Bump follow-redirects from 1.15.4 to 1.15.6 in /docs/console-endpoints (#2375 )

Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.4 to 1.15.6. - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.15.4...v1.15.6) --- updated-dependencies: - dependency-name: follow-redirects dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Add IDN check to BSA validate (#2370 )
2026-05-28 02:30:37 +00:00 · 2024-03-15 19:06:26 -04:00 · 2024-03-15 19:06:12 -04:00 · 2024-03-15 19:06:00 -04:00 · 2024-03-15 17:23:02 +00:00 · 2024-03-15 14:21:46 +00:00
259 changed files with 3360 additions and 2290 deletions
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
    # The branches below must be a subset of the branches above
    branches: [ 'master' ]
  schedule:
-    - cron: '24 4 * * 2'
+    - cron: '24 4 * * *'

 jobs:
  analyze:
@@ -27,17 +27,17 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4

    - name: Set Java version
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
      with:
        distribution: 'temurin'
-        java-version: '17'
+        java-version: '21'

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
@@ -47,11 +47,20 @@ jobs:
        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
        queries: security-and-quality

+    # Build with Gradle
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v3
+      with:
+        build-scan-publish: true
+        build-scan-terms-of-service-url: "https://gradle.com/terms-of-service"
+        build-scan-terms-of-service-agree: "yes"
+    - name: Execute Gradle build
+      run: ./gradlew build -x test -x jIFC

    # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+    #- name: Autobuild
+    #  uses: github/codeql-action/autobuild@v3

    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -64,6 +73,6 @@ jobs:
    #   ./location_of_script_within_repo/buildscript.sh

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
      with:
        category: "/language:${{matrix.language}}"
--- a/.github/workflows/dependency-submission.yml
+++ b/.github/workflows/dependency-submission.yml
@@ -0,0 +1,25 @@
+name: Dependency Submission
+
+on:
+  push:
+    branches: [ 'master' ]
+  schedule:
+    - cron: '24 3 * * *'
+
+permissions:
+  contents: write
+
+jobs:
+
+  dependency-submission:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Set Java version
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'temurin'
+        java-version: '21'
+    - name: Generate and submit dependency graph
+      uses: gradle/actions/dependency-submission@v3
--- a/.github/workflows/do-not-merge.yml
+++ b/.github/workflows/do-not-merge.yml
@@ -0,0 +1,23 @@
+name: "Check labels"
+
+on:
+  pull_request:
+    branches: ["master"]
+    types:
+      - opened
+      - synchronize
+      - labeled
+      - unlabeled
+  merge_group:
+    branches: ["master"]
+    types: [checks_requested]
+
+jobs:
+  fail-by-label:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail if PR is labeled as "do not merge"
+        if: contains(github.event.pull_request.labels.*.name, 'do not merge')
+        run: |
+          echo "This PR is labeled as do not merge!"
+          exit 1
--- a/.java-version
+++ b/.java-version
@@ -1 +1 @@
-17
+21
--- a/build.gradle
+++ b/build.gradle
@@ -281,6 +281,12 @@ def javadocSource = []
 def javadocClasspath = []
 def javadocDependentTasks = []

+def services = [':services:default',
+                ':services:backend',
+                ':services:bsa',
+                ':services:tools',
+                ':services:pubapi']
+
 subprojects {
  // Skip no-op project
  if (project.name == 'services') return
@@ -354,23 +360,6 @@ subprojects {
    }
  }

-  // 'listenablefuture' is folded into guava since v32. This block is required
-  // until all transitive dependencies have upgraded past guava v32.
-  // TODO(periodically): remove this block and see if build succeeds.
-  configurations.all {
-    resolutionStrategy
-            .capabilitiesResolution
-            .withCapability("com.google.guava:listenablefuture") {
-      select("com.google.guava:guava:0")
-    }
-  }
-
-  def services = [':services:default',
-                  ':services:backend',
-                  ':services:bsa',
-                  ':services:tools',
-                  ':services:pubapi']
-
  // Set up all of the deployment projects.
  if (services.contains(project.path)) {

@@ -412,9 +401,9 @@ subprojects {
    }
  }

-  // No need to produce javadoc for the docs subproject, which has no APIs to
+  // No need to produce javadoc for the jetty subproject, which has no APIs to
  // expose to users.
-  if (project.name != 'docs') {
+  if (project.name != 'jetty') {
    javadocSource << project.sourceSets.main.allJava
    javadocClasspath << project.sourceSets.main.runtimeClasspath
    javadocClasspath << "${buildDir}/generated/sources/annotationProcessor/java/main"
@@ -422,6 +411,17 @@ subprojects {
  }
 }

+// Force SDK download and deployment to be sequential, otherwise parallel tasks
+// will fail. For SDK download, they will try to write to the same location to
+// upgrade gcloud. For deployment, they will try to deploy different services to
+// the same project at the same time.
+for (int i = 1; i < services.size(); i++) {
+  project("${services[i]}").downloadCloudSdk
+          .dependsOn(project("${services[i - 1]}").downloadCloudSdk)
+  project("${services[i]}").appengineDeployAll
+          .dependsOn(project("${services[i - 1]}").appengineDeployAll)
+}
+
 // If "-P verboseTestOutput=true" is passed in, configure all subprojects to dump all of their
 // output and final test status (pass/fail, errors) for each test class.
 //
@@ -572,7 +572,9 @@ task javadoc(type: Javadoc) {
  destinationDir = file("${buildDir}/docs/javadoc")
  options.encoding = "UTF-8"
  // In a lot of places we don't write @return so suppress warnings about that.
-  options.addBooleanOption('Xdoclint:all,-missing', true)
+  // We don't report HTML lint errors because XJB-generated POJO files have
+  // incorrect tags (like dangling </p> without the corresponding open tag.
+  options.addBooleanOption('Xdoclint:all,-missing,-html', true)
  options.addBooleanOption("-allow-script-in-comments",true)
  options.tags = ["type:a:Generic Type",
                  "error:a:Expected Error",
@@ -590,7 +592,8 @@ task coreDev {
  dependsOn 'javadoc'
  dependsOn 'checkDependenciesDotGradle'
  dependsOn 'checkLicense'
-  dependsOn ':console-webapp:runConsoleWebappUnitTests'
+  // TODO: @ptkach reenable after console design merged
+  // dependsOn ':console-webapp:runConsoleWebappUnitTests'
  dependsOn ':core:check'
  dependsOn 'assemble'
 }
--- a/buildSrc/build.gradle.kts
+++ b/buildSrc/build.gradle.kts
@@ -104,8 +104,6 @@ dependencies {
  implementation(deps["org.apache.commons:commons-text"]!!)
  annotationProcessor(deps["com.google.auto.value:auto-value"]!!)
  testImplementation(deps["com.google.truth:truth"]!!)
-  testImplementation(
-      deps["com.google.truth.extensions:truth-java8-extension"]!!)
  testImplementation(deps["org.junit.jupiter:junit-jupiter-api"]!!)
  testImplementation(deps["org.junit.jupiter:junit-jupiter-engine"]!!)
  testImplementation(deps["org.mockito:mockito-core"]!!)
--- a/buildSrc/gradle.lockfile
+++ b/buildSrc/gradle.lockfile
@@ -3,38 +3,39 @@
 # This file is expected to be part of source control.
 aopalliance:aopalliance:1.0=annotationProcessor,buildScriptClasspath,compileClasspath
 args4j:args4j:2.0.23=buildScriptClasspath,compileClasspath
-com.fasterxml.jackson.core:jackson-core:2.14.2=buildScriptClasspath,compileClasspath
-com.fasterxml.jackson:jackson-bom:2.14.2=buildScriptClasspath,compileClasspath
+com.fasterxml.jackson.core:jackson-core:2.16.1=buildScriptClasspath,compileClasspath
+com.fasterxml.jackson:jackson-bom:2.16.1=buildScriptClasspath,compileClasspath
 com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor
 com.google.android:annotations:4.1.1.4=buildScriptClasspath
-com.google.api-client:google-api-client:2.2.0=buildScriptClasspath,compileClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.22.6-alpha=buildScriptClasspath,compileClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.22.6-alpha=buildScriptClasspath,compileClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.22.6-alpha=buildScriptClasspath,compileClasspath
-com.google.api.grpc:proto-google-common-protos:2.22.0=buildScriptClasspath,compileClasspath
-com.google.api.grpc:proto-google-iam-v1:1.17.0=buildScriptClasspath,compileClasspath
-com.google.api:api-common:2.14.0=buildScriptClasspath,compileClasspath
-com.google.api:gax-grpc:2.31.0=buildScriptClasspath,compileClasspath
-com.google.api:gax-httpjson:2.31.0=buildScriptClasspath,compileClasspath
-com.google.api:gax:2.31.0=buildScriptClasspath,compileClasspath
-com.google.apis:google-api-services-storage:v1-rev20230301-2.0.0=buildScriptClasspath,compileClasspath
-com.google.auth:google-auth-library-credentials:1.19.0=buildScriptClasspath,compileClasspath
-com.google.auth:google-auth-library-oauth2-http:1.19.0=buildScriptClasspath,compileClasspath
+com.google.api-client:google-api-client:2.3.0=buildScriptClasspath,compileClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.35.0-alpha=buildScriptClasspath,compileClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.35.0-alpha=buildScriptClasspath,compileClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.35.0-alpha=buildScriptClasspath,compileClasspath
+com.google.api.grpc:proto-google-common-protos:2.36.0=buildScriptClasspath,compileClasspath
+com.google.api.grpc:proto-google-iam-v1:1.31.0=buildScriptClasspath,compileClasspath
+com.google.api:api-common:2.28.0=buildScriptClasspath,compileClasspath
+com.google.api:gax-grpc:2.45.0=buildScriptClasspath,compileClasspath
+com.google.api:gax-httpjson:2.45.0=buildScriptClasspath,compileClasspath
+com.google.api:gax:2.45.0=buildScriptClasspath,compileClasspath
+com.google.apis:google-api-services-storage:v1-rev20240209-2.0.0=buildScriptClasspath,compileClasspath
+com.google.auth:google-auth-library-credentials:1.23.0=buildScriptClasspath,compileClasspath
+com.google.auth:google-auth-library-oauth2-http:1.23.0=buildScriptClasspath,compileClasspath
 com.google.auto.service:auto-service-annotations:1.0.1=annotationProcessor
-com.google.auto.value:auto-value-annotations:1.10.1=buildScriptClasspath,compileClasspath
+com.google.auto.value:auto-value-annotations:1.10.4=buildScriptClasspath,compileClasspath
 com.google.auto.value:auto-value-annotations:1.9=annotationProcessor
 com.google.auto.value:auto-value:1.10.4=annotationProcessor
 com.google.auto:auto-common:1.2.1=annotationProcessor
-com.google.cloud:google-cloud-core-grpc:2.21.0=buildScriptClasspath,compileClasspath
-com.google.cloud:google-cloud-core-http:2.21.0=buildScriptClasspath,compileClasspath
-com.google.cloud:google-cloud-core:2.21.0=buildScriptClasspath,compileClasspath
-com.google.cloud:google-cloud-storage:2.22.6=buildScriptClasspath,compileClasspath
+com.google.cloud:google-cloud-core-grpc:2.35.0=buildScriptClasspath,compileClasspath
+com.google.cloud:google-cloud-core-http:2.35.0=buildScriptClasspath,compileClasspath
+com.google.cloud:google-cloud-core:2.35.0=buildScriptClasspath,compileClasspath
+com.google.cloud:google-cloud-storage:2.35.0=buildScriptClasspath,compileClasspath
 com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,buildScriptClasspath,compileClasspath
 com.google.code.gson:gson:2.10.1=buildScriptClasspath,compileClasspath
 com.google.common.html.types:types:1.0.6=buildScriptClasspath,compileClasspath
 com.google.errorprone:error_prone_annotation:2.23.0=annotationProcessor
-com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor,buildScriptClasspath,compileClasspath
+com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor
+com.google.errorprone:error_prone_annotations:2.26.1=buildScriptClasspath,compileClasspath
 com.google.errorprone:error_prone_check_api:2.23.0=annotationProcessor
 com.google.errorprone:error_prone_core:2.23.0=annotationProcessor
 com.google.errorprone:error_prone_type_annotations:2.23.0=annotationProcessor
@@ -43,47 +44,49 @@ com.google.guava:failureaccess:1.0.1=annotationProcessor
 com.google.guava:failureaccess:1.0.2=buildScriptClasspath,compileClasspath
 com.google.guava:guava-parent:32.1.1-jre=annotationProcessor
 com.google.guava:guava:32.1.1-jre=annotationProcessor
-com.google.guava:guava:33.0.0-jre=buildScriptClasspath,compileClasspath
+com.google.guava:guava:33.1.0-jre=buildScriptClasspath,compileClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=buildScriptClasspath,compileClasspath
-com.google.http-client:google-http-client-apache-v2:1.43.3=buildScriptClasspath,compileClasspath
-com.google.http-client:google-http-client-appengine:1.43.3=buildScriptClasspath,compileClasspath
-com.google.http-client:google-http-client-gson:1.43.3=buildScriptClasspath,compileClasspath
-com.google.http-client:google-http-client-jackson2:1.43.3=buildScriptClasspath,compileClasspath
-com.google.http-client:google-http-client:1.43.3=buildScriptClasspath,compileClasspath
+com.google.http-client:google-http-client-apache-v2:1.44.1=buildScriptClasspath,compileClasspath
+com.google.http-client:google-http-client-appengine:1.44.1=buildScriptClasspath,compileClasspath
+com.google.http-client:google-http-client-gson:1.44.1=buildScriptClasspath,compileClasspath
+com.google.http-client:google-http-client-jackson2:1.44.1=buildScriptClasspath,compileClasspath
+com.google.http-client:google-http-client:1.44.1=buildScriptClasspath,compileClasspath
 com.google.inject.extensions:guice-multibindings:4.1.0=buildScriptClasspath,compileClasspath
 com.google.inject:guice:4.1.0=buildScriptClasspath,compileClasspath
 com.google.inject:guice:5.1.0=annotationProcessor
-com.google.j2objc:j2objc-annotations:2.8=buildScriptClasspath,compileClasspath
+com.google.j2objc:j2objc-annotations:2.8=buildScriptClasspath
+com.google.j2objc:j2objc-annotations:3.0.0=compileClasspath
 com.google.jsinterop:jsinterop-annotations:1.0.1=buildScriptClasspath,compileClasspath
-com.google.oauth-client:google-oauth-client:1.34.1=buildScriptClasspath,compileClasspath
-com.google.protobuf:protobuf-java-util:3.23.2=buildScriptClasspath,compileClasspath
+com.google.oauth-client:google-oauth-client:1.35.0=buildScriptClasspath,compileClasspath
+com.google.protobuf:protobuf-java-util:3.25.2=buildScriptClasspath,compileClasspath
 com.google.protobuf:protobuf-java:3.19.6=annotationProcessor
-com.google.protobuf:protobuf-java:3.23.2=buildScriptClasspath,compileClasspath
-com.google.re2j:re2j:1.6=buildScriptClasspath
+com.google.protobuf:protobuf-java:3.25.2=buildScriptClasspath,compileClasspath
+com.google.re2j:re2j:1.7=buildScriptClasspath
 com.google.template:soy:2021-02-01=buildScriptClasspath,compileClasspath
 com.ibm.icu:icu4j:57.1=buildScriptClasspath,compileClasspath
-commons-codec:commons-codec:1.15=buildScriptClasspath,compileClasspath
-commons-logging:commons-logging:1.2=buildScriptClasspath,compileClasspath
+commons-codec:commons-codec:1.16.1=buildScriptClasspath,compileClasspath
 io.github.eisop:dataflow-errorprone:3.34.0-eisop1=annotationProcessor
 io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor
-io.grpc:grpc-alts:1.55.3=buildScriptClasspath,compileClasspath
-io.grpc:grpc-api:1.55.3=buildScriptClasspath,compileClasspath
-io.grpc:grpc-auth:1.55.3=buildScriptClasspath,compileClasspath
-io.grpc:grpc-context:1.55.3=buildScriptClasspath,compileClasspath
-io.grpc:grpc-core:1.55.3=buildScriptClasspath
-io.grpc:grpc-googleapis:1.55.3=buildScriptClasspath
-io.grpc:grpc-grpclb:1.55.3=buildScriptClasspath,compileClasspath
-io.grpc:grpc-netty-shaded:1.55.3=buildScriptClasspath
-io.grpc:grpc-protobuf-lite:1.55.3=buildScriptClasspath,compileClasspath
-io.grpc:grpc-protobuf:1.55.3=buildScriptClasspath,compileClasspath
-io.grpc:grpc-rls:1.55.3=buildScriptClasspath
-io.grpc:grpc-services:1.55.3=buildScriptClasspath
-io.grpc:grpc-stub:1.55.3=buildScriptClasspath,compileClasspath
-io.grpc:grpc-xds:1.55.3=buildScriptClasspath
+io.grpc:grpc-alts:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-api:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-auth:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-context:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-core:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-googleapis:1.62.2=buildScriptClasspath
+io.grpc:grpc-grpclb:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-inprocess:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-netty-shaded:1.62.2=buildScriptClasspath
+io.grpc:grpc-protobuf-lite:1.62.2=buildScriptClasspath
+io.grpc:grpc-protobuf:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-rls:1.62.2=buildScriptClasspath
+io.grpc:grpc-services:1.62.2=buildScriptClasspath
+io.grpc:grpc-stub:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-util:1.62.2=buildScriptClasspath
+io.grpc:grpc-xds:1.62.2=buildScriptClasspath
 io.opencensus:opencensus-api:0.31.1=buildScriptClasspath,compileClasspath
 io.opencensus:opencensus-contrib-http-util:0.31.1=buildScriptClasspath,compileClasspath
 io.opencensus:opencensus-proto:0.2.0=buildScriptClasspath
-io.perfmark:perfmark-api:0.26.0=buildScriptClasspath
+io.perfmark:perfmark-api:0.27.0=buildScriptClasspath
 javax.annotation:javax.annotation-api:1.3.2=buildScriptClasspath,compileClasspath
 javax.annotation:jsr250-api:1.0=buildScriptClasspath,compileClasspath
 javax.inject:javax.inject:1=annotationProcessor,buildScriptClasspath,compileClasspath
@@ -92,7 +95,7 @@ org.apache.commons:commons-text:1.11.0=buildScriptClasspath,compileClasspath
 org.apache.httpcomponents:httpclient:4.5.14=buildScriptClasspath,compileClasspath
 org.apache.httpcomponents:httpcore:4.4.16=buildScriptClasspath,compileClasspath
 org.checkerframework:checker-qual:3.33.0=annotationProcessor
-org.checkerframework:checker-qual:3.41.0=buildScriptClasspath,compileClasspath
+org.checkerframework:checker-qual:3.42.0=buildScriptClasspath,compileClasspath
 org.codehaus.mojo:animal-sniffer-annotations:1.23=buildScriptClasspath
 org.conscrypt:conscrypt-openjdk-uber:2.5.2=buildScriptClasspath,compileClasspath
 org.json:json:20160212=buildScriptClasspath,compileClasspath
--- a/buildSrc/src/test/java/google/registry/gradle/plugin/CoverPageGeneratorTest.java
+++ b/buildSrc/src/test/java/google/registry/gradle/plugin/CoverPageGeneratorTest.java
@@ -16,7 +16,6 @@ package google.registry.gradle.plugin;

 import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.truth.Truth.assertThat;
-import static com.google.common.truth.Truth8.assertThat;
 import static google.registry.gradle.plugin.GcsPluginUtils.toByteArraySupplier;
 import static java.nio.charset.StandardCharsets.UTF_8;

--- a/common/build.gradle
+++ b/common/build.gradle
@@ -57,7 +57,7 @@ dependencies {
  implementation deps['com.github.ben-manes.caffeine:caffeine']
  implementation deps['com.google.code.findbugs:jsr305']
  implementation deps['com.google.guava:guava']
-  implementation deps['javax.inject:javax.inject']
+  implementation deps['jakarta.inject:jakarta.inject-api']
  implementation deps['joda-time:joda-time']
  implementation deps['com.google.flogger:flogger']
  implementation deps['io.github.java-diff-utils:java-diff-utils']
--- a/common/gradle.lockfile
+++ b/common/gradle.lockfile
@@ -2,8 +2,8 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 aopalliance:aopalliance:1.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.github.ben-manes.caffeine:caffeine:2.9.3=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.github.ben-manes.caffeine:caffeine:3.1.8=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.auto.service:auto-service-annotations:1.0.1=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.auto.value:auto-value-annotations:1.10.4=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
@@ -12,7 +12,7 @@ com.google.auto:auto-common:1.2.1=annotationProcessor,errorprone,testAnnotationP
 com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
 com.google.errorprone:error_prone_annotation:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.24.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.errorprone:error_prone_annotations:2.26.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.google.errorprone:error_prone_annotations:2.7.1=checkstyle
 com.google.errorprone:error_prone_check_api:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.errorprone:error_prone_core:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
@@ -24,20 +24,21 @@ com.google.guava:failureaccess:1.0.2=compileClasspath,deploy_jar,runtimeClasspat
 com.google.guava:guava-parent:32.1.1-jre=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.guava:guava:31.0.1-jre=checkstyle
 com.google.guava:guava:32.1.1-jre=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.google.guava:guava:33.0.0-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.guava:guava:33.1.0-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.google.inject:guice:5.1.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.j2objc:j2objc-annotations:1.3=checkstyle
-com.google.j2objc:j2objc-annotations:2.8=compileClasspath,testCompileClasspath,testingCompileClasspath
+com.google.j2objc:j2objc-annotations:3.0.0=compileClasspath,testCompileClasspath,testingCompileClasspath
 com.google.protobuf:protobuf-java:3.19.6=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.google.truth:truth:1.4.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.truth:truth:1.4.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.puppycrawl.tools:checkstyle:9.3=checkstyle
 commons-beanutils:commons-beanutils:1.9.4=checkstyle
 commons-collections:commons-collections:3.2.2=checkstyle
 info.picocli:picocli:4.6.2=checkstyle
 io.github.eisop:dataflow-errorprone:3.34.0-eisop1=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
-javax.inject:javax.inject:1=annotationProcessor,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
+jakarta.inject:jakarta.inject-api:1.0.5=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+javax.inject:javax.inject:1=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 joda-time:joda-time:2.12.7=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 junit:junit:4.13.2=testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 net.sf.saxon:Saxon-HE:10.6=checkstyle
--- a/common/src/testing/java/google/registry/testing/SystemInfo.java
+++ b/common/src/testing/java/google/registry/testing/SystemInfo.java
@@ -14,7 +14,6 @@

 package google.registry.testing;

-import com.github.benmanes.caffeine.cache.CacheLoader;
 import com.github.benmanes.caffeine.cache.Caffeine;
 import com.github.benmanes.caffeine.cache.LoadingCache;
 import com.google.common.flogger.FluentLogger;
@@ -31,28 +30,25 @@ public final class SystemInfo {
  private static final LoadingCache<String, Boolean> hasCommandCache =
      Caffeine.newBuilder()
          .build(
-              new CacheLoader<String, Boolean>() {
-                @Override
-                public Boolean load(String cmd) throws InterruptedException {
-                  try {
-                    Process pid = Runtime.getRuntime().exec(cmd);
-                    pid.getOutputStream().close();
-                    pid.waitFor();
-                  } catch (IOException e) {
-                    logger.atWarning().withCause(e).log("%s command not available.", cmd);
-                    return false;
-                  }
-                  return true;
+              cmd -> {
+                try {
+                  Process pid = Runtime.getRuntime().exec(cmd.split(" "));
+                  pid.getOutputStream().close();
+                  pid.waitFor();
+                } catch (IOException e) {
+                  logger.atWarning().withCause(e).log("%s command not available.", cmd);
+                  return false;
                }
+                return true;
              });

  /**
-   * Returns {@code true} if system command can be run from path.
+   * Returns {@code true} if system command can be run from the path.
   *
-   * <p><b>Warning:</b> The command is actually run! So there could be side-effects. You might need
+   * <p><b>Warning:</b> The command is actually run! So there could be side effects. You might need
   * to specify a version flag or something. Return code is ignored.
   *
-   * <p>This result is a memoized. If multiple therads try to get the same result at once, the heavy
+   * <p>This result is a memoized. If multiple threads try to get the same result at once, the heavy
   * lifting will only be performed by the first thread and the rest will wait.
   */
  public static boolean hasCommand(String cmd) throws ExecutionException {
--- a/config/dependency-license/allowed_licenses.json
+++ b/config/dependency-license/allowed_licenses.json
@@ -390,6 +390,12 @@
      "moduleLicense": null,
      "moduleVersion": "1.0.1",
      "moduleName": "org.jetbrains.kotlinx:kotlinx-serialization-core"
+    },
+    {
+      // "Apache License, Version 2.0".
+      "moduleLicense": null,
+      "moduleVersion": "1.4",
+      "moduleName": "jakarta-regexp:jakarta-regexp"
    }
  ]
 }
--- a/config/nom_build.py
+++ b/config/nom_build.py
@@ -47,7 +47,7 @@ class GradleFlag:


 PROPERTIES_HEADER = """\
-# This file defines properties used by the gradle build.  It must be kept in
+# This file defines properties used by the gradle build. It must be kept in
 # sync with config/nom_build.py.
 #
 # To regenerate, run ./nom_build --generate-gradle-properties
@@ -58,6 +58,7 @@ PROPERTIES_HEADER = """\
 # DO NOT EDIT THIS FILE BY HAND
 org.gradle.jvmargs=-Xmx1024m
 org.gradle.caching=true
+org.gradle.parallel=true
 """

 # Help text to be displayed (in addition to the synopsis and flag help, which
--- a/config/presubmits.py
+++ b/config/presubmits.py
@@ -173,11 +173,24 @@ PRESUBMITS = {
    ):
        "JavaScript files should not include console logging.",
    PresubmitCheck(
-        r"org\.testcontainers\.shaded\.",
+        r".*org\.testcontainers\.shaded.*",
        "java",
        {"/node_modules/"},
    ):
        "Do not use shaded dependencies from testcontainers.",
+    PresubmitCheck(
+        r".*com\.google\.common\.truth\.Truth8.*",
+        "java",
+        {"/node_modules/"},
+    ):
+        "Truth8 is deprecated. Use Truth instead.",
+    PresubmitCheck(
+        r".*java\.util\.Date.*",
+        "java",
+        {"/node_modules/", "JpaTransactionManagerImpl.java"},
+    ):
+        "Do not use java.util.Date. Use classes in java.time package instead.",
+
 }

 # Note that this regex only works for one kind of Flyway file.  If we want to
--- a/console-webapp/package-lock.json
+++ b/console-webapp/package-lock.json
@@ -8944,9 +8944,9 @@
      "dev": true
    },
    "node_modules/follow-redirects": {
-      "version": "1.15.5",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.5.tgz",
-      "integrity": "sha512-vSFWUON1B+yAw1VN4xMfxgn5fTUiaOzAJCKBwIIgT/+7CuGy9+r+5gITvP62j3RmaD5Ph65UaERdOSRGUzZtgw==",
+      "version": "1.15.6",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.6.tgz",
+      "integrity": "sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==",
      "dev": true,
      "funding": [
        {
--- a/core/Dockerfile
+++ b/core/Dockerfile
@@ -1,3 +1,3 @@
-FROM gcr.io/distroless/java17-debian11:debug
+FROM eclipse-temurin:21
 ADD build/libs/nomulus.jar /nomulus.jar
-ENTRYPOINT ["/usr/bin/java", "-jar", "/nomulus.jar"]
+ENTRYPOINT ["java", "-jar", "/nomulus.jar"]
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -31,19 +31,6 @@ def goldensDir =
  "${javaTestDir}/google/registry/webdriver/goldens/chrome-linux"
 def jsDir = "${project.projectDir}/src/main/javascript"

-// Tests that conflict with (mostly unidentified) members of the main test
-// suite. It is unclear if they are offenders (i.e., those that pollute global
-// state) or victims.
-// TODO(weiminyu): identify cause and fix offending tests.
-def outcastTestPatterns = [
-    // Problem seems to lie with AppEngine TaskQueue for test.
-    "google/registry/batch/RefreshDnsOnHostRenameActionTest.*",
-    "google/registry/flows/EppLifecycleHostTest.*",
-    "google/registry/flows/domain/DomainCreateFlowTest.*",
-    "google/registry/flows/domain/DomainUpdateFlowTest.*",
-    "google/registry/tools/CreateDomainCommandTest.*",
-]
-
 // Tests that fail when running Gradle in a docker container, e. g. when
 // building the release artifacts in Google Cloud Build.
 def dockerIncompatibleTestPatterns = [
@@ -62,9 +49,9 @@ def dockerIncompatibleTestPatterns = [
    "google/registry/persistence/PersistenceModuleTest.*",
 ]

-// Tests that conflict with members of both the main test suite and the
-// outcast suite. They seem to be affected by global states outside of
-// Nomulus classes, e.g., threads and objects retained by frameworks.
+// Tests that conflict with members of the main test suite. They seem to be
+// affected by global states outside of Nomulus classes, e.g., threads and
+// objects retained by frameworks.
 // TODO(weiminyu): identify cause and fix offending tests.
 def fragileTestPatterns = [
    // Changes cache timeouts and for some reason appears to have contention
@@ -98,12 +85,6 @@ sourceSets {
    java {
      compileClasspath += nonprod.output
      runtimeClasspath += nonprod.output
-
-      // Javadoc API is deprecated in Java 11 and removed in Java 12.
-      // TODO(jianglai): re-enable after migrating to the new Javadoc API
-      if ((JavaVersion.current().majorVersion as Integer) >= 11) {
-        exclude 'google/registry/documentation/**'
-      }
    }
    resources {
      exclude '**/*.xjb', '**/*.xsd'
@@ -123,10 +104,8 @@ configurations {
  devtool

  nonprodImplementation.extendsFrom implementation
-  nonprodRuntime.extendsFrom runtime

  testImplementation.extendsFrom nonprodImplementation
-  testRuntimeOnly.extendsFrom nonprodRuntime

  // Published jars that are used for server/schema compatibility tests.
  // See <a href="../integration/README.md">the integration project</a>
@@ -187,7 +166,6 @@ dependencies {
  implementation deps['com.google.dagger:dagger']
  implementation deps['com.google.errorprone:error_prone_annotations']
  implementation deps['com.google.flogger:flogger']
-  runtime deps['com.google.flogger:flogger-system-backend']
  implementation deps['com.google.guava:guava']
  implementation deps['com.google.protobuf:protobuf-java']
  // Might need to add this back if we re-add nebula-lint
@@ -210,17 +188,14 @@ dependencies {
  implementation deps['com.google.template:soy']
  implementation deps['com.googlecode.json-simple:json-simple']
  implementation deps['com.jcraft:jsch']
-  testImplementation deps['com.thoughtworks.qdox:qdox']
  implementation deps['com.zaxxer:HikariCP']
  implementation deps['com.squareup.okhttp3:okhttp']
  implementation deps['dnsjava:dnsjava']
-  runtime deps['guru.nidi:graphviz-java-all-j2v8']
+  testRuntimeOnly deps['guru.nidi:graphviz-java-all-j2v8']
  testImplementation deps['io.github.classgraph:classgraph']
  testRuntimeOnly deps['io.github.java-diff-utils:java-diff-utils']
-  testImplementation deps['javax.annotation:javax.annotation-api']
-  testImplementation deps['javax.annotation:jsr250-api']
  implementation deps['javax.mail:mail']
-  implementation deps['javax.inject:javax.inject']
+  implementation deps['jakarta.inject:jakarta.inject-api']
  implementation deps['javax.persistence:javax.persistence-api']
  implementation deps['javax.servlet:servlet-api']
  implementation deps['javax.xml.bind:jaxb-api']
@@ -244,11 +219,10 @@ dependencies {
  testImplementation deps['org.apache.sshd:sshd-scp']
  testImplementation deps['org.apache.sshd:sshd-sftp']
  testImplementation deps['org.apache.tomcat:tomcat-annotations-api']
-  implementation deps['org.bouncycastle:bcpg-jdk15on']
-  implementation deps['org.bouncycastle:bcpkix-jdk15on']
-  implementation deps['org.bouncycastle:bcprov-jdk15on']
+  implementation deps['org.bouncycastle:bcpg-jdk18on']
+  implementation deps['org.bouncycastle:bcpkix-jdk18on']
+  implementation deps['org.bouncycastle:bcprov-jdk18on']
  testImplementation deps['com.fasterxml.jackson.core:jackson-databind']
-  runtime deps['org.glassfish.jaxb:jaxb-runtime']
  implementation deps['org.hibernate:hibernate-core']
  implementation deps['org.hibernate:hibernate-hikaricp']
  implementation deps['org.joda:joda-money']
@@ -273,7 +247,7 @@ dependencies {
  implementation deps['us.fatehi:schemacrawler-diagram']
  implementation deps['us.fatehi:schemacrawler-tools']
  implementation deps['xerces:xmlParserAPIs']
-  implementation deps['xpp3:xpp3']
+  implementation deps['org.ogce:xpp3']
  // This dependency must come after javax.mail:mail as it would otherwise
  // shadow classes in package javax.mail with its own implementation.
  implementation deps['com.google.appengine:appengine-api-1.0-sdk']
@@ -300,7 +274,6 @@ dependencies {
  testImplementation deps['com.google.monitoring-client:contrib']
  testImplementation deps['com.google.protobuf:protobuf-java-util']
  testImplementation deps['com.google.truth:truth']
-  testImplementation deps['com.google.truth.extensions:truth-java8-extension']
  testImplementation deps['org.checkerframework:checker-qual']
  testImplementation deps['org.hamcrest:hamcrest']
  testImplementation deps['org.hamcrest:hamcrest-core']
@@ -315,7 +288,6 @@ dependencies {
  testImplementation deps['org.junit.platform:junit-platform-suite-api']
  testImplementation deps['org.mockito:mockito-core']
  testImplementation deps['org.mockito:mockito-junit-jupiter']
-  runtime deps['org.postgresql:postgresql']

  // Indirect dependency found by undeclared-dependency check. Such
  // dependencies should go after all other implementation and testImplementation
@@ -776,7 +748,7 @@ if (environment == 'alpha') {
            gs://${gcpProject}-deploy/live/beam/${metaDataBaseName} \
            --image-gcr-path ${imageName}:live \
            --sdk-language JAVA \
-            --flex-template-base-image JAVA17 \
+            --flex-template-base-image gcr.io/dataflow-templates-base/java21-template-launcher-base:latest \
            --metadata-file ${projectDir}/src/main/resources/${metaData} \
            --jar ${uberJarName} \
            --env FLEX_TEMPLATE_JAVA_MAIN_CLASS=${mainClass} \
@@ -956,16 +928,6 @@ task fragileTest(type: FilteringTest) {
  }
 }

-task outcastTest(type: FilteringTest) {
-  tests = outcastTestPatterns
-
-  // Sets the maximum number of test executors that may exist at the same time.
-  // Note that this number appears to contribute to NoClassDefFoundError
-  // exceptions on certain machines and distros. The root cause is unclear.
-  // Try reducing this number if you experience similar problems.
-  maxParallelForks 3
-}
-
 // Dedicated test suite for schema-dependent tests.
 task sqlIntegrationTest(type: FilteringTest) {
  // TestSuite still requires a JUnit 4 runner, which knows how to handle JUnit 5 tests.
@@ -989,7 +951,6 @@ task registryToolIntegrationTest(dependsOn: nomulus, type: FilteringTest) {
 task standardTest(type: FilteringTest) {
  includeAllTests()
  exclude fragileTestPatterns
-  exclude outcastTestPatterns
  // See SqlIntegrationTestSuite.java
  exclude '**/*BeforeSuiteTest.*', '**/*AfterSuiteTest.*'

@@ -1006,7 +967,7 @@ task standardTest(type: FilteringTest) {
  // Also, Gradle executes tests in 1 thread and some of our test infrastructures
  // depend on that, e.g. DualDatabaseTestInvocationContextProvider injects
  // different implementation of TransactionManager into TransactionManagerFactory.
-  maxParallelForks 5
+  maxParallelForks 64

  systemProperty 'test.projectRoot', rootProject.projectRootDir
  systemProperty 'test.resourcesDir', resourcesDir
@@ -1017,11 +978,11 @@ test {
  // FilteringTest tasks.
  exclude "**"
  // TODO(weiminyu): Remove dependency on sqlIntegrationTest
-}.dependsOn(fragileTest, outcastTest, standardTest, registryToolIntegrationTest, sqlIntegrationTest)
+}.dependsOn(fragileTest, standardTest, registryToolIntegrationTest, sqlIntegrationTest)


 // When we override tests, we also break the cleanTest command.
-cleanTest.dependsOn(cleanFragileTest, cleanOutcastTest, cleanStandardTest,
+cleanTest.dependsOn(cleanFragileTest, cleanStandardTest,
                    cleanRegistryToolIntegrationTest, cleanSqlIntegrationTest)

 project.build.dependsOn devtool
--- a/core/gradle.lockfile
+++ b/core/gradle.lockfile
@@ -10,36 +10,36 @@ cglib:cglib-nodep:2.2=css
 com.101tec:zkclient:0.10=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.beust:jcommander:1.60=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.charleskorn.kaml:kaml:0.20.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-joda:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-joda:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml:classmate:1.5.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.ben-manes.caffeine:caffeine:2.9.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-com.github.docker-java:docker-java-api:3.3.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.docker-java:docker-java-transport-zerodep:3.3.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.docker-java:docker-java-transport:3.3.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jffi:1.3.12=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.ben-manes.caffeine:caffeine:3.1.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.docker-java:docker-java-api:3.3.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.docker-java:docker-java-transport-zerodep:3.3.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.docker-java:docker-java-transport:3.3.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jffi:1.3.13=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-a64asm:1.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-constants:0.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-enxio:0.32.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-ffi:2.2.15=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-posix:3.1.18=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-unixsocket:0.38.21=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-enxio:0.32.17=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-ffi:2.2.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-posix:3.1.19=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-unixsocket:0.38.22=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-x86asm:1.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.android:annotations:4.1.1.4=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-appengine:1.35.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-appengine:2.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-jackson2:2.0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-java6:1.35.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-servlet:1.35.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-java6:2.1.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-servlet:2.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client:1.35.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.22.6-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.35.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.172.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.172.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -49,7 +49,7 @@ com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.12.20=compileClasspath,dep
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.56.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.56.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-spanner-v1:6.56.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.23.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.35.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-common-protos:2.30.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.172.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -62,42 +62,43 @@ com.google.api.grpc:proto-google-cloud-monitoring-v3:1.64.0=compileClasspath,non
 com.google.api.grpc:proto-google-cloud-monitoring-v3:3.34.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.108.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.12.20=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.23.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:2.23.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:2.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.56.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.56.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-executor-v1:6.56.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-v1:6.56.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.23.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2:2.23.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.113.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.113.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-common-protos:2.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-iam-v1:1.25.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:api-common:2.25.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-grpc:2.39.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-httpjson:2.39.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax:2.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-admin-directory:directory_v1-rev118-1.25.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-appengine:v1-rev20240218-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.35.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2:2.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.127.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.127.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-common-protos:2.36.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:api-common:2.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-grpc:2.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-httpjson:2.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax:2.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-admin-directory:directory_v1-rev20240304-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-appengine:v1-rev20240226-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-bigquery:v2-rev20230812-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20230806-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-dataflow:v1b3-rev20240113-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-dns:v2beta1-rev99-1.25.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-drive:v2-rev393-1.25.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-gmail:v1-rev20220404-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-gmail:v1-rev20231218-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20210624-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240110-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-monitoring:v3-rev20240128-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-monitoring:v3-rev20240303-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sheets:v4-rev20230815-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sqladmin:v1beta4-rev20240205-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20231202-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.appengine:appengine-api-1.0-sdk:1.9.86=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.appengine:appengine-api-1.0-sdk:2.0.24=testCompileClasspath,testRuntimeClasspath
-com.google.appengine:appengine-api-stubs:2.0.24=testCompileClasspath,testRuntimeClasspath
-com.google.appengine:appengine-testing:1.9.86=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20240304-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20240209-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.appengine:appengine-api-1.0-sdk:2.0.25=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.appengine:appengine-api-stubs:2.0.25=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.appengine:appengine-remote-api:2.0.25=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.appengine:appengine-testing:2.0.25=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.appengine:appengine-tools-sdk:2.0.25=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-credentials:1.23.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-oauth2-http:1.23.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service-annotations:1.0.1=errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
@@ -112,28 +113,28 @@ com.google.cloud.bigdataoss:gcsio:2.2.16=compileClasspath,deploy_jar,nonprodComp
 com.google.cloud.bigdataoss:util:2.2.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.bigtable:bigtable-client-core-config:1.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.datastore:datastore-v1-proto-client:2.17.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:jdbc-socket-factory-core:1.16.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.16.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.cloud.sql:jdbc-socket-factory-core:1.17.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.17.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable-stats:2.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.29.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-http:2.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core:2.29.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.35.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.35.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core:2.35.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-firestore:3.16.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-monitoring:1.82.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.cloud:google-cloud-monitoring:3.34.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-nio:0.126.19=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-nio:0.127.14=testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-pubsub:1.126.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-pubsublite:1.12.20=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-secretmanager:2.23.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-secretmanager:2.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-spanner:6.56.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage:2.22.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-tasks:2.23.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage:2.35.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-tasks:2.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:grpc-gcp:1.5.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.16.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.code.findbugs:jsr305:3.0.1=css
-com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.code.gson:gson:2.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.code.gson:gson:2.7=css,soy
 com.google.common.html.types:types:1.0.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
@@ -143,7 +144,7 @@ com.google.dagger:dagger:2.51=annotationProcessor,compileClasspath,deploy_jar,no
 com.google.devtools.ksp:symbol-processing-api:1.9.20-1.0.14=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotation:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.24.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.26.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotations:2.7.1=checkstyle,soy
 com.google.errorprone:error_prone_check_api:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
@@ -152,24 +153,25 @@ com.google.errorprone:javac-shaded:9-dev-r4023-3=annotationProcessor,testAnnotat
 com.google.errorprone:javac:9+181-r4173-1=errorproneJavac
 com.google.escapevelocity:escapevelocity:0.9.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.google.flatbuffers:flatbuffers-java:1.12.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.flogger:flogger-system-backend:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.flogger:flogger:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.flogger:flogger-system-backend:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.flogger:flogger:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flogger:google-extensions:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.googlejavaformat:google-java-format:1.5=annotationProcessor,testAnnotationProcessor
 com.google.guava:failureaccess:1.0.1=checkstyle,errorprone,nonprodAnnotationProcessor,soy
 com.google.guava:failureaccess:1.0.2=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.guava:guava-parent:32.1.1-jre=errorprone,nonprodAnnotationProcessor
-com.google.guava:guava-testlib:33.0.0-jre=testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava-testlib:33.1.0-jre=testCompileClasspath,testRuntimeClasspath
 com.google.guava:guava:20.0=css
 com.google.guava:guava:31.0.1-jre=checkstyle,soy
 com.google.guava:guava:32.1.1-jre=errorprone,nonprodAnnotationProcessor
-com.google.guava:guava:33.0.0-jre=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava:33.0.0-jre=annotationProcessor,testAnnotationProcessor
+com.google.guava:guava:33.1.0-jre=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-appengine:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-appengine:1.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-gson:1.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-jackson2:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-jackson2:1.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-protobuf:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client:1.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject.extensions:guice-multibindings:4.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
@@ -177,7 +179,8 @@ com.google.inject:guice:4.1.0=compileClasspath,deploy_jar,nonprodCompileClasspat
 com.google.inject:guice:5.1.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.inject:guice:7.0.0=soy
 com.google.j2objc:j2objc-annotations:1.3=checkstyle,soy
-com.google.j2objc:j2objc-annotations:2.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.j2objc:j2objc-annotations:2.8=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+com.google.j2objc:j2objc-annotations:3.0.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.javascript:closure-compiler-externs:v20160713=css
 com.google.javascript:closure-compiler-unshaded:v20160713=css
 com.google.javascript:closure-compiler:v20210505=closureCompiler
@@ -193,13 +196,12 @@ com.google.oauth-client:google-oauth-client-servlet:1.35.0=compileClasspath,depl
 com.google.oauth-client:google-oauth-client:1.35.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java-util:3.25.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java:2.5.0=css
+com.google.protobuf:protobuf-java:3.13.0=soy
 com.google.protobuf:protobuf-java:3.19.6=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.protobuf:protobuf-java:3.25.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.protobuf:protobuf-java:3.25.3=soy
 com.google.re2j:re2j:1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.template:soy:2021-02-01=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-com.google.truth.extensions:truth-java8-extension:1.4.1=testCompileClasspath,testRuntimeClasspath
-com.google.truth:truth:1.4.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.truth:truth:1.4.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.googlecode.json-simple:json-simple:1.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.ibm.icu:icu4j:57.1=soy
 com.ibm.icu:icu4j:73.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -229,26 +231,24 @@ com.squareup:kotlinpoet:1.15.1=compileClasspath,deploy_jar,nonprodCompileClasspa
 com.sun.activation:jakarta.activation:1.2.2=jaxb
 com.sun.activation:javax.activation:1.2.0=jaxb
 com.sun.istack:istack-commons-runtime:3.0.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.sun.istack:istack-commons-runtime:4.1.2=nonprodRuntime,runtime
-com.sun.xml.bind:jaxb-impl:2.3.3=jaxb
-com.sun.xml.bind:jaxb-osgi:4.0.4=jaxb
-com.sun.xml.bind:jaxb-xjc:2.3.3=jaxb
+com.sun.xml.bind:jaxb-impl:2.3.9=jaxb
+com.sun.xml.bind:jaxb-osgi:4.0.5=jaxb
+com.sun.xml.bind:jaxb-xjc:2.3.9=jaxb
 com.sun.xml.fastinfoset:FastInfoset:1.2.15=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.thoughtworks.paranamer:paranamer:2.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.thoughtworks.qdox:qdox:1.12.1=testCompileClasspath,testRuntimeClasspath
-com.zaxxer:HikariCP:3.4.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.zaxxer:HikariCP:5.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 commons-beanutils:commons-beanutils:1.9.4=checkstyle
-commons-codec:commons-codec:1.16.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+commons-codec:commons-codec:1.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 commons-collections:commons-collections:3.2.2=checkstyle
 commons-logging:commons-logging:1.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 dnsjava:dnsjava:3.5.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-guru.nidi.com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0=nonprodRuntime,runtime,testRuntimeClasspath
-guru.nidi.com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0=nonprodRuntime,runtime,testRuntimeClasspath
-guru.nidi.com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0=nonprodRuntime,runtime,testRuntimeClasspath
-guru.nidi.com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0=nonprodRuntime,runtime,testRuntimeClasspath
-guru.nidi.com.kitfox:svgSalamander:1.1.3=nonprodRuntime,runtime,testRuntimeClasspath
-guru.nidi:graphviz-java-all-j2v8:0.18.1=nonprodRuntime,runtime,testRuntimeClasspath
-guru.nidi:graphviz-java:0.18.1=nonprodRuntime,runtime,testRuntimeClasspath
+guru.nidi.com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0=testRuntimeClasspath
+guru.nidi.com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0=testRuntimeClasspath
+guru.nidi.com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0=testRuntimeClasspath
+guru.nidi.com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0=testRuntimeClasspath
+guru.nidi.com.kitfox:svgSalamander:1.1.3=testRuntimeClasspath
+guru.nidi:graphviz-java-all-j2v8:0.18.1=testRuntimeClasspath
+guru.nidi:graphviz-java:0.18.1=testRuntimeClasspath
 info.picocli:picocli:4.6.2=checkstyle
 io.apicurio:apicurio-registry-protobuf-schema-utilities:3.0.0.M2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.confluent:common-config:5.3.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -258,26 +258,28 @@ io.confluent:kafka-schema-registry-client:5.3.2=compileClasspath,deploy_jar,nonp
 io.github.classgraph:classgraph:4.8.162=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.github.eisop:dataflow-errorprone:3.34.0-eisop1=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-alts:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-auth:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-alts:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-auth:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-census:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.60.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-context:1.61.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-core:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-googleapis:1.60.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-grpclb:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-inprocess:1.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-netty-shaded:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-core:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-googleapis:1.62.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-grpclb:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-inprocess:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-netty-shaded:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-netty:1.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-protobuf-lite:1.60.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-protobuf-lite:1.61.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-rls:1.60.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-services:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-stub:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-util:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-xds:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf-lite:1.62.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-rls:1.62.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-services:1.61.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-services:1.62.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-stub:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-util:1.61.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-util:1.62.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-xds:1.61.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-xds:1.62.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.netty:netty-buffer:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-codec-http2:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-codec-http:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -304,10 +306,12 @@ io.opencensus:opencensus-impl-core:0.31.0=compileClasspath,deploy_jar,nonprodCom
 io.opencensus:opencensus-impl:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-proto:0.2.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.outfoxx:swiftpoet:1.3.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.perfmark:perfmark-api:0.26.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-jakarta.activation:jakarta.activation-api:2.1.2=jaxb,nonprodRuntime,runtime
+io.perfmark:perfmark-api:0.27.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+jakarta-regexp:jakarta-regexp:1.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+jakarta.activation:jakarta.activation-api:2.1.3=jaxb
+jakarta.inject:jakarta.inject-api:1.0.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 jakarta.inject:jakarta.inject-api:2.0.1=soy
-jakarta.xml.bind:jakarta.xml.bind-api:4.0.1=jaxb,nonprodRuntime,runtime
+jakarta.xml.bind:jakarta.xml.bind-api:4.0.2=jaxb
 javacc:javacc:4.1=css
 javax.activation:activation:1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 javax.activation:javax.activation-api:1.2.0=compileClasspath,deploy_jar,jaxb,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -324,10 +328,10 @@ javax.xml.bind:jaxb-api:2.4.0-b180830.0359=jaxb
 jline:jline:1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 joda-time:joda-time:2.10.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 junit:junit:4.13.2=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
-net.arnx:nashorn-promise:0.1.1=nonprodRuntime,runtime,testRuntimeClasspath
-net.bytebuddy:byte-buddy-agent:1.14.11=testCompileClasspath,testRuntimeClasspath
+net.arnx:nashorn-promise:0.1.1=testRuntimeClasspath
+net.bytebuddy:byte-buddy-agent:1.14.12=testCompileClasspath,testRuntimeClasspath
 net.bytebuddy:byte-buddy:1.12.18=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-net.bytebuddy:byte-buddy:1.14.11=testCompileClasspath,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.14.12=testCompileClasspath,testRuntimeClasspath
 net.java.dev.javacc:javacc:4.1=css
 net.java.dev.jna:jna:5.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.ltgt.gradle.incap:incap:0.2=annotationProcessor,testAnnotationProcessor
@@ -360,7 +364,7 @@ org.apache.beam:beam-vendor-grpc-1_60_1:0.1=compileClasspath,deploy_jar,nonprodC
 org.apache.beam:beam-vendor-guava-32_1_2-jre:0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-compress:1.24.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-csv:1.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-exec:1.3=nonprodRuntime,runtime,testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-exec:1.3=testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-lang3:3.13.0=testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-lang3:3.14.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 org.apache.commons:commons-text:1.11.0=testCompileClasspath,testRuntimeClasspath
@@ -369,27 +373,28 @@ org.apache.ftpserver:ftpserver-core:1.2.0=testCompileClasspath,testRuntimeClassp
 org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.httpcomponents:httpcore:4.4.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.mina:mina-core:2.1.6=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-core:2.0.0=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-scp:2.0.0=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-sftp:2.0.0=testCompileClasspath,testRuntimeClasspath
-org.apache.tomcat:tomcat-annotations-api:11.0.0-M17=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-common:2.12.1=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-core:2.12.1=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-scp:2.12.1=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-sftp:2.12.1=testCompileClasspath,testRuntimeClasspath
+org.apache.tomcat:tomcat-annotations-api:11.0.0-M18=testCompileClasspath,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
-org.bouncycastle:bcpg-jdk15on:1.67=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcpkix-jdk15on:1.67=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcprov-jdk15on:1.67=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.checkerframework:checker-compat-qual:2.5.3=compileClasspath,nonprodCompileClasspath,nonprodRuntime,runtime,testCompileClasspath
+org.bouncycastle:bcpg-jdk18on:1.77=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpkix-jdk18on:1.77=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcprov-jdk18on:1.77=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcutil-jdk18on:1.77=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.checkerframework:checker-compat-qual:2.5.3=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 org.checkerframework:checker-compat-qual:2.5.5=annotationProcessor,testAnnotationProcessor
 org.checkerframework:checker-compat-qual:2.5.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.12.0=checkstyle,soy
 org.checkerframework:checker-qual:3.33.0=errorprone,nonprodAnnotationProcessor
 org.checkerframework:checker-qual:3.41.0=annotationProcessor,testAnnotationProcessor
-org.checkerframework:checker-qual:3.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.checkerframework:checker-qual:3.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.codehaus.jackson:jackson-core-asl:1.9.13=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.codehaus.jackson:jackson-mapper-asl:1.9.13=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.codehaus.mojo:animal-sniffer-annotations:1.23=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.easymock:easymock:3.0=css
-org.eclipse.angus:angus-activation:2.0.1=nonprodRuntime,runtime
 org.eclipse.jetty:jetty-http:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-io:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-security:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -397,12 +402,10 @@ org.eclipse.jetty:jetty-server:9.4.49.v20220914=compileClasspath,deploy_jar,nonp
 org.eclipse.jetty:jetty-servlet:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-util-ajax:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-util:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-core:9.22.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.glassfish.jaxb:jaxb-core:4.0.4=nonprodRuntime,runtime
+org.flywaydb:flyway-core:10.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-database-postgresql:10.10.0=testRuntimeClasspath
 org.glassfish.jaxb:jaxb-runtime:2.3.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.glassfish.jaxb:jaxb-runtime:4.0.4=nonprodRuntime,runtime
 org.glassfish.jaxb:txw2:2.3.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.glassfish.jaxb:txw2:4.0.4=nonprodRuntime,runtime
 org.gwtproject:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.hamcrest:hamcrest-core:1.1=css
 org.hamcrest:hamcrest-core:1.3=nonprodCompileClasspath,nonprodRuntimeClasspath
@@ -456,12 +459,13 @@ org.junit.platform:junit-platform-suite-commons:1.10.2=testRuntimeClasspath
 org.junit:junit-bom:5.10.2=testCompileClasspath,testRuntimeClasspath
 org.jvnet.staxex:stax-ex:1.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.mockito:mockito-core:1.10.19=css
-org.mockito:mockito-core:5.10.0=testCompileClasspath,testRuntimeClasspath
-org.mockito:mockito-junit-jupiter:5.10.0=testCompileClasspath,testRuntimeClasspath
+org.mockito:mockito-core:5.11.0=testCompileClasspath,testRuntimeClasspath
+org.mockito:mockito-junit-jupiter:5.11.0=testCompileClasspath,testRuntimeClasspath
 org.mortbay.jetty:jetty-util:6.1.26=testCompileClasspath,testRuntimeClasspath
 org.mortbay.jetty:jetty:6.1.26=testCompileClasspath,testRuntimeClasspath
 org.objenesis:objenesis:2.1=css
 org.objenesis:objenesis:3.3=testRuntimeClasspath
+org.ogce:xpp3:1.1.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm-analysis:7.0=soy
 org.ow2.asm:asm-analysis:9.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -476,7 +480,7 @@ org.ow2.asm:asm:7.0=soy
 org.ow2.asm:asm:9.2=compileClasspath,nonprodCompileClasspath
 org.ow2.asm:asm:9.6=deploy_jar,jacocoAnt,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.pcollections:pcollections:3.1.4=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-org.postgresql:postgresql:42.7.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.postgresql:postgresql:42.7.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.reflections:reflections:0.10.2=checkstyle
 org.rnorth.duct-tape:duct-tape:1.0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.seleniumhq.selenium:selenium-api:3.141.59=testCompileClasspath,testRuntimeClasspath
@@ -489,9 +493,8 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59=testCompileClasspath,test
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59=testCompileClasspath,testRuntimeClasspath
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59=testCompileClasspath,testRuntimeClasspath
 org.seleniumhq.selenium:selenium-support:3.141.59=testCompileClasspath,testRuntimeClasspath
-org.slf4j:jcl-over-slf4j:1.7.30=nonprodRuntime,runtime,testRuntimeClasspath
-org.slf4j:jul-to-slf4j:1.7.30=nonprodRuntime,runtime,testRuntimeClasspath
-org.slf4j:slf4j-api:1.7.30=nonprodRuntime,runtime
+org.slf4j:jcl-over-slf4j:1.7.32=testCompileClasspath,testRuntimeClasspath
+org.slf4j:jul-to-slf4j:1.7.30=testRuntimeClasspath
 org.slf4j:slf4j-api:2.0.12=compileClasspath,nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath
 org.slf4j:slf4j-api:2.1.0-alpha1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.slf4j:slf4j-jdk14:2.1.0-alpha1=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -499,23 +502,22 @@ org.snakeyaml:snakeyaml-engine:2.1=deploy_jar,nonprodRuntimeClasspath,runtimeCla
 org.springframework:spring-core:5.3.27=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.springframework:spring-expression:5.3.27=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.springframework:spring-jcl:5.3.27=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:database-commons:1.19.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:jdbc:1.19.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:junit-jupiter:1.19.6=testCompileClasspath,testRuntimeClasspath
-org.testcontainers:postgresql:1.19.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:selenium:1.19.6=testCompileClasspath,testRuntimeClasspath
-org.testcontainers:testcontainers:1.19.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:database-commons:1.19.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:jdbc:1.19.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:junit-jupiter:1.19.7=testCompileClasspath,testRuntimeClasspath
+org.testcontainers:postgresql:1.19.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:selenium:1.19.7=testCompileClasspath,testRuntimeClasspath
+org.testcontainers:testcontainers:1.19.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.threeten:threetenbp:1.6.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.tukaani:xz:1.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.w3c.css:sac:1.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.webjars.npm:viz.js-graphviz-java:2.1.3=nonprodRuntime,runtime,testRuntimeClasspath
+org.webjars.npm:viz.js-graphviz-java:2.1.3=testRuntimeClasspath
 org.xerial.snappy:snappy-java:1.1.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.yaml:snakeyaml:2.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.yaml:snakeyaml:2.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-api:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-diagram:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-tools:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-utility:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 xerces:xmlParserAPIs:2.6.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-xpp3:xpp3:1.1.4c=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 empty=devtool,nomulus_test
--- a/core/src/main/java/google/registry/batch/RelockDomainAction.java
+++ b/core/src/main/java/google/registry/batch/RelockDomainAction.java
@@ -82,7 +82,6 @@ public class RelockDomainAction implements Runnable {
  private final long oldUnlockRevisionId;
  private final int previousAttempts;
  private final InternetAddress alertRecipientAddress;
-  private final InternetAddress gSuiteOutgoingEmailAddress;
  private final String supportEmail;
  private final GmailClient gmailClient;
  private final DomainLockUtils domainLockUtils;
@@ -93,7 +92,6 @@ public class RelockDomainAction implements Runnable {
      @Parameter(OLD_UNLOCK_REVISION_ID_PARAM) long oldUnlockRevisionId,
      @Parameter(PREVIOUS_ATTEMPTS_PARAM) int previousAttempts,
      @Config("newAlertRecipientEmailAddress") InternetAddress alertRecipientAddress,
-      @Config("gSuiteOutgoingEmailAddress") InternetAddress gSuiteOutgoingEmailAddress,
      @Config("supportEmail") String supportEmail,
      GmailClient gmailClient,
      DomainLockUtils domainLockUtils,
@@ -101,7 +99,6 @@ public class RelockDomainAction implements Runnable {
    this.oldUnlockRevisionId = oldUnlockRevisionId;
    this.previousAttempts = previousAttempts;
    this.alertRecipientAddress = alertRecipientAddress;
-    this.gSuiteOutgoingEmailAddress = gSuiteOutgoingEmailAddress;
    this.supportEmail = supportEmail;
    this.gmailClient = gmailClient;
    this.domainLockUtils = domainLockUtils;
@@ -217,7 +214,6 @@ public class RelockDomainAction implements Runnable {
            supportEmail);
    gmailClient.sendEmail(
        EmailMessage.newBuilder()
-            .setFrom(gSuiteOutgoingEmailAddress)
            .setBody(body)
            .setSubject(String.format("Error re-locking domain %s", oldLock.getDomainName()))
            .setRecipients(getEmailRecipients(oldLock.getRegistrarId()))
@@ -247,7 +243,6 @@ public class RelockDomainAction implements Runnable {

    gmailClient.sendEmail(
        EmailMessage.newBuilder()
-            .setFrom(gSuiteOutgoingEmailAddress)
            .setBody(body)
            .setSubject(String.format("Successful re-lock of domain %s", oldLock.getDomainName()))
            .setRecipients(getEmailRecipients(oldLock.getRegistrarId()))
@@ -266,7 +261,6 @@ public class RelockDomainAction implements Runnable {
            .build();
    gmailClient.sendEmail(
        EmailMessage.newBuilder()
-            .setFrom(gSuiteOutgoingEmailAddress)
            .setBody(body)
            .setSubject(String.format("Error re-locking domain %s", oldLock.getDomainName()))
            .setRecipients(allRecipients)
@@ -276,7 +270,6 @@ public class RelockDomainAction implements Runnable {
  private void sendUnknownRevisionIdAlertEmail() {
    gmailClient.sendEmail(
        EmailMessage.newBuilder()
-            .setFrom(gSuiteOutgoingEmailAddress)
            .setBody(String.format(RELOCK_UNKNOWN_ID_FAILURE_EMAIL_TEMPLATE, oldUnlockRevisionId))
            .setSubject("Error re-locking domain")
            .setRecipients(ImmutableSet.of(alertRecipientAddress))
--- a/core/src/main/java/google/registry/batch/SendExpiringCertificateNotificationEmailAction.java
+++ b/core/src/main/java/google/registry/batch/SendExpiringCertificateNotificationEmailAction.java
@@ -72,21 +72,18 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
  private final String expirationWarningEmailBodyText;
  private final GmailClient gmailClient;
  private final String expirationWarningEmailSubjectText;
-  private final InternetAddress gSuiteOutgoingEmailAddress;
  private final Response response;

  @Inject
  public SendExpiringCertificateNotificationEmailAction(
      @Config("expirationWarningEmailBodyText") String expirationWarningEmailBodyText,
      @Config("expirationWarningEmailSubjectText") String expirationWarningEmailSubjectText,
-      @Config("gSuiteOutgoingEmailAddress") InternetAddress gSuiteOutgoingEmailAddress,
      GmailClient gmailClient,
      CertificateChecker certificateChecker,
      Response response) {
    this.certificateChecker = certificateChecker;
    this.expirationWarningEmailSubjectText = expirationWarningEmailSubjectText;
    this.gmailClient = gmailClient;
-    this.gSuiteOutgoingEmailAddress = gSuiteOutgoingEmailAddress;
    this.expirationWarningEmailBodyText = expirationWarningEmailBodyText;
    this.response = response;
  }
@@ -172,7 +169,6 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
      }
      gmailClient.sendEmail(
          EmailMessage.newBuilder()
-              .setFrom(gSuiteOutgoingEmailAddress)
              .setSubject(expirationWarningEmailSubjectText)
              .setBody(
                  getEmailBody(
--- a/core/src/main/java/google/registry/bsa/BsaEmailSender.java
+++ b/core/src/main/java/google/registry/bsa/BsaEmailSender.java
@@ -0,0 +1,41 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.bsa;
+
+import google.registry.config.RegistryConfig.Config;
+import google.registry.groups.GmailClient;
+import google.registry.util.EmailMessage;
+import javax.inject.Inject;
+import javax.mail.internet.InternetAddress;
+
+/** Sends BSA-related email notifications. */
+class BsaEmailSender {
+
+  private final InternetAddress alertRecipientAddress;
+  private final GmailClient gmailClient;
+
+  @Inject
+  BsaEmailSender(
+      GmailClient gmailClient,
+      @Config("newAlertRecipientEmailAddress") InternetAddress alertRecipientAddress) {
+    this.alertRecipientAddress = alertRecipientAddress;
+    this.gmailClient = gmailClient;
+  }
+
+  /** Sends an email to the configured alert recipient. */
+  void sendNotification(String subject, String body) {
+    this.gmailClient.sendEmail(EmailMessage.create(subject, body, alertRecipientAddress));
+  }
+}
--- a/core/src/main/java/google/registry/bsa/BsaRefreshAction.java
+++ b/core/src/main/java/google/registry/bsa/BsaRefreshAction.java
@@ -14,6 +14,7 @@

 package google.registry.bsa;

+import static com.google.common.base.Throwables.getStackTraceAsString;
 import static google.registry.bsa.BsaStringUtils.LINE_SPLITTER;
 import static google.registry.request.Action.Method.GET;
 import static google.registry.request.Action.Method.POST;
@@ -55,6 +56,7 @@ public class BsaRefreshAction implements Runnable {
  private final BsaReportSender bsaReportSender;
  private final int transactionBatchSize;
  private final Duration domainCreateTxnCommitTimeLag;
+  private final BsaEmailSender emailSender;
  private final BsaLock bsaLock;
  private final Clock clock;
  private final Response response;
@@ -66,6 +68,7 @@ public class BsaRefreshAction implements Runnable {
      BsaReportSender bsaReportSender,
      @Config("bsaTxnBatchSize") int transactionBatchSize,
      @Config("domainCreateTxnCommitTimeLag") Duration domainCreateTxnCommitTimeLag,
+      BsaEmailSender emailSender,
      BsaLock bsaLock,
      Clock clock,
      Response response) {
@@ -74,6 +77,7 @@ public class BsaRefreshAction implements Runnable {
    this.bsaReportSender = bsaReportSender;
    this.transactionBatchSize = transactionBatchSize;
    this.domainCreateTxnCommitTimeLag = domainCreateTxnCommitTimeLag;
+    this.emailSender = emailSender;
    this.bsaLock = bsaLock;
    this.clock = clock;
    this.response = response;
@@ -83,11 +87,15 @@ public class BsaRefreshAction implements Runnable {
  public void run() {
    try {
      if (!bsaLock.executeWithLock(this::runWithinLock)) {
-        logger.atInfo().log("Job is being executed by another worker.");
+        String message = "BSA refresh did not run: another BSA related task is running";
+        logger.atInfo().log("%s.", message);
+        emailSender.sendNotification(message, /* body= */ "");
+      } else {
+        emailSender.sendNotification("BSA refreshed successfully", "");
      }
    } catch (Throwable throwable) {
-      // TODO(12/31/2023): consider sending an alert email.
-      logger.atWarning().withCause(throwable).log("Failed to update block lists.");
+      logger.atWarning().withCause(throwable).log("Failed to refresh BSA data.");
+      emailSender.sendNotification("BSA refresh aborted", getStackTraceAsString(throwable));
    }
    // Always return OK. No need to use a retrier on `runWithinLock`. Its individual steps are
    // implicitly retried. If action fails, the next cron will continue at checkpoint.
--- a/core/src/main/java/google/registry/bsa/BsaTransactions.java
+++ b/core/src/main/java/google/registry/bsa/BsaTransactions.java
@@ -16,7 +16,6 @@ package google.registry.bsa;

 import static com.google.common.base.Verify.verify;
 import static google.registry.persistence.PersistenceModule.TransactionIsolationLevel.TRANSACTION_REPEATABLE_READ;
-import static google.registry.persistence.transaction.JpaTransactionManagerImpl.isInTransaction;
 import static google.registry.persistence.transaction.TransactionManagerFactory.replicaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

@@ -36,18 +35,18 @@ public final class BsaTransactions {

  @CanIgnoreReturnValue
  public static <T> T bsaTransact(Callable<T> work) {
-    verify(!isInTransaction(), "May only be used for top-level transactions.");
+    verify(!tm().inTransaction(), "May only be used for top-level transactions.");
    return tm().transact(TRANSACTION_REPEATABLE_READ, work);
  }

  public static void bsaTransact(ThrowingRunnable work) {
-    verify(!isInTransaction(), "May only be used for top-level transactions.");
+    verify(!tm().inTransaction(), "May only be used for top-level transactions.");
    tm().transact(TRANSACTION_REPEATABLE_READ, work);
  }

  @CanIgnoreReturnValue
  public static <T> T bsaQuery(Callable<T> work) {
-    verify(!isInTransaction(), "May only be used for top-level transactions.");
+    verify(!tm().inTransaction(), "May only be used for top-level transactions.");
    // TRANSACTION_REPEATABLE_READ is default on replica.
    return replicaTm().transact(work);
  }
--- a/core/src/main/java/google/registry/bsa/BsaValidateAction.java
+++ b/core/src/main/java/google/registry/bsa/BsaValidateAction.java
@@ -0,0 +1,187 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.bsa;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Throwables.getStackTraceAsString;
+import static google.registry.bsa.BsaTransactions.bsaQuery;
+import static google.registry.bsa.persistence.Queries.batchReadBsaLabelText;
+import static google.registry.request.Action.Method.GET;
+import static google.registry.request.Action.Method.POST;
+import static javax.servlet.http.HttpServletResponse.SC_OK;
+
+import com.google.common.base.Joiner;
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Iterables;
+import com.google.common.collect.Sets;
+import com.google.common.collect.Sets.SetView;
+import com.google.common.flogger.FluentLogger;
+import google.registry.bsa.persistence.DownloadScheduler;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.request.Action;
+import google.registry.request.Response;
+import google.registry.request.auth.Auth;
+import java.util.Optional;
+import java.util.stream.Stream;
+import javax.inject.Inject;
+
+/** Validates the BSA data in the database against the most recent block lists. */
+@Action(
+    service = Action.Service.BSA,
+    path = BsaValidateAction.PATH,
+    method = {GET, POST},
+    auth = Auth.AUTH_API_ADMIN)
+public class BsaValidateAction implements Runnable {
+
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  static final String PATH = "/_dr/task/bsaValidate";
+  private final GcsClient gcsClient;
+  private final IdnChecker idnChecker;
+  private final BsaEmailSender emailSender;
+  private final int transactionBatchSize;
+  private final BsaLock bsaLock;
+  private final Response response;
+
+  @Inject
+  BsaValidateAction(
+      GcsClient gcsClient,
+      IdnChecker idnChecker,
+      BsaEmailSender emailSender,
+      @Config("bsaTxnBatchSize") int transactionBatchSize,
+      BsaLock bsaLock,
+      Response response) {
+    this.gcsClient = gcsClient;
+    this.idnChecker = idnChecker;
+    this.emailSender = emailSender;
+    this.transactionBatchSize = transactionBatchSize;
+    this.bsaLock = bsaLock;
+    this.response = response;
+  }
+
+  @Override
+  public void run() {
+    try {
+      if (!bsaLock.executeWithLock(this::runWithinLock)) {
+        String message = "BSA validation did not run: another BSA related task is running";
+        logger.atInfo().log("%s.", message);
+        emailSender.sendNotification(message, /* body= */ "");
+      }
+    } catch (Throwable throwable) {
+      logger.atWarning().withCause(throwable).log("Failed to validate block lists.");
+      emailSender.sendNotification("BSA validation aborted", getStackTraceAsString(throwable));
+    }
+    // Always return OK. No need to retry since all queries and GCS accesses are already
+    // implicitly retried.
+    response.setStatus(SC_OK);
+  }
+
+  /** Executes the validation action while holding the BSA lock. */
+  Void runWithinLock() {
+    Optional<String> downloadJobName =
+        bsaQuery(DownloadScheduler::fetchMostRecentDownloadJobIdIfCompleted);
+    if (downloadJobName.isEmpty()) {
+      logger.atInfo().log("Cannot validate: block list downloads not found.");
+      emailSender.sendNotification(
+          "BSA validation does not run: block list downloads not found", "");
+      return null;
+    }
+    logger.atInfo().log("Validating BSA with latest download: %s", downloadJobName.get());
+
+    ImmutableList.Builder<String> errorsBuilder = new ImmutableList.Builder<>();
+    errorsBuilder.addAll(checkBsaLabels(downloadJobName.get()));
+
+    ImmutableList<String> errors = errorsBuilder.build();
+
+    String resultSummary =
+        errors.isEmpty()
+            ? "BSA validation completed: no errors found"
+            : "BSA validation completed with errors";
+
+    emailValidationResults(resultSummary, downloadJobName.get(), errors);
+    logger.atInfo().log("Finished validating BSA with latest download: %s", downloadJobName.get());
+    return null;
+  }
+
+  void emailValidationResults(String subject, String jobName, ImmutableList<String> results) {
+    String body =
+        String.format("Most recent download is %s.\n\n", jobName) + Joiner.on('\n').join(results);
+    emailSender.sendNotification(subject, body);
+  }
+
+  ImmutableList<String> checkBsaLabels(String jobName) {
+    ImmutableSet<String> downloadedLabels = fetchDownloadedLabels(jobName);
+    ImmutableSet<String> persistedLabels = fetchPersistedLabels(transactionBatchSize);
+    ImmutableList.Builder<String> errors = new ImmutableList.Builder<>();
+
+    int nErrorExamples = 10;
+    SetView<String> missingLabels = Sets.difference(downloadedLabels, persistedLabels);
+    if (!missingLabels.isEmpty()) {
+      String examples = Joiner.on(',').join(Iterables.limit(missingLabels, nErrorExamples));
+      String errorMessage =
+          String.format(
+              "Found %d missing labels in the DB. Examples: [%s]", missingLabels.size(), examples);
+      logger.atInfo().log(errorMessage);
+      errors.add(errorMessage);
+    }
+    SetView<String> unexpectedLabels = Sets.difference(persistedLabels, downloadedLabels);
+    if (!unexpectedLabels.isEmpty()) {
+      String examples = Joiner.on(',').join(Iterables.limit(unexpectedLabels, nErrorExamples));
+      String errorMessage =
+          String.format(
+              "Found %d unexpected labels in the DB. Examples: [%s]",
+              unexpectedLabels.size(), examples);
+      logger.atInfo().log(errorMessage);
+      errors.add(errorMessage);
+    }
+    return errors.build();
+  }
+
+  /** Returns unique labels across all block lists in the download specified by {@code jobName}. */
+  ImmutableSet<String> fetchDownloadedLabels(String jobName) {
+    ImmutableSet.Builder<String> labelsBuilder = new ImmutableSet.Builder<>();
+    for (BlockListType blockListType : BlockListType.values()) {
+      try (Stream<String> lines = gcsClient.readBlockList(jobName, blockListType)) {
+        lines
+            .skip(1)
+            .map(BsaValidateAction::parseBlockListLine)
+            .filter(label -> !idnChecker.getAllValidIdns(label).isEmpty())
+            .forEach(labelsBuilder::add);
+      }
+    }
+    return labelsBuilder.build();
+  }
+
+  ImmutableSet<String> fetchPersistedLabels(int batchSize) {
+    ImmutableSet.Builder<String> labelsBuilder = new ImmutableSet.Builder<>();
+    ImmutableList<String> batch;
+    Optional<String> lastRead = Optional.empty();
+    do {
+      batch = batchReadBsaLabelText(lastRead, batchSize);
+      batch.forEach(labelsBuilder::add);
+      if (!batch.isEmpty()) {
+        lastRead = Optional.of(Iterables.getLast(batch));
+      }
+    } while (batch.size() == batchSize);
+    return labelsBuilder.build();
+  }
+
+  static String parseBlockListLine(String line) {
+    int firstComma = line.indexOf(',');
+    checkArgument(firstComma > 0, "Invalid block list line: %s", line);
+    return line.substring(0, firstComma);
+  }
+}
--- a/core/src/main/java/google/registry/bsa/IdnChecker.java
+++ b/core/src/main/java/google/registry/bsa/IdnChecker.java
@@ -50,7 +50,7 @@ public class IdnChecker {
  }

  /** Returns all IDNs in which the {@code label} is valid. */
-  ImmutableSet<IdnTableEnum> getAllValidIdns(String label) {
+  public ImmutableSet<IdnTableEnum> getAllValidIdns(String label) {
    return idnToTlds.keySet().stream()
        .filter(idnTable -> idnTable.getTable().isValidLabel(label))
        .collect(toImmutableSet());
--- a/core/src/main/java/google/registry/bsa/UploadBsaUnavailableDomainsAction.java
+++ b/core/src/main/java/google/registry/bsa/UploadBsaUnavailableDomainsAction.java
@@ -91,6 +91,7 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
  String gcsBucket;

  String apiUrl;
+  BsaEmailSender emailSender;

  google.registry.request.Response response;

@@ -99,6 +100,7 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
      Clock clock,
      BsaCredential bsaCredential,
      GcsUtils gcsUtils,
+      BsaEmailSender emailSender,
      @Config("bsaUnavailableDomainsGcsBucket") String gcsBucket,
      @Config("bsaUploadUnavailableDomainsUrl") String apiUrl,
      google.registry.request.Response response) {
@@ -107,6 +109,7 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
    this.gcsUtils = gcsUtils;
    this.gcsBucket = gcsBucket;
    this.apiUrl = apiUrl;
+    this.emailSender = emailSender;
    this.response = response;
  }

@@ -118,26 +121,36 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
    String unavailableDomains = Joiner.on("\n").join(getUnavailableDomains(runTime));
    if (unavailableDomains.isEmpty()) {
      logger.atWarning().log("No unavailable domains found; terminating.");
+      emailSender.sendNotification(
+          "BSA daily upload found no domains to upload", "This is unexpected. Please investigate.");
    } else {
-      uploadToGcs(unavailableDomains, runTime);
-      uploadToBsa(unavailableDomains, runTime);
+      boolean isGcsSuccess = uploadToGcs(unavailableDomains, runTime);
+      boolean isBsaSuccess = uploadToBsa(unavailableDomains, runTime);
+      if (isBsaSuccess && isGcsSuccess) {
+        emailSender.sendNotification("BSA daily upload completed successfully", "");
+      } else {
+        emailSender.sendNotification(
+            "BSA daily upload completed with errors", "Please see logs for details.");
+      }
    }
  }

  /** Uploads the unavailable domains list to GCS in the unavailable domains bucket. */
-  void uploadToGcs(String unavailableDomains, DateTime runTime) {
+  boolean uploadToGcs(String unavailableDomains, DateTime runTime) {
    logger.atInfo().log("Uploading unavailable names file to GCS in bucket %s", gcsBucket);
    BlobId blobId = BlobId.of(gcsBucket, createFilename(runTime));
    try (OutputStream gcsOutput = gcsUtils.openOutputStream(blobId);
        Writer osWriter = new OutputStreamWriter(gcsOutput, US_ASCII)) {
      osWriter.write(unavailableDomains);
+      return true;
    } catch (Exception e) {
      logger.atSevere().withCause(e).log(
          "Error writing BSA unavailable domains to GCS; skipping to BSA upload ...");
+      return false;
    }
  }

-  void uploadToBsa(String unavailableDomains, DateTime runTime) {
+  boolean uploadToBsa(String unavailableDomains, DateTime runTime) {
    try {
      byte[] gzippedContents = gzipUnavailableDomains(unavailableDomains);
      String sha512Hash = ByteSource.wrap(gzippedContents).hash(Hashing.sha512()).toString();
@@ -174,10 +187,12 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
            uploadResponse.code(),
            uploadResponse.body() == null ? "(none)" : uploadResponse.body().string());
      }
+      return true;
    } catch (IOException e) {
      logger.atSevere().withCause(e).log("Error while attempting to upload to BSA, aborting.");
      response.setStatus(HttpStatusCodes.STATUS_CODE_SERVER_ERROR);
      response.setPayload("Error while attempting to upload to BSA: " + e.getMessage());
+      return false;
    }
  }

--- a/core/src/main/java/google/registry/bsa/persistence/BsaLabelUtils.java
+++ b/core/src/main/java/google/registry/bsa/persistence/BsaLabelUtils.java
@@ -33,7 +33,7 @@ import google.registry.persistence.VKey;
 import java.time.Duration;
 import java.util.Map;
 import java.util.Optional;
-import org.apache.commons.lang3.stream.Streams;
+import java.util.Set;

 /** Helpers for {@link BsaLabel}. */
 public final class BsaLabelUtils {
@@ -41,7 +41,7 @@ public final class BsaLabelUtils {
  private BsaLabelUtils() {}

  static final CacheLoader<VKey<BsaLabel>, Optional<BsaLabel>> CACHE_LOADER =
-      new CacheLoader<VKey<BsaLabel>, Optional<BsaLabel>>() {
+      new CacheLoader<>() {

        @Override
        public Optional<BsaLabel> load(VKey<BsaLabel> key) {
@@ -49,11 +49,11 @@ public final class BsaLabelUtils {
        }

        @Override
-        public Map<VKey<BsaLabel>, Optional<BsaLabel>> loadAll(
-            Iterable<? extends VKey<BsaLabel>> keys) {
+        public Map<? extends VKey<BsaLabel>, ? extends Optional<BsaLabel>> loadAll(
+            Set<? extends VKey<BsaLabel>> keys) {
          ImmutableMap<VKey<? extends BsaLabel>, BsaLabel> existingLabels =
              replicaTm().reTransact(() -> replicaTm().loadByKeysIfPresent(keys));
-          return Streams.of(keys)
+          return keys.stream()
              .collect(
                  toImmutableMap(key -> key, key -> Optional.ofNullable(existingLabels.get(key))));
        }
@@ -75,7 +75,7 @@ public final class BsaLabelUtils {
   * <p>Since the cached BSA labels have the same usage pattern as the cached EppResources, the
   * cache configuration for the latter are reused here.
   */
-  private static LoadingCache<VKey<BsaLabel>, Optional<BsaLabel>> cacheBsaLabels =
+  private static final LoadingCache<VKey<BsaLabel>, Optional<BsaLabel>> cacheBsaLabels =
      createBsaLabelsCache(getEppResourceCachingDuration());

  private static LoadingCache<VKey<BsaLabel>, Optional<BsaLabel>> createBsaLabelsCache(
--- a/core/src/main/java/google/registry/bsa/persistence/DownloadScheduler.java
+++ b/core/src/main/java/google/registry/bsa/persistence/DownloadScheduler.java
@@ -30,7 +30,6 @@ import google.registry.util.Clock;
 import java.util.Objects;
 import java.util.Optional;
 import javax.inject.Inject;
-import org.joda.time.DateTime;
 import org.joda.time.Duration;

 /**
@@ -115,16 +114,6 @@ public final class DownloadScheduler {
            });
  }

-  Optional<DateTime> latestCompletedJobTime() {
-    return tm().transact(
-            () -> {
-              return fetchTwoMostRecentDownloads().stream()
-                  .filter(job -> Objects.equals(job.getStage(), DONE))
-                  .map(BsaDownload::getCreationTime)
-                  .findFirst();
-            });
-  }
-
  private boolean isTimeAgain(BsaDownload mostRecent, Duration interval) {
    return mostRecent.getCreationTime().plus(interval).minus(CRON_JITTER).isBefore(clock.nowUtc());
  }
@@ -163,4 +152,14 @@ public final class DownloadScheduler {
  static Optional<BsaDownload> fetchMostRecentDownload() {
    return fetchTwoMostRecentDownloads().stream().findFirst();
  }
+
+  /**
+   * Returns the most recent download {@code jobName} if it has been fully processed, and {@code
+   * empty} if the download is still being processed.
+   */
+  public static Optional<String> fetchMostRecentDownloadJobIdIfCompleted() {
+    return fetchMostRecentDownload()
+        .filter(bsaDownload -> Objects.equals(bsaDownload.getStage(), DONE))
+        .map(BsaDownload::getJobName);
+  }
 }
--- a/core/src/main/java/google/registry/bsa/persistence/Queries.java
+++ b/core/src/main/java/google/registry/bsa/persistence/Queries.java
@@ -17,7 +17,7 @@ package google.registry.bsa.persistence;
 import static com.google.common.base.Verify.verify;
 import static google.registry.bsa.BsaStringUtils.DOMAIN_SPLITTER;
 import static google.registry.bsa.BsaTransactions.bsaQuery;
-import static google.registry.persistence.transaction.JpaTransactionManagerImpl.em;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

 import com.google.common.collect.ImmutableCollection;
 import com.google.common.collect.ImmutableList;
@@ -30,19 +30,39 @@ import java.util.stream.Stream;
 import org.joda.time.DateTime;

 /** Helpers for querying BSA JPA entities. */
-class Queries {
+public final class Queries {

  private Queries() {}

+  /**
+   * Entity objects that may be updated in the same query must be detached. See {@code
+   * JpaTransactionManagerImpl}.
+   */
  private static Object detach(Object obj) {
-    em().detach(obj);
+    tm().getEntityManager().detach(obj);
    return obj;
  }

+  public static ImmutableList<String> batchReadBsaLabelText(
+      Optional<String> lastRead, int batchSize) {
+
+    return ImmutableList.copyOf(
+        bsaQuery(
+            () ->
+                tm().getEntityManager()
+                    .createQuery(
+                        "SELECT b.label FROM BsaLabel b WHERE b.label > :lastRead ORDER BY b.label",
+                        String.class)
+                    .setParameter("lastRead", lastRead.orElse(""))
+                    .setMaxResults(batchSize)
+                    .getResultList()));
+  }
+
  static Stream<BsaUnblockableDomain> queryBsaUnblockableDomainByLabels(
      ImmutableCollection<String> labels) {
    return ((Stream<?>)
-            em().createQuery("FROM BsaUnblockableDomain WHERE label in (:labels)")
+            tm().getEntityManager()
+                .createQuery("FROM BsaUnblockableDomain WHERE label in (:labels)")
                .setParameter("labels", labels)
                .getResultStream())
        .map(Queries::detach)
@@ -51,7 +71,8 @@ class Queries {

  static Stream<BsaLabel> queryBsaLabelByLabels(ImmutableCollection<String> labels) {
    return ((Stream<?>)
-            em().createQuery("FROM BsaLabel where label in (:labels)")
+            tm().getEntityManager()
+                .createQuery("FROM BsaLabel where label in (:labels)")
                .setParameter("labels", labels)
                .getResultStream())
        .map(Queries::detach)
@@ -59,7 +80,8 @@ class Queries {
  }

  static int deleteBsaLabelByLabels(ImmutableCollection<String> labels) {
-    return em().createQuery("DELETE FROM BsaLabel where label IN (:deleted_labels)")
+    return tm().getEntityManager()
+        .createQuery("DELETE FROM BsaLabel where label IN (:deleted_labels)")
        .setParameter("deleted_labels", labels)
        .executeUpdate();
  }
@@ -69,7 +91,8 @@ class Queries {
    return ImmutableList.copyOf(
        bsaQuery(
            () ->
-                em().createQuery(
+                tm().getEntityManager()
+                    .createQuery(
                        "FROM BsaUnblockableDomain d WHERE d.label > :label OR (d.label = :label"
                            + " AND d.tld >  :tld) ORDER BY d.tld, d.label ")
                    .setParameter("label", lastRead.map(d -> d.label).orElse(""))
@@ -93,13 +116,14 @@ class Queries {
            "SELECT CONCAT(d.label, '.', d.tld) FROM \"BsaUnblockableDomain\" d "
                + "WHERE (d.label, d.tld) IN (%s)",
            labelTldParis);
-    return ImmutableSet.copyOf(em().createNativeQuery(sql).getResultList());
+    return ImmutableSet.copyOf(tm().getEntityManager().createNativeQuery(sql).getResultList());
  }

  static ImmutableSet<String> queryNewlyCreatedDomains(
      ImmutableCollection<String> tlds, DateTime minCreationTime, DateTime now) {
    return ImmutableSet.copyOf(
-        em().createQuery(
+        tm().getEntityManager()
+            .createQuery(
                "SELECT domainName FROM Domain WHERE creationTime >= :minCreationTime "
                    + "AND deletionTime > :now "
                    + "AND tld in (:tlds)",
--- a/core/src/main/java/google/registry/config/DelegatedCredentials.java
+++ b/core/src/main/java/google/registry/config/DelegatedCredentials.java
@@ -45,7 +45,6 @@ import java.io.IOException;
 import java.math.BigDecimal;
 import java.time.Duration;
 import java.util.Collection;
-import java.util.Date;
 import java.util.Map;
 import java.util.ServiceLoader;
 import org.apache.commons.codec.binary.Base64;
@@ -195,10 +194,7 @@ public class DelegatedCredentials extends GoogleCredentials {
    GenericData responseData = response.parseAs(GenericData.class);
    String accessToken = validateString(responseData, "access_token", PARSE_ERROR_PREFIX);
    int expiresInSeconds = validateInt32(responseData, "expires_in", PARSE_ERROR_PREFIX);
-    long expiresAtMilliseconds = clock.nowUtc().getMillis() + expiresInSeconds * 1000L;
-    @SuppressWarnings("JavaUtilDate")
-    AccessToken token = new AccessToken(accessToken, new Date(expiresAtMilliseconds));
-    return token;
+    return new AccessToken(accessToken, clock.nowUtc().plusSeconds(expiresInSeconds).toDate());
  }

  String createAssertion(JsonFactory jsonFactory, long currentTime) throws IOException {
@@ -257,8 +253,7 @@ public class DelegatedCredentials extends GoogleCredentials {
    if (value == null) {
      throw new IOException(String.format(VALUE_NOT_FOUND_MESSAGE, errorPrefix, key));
    }
-    if (value instanceof BigDecimal) {
-      BigDecimal bigDecimalValue = (BigDecimal) value;
+    if (value instanceof BigDecimal bigDecimalValue) {
      return bigDecimalValue.intValueExact();
    }
    if (!(value instanceof Integer)) {
--- a/core/src/main/java/google/registry/dns/PublishDnsUpdatesAction.java
+++ b/core/src/main/java/google/registry/dns/PublishDnsUpdatesAction.java
@@ -118,7 +118,6 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
  private final String dnsUpdateFailRegistryName;
  private final Lazy<InternetAddress> registrySupportEmail;
  private final Lazy<InternetAddress> registryCcEmail;
-  private final InternetAddress gSuiteOutgoingEmailAddress;

  @Inject
  public PublishDnsUpdatesAction(
@@ -136,7 +135,6 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
      @Config("dnsUpdateFailRegistryName") String dnsUpdateFailRegistryName,
      @Config("registrySupportEmail") Lazy<InternetAddress> registrySupportEmail,
      @Config("registryCcEmail") Lazy<InternetAddress> registryCcEmail,
-      @Config("gSuiteOutgoingEmailAddress") InternetAddress gSuiteOutgoingEmailAddress,
      @Header(CLOUD_TASKS_RETRY_HEADER) int retryCount,
      DnsWriterProxy dnsWriterProxy,
      DnsMetrics dnsMetrics,
@@ -167,7 +165,6 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
    this.dnsUpdateFailRegistryName = dnsUpdateFailRegistryName;
    this.registrySupportEmail = registrySupportEmail;
    this.registryCcEmail = registryCcEmail;
-    this.gSuiteOutgoingEmailAddress = gSuiteOutgoingEmailAddress;
  }

  private void recordActionResult(ActionStatus status) {
@@ -309,7 +306,6 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
              .setSubject(dnsUpdateFailEmailSubjectText)
              .setRecipients(recipients)
              .addBcc(registryCcEmail.get())
-              .setFrom(gSuiteOutgoingEmailAddress)
              .build());

    } else {
--- a/core/src/main/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>backend</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="alpha"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1m"/>
  </static-files>
--- a/core/src/main/java/google/registry/env/alpha/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/alpha/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>bsa</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,16 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="alpha"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>

  <!-- Enable external traffic to go through VPC, required for static ip -->
  <vpc-access-connector>
--- a/core/src/main/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>default</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="alpha"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1m"/>
    <include path="/assets/js/**" expiration="1m"/>
--- a/core/src/main/java/google/registry/env/alpha/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/alpha/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>pubapi</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="alpha"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1m"/>
    <include path="/assets/js/**" expiration="1m"/>
--- a/core/src/main/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>tools</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="alpha"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1m"/>
    <include path="/assets/js/**" expiration="1m"/>
--- a/core/src/main/java/google/registry/env/common/bsa/WEB-INF/web.xml
+++ b/core/src/main/java/google/registry/env/common/bsa/WEB-INF/web.xml
@@ -25,6 +25,12 @@
    <url-pattern>/_dr/task/bsaRefresh</url-pattern>
  </servlet-mapping>

+  <!-- Refresh action -->
+  <servlet-mapping>
+    <servlet-name>bsa-servlet</servlet-name>
+    <url-pattern>/_dr/task/bsaValidate</url-pattern>
+  </servlet-mapping>
+
  <!-- Upload unavailable domains to BSA action -->
  <servlet-mapping>
    <servlet-name>bsa-servlet</servlet-name>
--- a/core/src/main/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>backend</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="crash"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1m"/>
  </static-files>
--- a/core/src/main/java/google/registry/env/crash/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/crash/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>bsa</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="crash"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <!-- Enable external traffic to go through VPC, required for static ip -->
  <vpc-access-connector>
    <name>projects/domain-registry-crash/locations/us-central1/connectors/appengine-connector</name>
--- a/core/src/main/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>default</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="crash"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1m"/>
    <include path="/assets/js/**" expiration="1m"/>
--- a/core/src/main/java/google/registry/env/crash/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/crash/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>pubapi</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="crash"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1m"/>
    <include path="/assets/js/**" expiration="1m"/>
--- a/core/src/main/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>tools</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="crash"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1m"/>
    <include path="/assets/js/**" expiration="1m"/>
--- a/core/src/main/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>backend</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
@@ -20,6 +21,10 @@
              value="/tmp/domain-registry-appengine-generated/local/"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html">
      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
--- a/core/src/main/java/google/registry/env/local/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/local/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>bsa</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
@@ -20,6 +21,10 @@
              value="/tmp/domain-registry-appengine-generated/local/"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html">
      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
--- a/core/src/main/java/google/registry/env/local/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/local/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>default</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
@@ -20,6 +21,10 @@
              value="/tmp/domain-registry-appengine-generated/local/"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html">
      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
--- a/core/src/main/java/google/registry/env/local/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/local/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>pubapi</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
@@ -20,6 +21,10 @@
              value="/tmp/domain-registry-appengine-generated/local/"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html">
      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
--- a/core/src/main/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>tools</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
@@ -20,6 +21,10 @@
              value="/tmp/domain-registry-appengine-generated/local/"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html">
      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
--- a/core/src/main/java/google/registry/env/production/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>backend</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="production"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1d"/>
  </static-files>
--- a/core/src/main/java/google/registry/env/production/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>bsa</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="production"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <!-- Enable external traffic to go through VPC, required for static ip -->
  <vpc-access-connector>
    <name>projects/domain-registry/locations/us-central1/connectors/appengine-connector</name>
--- a/core/src/main/java/google/registry/env/production/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>default</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -11,12 +11,17 @@
  </manual-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="production"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1d"/>
    <include path="/assets/js/**" expiration="1d"/>
--- a/core/src/main/java/google/registry/env/production/default/WEB-INF/cloud-scheduler-tasks.xml
+++ b/core/src/main/java/google/registry/env/production/default/WEB-INF/cloud-scheduler-tasks.xml
@@ -297,6 +297,18 @@
    <schedule>15,45 * * * *</schedule>
  </task>

+  <task>
+    <url><![CDATA[/_dr/task/bsaValidate]]></url>
+    <name>bsaValidate</name>
+    <service>bsa</service>
+    <description>
+      Validates the processed BSA data in the database against the original
+      block lists.
+    </description>
+    <!-- Runs twice daily. -->
+    <schedule>50 9,21 * * *</schedule>
+  </task>
+
  <task>
    <url><![CDATA[/_dr/task/uploadBsaUnavailableNames]]></url>
    <name>uploadBsaUnavailableNames</name>
--- a/core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>pubapi</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -11,12 +11,17 @@
  </manual-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="production"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1d"/>
    <include path="/assets/js/**" expiration="1d"/>
--- a/core/src/main/java/google/registry/env/production/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>tools</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="production"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1d"/>
    <include path="/assets/js/**" expiration="1d"/>
--- a/core/src/main/java/google/registry/env/qa/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/qa/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>backend</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="qa"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1h"/>
  </static-files>
--- a/core/src/main/java/google/registry/env/qa/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/qa/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>bsa</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="qa"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1h"/>
  </static-files>
--- a/core/src/main/java/google/registry/env/qa/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/qa/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>default</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -15,12 +15,17 @@
  </automatic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="qa"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1h"/>
    <include path="/assets/js/**" expiration="1h"/>
--- a/core/src/main/java/google/registry/env/qa/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/qa/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>pubapi</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="qa"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1h"/>
    <include path="/assets/js/**" expiration="1h"/>
--- a/core/src/main/java/google/registry/env/qa/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/qa/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>tools</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="qa"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1h"/>
    <include path="/assets/js/**" expiration="1h"/>
--- a/core/src/main/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>backend</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="sandbox"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1d"/>
  </static-files>
--- a/core/src/main/java/google/registry/env/sandbox/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/sandbox/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>bsa</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="sandbox"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1d"/>
  </static-files>
--- a/core/src/main/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>default</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -11,12 +11,17 @@
  </manual-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="sandbox"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1d"/>
    <include path="/assets/js/**" expiration="1d"/>
--- a/core/src/main/java/google/registry/env/sandbox/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/sandbox/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>pubapi</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -11,12 +11,17 @@
  </manual-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="sandbox"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1d"/>
    <include path="/assets/js/**" expiration="1d"/>
--- a/core/src/main/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
  <service>tools</service>
  <app-engine-apis>true</app-engine-apis>
  <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
  </basic-scaling>

  <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
    <property name="java.util.logging.config.file"
              value="WEB-INF/logging.properties"/>
    <property name="google.registry.environment"
              value="sandbox"/>
  </system-properties>

+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
  <static-files>
    <include path="/*.html" expiration="1d"/>
    <include path="/assets/js/**" expiration="1d"/>
--- a/core/src/main/java/google/registry/flows/certs/CertificateChecker.java
+++ b/core/src/main/java/google/registry/flows/certs/CertificateChecker.java
@@ -31,7 +31,6 @@ import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
 import java.security.interfaces.ECPublicKey;
 import java.security.interfaces.RSAPublicKey;
-import java.util.Date;
 import java.util.stream.Collectors;
 import javax.inject.Inject;
 import org.bouncycastle.jcajce.provider.asymmetric.util.EC5Util;
@@ -106,12 +105,9 @@ public class CertificateChecker {
    // These 2 different instances of PublicKey need to be handled separately since their OIDs are
    // encoded differently. More details on this can be found at
    // https://stackoverflow.com/questions/49895713/how-to-find-the-matching-curve-name-from-an-ecpublickey.
-    if (key instanceof ECPublicKey) {
-      ECPublicKey ecKey = (ECPublicKey) key;
+    if (key instanceof ECPublicKey ecKey) {
      params = EC5Util.convertSpec(ecKey.getParams());
-    } else if (key instanceof org.bouncycastle.jce.interfaces.ECPublicKey) {
-      org.bouncycastle.jce.interfaces.ECPublicKey ecKey =
-          (org.bouncycastle.jce.interfaces.ECPublicKey) key;
+    } else if (key instanceof org.bouncycastle.jce.interfaces.ECPublicKey ecKey) {
      params = ecKey.getParameters();
    } else {
      throw new IllegalArgumentException("Unrecognized instance of PublicKey.");
@@ -148,7 +144,7 @@ public class CertificateChecker {
    if (!violations.isEmpty()) {
      String displayMessages =
          violations.stream()
-              .map(violation -> getViolationDisplayMessage(violation))
+              .map(this::getViolationDisplayMessage)
              .collect(Collectors.joining("\n"));
      throw new InsecureCertificateException(violations, displayMessages);
    }
@@ -162,7 +158,7 @@ public class CertificateChecker {
    ImmutableSet.Builder<CertificateViolation> violations = new ImmutableSet.Builder<>();

    // Check if currently in validity period
-    Date now = clock.nowUtc().toDate();
+    DateTime now = clock.nowUtc();
    if (DateTimeComparator.getInstance().compare(certificate.getNotAfter(), now) < 0) {
      violations.add(CertificateViolation.EXPIRED);
    } else if (DateTimeComparator.getInstance().compare(certificate.getNotBefore(), now) > 0) {
@@ -231,13 +227,13 @@ public class CertificateChecker {
      DateTime lastExpiringNotificationSentDate, String certificateStr) {
    X509Certificate certificate = getCertificate(certificateStr);
    DateTime now = clock.nowUtc();
-    // expiration date is one day after lastValidDate
+    // the expiration date is one day after lastValidDate
    DateTime lastValidDate = new DateTime(certificate.getNotAfter());
    if (lastValidDate.isBefore(now)) {
      return false;
    }
    /*
-     * Client should receive a notification if :
+     * Client should receive a notification if:
     *    1) client has never received notification (lastExpiringNotificationSentDate is initially
     *    set to START_OF_TIME) and the certificate has entered the expiring period, OR
     *    2) client has received notification but the interval between now and
@@ -254,29 +250,21 @@ public class CertificateChecker {
    // Yes, we'd rather do this as an instance method on the CertificateViolation enum itself, but
    // we can't because we need access to configuration (injected as instance variables) which you
    // can't get in a static enum context.
-    switch (certificateViolation) {
-      case EXPIRED:
-        return "Certificate is expired.";
-      case NOT_YET_VALID:
-        return "Certificate start date is in the future.";
-      case ALGORITHM_CONSTRAINED:
-        return "Certificate key algorithm must be RSA or ECDSA.";
-      case RSA_KEY_LENGTH_TOO_SHORT:
-        return String.format(
-            "RSA key length is too short; the minimum allowed length is %d bits.",
-            this.minimumRsaKeyLength);
-      case VALIDITY_LENGTH_TOO_LONG:
-        return String.format(
-            "Certificate validity period is too long; it must be less than or equal to %d days.",
-            this.maxValidityLengthSchedule.lastEntry().getValue());
-      case INVALID_ECDSA_CURVE:
-        return String.format(
-            "The ECDSA key must use one of these algorithms: %s", allowedEcdsaCurves);
-      default:
-        throw new IllegalArgumentException(
-            String.format(
-                "Unknown CertificateViolation enum value: %s", certificateViolation.name()));
-    }
+    return switch (certificateViolation) {
+      case EXPIRED -> "Certificate is expired.";
+      case NOT_YET_VALID -> "Certificate start date is in the future.";
+      case ALGORITHM_CONSTRAINED -> "Certificate key algorithm must be RSA or ECDSA.";
+      case RSA_KEY_LENGTH_TOO_SHORT ->
+          String.format(
+              "RSA key length is too short; the minimum allowed length is %d bits.",
+              this.minimumRsaKeyLength);
+      case VALIDITY_LENGTH_TOO_LONG ->
+          String.format(
+              "Certificate validity period is too long; it must be less than or equal to %d days.",
+              this.maxValidityLengthSchedule.lastEntry().getValue());
+      case INVALID_ECDSA_CURVE ->
+          String.format("The ECDSA key must use one of these algorithms: %s", allowedEcdsaCurves);
+    };
  }

  /**
@@ -295,7 +283,7 @@ public class CertificateChecker {
     * Gets a suitable end-user-facing display message for this particular certificate violation.
     *
     * <p>Note that the {@link CertificateChecker} instance must be passed in because it contains
-     * configuration values (e.g. minimum RSA key length) that go into the error message text.
+     * configuration values (e.g., minimum RSA key length) that go into the error message text.
     */
    public String getDisplayMessage(CertificateChecker certificateChecker) {
      return certificateChecker.getViolationDisplayMessage(this);
--- a/core/src/main/java/google/registry/groups/DirectoryGroupsConnection.java
+++ b/core/src/main/java/google/registry/groups/DirectoryGroupsConnection.java
@@ -20,10 +20,10 @@ import static javax.servlet.http.HttpServletResponse.SC_NOT_FOUND;

 import com.google.api.client.googleapis.json.GoogleJsonError;
 import com.google.api.client.googleapis.json.GoogleJsonResponseException;
-import com.google.api.services.admin.directory.Directory;
-import com.google.api.services.admin.directory.model.Group;
-import com.google.api.services.admin.directory.model.Member;
-import com.google.api.services.admin.directory.model.Members;
+import com.google.api.services.directory.Directory;
+import com.google.api.services.directory.model.Group;
+import com.google.api.services.directory.model.Member;
+import com.google.api.services.directory.model.Members;
 import com.google.api.services.groupssettings.Groupssettings;
 import com.google.api.services.groupssettings.model.Groups;
 import com.google.common.annotations.VisibleForTesting;
--- a/core/src/main/java/google/registry/groups/DirectoryModule.java
+++ b/core/src/main/java/google/registry/groups/DirectoryModule.java
@@ -14,7 +14,7 @@

 package google.registry.groups;

-import com.google.api.services.admin.directory.Directory;
+import com.google.api.services.directory.Directory;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.config.CredentialModule.AdcDelegatedCredential;
--- a/core/src/main/java/google/registry/groups/GmailClient.java
+++ b/core/src/main/java/google/registry/groups/GmailClient.java
@@ -79,9 +79,6 @@ public final class GmailClient {

  /**
   * Sends {@code emailMessage} using {@link Gmail}.
-   *
-   * <p>If the sender as specified by {@link EmailMessage#from} differs from the caller's identity,
-   * the caller must have delegated `send` authority to the sender.
   */
  public void sendEmail(EmailMessage emailMessage) {
    if (!isEmailSendingEnabled) {
--- a/core/src/main/java/google/registry/groups/GroupsConnection.java
+++ b/core/src/main/java/google/registry/groups/GroupsConnection.java
@@ -15,7 +15,7 @@
 package google.registry.groups;

 import com.google.api.client.googleapis.json.GoogleJsonResponseException;
-import com.google.api.services.admin.directory.model.Group;
+import com.google.api.services.directory.model.Group;
 import java.io.IOException;
 import java.util.Set;

--- a/core/src/main/java/google/registry/keyring/api/PgpHelper.java
+++ b/core/src/main/java/google/registry/keyring/api/PgpHelper.java
@@ -73,21 +73,17 @@ public final class PgpHelper {
   */
  public static PGPPublicKey lookupPublicKey(
      PGPPublicKeyRingCollection keyring, String query, KeyRequirement want) {
-    try {
-      Iterator<PGPPublicKeyRing> results =
-          keyring.getKeyRings(checkNotNull(query, "query"), true, true);
-      verify(results.hasNext(), "No public key found matching substring: %s", query);
-      while (results.hasNext()) {
-        Optional<PGPPublicKey> result = lookupPublicSubkey(results.next(), want);
-        if (result.isPresent()) {
-          return result.get();
-        }
+    Iterator<PGPPublicKeyRing> results =
+        keyring.getKeyRings(checkNotNull(query, "query"), true, true);
+    verify(results.hasNext(), "No public key found matching substring: %s", query);
+    while (results.hasNext()) {
+      Optional<PGPPublicKey> result = lookupPublicSubkey(results.next(), want);
+      if (result.isPresent()) {
+        return result.get();
      }
-      throw new VerifyException(String.format(
-          "No public key (%s) found matching substring: %s", want, query));
-    } catch (PGPException e) {
-      throw new VerifyException(String.format("Public key lookup failed for query: %s", query), e);
    }
+    throw new VerifyException(
+        String.format("No public key (%s) found matching substring: %s", want, query));
  }

  /**
--- a/core/src/main/java/google/registry/model/EppResource.java
+++ b/core/src/main/java/google/registry/model/EppResource.java
@@ -354,7 +354,7 @@ public abstract class EppResource extends UpdateAutoTimestampEntity implements B
  }

  static final CacheLoader<VKey<? extends EppResource>, EppResource> CACHE_LOADER =
-      new CacheLoader<VKey<? extends EppResource>, EppResource>() {
+      new CacheLoader<>() {

        @Override
        public EppResource load(VKey<? extends EppResource> key) {
@@ -362,8 +362,8 @@ public abstract class EppResource extends UpdateAutoTimestampEntity implements B
        }

        @Override
-        public Map<VKey<? extends EppResource>, EppResource> loadAll(
-            Iterable<? extends VKey<? extends EppResource>> keys) {
+        public Map<? extends VKey<? extends EppResource>, ? extends EppResource> loadAll(
+            Set<? extends VKey<? extends EppResource>> keys) {
          return replicaTm().reTransact(() -> replicaTm().loadByKeys(keys));
        }
      };
--- a/core/src/main/java/google/registry/model/ForeignKeyUtils.java
+++ b/core/src/main/java/google/registry/model/ForeignKeyUtils.java
@@ -29,7 +29,6 @@ import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Maps;
-import com.google.common.collect.Streams;
 import google.registry.config.RegistryConfig;
 import google.registry.model.contact.Contact;
 import google.registry.model.domain.Domain;
@@ -42,6 +41,7 @@ import java.util.Collection;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Optional;
+import java.util.Set;
 import javax.annotation.Nullable;
 import org.joda.time.DateTime;

@@ -83,7 +83,7 @@ public final class ForeignKeyUtils {
   * active at or after the specified moment in time.
   *
   * <p>The returned map will omit any foreign keys for which the {@link EppResource} doesn't exist
-   * or has been soft deleted.
+   * or has been soft-deleted.
   */
  public static <E extends EppResource> ImmutableMap<String, VKey<E>> load(
      Class<E> clazz, Collection<String> foreignKeys, final DateTime now) {
@@ -94,7 +94,7 @@ public final class ForeignKeyUtils {

  /**
   * Helper method to load {@link VKey}s to all the most recent {@link EppResource}s for the given
-   * foreign keys, regardless of whether or not they have been soft-deleted.
+   * foreign keys, regardless of whether they have been soft-deleted.
   *
   * <p>Used by both the cached (w/o deletion check) and the non-cached (with deletion check) calls.
   *
@@ -129,24 +129,25 @@ public final class ForeignKeyUtils {

  private static final CacheLoader<VKey<? extends EppResource>, Optional<MostRecentResource>>
      CACHE_LOADER =
-          new CacheLoader<VKey<? extends EppResource>, Optional<MostRecentResource>>() {
+          new CacheLoader<>() {

            @Override
            public Optional<MostRecentResource> load(VKey<? extends EppResource> key) {
-              return loadAll(ImmutableList.of(key)).get(key);
+              return loadAll(ImmutableSet.of(key)).get(key);
            }

            @Override
-            public Map<VKey<? extends EppResource>, Optional<MostRecentResource>> loadAll(
-                Iterable<? extends VKey<? extends EppResource>> keys) {
-              if (!keys.iterator().hasNext()) {
+            public Map<
+                    ? extends VKey<? extends EppResource>, ? extends Optional<MostRecentResource>>
+                loadAll(Set<? extends VKey<? extends EppResource>> keys) {
+              if (keys.isEmpty()) {
                return ImmutableMap.of();
              }
              // It is safe to use the resource type of first element because when this function is
              // called, it is always passed with a list of VKeys with the same type.
              Class<? extends EppResource> clazz = keys.iterator().next().getKind();
              ImmutableList<String> foreignKeys =
-                  Streams.stream(keys).map(key -> (String) key.getKey()).collect(toImmutableList());
+                  keys.stream().map(key -> (String) key.getKey()).collect(toImmutableList());
              ImmutableMap<String, MostRecentResource> existingKeys =
                  ForeignKeyUtils.load(clazz, foreignKeys, true);
              // The above map only contains keys that exist in the database, so we re-add the
@@ -166,7 +167,7 @@ public final class ForeignKeyUtils {
   *
   * <p>Note that here the key of the {@link LoadingCache} is of type {@code VKey<? extends
   * EppResource>}, but they are not legal {@link VKey}s to {@link EppResource}s, whose keys are the
-   * SQL primary keys, i.e. the {@code repoId}s. Instead, their keys are the foreign keys used to
+   * SQL primary keys, i.e., the {@code repoId}s. Instead, their keys are the foreign keys used to
   * query the database. We use {@link VKey} here because it is a convenient composite class that
   * contains both the resource type and the foreign key, which are needed to for the query and
   * caching.
@@ -199,7 +200,7 @@ public final class ForeignKeyUtils {
   * that are active at or after the specified moment in time, using the cache if enabled.
   *
   * <p>The returned map will omit any keys for which the {@link EppResource} doesn't exist or has
-   * been soft deleted.
+   * been soft-deleted.
   *
   * <p>Don't use the cached version of this method unless you really need it for performance
   * reasons, and are OK with the trade-offs in loss of transactional consistency.
--- a/core/src/main/java/google/registry/model/domain/token/AllocationToken.java
+++ b/core/src/main/java/google/registry/model/domain/token/AllocationToken.java
@@ -322,19 +322,18 @@ public class AllocationToken extends UpdateAutoTimestampEntity implements Builda
      ALLOCATION_TOKENS_CACHE =
          CacheUtils.newCacheBuilder(getSingletonCacheRefreshDuration())
              .build(
-                  new CacheLoader<VKey<AllocationToken>, Optional<AllocationToken>>() {
+                  new CacheLoader<>() {
                    @Override
                    public Optional<AllocationToken> load(VKey<AllocationToken> key) {
                      return tm().reTransact(() -> tm().loadByKeyIfPresent(key));
                    }

                    @Override
-                    public Map<VKey<AllocationToken>, Optional<AllocationToken>> loadAll(
-                        Iterable<? extends VKey<AllocationToken>> keys) {
-                      ImmutableSet<VKey<AllocationToken>> keySet = ImmutableSet.copyOf(keys);
+                    public Map<? extends VKey<AllocationToken>, ? extends Optional<AllocationToken>>
+                        loadAll(Set<? extends VKey<AllocationToken>> keys) {
                      return tm().reTransact(
                              () ->
-                                  keySet.stream()
+                                  keys.stream()
                                      .collect(
                                          toImmutableMap(
                                              key -> key, key -> tm().loadByKeyIfPresent(key))));
--- a/core/src/main/java/google/registry/model/tld/Tld.java
+++ b/core/src/main/java/google/registry/model/tld/Tld.java
@@ -16,8 +16,8 @@ package google.registry.model.tld;

 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
+import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
-import static com.google.common.collect.Maps.toMap;
 import static google.registry.config.RegistryConfig.getSingletonCacheRefreshDuration;
 import static google.registry.model.EntityYamlUtils.createObjectMapper;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
@@ -106,7 +106,7 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
  @Column(name = "tld_name", nullable = false)
  String tldStr;

-  /** The suffix that identifies roids as belonging to this specific tld, e.g. -HOW for .how. */
+  /** The suffix that identifies roids as belonging to this specific tld, e.g., -HOW for .how. */
  String roidSuffix;

  /** Default values for all the relevant TLD parameters. */
@@ -234,7 +234,7 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
  private static final LoadingCache<String, Tld> CACHE =
      CacheUtils.newCacheBuilder(getSingletonCacheRefreshDuration())
          .build(
-              new CacheLoader<String, Tld>() {
+              new CacheLoader<>() {
                @Override
                public Tld load(final String tld) {
                  return tm().reTransact(() -> tm().loadByKeyIfPresent(createVKey(tld)))
@@ -242,9 +242,9 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
                }

                @Override
-                public Map<String, Tld> loadAll(Iterable<? extends String> tlds) {
+                public Map<? extends String, ? extends Tld> loadAll(Set<? extends String> tlds) {
                  ImmutableMap<String, VKey<Tld>> keysMap =
-                      toMap(ImmutableSet.copyOf(tlds), Tld::createVKey);
+                      tlds.stream().collect(toImmutableMap(tld -> tld, Tld::createVKey));
                  Map<VKey<? extends Tld>, Tld> entities =
                      tm().reTransact(() -> tm().loadByKeysIfPresent(keysMap.values()));
                  return Maps.transformEntries(keysMap, (k, v) -> entities.getOrDefault(v, null));
--- a/core/src/main/java/google/registry/model/tld/label/ReservedList.java
+++ b/core/src/main/java/google/registry/model/tld/label/ReservedList.java
@@ -71,10 +71,6 @@ public final class ReservedList
   */
  @Insignificant @Transient Map<String, ReservedListEntry> reservedListMap;

-  // TODO(b/321053918): Remove this field once the column is nullable
-  @Column(nullable = true)
-  boolean shouldPublish = true;
-
  @PreRemove
  void preRemove() {
    tm().query("DELETE FROM ReservedEntry WHERE revision_id = :revisionId")
--- a/core/src/main/java/google/registry/module/RequestComponent.java
+++ b/core/src/main/java/google/registry/module/RequestComponent.java
@@ -29,6 +29,7 @@ import google.registry.batch.SendExpiringCertificateNotificationEmailAction;
 import google.registry.batch.WipeOutContactHistoryPiiAction;
 import google.registry.bsa.BsaDownloadAction;
 import google.registry.bsa.BsaRefreshAction;
+import google.registry.bsa.BsaValidateAction;
 import google.registry.bsa.UploadBsaUnavailableDomainsAction;
 import google.registry.cron.CronModule;
 import google.registry.cron.TldFanoutAction;
@@ -167,6 +168,8 @@ interface RequestComponent {

  BsaRefreshAction bsaRefreshAction();

+  BsaValidateAction bsaValidateAction();
+
  CannedScriptExecutionAction cannedScriptExecutionAction();

  CheckApiAction checkApiAction();
--- a/core/src/main/java/google/registry/module/backend/BackendRequestComponent.java
+++ b/core/src/main/java/google/registry/module/backend/BackendRequestComponent.java
@@ -99,7 +99,7 @@ import google.registry.tmch.TmchSmdrlAction;
      VoidDnsWriterModule.class,
      WhiteboxModule.class,
    })
-interface BackendRequestComponent {
+public interface BackendRequestComponent {

  BrdaCopyAction brdaCopyAction();

--- a/core/src/main/java/google/registry/module/bsa/BsaComponent.java
+++ b/core/src/main/java/google/registry/module/bsa/BsaComponent.java
@@ -19,6 +19,7 @@ import dagger.Component;
 import dagger.Lazy;
 import google.registry.config.CredentialModule;
 import google.registry.config.RegistryConfig.ConfigModule;
+import google.registry.groups.GmailModule;
 import google.registry.keyring.KeyringModule;
 import google.registry.keyring.secretmanager.SecretManagerKeyringModule;
 import google.registry.module.bsa.BsaRequestComponent.BsaRequestComponentModule;
@@ -39,6 +40,7 @@ import javax.inject.Singleton;
      BsaRequestComponentModule.class,
      ConfigModule.class,
      CredentialModule.class,
+      GmailModule.class,
      GsonModule.class,
      PersistenceModule.class,
      KeyringModule.class,
--- a/core/src/main/java/google/registry/module/bsa/BsaRequestComponent.java
+++ b/core/src/main/java/google/registry/module/bsa/BsaRequestComponent.java
@@ -18,6 +18,7 @@ import dagger.Module;
 import dagger.Subcomponent;
 import google.registry.bsa.BsaDownloadAction;
 import google.registry.bsa.BsaRefreshAction;
+import google.registry.bsa.BsaValidateAction;
 import google.registry.bsa.UploadBsaUnavailableDomainsAction;
 import google.registry.request.Modules.UrlConnectionServiceModule;
 import google.registry.request.RequestComponentBuilder;
@@ -26,12 +27,14 @@ import google.registry.request.RequestScope;

@RequestScope
@Subcomponent(modules = {RequestModule.class, UrlConnectionServiceModule.class})
-interface BsaRequestComponent {
+public interface BsaRequestComponent {

  BsaDownloadAction bsaDownloadAction();

  BsaRefreshAction bsaRefreshAction();

+  BsaValidateAction bsaValidateAction();
+
  UploadBsaUnavailableDomainsAction uploadBsaUnavailableDomains();

  @Subcomponent.Builder
--- a/core/src/main/java/google/registry/module/frontend/FrontendRequestComponent.java
+++ b/core/src/main/java/google/registry/module/frontend/FrontendRequestComponent.java
@@ -53,7 +53,7 @@ import google.registry.ui.server.registrar.RegistryLockVerifyAction;
      RequestModule.class,
      WhiteboxModule.class,
    })
-interface FrontendRequestComponent {
+public interface FrontendRequestComponent {
  ConsoleDomainGetAction consoleDomainGetAction();

  ConsoleDomainListAction consoleDomainListAction();
--- a/core/src/main/java/google/registry/module/pubapi/PubApiRequestComponent.java
+++ b/core/src/main/java/google/registry/module/pubapi/PubApiRequestComponent.java
@@ -50,7 +50,7 @@ import google.registry.whois.WhoisModule;
      WhiteboxModule.class,
      WhoisModule.class,
    })
-interface PubApiRequestComponent {
+public interface PubApiRequestComponent {
  CheckApiAction checkApiAction();
  RdapAutnumAction rdapAutnumAction();
  RdapDomainAction rdapDomainAction();
--- a/core/src/main/java/google/registry/module/tools/ToolsRequestComponent.java
+++ b/core/src/main/java/google/registry/module/tools/ToolsRequestComponent.java
@@ -49,7 +49,7 @@ import google.registry.tools.server.VerifyOteAction;
      ToolsServerModule.class,
      WhiteboxModule.class,
    })
-interface ToolsRequestComponent {
+public interface ToolsRequestComponent {
  CreateGroupsAction createGroupsAction();
  EppToolAction eppToolAction();
  FlowComponent.Builder flowComponentBuilder();
--- a/core/src/main/java/google/registry/persistence/PersistenceComponent.java
+++ b/core/src/main/java/google/registry/persistence/PersistenceComponent.java
@@ -18,7 +18,7 @@ import dagger.Component;
 import google.registry.config.CredentialModule;
 import google.registry.config.RegistryConfig.ConfigModule;
 import google.registry.keyring.secretmanager.SecretManagerKeyringModule;
-import google.registry.persistence.PersistenceModule.AppEngineJpaTm;
+import google.registry.persistence.PersistenceModule.DefaultJpaTm;
 import google.registry.persistence.PersistenceModule.ReadOnlyReplicaJpaTm;
 import google.registry.persistence.transaction.JpaTransactionManager;
 import google.registry.privileges.secretmanager.SecretManagerModule;
@@ -39,8 +39,8 @@ import javax.persistence.EntityManagerFactory;
    })
 public interface PersistenceComponent {

-  @AppEngineJpaTm
-  JpaTransactionManager appEngineJpaTransactionManager();
+  @DefaultJpaTm
+  JpaTransactionManager jpaTransactionManager();

  @ReadOnlyReplicaJpaTm
  JpaTransactionManager readOnlyReplicaJpaTransactionManager();
--- a/core/src/main/java/google/registry/persistence/PersistenceModule.java
+++ b/core/src/main/java/google/registry/persistence/PersistenceModule.java
@@ -220,8 +220,8 @@ public abstract class PersistenceModule {

  @Provides
  @Singleton
-  @AppEngineJpaTm
-  static JpaTransactionManager provideAppEngineJpaTm(
+  @DefaultJpaTm
+  static JpaTransactionManager provideDefaultJpaTm(
      SqlCredentialStore credentialStore,
      @PartialCloudSqlConfigs ImmutableMap<String, String> cloudSqlConfigs,
      Clock clock) {
@@ -380,10 +380,10 @@ public abstract class PersistenceModule {
  @Documented
  public @interface SchemaManagerConnection {}

-  /** Dagger qualifier for {@link JpaTransactionManager} used for App Engine application. */
+  /** Dagger qualifier for {@link JpaTransactionManager} used by default. */
  @Qualifier
  @Documented
-  @interface AppEngineJpaTm {}
+  @interface DefaultJpaTm {}

  /** Dagger qualifier for {@link JpaTransactionManager} used inside BEAM pipelines. */
  @Qualifier
--- a/core/src/main/java/google/registry/persistence/transaction/JpaTransactionManager.java
+++ b/core/src/main/java/google/registry/persistence/transaction/JpaTransactionManager.java
@@ -36,12 +36,10 @@ public interface JpaTransactionManager extends TransactionManager {
   *
   * <p>The returned instance is closed when the current transaction completes.
   *
-   * @deprecated Use the static {@link JpaTransactionManagerImpl#em} method for now. In current
-   *     implementation the entity manager is obtained from a static {@code ThreadLocal} object that
-   *     is set up by the outermost {@link #transact} call. As an instance method, this method gives
-   *     the illusion that the call site has control over which database instance to use.
+   * <p>Note that in the current implementation the entity manager is obtained from a static {@code
+   * ThreadLocal} object that is set up by the outermost {@link #transact} call. Nested call sites
+   * have no control over which database instance to use.
   */
-  @Deprecated // See Javadoc above.
  EntityManager getEntityManager();

  /**
--- a/core/src/main/java/google/registry/persistence/transaction/JpaTransactionManagerImpl.java
+++ b/core/src/main/java/google/registry/persistence/transaction/JpaTransactionManagerImpl.java
@@ -91,26 +91,6 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
  private static final ThreadLocal<TransactionInfo> transactionInfo =
      ThreadLocal.withInitial(TransactionInfo::new);

-  /** Returns true if inside a transaction; returns false otherwise. */
-  public static boolean isInTransaction() {
-    return transactionInfo.get().inTransaction;
-  }
-
-  /**
-   * Returns the {@link EntityManager} for the current database transaction.
-   *
-   * <p>This method must be call from inside a transaction.
-   */
-  public static EntityManager em() {
-    EntityManager entityManager = transactionInfo.get().entityManager;
-    if (entityManager == null) {
-      throw new PersistenceException(
-          "No EntityManager has been initialized. getEntityManager() must be invoked in the scope"
-              + " of a transaction");
-    }
-    return entityManager;
-  }
-
  public JpaTransactionManagerImpl(EntityManagerFactory emf, Clock clock, boolean readOnly) {
    this.emf = emf;
    this.clock = clock;
@@ -131,16 +111,10 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
    return emf.createEntityManager();
  }

-  @Deprecated // See Javadoc of interface method.
  @Override
  public EntityManager getEntityManager() {
-    EntityManager entityManager = transactionInfo.get().entityManager;
-    if (entityManager == null) {
-      throw new PersistenceException(
-          "No EntityManager has been initialized. getEntityManager() must be invoked in the scope"
-              + " of a transaction");
-    }
-    return entityManager;
+    assertInTransaction();
+    return transactionInfo.get().entityManager;
  }

  @Override
@@ -158,7 +132,6 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
    return getEntityManager().createQuery(sqlString);
  }

-  @Deprecated // See Javadoc of instance method.
  @Override
  public boolean inTransaction() {
    return transactionInfo.get().inTransaction;
--- a/core/src/main/java/google/registry/persistence/transaction/TransactionManager.java
+++ b/core/src/main/java/google/registry/persistence/transaction/TransactionManager.java
@@ -34,16 +34,10 @@ public interface TransactionManager {
  /**
   * Returns {@code true} if the caller is in a transaction.
   *
-   * <p>Note that this function is kept for backward compatibility. We will review the use case
-   * later when adding the cloud sql implementation.
-   *
-   * @deprecated Use the static {@link JpaTransactionManagerImpl#isInTransaction()} method for now.
-   *     In current implementation the entity manager is obtained from a static {@code ThreadLocal}
-   *     object that is set up by the outermost {@link #transact} call. As an instance method, this
-   *     method gives the illusion that the call site has control over which database instance to
-   *     use.
+   * <p>Note that in the current implementation the entity manager is obtained from a static {@code
+   * ThreadLocal} object that is set up by the outermost {@link #transact} call. Nested call sites
+   * have no control over which database instance to use.
   */
-  @Deprecated // See Javadoc above.
  boolean inTransaction();

  /**
--- a/core/src/main/java/google/registry/persistence/transaction/TransactionManagerFactory.java
+++ b/core/src/main/java/google/registry/persistence/transaction/TransactionManagerFactory.java
@@ -17,9 +17,8 @@ package google.registry.persistence.transaction;
 import static com.google.common.base.Preconditions.checkState;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;

-import com.google.appengine.api.utils.SystemProperty;
-import com.google.appengine.api.utils.SystemProperty.Environment.Value;
 import com.google.common.base.Suppliers;
+import com.google.common.collect.ImmutableSet;
 import google.registry.persistence.DaggerPersistenceComponent;
 import google.registry.tools.RegistryToolEnvironment;
 import google.registry.util.NonFinalForTesting;
@@ -29,6 +28,9 @@ import java.util.function.Supplier;
 /** Factory class to create {@link TransactionManager} instance. */
 public final class TransactionManagerFactory {

+  private static final ImmutableSet<RegistryEnvironment> NON_SERVING_ENVS =
+      ImmutableSet.of(RegistryEnvironment.UNITTEST, RegistryEnvironment.LOCAL);
+
  /** Supplier for jpaTm so that it is initialized only once, upon first usage. */
  @NonFinalForTesting
  private static Supplier<JpaTransactionManager> jpaTm =
@@ -43,34 +45,21 @@ public final class TransactionManagerFactory {
  private static JpaTransactionManager createJpaTransactionManager() {
    // If we are running a nomulus command, jpaTm will be injected in RegistryCli.java
    // by calling setJpaTm().
-    if (isInAppEngine()) {
-      return DaggerPersistenceComponent.create().appEngineJpaTransactionManager();
+    if (!NON_SERVING_ENVS.contains(RegistryEnvironment.get())) {
+      return DaggerPersistenceComponent.create().jpaTransactionManager();
    } else {
      return DummyJpaTransactionManager.create();
    }
  }

  private static JpaTransactionManager createReplicaJpaTransactionManager() {
-    if (isInAppEngine()) {
+    if (RegistryEnvironment.get() != RegistryEnvironment.UNITTEST) {
      return DaggerPersistenceComponent.create().readOnlyReplicaJpaTransactionManager();
    } else {
      return DummyJpaTransactionManager.create();
    }
  }

-  /**
-   * This function uses App Engine API to determine if the current runtime environment is App
-   * Engine.
-   *
-   * @see <a
-   *     href="https://cloud.google.com/appengine/docs/standard/java/javadoc/com/google/appengine/api/utils/SystemProperty">App
-   *     Engine API public doc</a>
-   */
-  private static boolean isInAppEngine() {
-    // SystemProperty.environment.value() returns null if the current runtime is local JVM
-    return SystemProperty.environment.value() == Value.Production;
-  }
-
  /**
   * Returns {@link JpaTransactionManager} instance.
   *
--- a/core/src/main/java/google/registry/reporting/billing/BillingEmailUtils.java
+++ b/core/src/main/java/google/registry/reporting/billing/BillingEmailUtils.java
@@ -37,7 +37,6 @@ public class BillingEmailUtils {
  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
  private final GmailClient gmailClient;
  private final YearMonth yearMonth;
-  private final InternetAddress outgoingEmailAddress;
  private final InternetAddress alertRecipientAddress;
  private final ImmutableList<InternetAddress> invoiceEmailRecipients;
  private final Optional<InternetAddress> replyToEmailAddress;
@@ -51,7 +50,6 @@ public class BillingEmailUtils {
  BillingEmailUtils(
      GmailClient gmailClient,
      YearMonth yearMonth,
-      @Config("gSuiteOutgoingEmailAddress") InternetAddress outgoingEmailAddress,
      @Config("newAlertRecipientEmailAddress") InternetAddress alertRecipientAddress,
      @Config("invoiceEmailRecipients") ImmutableList<InternetAddress> invoiceEmailRecipients,
      @Config("invoiceReplyToEmailAddress") Optional<InternetAddress> replyToEmailAddress,
@@ -62,7 +60,6 @@ public class BillingEmailUtils {
      GcsUtils gcsUtils) {
    this.gmailClient = gmailClient;
    this.yearMonth = yearMonth;
-    this.outgoingEmailAddress = outgoingEmailAddress;
    this.alertRecipientAddress = alertRecipientAddress;
    this.invoiceEmailRecipients = invoiceEmailRecipients;
    this.replyToEmailAddress = replyToEmailAddress;
@@ -94,7 +91,6 @@ public class BillingEmailUtils {
                      "<p>Use the following link to download %s invoice for the domain registry -"
                          + " <a href=\"%s\">invoice</a>.</p>",
                      yearMonth, fileUrl))
-              .setFrom(outgoingEmailAddress)
              .setRecipients(invoiceEmailRecipients)
              .setReplyToEmailAddress(replyToEmailAddress)
              .setContentType(MediaType.HTML_UTF_8)
@@ -115,7 +111,6 @@ public class BillingEmailUtils {
              .setSubject(String.format("Billing Pipeline Alert: %s", yearMonth))
              .setBody(body)
              .addRecipient(alertRecipientAddress)
-              .setFrom(outgoingEmailAddress)
              .build());
    } catch (Throwable e) {
      throw new RuntimeException("The alert e-mail system failed.", e);
--- a/core/src/main/java/google/registry/reporting/icann/IcannReportingStagingAction.java
+++ b/core/src/main/java/google/registry/reporting/icann/IcannReportingStagingAction.java
@@ -82,7 +82,6 @@ public final class IcannReportingStagingAction implements Runnable {
  @Inject IcannReportingStager stager;
  @Inject Retrier retrier;
  @Inject Response response;
-  @Inject @Config("gSuiteOutgoingEmailAddress") InternetAddress sender;

  @Inject
  @Config("newAlertRecipientEmailAddress")
@@ -115,7 +114,6 @@ public final class IcannReportingStagingAction implements Runnable {
                            "Completed staging the following %d ICANN reports:\n%s",
                            manifestedFiles.size(), Joiner.on('\n').join(manifestedFiles)))
                    .addRecipient(recipient)
-                    .setFrom(sender)
                    .build());

            response.setStatus(SC_OK);
@@ -139,8 +137,7 @@ public final class IcannReportingStagingAction implements Runnable {
              "ICANN Monthly report staging summary [FAILURE]",
              String.format(
                  "Staging failed due to %s, check logs for more details.", getRootCause(e)),
-              recipient,
-              sender));
+              recipient));
      response.setStatus(SC_INTERNAL_SERVER_ERROR);
      response.setContentType(MediaType.PLAIN_TEXT_UTF_8);
      response.setPayload(
--- a/core/src/main/java/google/registry/reporting/icann/IcannReportingUploadAction.java
+++ b/core/src/main/java/google/registry/reporting/icann/IcannReportingUploadAction.java
@@ -63,7 +63,7 @@ import org.joda.time.Duration;
 * <p>Parameters:
 *
 * <p>subdir: the subdirectory of gs://[project-id]-reporting/ to retrieve reports from. For
- * example: "manual/dir" means reports will be stored under gs://[project-id]-reporting/manual/dir.
+ * example, "manual/dir" means reports will be stored under gs://[project-id]-reporting/manual/dir.
 * Defaults to "icann/monthly/[last month in yyyy-MM format]".
 */
@Action(
@@ -86,7 +86,6 @@ public final class IcannReportingUploadAction implements Runnable {
  @Inject IcannHttpReporter icannReporter;
  @Inject Retrier retrier;
  @Inject Response response;
-  @Inject @Config("gSuiteOutgoingEmailAddress") InternetAddress sender;

  @Inject
  @Config("newAlertRecipientEmailAddress")
@@ -99,6 +98,17 @@ public final class IcannReportingUploadAction implements Runnable {
  @Inject
  IcannReportingUploadAction() {}

+  /**
+   * Get the scheduled time for the next month of the given {@link DateTime}.
+   *
+   * <p>The scheduled time is always the second day of next month at 10AM UTC. This is because the
+   * staging action is scheduled to run at 9AM UTC on that day, and there is no reason to run the
+   * upload job before that. See {@code icannReportingStaging} in {@code cloud-scheduler.xml}.
+   */
+  private static DateTime getScheduledTimeForCurrentMonth(DateTime time) {
+    return time.withDayOfMonth(2).withHourOfDay(10).withMinuteOfHour(0).plusMonths(1);
+  }
+
  @Override
  public void run() {
    if (!lockHandler.executeWithLocks(
@@ -171,12 +181,10 @@ public final class IcannReportingUploadAction implements Runnable {
    if (success) {
      Cursor newCursor =
          Cursor.createScoped(
-              cursorType,
-              cursorTime.withTimeAtStartOfDay().withDayOfMonth(1).plusMonths(1),
-              Tld.get(tldStr));
-      // In order to keep the transactions short-lived, we load all of the cursors in a single
+              cursorType, getScheduledTimeForCurrentMonth(cursorTime), Tld.get(tldStr));
+      // In order to keep the transactions short-lived, we load all the cursors in a single
      // transaction then later use per-cursor transactions when checking + saving the cursors. We
-      // run behind a lock so the cursors shouldn't be changed, but double check to be sure.
+      // run behind a lock, so the cursors shouldn't be changed, but double check to be sure.
      success =
          tm().transact(
                  () -> {
@@ -236,7 +244,7 @@ public final class IcannReportingUploadAction implements Runnable {

  /**
   * Return a map with the Cursor and scope for each key in the keyMap. If the key from the keyMap
-   * does not have an existing cursor, create a new cursor with a default cursorTime of the first of
+   * does not have an existing cursor, create a new cursor with a default cursorTime at the first of
   * next month.
   */
  private ImmutableMap<Cursor, String> defaultNullCursorsToNextMonthAndAddToMap(
@@ -246,15 +254,13 @@ public final class IcannReportingUploadAction implements Runnable {
    ImmutableMap.Builder<Cursor, String> cursors = new ImmutableMap.Builder<>();
    keyMap.forEach(
        (key, registry) -> {
-          // Cursor time is defaulted to the first of next month since a new tld will not yet have a
-          // report staged for upload.
+          // Cursor time is defaulted to 10AM on the second day of next month since a new tld will
+          // not yet have a report staged for upload.
          Cursor cursor =
              cursorMap.getOrDefault(
                  key,
                  Cursor.createScoped(
-                      type,
-                      clock.nowUtc().withDayOfMonth(1).withTimeAtStartOfDay().plusMonths(1),
-                      registry));
+                      type, getScheduledTimeForCurrentMonth(clock.nowUtc()), registry));
          if (!cursorMap.containsValue(cursor)) {
            tm().put(cursor);
          }
@@ -279,7 +285,7 @@ public final class IcannReportingUploadAction implements Runnable {
  }

  private void emailUploadResults(ImmutableMap<String, Boolean> reportSummary) {
-    if (reportSummary.size() == 0) {
+    if (reportSummary.isEmpty()) {
      logger.atInfo().log("No uploads were attempted today; skipping notification email.");
      return;
    }
@@ -297,7 +303,7 @@ public final class IcannReportingUploadAction implements Runnable {
                    (e) ->
                        String.format("%s - %s", e.getKey(), e.getValue() ? "SUCCESS" : "FAILURE"))
                .collect(Collectors.joining("\n")));
-    gmailClient.sendEmail(EmailMessage.create(subject, body, recipient, sender));
+    gmailClient.sendEmail(EmailMessage.create(subject, body, recipient));
  }

  private byte[] readBytesFromGcs(BlobId reportFilename) throws IOException {
--- a/core/src/main/java/google/registry/reporting/spec11/Spec11EmailUtils.java
+++ b/core/src/main/java/google/registry/reporting/spec11/Spec11EmailUtils.java
@@ -173,7 +173,6 @@ public class Spec11EmailUtils {
            .setSubject(subject)
            .setBody(getEmailBody(date, soyTemplateInfo, registrarThreatMatches))
            .setContentType(MediaType.HTML_UTF_8)
-            .setFrom(outgoingEmailAddress)
            .addRecipient(getEmailAddressForRegistrar(registrarThreatMatches.clientId()))
            .setBccs(spec11BccEmailAddresses)
            .build());
@@ -216,7 +215,6 @@ public class Spec11EmailUtils {
    try {
      gmailClient.sendEmail(
          EmailMessage.newBuilder()
-              .setFrom(outgoingEmailAddress)
              .addRecipient(alertRecipientAddress)
              .setBody(body)
              .setSubject(subject)
--- a/core/src/main/java/google/registry/tmch/TmchCertificateAuthority.java
+++ b/core/src/main/java/google/registry/tmch/TmchCertificateAuthority.java
@@ -127,7 +127,7 @@ public final class TmchCertificateAuthority {
   */
  public void verify(X509Certificate cert) throws GeneralSecurityException {
    synchronized (TmchCertificateAuthority.class) {
-      X509Utils.verifyCertificate(getAndValidateRoot(), getCrl(), cert, clock.nowUtc().toDate());
+      X509Utils.verifyCertificate(getAndValidateRoot(), getCrl(), cert, clock.nowUtc());
    }
  }

@@ -151,7 +151,7 @@ public final class TmchCertificateAuthority {
    } catch (Exception e) {
      logger.atWarning().withCause(e).log("Old CRL is invalid, ignored during CRL update.");
    }
-    X509Utils.verifyCrl(getAndValidateRoot(), oldCrl, newCrl, clock.nowUtc().toDate());
+    X509Utils.verifyCrl(getAndValidateRoot(), oldCrl, newCrl, clock.nowUtc());
    TmchCrl.set(asciiCrl, url);
  }

--- a/core/src/main/java/google/registry/tools/CreateOrUpdateBulkPricingPackageCommand.java
+++ b/core/src/main/java/google/registry/tools/CreateOrUpdateBulkPricingPackageCommand.java
@@ -22,7 +22,7 @@ import google.registry.model.domain.token.AllocationToken;
 import google.registry.model.domain.token.AllocationToken.TokenType;
 import google.registry.model.domain.token.BulkPricingPackage;
 import google.registry.persistence.VKey;
-import java.util.Date;
+import google.registry.tools.params.DateTimeParameter;
 import java.util.List;
 import java.util.Optional;
 import javax.annotation.Nullable;
@@ -56,9 +56,11 @@ abstract class CreateOrUpdateBulkPricingPackageCommand extends MutatingCommand {
  @Nullable
  @Parameter(
      names = "--next_billing_date",
+      converter = DateTimeParameter.class,
+      validateWith = DateTimeParameter.class,
      description =
          "The next date that the bulk pricing package should be billed for its annual fee")
-  Date nextBillingDate;
+  DateTime nextBillingDate;

  /** Returns the existing BulkPricingPackage or null if it does not exist. */
  @Nullable
@@ -105,9 +107,7 @@ abstract class CreateOrUpdateBulkPricingPackageCommand extends MutatingCommand {
                Optional.ofNullable(maxCreates).ifPresent(builder::setMaxCreates);
                Optional.ofNullable(price).ifPresent(builder::setBulkPrice);
                Optional.ofNullable(nextBillingDate)
-                    .ifPresent(
-                        nextBillingDate ->
-                            builder.setNextBillingDate(new DateTime(nextBillingDate)));
+                    .ifPresent(nextBillingDate -> builder.setNextBillingDate(nextBillingDate));
                if (clearLastNotificationSent()) {
                  builder.setLastNotificationSent(null);
                }
--- a/core/src/main/java/google/registry/tools/RegistryCli.java
+++ b/core/src/main/java/google/registry/tools/RegistryCli.java
@@ -30,6 +30,7 @@ import google.registry.persistence.transaction.JpaTransactionManager;
 import google.registry.persistence.transaction.TransactionManagerFactory;
 import google.registry.tools.AuthModule.LoginRequiredException;
 import google.registry.tools.params.ParameterFactory;
+import google.registry.util.RegistryEnvironment;
 import java.security.Security;
 import java.util.Map;
 import java.util.Optional;
@@ -218,12 +219,19 @@ final class RegistryCli implements CommandRunner {

    // Reset the JPA transaction manager after every command to avoid a situation where a test can
    // interfere with other tests
-    JpaTransactionManager cachedJpaTm = tm();
+    final JpaTransactionManager cachedJpaTm;
+    if (RegistryEnvironment.get() == RegistryEnvironment.UNITTEST) {
+      cachedJpaTm = tm();
+    } else {
+      cachedJpaTm = null;
+    }
    TransactionManagerFactory.setJpaTm(() -> component.nomulusToolJpaTransactionManager().get());
    TransactionManagerFactory.setReplicaJpaTm(
        () -> component.nomulusToolReplicaJpaTransactionManager().get());
    command.run();
-    TransactionManagerFactory.setJpaTm(() -> cachedJpaTm);
+    if (RegistryEnvironment.get() == RegistryEnvironment.UNITTEST) {
+      TransactionManagerFactory.setJpaTm(() -> cachedJpaTm);
+    }
  }

  void setEnvironment(RegistryToolEnvironment environment) {
--- a/core/src/main/java/google/registry/ui/server/SendEmailUtils.java
+++ b/core/src/main/java/google/registry/ui/server/SendEmailUtils.java
@@ -35,21 +35,14 @@ import javax.mail.internet.InternetAddress;
 public class SendEmailUtils {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
-
-  private final InternetAddress gSuiteOutgoingEmailAddress;
-  private final String gSuiteOutgoingEmailDisplayName;
  private final GmailClient gmailClient;
  private final ImmutableList<String> registrarChangesNotificationEmailAddresses;

  @Inject
  public SendEmailUtils(
-      @Config("gSuiteOutgoingEmailAddress") InternetAddress gSuiteOutgoingEmailAddress,
-      @Config("gSuiteOutgoingEmailDisplayName") String gSuiteOutgoingEmailDisplayName,
      @Config("registrarChangesNotificationEmailAddresses")
          ImmutableList<String> registrarChangesNotificationEmailAddresses,
      GmailClient gmailClient) {
-    this.gSuiteOutgoingEmailAddress = gSuiteOutgoingEmailAddress;
-    this.gSuiteOutgoingEmailDisplayName = gSuiteOutgoingEmailDisplayName;
    this.gmailClient = gmailClient;
    this.registrarChangesNotificationEmailAddresses = registrarChangesNotificationEmailAddresses;
  }
@@ -71,9 +64,6 @@ public class SendEmailUtils {
      Optional<String> bcc,
      ImmutableList<String> additionalAddresses) {
    try {
-      InternetAddress from =
-          new InternetAddress(
-              gSuiteOutgoingEmailAddress.getAddress(), gSuiteOutgoingEmailDisplayName);
      ImmutableList<InternetAddress> recipients =
          Stream.concat(
                  registrarChangesNotificationEmailAddresses.stream(), additionalAddresses.stream())
@@ -95,11 +85,7 @@ public class SendEmailUtils {
        return false;
      }
      EmailMessage.Builder emailMessage =
-          EmailMessage.newBuilder()
-              .setBody(body)
-              .setSubject(subject)
-              .setRecipients(recipients)
-              .setFrom(from);
+          EmailMessage.newBuilder().setBody(body).setSubject(subject).setRecipients(recipients);
      if (bcc.isPresent()) {
        try {
          InternetAddress bccInternetAddress = new InternetAddress(bcc.get(), true);
--- a/core/src/main/java/google/registry/ui/server/registrar/RegistryLockPostAction.java
+++ b/core/src/main/java/google/registry/ui/server/registrar/RegistryLockPostAction.java
@@ -29,7 +29,6 @@ import com.google.common.base.Throwables;
 import com.google.common.collect.ImmutableList;
 import com.google.common.flogger.FluentLogger;
 import com.google.gson.Gson;
-import google.registry.config.RegistryConfig.Config;
 import google.registry.flows.domain.DomainFlowUtils;
 import google.registry.groups.GmailClient;
 import google.registry.model.domain.RegistryLock;
@@ -85,7 +84,6 @@ public class RegistryLockPostAction implements Runnable, JsonActionRunner.JsonAc
  private final AuthenticatedRegistrarAccessor registrarAccessor;
  private final GmailClient gmailClient;
  private final DomainLockUtils domainLockUtils;
-  private final InternetAddress gSuiteOutgoingEmailAddress;

  @Inject
  RegistryLockPostAction(
@@ -94,15 +92,13 @@ public class RegistryLockPostAction implements Runnable, JsonActionRunner.JsonAc
      AuthResult authResult,
      AuthenticatedRegistrarAccessor registrarAccessor,
      GmailClient gmailClient,
-      DomainLockUtils domainLockUtils,
-      @Config("gSuiteOutgoingEmailAddress") InternetAddress gSuiteOutgoingEmailAddress) {
+      DomainLockUtils domainLockUtils) {
    this.req = req;
    this.jsonActionRunner = jsonActionRunner;
    this.authResult = authResult;
    this.registrarAccessor = registrarAccessor;
    this.gmailClient = gmailClient;
    this.domainLockUtils = domainLockUtils;
-    this.gSuiteOutgoingEmailAddress = gSuiteOutgoingEmailAddress;
  }

  @Override
@@ -174,7 +170,6 @@ public class RegistryLockPostAction implements Runnable, JsonActionRunner.JsonAc
              .setBody(body)
              .setSubject(String.format("Registry %s verification", action))
              .setRecipients(recipients)
-              .setFrom(gSuiteOutgoingEmailAddress)
              .build());
    } catch (AddressException | URISyntaxException e) {
      throw new RuntimeException(e); // caught above -- this is so we can run in a transaction
--- a/core/src/nonprod/java/google/registry/tools/GenerateSqlErDiagramCommand.java
+++ b/core/src/nonprod/java/google/registry/tools/GenerateSqlErDiagramCommand.java
@@ -50,7 +50,7 @@ import schemacrawler.tools.options.OutputOptions;
 import schemacrawler.tools.options.OutputOptionsBuilder;

 /** Command to generate ER diagrams for SQL schema. */
-@Parameters(separators = " =", commandDescription = "Generate ER diagrams for SQL schmea.")
+@Parameters(separators = " =", commandDescription = "Generate ER diagrams for SQL schema.")
 public class GenerateSqlErDiagramCommand implements Command {

  private static final String DB_NAME = "postgres";
@@ -101,14 +101,14 @@ public class GenerateSqlErDiagramCommand implements Command {
      checkState(outDir.toFile().mkdirs(), "Failed to create directory %s", outDir);
    }

-    PostgreSQLContainer postgresContainer =
-        new PostgreSQLContainer(NomulusPostgreSql.getDockerTag())
-            .withDatabaseName(DB_NAME)
-            .withUsername(DB_USER)
-            .withPassword(DB_PASSWORD);
-    postgresContainer.start();
-
-    try (Connection conn = getConnection(postgresContainer)) {
+    try (PostgreSQLContainer<?> postgresContainer =
+        new PostgreSQLContainer<>(NomulusPostgreSql.getDockerTag())) {
+      postgresContainer
+          .withDatabaseName(DB_NAME)
+          .withUsername(DB_USER)
+          .withPassword(DB_PASSWORD)
+          .start();
+      Connection conn = getConnection(postgresContainer);
      initDb(conn);
      if (diagramType == ALL || diagramType == FULL) {
        improveDiagramHtml(generateErDiagram(conn, FULL_DIAGRAM_COMMAND, FULL_DIAGRAM_FILE_NAME));
@@ -116,8 +116,6 @@ public class GenerateSqlErDiagramCommand implements Command {
      if (diagramType == ALL || diagramType == BRIEF) {
        improveDiagramHtml(generateErDiagram(conn, BRIEF_DIAGRAM_COMMAND, BRIEF_DIAGRAM_FILE_NAME));
      }
-    } finally {
-      postgresContainer.stop();
    }
  }

@@ -125,7 +123,7 @@ public class GenerateSqlErDiagramCommand implements Command {
    try {
      Document doc = Jsoup.parse(diagram.toFile(), StandardCharsets.UTF_8.name());

-      // Add the last name of the flyway file to the HTML so we can have a test to verify that if
+      // Add the last name of the flyway file to the HTML, so we can have a test to verify that if
      // the generated diagram is up to date.
      doc.select("body > table > tbody")
          .first()
@@ -140,11 +138,9 @@ public class GenerateSqlErDiagramCommand implements Command {
                  + "</tr>");

      // Add pan and zoom support for the embedded SVG in the HTML.
-      StringBuilder svgPanZoomLib =
-          new StringBuilder("<script>")
-              .append(ResourceUtils.readResourceUtf8(SVG_PAN_ZOOM_LIB))
-              .append("</script>");
-      doc.select("head").first().append(svgPanZoomLib.toString());
+      String svgPanZoomLib =
+          "<script>" + ResourceUtils.readResourceUtf8(SVG_PAN_ZOOM_LIB) + "</script>";
+      doc.select("head").first().append(svgPanZoomLib);
      doc.select("svg")
          .first()
          .attributes()
@@ -163,8 +159,7 @@ public class GenerateSqlErDiagramCommand implements Command {
                  + "});"
                  + "</script>");

-      Files.write(
-          diagram, doc.outerHtml().getBytes(StandardCharsets.UTF_8), StandardOpenOption.WRITE);
+      Files.writeString(diagram, doc.outerHtml(), StandardOpenOption.WRITE);
    } catch (IOException e) {
      throw new UncheckedIOException(e);
    }
@@ -194,7 +189,7 @@ public class GenerateSqlErDiagramCommand implements Command {
    return outputFile;
  }

-  private static Connection getConnection(PostgreSQLContainer container) {
+  private static Connection getConnection(PostgreSQLContainer<?> container) {
    Properties info = new Properties();
    info.put("user", container.getUsername());
    info.put("password", container.getPassword());
--- a/core/src/test/java/google/registry/batch/CheckBulkComplianceActionTest.java
+++ b/core/src/test/java/google/registry/batch/CheckBulkComplianceActionTest.java
@@ -44,7 +44,6 @@ import google.registry.ui.server.SendEmailUtils;
 import google.registry.util.EmailMessage;
 import java.util.logging.Level;
 import java.util.logging.Logger;
-import javax.mail.internet.InternetAddress;
 import org.joda.money.CurrencyUnit;
 import org.joda.money.Money;
 import org.joda.time.DateTime;
@@ -89,8 +88,6 @@ public class CheckBulkComplianceActionTest {
    loggerToIntercept.addHandler(logHandler);
    sendEmailUtils =
        new SendEmailUtils(
-            new InternetAddress("outgoing@registry.example"),
-            "UnitTest Registry",
            ImmutableList.of("notification@test.example", "notification2@test.example"),
            gmailClient);
    createTld("tld");
--- a/core/src/test/java/google/registry/batch/DeleteProberDataActionTest.java
+++ b/core/src/test/java/google/registry/batch/DeleteProberDataActionTest.java
@@ -16,7 +16,6 @@ package google.registry.batch;

 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth.assertWithMessage;
-import static com.google.common.truth.Truth8.assertThat;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
 import static google.registry.testing.DatabaseHelper.assertDomainDnsRequests;
 import static google.registry.testing.DatabaseHelper.createTld;
--- a/core/src/test/java/google/registry/batch/RelockDomainActionTest.java
+++ b/core/src/test/java/google/registry/batch/RelockDomainActionTest.java
@@ -258,7 +258,6 @@ public class RelockDomainActionTest {
                    + "contact support at support@example.com if you have any questions.")
            .setRecipients(
                ImmutableSet.of(new InternetAddress("Marla.Singer.RegistryLock@crr.com")))
-            .setFrom(new InternetAddress("outgoing@example.com"))
            .build();
    verify(gmailClient).sendEmail(expectedEmail);
  }
@@ -292,7 +291,6 @@ public class RelockDomainActionTest {
            .setSubject("Error re-locking domain example.tld")
            .setBody(body)
            .setRecipients(recipients)
-            .setFrom(new InternetAddress("outgoing@example.com"))
            .build();
    verify(gmailClient).sendEmail(expectedEmail);
  }
@@ -321,12 +319,10 @@ public class RelockDomainActionTest {
  private RelockDomainAction createAction(Long oldUnlockRevisionId, int previousAttempts)
      throws Exception {
    InternetAddress alertRecipientAddress = new InternetAddress("alerts@example.com");
-    InternetAddress gSuiteOutgoingAddress = new InternetAddress("outgoing@example.com");
    return new RelockDomainAction(
        oldUnlockRevisionId,
        previousAttempts,
        alertRecipientAddress,
-        gSuiteOutgoingAddress,
        "support@example.com",
        gmailClient,
        domainLockUtils,
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
dependabot[bot]	3a7c53d895	Bump follow-redirects from 1.15.4 to 1.15.6 in /docs/console-endpoints (#2375 ) Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.4 to 1.15.6. - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.15.4...v1.15.6) --- updated-dependencies: - dependency-name: follow-redirects dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-03-15 19:06:26 -04:00
Weimin Yu	f5b279a288	Add IDN check to BSA validate (#2370 ) Labels that are not in any supported IDN are not added to the database. Remove such labels from those loaded from the block list files before comparing with DB.	2024-03-15 19:06:12 -04:00
Lai Jiang	c68583f666	Remove java.util.Date (#2373 ) There is one remaining instance in JpaTransactionManagerImpl that cannot be removed because DetachingTypedQuery is implementing TypedQuery, which has a method that expectred java.util.Date.	2024-03-15 19:06:00 -04:00
Pavlo Tkach	6d2eb2e140	Update build.gradle (#2377 ) Console tests fail for the files that are affected by redesign. There's no point in fixing it here. I will reenable the task after the console redesign PR is merged	2024-03-15 17:23:02 +00:00
dependabot[bot]	00a2022292	Bump follow-redirects from 1.15.5 to 1.15.6 in /console-webapp (#2376 ) Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.5 to 1.15.6. - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.15.5...v1.15.6) --- updated-dependencies: - dependency-name: follow-redirects dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-03-15 14:21:46 +00:00
Lai Jiang	de372c4d47	Replace javax.inject with jakarta.inject (#2372 ) Note that Dagger currently doesn't work with the Jakarta namespace and we have to cap the jakarta inject package version below 2.0 so that it sill provides classes in the old namespace.	2024-03-15 03:26:53 +00:00
sarahcaseybot	5f9c7de516	Drop should publish field from ReservedList entity (#2369 ) * Remove the shouldPublish field from the reservedLIst entity * Add generated schema file	2024-03-14 22:04:18 +00:00
Lai Jiang	6e57d93507	Upgrade a few more dependencies (#2371 ) * jaxb and gmail * admin-directory * Upgrade a few more dependencies	2024-03-14 17:37:54 +00:00
Lai Jiang	b9cfa65546	Refactor some code related to the transaction manager (#2366 ) Removed the deprecation mark as it is natural to expose methods related to a transaction like getting the entity manager or checking if one is in a transaction through the transaction manager interface.	2024-03-14 14:37:44 +00:00
Weimin Yu	9af006836c	Add email notification of BSA job status (#2368 )	2024-03-13 19:14:02 +00:00
Lai Jiang	cd95be4776	Upgrade a few pinned dependencies (#2359 )	2024-03-13 11:52:34 +00:00
Lai Jiang	bdc9a1fd1d	Fix nomulus tool when the environment is localhost (#2365 ) Also only caches/resets the original TM when in unit tests (TBT I'm not so sure that even this is necessary as we don't seem to call the tool from tests that often. There is only ShellCommandTest that calls the run() function in RegistryCli and we could just put these tests in fragileTest and make them run sequentially and fork every time to get around issue with inference). The issue with caching is that it tries to first create the to-be-cached TM, and when the environment given is prod/sandbox/... It will try to retrieve SQL credentials from prod/sandbox/... secret manager. This works fine locally as we all have access to prod/sandbox/..., but fails in Cloud Build jobs such as sync-db-objects where it provides it own credential that has direct SQL access, but not access to prod/sandbox/... secret manager. TESTED=ran `./gradlew devTool --args="-e localhost generate_sql_er_diagram -o ../db/src/main/resources/sql/er_diagram"`	2024-03-13 04:49:07 +00:00
Lai Jiang	d0b036227a	Add a GitHub action to block merging based on the labels (#2367 )	2024-03-13 02:47:37 +00:00
gbrodman	0f02858965	Rename console update mod time to history_modification_time (#2363 )	2024-03-12 20:38:15 +00:00
Lai Jiang	6acb14c60d	Add a test to ensure all actions are routable by the RegistryServlet (#2361 )	2024-03-12 17:18:44 +00:00
Lai Jiang	e881f254f8	Add a GitHub Action (#2360 ) * Add a GitHub Action workflow This allows us to create Gradle depedency graphs for Dependabot analysis (as the ones we already get for Javascript dependencies). * Update Java version * Add build scan * codeql 3 * run with gradle * exclude jIFC * build scan * Finalize	2024-03-11 18:55:13 +00:00
Lai Jiang	1fb27fcf8e	Make nomulus work locally (#2349 ) Chose the default transaction manager based on RegistryEnvironment. This makes it possible to run nomulus on Jetty locally. Tested with the following: ```bash ./gradle :jetty:run -Penvironment=alpha curl http://localhost:8080/beta.app ``` The docker image is also updated to take an argument that specifies the environment. It runs locally as well but the container doesn't get access to locally stored credentials, so it fails to initialize the transaction manager.	2024-03-11 16:05:44 +00:00
Weimin Yu	34a8a94083	Add BSA validation job (#2356 ) * Add BSA validation job Add the BsaValidateAction class with a first check (for inconsistency between downloaded and persisted labels). * Addressing comments * Addressing reviews	2024-03-08 22:08:09 +00:00
Lai Jiang	779dc36858	Remove some dead gradle code (#2358 ) runtime is not actually a predefined confiugration and it doesn't affect the runtime classpath in anyway. See: https://docs.gradle.org/current/userguide/java_plugin.html#tab:configurations	2024-03-08 15:12:11 +00:00
Lai Jiang	40174b825a	Change ICANN upload cursor time (#2346 ) The staging job runs at 9AM on the 2nd day of each month, we should set the cursor to be after that time, otherwise we attempt to upload reports on the 1st day of each month before they are ready, causing an error email to be sent to us.	2024-03-07 15:52:14 +00:00
Weimin Yu	df4e345961	Remove appengine-based email client (#2354 ) Remove email classes that depend on AppEngine API. They have been replaced by the gmail-based client. Remove `EmailMessage.from` method, which is no longer used. There is a fixed sender address for the entire domain, and is set by the gmail client. The configs remain to be cleaned up. There is a bug (b/279671974) that tracks it.	2024-03-07 03:26:12 +00:00
Lai Jiang	1cac9c9684	Make Kythe work with JDK 21 (#2355 )	2024-03-06 20:23:53 +00:00
Lai Jiang	11883812b3	Update runtime to Java 21 (#2353 ) This PR makes the runtime of most of our workload Java 21. 1. App Engine. Java 21 is in GA and it supports Java EE 8. I had to add an environmental variable so that we don't get an AppEngineCredentails by default (we have been using ComputeEngineCredentials for a couple of years). The uprade to Java 21 runtime changed a system property that controls how jetty logging works, which also control if AppEngineCredential is return. Tested by deploying to alpha. 2. Proxy base image upgradedd to Java 21 (distroless still doesn't support Java 21 and it looks like Temurin is the way to go b/306728455). Tested by deploying to alpha. 3. Nomulus tool image upgrade to Temurin 21 as well. Tested locally. 4. Beam pipeline base image upgrade to Java 21. The JAVA21 flag is not supported by gcloud yet, but specifying the image URL directly works (and is supported). Tested by running in alpha. 5. Jetty base image upgraded to Java 21. Tested locally.	2024-03-06 15:10:11 +00:00
Lai Jiang	742481932e	Upgrade builder base image (#2352 ) This allows us to install Java 21 in the image.	2024-03-05 23:17:13 +00:00
Lai Jiang	37e4607c91	Temporarily revert builder to Java 17 (#2351 ) Debian 11 repo does not have Java 21. Revert to Java 17 for now so we can build the builder image, which is needed for release.	2024-03-05 21:30:23 +00:00
Lai Jiang	c896c022a6	Remove caps/pins on some dependencies (#2348 ) Also re-organized the dependencies.gradle file. Not all caps/pins are removed at this point, but I think this is enough change for one PR.	2024-03-05 17:00:40 +00:00
Lai Jiang	805a34be96	Fix gax and gax-grpc dependency mismatch (#2347 ) Also address a deprecation warning. TESTED=build the nomulus tool locally and it run the `list_cursors` command correctly. It used to fail.	2024-03-04 23:39:42 +00:00
Lai Jiang	dcf0412f11	Compile Nomulus with Java 21 (#2344 ) Make the necessary changes for the code base to compile with JDK 21. Other changes: 1. Upgraded testcontainer version and the SQL image version (to be the same as what we use in Cloud SQL). This led to some schema changes and also changed the order of results in some test queries (for the better I think, as the new order appears to be alphabetical). 2. Remove dependency on Truth8, which is deprecated. 3. Enable parallel Gradle task execution and greatly increased the number of parallel tests in standardTest. Removed outcastTest.	2024-03-04 19:31:08 +00:00