void test_enqueueAsyncResave_ignoresTasksTooFarIntoFuture() {
    Contact contact = persistActiveContact("jd23456");
    asyncTaskEnqueuer.enqueueAsyncResave(
-        contact.createVKey(), clock.nowUtc(), clock.nowUtc().plusDays(31));
+        contact.createVKey(), clock.nowUtc(), ImmutableSortedSet.of(clock.nowUtc().plusDays(31)));
    cloudTasksHelper.assertNoTasksEnqueued(QUEUE_ASYNC_ACTIONS);
    assertLogMessage(logHandler, Level.INFO, "Ignoring async re-save");
  }
--- a/core/src/test/java/google/registry/beam/common/DatabaseSnapshotTest.java
+++ b/core/src/test/java/google/registry/beam/common/DatabaseSnapshotTest.java
@@ -1,174 +0,0 @@
-// Copyright 2021 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.beam.common;
-
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-
-import com.google.common.collect.ImmutableMap;
-import com.google.common.truth.Truth;
-import google.registry.beam.TestPipelineExtension;
-import google.registry.beam.common.RegistryJpaIO.Read;
-import google.registry.model.tld.Tld;
-import google.registry.persistence.NomulusPostgreSql;
-import google.registry.persistence.PersistenceModule;
-import google.registry.persistence.transaction.CriteriaQueryBuilder;
-import google.registry.persistence.transaction.JpaTransactionManager;
-import google.registry.persistence.transaction.JpaTransactionManagerImpl;
-import google.registry.persistence.transaction.TransactionManagerFactory;
-import google.registry.testing.DatabaseHelper;
-import google.registry.testing.FakeClock;
-import javax.persistence.Persistence;
-import org.apache.beam.sdk.coders.SerializableCoder;
-import org.apache.beam.sdk.testing.PAssert;
-import org.apache.beam.sdk.values.PCollection;
-import org.hibernate.cfg.Environment;
-import org.junit.jupiter.api.AfterAll;
-import org.junit.jupiter.api.BeforeAll;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.RegisterExtension;
-import org.testcontainers.containers.PostgreSQLContainer;
-import org.testcontainers.junit.jupiter.Container;
-import org.testcontainers.junit.jupiter.Testcontainers;
-
-/** Unit tests for {@link DatabaseSnapshot}. */
-@Testcontainers
-public class DatabaseSnapshotTest {
-
-  /**
-   * Directly start a PSQL database instead of going through the test extensions.
-   *
-   * <p>For reasons unknown, an EntityManagerFactory created by {@code JpaIntegrationTestExtension}
-   * or {@code JpaUnitTestExtension} enters a bad state after exporting the first snapshot. Starting
-   * with the second attempt, exports alternate between error ("cannot export a snapshot from a
-   * subtransaction") and success. The {@link #createSnapshot_twiceNoRead} test below fails with
-   * either extension. EntityManagerFactory created for production does not have this problem.
-   */
-  @Container
-  private static PostgreSQLContainer sqlContainer =
-      new PostgreSQLContainer<>(NomulusPostgreSql.getDockerTag())
-          .withInitScript("sql/schema/nomulus.golden.sql");
-
-  @RegisterExtension
-  final transient TestPipelineExtension testPipeline =
-      TestPipelineExtension.create().enableAbandonedNodeEnforcement(true);
-
-  static JpaTransactionManager origJpa;
-  static JpaTransactionManager jpa;
-
-  static Tld registry;
-
-  @BeforeAll
-  static void setup() {
-    ImmutableMap<String, String> jpaProperties =
-        new ImmutableMap.Builder<String, String>()
-            .put(Environment.URL, sqlContainer.getJdbcUrl())
-            .put(Environment.USER, sqlContainer.getUsername())
-            .put(Environment.PASS, sqlContainer.getPassword())
-            .putAll(PersistenceModule.provideDefaultDatabaseConfigs())
-            .build();
-    jpa =
-        new JpaTransactionManagerImpl(
-            Persistence.createEntityManagerFactory("nomulus", jpaProperties), new FakeClock());
-    origJpa = tm();
-    TransactionManagerFactory.setJpaTm(() -> jpa);
-
-    Tld tld = DatabaseHelper.newTld("tld", "TLD");
-    tm().transact(() -> tm().put(tld));
-    registry = tm().transact(() -> tm().loadByEntity(tld));
-  }
-
-  @AfterAll
-  static void tearDown() {
-    TransactionManagerFactory.setJpaTm(() -> origJpa);
-
-    if (jpa != null) {
-      jpa.teardown();
-    }
-  }
-
-  @Test
-  void createSnapshot_onceNoRead() {
-    try (DatabaseSnapshot databaseSnapshot = DatabaseSnapshot.createSnapshot()) {}
-  }
-
-  @Test
-  void createSnapshot_twiceNoRead() {
-    try (DatabaseSnapshot databaseSnapshot = DatabaseSnapshot.createSnapshot()) {}
-    try (DatabaseSnapshot databaseSnapshot = DatabaseSnapshot.createSnapshot()) {}
-  }
-
-  @Test
-  void readSnapshot() {
-    try (DatabaseSnapshot databaseSnapshot = DatabaseSnapshot.createSnapshot()) {
-      Tld snapshotRegistry =
-          tm().transact(
-                  () ->
-                      tm().setDatabaseSnapshot(databaseSnapshot.getSnapshotId())
-                          .loadByEntity(registry));
-      Truth.assertThat(snapshotRegistry).isEqualTo(registry);
-    }
-  }
-
-  @Test
-  void readSnapshot_withSubsequentChange() {
-    try (DatabaseSnapshot databaseSnapshot = DatabaseSnapshot.createSnapshot()) {
-      Tld updated =
-          registry
-              .asBuilder()
-              .setCreateBillingCost(registry.getStandardCreateCost().plus(1))
-              .build();
-      tm().transact(() -> tm().put(updated));
-
-      Tld persistedUpdate = tm().transact(() -> tm().loadByEntity(registry));
-      Truth.assertThat(persistedUpdate).isNotEqualTo(registry);
-
-      Tld snapshotRegistry =
-          tm().transact(
-                  () ->
-                      tm().setDatabaseSnapshot(databaseSnapshot.getSnapshotId())
-                          .loadByEntity(registry));
-      Truth.assertThat(snapshotRegistry).isEqualTo(registry);
-    } finally {
-      // Revert change to registry in DB, which is shared by all test methods.
-      tm().transact(() -> tm().put(registry));
-    }
-  }
-
-  @Test
-  void readWithRegistryJpaIO() {
-    try (DatabaseSnapshot databaseSnapshot = DatabaseSnapshot.createSnapshot()) {
-      Tld updated =
-          registry
-              .asBuilder()
-              .setCreateBillingCost(registry.getStandardCreateCost().plus(1))
-              .build();
-      tm().transact(() -> tm().put(updated));
-
-      Read<Tld, Tld> read =
-          RegistryJpaIO.read(() -> CriteriaQueryBuilder.create(Tld.class).build(), x -> x)
-              .withCoder(SerializableCoder.of(Tld.class))
-              .withSnapshot(databaseSnapshot.getSnapshotId());
-      PCollection<Tld> registries = testPipeline.apply(read);
-
-      // This assertion depends on Registry being Serializable, which may change if the
-      // UnsafeSerializable interface is removed after migration.
-      PAssert.that(registries).containsInAnyOrder(registry);
-      testPipeline.run();
-    } finally {
-      // Revert change to registry in DB, which is shared by all test methods.
-      tm().transact(() -> tm().put(registry));
-    }
-  }
-}
--- a/core/src/test/java/google/registry/flows/domain/DomainInfoFlowTest.java
+++ b/core/src/test/java/google/registry/flows/domain/DomainInfoFlowTest.java
@@ -1085,7 +1085,7 @@ class DomainInfoFlowTest extends ResourceFlowTestCase<DomainInfoFlow, Domain> {
  }

  @Test
-  void testPackageInfoExtension_returnsPackageInfo() throws Exception {
+  void testBulkInfoExtension_returnsBulkInfo() throws Exception {
    persistTestEntities(false);
    AllocationToken token =
        persistResource(
@@ -1100,12 +1100,12 @@ class DomainInfoFlowTest extends ResourceFlowTestCase<DomainInfoFlow, Domain> {
                .build());
    domain = domain.asBuilder().setCurrentPackageToken(token.createVKey()).build();
    persistResource(domain);
-    setEppInput("domain_info_package.xml");
-    doSuccessfulTest("domain_info_response_package.xml", false);
+    setEppInput("domain_info_bulk.xml");
+    doSuccessfulTest("domain_info_response_bulk.xml", false);
  }

  @Test
-  void testPackageInfoExtension_returnsPackageInfoForSuperUser() throws Exception {
+  void testBulkInfoExtension_returnsBulkInfoForSuperUser() throws Exception {
    persistTestEntities(false);
    AllocationToken token =
        persistResource(
@@ -1121,23 +1121,23 @@ class DomainInfoFlowTest extends ResourceFlowTestCase<DomainInfoFlow, Domain> {
    domain = domain.asBuilder().setCurrentPackageToken(token.createVKey()).build();
    persistResource(domain);
    sessionMetadata.setRegistrarId("TheRegistrar");
-    setEppInput("domain_info_package.xml");
+    setEppInput("domain_info_bulk.xml");
    EppOutput output = runFlowAsSuperuser();
    String expectedOutput =
        loadFile(
-            "domain_info_response_superuser_package.xml",
+            "domain_info_response_superuser_bulk.xml",
            updateSubstitutions(ImmutableMap.of(), "ROID", "2FF-TLD"));
    assertXmlEquals(expectedOutput, new String(marshal(output, ValidationMode.LENIENT), UTF_8));
  }

  @Test
-  void testPackageInfoExtension_nameNotInPackage() throws Exception {
-    setEppInput("domain_info_package.xml");
-    doSuccessfulTest("domain_info_response_empty_package.xml");
+  void testBulkInfoExtension_nameNotInBulkPackage() throws Exception {
+    setEppInput("domain_info_bulk.xml");
+    doSuccessfulTest("domain_info_response_empty_bulk_package.xml");
  }

  @Test
-  void testPackageInfoExtension_notCurrentSponsorRegistrar() throws Exception {
+  void testBulkInfoExtension_notCurrentSponsorRegistrar() throws Exception {
    persistTestEntities(false);
    AllocationToken token =
        persistResource(
@@ -1153,7 +1153,7 @@ class DomainInfoFlowTest extends ResourceFlowTestCase<DomainInfoFlow, Domain> {
    domain = domain.asBuilder().setCurrentPackageToken(token.createVKey()).build();
    persistResource(domain);
    sessionMetadata.setRegistrarId("TheRegistrar");
-    setEppInput("domain_info_package.xml");
+    setEppInput("domain_info_bulk.xml");
    doSuccessfulTest("domain_info_response_unauthorized.xml", false);
  }
 }
--- a/core/src/test/java/google/registry/flows/domain/DomainRenewFlowTest.java
+++ b/core/src/test/java/google/registry/flows/domain/DomainRenewFlowTest.java
@@ -77,8 +77,8 @@ import google.registry.flows.domain.token.AllocationTokenFlowUtils.AllocationTok
 import google.registry.flows.domain.token.AllocationTokenFlowUtils.AllocationTokenNotValidForTldException;
 import google.registry.flows.domain.token.AllocationTokenFlowUtils.AlreadyRedeemedAllocationTokenException;
 import google.registry.flows.domain.token.AllocationTokenFlowUtils.InvalidAllocationTokenException;
-import google.registry.flows.domain.token.AllocationTokenFlowUtils.MissingRemovePackageTokenOnPackageDomainException;
-import google.registry.flows.domain.token.AllocationTokenFlowUtils.RemovePackageTokenOnNonPackageDomainException;
+import google.registry.flows.domain.token.AllocationTokenFlowUtils.MissingRemoveDomainTokenOnPackageDomainException;
+import google.registry.flows.domain.token.AllocationTokenFlowUtils.RemoveDomainTokenOnNonPackageDomainException;
 import google.registry.flows.exceptions.ResourceStatusProhibitsOperationException;
 import google.registry.model.billing.BillingBase.Flag;
 import google.registry.model.billing.BillingBase.Reason;
@@ -1271,12 +1271,12 @@ class DomainRenewFlowTest extends ResourceFlowTestCase<DomainRenewFlow, Domain>
        ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2", "TOKEN", "abc123"));

    EppException thrown =
-        assertThrows(MissingRemovePackageTokenOnPackageDomainException.class, this::runFlow);
+        assertThrows(MissingRemoveDomainTokenOnPackageDomainException.class, this::runFlow);
    assertAboutEppExceptions().that(thrown).marshalsToXml();
  }

  @Test
-  void testFailsToRenewPackageDomainNoRemovePackageToken() throws Exception {
+  void testFailsToRenewPackageDomainNoRemoveDomainToken() throws Exception {
    AllocationToken token =
        persistResource(
            new AllocationToken.Builder()
@@ -1296,25 +1296,25 @@ class DomainRenewFlowTest extends ResourceFlowTestCase<DomainRenewFlow, Domain>
    setEppInput("domain_renew.xml", ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "5"));

    EppException thrown =
-        assertThrows(MissingRemovePackageTokenOnPackageDomainException.class, this::runFlow);
+        assertThrows(MissingRemoveDomainTokenOnPackageDomainException.class, this::runFlow);
    assertAboutEppExceptions().that(thrown).marshalsToXml();
  }

  @Test
-  void testFailsToRenewNonPackageDomainWithRemovePackageToken() throws Exception {
+  void testFailsToRenewNonPackageDomainWithRemoveDomainToken() throws Exception {
    persistDomain();

    setEppInput(
        "domain_renew_allocationtoken.xml",
-        ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2", "TOKEN", "__REMOVEPACKAGE__"));
+        ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2", "TOKEN", "__REMOVEDOMAIN__"));

    EppException thrown =
-        assertThrows(RemovePackageTokenOnNonPackageDomainException.class, this::runFlow);
+        assertThrows(RemoveDomainTokenOnNonPackageDomainException.class, this::runFlow);
    assertAboutEppExceptions().that(thrown).marshalsToXml();
  }

  @Test
-  void testSuccesfullyAppliesRemovePackageToken() throws Exception {
+  void testSuccesfullyAppliesRemoveDomainToken() throws Exception {
    AllocationToken token =
        persistResource(
            new AllocationToken.Builder()
@@ -1332,7 +1332,7 @@ class DomainRenewFlowTest extends ResourceFlowTestCase<DomainRenewFlow, Domain>
            .build());
    setEppInput(
        "domain_renew_allocationtoken.xml",
-        ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2", "TOKEN", "__REMOVEPACKAGE__"));
+        ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2", "TOKEN", "__REMOVEDOMAIN__"));

    doSuccessfulTest(
        "domain_renew_response.xml",
@@ -1346,7 +1346,7 @@ class DomainRenewFlowTest extends ResourceFlowTestCase<DomainRenewFlow, Domain>
  }

  @Test
-  void testDryRunRemovePackageToken() throws Exception {
+  void testDryRunRemoveDomainToken() throws Exception {
    AllocationToken token =
        persistResource(
            new AllocationToken.Builder()
@@ -1365,7 +1365,7 @@ class DomainRenewFlowTest extends ResourceFlowTestCase<DomainRenewFlow, Domain>

    setEppInput(
        "domain_renew_allocationtoken.xml",
-        ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2", "TOKEN", "__REMOVEPACKAGE__"));
+        ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2", "TOKEN", "__REMOVEDOMAIN__"));

    dryRunFlowAssertResponse(
        loadFile(
--- a/core/src/test/java/google/registry/flows/session/LoginFlowTestCase.java
+++ b/core/src/test/java/google/registry/flows/session/LoginFlowTestCase.java
@@ -21,15 +21,16 @@ import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
 import static org.junit.jupiter.api.Assertions.assertThrows;

+import com.google.common.collect.ImmutableMap;
 import google.registry.flows.EppException;
 import google.registry.flows.EppException.UnimplementedExtensionException;
 import google.registry.flows.EppException.UnimplementedObjectServiceException;
 import google.registry.flows.EppException.UnimplementedProtocolVersionException;
 import google.registry.flows.FlowTestCase;
+import google.registry.flows.FlowUtils.GenericXmlSyntaxErrorException;
 import google.registry.flows.TransportCredentials.BadRegistrarPasswordException;
 import google.registry.flows.session.LoginFlow.AlreadyLoggedInException;
 import google.registry.flows.session.LoginFlow.BadRegistrarIdException;
-import google.registry.flows.session.LoginFlow.PasswordChangesNotSupportedException;
 import google.registry.flows.session.LoginFlow.RegistrarAccountNotActiveException;
 import google.registry.flows.session.LoginFlow.TooManyFailedLoginsException;
 import google.registry.flows.session.LoginFlow.UnsupportedLanguageException;
@@ -61,7 +62,7 @@ public abstract class LoginFlowTestCase extends FlowTestCase<LoginFlow> {
  // Also called in subclasses.
  void doSuccessfulTest(String xmlFilename) throws Exception {
    setEppInput(xmlFilename);
-    assertTransactionalFlow(false);
+    assertTransactionalFlow(true);
    runFlowAssertResponse(loadFile("generic_success_response.xml"));
  }

@@ -80,7 +81,7 @@ public abstract class LoginFlowTestCase extends FlowTestCase<LoginFlow> {
  @Test
  void testSuccess_setsIsLoginResponse() throws Exception {
    setEppInput("login_valid.xml");
-    assertTransactionalFlow(false);
+    assertTransactionalFlow(true);
    EppOutput output = runFlow();
    assertThat(output.getResponse().isLoginResponse()).isTrue();
  }
@@ -118,8 +119,52 @@ public abstract class LoginFlowTestCase extends FlowTestCase<LoginFlow> {
  }

  @Test
-  void testFailure_newPassword() {
-    doFailingTest("login_invalid_newpw.xml", PasswordChangesNotSupportedException.class);
+  void testSetNewPassword() throws Exception {
+    assertThat(registrar.verifyPassword("foo-BAR2")).isTrue();
+    assertThat(registrar.verifyPassword("ANewPassword")).isFalse();
+    assertThat(registrar.verifyPassword("randomstring")).isFalse();
+
+    setEppInput("login_set_new_password.xml", ImmutableMap.of("NEWPW", "ANewPassword"));
+    assertTransactionalFlow(true);
+    runFlowAssertResponse(loadFile("generic_success_response.xml"));
+
+    Registrar newRegistrar = loadRegistrar("NewRegistrar");
+    assertThat(newRegistrar.verifyPassword("foo-BAR2")).isFalse();
+    assertThat(newRegistrar.verifyPassword("ANewPassword")).isTrue();
+    assertThat(registrar.verifyPassword("randomstring")).isFalse();
+  }
+
+  @Test
+  void testFailure_invalidNewPassword_tooShort() throws Exception {
+    setEppInput("login_set_new_password.xml", ImmutableMap.of("NEWPW", "5Char"));
+    EppException thrown = assertThrows(GenericXmlSyntaxErrorException.class, this::runFlow);
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+    assertThat(thrown)
+        .hasMessageThat()
+        .contains(
+            "length = '5' is not facet-valid with respect to minLength '6' for type 'pwType'");
+  }
+
+  @Test
+  void testFailure_invalidNewPassword_tooLong() throws Exception {
+    setEppInput(
+        "login_set_new_password.xml", ImmutableMap.of("NEWPW", "ThisIsMoreThan16Characters"));
+    EppException thrown = assertThrows(GenericXmlSyntaxErrorException.class, this::runFlow);
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+    assertThat(thrown)
+        .hasMessageThat()
+        .contains(
+            "length = '26' is not facet-valid with respect to maxLength '16' for type 'pwType'");
+  }
+
+  @Test
+  void testFailure_invalidNewPassword_containsInvalidCharacter() throws Exception {
+    setEppInput("login_set_new_password.xml", ImmutableMap.of("NEWPW", "TheChar&IsNotValid"));
+    EppException thrown = assertThrows(GenericXmlSyntaxErrorException.class, this::runFlow);
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+    // Just generically assert on this error message because it's a pretty broad error owing to the
+    // overall XML simply not parsing correctly.
+    assertThat(thrown).hasMessageThat().contains("Syntax error");
  }

  @Test
--- a/core/src/test/java/google/registry/groups/GmailClientTest.java
+++ b/core/src/test/java/google/registry/groups/GmailClientTest.java
@@ -0,0 +1,202 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.groups;
+
+import static com.google.common.net.MediaType.CSV_UTF_8;
+import static com.google.common.net.MediaType.PLAIN_TEXT_UTF_8;
+import static com.google.common.truth.Truth.assertThat;
+import static java.nio.charset.StandardCharsets.UTF_8;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+import com.google.api.client.http.HttpResponseException;
+import com.google.api.services.gmail.Gmail;
+import com.google.api.services.gmail.Gmail.Users;
+import com.google.api.services.gmail.Gmail.Users.Messages;
+import com.google.api.services.gmail.Gmail.Users.Messages.Send;
+import com.google.api.services.gmail.model.Message;
+import google.registry.groups.GmailClient.RetriableGmailExceptionPredicate;
+import google.registry.util.EmailMessage;
+import google.registry.util.EmailMessage.Attachment;
+import google.registry.util.Retrier;
+import google.registry.util.SystemSleeper;
+import java.io.OutputStream;
+import javax.mail.Message.RecipientType;
+import javax.mail.Part;
+import javax.mail.internet.InternetAddress;
+import javax.mail.internet.MimeMessage;
+import javax.mail.internet.MimeMultipart;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.invocation.InvocationOnMock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.mockito.stubbing.Answer;
+import org.testcontainers.shaded.com.google.common.collect.ImmutableList;
+
+/** Unit tests for {@link GmailClient}. */
+@ExtendWith(MockitoExtension.class)
+public class GmailClientTest {
+
+  @Mock private Gmail gmail;
+  @Mock private HttpResponseException httpResponseException;
+
+  private GmailClient getGmailClient(boolean isExternalEmailAllowed) throws Exception {
+    return new GmailClient(
+        gmail,
+        new Retrier(new SystemSleeper(), 3),
+        isExternalEmailAllowed,
+        "from@example.com",
+        "My sender",
+        new InternetAddress("replyTo@example.com"));
+  }
+
+  @Test
+  public void sendEmail_sentWhenAllowed() throws Exception {
+    EmailMessage message =
+        EmailMessage.create(
+            "subject",
+            "body",
+            new InternetAddress("from@example.com"),
+            new InternetAddress("to@example.com"));
+    Send gSend = mock(Send.class);
+    Messages gMessages = mock(Messages.class);
+    Users gUsers = mock(Users.class);
+    when(gmail.users()).thenReturn(gUsers);
+    when(gUsers.messages()).thenReturn(gMessages);
+    when(gMessages.send(anyString(), any())).thenReturn(gSend);
+    getGmailClient(true).sendEmail(message);
+    verify(gmail, times(1)).users();
+  }
+
+  @Test
+  public void sendEmail_notSentWhenNotAllowed() throws Exception {
+    EmailMessage message =
+        EmailMessage.create(
+            "subject",
+            "body",
+            new InternetAddress("from@example.com"),
+            new InternetAddress("to@example.com"));
+    getGmailClient(false).sendEmail(message);
+    verifyNoInteractions(gmail);
+  }
+
+  @Test
+  public void toMimeMessage_fullMessage() throws Exception {
+    InternetAddress fromAddr = new InternetAddress("from@example.com", "My sender");
+    InternetAddress toAddr = new InternetAddress("to@example.com");
+    InternetAddress ccAddr = new InternetAddress("cc@example.com");
+    InternetAddress bccAddr = new InternetAddress("bcc@example.com");
+    EmailMessage emailMessage =
+        EmailMessage.newBuilder()
+            .setFrom(fromAddr)
+            .setRecipients(ImmutableList.of(toAddr))
+            .setSubject("My subject")
+            .setBody("My body")
+            .addCc(ccAddr)
+            .addBcc(bccAddr)
+            .setAttachment(
+                Attachment.newBuilder()
+                    .setFilename("filename")
+                    .setContent("foo,bar\nbaz,qux")
+                    .setContentType(CSV_UTF_8)
+                    .build())
+            .build();
+    MimeMessage mimeMessage = getGmailClient(true).toMimeMessage(emailMessage);
+    assertThat(mimeMessage.getFrom()).asList().containsExactly(fromAddr);
+    assertThat(mimeMessage.getRecipients(RecipientType.TO)).asList().containsExactly(toAddr);
+    assertThat(mimeMessage.getRecipients(RecipientType.CC)).asList().containsExactly(ccAddr);
+    assertThat(mimeMessage.getRecipients(RecipientType.BCC)).asList().containsExactly(bccAddr);
+    assertThat(mimeMessage.getSubject()).isEqualTo("My subject");
+    assertThat(mimeMessage.getContent()).isInstanceOf(MimeMultipart.class);
+    MimeMultipart parts = (MimeMultipart) mimeMessage.getContent();
+    Part body = parts.getBodyPart(0);
+    assertThat(body.getContentType()).isEqualTo(PLAIN_TEXT_UTF_8.toString());
+    assertThat(body.getContent()).isEqualTo("My body");
+    Part attachment = parts.getBodyPart(1);
+    assertThat(attachment.getContentType()).startsWith(CSV_UTF_8.toString());
+    assertThat(attachment.getContentType()).endsWith("name=filename");
+    assertThat(attachment.getContent()).isEqualTo("foo,bar\nbaz,qux");
+  }
+
+  @Test
+  public void toGmailMessage() throws Exception {
+    MimeMessage mimeMessage = mock(MimeMessage.class);
+    byte[] data = "My content".getBytes(UTF_8);
+    doAnswer(
+            new Answer() {
+              @Override
+              public Object answer(InvocationOnMock invocation) throws Throwable {
+                OutputStream os = invocation.getArgument(0);
+                os.write(data);
+                return null;
+              }
+            })
+        .when(mimeMessage)
+        .writeTo(any(OutputStream.class));
+    Message gmailMessage = GmailClient.toGmailMessage(mimeMessage);
+    assertThat(gmailMessage.decodeRaw()).isEqualTo(data);
+  }
+
+  @Test
+  public void isRetriable_trueIfNotHttpResponseException() {
+    assertThat(RetriableGmailExceptionPredicate.INSTANCE.test(new Exception())).isTrue();
+  }
+
+  @Test
+  public void isHttpResponseExceptionRetriable_trueIf500() {
+    when(httpResponseException.getStatusCode()).thenReturn(500);
+    assertThat(RetriableGmailExceptionPredicate.INSTANCE.test(httpResponseException)).isTrue();
+  }
+
+  @Test
+  public void isHttpResponseExceptionRetriable_trueIf429() {
+    when(httpResponseException.getStatusCode()).thenReturn(429);
+    assertThat(RetriableGmailExceptionPredicate.INSTANCE.test(httpResponseException)).isTrue();
+  }
+
+  @Test
+  public void isHttpResponseExceptionRetriable_trueIf403WithRateLimitOverage() {
+    when(httpResponseException.getStatusCode()).thenReturn(403);
+    when(httpResponseException.getStatusMessage()).thenReturn("rateLimitExceeded");
+    assertThat(RetriableGmailExceptionPredicate.INSTANCE.test(httpResponseException)).isTrue();
+  }
+
+  @Test
+  public void isHttpResponseExceptionRetriable_trueIf403WithUserRateLimitOverage() {
+    when(httpResponseException.getStatusCode()).thenReturn(403);
+    when(httpResponseException.getStatusMessage()).thenReturn("userRateLimitExceeded");
+    assertThat(RetriableGmailExceptionPredicate.INSTANCE.test(httpResponseException)).isTrue();
+  }
+
+  @Test
+  public void isHttpResponseExceptionRetriable_falseIf403WithLongLastingOverage() {
+    when(httpResponseException.getStatusCode()).thenReturn(403);
+    when(httpResponseException.getStatusMessage()).thenReturn("dailyLimitExceeded");
+    assertThat(RetriableGmailExceptionPredicate.INSTANCE.test(httpResponseException)).isFalse();
+  }
+
+  @Test
+  public void isHttpResponseExceptionRetriable_falseIfBadRequest() {
+    when(httpResponseException.getStatusCode()).thenReturn(400);
+    assertThat(RetriableGmailExceptionPredicate.INSTANCE.test(httpResponseException)).isFalse();
+  }
+}
--- a/core/src/test/java/google/registry/model/tld/TldTest.java
+++ b/core/src/test/java/google/registry/model/tld/TldTest.java
@@ -17,6 +17,8 @@ package google.registry.model.tld;
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth.assertWithMessage;
 import static com.google.common.truth.Truth8.assertThat;
+import static google.registry.model.EntityYamlUtils.createObjectMapper;
+import static google.registry.model.ImmutableObjectSubject.assertAboutImmutableObjects;
 import static google.registry.model.domain.token.AllocationToken.TokenType.DEFAULT_PROMO;
 import static google.registry.model.domain.token.AllocationToken.TokenType.SINGLE_USE;
 import static google.registry.model.tld.Tld.TldState.GENERAL_AVAILABILITY;
@@ -29,13 +31,16 @@ import static google.registry.testing.DatabaseHelper.newTld;
 import static google.registry.testing.DatabaseHelper.persistPremiumList;
 import static google.registry.testing.DatabaseHelper.persistReservedList;
 import static google.registry.testing.DatabaseHelper.persistResource;
+import static google.registry.testing.TestDataHelper.loadFile;
 import static google.registry.util.DateTimeUtils.END_OF_TIME;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
+import static google.registry.util.ResourceUtils.readResourceBytes;
 import static java.math.RoundingMode.UNNECESSARY;
 import static org.joda.money.CurrencyUnit.EUR;
 import static org.joda.money.CurrencyUnit.USD;
 import static org.junit.jupiter.api.Assertions.assertThrows;

+import com.fasterxml.jackson.databind.ObjectMapper;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedMap;
@@ -48,11 +53,13 @@ import google.registry.model.tld.label.PremiumList;
 import google.registry.model.tld.label.PremiumListDao;
 import google.registry.model.tld.label.ReservedList;
 import google.registry.persistence.VKey;
+import google.registry.tldconfig.idn.IdnTableEnum;
 import google.registry.util.SerializeUtils;
 import java.math.BigDecimal;
 import java.util.Optional;
 import org.joda.money.Money;
 import org.joda.time.DateTime;
+import org.joda.time.Duration;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;

@@ -94,6 +101,107 @@ public final class TldTest extends EntityTestCase {
    assertThat(SerializeUtils.serializeDeserialize(persisted)).isEqualTo(persisted);
  }

+  @Test
+  void testTldToYaml() throws Exception {
+    fakeClock.setTo(START_OF_TIME);
+    AllocationToken defaultToken =
+        persistResource(
+            new AllocationToken.Builder()
+                .setToken("bbbbb")
+                .setTokenType(DEFAULT_PROMO)
+                .setAllowedTlds(ImmutableSet.of("tld"))
+                .build());
+    Tld existingTld =
+        createTld("tld")
+            .asBuilder()
+            .setDnsAPlusAaaaTtl(Duration.standardHours(1))
+            .setDnsWriters(ImmutableSet.of("baz", "bang"))
+            .setEapFeeSchedule(
+                ImmutableSortedMap.of(
+                    START_OF_TIME,
+                    Money.of(USD, 0),
+                    DateTime.parse("2000-06-01T00:00:00Z"),
+                    Money.of(USD, 100),
+                    DateTime.parse("2000-06-02T00:00:00Z"),
+                    Money.of(USD, 0)))
+            .setAllowedFullyQualifiedHostNames(ImmutableSet.of("foo"))
+            .setDefaultPromoTokens(ImmutableList.of(defaultToken.createVKey()))
+            .setIdnTables(ImmutableSet.of(IdnTableEnum.JA, IdnTableEnum.EXTENDED_LATIN))
+            .build();
+
+    ObjectMapper mapper = createObjectMapper();
+    String yaml = mapper.writeValueAsString(existingTld);
+    assertThat(yaml).isEqualTo(loadFile(getClass(), "tld.yaml"));
+  }
+
+  @Test
+  void testYamlToTld() throws Exception {
+    fakeClock.setTo(START_OF_TIME);
+    AllocationToken defaultToken =
+        persistResource(
+            new AllocationToken.Builder()
+                .setToken("bbbbb")
+                .setTokenType(DEFAULT_PROMO)
+                .setAllowedTlds(ImmutableSet.of("tld"))
+                .build());
+    Tld existingTld =
+        createTld("tld")
+            .asBuilder()
+            .setDnsAPlusAaaaTtl(Duration.standardHours(1))
+            .setDnsWriters(ImmutableSet.of("baz", "bang"))
+            .setEapFeeSchedule(
+                ImmutableSortedMap.of(
+                    START_OF_TIME,
+                    Money.of(USD, 0),
+                    DateTime.parse("2000-06-01T00:00:00Z"),
+                    Money.of(USD, 100),
+                    DateTime.parse("2000-06-02T00:00:00Z"),
+                    Money.of(USD, 0)))
+            .setAllowedFullyQualifiedHostNames(ImmutableSet.of("foo"))
+            .setDefaultPromoTokens(ImmutableList.of(defaultToken.createVKey()))
+            .setIdnTables(ImmutableSet.of(IdnTableEnum.JA, IdnTableEnum.EXTENDED_LATIN))
+            .build();
+
+    ObjectMapper mapper = createObjectMapper();
+    Tld constructedTld =
+        mapper.readValue(readResourceBytes(getClass(), "tld.yaml").openBufferedStream(), Tld.class);
+    compareTlds(existingTld, constructedTld);
+  }
+
+  @Test
+  void testSuccess_tldYamlRoundtrip() throws Exception {
+    Tld testTld = createTld("test");
+    ObjectMapper mapper = createObjectMapper();
+    String yaml = mapper.writeValueAsString(testTld);
+    Tld constructedTld = mapper.readValue(yaml, Tld.class);
+    compareTlds(testTld, constructedTld);
+  }
+
+  // On YAML serialization/deserialization some null values may be changed to empty collections
+  void compareTlds(Tld existingTld, Tld constructedTld) {
+    assertAboutImmutableObjects()
+        .that(constructedTld)
+        .isEqualExceptFields(
+            existingTld,
+            "dnsWriters",
+            "idnTables",
+            "reservedListNames",
+            "allowedRegistrantContactIds",
+            "allowedFullyQualifiedHostNames",
+            "defaultPromoTokens");
+    assertThat(constructedTld.getDnsWriters())
+        .containsExactlyElementsIn(existingTld.getDnsWriters());
+    assertThat(constructedTld.getIdnTables()).containsExactlyElementsIn(existingTld.getIdnTables());
+    assertThat(constructedTld.getReservedListNames())
+        .containsExactlyElementsIn(existingTld.getReservedListNames());
+    assertThat(constructedTld.getAllowedRegistrantContactIds())
+        .containsExactlyElementsIn(existingTld.getAllowedRegistrantContactIds());
+    assertThat(constructedTld.getAllowedFullyQualifiedHostNames())
+        .containsExactlyElementsIn(existingTld.getAllowedFullyQualifiedHostNames());
+    assertThat(constructedTld.getDefaultPromoTokens())
+        .containsExactlyElementsIn(existingTld.getDefaultPromoTokens());
+  }
+
  @Test
  void testFailure_registryNotFound() {
    createTld("foo");
@@ -111,17 +219,17 @@ public final class TldTest extends EntityTestCase {
  @Test
  void testSettingCreateBillingCost() {
    Tld registry = Tld.get("tld").asBuilder().setCreateBillingCost(Money.of(USD, 42)).build();
-    assertThat(registry.getStandardCreateCost()).isEqualTo(Money.of(USD, 42));
+    assertThat(registry.getCreateBillingCost()).isEqualTo(Money.of(USD, 42));
    // The default value of 17 is set in createTld().
-    assertThat(registry.getStandardRestoreCost()).isEqualTo(Money.of(USD, 17));
+    assertThat(registry.getRestoreBillingCost()).isEqualTo(Money.of(USD, 17));
  }

  @Test
  void testSettingRestoreBillingCost() {
    Tld registry = Tld.get("tld").asBuilder().setRestoreBillingCost(Money.of(USD, 42)).build();
    // The default value of 13 is set in createTld().
-    assertThat(registry.getStandardCreateCost()).isEqualTo(Money.of(USD, 13));
-    assertThat(registry.getStandardRestoreCost()).isEqualTo(Money.of(USD, 42));
+    assertThat(registry.getCreateBillingCost()).isEqualTo(Money.of(USD, 13));
+    assertThat(registry.getRestoreBillingCost()).isEqualTo(Money.of(USD, 42));
  }

  @Test
@@ -251,7 +359,7 @@ public final class TldTest extends EntityTestCase {
  void testSettingServerStatusChangeBillingCost() {
    Tld registry =
        Tld.get("tld").asBuilder().setServerStatusChangeBillingCost(Money.of(USD, 42)).build();
-    assertThat(registry.getServerStatusChangeCost()).isEqualTo(Money.of(USD, 42));
+    assertThat(registry.getServerStatusChangeBillingCost()).isEqualTo(Money.of(USD, 42));
  }

  @Test
--- a/core/src/test/java/google/registry/persistence/transaction/ReplicaSimulatingJpaTransactionManager.java
+++ b/core/src/test/java/google/registry/persistence/transaction/ReplicaSimulatingJpaTransactionManager.java
@@ -59,11 +59,6 @@ public class ReplicaSimulatingJpaTransactionManager implements JpaTransactionMan
    return delegate.getEntityManager();
  }

-  @Override
-  public JpaTransactionManager setDatabaseSnapshot(String snapshotId) {
-    return delegate.setDatabaseSnapshot(snapshotId);
-  }
-
  @Override
  public <T> TypedQuery<T> query(String sqlString, Class<T> resultClass) {
    return delegate.query(sqlString, resultClass);
--- a/core/src/test/java/google/registry/reporting/spec11/GenerateSpec11ReportActionTest.java
+++ b/core/src/test/java/google/registry/reporting/spec11/GenerateSpec11ReportActionTest.java
@@ -93,7 +93,8 @@ class GenerateSpec11ReportActionTest extends BeamActionTestBase {
            .scheduleTime(
                clock
                    .nowUtc()
-                    .plus(Duration.standardMinutes(ReportingModule.ENQUEUE_DELAY_MINUTES))));
+                    // TODO(b/296582836): mitigating retry problem. Remove `+10` when bug is fixed.
+                    .plus(Duration.standardMinutes(ReportingModule.ENQUEUE_DELAY_MINUTES + 10))));
  }

  @Test
--- a/core/src/test/java/google/registry/reporting/spec11/Spec11EmailUtilsTest.java
+++ b/core/src/test/java/google/registry/reporting/spec11/Spec11EmailUtilsTest.java
@@ -27,14 +27,13 @@ import static google.registry.testing.DatabaseHelper.persistActiveHost;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.mockito.Mockito.doThrow;
-import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;

 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.net.MediaType;
+import google.registry.groups.GmailClient;
 import google.registry.model.domain.Domain;
 import google.registry.model.host.Host;
 import google.registry.persistence.transaction.JpaTestExtensions;
@@ -42,7 +41,6 @@ import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationT
 import google.registry.reporting.spec11.soy.Spec11EmailSoyInfo;
 import google.registry.testing.DatabaseHelper;
 import google.registry.util.EmailMessage;
-import google.registry.util.SendEmailService;
 import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Optional;
@@ -51,10 +49,14 @@ import javax.mail.internet.InternetAddress;
 import org.joda.time.LocalDate;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
 import org.junit.jupiter.api.extension.RegisterExtension;
 import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;

 /** Unit tests for {@link Spec11EmailUtils}. */
+@ExtendWith(MockitoExtension.class)
 class Spec11EmailUtilsTest {

  private static final ImmutableList<String> FAKE_RESOURCES = ImmutableList.of("foo");
@@ -98,9 +100,8 @@ class Spec11EmailUtilsTest {
  final JpaIntegrationTestExtension jpa =
      new JpaTestExtensions.Builder().buildIntegrationTestExtension();

-  private SendEmailService emailService;
+  @Mock private GmailClient gmailClient;
  private Spec11EmailUtils emailUtils;
-  private Spec11RegistrarThreatMatchesParser parser;
  private ArgumentCaptor<EmailMessage> contentCaptor;
  private final LocalDate date = new LocalDate(2018, 7, 15);

@@ -109,13 +110,10 @@ class Spec11EmailUtilsTest {

  @BeforeEach
  void beforeEach() throws Exception {
-    emailService = mock(SendEmailService.class);
-    parser = mock(Spec11RegistrarThreatMatchesParser.class);
-    when(parser.getRegistrarThreatMatches(date)).thenReturn(sampleThreatMatches());
    contentCaptor = ArgumentCaptor.forClass(EmailMessage.class);
    emailUtils =
        new Spec11EmailUtils(
-            emailService,
+            gmailClient,
            new InternetAddress("my-receiver@test.com"),
            new InternetAddress("abuse@test.com"),
            ImmutableList.of(
@@ -138,7 +136,7 @@ class Spec11EmailUtilsTest {
        "Super Cool Registry Monthly Threat Detector [2018-07-15]",
        sampleThreatMatches());
    // We inspect individual parameters because Message doesn't implement equals().
-    verify(emailService, times(3)).sendEmail(contentCaptor.capture());
+    verify(gmailClient, times(3)).sendEmail(contentCaptor.capture());
    List<EmailMessage> capturedContents = contentCaptor.getAllValues();
    validateMessage(
        capturedContents.get(0),
@@ -176,7 +174,7 @@ class Spec11EmailUtilsTest {
        "Super Cool Registry Daily Threat Detector [2018-07-15]",
        sampleThreatMatches());
    // We inspect individual parameters because Message doesn't implement equals().
-    verify(emailService, times(3)).sendEmail(contentCaptor.capture());
+    verify(gmailClient, times(3)).sendEmail(contentCaptor.capture());
    List<EmailMessage> capturedMessages = contentCaptor.getAllValues();
    validateMessage(
        capturedMessages.get(0),
@@ -217,7 +215,7 @@ class Spec11EmailUtilsTest {
        "Super Cool Registry Monthly Threat Detector [2018-07-15]",
        sampleThreatMatches());
    // We inspect individual parameters because Message doesn't implement equals().
-    verify(emailService, times(2)).sendEmail(contentCaptor.capture());
+    verify(gmailClient, times(2)).sendEmail(contentCaptor.capture());
    List<EmailMessage> capturedContents = contentCaptor.getAllValues();
    validateMessage(
        capturedContents.get(0),
@@ -250,7 +248,7 @@ class Spec11EmailUtilsTest {
        "Super Cool Registry Monthly Threat Detector [2018-07-15]",
        sampleThreatMatches());
    // We inspect individual parameters because Message doesn't implement equals().
-    verify(emailService, times(3)).sendEmail(contentCaptor.capture());
+    verify(gmailClient, times(3)).sendEmail(contentCaptor.capture());
    List<EmailMessage> capturedContents = contentCaptor.getAllValues();
    validateMessage(
        capturedContents.get(0),
@@ -289,7 +287,7 @@ class Spec11EmailUtilsTest {
    doThrow(new RuntimeException(new MessagingException("expected")))
        .doNothing()
        .doNothing()
-        .when(emailService)
+        .when(gmailClient)
        .sendEmail(contentCaptor.capture());
    RuntimeException thrown =
        assertThrows(
@@ -305,7 +303,7 @@ class Spec11EmailUtilsTest {
        .isEqualTo("Emailing Spec11 reports failed, first exception:");
    assertThat(thrown).hasCauseThat().hasMessageThat().isEqualTo("expected");
    // Verify we sent an e-mail alert
-    verify(emailService, times(3)).sendEmail(contentCaptor.capture());
+    verify(gmailClient, times(3)).sendEmail(contentCaptor.capture());
    List<EmailMessage> capturedMessages = contentCaptor.getAllValues();
    validateMessage(
        capturedMessages.get(0),
@@ -338,7 +336,7 @@ class Spec11EmailUtilsTest {
  @Test
  void testSuccess_sendAlertEmail() throws Exception {
    emailUtils.sendAlertEmail("Spec11 Pipeline Alert: 2018-07", "Alert!");
-    verify(emailService).sendEmail(contentCaptor.capture());
+    verify(gmailClient).sendEmail(contentCaptor.capture());
    validateMessage(
        contentCaptor.getValue(),
        "abuse@test.com",
@@ -363,7 +361,7 @@ class Spec11EmailUtilsTest {
        Spec11EmailSoyInfo.MONTHLY_SPEC_11_EMAIL,
        "Super Cool Registry Monthly Threat Detector [2018-07-15]",
        sampleThreatMatches());
-    verify(emailService, times(3)).sendEmail(contentCaptor.capture());
+    verify(gmailClient, times(3)).sendEmail(contentCaptor.capture());
    assertThat(contentCaptor.getAllValues().get(0).recipients())
        .containsExactly(new InternetAddress("johndoe@theregistrar.com"));
  }
--- a/core/src/test/java/google/registry/tools/CommandTestCase.java
+++ b/core/src/test/java/google/registry/tools/CommandTestCase.java
@@ -80,11 +80,12 @@ public abstract class CommandTestCase<C extends Command> {
    RegistryToolEnvironment.UNITTEST.setup(systemPropertyExtension);
    command = newCommandInstance();

-    // Capture standard output/error.
+    // Capture standard output/error. Use a single-byte encoding to emulate platforms where default
+    // charset is not UTF_8.
    oldStdout = System.out;
-    System.setOut(new PrintStream(new OutputSplitter(System.out, stdout)));
+    System.setOut(new PrintStream(new OutputSplitter(System.out, stdout), false, "US-ASCII"));
    oldStderr = System.err;
-    System.setErr(new PrintStream(new OutputSplitter(System.err, stderr)));
+    System.setErr(new PrintStream(new OutputSplitter(System.err, stderr), false, "US-ASCII"));
  }

  @AfterEach
--- a/core/src/test/java/google/registry/tools/CreateTldCommandTest.java
+++ b/core/src/test/java/google/registry/tools/CreateTldCommandTest.java
@@ -225,7 +225,7 @@ class CreateTldCommandTest extends CommandTestCase<CreateTldCommand> {
        "--roid_suffix=Q9JYB4C",
        "--dns_writers=VoidDnsWriter",
        "xn--q9jyb4c");
-    assertThat(Tld.get("xn--q9jyb4c").getStandardCreateCost()).isEqualTo(Money.of(USD, 42.42));
+    assertThat(Tld.get("xn--q9jyb4c").getCreateBillingCost()).isEqualTo(Money.of(USD, 42.42));
  }

  @Test
@@ -235,7 +235,7 @@ class CreateTldCommandTest extends CommandTestCase<CreateTldCommand> {
        "--roid_suffix=Q9JYB4C",
        "--dns_writers=VoidDnsWriter",
        "xn--q9jyb4c");
-    assertThat(Tld.get("xn--q9jyb4c").getStandardRestoreCost()).isEqualTo(Money.of(USD, 42.42));
+    assertThat(Tld.get("xn--q9jyb4c").getRestoreBillingCost()).isEqualTo(Money.of(USD, 42.42));
  }

  @Test
@@ -245,7 +245,8 @@ class CreateTldCommandTest extends CommandTestCase<CreateTldCommand> {
        "--roid_suffix=Q9JYB4C",
        "--dns_writers=VoidDnsWriter",
        "xn--q9jyb4c");
-    assertThat(Tld.get("xn--q9jyb4c").getServerStatusChangeCost()).isEqualTo(Money.of(USD, 42.42));
+    assertThat(Tld.get("xn--q9jyb4c").getServerStatusChangeBillingCost())
+        .isEqualTo(Money.of(USD, 42.42));
  }

  @Test
@@ -271,8 +272,8 @@ class CreateTldCommandTest extends CommandTestCase<CreateTldCommand> {
        "--dns_writers=VoidDnsWriter",
        "xn--q9jyb4c");
    Tld registry = Tld.get("xn--q9jyb4c");
-    assertThat(registry.getStandardCreateCost()).isEqualTo(Money.ofMajor(JPY, 12345));
-    assertThat(registry.getStandardRestoreCost()).isEqualTo(Money.ofMajor(JPY, 67890));
+    assertThat(registry.getCreateBillingCost()).isEqualTo(Money.ofMajor(JPY, 12345));
+    assertThat(registry.getRestoreBillingCost()).isEqualTo(Money.ofMajor(JPY, 67890));
    assertThat(registry.getStandardRenewCost(START_OF_TIME)).isEqualTo(Money.ofMajor(JPY, 101112));
  }

--- a/core/src/test/java/google/registry/tools/GetTldCommandTest.java
+++ b/core/src/test/java/google/registry/tools/GetTldCommandTest.java
@@ -16,18 +16,27 @@ package google.registry.tools;

 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.createTlds;
+import static google.registry.testing.TestDataHelper.loadFile;
 import static org.junit.jupiter.api.Assertions.assertThrows;

 import com.beust.jcommander.ParameterException;
+import google.registry.model.EntityYamlUtils;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;

 /** Unit tests for {@link GetTldCommand}. */
 class GetTldCommandTest extends CommandTestCase<GetTldCommand> {

+  @BeforeEach
+  void beforeEach() {
+    command.objectMapper = EntityYamlUtils.createObjectMapper();
+  }
+
  @Test
  void testSuccess() throws Exception {
    createTld("xn--q9jyb4c");
    runCommand("xn--q9jyb4c");
+    assertInStdout(loadFile(getClass(), "tld.yaml"));
  }

  @Test
--- a/core/src/test/java/google/registry/tools/UpdateTldCommandTest.java
+++ b/core/src/test/java/google/registry/tools/UpdateTldCommandTest.java
@@ -299,13 +299,13 @@ class UpdateTldCommandTest extends CommandTestCase<UpdateTldCommand> {
  @Test
  void testSuccess_createBillingCostFlag() throws Exception {
    runCommandForced("--create_billing_cost=\"USD 42.42\"", "xn--q9jyb4c");
-    assertThat(Tld.get("xn--q9jyb4c").getStandardCreateCost()).isEqualTo(Money.of(USD, 42.42));
+    assertThat(Tld.get("xn--q9jyb4c").getCreateBillingCost()).isEqualTo(Money.of(USD, 42.42));
  }

  @Test
  void testSuccess_restoreBillingCostFlag() throws Exception {
    runCommandForced("--restore_billing_cost=\"USD 42.42\"", "xn--q9jyb4c");
-    assertThat(Tld.get("xn--q9jyb4c").getStandardRestoreCost()).isEqualTo(Money.of(USD, 42.42));
+    assertThat(Tld.get("xn--q9jyb4c").getRestoreBillingCost()).isEqualTo(Money.of(USD, 42.42));
  }

  @Test
@@ -330,10 +330,10 @@ class UpdateTldCommandTest extends CommandTestCase<UpdateTldCommand> {
        "--registry_lock_or_unlock_cost=\"JPY 9001\"",
        "xn--q9jyb4c");
    Tld registry = Tld.get("xn--q9jyb4c");
-    assertThat(registry.getStandardCreateCost()).isEqualTo(Money.ofMajor(JPY, 12345));
-    assertThat(registry.getStandardRestoreCost()).isEqualTo(Money.ofMajor(JPY, 67890));
+    assertThat(registry.getCreateBillingCost()).isEqualTo(Money.ofMajor(JPY, 12345));
+    assertThat(registry.getRestoreBillingCost()).isEqualTo(Money.ofMajor(JPY, 67890));
    assertThat(registry.getStandardRenewCost(START_OF_TIME)).isEqualTo(Money.ofMajor(JPY, 101112));
-    assertThat(registry.getServerStatusChangeCost()).isEqualTo(Money.ofMajor(JPY, 97865));
+    assertThat(registry.getServerStatusChangeBillingCost()).isEqualTo(Money.ofMajor(JPY, 97865));
    assertThat(registry.getRegistryLockOrUnlockBillingCost()).isEqualTo(Money.ofMajor(JPY, 9001));
  }

--- a/core/src/test/java/google/registry/ui/server/console/ConsoleDomainGetActionTest.java
+++ b/core/src/test/java/google/registry/ui/server/console/ConsoleDomainGetActionTest.java
@@ -25,12 +25,12 @@ import google.registry.model.console.RegistrarRole;
 import google.registry.model.console.User;
 import google.registry.model.console.UserRoles;
 import google.registry.persistence.transaction.JpaTestExtensions;
+import google.registry.request.RequestModule;
 import google.registry.request.auth.AuthResult;
 import google.registry.request.auth.AuthSettings.AuthLevel;
 import google.registry.request.auth.UserAuthInfo;
 import google.registry.testing.DatabaseHelper;
 import google.registry.testing.FakeResponse;
-import google.registry.util.UtilsModule;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
@@ -38,7 +38,7 @@ import org.junit.jupiter.api.extension.RegisterExtension;
 /** Tests for {@link google.registry.ui.server.console.ConsoleDomainGetAction}. */
 public class ConsoleDomainGetActionTest {

-  private static final Gson GSON = UtilsModule.provideGson();
+  private static final Gson GSON = RequestModule.provideGson();
  private static final FakeResponse RESPONSE = new FakeResponse();

  @RegisterExtension
--- a/core/src/test/java/google/registry/ui/server/console/RegistrarsActionTest.java
+++ b/core/src/test/java/google/registry/ui/server/console/RegistrarsActionTest.java
@@ -15,11 +15,17 @@
 package google.registry.ui.server.console;

 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.testing.DatabaseHelper.loadAllOf;
+import static google.registry.testing.DatabaseHelper.loadRegistrar;
 import static google.registry.testing.DatabaseHelper.persistNewRegistrar;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.SqlHelper.saveRegistrar;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;

 import com.google.api.client.http.HttpStatusCodes;
+import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.gson.Gson;
 import google.registry.model.console.GlobalRole;
@@ -27,21 +33,69 @@ import google.registry.model.console.RegistrarRole;
 import google.registry.model.console.User;
 import google.registry.model.console.UserRoles;
 import google.registry.model.registrar.Registrar;
+import google.registry.model.registrar.RegistrarPoc;
 import google.registry.persistence.transaction.JpaTestExtensions;
+import google.registry.request.Action;
+import google.registry.request.RequestModule;
 import google.registry.request.auth.AuthResult;
 import google.registry.request.auth.AuthSettings.AuthLevel;
 import google.registry.request.auth.UserAuthInfo;
+import google.registry.testing.DeterministicStringGenerator;
 import google.registry.testing.FakeResponse;
-import google.registry.util.UtilsModule;
+import google.registry.ui.server.registrar.RegistrarConsoleModule;
+import google.registry.util.StringGenerator;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.StringReader;
+import java.util.Map;
+import java.util.Optional;
+import java.util.stream.Collectors;
+import javax.servlet.http.HttpServletRequest;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;

 /** Tests for {@link google.registry.ui.server.console.RegistrarsAction}. */
 class RegistrarsActionTest {

-  private static final Gson GSON = UtilsModule.provideGson();
+  private final HttpServletRequest request = mock(HttpServletRequest.class);
+  private static final Gson GSON = RequestModule.provideGson();
  private FakeResponse response;

+  private StringGenerator passwordGenerator =
+      new DeterministicStringGenerator("abcdefghijklmnopqrstuvwxyz");
+  private StringGenerator passcodeGenerator = new DeterministicStringGenerator("314159265");
+
+  private ImmutableMap<String, String> userFriendlyKeysToRegistrarKeys =
+      ImmutableMap.of(
+          "registrarId", "registrarId",
+          "registrarName", "name",
+          "billingAccountMap", "billingAccount",
+          "ianaIdentifier", "ianaId",
+          "icannReferralEmail", "referralEmail",
+          "driveFolderId", "driveId",
+          "emailAddress", "consoleUserEmail",
+          "localizedAddress", "address");
+
+  private ImmutableMap<String, String> registrarParamMap =
+      ImmutableMap.of(
+          "registrarId",
+          "regIdTest",
+          "registrarName",
+          "name",
+          "billingAccountMap",
+          "{\"USD\": \"789\"}",
+          "ianaIdentifier",
+          "123",
+          "icannReferralEmail",
+          "cannReferralEmail@gmail.com",
+          "driveFolderId",
+          "testDriveId",
+          "emailAddress",
+          "testEmailAddress@gmail.com",
+          "localizedAddress",
+          "{ \"street\": [\"test street\"], \"city\": \"test city\", \"state\": \"test state\","
+              + " \"zip\": \"00700\", \"countryCode\": \"US\" }");
+
  @RegisterExtension
  final JpaTestExtensions.JpaIntegrationTestExtension jpa =
      new JpaTestExtensions.Builder().buildIntegrationTestExtension();
@@ -53,6 +107,7 @@ class RegistrarsActionTest {
    persistResource(registrar);
    RegistrarsAction action =
        createAction(
+            Action.Method.GET,
            AuthResult.create(
                AuthLevel.USER,
                UserAuthInfo.create(
@@ -60,22 +115,98 @@ class RegistrarsActionTest {
                        new UserRoles.Builder().setGlobalRole(GlobalRole.SUPPORT_LEAD).build()))));
    action.run();
    assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_OK);
-    assertThat(response.getPayload()).isEqualTo("[\"NewRegistrar\",\"TheRegistrar\"]");
+    String payload = response.getPayload();
+    assertThat(
+            ImmutableList.of("\"registrarId\":\"NewRegistrar\"", "\"registrarId\":\"TheRegistrar\"")
+                .stream()
+                .allMatch(s -> payload.contains(s)))
+        .isTrue();
  }

  @Test
-  void testSuccess_getRegistrarIds() {
+  void testSuccess_getRegistrars() {
    saveRegistrar("registrarId");
    RegistrarsAction action =
        createAction(
+            Action.Method.GET,
            AuthResult.create(
                AuthLevel.USER,
                UserAuthInfo.create(
                    createUser(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build()))));
    action.run();
    assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_OK);
+    String payload = response.getPayload();
+    assertThat(
+            ImmutableList.of(
+                    "\"registrarId\":\"NewRegistrar\"",
+                    "\"registrarId\":\"TheRegistrar\"",
+                    "\"registrarId\":\"registrarId\"")
+                .stream()
+                .allMatch(s -> payload.contains(s)))
+        .isTrue();
+  }
+
+  @Test
+  void testSuccess_createRegistrar() {
+    RegistrarsAction action =
+        createAction(
+            Action.Method.POST,
+            AuthResult.create(
+                AuthLevel.USER,
+                UserAuthInfo.create(createUser(new UserRoles.Builder().setIsAdmin(true).build()))));
+    action.run();
+    assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_OK);
+    Registrar r = loadRegistrar("regIdTest");
+    assertThat(r).isNotNull();
+    assertThat(
+            loadAllOf(RegistrarPoc.class).stream()
+                .filter(rPOC -> rPOC.getEmailAddress().equals("testEmailAddress@gmail.com"))
+                .findAny()
+                .isPresent())
+        .isTrue();
+  }
+
+  @Test
+  void testFailure_createRegistrar_missingValue() {
+    ImmutableMap<String, String> copy = ImmutableMap.copyOf(registrarParamMap);
+    copy.keySet()
+        .forEach(
+            key -> {
+              registrarParamMap =
+                  ImmutableMap.copyOf(
+                      copy.entrySet().stream()
+                          .filter(entry -> !entry.getKey().equals(key))
+                          .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue)));
+              RegistrarsAction action =
+                  createAction(
+                      Action.Method.POST,
+                      AuthResult.create(
+                          AuthLevel.USER,
+                          UserAuthInfo.create(
+                              createUser(new UserRoles.Builder().setIsAdmin(true).build()))));
+              action.run();
+              assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_BAD_REQUEST);
+              assertThat(response.getPayload())
+                  .isEqualTo(
+                      GSON.toJson(
+                          String.format(
+                              "Missing value for %s", userFriendlyKeysToRegistrarKeys.get(key))));
+            });
+  }
+
+  @Test
+  void testFailure_createRegistrar_existingRegistrar() {
+    saveRegistrar("regIdTest");
+    RegistrarsAction action =
+        createAction(
+            Action.Method.POST,
+            AuthResult.create(
+                AuthLevel.USER,
+                UserAuthInfo.create(createUser(new UserRoles.Builder().setIsAdmin(true).build()))));
+    action.run();
+    assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_BAD_REQUEST);
    assertThat(response.getPayload())
-        .isEqualTo("[\"NewRegistrar\",\"TheRegistrar\",\"registrarId\"]");
+        .isEqualTo(GSON.toJson("Registrar with registrarId regIdTest already exists"));
  }

  @Test
@@ -83,6 +214,7 @@ class RegistrarsActionTest {
    saveRegistrar("registrarId");
    RegistrarsAction action =
        createAction(
+            Action.Method.GET,
            AuthResult.create(
                AuthLevel.USER,
                UserAuthInfo.create(
@@ -105,8 +237,44 @@ class RegistrarsActionTest {
        .build();
  }

-  private RegistrarsAction createAction(AuthResult authResult) {
+  private RegistrarsAction createAction(Action.Method method, AuthResult authResult) {
    response = new FakeResponse();
-    return new RegistrarsAction(authResult, response, GSON);
+    when(request.getMethod()).thenReturn(method.toString());
+    if (method.equals(Action.Method.GET)) {
+      return new RegistrarsAction(
+          request,
+          authResult,
+          response,
+          GSON,
+          Optional.ofNullable(null),
+          passwordGenerator,
+          passcodeGenerator);
+    } else {
+      try {
+        doReturn(new BufferedReader(new StringReader(registrarParamMap.toString())))
+            .when(request)
+            .getReader();
+      } catch (IOException e) {
+        return new RegistrarsAction(
+            request,
+            authResult,
+            response,
+            GSON,
+            Optional.ofNullable(null),
+            passwordGenerator,
+            passcodeGenerator);
+      }
+      Optional<Registrar> maybeRegistrar =
+          RegistrarConsoleModule.provideRegistrar(
+              GSON, RequestModule.provideJsonBody(request, GSON));
+      return new RegistrarsAction(
+          request,
+          authResult,
+          response,
+          GSON,
+          maybeRegistrar,
+          passwordGenerator,
+          passcodeGenerator);
+    }
  }
 }
--- a/core/src/test/java/google/registry/ui/server/console/settings/ContactActionTest.java
+++ b/core/src/test/java/google/registry/ui/server/console/settings/ContactActionTest.java
@@ -41,7 +41,6 @@ import google.registry.request.auth.AuthSettings.AuthLevel;
 import google.registry.request.auth.UserAuthInfo;
 import google.registry.testing.FakeResponse;
 import google.registry.ui.server.registrar.RegistrarConsoleModule;
-import google.registry.util.UtilsModule;
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.StringReader;
@@ -73,7 +72,7 @@ class ContactActionTest {
  private Registrar testRegistrar;
  private final HttpServletRequest request = mock(HttpServletRequest.class);
  private RegistrarPoc testRegistrarPoc;
-  private static final Gson GSON = UtilsModule.provideGson();
+  private static final Gson GSON = RequestModule.provideGson();
  private FakeResponse response;

  @RegisterExtension
@@ -239,8 +238,7 @@ class ContactActionTest {
    if (method.equals(Action.Method.GET)) {
      return new ContactAction(request, authResult, response, GSON, registrarId, Optional.empty());
    } else {
-      when(request.getReader())
-          .thenReturn(new BufferedReader(new StringReader("{\"contacts\":" + contacts + "}")));
+      when(request.getReader()).thenReturn(new BufferedReader(new StringReader(contacts)));
      Optional<ImmutableSet<RegistrarPoc>> maybeContacts =
          RegistrarConsoleModule.provideContacts(
              GSON, RequestModule.provideJsonBody(request, GSON));
--- a/core/src/test/java/google/registry/ui/server/console/settings/SecurityActionTest.java
+++ b/core/src/test/java/google/registry/ui/server/console/settings/SecurityActionTest.java
@@ -15,21 +15,17 @@
 package google.registry.ui.server.console.settings;

 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.testing.CertificateSamples.SAMPLE_CERT;
 import static google.registry.testing.CertificateSamples.SAMPLE_CERT2;
 import static google.registry.testing.DatabaseHelper.loadRegistrar;
-import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.SqlHelper.saveRegistrar;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;

 import com.google.api.client.http.HttpStatusCodes;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSetMultimap;
 import com.google.common.collect.ImmutableSortedMap;
-import com.google.common.net.InetAddresses;
 import com.google.gson.Gson;
 import google.registry.flows.certs.CertificateChecker;
 import google.registry.model.console.GlobalRole;
@@ -37,7 +33,6 @@ import google.registry.model.console.User;
 import google.registry.model.console.UserRoles;
 import google.registry.model.registrar.Registrar;
 import google.registry.persistence.transaction.JpaTestExtensions;
-import google.registry.request.Action;
 import google.registry.request.RequestModule;
 import google.registry.request.auth.AuthResult;
 import google.registry.request.auth.AuthSettings.AuthLevel;
@@ -46,8 +41,6 @@ import google.registry.request.auth.UserAuthInfo;
 import google.registry.testing.FakeClock;
 import google.registry.testing.FakeResponse;
 import google.registry.ui.server.registrar.RegistrarConsoleModule;
-import google.registry.util.CidrAddressBlock;
-import google.registry.util.UtilsModule;
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.StringReader;
@@ -66,7 +59,7 @@ class SecurityActionTest {
          "{\"registrarId\": \"registrarId\", \"clientCertificate\": \"%s\","
              + " \"ipAddressAllowList\": [\"192.168.1.1/32\"]}",
          SAMPLE_CERT2);
-  private static final Gson GSON = UtilsModule.provideGson();
+  private static final Gson GSON = RequestModule.provideGson();
  private final HttpServletRequest request = mock(HttpServletRequest.class);
  private final FakeClock clock = new FakeClock();
  private Registrar testRegistrar;
@@ -94,39 +87,11 @@ class SecurityActionTest {
    testRegistrar = saveRegistrar("registrarId");
  }

-  @Test
-  void testSuccess_getRegistrarInfo() throws IOException {
-    persistResource(
-        testRegistrar
-            .asBuilder()
-            .setClientCertificate(SAMPLE_CERT, clock.nowUtc())
-            .setIpAddressAllowList(
-                ImmutableSet.of(
-                    CidrAddressBlock.create(InetAddresses.forString("192.168.1.1"), 32),
-                    CidrAddressBlock.create(InetAddresses.forString("2001:db8::1"), 128)))
-            .build());
-    SecurityAction action =
-        createAction(
-            Action.Method.GET,
-            AuthResult.create(
-                AuthLevel.USER,
-                UserAuthInfo.create(
-                    createUser(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build()))),
-            testRegistrar.getRegistrarId());
-    action.run();
-    assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_OK);
-    String payload = response.getPayload().replace("\\n", "").replace("\\u003d", "=");
-    assertThat(payload).contains(SAMPLE_CERT.replace("\n", ""));
-    assertThat(payload).contains("192.168.1.1/32");
-    assertThat(payload).contains("2001:db8:0:0:0:0:0:1/128");
-  }
-
  @Test
  void testSuccess_postRegistrarInfo() throws IOException {
    clock.setTo(DateTime.parse("2020-11-01T00:00:00Z"));
    SecurityAction action =
        createAction(
-            Action.Method.POST,
            AuthResult.create(
                AuthLevel.USER,
                UserAuthInfo.create(
@@ -149,28 +114,12 @@ class SecurityActionTest {
        .build();
  }

-  private SecurityAction createAction(
-      Action.Method method, AuthResult authResult, String registrarId) throws IOException {
-    when(request.getMethod()).thenReturn(method.toString());
-    if (method.equals(Action.Method.GET)) {
+  private SecurityAction createAction(AuthResult authResult, String registrarId)
+      throws IOException {
+    doReturn(new BufferedReader(new StringReader(jsonRegistrar1))).when(request).getReader();
+    Optional<Registrar> maybeRegistrar =
+        RegistrarConsoleModule.provideRegistrar(GSON, RequestModule.provideJsonBody(request, GSON));
      return new SecurityAction(
-          request,
-          authResult,
-          response,
-          GSON,
-          certificateChecker,
-          registrarAccessor,
-          registrarId,
-          Optional.empty());
-    } else {
-      doReturn(new BufferedReader(new StringReader("{\"registrar\":" + jsonRegistrar1 + "}")))
-          .when(request)
-          .getReader();
-      Optional<Registrar> maybeRegistrar =
-          RegistrarConsoleModule.provideRegistrar(
-              GSON, RequestModule.provideJsonBody(request, GSON));
-      return new SecurityAction(
-          request,
          authResult,
          response,
          GSON,
@@ -178,6 +127,6 @@ class SecurityActionTest {
          registrarAccessor,
          registrarId,
          maybeRegistrar);
-    }
+
  }
 }
--- a/core/src/test/resources/google/registry/flows/domain/domain_delete_response_fee_free_grace.xml
+++ b/core/src/test/resources/google/registry/flows/domain/domain_delete_response_fee_free_grace.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<epp xmlns:domain="urn:ietf:params:xml:ns:domain-1.0" xmlns:contact="urn:ietf:params:xml:ns:contact-1.0" xmlns:fee="urn:ietf:params:xml:ns:fee-0.6" xmlns:packageToken="urn:google:params:xml:ns:packageToken-1.0" xmlns="urn:ietf:params:xml:ns:epp-1.0" xmlns:rgp="urn:ietf:params:xml:ns:rgp-1.0" xmlns:fee11="urn:ietf:params:xml:ns:fee-0.11" xmlns:fee12="urn:ietf:params:xml:ns:fee-0.12" xmlns:launch="urn:ietf:params:xml:ns:launch-1.0" xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1" xmlns:host="urn:ietf:params:xml:ns:host-1.0">
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0" xmlns:fee12="urn:ietf:params:xml:ns:fee-0.12">
  <response>
    <result code="1000">
      <msg>Command completed successfully</msg>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Weimin Yu	cfcafeefc6	Mitigate Cloud task retry problem (#2116 ) * Mitigate Cloud task retry problem Increase PublishSpec11Action start delay to avoid the need to retry. The only other use case is invoice, which typically does not retry: delay is 10 minutes, pipeline finishes within 7 minutes.	2023-08-18 17:14:03 -04:00
Weimin Yu	c32d831dd6	Add logging about Spec11 email sending (#2115 )	2023-08-18 15:02:03 -04:00
Ben McIlwain	b38e0efe9a	Refactor the way that the console BE parses POST bodies (#2113 ) (#2109 ) This includes two changes: 1. Creating a base string-type adapter for use parsing to/from JSON classes that are represented as simple strings 2. Changing the object-provider methods so that the POST bodies should contain precisely the expected object(s) and nothing else. This way, it's easier for the frontend and backend to agree that, for instance, one POST endpoint might accept exactly a Registrar object, or a list of Contact objects. Co-Authored-By: gbrodman <gbrodman@google.com>	2023-08-18 12:30:35 -04:00
Lai Jiang	67cb411c99	Remove DatabaseSnapshot (#2105 ) It is no longer being used.	2023-08-17 22:40:54 -04:00
gbrodman	9f551eb552	Refactor the way that the console BE parses POST bodies (#2113 ) This includes two changes: 1. Creating a base string-type adapter for use parsing to/from JSON classes that are represented as simple strings 2. Changing the object-provider methods so that the POST bodies should contain precisely the expected object(s) and nothing else. This way, it's easier for the frontend and backend to agree that, for instance, one POST endpoint might accept exactly a Registrar object, or a list of Contact objects.	2023-08-17 15:51:21 -04:00
sarahcaseybot	655f05c58c	Remove references to cloud-build-local (#2111 ) * Update cloudbuild-nomulus to save standardTest logs to GCS * Remove step changes from cloudbuild-nomulus	2023-08-17 15:26:41 -04:00
Pavlo Tkach	95c810ddf4	Add script to allow quickly update number of instances (#2112 ) This is a fast and easy way to update number of instances for the service deployed to app engine. Works with manual-scaling types services.	2023-08-17 12:33:35 -04:00
Pavlo Tkach	ec9a220bc3	Add console registrars screen API support to /console-api/registrars endpoint (#2095 )	2023-08-17 10:17:23 -04:00
Weimin Yu	68d35d2d95	Fix unicode issue in GetTldCommand (#2108 )	2023-08-16 12:24:35 -04:00
Weimin Yu	99840488a1	Fix TldTest (#2107 ) Test data should be loaded from resources, not source tree.	2023-08-16 11:31:21 -04:00
Lai Jiang	ee7c8fb018	Disable flaky tests temporarily (#2106 )	2023-08-15 13:59:56 -04:00
Weimin Yu	c6f62dcffd	Fix the alert recipient address for Spec11 (#2103 ) During email migration, alerts should be sent to the address annotated with `newAlertRecipientEmailAddress`.	2023-08-10 15:38:13 -04:00
sarahcaseybot	ee66805d2e	Modify getTldCommand to return TLD in YAML (#2102 )	2023-08-10 14:20:56 -04:00
Weimin Yu	d7a3c0c439	Send Spec11 emails using Gmail (#2101 ) First of a series of migrations to Gmail. This can only be verified in production.	2023-08-10 10:26:28 -04:00
Weimin Yu	45666773ee	Enable/disable email sending by environments (#2099 )	2023-08-09 10:46:48 -04:00
Lai Jiang	b8b5152336	Bump PUBAPI instance number to 24 (#2098 )	2023-08-08 11:23:50 -04:00
Weimin Yu	0f6302e92b	Add tests to GmailClient (#2097 ) Also make GmailClient do retries on transit errors.	2023-08-07 16:05:15 -04:00
Lai Jiang	e594bd13a1	Revert google-cloud-storage to 2.22.6 (#2093 ) 2.25.0 contains a breaking change that made HttpStorageOptions not serializeable, which breaks RDE as it needs to access GCS from Beam. 2.22.6 was the last version that was used before the Gradle upgrade. Also had to downgrade google-cloud-nio to pass the tests. For some inexplicable reason, I had to manually add guava-listenablefuture as testRuntimeClasspath/runtimeClasspath/deploy_jar dependencies to the networking, docs and prober subprojects' lock files, as running `gradle test --write-locks` would NOT add them and succeed; but without `--write-locks`, running the corresponding tests would fail. See: b/294378137.	2023-08-07 12:21:08 -04:00
gbrodman	00051dbc0f	Ignore/exclude IDEA-generated classpath index files (#2094 ) See https://youtrack.jetbrains.com/issue/IDEA-305759/Gradle-cannot-handle-classpath.index-duplicates for more info -- it looks like this is fixed in some recent versions but as of right now it doesn't seem like it's fixed on the Google-managed version	2023-08-07 11:10:25 -04:00
Weimin Yu	aab89fb816	Re-enable flyway deadlock check (#2092 ) Use a system property to specify whether this check should be executed. We will update the presubmit test script to run this check only during foss-pr.	2023-08-03 15:34:30 -04:00
sarahcaseybot	6ea548a35d	Change static __REMOVEPACKAGE__ token to __REMOVEDOMAIN__ token (#2090 ) * Change static __REMOVEPACKAGE__ token to __REMOVEDOMAIN__ token * FIx some references * Fix variable name * Update docs	2023-08-03 14:09:43 -04:00
sarahcaseybot	733e9a4a6a	Change packageToken extension to bulkToken extension (#2091 ) * Change packageToken extension to bulkToken extension * Small fixes	2023-08-02 17:06:20 -04:00
Weimin Yu	10d28efa1c	Add placeholder configs for Gmail (#2089 ) Add placeholder configs for sending emails using Gmail in GSuite. The names of the new configs are temporary. After migration they will revert to the names currently in use by the AppEngine email API.	2023-08-02 16:09:45 -04:00
Weimin Yu	1e0a0cf29e	Temporarily disable flyway single-table check (#2088 )	2023-07-31 14:34:53 -04:00
Lai Jiang	0c824fed5a	Fix time inversion error when writing metrics (#2086 ) The instance ID used to be uniquely determined by App Engine SDK. Since we no longer calls the SDK, we need a way to distinguish instances so that their metrics would not stump on each other and result in a time inversion error (as we have seen frequently in the logs since the removal of the App Engine SDK).	2023-07-27 13:05:11 -04:00
gbrodman	4aa1bd0856	Update Gradle to 8.2.1 (#2087 ) This includes removing (hopefully temporarily) the gradle-lint plugin as it is incompatible with various Gradle versions (see https://github.com/nebula-plugins/gradle-lint-plugin/issues/393). This is somewhat unfortunate since the plugin is useful for removing unused dependencies, though with the relatively small amount of Gradle code we write hopefully it will not be missed much. If Nebula changes their code to be compatible with Gradle 8+, we can re-add it easily. This upgrade means we can remove the code added in `342051e1`.	2023-07-27 12:59:42 -04:00
sarahcaseybot	f5839777d1	Use Jackson to create and read Tld YAML files (#2082 ) * Use Jackson to create and read Tld YAML files * Add getObjectMapper to TldYamlUtils * revert lockfiles * Fix optionals * Add more tests and javadocs * small fixes	2023-07-26 16:25:03 -04:00
Weimin Yu	43d325d2a5	Checks flyway deadlock risk for new schema chagnes (#2078 ) * Checks flyway deadlock risk for new schema chagnes	2023-07-26 14:35:48 -04:00
Pavlo Tkach	9b17adcb28	Add Console Settings -> Security front-end (#2079 )	2023-07-26 12:50:31 -04:00
Ben McIlwain	9873772150	Allow EPP password to be set during login flow (#2080 ) This is part of the spec in RFC 5730 that we hadn't implemented until now. Note that this requires changing LoginFlow to be transactional, but I don't think that should cause any issues.	2023-07-25 18:15:45 -04:00
Lai Jiang	342051e11d	Fix the build due to jackson-core incompatibility (#2085 )	2023-07-25 11:09:38 -04:00
Ben McIlwain	5f5cb8df9f	Remove unnecessary overload of AsyncTaskEnqueuer.enqueueAsyncResave() (#2083 ) It was only called in one place (in actual production code), and it was just slightly obscuring the fact that re-saves can be scheduled for multiple points in the future in a way that wasn't amazingly helpful to understanding of the system logic at the callsite.	2023-07-24 13:37:36 -04:00
gbrodman	311d5ac9b6	Fix ICANN reporting and add rdap-queries field (#2081 ) This includes two changes, the second necessary for testing the first. 1. We add the rdap-queries field as mandated by the amendment to the registry agreement, https://itp.cdn.icann.org/en/files/registry-agreement/proposed-global-amendment-base-gtld-registry-agreement-12-04-2023-en.pdf. This is fairly similar to the whois-queries field where we just query the logs, but instead of searching for "whois" we search for "rdap". 2. BigQuery doesn't use MAX to refer to the bigger of two fields; MAX accepts an array as an argument. In order to do what we want (and to have the BigQuery statements succeed), we need to use GREATEST. Tested both versions in alpha and production BigQuery instances.	2023-07-21 14:28:14 -04:00