Add email notification of BSA job status (#2368)

Also only caches/resets the original TM when in unit tests (TBT I'm not so sure
that even this is necessary as we don't seem to call the tool from tests
that often. There is only ShellCommandTest that calls the run() function
in RegistryCli and we could just put these tests in fragileTest and make
them run sequentially and fork every time to get around issue with
inference).

The issue with caching is that it tries to first create the to-be-cached
TM, and when the environment given is prod/sandbox/... It will try to
retrieve SQL credentials from prod/sandbox/... secret manager. This
works fine locally as we all have access to prod/sandbox/..., but fails
in Cloud Build jobs such as sync-db-objects where it provides it own
credential that has direct SQL access, but not access to
prod/sandbox/... secret manager.

TESTED=ran `./gradlew devTool --args="-e localhost generate_sql_er_diagram -o ../db/src/main/resources/sql/er_diagram"`

.github/workflows/codeql.yml

@@ -7,7 +7,7 @@ on:
     # The branches below must be a subset of the branches above
     branches: [ 'master' ]
   schedule:
-    - cron: '24 4 * * 2'
+    - cron: '24 4 * * *'
 
 jobs:
   analyze:
@@ -27,17 +27,17 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Set Java version
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
       with:
         distribution: 'temurin'
-        java-version: '17'
+        java-version: '21'
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -47,11 +47,20 @@ jobs:
         # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
         queries: security-and-quality
 
+    # Build with Gradle
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v3
+      with:
+        build-scan-publish: true
+        build-scan-terms-of-service-url: "https://gradle.com/terms-of-service"
+        build-scan-terms-of-service-agree: "yes"
+    - name: Execute Gradle build
+      run: ./gradlew build -x test -x jIFC
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+    #- name: Autobuild
+    #  uses: github/codeql-action/autobuild@v3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -64,6 +73,6 @@ jobs:
     #   ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/dependency-submission.yml

@@ -0,0 +1,25 @@
+name: Dependency Submission
+
+on:
+  push:
+    branches: [ 'master' ]
+  schedule:
+    - cron: '24 3 * * *'
+
+permissions:
+  contents: write
+
+jobs:
+
+  dependency-submission:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Set Java version
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'temurin'
+        java-version: '21'
+    - name: Generate and submit dependency graph
+      uses: gradle/actions/dependency-submission@v3

.github/workflows/do-not-merge.yml

@@ -0,0 +1,23 @@
+name: "Check labels"
+
+on:
+  pull_request:
+    branches: ["master"]
+    types:
+      - opened
+      - synchronize
+      - labeled
+      - unlabeled
+  merge_group:
+    branches: ["master"]
+    types: [checks_requested]
+
+jobs:
+  fail-by-label:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail if PR is labeled as "do not merge"
+        if: contains(github.event.pull_request.labels.*.name, 'do not merge')
+        run: |
+          echo "This PR is labeled as do not merge!"
+          exit 1

.java-version

@@ -1 +1 @@
-17
+21

build.gradle

@@ -281,6 +281,12 @@ def javadocSource = []
 def javadocClasspath = []
 def javadocDependentTasks = []
 
+def services = [':services:default',
+                ':services:backend',
+                ':services:bsa',
+                ':services:tools',
+                ':services:pubapi']
+
 subprojects {
   // Skip no-op project
   if (project.name == 'services') return
@@ -354,23 +360,6 @@ subprojects {
     }
   }
 
-  // 'listenablefuture' is folded into guava since v32. This block is required
-  // until all transitive dependencies have upgraded past guava v32.
-  // TODO(periodically): remove this block and see if build succeeds.
-  configurations.all {
-    resolutionStrategy
-            .capabilitiesResolution
-            .withCapability("com.google.guava:listenablefuture") {
-      select("com.google.guava:guava:0")
-    }
-  }
-
-  def services = [':services:default',
-                  ':services:backend',
-                  ':services:bsa',
-                  ':services:tools',
-                  ':services:pubapi']
-
   // Set up all of the deployment projects.
   if (services.contains(project.path)) {
 
@@ -412,9 +401,9 @@ subprojects {
     }
   }
 
-  // No need to produce javadoc for the docs subproject, which has no APIs to
+  // No need to produce javadoc for the jetty subproject, which has no APIs to
   // expose to users.
-  if (project.name != 'docs') {
+  if (project.name != 'jetty') {
     javadocSource << project.sourceSets.main.allJava
     javadocClasspath << project.sourceSets.main.runtimeClasspath
     javadocClasspath << "${buildDir}/generated/sources/annotationProcessor/java/main"
@@ -422,6 +411,17 @@ subprojects {
   }
 }
 
+// Force SDK download and deployment to be sequential, otherwise parallel tasks
+// will fail. For SDK download, they will try to write to the same location to
+// upgrade gcloud. For deployment, they will try to deploy different services to
+// the same project at the same time.
+for (int i = 1; i < services.size(); i++) {
+  project("${services[i]}").downloadCloudSdk
+          .dependsOn(project("${services[i - 1]}").downloadCloudSdk)
+  project("${services[i]}").appengineDeployAll
+          .dependsOn(project("${services[i - 1]}").appengineDeployAll)
+}
+
 // If "-P verboseTestOutput=true" is passed in, configure all subprojects to dump all of their
 // output and final test status (pass/fail, errors) for each test class.
 //

buildSrc/build.gradle.kts

@@ -104,8 +104,6 @@ dependencies {
   implementation(deps["org.apache.commons:commons-text"]!!)
   annotationProcessor(deps["com.google.auto.value:auto-value"]!!)
   testImplementation(deps["com.google.truth:truth"]!!)
-  testImplementation(
-      deps["com.google.truth.extensions:truth-java8-extension"]!!)
   testImplementation(deps["org.junit.jupiter:junit-jupiter-api"]!!)
   testImplementation(deps["org.junit.jupiter:junit-jupiter-engine"]!!)
   testImplementation(deps["org.mockito:mockito-core"]!!)

buildSrc/gradle.lockfile

@@ -3,38 +3,39 @@
 # This file is expected to be part of source control.
 aopalliance:aopalliance:1.0=annotationProcessor,buildScriptClasspath,compileClasspath
 args4j:args4j:2.0.23=buildScriptClasspath,compileClasspath
-com.fasterxml.jackson.core:jackson-core:2.14.2=buildScriptClasspath,compileClasspath
-com.fasterxml.jackson:jackson-bom:2.14.2=buildScriptClasspath,compileClasspath
+com.fasterxml.jackson.core:jackson-core:2.16.1=buildScriptClasspath,compileClasspath
+com.fasterxml.jackson:jackson-bom:2.16.1=buildScriptClasspath,compileClasspath
 com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor
 com.google.android:annotations:4.1.1.4=buildScriptClasspath
-com.google.api-client:google-api-client:2.2.0=buildScriptClasspath,compileClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.22.6-alpha=buildScriptClasspath,compileClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.22.6-alpha=buildScriptClasspath,compileClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.22.6-alpha=buildScriptClasspath,compileClasspath
-com.google.api.grpc:proto-google-common-protos:2.22.0=buildScriptClasspath,compileClasspath
-com.google.api.grpc:proto-google-iam-v1:1.17.0=buildScriptClasspath,compileClasspath
-com.google.api:api-common:2.14.0=buildScriptClasspath,compileClasspath
-com.google.api:gax-grpc:2.31.0=buildScriptClasspath,compileClasspath
-com.google.api:gax-httpjson:2.31.0=buildScriptClasspath,compileClasspath
-com.google.api:gax:2.31.0=buildScriptClasspath,compileClasspath
-com.google.apis:google-api-services-storage:v1-rev20230301-2.0.0=buildScriptClasspath,compileClasspath
-com.google.auth:google-auth-library-credentials:1.19.0=buildScriptClasspath,compileClasspath
-com.google.auth:google-auth-library-oauth2-http:1.19.0=buildScriptClasspath,compileClasspath
+com.google.api-client:google-api-client:2.3.0=buildScriptClasspath,compileClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.35.0-alpha=buildScriptClasspath,compileClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.35.0-alpha=buildScriptClasspath,compileClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.35.0-alpha=buildScriptClasspath,compileClasspath
+com.google.api.grpc:proto-google-common-protos:2.36.0=buildScriptClasspath,compileClasspath
+com.google.api.grpc:proto-google-iam-v1:1.31.0=buildScriptClasspath,compileClasspath
+com.google.api:api-common:2.28.0=buildScriptClasspath,compileClasspath
+com.google.api:gax-grpc:2.45.0=buildScriptClasspath,compileClasspath
+com.google.api:gax-httpjson:2.45.0=buildScriptClasspath,compileClasspath
+com.google.api:gax:2.45.0=buildScriptClasspath,compileClasspath
+com.google.apis:google-api-services-storage:v1-rev20240209-2.0.0=buildScriptClasspath,compileClasspath
+com.google.auth:google-auth-library-credentials:1.23.0=buildScriptClasspath,compileClasspath
+com.google.auth:google-auth-library-oauth2-http:1.23.0=buildScriptClasspath,compileClasspath
 com.google.auto.service:auto-service-annotations:1.0.1=annotationProcessor
-com.google.auto.value:auto-value-annotations:1.10.1=buildScriptClasspath,compileClasspath
+com.google.auto.value:auto-value-annotations:1.10.4=buildScriptClasspath,compileClasspath
 com.google.auto.value:auto-value-annotations:1.9=annotationProcessor
 com.google.auto.value:auto-value:1.10.4=annotationProcessor
 com.google.auto:auto-common:1.2.1=annotationProcessor
-com.google.cloud:google-cloud-core-grpc:2.21.0=buildScriptClasspath,compileClasspath
-com.google.cloud:google-cloud-core-http:2.21.0=buildScriptClasspath,compileClasspath
-com.google.cloud:google-cloud-core:2.21.0=buildScriptClasspath,compileClasspath
-com.google.cloud:google-cloud-storage:2.22.6=buildScriptClasspath,compileClasspath
+com.google.cloud:google-cloud-core-grpc:2.35.0=buildScriptClasspath,compileClasspath
+com.google.cloud:google-cloud-core-http:2.35.0=buildScriptClasspath,compileClasspath
+com.google.cloud:google-cloud-core:2.35.0=buildScriptClasspath,compileClasspath
+com.google.cloud:google-cloud-storage:2.35.0=buildScriptClasspath,compileClasspath
 com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,buildScriptClasspath,compileClasspath
 com.google.code.gson:gson:2.10.1=buildScriptClasspath,compileClasspath
 com.google.common.html.types:types:1.0.6=buildScriptClasspath,compileClasspath
 com.google.errorprone:error_prone_annotation:2.23.0=annotationProcessor
-com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor,buildScriptClasspath,compileClasspath
+com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor
+com.google.errorprone:error_prone_annotations:2.24.1=buildScriptClasspath,compileClasspath
 com.google.errorprone:error_prone_check_api:2.23.0=annotationProcessor
 com.google.errorprone:error_prone_core:2.23.0=annotationProcessor
 com.google.errorprone:error_prone_type_annotations:2.23.0=annotationProcessor
@@ -45,45 +46,46 @@ com.google.guava:guava-parent:32.1.1-jre=annotationProcessor
 com.google.guava:guava:32.1.1-jre=annotationProcessor
 com.google.guava:guava:33.0.0-jre=buildScriptClasspath,compileClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=buildScriptClasspath,compileClasspath
-com.google.http-client:google-http-client-apache-v2:1.43.3=buildScriptClasspath,compileClasspath
-com.google.http-client:google-http-client-appengine:1.43.3=buildScriptClasspath,compileClasspath
-com.google.http-client:google-http-client-gson:1.43.3=buildScriptClasspath,compileClasspath
-com.google.http-client:google-http-client-jackson2:1.43.3=buildScriptClasspath,compileClasspath
-com.google.http-client:google-http-client:1.43.3=buildScriptClasspath,compileClasspath
+com.google.http-client:google-http-client-apache-v2:1.44.1=buildScriptClasspath,compileClasspath
+com.google.http-client:google-http-client-appengine:1.44.1=buildScriptClasspath,compileClasspath
+com.google.http-client:google-http-client-gson:1.44.1=buildScriptClasspath,compileClasspath
+com.google.http-client:google-http-client-jackson2:1.44.1=buildScriptClasspath,compileClasspath
+com.google.http-client:google-http-client:1.44.1=buildScriptClasspath,compileClasspath
 com.google.inject.extensions:guice-multibindings:4.1.0=buildScriptClasspath,compileClasspath
 com.google.inject:guice:4.1.0=buildScriptClasspath,compileClasspath
 com.google.inject:guice:5.1.0=annotationProcessor
 com.google.j2objc:j2objc-annotations:2.8=buildScriptClasspath,compileClasspath
 com.google.jsinterop:jsinterop-annotations:1.0.1=buildScriptClasspath,compileClasspath
-com.google.oauth-client:google-oauth-client:1.34.1=buildScriptClasspath,compileClasspath
-com.google.protobuf:protobuf-java-util:3.23.2=buildScriptClasspath,compileClasspath
+com.google.oauth-client:google-oauth-client:1.35.0=buildScriptClasspath,compileClasspath
+com.google.protobuf:protobuf-java-util:3.25.2=buildScriptClasspath,compileClasspath
 com.google.protobuf:protobuf-java:3.19.6=annotationProcessor
-com.google.protobuf:protobuf-java:3.23.2=buildScriptClasspath,compileClasspath
-com.google.re2j:re2j:1.6=buildScriptClasspath
+com.google.protobuf:protobuf-java:3.25.2=buildScriptClasspath,compileClasspath
+com.google.re2j:re2j:1.7=buildScriptClasspath
 com.google.template:soy:2021-02-01=buildScriptClasspath,compileClasspath
 com.ibm.icu:icu4j:57.1=buildScriptClasspath,compileClasspath
-commons-codec:commons-codec:1.15=buildScriptClasspath,compileClasspath
-commons-logging:commons-logging:1.2=buildScriptClasspath,compileClasspath
+commons-codec:commons-codec:1.16.1=buildScriptClasspath,compileClasspath
 io.github.eisop:dataflow-errorprone:3.34.0-eisop1=annotationProcessor
 io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor
-io.grpc:grpc-alts:1.55.3=buildScriptClasspath,compileClasspath
-io.grpc:grpc-api:1.55.3=buildScriptClasspath,compileClasspath
-io.grpc:grpc-auth:1.55.3=buildScriptClasspath,compileClasspath
-io.grpc:grpc-context:1.55.3=buildScriptClasspath,compileClasspath
-io.grpc:grpc-core:1.55.3=buildScriptClasspath
-io.grpc:grpc-googleapis:1.55.3=buildScriptClasspath
-io.grpc:grpc-grpclb:1.55.3=buildScriptClasspath,compileClasspath
-io.grpc:grpc-netty-shaded:1.55.3=buildScriptClasspath
-io.grpc:grpc-protobuf-lite:1.55.3=buildScriptClasspath,compileClasspath
-io.grpc:grpc-protobuf:1.55.3=buildScriptClasspath,compileClasspath
-io.grpc:grpc-rls:1.55.3=buildScriptClasspath
-io.grpc:grpc-services:1.55.3=buildScriptClasspath
-io.grpc:grpc-stub:1.55.3=buildScriptClasspath,compileClasspath
-io.grpc:grpc-xds:1.55.3=buildScriptClasspath
+io.grpc:grpc-alts:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-api:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-auth:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-context:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-core:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-googleapis:1.62.2=buildScriptClasspath
+io.grpc:grpc-grpclb:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-inprocess:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-netty-shaded:1.62.2=buildScriptClasspath
+io.grpc:grpc-protobuf-lite:1.62.2=buildScriptClasspath
+io.grpc:grpc-protobuf:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-rls:1.62.2=buildScriptClasspath
+io.grpc:grpc-services:1.62.2=buildScriptClasspath
+io.grpc:grpc-stub:1.62.2=buildScriptClasspath,compileClasspath
+io.grpc:grpc-util:1.62.2=buildScriptClasspath
+io.grpc:grpc-xds:1.62.2=buildScriptClasspath
 io.opencensus:opencensus-api:0.31.1=buildScriptClasspath,compileClasspath
 io.opencensus:opencensus-contrib-http-util:0.31.1=buildScriptClasspath,compileClasspath
 io.opencensus:opencensus-proto:0.2.0=buildScriptClasspath
-io.perfmark:perfmark-api:0.26.0=buildScriptClasspath
+io.perfmark:perfmark-api:0.27.0=buildScriptClasspath
 javax.annotation:javax.annotation-api:1.3.2=buildScriptClasspath,compileClasspath
 javax.annotation:jsr250-api:1.0=buildScriptClasspath,compileClasspath
 javax.inject:javax.inject:1=annotationProcessor,buildScriptClasspath,compileClasspath
@@ -92,7 +94,7 @@ org.apache.commons:commons-text:1.11.0=buildScriptClasspath,compileClasspath
 org.apache.httpcomponents:httpclient:4.5.14=buildScriptClasspath,compileClasspath
 org.apache.httpcomponents:httpcore:4.4.16=buildScriptClasspath,compileClasspath
 org.checkerframework:checker-qual:3.33.0=annotationProcessor
-org.checkerframework:checker-qual:3.41.0=buildScriptClasspath,compileClasspath
+org.checkerframework:checker-qual:3.42.0=buildScriptClasspath,compileClasspath
 org.codehaus.mojo:animal-sniffer-annotations:1.23=buildScriptClasspath
 org.conscrypt:conscrypt-openjdk-uber:2.5.2=buildScriptClasspath,compileClasspath
 org.json:json:20160212=buildScriptClasspath,compileClasspath

buildSrc/src/test/java/google/registry/gradle/plugin/CoverPageGeneratorTest.java

@@ -16,7 +16,6 @@ package google.registry.gradle.plugin;
 
 import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.truth.Truth.assertThat;
-import static com.google.common.truth.Truth8.assertThat;
 import static google.registry.gradle.plugin.GcsPluginUtils.toByteArraySupplier;
 import static java.nio.charset.StandardCharsets.UTF_8;
 

common/gradle.lockfile

@@ -2,8 +2,8 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 aopalliance:aopalliance:1.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.github.ben-manes.caffeine:caffeine:2.9.3=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.github.ben-manes.caffeine:caffeine:3.1.8=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.auto.service:auto-service-annotations:1.0.1=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.auto.value:auto-value-annotations:1.10.4=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
@@ -12,7 +12,7 @@ com.google.auto:auto-common:1.2.1=annotationProcessor,errorprone,testAnnotationP
 com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
 com.google.errorprone:error_prone_annotation:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.24.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.errorprone:error_prone_annotations:2.25.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.google.errorprone:error_prone_annotations:2.7.1=checkstyle
 com.google.errorprone:error_prone_check_api:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.errorprone:error_prone_core:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
@@ -30,7 +30,7 @@ com.google.inject:guice:5.1.0=annotationProcessor,errorprone,testAnnotationProce
 com.google.j2objc:j2objc-annotations:1.3=checkstyle
 com.google.j2objc:j2objc-annotations:2.8=compileClasspath,testCompileClasspath,testingCompileClasspath
 com.google.protobuf:protobuf-java:3.19.6=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.google.truth:truth:1.4.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.truth:truth:1.4.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.puppycrawl.tools:checkstyle:9.3=checkstyle
 commons-beanutils:commons-beanutils:1.9.4=checkstyle
 commons-collections:commons-collections:3.2.2=checkstyle

common/src/testing/java/google/registry/testing/SystemInfo.java

@@ -14,7 +14,6 @@
 
 package google.registry.testing;
 
-import com.github.benmanes.caffeine.cache.CacheLoader;
 import com.github.benmanes.caffeine.cache.Caffeine;
 import com.github.benmanes.caffeine.cache.LoadingCache;
 import com.google.common.flogger.FluentLogger;
@@ -31,28 +30,25 @@ public final class SystemInfo {
   private static final LoadingCache<String, Boolean> hasCommandCache =
       Caffeine.newBuilder()
           .build(
-              new CacheLoader<String, Boolean>() {
-                @Override
-                public Boolean load(String cmd) throws InterruptedException {
-                  try {
-                    Process pid = Runtime.getRuntime().exec(cmd);
-                    pid.getOutputStream().close();
-                    pid.waitFor();
-                  } catch (IOException e) {
-                    logger.atWarning().withCause(e).log("%s command not available.", cmd);
-                    return false;
-                  }
-                  return true;
+              cmd -> {
+                try {
+                  Process pid = Runtime.getRuntime().exec(cmd.split(" "));
+                  pid.getOutputStream().close();
+                  pid.waitFor();
+                } catch (IOException e) {
+                  logger.atWarning().withCause(e).log("%s command not available.", cmd);
+                  return false;
                 }
+                return true;
               });
 
   /**
-   * Returns {@code true} if system command can be run from path.
+   * Returns {@code true} if system command can be run from the path.
    *
-   * <p><b>Warning:</b> The command is actually run! So there could be side-effects. You might need
+   * <p><b>Warning:</b> The command is actually run! So there could be side effects. You might need
    * to specify a version flag or something. Return code is ignored.
    *
-   * <p>This result is a memoized. If multiple therads try to get the same result at once, the heavy
+   * <p>This result is a memoized. If multiple threads try to get the same result at once, the heavy
    * lifting will only be performed by the first thread and the rest will wait.
    */
   public static boolean hasCommand(String cmd) throws ExecutionException {

config/dependency-license/allowed_licenses.json

@@ -390,6 +390,12 @@
       "moduleLicense": null,
       "moduleVersion": "1.0.1",
       "moduleName": "org.jetbrains.kotlinx:kotlinx-serialization-core"
+    },
+    {
+      // "Apache License, Version 2.0".
+      "moduleLicense": null,
+      "moduleVersion": "1.4",
+      "moduleName": "jakarta-regexp:jakarta-regexp"
     }
   ]
 }

config/nom_build.py

@@ -47,7 +47,7 @@ class GradleFlag:
 
 
 PROPERTIES_HEADER = """\
-# This file defines properties used by the gradle build.  It must be kept in
+# This file defines properties used by the gradle build. It must be kept in
 # sync with config/nom_build.py.
 #
 # To regenerate, run ./nom_build --generate-gradle-properties
@@ -58,6 +58,7 @@ PROPERTIES_HEADER = """\
 # DO NOT EDIT THIS FILE BY HAND
 org.gradle.jvmargs=-Xmx1024m
 org.gradle.caching=true
+org.gradle.parallel=true
 """
 
 # Help text to be displayed (in addition to the synopsis and flag help, which

config/presubmits.py

@@ -178,6 +178,12 @@ PRESUBMITS = {
         {"/node_modules/"},
     ):
         "Do not use shaded dependencies from testcontainers.",
+    PresubmitCheck(
+        r"com\.google\.common\.truth\.Truth8",
+        "java",
+        {"/node_modules/"},
+    ):
+        "Truth8 is deprecated. Use Truth instead.",
 }
 
 # Note that this regex only works for one kind of Flyway file.  If we want to

core/Dockerfile

@@ -1,3 +1,3 @@
-FROM gcr.io/distroless/java17-debian11:debug
+FROM eclipse-temurin:21
 ADD build/libs/nomulus.jar /nomulus.jar
-ENTRYPOINT ["/usr/bin/java", "-jar", "/nomulus.jar"]
+ENTRYPOINT ["java", "-jar", "/nomulus.jar"]

core/build.gradle

@@ -31,19 +31,6 @@ def goldensDir =
   "${javaTestDir}/google/registry/webdriver/goldens/chrome-linux"
 def jsDir = "${project.projectDir}/src/main/javascript"
 
-// Tests that conflict with (mostly unidentified) members of the main test
-// suite. It is unclear if they are offenders (i.e., those that pollute global
-// state) or victims.
-// TODO(weiminyu): identify cause and fix offending tests.
-def outcastTestPatterns = [
-    // Problem seems to lie with AppEngine TaskQueue for test.
-    "google/registry/batch/RefreshDnsOnHostRenameActionTest.*",
-    "google/registry/flows/EppLifecycleHostTest.*",
-    "google/registry/flows/domain/DomainCreateFlowTest.*",
-    "google/registry/flows/domain/DomainUpdateFlowTest.*",
-    "google/registry/tools/CreateDomainCommandTest.*",
-]
-
 // Tests that fail when running Gradle in a docker container, e. g. when
 // building the release artifacts in Google Cloud Build.
 def dockerIncompatibleTestPatterns = [
@@ -62,9 +49,9 @@ def dockerIncompatibleTestPatterns = [
     "google/registry/persistence/PersistenceModuleTest.*",
 ]
 
-// Tests that conflict with members of both the main test suite and the
-// outcast suite. They seem to be affected by global states outside of
-// Nomulus classes, e.g., threads and objects retained by frameworks.
+// Tests that conflict with members of the main test suite. They seem to be
+// affected by global states outside of Nomulus classes, e.g., threads and
+// objects retained by frameworks.
 // TODO(weiminyu): identify cause and fix offending tests.
 def fragileTestPatterns = [
     // Changes cache timeouts and for some reason appears to have contention
@@ -98,12 +85,6 @@ sourceSets {
     java {
       compileClasspath += nonprod.output
       runtimeClasspath += nonprod.output
-
-      // Javadoc API is deprecated in Java 11 and removed in Java 12.
-      // TODO(jianglai): re-enable after migrating to the new Javadoc API
-      if ((JavaVersion.current().majorVersion as Integer) >= 11) {
-        exclude 'google/registry/documentation/**'
-      }
     }
     resources {
       exclude '**/*.xjb', '**/*.xsd'
@@ -123,10 +104,8 @@ configurations {
   devtool
 
   nonprodImplementation.extendsFrom implementation
-  nonprodRuntime.extendsFrom runtime
 
   testImplementation.extendsFrom nonprodImplementation
-  testRuntimeOnly.extendsFrom nonprodRuntime
 
   // Published jars that are used for server/schema compatibility tests.
   // See <a href="../integration/README.md">the integration project</a>
@@ -187,7 +166,6 @@ dependencies {
   implementation deps['com.google.dagger:dagger']
   implementation deps['com.google.errorprone:error_prone_annotations']
   implementation deps['com.google.flogger:flogger']
-  runtime deps['com.google.flogger:flogger-system-backend']
   implementation deps['com.google.guava:guava']
   implementation deps['com.google.protobuf:protobuf-java']
   // Might need to add this back if we re-add nebula-lint
@@ -214,7 +192,7 @@ dependencies {
   implementation deps['com.zaxxer:HikariCP']
   implementation deps['com.squareup.okhttp3:okhttp']
   implementation deps['dnsjava:dnsjava']
-  runtime deps['guru.nidi:graphviz-java-all-j2v8']
+  testRuntimeOnly deps['guru.nidi:graphviz-java-all-j2v8']
   testImplementation deps['io.github.classgraph:classgraph']
   testRuntimeOnly deps['io.github.java-diff-utils:java-diff-utils']
   testImplementation deps['javax.annotation:javax.annotation-api']
@@ -244,11 +222,10 @@ dependencies {
   testImplementation deps['org.apache.sshd:sshd-scp']
   testImplementation deps['org.apache.sshd:sshd-sftp']
   testImplementation deps['org.apache.tomcat:tomcat-annotations-api']
-  implementation deps['org.bouncycastle:bcpg-jdk15on']
-  implementation deps['org.bouncycastle:bcpkix-jdk15on']
-  implementation deps['org.bouncycastle:bcprov-jdk15on']
+  implementation deps['org.bouncycastle:bcpg-jdk18on']
+  implementation deps['org.bouncycastle:bcpkix-jdk18on']
+  implementation deps['org.bouncycastle:bcprov-jdk18on']
   testImplementation deps['com.fasterxml.jackson.core:jackson-databind']
-  runtime deps['org.glassfish.jaxb:jaxb-runtime']
   implementation deps['org.hibernate:hibernate-core']
   implementation deps['org.hibernate:hibernate-hikaricp']
   implementation deps['org.joda:joda-money']
@@ -273,7 +250,7 @@ dependencies {
   implementation deps['us.fatehi:schemacrawler-diagram']
   implementation deps['us.fatehi:schemacrawler-tools']
   implementation deps['xerces:xmlParserAPIs']
-  implementation deps['xpp3:xpp3']
+  implementation deps['org.ogce:xpp3']
   // This dependency must come after javax.mail:mail as it would otherwise
   // shadow classes in package javax.mail with its own implementation.
   implementation deps['com.google.appengine:appengine-api-1.0-sdk']
@@ -300,7 +277,6 @@ dependencies {
   testImplementation deps['com.google.monitoring-client:contrib']
   testImplementation deps['com.google.protobuf:protobuf-java-util']
   testImplementation deps['com.google.truth:truth']
-  testImplementation deps['com.google.truth.extensions:truth-java8-extension']
   testImplementation deps['org.checkerframework:checker-qual']
   testImplementation deps['org.hamcrest:hamcrest']
   testImplementation deps['org.hamcrest:hamcrest-core']
@@ -315,7 +291,6 @@ dependencies {
   testImplementation deps['org.junit.platform:junit-platform-suite-api']
   testImplementation deps['org.mockito:mockito-core']
   testImplementation deps['org.mockito:mockito-junit-jupiter']
-  runtime deps['org.postgresql:postgresql']
 
   // Indirect dependency found by undeclared-dependency check. Such
   // dependencies should go after all other implementation and testImplementation
@@ -776,7 +751,7 @@ if (environment == 'alpha') {
             gs://${gcpProject}-deploy/live/beam/${metaDataBaseName} \
             --image-gcr-path ${imageName}:live \
             --sdk-language JAVA \
-            --flex-template-base-image JAVA17 \
+            --flex-template-base-image gcr.io/dataflow-templates-base/java21-template-launcher-base:latest \
             --metadata-file ${projectDir}/src/main/resources/${metaData} \
             --jar ${uberJarName} \
             --env FLEX_TEMPLATE_JAVA_MAIN_CLASS=${mainClass} \
@@ -956,16 +931,6 @@ task fragileTest(type: FilteringTest) {
   }
 }
 
-task outcastTest(type: FilteringTest) {
-  tests = outcastTestPatterns
-
-  // Sets the maximum number of test executors that may exist at the same time.
-  // Note that this number appears to contribute to NoClassDefFoundError
-  // exceptions on certain machines and distros. The root cause is unclear.
-  // Try reducing this number if you experience similar problems.
-  maxParallelForks 3
-}
-
 // Dedicated test suite for schema-dependent tests.
 task sqlIntegrationTest(type: FilteringTest) {
   // TestSuite still requires a JUnit 4 runner, which knows how to handle JUnit 5 tests.
@@ -989,7 +954,6 @@ task registryToolIntegrationTest(dependsOn: nomulus, type: FilteringTest) {
 task standardTest(type: FilteringTest) {
   includeAllTests()
   exclude fragileTestPatterns
-  exclude outcastTestPatterns
   // See SqlIntegrationTestSuite.java
   exclude '**/*BeforeSuiteTest.*', '**/*AfterSuiteTest.*'
 
@@ -1006,7 +970,7 @@ task standardTest(type: FilteringTest) {
   // Also, Gradle executes tests in 1 thread and some of our test infrastructures
   // depend on that, e.g. DualDatabaseTestInvocationContextProvider injects
   // different implementation of TransactionManager into TransactionManagerFactory.
-  maxParallelForks 5
+  maxParallelForks 64
 
   systemProperty 'test.projectRoot', rootProject.projectRootDir
   systemProperty 'test.resourcesDir', resourcesDir
@@ -1017,11 +981,11 @@ test {
   // FilteringTest tasks.
   exclude "**"
   // TODO(weiminyu): Remove dependency on sqlIntegrationTest
-}.dependsOn(fragileTest, outcastTest, standardTest, registryToolIntegrationTest, sqlIntegrationTest)
+}.dependsOn(fragileTest, standardTest, registryToolIntegrationTest, sqlIntegrationTest)
 
 
 // When we override tests, we also break the cleanTest command.
-cleanTest.dependsOn(cleanFragileTest, cleanOutcastTest, cleanStandardTest,
+cleanTest.dependsOn(cleanFragileTest, cleanStandardTest,
                     cleanRegistryToolIntegrationTest, cleanSqlIntegrationTest)
 
 project.build.dependsOn devtool

core/gradle.lockfile

@@ -10,20 +10,20 @@ cglib:cglib-nodep:2.2=css
 com.101tec:zkclient:0.10=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.beust:jcommander:1.60=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.charleskorn.kaml:kaml:0.20.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-joda:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-joda:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml:classmate:1.5.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.ben-manes.caffeine:caffeine:2.9.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-com.github.docker-java:docker-java-api:3.3.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.docker-java:docker-java-transport-zerodep:3.3.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.docker-java:docker-java-transport:3.3.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.ben-manes.caffeine:caffeine:3.1.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.docker-java:docker-java-api:3.3.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.docker-java:docker-java-transport-zerodep:3.3.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.docker-java:docker-java-transport:3.3.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jffi:1.3.12=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-a64asm:1.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-constants:0.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -39,7 +39,7 @@ com.google.api-client:google-api-client-jackson2:2.0.1=compileClasspath,deploy_j
 com.google.api-client:google-api-client-java6:1.35.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-servlet:1.35.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client:1.35.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.22.6-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.35.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.172.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.172.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -49,7 +49,7 @@ com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.12.20=compileClasspath,dep
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.56.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.56.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-spanner-v1:6.56.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.23.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.35.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-common-protos:2.30.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.172.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -62,24 +62,24 @@ com.google.api.grpc:proto-google-cloud-monitoring-v3:1.64.0=compileClasspath,non
 com.google.api.grpc:proto-google-cloud-monitoring-v3:3.34.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.108.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.12.20=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.23.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:2.23.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:2.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.56.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.56.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-executor-v1:6.56.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-v1:6.56.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.23.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2:2.23.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.113.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.113.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-common-protos:2.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-iam-v1:1.25.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:api-common:2.25.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-grpc:2.39.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-httpjson:2.39.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax:2.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.35.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2:2.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.127.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.127.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-common-protos:2.36.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:api-common:2.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-grpc:2.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-httpjson:2.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax:2.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-admin-directory:directory_v1-rev118-1.25.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-appengine:v1-rev20240218-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-appengine:v1-rev20240226-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-bigquery:v2-rev20230812-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20230806-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-dataflow:v1b3-rev20240113-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -89,15 +89,16 @@ com.google.apis:google-api-services-gmail:v1-rev20220404-2.0.0=compileClasspath,
 com.google.apis:google-api-services-groupssettings:v1-rev20210624-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240110-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-monitoring:v3-rev20240128-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-monitoring:v3-rev20240303-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sheets:v4-rev20230815-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20240205-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20231202-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.appengine:appengine-api-1.0-sdk:1.9.86=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.appengine:appengine-api-1.0-sdk:2.0.24=testCompileClasspath,testRuntimeClasspath
-com.google.appengine:appengine-api-stubs:2.0.24=testCompileClasspath,testRuntimeClasspath
-com.google.appengine:appengine-testing:1.9.86=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20240209-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.appengine:appengine-api-1.0-sdk:2.0.25=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.appengine:appengine-api-stubs:2.0.25=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.appengine:appengine-remote-api:2.0.25=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.appengine:appengine-testing:2.0.25=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.appengine:appengine-tools-sdk:2.0.25=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-credentials:1.23.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-oauth2-http:1.23.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service-annotations:1.0.1=errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
@@ -117,23 +118,23 @@ com.google.cloud.sql:postgres-socket-factory:1.16.0=deploy_jar,runtimeClasspath,
 com.google.cloud:google-cloud-bigquerystorage:3.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable-stats:2.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.29.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-http:2.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core:2.29.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.35.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.35.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core:2.35.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-firestore:3.16.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-monitoring:1.82.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.cloud:google-cloud-monitoring:3.34.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-nio:0.126.19=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-nio:0.127.14=testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-pubsub:1.126.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-pubsublite:1.12.20=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-secretmanager:2.23.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-secretmanager:2.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-spanner:6.56.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage:2.22.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-tasks:2.23.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage:2.35.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-tasks:2.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:grpc-gcp:1.5.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.16.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.code.findbugs:jsr305:3.0.1=css
-com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.code.gson:gson:2.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.code.gson:gson:2.7=css,soy
 com.google.common.html.types:types:1.0.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
@@ -143,7 +144,8 @@ com.google.dagger:dagger:2.51=annotationProcessor,compileClasspath,deploy_jar,no
 com.google.devtools.ksp:symbol-processing-api:1.9.20-1.0.14=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotation:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.24.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.24.1=compileClasspath,nonprodCompileClasspath
+com.google.errorprone:error_prone_annotations:2.25.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotations:2.7.1=checkstyle,soy
 com.google.errorprone:error_prone_check_api:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
@@ -152,8 +154,8 @@ com.google.errorprone:javac-shaded:9-dev-r4023-3=annotationProcessor,testAnnotat
 com.google.errorprone:javac:9+181-r4173-1=errorproneJavac
 com.google.escapevelocity:escapevelocity:0.9.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.google.flatbuffers:flatbuffers-java:1.12.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.flogger:flogger-system-backend:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.flogger:flogger:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.flogger:flogger-system-backend:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.flogger:flogger:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flogger:google-extensions:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.googlejavaformat:google-java-format:1.5=annotationProcessor,testAnnotationProcessor
 com.google.guava:failureaccess:1.0.1=checkstyle,errorprone,nonprodAnnotationProcessor,soy
@@ -166,10 +168,10 @@ com.google.guava:guava:32.1.1-jre=errorprone,nonprodAnnotationProcessor
 com.google.guava:guava:33.0.0-jre=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-appengine:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-appengine:1.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-gson:1.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-jackson2:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-jackson2:1.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-protobuf:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client:1.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject.extensions:guice-multibindings:4.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
@@ -193,13 +195,12 @@ com.google.oauth-client:google-oauth-client-servlet:1.35.0=compileClasspath,depl
 com.google.oauth-client:google-oauth-client:1.35.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java-util:3.25.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java:2.5.0=css
+com.google.protobuf:protobuf-java:3.13.0=soy
 com.google.protobuf:protobuf-java:3.19.6=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.protobuf:protobuf-java:3.25.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.protobuf:protobuf-java:3.25.3=soy
 com.google.re2j:re2j:1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.template:soy:2021-02-01=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-com.google.truth.extensions:truth-java8-extension:1.4.1=testCompileClasspath,testRuntimeClasspath
-com.google.truth:truth:1.4.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.truth:truth:1.4.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.googlecode.json-simple:json-simple:1.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.ibm.icu:icu4j:57.1=soy
 com.ibm.icu:icu4j:73.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -229,26 +230,25 @@ com.squareup:kotlinpoet:1.15.1=compileClasspath,deploy_jar,nonprodCompileClasspa
 com.sun.activation:jakarta.activation:1.2.2=jaxb
 com.sun.activation:javax.activation:1.2.0=jaxb
 com.sun.istack:istack-commons-runtime:3.0.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.sun.istack:istack-commons-runtime:4.1.2=nonprodRuntime,runtime
 com.sun.xml.bind:jaxb-impl:2.3.3=jaxb
-com.sun.xml.bind:jaxb-osgi:4.0.4=jaxb
+com.sun.xml.bind:jaxb-osgi:4.0.5=jaxb
 com.sun.xml.bind:jaxb-xjc:2.3.3=jaxb
 com.sun.xml.fastinfoset:FastInfoset:1.2.15=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.thoughtworks.paranamer:paranamer:2.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.thoughtworks.qdox:qdox:1.12.1=testCompileClasspath,testRuntimeClasspath
-com.zaxxer:HikariCP:3.4.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.zaxxer:HikariCP:5.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 commons-beanutils:commons-beanutils:1.9.4=checkstyle
-commons-codec:commons-codec:1.16.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+commons-codec:commons-codec:1.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 commons-collections:commons-collections:3.2.2=checkstyle
 commons-logging:commons-logging:1.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 dnsjava:dnsjava:3.5.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-guru.nidi.com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0=nonprodRuntime,runtime,testRuntimeClasspath
-guru.nidi.com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0=nonprodRuntime,runtime,testRuntimeClasspath
-guru.nidi.com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0=nonprodRuntime,runtime,testRuntimeClasspath
-guru.nidi.com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0=nonprodRuntime,runtime,testRuntimeClasspath
-guru.nidi.com.kitfox:svgSalamander:1.1.3=nonprodRuntime,runtime,testRuntimeClasspath
-guru.nidi:graphviz-java-all-j2v8:0.18.1=nonprodRuntime,runtime,testRuntimeClasspath
-guru.nidi:graphviz-java:0.18.1=nonprodRuntime,runtime,testRuntimeClasspath
+guru.nidi.com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0=testRuntimeClasspath
+guru.nidi.com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0=testRuntimeClasspath
+guru.nidi.com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0=testRuntimeClasspath
+guru.nidi.com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0=testRuntimeClasspath
+guru.nidi.com.kitfox:svgSalamander:1.1.3=testRuntimeClasspath
+guru.nidi:graphviz-java-all-j2v8:0.18.1=testRuntimeClasspath
+guru.nidi:graphviz-java:0.18.1=testRuntimeClasspath
 info.picocli:picocli:4.6.2=checkstyle
 io.apicurio:apicurio-registry-protobuf-schema-utilities:3.0.0.M2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.confluent:common-config:5.3.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -258,26 +258,28 @@ io.confluent:kafka-schema-registry-client:5.3.2=compileClasspath,deploy_jar,nonp
 io.github.classgraph:classgraph:4.8.162=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.github.eisop:dataflow-errorprone:3.34.0-eisop1=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-alts:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-auth:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-alts:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-auth:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-census:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.60.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-context:1.61.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-core:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-googleapis:1.60.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-grpclb:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-inprocess:1.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-netty-shaded:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-core:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-googleapis:1.62.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-grpclb:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-inprocess:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-netty-shaded:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-netty:1.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-protobuf-lite:1.60.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-protobuf-lite:1.61.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-rls:1.60.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-services:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-stub:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-util:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-xds:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf-lite:1.62.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-rls:1.62.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-services:1.61.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-services:1.62.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-stub:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-util:1.61.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-util:1.62.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-xds:1.61.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-xds:1.62.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.netty:netty-buffer:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-codec-http2:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-codec-http:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -304,10 +306,11 @@ io.opencensus:opencensus-impl-core:0.31.0=compileClasspath,deploy_jar,nonprodCom
 io.opencensus:opencensus-impl:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-proto:0.2.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.outfoxx:swiftpoet:1.3.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.perfmark:perfmark-api:0.26.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-jakarta.activation:jakarta.activation-api:2.1.2=jaxb,nonprodRuntime,runtime
+io.perfmark:perfmark-api:0.27.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+jakarta-regexp:jakarta-regexp:1.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+jakarta.activation:jakarta.activation-api:2.1.3=jaxb
 jakarta.inject:jakarta.inject-api:2.0.1=soy
-jakarta.xml.bind:jakarta.xml.bind-api:4.0.1=jaxb,nonprodRuntime,runtime
+jakarta.xml.bind:jakarta.xml.bind-api:4.0.2=jaxb
 javacc:javacc:4.1=css
 javax.activation:activation:1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 javax.activation:javax.activation-api:1.2.0=compileClasspath,deploy_jar,jaxb,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -324,10 +327,10 @@ javax.xml.bind:jaxb-api:2.4.0-b180830.0359=jaxb
 jline:jline:1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 joda-time:joda-time:2.10.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 junit:junit:4.13.2=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
-net.arnx:nashorn-promise:0.1.1=nonprodRuntime,runtime,testRuntimeClasspath
-net.bytebuddy:byte-buddy-agent:1.14.11=testCompileClasspath,testRuntimeClasspath
+net.arnx:nashorn-promise:0.1.1=testRuntimeClasspath
+net.bytebuddy:byte-buddy-agent:1.14.12=testCompileClasspath,testRuntimeClasspath
 net.bytebuddy:byte-buddy:1.12.18=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-net.bytebuddy:byte-buddy:1.14.11=testCompileClasspath,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.14.12=testCompileClasspath,testRuntimeClasspath
 net.java.dev.javacc:javacc:4.1=css
 net.java.dev.jna:jna:5.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.ltgt.gradle.incap:incap:0.2=annotationProcessor,testAnnotationProcessor
@@ -360,7 +363,7 @@ org.apache.beam:beam-vendor-grpc-1_60_1:0.1=compileClasspath,deploy_jar,nonprodC
 org.apache.beam:beam-vendor-guava-32_1_2-jre:0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-compress:1.24.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-csv:1.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-exec:1.3=nonprodRuntime,runtime,testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-exec:1.3=testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-lang3:3.13.0=testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-lang3:3.14.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 org.apache.commons:commons-text:1.11.0=testCompileClasspath,testRuntimeClasspath
@@ -369,27 +372,28 @@ org.apache.ftpserver:ftpserver-core:1.2.0=testCompileClasspath,testRuntimeClassp
 org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.httpcomponents:httpcore:4.4.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.mina:mina-core:2.1.6=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-core:2.0.0=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-scp:2.0.0=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-sftp:2.0.0=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-common:2.12.1=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-core:2.12.1=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-scp:2.12.1=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-sftp:2.12.1=testCompileClasspath,testRuntimeClasspath
 org.apache.tomcat:tomcat-annotations-api:11.0.0-M17=testCompileClasspath,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
-org.bouncycastle:bcpg-jdk15on:1.67=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcpkix-jdk15on:1.67=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcprov-jdk15on:1.67=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.checkerframework:checker-compat-qual:2.5.3=compileClasspath,nonprodCompileClasspath,nonprodRuntime,runtime,testCompileClasspath
+org.bouncycastle:bcpg-jdk18on:1.77=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpkix-jdk18on:1.77=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcprov-jdk18on:1.77=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcutil-jdk18on:1.77=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.checkerframework:checker-compat-qual:2.5.3=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 org.checkerframework:checker-compat-qual:2.5.5=annotationProcessor,testAnnotationProcessor
 org.checkerframework:checker-compat-qual:2.5.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.12.0=checkstyle,soy
 org.checkerframework:checker-qual:3.33.0=errorprone,nonprodAnnotationProcessor
 org.checkerframework:checker-qual:3.41.0=annotationProcessor,testAnnotationProcessor
-org.checkerframework:checker-qual:3.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.checkerframework:checker-qual:3.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.codehaus.jackson:jackson-core-asl:1.9.13=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.codehaus.jackson:jackson-mapper-asl:1.9.13=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.codehaus.mojo:animal-sniffer-annotations:1.23=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.easymock:easymock:3.0=css
-org.eclipse.angus:angus-activation:2.0.1=nonprodRuntime,runtime
 org.eclipse.jetty:jetty-http:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-io:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-security:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -397,12 +401,10 @@ org.eclipse.jetty:jetty-server:9.4.49.v20220914=compileClasspath,deploy_jar,nonp
 org.eclipse.jetty:jetty-servlet:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-util-ajax:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-util:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-core:9.22.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.glassfish.jaxb:jaxb-core:4.0.4=nonprodRuntime,runtime
+org.flywaydb:flyway-core:10.9.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-database-postgresql:10.9.1=testRuntimeClasspath
 org.glassfish.jaxb:jaxb-runtime:2.3.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.glassfish.jaxb:jaxb-runtime:4.0.4=nonprodRuntime,runtime
 org.glassfish.jaxb:txw2:2.3.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.glassfish.jaxb:txw2:4.0.4=nonprodRuntime,runtime
 org.gwtproject:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.hamcrest:hamcrest-core:1.1=css
 org.hamcrest:hamcrest-core:1.3=nonprodCompileClasspath,nonprodRuntimeClasspath
@@ -456,12 +458,13 @@ org.junit.platform:junit-platform-suite-commons:1.10.2=testRuntimeClasspath
 org.junit:junit-bom:5.10.2=testCompileClasspath,testRuntimeClasspath
 org.jvnet.staxex:stax-ex:1.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.mockito:mockito-core:1.10.19=css
-org.mockito:mockito-core:5.10.0=testCompileClasspath,testRuntimeClasspath
-org.mockito:mockito-junit-jupiter:5.10.0=testCompileClasspath,testRuntimeClasspath
+org.mockito:mockito-core:5.11.0=testCompileClasspath,testRuntimeClasspath
+org.mockito:mockito-junit-jupiter:5.11.0=testCompileClasspath,testRuntimeClasspath
 org.mortbay.jetty:jetty-util:6.1.26=testCompileClasspath,testRuntimeClasspath
 org.mortbay.jetty:jetty:6.1.26=testCompileClasspath,testRuntimeClasspath
 org.objenesis:objenesis:2.1=css
 org.objenesis:objenesis:3.3=testRuntimeClasspath
+org.ogce:xpp3:1.1.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm-analysis:7.0=soy
 org.ow2.asm:asm-analysis:9.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -476,7 +479,7 @@ org.ow2.asm:asm:7.0=soy
 org.ow2.asm:asm:9.2=compileClasspath,nonprodCompileClasspath
 org.ow2.asm:asm:9.6=deploy_jar,jacocoAnt,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.pcollections:pcollections:3.1.4=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-org.postgresql:postgresql:42.7.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.postgresql:postgresql:42.7.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.reflections:reflections:0.10.2=checkstyle
 org.rnorth.duct-tape:duct-tape:1.0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.seleniumhq.selenium:selenium-api:3.141.59=testCompileClasspath,testRuntimeClasspath
@@ -489,9 +492,8 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59=testCompileClasspath,test
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59=testCompileClasspath,testRuntimeClasspath
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59=testCompileClasspath,testRuntimeClasspath
 org.seleniumhq.selenium:selenium-support:3.141.59=testCompileClasspath,testRuntimeClasspath
-org.slf4j:jcl-over-slf4j:1.7.30=nonprodRuntime,runtime,testRuntimeClasspath
-org.slf4j:jul-to-slf4j:1.7.30=nonprodRuntime,runtime,testRuntimeClasspath
-org.slf4j:slf4j-api:1.7.30=nonprodRuntime,runtime
+org.slf4j:jcl-over-slf4j:1.7.32=testCompileClasspath,testRuntimeClasspath
+org.slf4j:jul-to-slf4j:1.7.30=testRuntimeClasspath
 org.slf4j:slf4j-api:2.0.12=compileClasspath,nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath
 org.slf4j:slf4j-api:2.1.0-alpha1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.slf4j:slf4j-jdk14:2.1.0-alpha1=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -499,23 +501,22 @@ org.snakeyaml:snakeyaml-engine:2.1=deploy_jar,nonprodRuntimeClasspath,runtimeCla
 org.springframework:spring-core:5.3.27=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.springframework:spring-expression:5.3.27=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.springframework:spring-jcl:5.3.27=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:database-commons:1.19.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:jdbc:1.19.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:junit-jupiter:1.19.6=testCompileClasspath,testRuntimeClasspath
-org.testcontainers:postgresql:1.19.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:selenium:1.19.6=testCompileClasspath,testRuntimeClasspath
-org.testcontainers:testcontainers:1.19.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:database-commons:1.19.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:jdbc:1.19.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:junit-jupiter:1.19.7=testCompileClasspath,testRuntimeClasspath
+org.testcontainers:postgresql:1.19.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:selenium:1.19.7=testCompileClasspath,testRuntimeClasspath
+org.testcontainers:testcontainers:1.19.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.threeten:threetenbp:1.6.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.tukaani:xz:1.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.w3c.css:sac:1.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.webjars.npm:viz.js-graphviz-java:2.1.3=nonprodRuntime,runtime,testRuntimeClasspath
+org.webjars.npm:viz.js-graphviz-java:2.1.3=testRuntimeClasspath
 org.xerial.snappy:snappy-java:1.1.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.yaml:snakeyaml:2.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.yaml:snakeyaml:2.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-api:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-diagram:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-tools:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-utility:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 xerces:xmlParserAPIs:2.6.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-xpp3:xpp3:1.1.4c=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 empty=devtool,nomulus_test

core/src/main/java/google/registry/batch/RelockDomainAction.java

@@ -82,7 +82,6 @@ public class RelockDomainAction implements Runnable {
   private final long oldUnlockRevisionId;
   private final int previousAttempts;
   private final InternetAddress alertRecipientAddress;
-  private final InternetAddress gSuiteOutgoingEmailAddress;
   private final String supportEmail;
   private final GmailClient gmailClient;
   private final DomainLockUtils domainLockUtils;
@@ -93,7 +92,6 @@ public class RelockDomainAction implements Runnable {
       @Parameter(OLD_UNLOCK_REVISION_ID_PARAM) long oldUnlockRevisionId,
       @Parameter(PREVIOUS_ATTEMPTS_PARAM) int previousAttempts,
       @Config("newAlertRecipientEmailAddress") InternetAddress alertRecipientAddress,
-      @Config("gSuiteOutgoingEmailAddress") InternetAddress gSuiteOutgoingEmailAddress,
       @Config("supportEmail") String supportEmail,
       GmailClient gmailClient,
       DomainLockUtils domainLockUtils,
@@ -101,7 +99,6 @@ public class RelockDomainAction implements Runnable {
     this.oldUnlockRevisionId = oldUnlockRevisionId;
     this.previousAttempts = previousAttempts;
     this.alertRecipientAddress = alertRecipientAddress;
-    this.gSuiteOutgoingEmailAddress = gSuiteOutgoingEmailAddress;
     this.supportEmail = supportEmail;
     this.gmailClient = gmailClient;
     this.domainLockUtils = domainLockUtils;
@@ -217,7 +214,6 @@ public class RelockDomainAction implements Runnable {
             supportEmail);
     gmailClient.sendEmail(
         EmailMessage.newBuilder()
-            .setFrom(gSuiteOutgoingEmailAddress)
             .setBody(body)
             .setSubject(String.format("Error re-locking domain %s", oldLock.getDomainName()))
             .setRecipients(getEmailRecipients(oldLock.getRegistrarId()))
@@ -247,7 +243,6 @@ public class RelockDomainAction implements Runnable {
 
     gmailClient.sendEmail(
         EmailMessage.newBuilder()
-            .setFrom(gSuiteOutgoingEmailAddress)
             .setBody(body)
             .setSubject(String.format("Successful re-lock of domain %s", oldLock.getDomainName()))
             .setRecipients(getEmailRecipients(oldLock.getRegistrarId()))
@@ -266,7 +261,6 @@ public class RelockDomainAction implements Runnable {
             .build();
     gmailClient.sendEmail(
         EmailMessage.newBuilder()
-            .setFrom(gSuiteOutgoingEmailAddress)
             .setBody(body)
             .setSubject(String.format("Error re-locking domain %s", oldLock.getDomainName()))
             .setRecipients(allRecipients)
@@ -276,7 +270,6 @@ public class RelockDomainAction implements Runnable {
   private void sendUnknownRevisionIdAlertEmail() {
     gmailClient.sendEmail(
         EmailMessage.newBuilder()
-            .setFrom(gSuiteOutgoingEmailAddress)
             .setBody(String.format(RELOCK_UNKNOWN_ID_FAILURE_EMAIL_TEMPLATE, oldUnlockRevisionId))
             .setSubject("Error re-locking domain")
             .setRecipients(ImmutableSet.of(alertRecipientAddress))

core/src/main/java/google/registry/batch/SendExpiringCertificateNotificationEmailAction.java

@@ -72,21 +72,18 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
   private final String expirationWarningEmailBodyText;
   private final GmailClient gmailClient;
   private final String expirationWarningEmailSubjectText;
-  private final InternetAddress gSuiteOutgoingEmailAddress;
   private final Response response;
 
   @Inject
   public SendExpiringCertificateNotificationEmailAction(
       @Config("expirationWarningEmailBodyText") String expirationWarningEmailBodyText,
       @Config("expirationWarningEmailSubjectText") String expirationWarningEmailSubjectText,
-      @Config("gSuiteOutgoingEmailAddress") InternetAddress gSuiteOutgoingEmailAddress,
       GmailClient gmailClient,
       CertificateChecker certificateChecker,
       Response response) {
     this.certificateChecker = certificateChecker;
     this.expirationWarningEmailSubjectText = expirationWarningEmailSubjectText;
     this.gmailClient = gmailClient;
-    this.gSuiteOutgoingEmailAddress = gSuiteOutgoingEmailAddress;
     this.expirationWarningEmailBodyText = expirationWarningEmailBodyText;
     this.response = response;
   }
@@ -172,7 +169,6 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
       }
       gmailClient.sendEmail(
           EmailMessage.newBuilder()
-              .setFrom(gSuiteOutgoingEmailAddress)
               .setSubject(expirationWarningEmailSubjectText)
               .setBody(
                   getEmailBody(

core/src/main/java/google/registry/bsa/BsaEmailSender.java

@@ -0,0 +1,41 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.bsa;
+
+import google.registry.config.RegistryConfig.Config;
+import google.registry.groups.GmailClient;
+import google.registry.util.EmailMessage;
+import javax.inject.Inject;
+import javax.mail.internet.InternetAddress;
+
+/** Sends BSA-related email notifications. */
+class BsaEmailSender {
+
+  private final InternetAddress alertRecipientAddress;
+  private final GmailClient gmailClient;
+
+  @Inject
+  BsaEmailSender(
+      GmailClient gmailClient,
+      @Config("newAlertRecipientEmailAddress") InternetAddress alertRecipientAddress) {
+    this.alertRecipientAddress = alertRecipientAddress;
+    this.gmailClient = gmailClient;
+  }
+
+  /** Sends an email to the configured alert recipient. */
+  void sendNotification(String subject, String body) {
+    this.gmailClient.sendEmail(EmailMessage.create(subject, body, alertRecipientAddress));
+  }
+}

core/src/main/java/google/registry/bsa/BsaRefreshAction.java

@@ -14,6 +14,7 @@
 
 package google.registry.bsa;
 
+import static com.google.common.base.Throwables.getStackTraceAsString;
 import static google.registry.bsa.BsaStringUtils.LINE_SPLITTER;
 import static google.registry.request.Action.Method.GET;
 import static google.registry.request.Action.Method.POST;
@@ -55,6 +56,7 @@ public class BsaRefreshAction implements Runnable {
   private final BsaReportSender bsaReportSender;
   private final int transactionBatchSize;
   private final Duration domainCreateTxnCommitTimeLag;
+  private final BsaEmailSender emailSender;
   private final BsaLock bsaLock;
   private final Clock clock;
   private final Response response;
@@ -66,6 +68,7 @@ public class BsaRefreshAction implements Runnable {
       BsaReportSender bsaReportSender,
       @Config("bsaTxnBatchSize") int transactionBatchSize,
       @Config("domainCreateTxnCommitTimeLag") Duration domainCreateTxnCommitTimeLag,
+      BsaEmailSender emailSender,
       BsaLock bsaLock,
       Clock clock,
       Response response) {
@@ -74,6 +77,7 @@ public class BsaRefreshAction implements Runnable {
     this.bsaReportSender = bsaReportSender;
     this.transactionBatchSize = transactionBatchSize;
     this.domainCreateTxnCommitTimeLag = domainCreateTxnCommitTimeLag;
+    this.emailSender = emailSender;
     this.bsaLock = bsaLock;
     this.clock = clock;
     this.response = response;
@@ -83,11 +87,15 @@ public class BsaRefreshAction implements Runnable {
   public void run() {
     try {
       if (!bsaLock.executeWithLock(this::runWithinLock)) {
-        logger.atInfo().log("Job is being executed by another worker.");
+        String message = "BSA refresh did not run: another BSA related task is running";
+        logger.atInfo().log("%s.", message);
+        emailSender.sendNotification(message, /* body= */ "");
+      } else {
+        emailSender.sendNotification("BSA refreshed successfully", "");
       }
     } catch (Throwable throwable) {
-      // TODO(12/31/2023): consider sending an alert email.
-      logger.atWarning().withCause(throwable).log("Failed to update block lists.");
+      logger.atWarning().withCause(throwable).log("Failed to refresh BSA data.");
+      emailSender.sendNotification("BSA refresh aborted", getStackTraceAsString(throwable));
     }
     // Always return OK. No need to use a retrier on `runWithinLock`. Its individual steps are
     // implicitly retried. If action fails, the next cron will continue at checkpoint.

core/src/main/java/google/registry/bsa/BsaValidateAction.java

@@ -0,0 +1,180 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.bsa;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Throwables.getStackTraceAsString;
+import static google.registry.bsa.BsaTransactions.bsaQuery;
+import static google.registry.bsa.persistence.Queries.batchReadBsaLabelText;
+import static google.registry.request.Action.Method.GET;
+import static google.registry.request.Action.Method.POST;
+import static javax.servlet.http.HttpServletResponse.SC_OK;
+
+import com.google.common.base.Joiner;
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Iterables;
+import com.google.common.collect.Sets;
+import com.google.common.collect.Sets.SetView;
+import com.google.common.flogger.FluentLogger;
+import google.registry.bsa.persistence.DownloadScheduler;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.request.Action;
+import google.registry.request.Response;
+import google.registry.request.auth.Auth;
+import java.util.Optional;
+import java.util.stream.Stream;
+import javax.inject.Inject;
+
+/** Validates the BSA data in the database against the most recent block lists. */
+@Action(
+    service = Action.Service.BSA,
+    path = BsaValidateAction.PATH,
+    method = {GET, POST},
+    auth = Auth.AUTH_API_ADMIN)
+public class BsaValidateAction implements Runnable {
+
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  static final String PATH = "/_dr/task/bsaValidate";
+  private final GcsClient gcsClient;
+  private final BsaEmailSender emailSender;
+  private final int transactionBatchSize;
+  private final BsaLock bsaLock;
+  private final Response response;
+
+  @Inject
+  BsaValidateAction(
+      GcsClient gcsClient,
+      BsaEmailSender emailSender,
+      @Config("bsaTxnBatchSize") int transactionBatchSize,
+      BsaLock bsaLock,
+      Response response) {
+    this.gcsClient = gcsClient;
+    this.emailSender = emailSender;
+    this.transactionBatchSize = transactionBatchSize;
+    this.bsaLock = bsaLock;
+    this.response = response;
+  }
+
+  @Override
+  public void run() {
+    try {
+      if (!bsaLock.executeWithLock(this::runWithinLock)) {
+        String message = "BSA validation did not run: another BSA related task is running";
+        logger.atInfo().log("%s.", message);
+        emailSender.sendNotification(message, /* body= */ "");
+      }
+    } catch (Throwable throwable) {
+      logger.atWarning().withCause(throwable).log("Failed to validate block lists.");
+      emailSender.sendNotification("BSA validation aborted", getStackTraceAsString(throwable));
+    }
+    // Always return OK. No need to retry since all queries and GCS accesses are already
+    // implicitly retried.
+    response.setStatus(SC_OK);
+  }
+
+  /** Executes the validation action while holding the BSA lock. */
+  Void runWithinLock() {
+    Optional<String> downloadJobName =
+        bsaQuery(DownloadScheduler::fetchMostRecentDownloadJobIdIfCompleted);
+    if (downloadJobName.isEmpty()) {
+      logger.atInfo().log("Cannot validate: block list downloads not found.");
+      emailSender.sendNotification(
+          "BSA validation does not run: block list downloads not found", "");
+      return null;
+    }
+    logger.atInfo().log("Validating BSA with latest download: %s", downloadJobName.get());
+
+    ImmutableList.Builder<String> errorsBuilder = new ImmutableList.Builder<>();
+    errorsBuilder.addAll(checkBsaLabels(downloadJobName.get()));
+
+    ImmutableList<String> errors = errorsBuilder.build();
+
+    String resultSummary =
+        errors.isEmpty()
+            ? "BSA validation completed: no errors found"
+            : "BSA validation completed with errors";
+
+    emailValidationResults(resultSummary, downloadJobName.get(), errors);
+    logger.atInfo().log("Finished validating BSA with latest download: %s", downloadJobName.get());
+    return null;
+  }
+
+  void emailValidationResults(String subject, String jobName, ImmutableList<String> results) {
+    String body =
+        String.format("Most recent download is %s.\n\n", jobName) + Joiner.on('\n').join(results);
+    emailSender.sendNotification(subject, body);
+  }
+
+  ImmutableList<String> checkBsaLabels(String jobName) {
+    ImmutableSet<String> downloadedLabels = fetchDownloadedLabels(jobName);
+    ImmutableSet<String> persistedLabels = fetchPersistedLabels(transactionBatchSize);
+    ImmutableList.Builder<String> errors = new ImmutableList.Builder<>();
+
+    int nErrorExamples = 10;
+    SetView<String> missingLabels = Sets.difference(downloadedLabels, persistedLabels);
+    if (!missingLabels.isEmpty()) {
+      String examples = Joiner.on(',').join(Iterables.limit(missingLabels, nErrorExamples));
+      String errorMessage =
+          String.format(
+              "Found %d missing labels in the DB. Examples: [%s]", missingLabels.size(), examples);
+      logger.atInfo().log(errorMessage);
+      errors.add(errorMessage);
+    }
+    SetView<String> unexpectedLabels = Sets.difference(persistedLabels, downloadedLabels);
+    if (!unexpectedLabels.isEmpty()) {
+      String examples = Joiner.on(',').join(Iterables.limit(unexpectedLabels, nErrorExamples));
+      String errorMessage =
+          String.format(
+              "Found %d unexpected labels in the DB. Examples: [%s]",
+              unexpectedLabels.size(), examples);
+      logger.atInfo().log(errorMessage);
+      errors.add(errorMessage);
+    }
+    return errors.build();
+  }
+
+  /** Returns unique labels across all block lists in the download specified by {@code jobName}. */
+  ImmutableSet<String> fetchDownloadedLabels(String jobName) {
+    ImmutableSet.Builder<String> labelsBuilder = new ImmutableSet.Builder<>();
+    for (BlockListType blockListType : BlockListType.values()) {
+      try (Stream<String> lines = gcsClient.readBlockList(jobName, blockListType)) {
+        lines.skip(1).map(BsaValidateAction::parseBlockListLine).forEach(labelsBuilder::add);
+      }
+    }
+    return labelsBuilder.build();
+  }
+
+  ImmutableSet<String> fetchPersistedLabels(int batchSize) {
+    ImmutableSet.Builder<String> labelsBuilder = new ImmutableSet.Builder<>();
+    ImmutableList<String> batch;
+    Optional<String> lastRead = Optional.empty();
+    do {
+      batch = batchReadBsaLabelText(lastRead, batchSize);
+      batch.forEach(labelsBuilder::add);
+      if (!batch.isEmpty()) {
+        lastRead = Optional.of(Iterables.getLast(batch));
+      }
+    } while (batch.size() == batchSize);
+    return labelsBuilder.build();
+  }
+
+  static String parseBlockListLine(String line) {
+    int firstComma = line.indexOf(',');
+    checkArgument(firstComma > 0, "Invalid block list line: %s", line);
+    return line.substring(0, firstComma);
+  }
+}

core/src/main/java/google/registry/bsa/UploadBsaUnavailableDomainsAction.java

@@ -91,6 +91,7 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
   String gcsBucket;
 
   String apiUrl;
+  BsaEmailSender emailSender;
 
   google.registry.request.Response response;
 
@@ -99,6 +100,7 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
       Clock clock,
       BsaCredential bsaCredential,
       GcsUtils gcsUtils,
+      BsaEmailSender emailSender,
       @Config("bsaUnavailableDomainsGcsBucket") String gcsBucket,
       @Config("bsaUploadUnavailableDomainsUrl") String apiUrl,
       google.registry.request.Response response) {
@@ -107,6 +109,7 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
     this.gcsUtils = gcsUtils;
     this.gcsBucket = gcsBucket;
     this.apiUrl = apiUrl;
+    this.emailSender = emailSender;
     this.response = response;
   }
 
@@ -118,26 +121,36 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
     String unavailableDomains = Joiner.on("\n").join(getUnavailableDomains(runTime));
     if (unavailableDomains.isEmpty()) {
       logger.atWarning().log("No unavailable domains found; terminating.");
+      emailSender.sendNotification(
+          "BSA daily upload found no domains to upload", "This is unexpected. Please investigate.");
     } else {
-      uploadToGcs(unavailableDomains, runTime);
-      uploadToBsa(unavailableDomains, runTime);
+      boolean isGcsSuccess = uploadToGcs(unavailableDomains, runTime);
+      boolean isBsaSuccess = uploadToBsa(unavailableDomains, runTime);
+      if (isBsaSuccess && isGcsSuccess) {
+        emailSender.sendNotification("BSA daily upload completed successfully", "");
+      } else {
+        emailSender.sendNotification(
+            "BSA daily upload completed with errors", "Please see logs for details.");
+      }
     }
   }
 
   /** Uploads the unavailable domains list to GCS in the unavailable domains bucket. */
-  void uploadToGcs(String unavailableDomains, DateTime runTime) {
+  boolean uploadToGcs(String unavailableDomains, DateTime runTime) {
     logger.atInfo().log("Uploading unavailable names file to GCS in bucket %s", gcsBucket);
     BlobId blobId = BlobId.of(gcsBucket, createFilename(runTime));
     try (OutputStream gcsOutput = gcsUtils.openOutputStream(blobId);
         Writer osWriter = new OutputStreamWriter(gcsOutput, US_ASCII)) {
       osWriter.write(unavailableDomains);
+      return true;
     } catch (Exception e) {
       logger.atSevere().withCause(e).log(
           "Error writing BSA unavailable domains to GCS; skipping to BSA upload ...");
+      return false;
     }
   }
 
-  void uploadToBsa(String unavailableDomains, DateTime runTime) {
+  boolean uploadToBsa(String unavailableDomains, DateTime runTime) {
     try {
       byte[] gzippedContents = gzipUnavailableDomains(unavailableDomains);
       String sha512Hash = ByteSource.wrap(gzippedContents).hash(Hashing.sha512()).toString();
@@ -174,10 +187,12 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
             uploadResponse.code(),
             uploadResponse.body() == null ? "(none)" : uploadResponse.body().string());
       }
+      return true;
     } catch (IOException e) {
       logger.atSevere().withCause(e).log("Error while attempting to upload to BSA, aborting.");
       response.setStatus(HttpStatusCodes.STATUS_CODE_SERVER_ERROR);
       response.setPayload("Error while attempting to upload to BSA: " + e.getMessage());
+      return false;
     }
   }
 

core/src/main/java/google/registry/bsa/persistence/BsaLabelUtils.java

@@ -33,7 +33,7 @@ import google.registry.persistence.VKey;
 import java.time.Duration;
 import java.util.Map;
 import java.util.Optional;
-import org.apache.commons.lang3.stream.Streams;
+import java.util.Set;
 
 /** Helpers for {@link BsaLabel}. */
 public final class BsaLabelUtils {
@@ -41,7 +41,7 @@ public final class BsaLabelUtils {
   private BsaLabelUtils() {}
 
   static final CacheLoader<VKey<BsaLabel>, Optional<BsaLabel>> CACHE_LOADER =
-      new CacheLoader<VKey<BsaLabel>, Optional<BsaLabel>>() {
+      new CacheLoader<>() {
 
         @Override
         public Optional<BsaLabel> load(VKey<BsaLabel> key) {
@@ -49,11 +49,11 @@ public final class BsaLabelUtils {
         }
 
         @Override
-        public Map<VKey<BsaLabel>, Optional<BsaLabel>> loadAll(
-            Iterable<? extends VKey<BsaLabel>> keys) {
+        public Map<? extends VKey<BsaLabel>, ? extends Optional<BsaLabel>> loadAll(
+            Set<? extends VKey<BsaLabel>> keys) {
           ImmutableMap<VKey<? extends BsaLabel>, BsaLabel> existingLabels =
               replicaTm().reTransact(() -> replicaTm().loadByKeysIfPresent(keys));
-          return Streams.of(keys)
+          return keys.stream()
               .collect(
                   toImmutableMap(key -> key, key -> Optional.ofNullable(existingLabels.get(key))));
         }
@@ -75,7 +75,7 @@ public final class BsaLabelUtils {
    * <p>Since the cached BSA labels have the same usage pattern as the cached EppResources, the
    * cache configuration for the latter are reused here.
    */
-  private static LoadingCache<VKey<BsaLabel>, Optional<BsaLabel>> cacheBsaLabels =
+  private static final LoadingCache<VKey<BsaLabel>, Optional<BsaLabel>> cacheBsaLabels =
       createBsaLabelsCache(getEppResourceCachingDuration());
 
   private static LoadingCache<VKey<BsaLabel>, Optional<BsaLabel>> createBsaLabelsCache(

core/src/main/java/google/registry/bsa/persistence/DownloadScheduler.java

@@ -30,7 +30,6 @@ import google.registry.util.Clock;
 import java.util.Objects;
 import java.util.Optional;
 import javax.inject.Inject;
-import org.joda.time.DateTime;
 import org.joda.time.Duration;
 
 /**
@@ -115,16 +114,6 @@ public final class DownloadScheduler {
             });
   }
 
-  Optional<DateTime> latestCompletedJobTime() {
-    return tm().transact(
-            () -> {
-              return fetchTwoMostRecentDownloads().stream()
-                  .filter(job -> Objects.equals(job.getStage(), DONE))
-                  .map(BsaDownload::getCreationTime)
-                  .findFirst();
-            });
-  }
-
   private boolean isTimeAgain(BsaDownload mostRecent, Duration interval) {
     return mostRecent.getCreationTime().plus(interval).minus(CRON_JITTER).isBefore(clock.nowUtc());
   }
@@ -163,4 +152,14 @@ public final class DownloadScheduler {
   static Optional<BsaDownload> fetchMostRecentDownload() {
     return fetchTwoMostRecentDownloads().stream().findFirst();
   }
+
+  /**
+   * Returns the most recent download {@code jobName} if it has been fully processed, and {@code
+   * empty} if the download is still being processed.
+   */
+  public static Optional<String> fetchMostRecentDownloadJobIdIfCompleted() {
+    return fetchMostRecentDownload()
+        .filter(bsaDownload -> Objects.equals(bsaDownload.getStage(), DONE))
+        .map(BsaDownload::getJobName);
+  }
 }

core/src/main/java/google/registry/bsa/persistence/Queries.java

@@ -30,15 +30,33 @@ import java.util.stream.Stream;
 import org.joda.time.DateTime;
 
 /** Helpers for querying BSA JPA entities. */
-class Queries {
+public final class Queries {
 
   private Queries() {}
 
+  /**
+   * Entity objects that may be updated in the same query must be detached. See {@code
+   * JpaTransactionManagerImpl}.
+   */
   private static Object detach(Object obj) {
     em().detach(obj);
     return obj;
   }
 
+  public static ImmutableList<String> batchReadBsaLabelText(
+      Optional<String> lastRead, int batchSize) {
+
+    return ImmutableList.copyOf(
+        bsaQuery(
+            () ->
+                em().createQuery(
+                        "SELECT b.label FROM BsaLabel b WHERE b.label > :lastRead ORDER BY b.label",
+                        String.class)
+                    .setParameter("lastRead", lastRead.orElse(""))
+                    .setMaxResults(batchSize)
+                    .getResultList()));
+  }
+
   static Stream<BsaUnblockableDomain> queryBsaUnblockableDomainByLabels(
       ImmutableCollection<String> labels) {
     return ((Stream<?>)

core/src/main/java/google/registry/dns/PublishDnsUpdatesAction.java

@@ -118,7 +118,6 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
   private final String dnsUpdateFailRegistryName;
   private final Lazy<InternetAddress> registrySupportEmail;
   private final Lazy<InternetAddress> registryCcEmail;
-  private final InternetAddress gSuiteOutgoingEmailAddress;
 
   @Inject
   public PublishDnsUpdatesAction(
@@ -136,7 +135,6 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
       @Config("dnsUpdateFailRegistryName") String dnsUpdateFailRegistryName,
       @Config("registrySupportEmail") Lazy<InternetAddress> registrySupportEmail,
       @Config("registryCcEmail") Lazy<InternetAddress> registryCcEmail,
-      @Config("gSuiteOutgoingEmailAddress") InternetAddress gSuiteOutgoingEmailAddress,
       @Header(CLOUD_TASKS_RETRY_HEADER) int retryCount,
       DnsWriterProxy dnsWriterProxy,
       DnsMetrics dnsMetrics,
@@ -167,7 +165,6 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
     this.dnsUpdateFailRegistryName = dnsUpdateFailRegistryName;
     this.registrySupportEmail = registrySupportEmail;
     this.registryCcEmail = registryCcEmail;
-    this.gSuiteOutgoingEmailAddress = gSuiteOutgoingEmailAddress;
   }
 
   private void recordActionResult(ActionStatus status) {
@@ -309,7 +306,6 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
               .setSubject(dnsUpdateFailEmailSubjectText)
               .setRecipients(recipients)
               .addBcc(registryCcEmail.get())
-              .setFrom(gSuiteOutgoingEmailAddress)
               .build());
 
     } else {

core/src/main/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="alpha"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
   </static-files>

core/src/main/java/google/registry/env/alpha/bsa/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,16 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="alpha"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
 
   <!-- Enable external traffic to go through VPC, required for static ip -->
   <vpc-access-connector>

core/src/main/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="alpha"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>

core/src/main/java/google/registry/env/alpha/pubapi/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="alpha"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>

core/src/main/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="alpha"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>

core/src/main/java/google/registry/env/common/bsa/WEB-INF/web.xml

@@ -25,6 +25,12 @@
     <url-pattern>/_dr/task/bsaRefresh</url-pattern>
   </servlet-mapping>
 
+  <!-- Refresh action -->
+  <servlet-mapping>
+    <servlet-name>bsa-servlet</servlet-name>
+    <url-pattern>/_dr/task/bsaValidate</url-pattern>
+  </servlet-mapping>
+
   <!-- Upload unavailable domains to BSA action -->
   <servlet-mapping>
     <servlet-name>bsa-servlet</servlet-name>

core/src/main/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="crash"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
   </static-files>

core/src/main/java/google/registry/env/crash/bsa/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="crash"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <!-- Enable external traffic to go through VPC, required for static ip -->
   <vpc-access-connector>
     <name>projects/domain-registry-crash/locations/us-central1/connectors/appengine-connector</name>

core/src/main/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="crash"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>

core/src/main/java/google/registry/env/crash/pubapi/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="crash"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>

core/src/main/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="crash"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>

core/src/main/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
@@ -20,6 +21,10 @@
               value="/tmp/domain-registry-appengine-generated/local/"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html">
       <http-header name="Cache-Control" value="max-age=0,must-revalidate" />

core/src/main/java/google/registry/env/local/bsa/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
@@ -20,6 +21,10 @@
               value="/tmp/domain-registry-appengine-generated/local/"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html">
       <http-header name="Cache-Control" value="max-age=0,must-revalidate" />

core/src/main/java/google/registry/env/local/default/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
@@ -20,6 +21,10 @@
               value="/tmp/domain-registry-appengine-generated/local/"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html">
       <http-header name="Cache-Control" value="max-age=0,must-revalidate" />

core/src/main/java/google/registry/env/local/pubapi/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
@@ -20,6 +21,10 @@
               value="/tmp/domain-registry-appengine-generated/local/"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html">
       <http-header name="Cache-Control" value="max-age=0,must-revalidate" />

core/src/main/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
@@ -20,6 +21,10 @@
               value="/tmp/domain-registry-appengine-generated/local/"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html">
       <http-header name="Cache-Control" value="max-age=0,must-revalidate" />

core/src/main/java/google/registry/env/production/backend/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="production"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
   </static-files>

core/src/main/java/google/registry/env/production/bsa/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="production"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <!-- Enable external traffic to go through VPC, required for static ip -->
   <vpc-access-connector>
     <name>projects/domain-registry/locations/us-central1/connectors/appengine-connector</name>

core/src/main/java/google/registry/env/production/default/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -11,12 +11,17 @@
   </manual-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="production"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>

core/src/main/java/google/registry/env/production/default/WEB-INF/cloud-scheduler-tasks.xml

@@ -297,6 +297,18 @@
     <schedule>15,45 * * * *</schedule>
   </task>
 
+  <task>
+    <url><![CDATA[/_dr/task/bsaValidate]]></url>
+    <name>bsaValidate</name>
+    <service>bsa</service>
+    <description>
+      Validates the processed BSA data in the database against the original
+      block lists.
+    </description>
+    <!-- Runs twice daily. -->
+    <schedule>50 9,21 * * *</schedule>
+  </task>
+
   <task>
     <url><![CDATA[/_dr/task/uploadBsaUnavailableNames]]></url>
     <name>uploadBsaUnavailableNames</name>

core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -11,12 +11,17 @@
   </manual-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="production"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>

core/src/main/java/google/registry/env/production/tools/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="production"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>

core/src/main/java/google/registry/env/qa/backend/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="qa"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1h"/>
   </static-files>

core/src/main/java/google/registry/env/qa/bsa/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="qa"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1h"/>
   </static-files>

core/src/main/java/google/registry/env/qa/default/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -15,12 +15,17 @@
   </automatic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="qa"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1h"/>
     <include path="/assets/js/**" expiration="1h"/>

core/src/main/java/google/registry/env/qa/pubapi/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="qa"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1h"/>
     <include path="/assets/js/**" expiration="1h"/>

core/src/main/java/google/registry/env/qa/tools/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="qa"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1h"/>
     <include path="/assets/js/**" expiration="1h"/>

core/src/main/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="sandbox"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
   </static-files>

core/src/main/java/google/registry/env/sandbox/bsa/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="sandbox"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
   </static-files>

core/src/main/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -11,12 +11,17 @@
   </manual-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="sandbox"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>

core/src/main/java/google/registry/env/sandbox/pubapi/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -11,12 +11,17 @@
   </manual-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="sandbox"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>

core/src/main/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="sandbox"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>

core/src/main/java/google/registry/groups/GmailClient.java

@@ -79,9 +79,6 @@ public final class GmailClient {
 
   /**
    * Sends {@code emailMessage} using {@link Gmail}.
-   *
-   * <p>If the sender as specified by {@link EmailMessage#from} differs from the caller's identity,
-   * the caller must have delegated `send` authority to the sender.
    */
   public void sendEmail(EmailMessage emailMessage) {
     if (!isEmailSendingEnabled) {

core/src/main/java/google/registry/keyring/api/PgpHelper.java

@@ -73,21 +73,17 @@ public final class PgpHelper {
    */
   public static PGPPublicKey lookupPublicKey(
       PGPPublicKeyRingCollection keyring, String query, KeyRequirement want) {
-    try {
-      Iterator<PGPPublicKeyRing> results =
-          keyring.getKeyRings(checkNotNull(query, "query"), true, true);
-      verify(results.hasNext(), "No public key found matching substring: %s", query);
-      while (results.hasNext()) {
-        Optional<PGPPublicKey> result = lookupPublicSubkey(results.next(), want);
-        if (result.isPresent()) {
-          return result.get();
-        }
+    Iterator<PGPPublicKeyRing> results =
+        keyring.getKeyRings(checkNotNull(query, "query"), true, true);
+    verify(results.hasNext(), "No public key found matching substring: %s", query);
+    while (results.hasNext()) {
+      Optional<PGPPublicKey> result = lookupPublicSubkey(results.next(), want);
+      if (result.isPresent()) {
+        return result.get();
       }
-      throw new VerifyException(String.format(
-          "No public key (%s) found matching substring: %s", want, query));
-    } catch (PGPException e) {
-      throw new VerifyException(String.format("Public key lookup failed for query: %s", query), e);
     }
+    throw new VerifyException(
+        String.format("No public key (%s) found matching substring: %s", want, query));
   }
 
   /**

core/src/main/java/google/registry/model/EppResource.java

@@ -354,7 +354,7 @@ public abstract class EppResource extends UpdateAutoTimestampEntity implements B
   }
 
   static final CacheLoader<VKey<? extends EppResource>, EppResource> CACHE_LOADER =
-      new CacheLoader<VKey<? extends EppResource>, EppResource>() {
+      new CacheLoader<>() {
 
         @Override
         public EppResource load(VKey<? extends EppResource> key) {
@@ -362,8 +362,8 @@ public abstract class EppResource extends UpdateAutoTimestampEntity implements B
         }
 
         @Override
-        public Map<VKey<? extends EppResource>, EppResource> loadAll(
-            Iterable<? extends VKey<? extends EppResource>> keys) {
+        public Map<? extends VKey<? extends EppResource>, ? extends EppResource> loadAll(
+            Set<? extends VKey<? extends EppResource>> keys) {
           return replicaTm().reTransact(() -> replicaTm().loadByKeys(keys));
         }
       };

core/src/main/java/google/registry/model/ForeignKeyUtils.java

@@ -29,7 +29,6 @@ import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Maps;
-import com.google.common.collect.Streams;
 import google.registry.config.RegistryConfig;
 import google.registry.model.contact.Contact;
 import google.registry.model.domain.Domain;
@@ -42,6 +41,7 @@ import java.util.Collection;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Optional;
+import java.util.Set;
 import javax.annotation.Nullable;
 import org.joda.time.DateTime;
 
@@ -83,7 +83,7 @@ public final class ForeignKeyUtils {
    * active at or after the specified moment in time.
    *
    * <p>The returned map will omit any foreign keys for which the {@link EppResource} doesn't exist
-   * or has been soft deleted.
+   * or has been soft-deleted.
    */
   public static <E extends EppResource> ImmutableMap<String, VKey<E>> load(
       Class<E> clazz, Collection<String> foreignKeys, final DateTime now) {
@@ -94,7 +94,7 @@ public final class ForeignKeyUtils {
 
   /**
    * Helper method to load {@link VKey}s to all the most recent {@link EppResource}s for the given
-   * foreign keys, regardless of whether or not they have been soft-deleted.
+   * foreign keys, regardless of whether they have been soft-deleted.
    *
    * <p>Used by both the cached (w/o deletion check) and the non-cached (with deletion check) calls.
    *
@@ -129,24 +129,25 @@ public final class ForeignKeyUtils {
 
   private static final CacheLoader<VKey<? extends EppResource>, Optional<MostRecentResource>>
       CACHE_LOADER =
-          new CacheLoader<VKey<? extends EppResource>, Optional<MostRecentResource>>() {
+          new CacheLoader<>() {
 
             @Override
             public Optional<MostRecentResource> load(VKey<? extends EppResource> key) {
-              return loadAll(ImmutableList.of(key)).get(key);
+              return loadAll(ImmutableSet.of(key)).get(key);
             }
 
             @Override
-            public Map<VKey<? extends EppResource>, Optional<MostRecentResource>> loadAll(
-                Iterable<? extends VKey<? extends EppResource>> keys) {
-              if (!keys.iterator().hasNext()) {
+            public Map<
+                    ? extends VKey<? extends EppResource>, ? extends Optional<MostRecentResource>>
+                loadAll(Set<? extends VKey<? extends EppResource>> keys) {
+              if (keys.isEmpty()) {
                 return ImmutableMap.of();
               }
               // It is safe to use the resource type of first element because when this function is
               // called, it is always passed with a list of VKeys with the same type.
               Class<? extends EppResource> clazz = keys.iterator().next().getKind();
               ImmutableList<String> foreignKeys =
-                  Streams.stream(keys).map(key -> (String) key.getKey()).collect(toImmutableList());
+                  keys.stream().map(key -> (String) key.getKey()).collect(toImmutableList());
               ImmutableMap<String, MostRecentResource> existingKeys =
                   ForeignKeyUtils.load(clazz, foreignKeys, true);
               // The above map only contains keys that exist in the database, so we re-add the
@@ -166,7 +167,7 @@ public final class ForeignKeyUtils {
    *
    * <p>Note that here the key of the {@link LoadingCache} is of type {@code VKey<? extends
    * EppResource>}, but they are not legal {@link VKey}s to {@link EppResource}s, whose keys are the
-   * SQL primary keys, i.e. the {@code repoId}s. Instead, their keys are the foreign keys used to
+   * SQL primary keys, i.e., the {@code repoId}s. Instead, their keys are the foreign keys used to
    * query the database. We use {@link VKey} here because it is a convenient composite class that
    * contains both the resource type and the foreign key, which are needed to for the query and
    * caching.
@@ -199,7 +200,7 @@ public final class ForeignKeyUtils {
    * that are active at or after the specified moment in time, using the cache if enabled.
    *
    * <p>The returned map will omit any keys for which the {@link EppResource} doesn't exist or has
-   * been soft deleted.
+   * been soft-deleted.
    *
    * <p>Don't use the cached version of this method unless you really need it for performance
    * reasons, and are OK with the trade-offs in loss of transactional consistency.

core/src/main/java/google/registry/model/domain/token/AllocationToken.java

@@ -322,19 +322,18 @@ public class AllocationToken extends UpdateAutoTimestampEntity implements Builda
       ALLOCATION_TOKENS_CACHE =
           CacheUtils.newCacheBuilder(getSingletonCacheRefreshDuration())
               .build(
-                  new CacheLoader<VKey<AllocationToken>, Optional<AllocationToken>>() {
+                  new CacheLoader<>() {
                     @Override
                     public Optional<AllocationToken> load(VKey<AllocationToken> key) {
                       return tm().reTransact(() -> tm().loadByKeyIfPresent(key));
                     }
 
                     @Override
-                    public Map<VKey<AllocationToken>, Optional<AllocationToken>> loadAll(
-                        Iterable<? extends VKey<AllocationToken>> keys) {
-                      ImmutableSet<VKey<AllocationToken>> keySet = ImmutableSet.copyOf(keys);
+                    public Map<? extends VKey<AllocationToken>, ? extends Optional<AllocationToken>>
+                        loadAll(Set<? extends VKey<AllocationToken>> keys) {
                       return tm().reTransact(
                               () ->
-                                  keySet.stream()
+                                  keys.stream()
                                       .collect(
                                           toImmutableMap(
                                               key -> key, key -> tm().loadByKeyIfPresent(key))));

core/src/main/java/google/registry/model/tld/Tld.java

@@ -16,8 +16,8 @@ package google.registry.model.tld;
 
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
+import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
-import static com.google.common.collect.Maps.toMap;
 import static google.registry.config.RegistryConfig.getSingletonCacheRefreshDuration;
 import static google.registry.model.EntityYamlUtils.createObjectMapper;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
@@ -106,7 +106,7 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
   @Column(name = "tld_name", nullable = false)
   String tldStr;
 
-  /** The suffix that identifies roids as belonging to this specific tld, e.g. -HOW for .how. */
+  /** The suffix that identifies roids as belonging to this specific tld, e.g., -HOW for .how. */
   String roidSuffix;
 
   /** Default values for all the relevant TLD parameters. */
@@ -234,7 +234,7 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
   private static final LoadingCache<String, Tld> CACHE =
       CacheUtils.newCacheBuilder(getSingletonCacheRefreshDuration())
           .build(
-              new CacheLoader<String, Tld>() {
+              new CacheLoader<>() {
                 @Override
                 public Tld load(final String tld) {
                   return tm().reTransact(() -> tm().loadByKeyIfPresent(createVKey(tld)))
@@ -242,9 +242,9 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
                 }
 
                 @Override
-                public Map<String, Tld> loadAll(Iterable<? extends String> tlds) {
+                public Map<? extends String, ? extends Tld> loadAll(Set<? extends String> tlds) {
                   ImmutableMap<String, VKey<Tld>> keysMap =
-                      toMap(ImmutableSet.copyOf(tlds), Tld::createVKey);
+                      tlds.stream().collect(toImmutableMap(tld -> tld, Tld::createVKey));
                   Map<VKey<? extends Tld>, Tld> entities =
                       tm().reTransact(() -> tm().loadByKeysIfPresent(keysMap.values()));
                   return Maps.transformEntries(keysMap, (k, v) -> entities.getOrDefault(v, null));

core/src/main/java/google/registry/module/RequestComponent.java

@@ -29,6 +29,7 @@ import google.registry.batch.SendExpiringCertificateNotificationEmailAction;
 import google.registry.batch.WipeOutContactHistoryPiiAction;
 import google.registry.bsa.BsaDownloadAction;
 import google.registry.bsa.BsaRefreshAction;
+import google.registry.bsa.BsaValidateAction;
 import google.registry.bsa.UploadBsaUnavailableDomainsAction;
 import google.registry.cron.CronModule;
 import google.registry.cron.TldFanoutAction;
@@ -167,6 +168,8 @@ interface RequestComponent {
 
   BsaRefreshAction bsaRefreshAction();
 
+  BsaValidateAction bsaValidateAction();
+
   CannedScriptExecutionAction cannedScriptExecutionAction();
 
   CheckApiAction checkApiAction();

core/src/main/java/google/registry/module/backend/BackendRequestComponent.java

@@ -99,7 +99,7 @@ import google.registry.tmch.TmchSmdrlAction;
       VoidDnsWriterModule.class,
       WhiteboxModule.class,
     })
-interface BackendRequestComponent {
+public interface BackendRequestComponent {
 
   BrdaCopyAction brdaCopyAction();
 

core/src/main/java/google/registry/module/bsa/BsaComponent.java

@@ -19,6 +19,7 @@ import dagger.Component;
 import dagger.Lazy;
 import google.registry.config.CredentialModule;
 import google.registry.config.RegistryConfig.ConfigModule;
+import google.registry.groups.GmailModule;
 import google.registry.keyring.KeyringModule;
 import google.registry.keyring.secretmanager.SecretManagerKeyringModule;
 import google.registry.module.bsa.BsaRequestComponent.BsaRequestComponentModule;
@@ -39,6 +40,7 @@ import javax.inject.Singleton;
       BsaRequestComponentModule.class,
       ConfigModule.class,
       CredentialModule.class,
+      GmailModule.class,
       GsonModule.class,
       PersistenceModule.class,
       KeyringModule.class,

core/src/main/java/google/registry/module/bsa/BsaRequestComponent.java

@@ -18,6 +18,7 @@ import dagger.Module;
 import dagger.Subcomponent;
 import google.registry.bsa.BsaDownloadAction;
 import google.registry.bsa.BsaRefreshAction;
+import google.registry.bsa.BsaValidateAction;
 import google.registry.bsa.UploadBsaUnavailableDomainsAction;
 import google.registry.request.Modules.UrlConnectionServiceModule;
 import google.registry.request.RequestComponentBuilder;
@@ -26,12 +27,14 @@ import google.registry.request.RequestScope;
 
 @RequestScope
 @Subcomponent(modules = {RequestModule.class, UrlConnectionServiceModule.class})
-interface BsaRequestComponent {
+public interface BsaRequestComponent {
 
   BsaDownloadAction bsaDownloadAction();
 
   BsaRefreshAction bsaRefreshAction();
 
+  BsaValidateAction bsaValidateAction();
+
   UploadBsaUnavailableDomainsAction uploadBsaUnavailableDomains();
 
   @Subcomponent.Builder

core/src/main/java/google/registry/module/frontend/FrontendRequestComponent.java

@@ -53,7 +53,7 @@ import google.registry.ui.server.registrar.RegistryLockVerifyAction;
       RequestModule.class,
       WhiteboxModule.class,
     })
-interface FrontendRequestComponent {
+public interface FrontendRequestComponent {
   ConsoleDomainGetAction consoleDomainGetAction();
 
   ConsoleDomainListAction consoleDomainListAction();

core/src/main/java/google/registry/module/pubapi/PubApiRequestComponent.java

@@ -50,7 +50,7 @@ import google.registry.whois.WhoisModule;
       WhiteboxModule.class,
       WhoisModule.class,
     })
-interface PubApiRequestComponent {
+public interface PubApiRequestComponent {
   CheckApiAction checkApiAction();
   RdapAutnumAction rdapAutnumAction();
   RdapDomainAction rdapDomainAction();

core/src/main/java/google/registry/module/tools/ToolsRequestComponent.java

@@ -49,7 +49,7 @@ import google.registry.tools.server.VerifyOteAction;
       ToolsServerModule.class,
       WhiteboxModule.class,
     })
-interface ToolsRequestComponent {
+public interface ToolsRequestComponent {
   CreateGroupsAction createGroupsAction();
   EppToolAction eppToolAction();
   FlowComponent.Builder flowComponentBuilder();

core/src/main/java/google/registry/persistence/PersistenceComponent.java

@@ -18,7 +18,7 @@ import dagger.Component;
 import google.registry.config.CredentialModule;
 import google.registry.config.RegistryConfig.ConfigModule;
 import google.registry.keyring.secretmanager.SecretManagerKeyringModule;
-import google.registry.persistence.PersistenceModule.AppEngineJpaTm;
+import google.registry.persistence.PersistenceModule.DefaultJpaTm;
 import google.registry.persistence.PersistenceModule.ReadOnlyReplicaJpaTm;
 import google.registry.persistence.transaction.JpaTransactionManager;
 import google.registry.privileges.secretmanager.SecretManagerModule;
@@ -39,8 +39,8 @@ import javax.persistence.EntityManagerFactory;
     })
 public interface PersistenceComponent {
 
-  @AppEngineJpaTm
-  JpaTransactionManager appEngineJpaTransactionManager();
+  @DefaultJpaTm
+  JpaTransactionManager jpaTransactionManager();
 
   @ReadOnlyReplicaJpaTm
   JpaTransactionManager readOnlyReplicaJpaTransactionManager();

core/src/main/java/google/registry/persistence/PersistenceModule.java

@@ -220,8 +220,8 @@ public abstract class PersistenceModule {
 
   @Provides
   @Singleton
-  @AppEngineJpaTm
-  static JpaTransactionManager provideAppEngineJpaTm(
+  @DefaultJpaTm
+  static JpaTransactionManager provideDefaultJpaTm(
       SqlCredentialStore credentialStore,
       @PartialCloudSqlConfigs ImmutableMap<String, String> cloudSqlConfigs,
       Clock clock) {
@@ -380,10 +380,10 @@ public abstract class PersistenceModule {
   @Documented
   public @interface SchemaManagerConnection {}
 
-  /** Dagger qualifier for {@link JpaTransactionManager} used for App Engine application. */
+  /** Dagger qualifier for {@link JpaTransactionManager} used by default. */
   @Qualifier
   @Documented
-  @interface AppEngineJpaTm {}
+  @interface DefaultJpaTm {}
 
   /** Dagger qualifier for {@link JpaTransactionManager} used inside BEAM pipelines. */
   @Qualifier

core/src/main/java/google/registry/persistence/transaction/TransactionManagerFactory.java

@@ -17,9 +17,8 @@ package google.registry.persistence.transaction;
 import static com.google.common.base.Preconditions.checkState;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 
-import com.google.appengine.api.utils.SystemProperty;
-import com.google.appengine.api.utils.SystemProperty.Environment.Value;
 import com.google.common.base.Suppliers;
+import com.google.common.collect.ImmutableSet;
 import google.registry.persistence.DaggerPersistenceComponent;
 import google.registry.tools.RegistryToolEnvironment;
 import google.registry.util.NonFinalForTesting;
@@ -29,6 +28,9 @@ import java.util.function.Supplier;
 /** Factory class to create {@link TransactionManager} instance. */
 public final class TransactionManagerFactory {
 
+  private static final ImmutableSet<RegistryEnvironment> NON_SERVING_ENVS =
+      ImmutableSet.of(RegistryEnvironment.UNITTEST, RegistryEnvironment.LOCAL);
+
   /** Supplier for jpaTm so that it is initialized only once, upon first usage. */
   @NonFinalForTesting
   private static Supplier<JpaTransactionManager> jpaTm =
@@ -43,34 +45,21 @@ public final class TransactionManagerFactory {
   private static JpaTransactionManager createJpaTransactionManager() {
     // If we are running a nomulus command, jpaTm will be injected in RegistryCli.java
     // by calling setJpaTm().
-    if (isInAppEngine()) {
-      return DaggerPersistenceComponent.create().appEngineJpaTransactionManager();
+    if (!NON_SERVING_ENVS.contains(RegistryEnvironment.get())) {
+      return DaggerPersistenceComponent.create().jpaTransactionManager();
     } else {
       return DummyJpaTransactionManager.create();
     }
   }
 
   private static JpaTransactionManager createReplicaJpaTransactionManager() {
-    if (isInAppEngine()) {
+    if (RegistryEnvironment.get() != RegistryEnvironment.UNITTEST) {
       return DaggerPersistenceComponent.create().readOnlyReplicaJpaTransactionManager();
     } else {
       return DummyJpaTransactionManager.create();
     }
   }
 
-  /**
-   * This function uses App Engine API to determine if the current runtime environment is App
-   * Engine.
-   *
-   * @see <a
-   *     href="https://cloud.google.com/appengine/docs/standard/java/javadoc/com/google/appengine/api/utils/SystemProperty">App
-   *     Engine API public doc</a>
-   */
-  private static boolean isInAppEngine() {
-    // SystemProperty.environment.value() returns null if the current runtime is local JVM
-    return SystemProperty.environment.value() == Value.Production;
-  }
-
   /**
    * Returns {@link JpaTransactionManager} instance.
    *

core/src/main/java/google/registry/reporting/billing/BillingEmailUtils.java

@@ -37,7 +37,6 @@ public class BillingEmailUtils {
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
   private final GmailClient gmailClient;
   private final YearMonth yearMonth;
-  private final InternetAddress outgoingEmailAddress;
   private final InternetAddress alertRecipientAddress;
   private final ImmutableList<InternetAddress> invoiceEmailRecipients;
   private final Optional<InternetAddress> replyToEmailAddress;
@@ -51,7 +50,6 @@ public class BillingEmailUtils {
   BillingEmailUtils(
       GmailClient gmailClient,
       YearMonth yearMonth,
-      @Config("gSuiteOutgoingEmailAddress") InternetAddress outgoingEmailAddress,
       @Config("newAlertRecipientEmailAddress") InternetAddress alertRecipientAddress,
       @Config("invoiceEmailRecipients") ImmutableList<InternetAddress> invoiceEmailRecipients,
       @Config("invoiceReplyToEmailAddress") Optional<InternetAddress> replyToEmailAddress,
@@ -62,7 +60,6 @@ public class BillingEmailUtils {
       GcsUtils gcsUtils) {
     this.gmailClient = gmailClient;
     this.yearMonth = yearMonth;
-    this.outgoingEmailAddress = outgoingEmailAddress;
     this.alertRecipientAddress = alertRecipientAddress;
     this.invoiceEmailRecipients = invoiceEmailRecipients;
     this.replyToEmailAddress = replyToEmailAddress;
@@ -94,7 +91,6 @@ public class BillingEmailUtils {
                       "<p>Use the following link to download %s invoice for the domain registry -"
                           + " <a href=\"%s\">invoice</a>.</p>",
                       yearMonth, fileUrl))
-              .setFrom(outgoingEmailAddress)
               .setRecipients(invoiceEmailRecipients)
               .setReplyToEmailAddress(replyToEmailAddress)
               .setContentType(MediaType.HTML_UTF_8)
@@ -115,7 +111,6 @@ public class BillingEmailUtils {
               .setSubject(String.format("Billing Pipeline Alert: %s", yearMonth))
               .setBody(body)
               .addRecipient(alertRecipientAddress)
-              .setFrom(outgoingEmailAddress)
               .build());
     } catch (Throwable e) {
       throw new RuntimeException("The alert e-mail system failed.", e);

core/src/main/java/google/registry/reporting/icann/IcannReportingStagingAction.java

@@ -82,7 +82,6 @@ public final class IcannReportingStagingAction implements Runnable {
   @Inject IcannReportingStager stager;
   @Inject Retrier retrier;
   @Inject Response response;
-  @Inject @Config("gSuiteOutgoingEmailAddress") InternetAddress sender;
 
   @Inject
   @Config("newAlertRecipientEmailAddress")
@@ -115,7 +114,6 @@ public final class IcannReportingStagingAction implements Runnable {
                             "Completed staging the following %d ICANN reports:\n%s",
                             manifestedFiles.size(), Joiner.on('\n').join(manifestedFiles)))
                     .addRecipient(recipient)
-                    .setFrom(sender)
                     .build());
 
             response.setStatus(SC_OK);
@@ -139,8 +137,7 @@ public final class IcannReportingStagingAction implements Runnable {
               "ICANN Monthly report staging summary [FAILURE]",
               String.format(
                   "Staging failed due to %s, check logs for more details.", getRootCause(e)),
-              recipient,
-              sender));
+              recipient));
       response.setStatus(SC_INTERNAL_SERVER_ERROR);
       response.setContentType(MediaType.PLAIN_TEXT_UTF_8);
       response.setPayload(

core/src/main/java/google/registry/reporting/icann/IcannReportingUploadAction.java

@@ -63,7 +63,7 @@ import org.joda.time.Duration;
  * <p>Parameters:
  *
  * <p>subdir: the subdirectory of gs://[project-id]-reporting/ to retrieve reports from. For
- * example: "manual/dir" means reports will be stored under gs://[project-id]-reporting/manual/dir.
+ * example, "manual/dir" means reports will be stored under gs://[project-id]-reporting/manual/dir.
  * Defaults to "icann/monthly/[last month in yyyy-MM format]".
  */
 @Action(
@@ -86,7 +86,6 @@ public final class IcannReportingUploadAction implements Runnable {
   @Inject IcannHttpReporter icannReporter;
   @Inject Retrier retrier;
   @Inject Response response;
-  @Inject @Config("gSuiteOutgoingEmailAddress") InternetAddress sender;
 
   @Inject
   @Config("newAlertRecipientEmailAddress")
@@ -99,6 +98,17 @@ public final class IcannReportingUploadAction implements Runnable {
   @Inject
   IcannReportingUploadAction() {}
 
+  /**
+   * Get the scheduled time for the next month of the given {@link DateTime}.
+   *
+   * <p>The scheduled time is always the second day of next month at 10AM UTC. This is because the
+   * staging action is scheduled to run at 9AM UTC on that day, and there is no reason to run the
+   * upload job before that. See {@code icannReportingStaging} in {@code cloud-scheduler.xml}.
+   */
+  private static DateTime getScheduledTimeForCurrentMonth(DateTime time) {
+    return time.withDayOfMonth(2).withHourOfDay(10).withMinuteOfHour(0).plusMonths(1);
+  }
+
   @Override
   public void run() {
     if (!lockHandler.executeWithLocks(
@@ -171,12 +181,10 @@ public final class IcannReportingUploadAction implements Runnable {
     if (success) {
       Cursor newCursor =
           Cursor.createScoped(
-              cursorType,
-              cursorTime.withTimeAtStartOfDay().withDayOfMonth(1).plusMonths(1),
-              Tld.get(tldStr));
-      // In order to keep the transactions short-lived, we load all of the cursors in a single
+              cursorType, getScheduledTimeForCurrentMonth(cursorTime), Tld.get(tldStr));
+      // In order to keep the transactions short-lived, we load all the cursors in a single
       // transaction then later use per-cursor transactions when checking + saving the cursors. We
-      // run behind a lock so the cursors shouldn't be changed, but double check to be sure.
+      // run behind a lock, so the cursors shouldn't be changed, but double check to be sure.
       success =
           tm().transact(
                   () -> {
@@ -236,7 +244,7 @@ public final class IcannReportingUploadAction implements Runnable {
 
   /**
    * Return a map with the Cursor and scope for each key in the keyMap. If the key from the keyMap
-   * does not have an existing cursor, create a new cursor with a default cursorTime of the first of
+   * does not have an existing cursor, create a new cursor with a default cursorTime at the first of
    * next month.
    */
   private ImmutableMap<Cursor, String> defaultNullCursorsToNextMonthAndAddToMap(
@@ -246,15 +254,13 @@ public final class IcannReportingUploadAction implements Runnable {
     ImmutableMap.Builder<Cursor, String> cursors = new ImmutableMap.Builder<>();
     keyMap.forEach(
         (key, registry) -> {
-          // Cursor time is defaulted to the first of next month since a new tld will not yet have a
-          // report staged for upload.
+          // Cursor time is defaulted to 10AM on the second day of next month since a new tld will
+          // not yet have a report staged for upload.
           Cursor cursor =
               cursorMap.getOrDefault(
                   key,
                   Cursor.createScoped(
-                      type,
-                      clock.nowUtc().withDayOfMonth(1).withTimeAtStartOfDay().plusMonths(1),
-                      registry));
+                      type, getScheduledTimeForCurrentMonth(clock.nowUtc()), registry));
           if (!cursorMap.containsValue(cursor)) {
             tm().put(cursor);
           }
@@ -279,7 +285,7 @@ public final class IcannReportingUploadAction implements Runnable {
   }
 
   private void emailUploadResults(ImmutableMap<String, Boolean> reportSummary) {
-    if (reportSummary.size() == 0) {
+    if (reportSummary.isEmpty()) {
       logger.atInfo().log("No uploads were attempted today; skipping notification email.");
       return;
     }
@@ -297,7 +303,7 @@ public final class IcannReportingUploadAction implements Runnable {
                     (e) ->
                         String.format("%s - %s", e.getKey(), e.getValue() ? "SUCCESS" : "FAILURE"))
                 .collect(Collectors.joining("\n")));
-    gmailClient.sendEmail(EmailMessage.create(subject, body, recipient, sender));
+    gmailClient.sendEmail(EmailMessage.create(subject, body, recipient));
   }
 
   private byte[] readBytesFromGcs(BlobId reportFilename) throws IOException {

core/src/main/java/google/registry/reporting/spec11/Spec11EmailUtils.java

@@ -173,7 +173,6 @@ public class Spec11EmailUtils {
             .setSubject(subject)
             .setBody(getEmailBody(date, soyTemplateInfo, registrarThreatMatches))
             .setContentType(MediaType.HTML_UTF_8)
-            .setFrom(outgoingEmailAddress)
             .addRecipient(getEmailAddressForRegistrar(registrarThreatMatches.clientId()))
             .setBccs(spec11BccEmailAddresses)
             .build());
@@ -216,7 +215,6 @@ public class Spec11EmailUtils {
     try {
       gmailClient.sendEmail(
           EmailMessage.newBuilder()
-              .setFrom(outgoingEmailAddress)
               .addRecipient(alertRecipientAddress)
               .setBody(body)
               .setSubject(subject)

core/src/main/java/google/registry/tools/RegistryCli.java

@@ -30,6 +30,7 @@ import google.registry.persistence.transaction.JpaTransactionManager;
 import google.registry.persistence.transaction.TransactionManagerFactory;
 import google.registry.tools.AuthModule.LoginRequiredException;
 import google.registry.tools.params.ParameterFactory;
+import google.registry.util.RegistryEnvironment;
 import java.security.Security;
 import java.util.Map;
 import java.util.Optional;
@@ -218,12 +219,19 @@ final class RegistryCli implements CommandRunner {
 
     // Reset the JPA transaction manager after every command to avoid a situation where a test can
     // interfere with other tests
-    JpaTransactionManager cachedJpaTm = tm();
+    final JpaTransactionManager cachedJpaTm;
+    if (RegistryEnvironment.get() == RegistryEnvironment.UNITTEST) {
+      cachedJpaTm = tm();
+    } else {
+      cachedJpaTm = null;
+    }
     TransactionManagerFactory.setJpaTm(() -> component.nomulusToolJpaTransactionManager().get());
     TransactionManagerFactory.setReplicaJpaTm(
         () -> component.nomulusToolReplicaJpaTransactionManager().get());
     command.run();
-    TransactionManagerFactory.setJpaTm(() -> cachedJpaTm);
+    if (RegistryEnvironment.get() == RegistryEnvironment.UNITTEST) {
+      TransactionManagerFactory.setJpaTm(() -> cachedJpaTm);
+    }
   }
 
   void setEnvironment(RegistryToolEnvironment environment) {

core/src/main/java/google/registry/ui/server/SendEmailUtils.java

@@ -35,21 +35,14 @@ import javax.mail.internet.InternetAddress;
 public class SendEmailUtils {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
-
-  private final InternetAddress gSuiteOutgoingEmailAddress;
-  private final String gSuiteOutgoingEmailDisplayName;
   private final GmailClient gmailClient;
   private final ImmutableList<String> registrarChangesNotificationEmailAddresses;
 
   @Inject
   public SendEmailUtils(
-      @Config("gSuiteOutgoingEmailAddress") InternetAddress gSuiteOutgoingEmailAddress,
-      @Config("gSuiteOutgoingEmailDisplayName") String gSuiteOutgoingEmailDisplayName,
       @Config("registrarChangesNotificationEmailAddresses")
           ImmutableList<String> registrarChangesNotificationEmailAddresses,
       GmailClient gmailClient) {
-    this.gSuiteOutgoingEmailAddress = gSuiteOutgoingEmailAddress;
-    this.gSuiteOutgoingEmailDisplayName = gSuiteOutgoingEmailDisplayName;
     this.gmailClient = gmailClient;
     this.registrarChangesNotificationEmailAddresses = registrarChangesNotificationEmailAddresses;
   }
@@ -71,9 +64,6 @@ public class SendEmailUtils {
       Optional<String> bcc,
       ImmutableList<String> additionalAddresses) {
     try {
-      InternetAddress from =
-          new InternetAddress(
-              gSuiteOutgoingEmailAddress.getAddress(), gSuiteOutgoingEmailDisplayName);
       ImmutableList<InternetAddress> recipients =
           Stream.concat(
                   registrarChangesNotificationEmailAddresses.stream(), additionalAddresses.stream())
@@ -95,11 +85,7 @@ public class SendEmailUtils {
         return false;
       }
       EmailMessage.Builder emailMessage =
-          EmailMessage.newBuilder()
-              .setBody(body)
-              .setSubject(subject)
-              .setRecipients(recipients)
-              .setFrom(from);
+          EmailMessage.newBuilder().setBody(body).setSubject(subject).setRecipients(recipients);
       if (bcc.isPresent()) {
         try {
           InternetAddress bccInternetAddress = new InternetAddress(bcc.get(), true);

core/src/main/java/google/registry/ui/server/registrar/RegistryLockPostAction.java

@@ -29,7 +29,6 @@ import com.google.common.base.Throwables;
 import com.google.common.collect.ImmutableList;
 import com.google.common.flogger.FluentLogger;
 import com.google.gson.Gson;
-import google.registry.config.RegistryConfig.Config;
 import google.registry.flows.domain.DomainFlowUtils;
 import google.registry.groups.GmailClient;
 import google.registry.model.domain.RegistryLock;
@@ -85,7 +84,6 @@ public class RegistryLockPostAction implements Runnable, JsonActionRunner.JsonAc
   private final AuthenticatedRegistrarAccessor registrarAccessor;
   private final GmailClient gmailClient;
   private final DomainLockUtils domainLockUtils;
-  private final InternetAddress gSuiteOutgoingEmailAddress;
 
   @Inject
   RegistryLockPostAction(
@@ -94,15 +92,13 @@ public class RegistryLockPostAction implements Runnable, JsonActionRunner.JsonAc
       AuthResult authResult,
       AuthenticatedRegistrarAccessor registrarAccessor,
       GmailClient gmailClient,
-      DomainLockUtils domainLockUtils,
-      @Config("gSuiteOutgoingEmailAddress") InternetAddress gSuiteOutgoingEmailAddress) {
+      DomainLockUtils domainLockUtils) {
     this.req = req;
     this.jsonActionRunner = jsonActionRunner;
     this.authResult = authResult;
     this.registrarAccessor = registrarAccessor;
     this.gmailClient = gmailClient;
     this.domainLockUtils = domainLockUtils;
-    this.gSuiteOutgoingEmailAddress = gSuiteOutgoingEmailAddress;
   }
 
   @Override
@@ -174,7 +170,6 @@ public class RegistryLockPostAction implements Runnable, JsonActionRunner.JsonAc
               .setBody(body)
               .setSubject(String.format("Registry %s verification", action))
               .setRecipients(recipients)
-              .setFrom(gSuiteOutgoingEmailAddress)
               .build());
     } catch (AddressException | URISyntaxException e) {
       throw new RuntimeException(e); // caught above -- this is so we can run in a transaction

core/src/nonprod/java/google/registry/tools/GenerateSqlErDiagramCommand.java

@@ -50,7 +50,7 @@ import schemacrawler.tools.options.OutputOptions;
 import schemacrawler.tools.options.OutputOptionsBuilder;
 
 /** Command to generate ER diagrams for SQL schema. */
-@Parameters(separators = " =", commandDescription = "Generate ER diagrams for SQL schmea.")
+@Parameters(separators = " =", commandDescription = "Generate ER diagrams for SQL schema.")
 public class GenerateSqlErDiagramCommand implements Command {
 
   private static final String DB_NAME = "postgres";
@@ -101,14 +101,14 @@ public class GenerateSqlErDiagramCommand implements Command {
       checkState(outDir.toFile().mkdirs(), "Failed to create directory %s", outDir);
     }
 
-    PostgreSQLContainer postgresContainer =
-        new PostgreSQLContainer(NomulusPostgreSql.getDockerTag())
-            .withDatabaseName(DB_NAME)
-            .withUsername(DB_USER)
-            .withPassword(DB_PASSWORD);
-    postgresContainer.start();
-
-    try (Connection conn = getConnection(postgresContainer)) {
+    try (PostgreSQLContainer<?> postgresContainer =
+        new PostgreSQLContainer<>(NomulusPostgreSql.getDockerTag())) {
+      postgresContainer
+          .withDatabaseName(DB_NAME)
+          .withUsername(DB_USER)
+          .withPassword(DB_PASSWORD)
+          .start();
+      Connection conn = getConnection(postgresContainer);
       initDb(conn);
       if (diagramType == ALL || diagramType == FULL) {
         improveDiagramHtml(generateErDiagram(conn, FULL_DIAGRAM_COMMAND, FULL_DIAGRAM_FILE_NAME));
@@ -116,8 +116,6 @@ public class GenerateSqlErDiagramCommand implements Command {
       if (diagramType == ALL || diagramType == BRIEF) {
         improveDiagramHtml(generateErDiagram(conn, BRIEF_DIAGRAM_COMMAND, BRIEF_DIAGRAM_FILE_NAME));
       }
-    } finally {
-      postgresContainer.stop();
     }
   }
 
@@ -125,7 +123,7 @@ public class GenerateSqlErDiagramCommand implements Command {
     try {
       Document doc = Jsoup.parse(diagram.toFile(), StandardCharsets.UTF_8.name());
 
-      // Add the last name of the flyway file to the HTML so we can have a test to verify that if
+      // Add the last name of the flyway file to the HTML, so we can have a test to verify that if
       // the generated diagram is up to date.
       doc.select("body > table > tbody")
           .first()
@@ -140,11 +138,9 @@ public class GenerateSqlErDiagramCommand implements Command {
                   + "</tr>");
 
       // Add pan and zoom support for the embedded SVG in the HTML.
-      StringBuilder svgPanZoomLib =
-          new StringBuilder("<script>")
-              .append(ResourceUtils.readResourceUtf8(SVG_PAN_ZOOM_LIB))
-              .append("</script>");
-      doc.select("head").first().append(svgPanZoomLib.toString());
+      String svgPanZoomLib =
+          "<script>" + ResourceUtils.readResourceUtf8(SVG_PAN_ZOOM_LIB) + "</script>";
+      doc.select("head").first().append(svgPanZoomLib);
       doc.select("svg")
           .first()
           .attributes()
@@ -163,8 +159,7 @@ public class GenerateSqlErDiagramCommand implements Command {
                   + "});"
                   + "</script>");
 
-      Files.write(
-          diagram, doc.outerHtml().getBytes(StandardCharsets.UTF_8), StandardOpenOption.WRITE);
+      Files.writeString(diagram, doc.outerHtml(), StandardOpenOption.WRITE);
     } catch (IOException e) {
       throw new UncheckedIOException(e);
     }
@@ -194,7 +189,7 @@ public class GenerateSqlErDiagramCommand implements Command {
     return outputFile;
   }
 
-  private static Connection getConnection(PostgreSQLContainer container) {
+  private static Connection getConnection(PostgreSQLContainer<?> container) {
     Properties info = new Properties();
     info.put("user", container.getUsername());
     info.put("password", container.getPassword());

core/src/test/java/google/registry/batch/CheckBulkComplianceActionTest.java

@@ -44,7 +44,6 @@ import google.registry.ui.server.SendEmailUtils;
 import google.registry.util.EmailMessage;
 import java.util.logging.Level;
 import java.util.logging.Logger;
-import javax.mail.internet.InternetAddress;
 import org.joda.money.CurrencyUnit;
 import org.joda.money.Money;
 import org.joda.time.DateTime;
@@ -89,8 +88,6 @@ public class CheckBulkComplianceActionTest {
     loggerToIntercept.addHandler(logHandler);
     sendEmailUtils =
         new SendEmailUtils(
-            new InternetAddress("outgoing@registry.example"),
-            "UnitTest Registry",
             ImmutableList.of("notification@test.example", "notification2@test.example"),
             gmailClient);
     createTld("tld");

core/src/test/java/google/registry/batch/DeleteProberDataActionTest.java

@@ -16,7 +16,6 @@ package google.registry.batch;
 
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth.assertWithMessage;
-import static com.google.common.truth.Truth8.assertThat;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
 import static google.registry.testing.DatabaseHelper.assertDomainDnsRequests;
 import static google.registry.testing.DatabaseHelper.createTld;

core/src/test/java/google/registry/batch/RelockDomainActionTest.java

@@ -258,7 +258,6 @@ public class RelockDomainActionTest {
                     + "contact support at support@example.com if you have any questions.")
             .setRecipients(
                 ImmutableSet.of(new InternetAddress("Marla.Singer.RegistryLock@crr.com")))
-            .setFrom(new InternetAddress("outgoing@example.com"))
             .build();
     verify(gmailClient).sendEmail(expectedEmail);
   }
@@ -292,7 +291,6 @@ public class RelockDomainActionTest {
             .setSubject("Error re-locking domain example.tld")
             .setBody(body)
             .setRecipients(recipients)
-            .setFrom(new InternetAddress("outgoing@example.com"))
             .build();
     verify(gmailClient).sendEmail(expectedEmail);
   }
@@ -321,12 +319,10 @@ public class RelockDomainActionTest {
   private RelockDomainAction createAction(Long oldUnlockRevisionId, int previousAttempts)
       throws Exception {
     InternetAddress alertRecipientAddress = new InternetAddress("alerts@example.com");
-    InternetAddress gSuiteOutgoingAddress = new InternetAddress("outgoing@example.com");
     return new RelockDomainAction(
         oldUnlockRevisionId,
         previousAttempts,
         alertRecipientAddress,
-        gSuiteOutgoingAddress,
         "support@example.com",
         gmailClient,
         domainLockUtils,

core/src/test/java/google/registry/batch/SendExpiringCertificateNotificationEmailActionTest.java

@@ -98,7 +98,6 @@ class SendExpiringCertificateNotificationEmailActionTest {
         new SendExpiringCertificateNotificationEmailAction(
             EXPIRATION_WARNING_EMAIL_BODY_TEXT,
             EXPIRATION_WARNING_EMAIL_SUBJECT_TEXT,
-            new InternetAddress("test@example.com"),
             sendEmailService,
             certificateChecker,
             response);

core/src/test/java/google/registry/bsa/BsaDiffCreatorTest.java

@@ -15,7 +15,6 @@
 package google.registry.bsa;
 
 import static com.google.common.truth.Truth.assertThat;
-import static com.google.common.truth.Truth8.assertThat;
 import static google.registry.bsa.BsaDiffCreator.ORDER_ID_SENTINEL;
 import static org.junit.Assert.assertThrows;
 import static org.mockito.ArgumentMatchers.anyString;

core/src/test/java/google/registry/bsa/BsaDownloadFunctionalTest.java

@@ -16,7 +16,6 @@ package google.registry.bsa;
 
 import static com.google.common.io.BaseEncoding.base16;
 import static com.google.common.truth.Truth.assertThat;
-import static com.google.common.truth.Truth8.assertThat;
 import static google.registry.bsa.persistence.BsaTestingUtils.createDownloadScheduler;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.createTlds;

core/src/test/java/google/registry/bsa/BsaRefreshActionTest.java

@@ -0,0 +1,109 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.bsa;
+
+import static com.google.common.base.Throwables.getStackTraceAsString;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import google.registry.bsa.api.BsaReportSender;
+import google.registry.bsa.persistence.RefreshScheduler;
+import google.registry.groups.GmailClient;
+import google.registry.request.Response;
+import google.registry.testing.FakeClock;
+import google.registry.util.EmailMessage;
+import javax.mail.internet.InternetAddress;
+import org.joda.time.DateTime;
+import org.joda.time.Duration;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+/** Unit tests for {@link BsaRefreshAction}. */
+@ExtendWith(MockitoExtension.class)
+public class BsaRefreshActionTest {
+
+  FakeClock fakeClock = new FakeClock(DateTime.parse("2023-11-09T02:08:57.880Z"));
+
+  @Mock RefreshScheduler scheduler;
+
+  @Mock GmailClient gmailClient;
+
+  @Mock private InternetAddress emailRecipient;
+
+  @Mock Response response;
+
+  @Mock private BsaLock bsaLock;
+
+  @Mock private GcsClient gcsClient;
+
+  @Mock private BsaReportSender bsaReportSender;
+
+  BsaRefreshAction action;
+
+  @BeforeEach
+  void setup() {
+    action =
+        new BsaRefreshAction(
+            scheduler,
+            gcsClient,
+            bsaReportSender,
+            /* transactionBatchSize= */ 5,
+            /* domainCreateTxnCommitTimeLag= */ Duration.millis(1),
+            new BsaEmailSender(gmailClient, emailRecipient),
+            bsaLock,
+            fakeClock,
+            response);
+  }
+
+  @Test
+  void notificationSent_cannotAcquireLock() {
+    when(bsaLock.executeWithLock(any())).thenReturn(false);
+    action.run();
+    verify(gmailClient, times(1))
+        .sendEmail(
+            EmailMessage.create(
+                "BSA refresh did not run: another BSA related task is running",
+                "",
+                emailRecipient));
+  }
+
+  @Test
+  void notificationSent_abortedByException() {
+    RuntimeException throwable = new RuntimeException("Error");
+    when(bsaLock.executeWithLock(any())).thenThrow(throwable);
+    action.run();
+    verify(gmailClient, times(1))
+        .sendEmail(
+            EmailMessage.create(
+                "BSA refresh aborted", getStackTraceAsString(throwable), emailRecipient));
+  }
+
+  @Test
+  void notificationSent_success() {
+    when(bsaLock.executeWithLock(any()))
+        .thenAnswer(
+            args -> {
+              return true;
+            });
+    action.run();
+    verify(gmailClient, times(1))
+        .sendEmail(EmailMessage.create("BSA refreshed successfully", "", emailRecipient));
+  }
+}

core/src/test/java/google/registry/bsa/BsaRefreshFunctionalTest.java

@@ -15,7 +15,6 @@
 package google.registry.bsa;
 
 import static com.google.common.truth.Truth.assertThat;
-import static com.google.common.truth.Truth8.assertThat;
 import static google.registry.bsa.ReservedDomainsTestingUtils.addReservedDomainToList;
 import static google.registry.bsa.ReservedDomainsTestingUtils.addReservedListsToTld;
 import static google.registry.bsa.ReservedDomainsTestingUtils.createReservedList;
@@ -87,6 +86,8 @@ class BsaRefreshFunctionalTest {
 
   @Mock BsaReportSender bsaReportSender;
 
+  @Mock BsaEmailSender emailSender;
+
   private GcsClient gcsClient;
   private Response response;
   private BsaRefreshAction action;
@@ -103,6 +104,7 @@ class BsaRefreshFunctionalTest {
             bsaReportSender,
             /* transactionBatchSize= */ 5,
             /* domainCreateTxnCommitTimeLag= */ Duration.millis(1),
+            emailSender,
             new BsaLock(
                 new FakeLockHandler(/* lockSucceeds= */ true), Duration.standardSeconds(30)),
             fakeClock,
@@ -146,6 +148,8 @@ class BsaRefreshFunctionalTest {
     verify(bsaReportSender, never()).removeUnblockableDomainsUpdates(anyString());
     verify(bsaReportSender, times(1))
         .addUnblockableDomainsUpdates("{\n  \"reserved\": [\n    \"blocked1.app\"\n  ]\n}");
+
+    verify(emailSender, times(1)).sendNotification("BSA refreshed successfully", "");
   }
 
   @Test

core/src/test/java/google/registry/bsa/BsaValidateActionTest.java

@@ -0,0 +1,262 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.bsa;
+
+import static com.google.common.base.Throwables.getStackTraceAsString;
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.bsa.persistence.BsaTestingUtils.persistDownloadSchedule;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import com.google.cloud.storage.BlobId;
+import com.google.cloud.storage.contrib.nio.testing.LocalStorageHelper;
+import com.google.common.base.Joiner;
+import com.google.common.collect.ImmutableList;
+import google.registry.bsa.persistence.BsaTestingUtils;
+import google.registry.gcs.GcsUtils;
+import google.registry.groups.GmailClient;
+import google.registry.persistence.transaction.JpaTestExtensions;
+import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationWithCoverageExtension;
+import google.registry.request.Response;
+import google.registry.testing.FakeClock;
+import google.registry.util.EmailMessage;
+import java.util.concurrent.Callable;
+import javax.mail.internet.InternetAddress;
+import org.joda.time.DateTime;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.api.extension.RegisterExtension;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Captor;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+/** Unit tests for {@link BsaValidateAction}. */
+@ExtendWith(MockitoExtension.class)
+public class BsaValidateActionTest {
+
+  private static final String DOWNLOAD_JOB_NAME = "job";
+
+  FakeClock fakeClock = new FakeClock(DateTime.parse("2023-11-09T02:08:57.880Z"));
+
+  @RegisterExtension
+  final JpaIntegrationWithCoverageExtension jpa =
+      new JpaTestExtensions.Builder().withClock(fakeClock).buildIntegrationWithCoverageExtension();
+
+  @Mock GmailClient gmailClient;
+
+  @Mock Response response;
+
+  @Mock private BsaLock bsaLock;
+
+  @Mock private InternetAddress emailRecipient;
+
+  @Captor ArgumentCaptor<EmailMessage> emailCaptor = ArgumentCaptor.forClass(EmailMessage.class);
+
+  private GcsClient gcsClient;
+
+  private BsaValidateAction action;
+
+  @BeforeEach
+  void setup() throws Exception {
+    gcsClient =
+        new GcsClient(new GcsUtils(LocalStorageHelper.getOptions()), "my-bucket", "SHA-256");
+    action =
+        new BsaValidateAction(
+            gcsClient,
+            new BsaEmailSender(gmailClient, emailRecipient),
+            /* transactionBatchSize= */ 500,
+            bsaLock,
+            response);
+  }
+
+  static void createBlockList(GcsClient gcsClient, BlockListType blockListType, String content)
+      throws Exception {
+    BlobId blobId =
+        gcsClient.getBlobId(DOWNLOAD_JOB_NAME, GcsClient.getBlockListFileName(blockListType));
+    try (var writer = gcsClient.getWriter(blobId)) {
+      writer.write(content);
+    }
+  }
+
+  @Test
+  void fetchDownloadedLabels_success() throws Exception {
+    String blockContent =
+        """
+        domainLabel,orderIDs
+        test1,1;2
+        test2,3
+        """;
+    String blockPlusContent =
+        """
+        domainLabel,orderIDs
+        test2,4
+        test3,5
+        """;
+    createBlockList(gcsClient, BlockListType.BLOCK, blockContent);
+    createBlockList(gcsClient, BlockListType.BLOCK_PLUS, blockPlusContent);
+    assertThat(action.fetchDownloadedLabels(DOWNLOAD_JOB_NAME))
+        .containsExactly("test1", "test2", "test3");
+  }
+
+  @Test
+  void fetchPersistedLabels_multipleOfBatchSize_success() {
+    BsaTestingUtils.persistBsaLabel("a");
+    BsaTestingUtils.persistBsaLabel("b");
+    BsaTestingUtils.persistBsaLabel("c");
+
+    assertThat(action.fetchPersistedLabels(1)).containsExactly("a", "b", "c");
+  }
+
+  @Test
+  void fetchPersistedLabels_notMultipleOfBatchSize_success() {
+    BsaTestingUtils.persistBsaLabel("a");
+    BsaTestingUtils.persistBsaLabel("b");
+    BsaTestingUtils.persistBsaLabel("c");
+
+    assertThat(action.fetchPersistedLabels(2)).containsExactly("a", "b", "c");
+  }
+
+  @Test
+  void checkBsaLabels_noErrors() throws Exception {
+    String blockContent =
+        """
+        domainLabel,orderIDs
+        test1,1;2
+        test2,3
+        """;
+    String blockPlusContent =
+        """
+        domainLabel,orderIDs
+        test2,4
+        test3,5
+        """;
+    createBlockList(gcsClient, BlockListType.BLOCK, blockContent);
+    createBlockList(gcsClient, BlockListType.BLOCK_PLUS, blockPlusContent);
+    BsaTestingUtils.persistBsaLabel("test1");
+    BsaTestingUtils.persistBsaLabel("test2");
+    BsaTestingUtils.persistBsaLabel("test3");
+
+    assertThat(action.checkBsaLabels(DOWNLOAD_JOB_NAME)).isEmpty();
+  }
+
+  @Test
+  void checkBsaLabels_withErrors() throws Exception {
+    String blockContent =
+        """
+        domainLabel,orderIDs
+        test1,1;2
+        test2,3
+        """;
+    String blockPlusContent = """
+        domainLabel,orderIDs
+        test2,4
+        """;
+    createBlockList(gcsClient, BlockListType.BLOCK, blockContent);
+    createBlockList(gcsClient, BlockListType.BLOCK_PLUS, blockPlusContent);
+    BsaTestingUtils.persistBsaLabel("test2");
+    BsaTestingUtils.persistBsaLabel("test3");
+
+    String allErrors = Joiner.on('\n').join(action.checkBsaLabels(DOWNLOAD_JOB_NAME));
+
+    assertThat(allErrors).contains("Found 1 missing labels in the DB. Examples: [test1]");
+    assertThat(allErrors).contains("Found 1 unexpected labels in the DB. Examples: [test3]");
+  }
+
+  @Test
+  void notificationSent_cannotAcquireLock() {
+    when(bsaLock.executeWithLock(any())).thenReturn(false);
+    action.run();
+    verify(gmailClient, times(1))
+        .sendEmail(
+            EmailMessage.create(
+                "BSA validation did not run: another BSA related task is running",
+                "",
+                emailRecipient));
+  }
+
+  @Test
+  void notificationSent_abortedByException() {
+    RuntimeException throwable = new RuntimeException("Error");
+    when(bsaLock.executeWithLock(any())).thenThrow(throwable);
+    action.run();
+    verify(gmailClient, times(1))
+        .sendEmail(
+            EmailMessage.create(
+                "BSA validation aborted", getStackTraceAsString(throwable), emailRecipient));
+  }
+
+  @Test
+  void notificationSent_noDownloads() {
+    when(bsaLock.executeWithLock(any()))
+        .thenAnswer(
+            args -> {
+              args.getArgument(0, Callable.class).call();
+              return true;
+            });
+    action.run();
+    verify(gmailClient, times(1))
+        .sendEmail(
+            EmailMessage.create(
+                "BSA validation does not run: block list downloads not found", "", emailRecipient));
+  }
+
+  @Test
+  void notificationSent_withValidationError() {
+    when(bsaLock.executeWithLock(any()))
+        .thenAnswer(
+            args -> {
+              args.getArgument(0, Callable.class).call();
+              return true;
+            });
+    persistDownloadSchedule(DownloadStage.DONE);
+    action = spy(action);
+    doReturn(ImmutableList.of("Error line 1.", "Error line 2"))
+        .when(action)
+        .checkBsaLabels(anyString());
+    action.run();
+    verify(gmailClient, times(1)).sendEmail(emailCaptor.capture());
+    EmailMessage message = emailCaptor.getValue();
+    assertThat(message.subject()).isEqualTo("BSA validation completed with errors");
+    assertThat(message.body()).startsWith("Most recent download is");
+    assertThat(message.body())
+        .isEqualTo(
+            "Most recent download is 2023-11-09t020857.880z.\n\n" + "Error line 1.\nError line 2");
+  }
+
+  @Test
+  void notificationSent_noError() {
+    when(bsaLock.executeWithLock(any()))
+        .thenAnswer(
+            args -> {
+              args.getArgument(0, Callable.class).call();
+              return true;
+            });
+    persistDownloadSchedule(DownloadStage.DONE);
+    action = spy(action);
+    doReturn(ImmutableList.of()).when(action).checkBsaLabels(anyString());
+    action.run();
+    verify(gmailClient, times(1)).sendEmail(emailCaptor.capture());
+    EmailMessage message = emailCaptor.getValue();
+    assertThat(message.subject()).isEqualTo("BSA validation completed: no errors found");
+    assertThat(message.body()).isEqualTo("Most recent download is 2023-11-09t020857.880z.\n\n");
+  }
+}

core/src/test/java/google/registry/bsa/GcsClientTest.java

@@ -15,7 +15,6 @@
 package google.registry.bsa;
 
 import static com.google.common.truth.Truth.assertThat;
-import static com.google.common.truth.Truth8.assertThat;
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.mockito.Mockito.when;
 

core/src/test/java/google/registry/bsa/UploadBsaUnavailableDomainsActionTest.java

@@ -22,6 +22,8 @@ import static google.registry.testing.DatabaseHelper.persistReservedList;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static java.nio.charset.StandardCharsets.UTF_8;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
 
 import com.google.cloud.storage.BlobId;
 import com.google.cloud.storage.contrib.nio.testing.LocalStorageHelper;
@@ -64,6 +66,8 @@ public class UploadBsaUnavailableDomainsActionTest {
 
   @Mock BsaCredential bsaCredential;
 
+  @Mock BsaEmailSender emailSender;
+
   private final GcsUtils gcsUtils = new GcsUtils(LocalStorageHelper.getOptions());
 
   private final FakeResponse response = new FakeResponse();
@@ -86,7 +90,7 @@ public class UploadBsaUnavailableDomainsActionTest {
             .build());
     action =
         new UploadBsaUnavailableDomainsAction(
-            clock, bsaCredential, gcsUtils, BUCKET, API_URL, response);
+            clock, bsaCredential, gcsUtils, emailSender, BUCKET, API_URL, response);
   }
 
   @Test
@@ -101,6 +105,10 @@ public class UploadBsaUnavailableDomainsActionTest {
     assertThat(blockList).isEqualTo("ace.tld\nflagrant.tld\nfoobar.tld\njimmy.tld\ntine.tld");
     assertThat(blockList).doesNotContain("not-blocked.tld");
 
+    // This test currently fails in the upload-to-bsa step.
+    verify(emailSender, times(1))
+        .sendNotification("BSA daily upload completed with errors", "Please see logs for details.");
+
     // TODO(mcilwain): Add test of BSA API upload as well.
   }
 }

core/src/test/java/google/registry/bsa/api/JsonSerializationsTest.java

@@ -14,7 +14,7 @@
 
 package google.registry.bsa.api;
 
-import static com.google.common.truth.Truth8.assertThat;
+import static com.google.common.truth.Truth.assertThat;
 import static google.registry.bsa.api.JsonSerializations.toCompletedOrdersReport;
 import static google.registry.bsa.api.JsonSerializations.toInProgressOrdersReport;
 import static google.registry.bsa.api.JsonSerializations.toUnblockableDomainsReport;

core/src/test/java/google/registry/bsa/persistence/BsaTestingUtils.java

@@ -18,6 +18,7 @@ import static com.google.common.collect.ImmutableList.toImmutableList;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
 import com.google.common.collect.ImmutableList;
+import google.registry.bsa.DownloadStage;
 import google.registry.bsa.api.UnblockableDomain;
 import google.registry.util.Clock;
 import org.joda.time.DateTime;
@@ -42,6 +43,11 @@ public final class BsaTestingUtils {
     tm().transact(() -> tm().put(BsaUnblockableDomain.of(unblockableDomain)));
   }
 
+  public static void persistDownloadSchedule(DownloadStage stage) {
+    BsaDownload bsaDownload = new BsaDownload().setStage(stage);
+    tm().transact(() -> tm().put(bsaDownload));
+  }
+
   public static DownloadScheduler createDownloadScheduler(Clock clock) {
     return new DownloadScheduler(DEFAULT_DOWNLOAD_INTERVAL, DEFAULT_NOP_INTERVAL, clock);
   }

core/src/test/java/google/registry/bsa/persistence/BsaUnblockableDomainTest.java

@@ -15,7 +15,6 @@
 package google.registry.bsa.persistence;
 
 import static com.google.common.truth.Truth.assertThat;
-import static com.google.common.truth.Truth8.assertThat;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static org.joda.time.DateTimeZone.UTC;
 import static org.junit.jupiter.api.Assertions.assertThrows;

core/src/test/java/google/registry/bsa/persistence/DownloadSchedulerTest.java

@@ -15,7 +15,6 @@
 package google.registry.bsa.persistence;
 
 import static com.google.common.truth.Truth.assertThat;
-import static com.google.common.truth.Truth8.assertThat;
 import static google.registry.bsa.DownloadStage.CHECKSUMS_DO_NOT_MATCH;
 import static google.registry.bsa.DownloadStage.DONE;
 import static google.registry.bsa.DownloadStage.DOWNLOAD_BLOCK_LISTS;

core/src/test/java/google/registry/bsa/persistence/LabelDiffUpdatesTest.java

@@ -15,7 +15,6 @@
 package google.registry.bsa.persistence;
 
 import static com.google.common.truth.Truth.assertThat;
-import static com.google.common.truth.Truth8.assertThat;
 import static google.registry.bsa.ReservedDomainsTestingUtils.addReservedListsToTld;
 import static google.registry.bsa.ReservedDomainsTestingUtils.createReservedList;
 import static google.registry.bsa.persistence.LabelDiffUpdates.applyLabelDiff;

core/src/test/java/google/registry/bsa/persistence/QueriesTest.java

@@ -17,6 +17,7 @@ package google.registry.bsa.persistence;
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.bsa.BsaTransactions.bsaQuery;
+import static google.registry.bsa.persistence.Queries.batchReadBsaLabelText;
 import static google.registry.bsa.persistence.Queries.deleteBsaLabelByLabels;
 import static google.registry.bsa.persistence.Queries.queryBsaLabelByLabels;
 import static google.registry.bsa.persistence.Queries.queryBsaUnblockableDomainByLabels;
@@ -35,6 +36,7 @@ import google.registry.bsa.persistence.BsaUnblockableDomain.Reason;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationWithCoverageExtension;
 import google.registry.testing.FakeClock;
+import java.util.Optional;
 import org.joda.time.DateTime;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -114,6 +116,16 @@ class QueriesTest {
             new BsaLabel("label1", fakeClock.nowUtc()), new BsaLabel("label2", fakeClock.nowUtc()));
   }
 
+  @Test
+  void batchReadBsaLabelText_firstBatch() {
+    assertThat(batchReadBsaLabelText(Optional.empty(), 1)).containsExactly("label1");
+  }
+
+  @Test
+  void batchReadBsaLabelText_nextBatch() {
+    assertThat(batchReadBsaLabelText(Optional.of("label1"), 1)).containsExactly("label2");
+  }
+
   @Test
   void deleteBsaLabelByLabels_oneLabel() {
     assertThat(tm().transact(() -> deleteBsaLabelByLabels(ImmutableList.of("label1"))))

core/src/test/java/google/registry/bsa/persistence/RefreshSchedulerTest.java

@@ -15,7 +15,6 @@
 package google.registry.bsa.persistence;
 
 import static com.google.common.truth.Truth.assertThat;
-import static com.google.common.truth.Truth8.assertThat;
 import static google.registry.bsa.RefreshStage.APPLY_CHANGES;
 import static google.registry.bsa.RefreshStage.DONE;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;