Fix XML parsing issues that occur on dependency update (#3012 )

We want to make sure that we use the same XML factories no matter what, so we use "newDefaultFactory" instead of "newFactory" (to avoid picking up some random thing on the classpath). This also fixes an exception that occurs if you haven't synced the internal repo with the public repo.
Change language and bytecode levels to Java 25 (#3009 )
2026-05-16 12:51:47 +00:00 · 2026-04-16 20:15:02 +00:00 · 2026-04-15 16:34:52 +00:00 · 2026-04-13 20:52:29 +00:00 · 2026-04-10 20:46:06 +00:00 · 2026-04-09 20:45:36 +00:00
39 changed files with 942 additions and 236 deletions
--- a/.github/workflows/dependency-submission.yml
+++ b/.github/workflows/dependency-submission.yml
@@ -20,6 +20,6 @@ jobs:
      uses: actions/setup-java@v4
      with:
        distribution: 'temurin'
-        java-version: '21'
+        java-version: '25'
    - name: Generate and submit dependency graph
      uses: gradle/actions/dependency-submission@v3
--- a/build.gradle
+++ b/build.gradle
@@ -200,6 +200,7 @@ allprojects {
                                "--add-exports",
                                "jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED"]
        options.forkOptions.jvmArgs = ["-J--add-exports=jdk.compiler/com.sun.tools.javac.main=ALL-UNNAMED",
+                                       "-J--add-exports=jdk.compiler/com.sun.tools.javac.model=ALL-UNNAMED",
                                       "-J--add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED",
                                       "-J--add-exports=jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED",
                                       "-J--add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED",
@@ -358,11 +359,13 @@ subprojects {
  // search for `flex-template-base-image` and update the parameter value.
  // There are at least two instances, one in core/build.gradle, one in
  // release/stage_beam_pipeline.sh
+  // Also need to change:
+  // - base images in Dockerfiles under core, jetty, and proxy.
+  // - Java installation command in the builder image under release.
+  // - cloudbuild-release.yaml under release.
  java {
-    // TODO(b/457758757): change to V_25 once Java in all environments are
-    // upgraded.
-    sourceCompatibility = JavaVersion.VERSION_21
-    targetCompatibility = JavaVersion.VERSION_21
+    sourceCompatibility = JavaVersion.VERSION_25
+    targetCompatibility = JavaVersion.VERSION_25
  }

  project.tasks.test.dependsOn runPresubmits
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -74,11 +74,7 @@ sourceSets {
  nonprod {
    java {
      compileClasspath += main.output
-
-      // Add the DB runtime classpath to nonprod so we can load the flyway
-      // scripts.
-      runtimeClasspath += main.output +
-          rootProject.project(":db").sourceSets.main.runtimeClasspath
+      runtimeClasspath += main.output
    }
  }
  test {
@@ -102,6 +98,7 @@ configurations {
  devtool

  nonprodImplementation.extendsFrom implementation
+  nonprodRuntimeOnly.extendsFrom runtimeOnly

  testImplementation.extendsFrom nonprodImplementation

@@ -259,6 +256,7 @@ dependencies {
  implementation project(':util')
  // Import NomulusPostreSql from ':db' for implementation but exclude dependencies.
  implementation project(path: ':db', configuration: 'implementationApi')
+  nonprodRuntimeOnly project(':db')
  testRuntimeOnly project(':db')

  annotationProcessor deps['com.google.auto.service:auto-service']
@@ -385,6 +383,7 @@ task soyToJava {
    project.services.get(ExecOperations).javaexec {
      mainClass = "com.google.template.soy.SoyParseInfoGenerator"
      classpath = configurations.soy
+      jvmArgs = ["--sun-misc-unsafe-memory-access=allow", "--enable-native-access=ALL-UNNAMED"]
      args = ["--javaPackage", "${javaPackage}",
              "--outputDirectory", "${outputDirectory}",
              "--javaClassNameSource", "filename",
@@ -440,7 +439,7 @@ artifacts {
 task findGoldenImages(type: JavaExec) {
  classpath = sourceSets.test.runtimeClasspath
  mainClass = 'google.registry.webdriver.GoldenImageFinder'
-
+  jvmArgs "--sun-misc-unsafe-memory-access=allow"
  def arguments = []
  arguments << "--screenshots_for_goldens_dir=${screenshotsForGoldensDir}"
  arguments << "--new_goldens_dir=${newGoldensDir}"
@@ -491,6 +490,7 @@ ext.createToolTask = {
  project.tasks.create(taskName, JavaExec) {
    classpath = sourceSet.runtimeClasspath
    mainClass = mainClassName
+    jvmArgs "--sun-misc-unsafe-memory-access=allow", "--enable-native-access=ALL-UNNAMED"

    doFirst {
      getToolArgsList().ifPresent {
@@ -508,6 +508,7 @@ createToolTask(
 project.tasks.create('generateSqlSchema', JavaExec) {
  classpath = sourceSets.nonprod.runtimeClasspath
  mainClass = 'google.registry.tools.DevTool'
+  jvmArgs "--sun-misc-unsafe-memory-access=allow"
  args = [
      '-e', 'alpha',
      'generate_sql_schema', '--start_postgresql', '-o',
@@ -666,6 +667,7 @@ artifacts {
 task runTestServer(type: JavaExec) {
  mainClass = 'google.registry.server.RegistryTestServerMain'
  classpath = sourceSets.test.runtimeClasspath
+  jvmArgs "--sun-misc-unsafe-memory-access=allow"
  dependsOn(rootProject.project('console-webapp').tasks.named('buildConsoleWebapp'))
 }

--- a/core/gradle.lockfile
+++ b/core/gradle.lockfile
@@ -7,10 +7,12 @@ com.charleskorn.kaml:kaml:0.20.0=deploy_jar,nonprodRuntimeClasspath,runtimeClass
 com.fasterxml.jackson.core:jackson-annotations:2.21=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson.core:jackson-core:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson.core:jackson-databind:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.20.2=testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson.datatype:jackson-datatype-joda:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson:jackson-bom:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.woodstox:woodstox-core:7.0.0=testCompileClasspath,testRuntimeClasspath
 com.fasterxml:classmate:1.7.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.github.ben-manes.caffeine:caffeine:3.2.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -33,7 +35,8 @@ com.google.api-client:google-api-client-java6:2.1.4=compileClasspath,deploy_jar,
 com.google.api-client:google-api-client-servlet:2.7.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-servlet:2.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.api-client:google-api-client:2.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.67.0=testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.181.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
@@ -52,7 +55,8 @@ com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.74.0=compileCl
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-spanner-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.api.grpc:grpc-google-cloud-spanner-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.67.0=testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-common-protos:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.api.grpc:grpc-google-common-protos:2.45.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
@@ -86,22 +90,27 @@ com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.77.0=deploy_j
 com.google.api.grpc:proto-google-cloud-spanner-executor-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.api.grpc:proto-google-cloud-spanner-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.api.grpc:proto-google-cloud-spanner-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.67.0=testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.141.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.141.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-common-protos:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-iam-v1:1.50.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:api-common:2.57.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-grpc:2.64.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-httpjson:2.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.50.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.65.0=testCompileClasspath,testRuntimeClasspath
+com.google.api:api-common:2.57.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api:api-common:2.62.0=testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-grpc:2.64.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api:gax-grpc:2.79.0=testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-httpjson:2.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api:gax-httpjson:2.79.0=testCompileClasspath,testRuntimeClasspath
 com.google.api:gax:2.74.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-admin-directory:directory_v1-rev20260227-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-bigquery:v2-rev20240815-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20240310-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-dataflow:v1b3-rev20260213-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-dns:v1-rev20260219-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-drive:v3-rev20260322-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-dataflow:v1b3-rev20260405-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-dns:v1-rev20260402-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-drive:v3-rev20260405-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-gmail:v1-rev20260112-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20220614-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240130-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -112,9 +121,11 @@ com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath
 com.google.apis:google-api-services-sheets:v4-rev20260213-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20251201-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20250312-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20251118-2.0.0=testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-credentials:1.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-oauth2-http:1.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20260204-2.0.0=testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-credentials:1.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.auth:google-auth-library-credentials:1.46.0=testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-oauth2-http:1.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.auth:google-auth-library-oauth2-http:1.46.0=testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service-annotations:1.0.1=nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.auto.service:auto-service-annotations:1.1.1=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service:1.1.1=annotationProcessor
@@ -132,19 +143,21 @@ com.google.cloud.opentelemetry:detector-resources-support:0.33.0=deploy_jar,nonp
 com.google.cloud.opentelemetry:exporter-metrics:0.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.opentelemetry:shared-resourcemapping:0.33.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.cloud.sql:jdbc-socket-factory-core:1.28.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.28.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.28.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.9.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.cloud:google-cloud-bigtable:2.44.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-compute:1.82.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.54.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-http:2.54.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.54.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.69.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.54.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.cloud:google-cloud-core-http:2.69.0=testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-firestore:3.25.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.cloud:google-cloud-firestore:3.26.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-monitoring:3.52.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-nio:0.129.0-rc1=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-nio:0.131.0=testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-pubsub:1.132.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.cloud:google-cloud-pubsub:1.133.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-pubsublite:1.14.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
@@ -185,16 +198,20 @@ com.google.guava:failureaccess:1.0.1=soy
 com.google.guava:failureaccess:1.0.3=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.guava:guava-parent:32.1.1-jre=soy
 com.google.guava:guava-testlib:33.3.0-jre=testRuntimeClasspath
-com.google.guava:guava-testlib:33.5.0-jre=testCompileClasspath
+com.google.guava:guava-testlib:33.6.0-jre=testCompileClasspath
 com.google.guava:guava:32.1.1-jre=soy
 com.google.guava:guava:33.4.8-jre=checkstyle
-com.google.guava:guava:33.5.0-jre=annotationProcessor,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava:33.5.0-jre=annotationProcessor,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
+com.google.guava:guava:33.6.0-jre=testCompileClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-appengine:1.46.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.http-client:google-http-client-apache-v2:2.1.0=testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-appengine:1.46.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.http-client:google-http-client-appengine:2.1.0=testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-gson:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-jackson2:1.46.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-jackson2:1.46.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.http-client:google-http-client-jackson2:2.1.0=testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-protobuf:1.44.2=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.http-client:google-http-client-protobuf:1.45.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -218,7 +235,8 @@ com.google.protobuf:protobuf-java-util:4.34.1=testCompileClasspath,testRuntimeCl
 com.google.protobuf:protobuf-java:3.21.7=soy
 com.google.protobuf:protobuf-java:4.33.2=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.protobuf:protobuf-java:4.34.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.re2j:re2j:1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.re2j:re2j:1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.re2j:re2j:1.8=testRuntimeClasspath
 com.google.template:soy:2024-02-26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.google.truth:truth:1.4.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.googlecode.json-simple:json-simple:1.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -272,31 +290,48 @@ io.github.classgraph:classgraph:4.8.162=compileClasspath,deploy_jar,nonprodCompi
 io.github.eisop:dataflow-errorprone:3.41.0-eisop1=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 io.github.java-diff-utils:java-diff-utils:4.16=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-alts:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.70.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-api:1.71.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-auth:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-alts:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-alts:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.70.0=compileClasspath,nonprodCompileClasspath
+io.grpc:grpc-api:1.71.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-api:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-auth:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-auth:1.80.0=testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-census:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 io.grpc:grpc-census:1.68.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.71.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-core:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-googleapis:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-grpclb:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-inprocess:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-netty-shaded:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.71.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-context:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-core:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-core:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-googleapis:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-googleapis:1.80.0=testRuntimeClasspath
+io.grpc:grpc-grpclb:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-grpclb:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-inprocess:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-inprocess:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-netty-shaded:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-netty-shaded:1.80.0=testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-netty:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 io.grpc:grpc-netty:1.68.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-opentelemetry:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf-lite:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-rls:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-opentelemetry:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-opentelemetry:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf-lite:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-protobuf-lite:1.80.0=testRuntimeClasspath
+io.grpc:grpc-protobuf:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-protobuf:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-rls:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-rls:1.80.0=testRuntimeClasspath
 io.grpc:grpc-services:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-services:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-stub:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-services:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-services:1.80.0=testRuntimeClasspath
+io.grpc:grpc-stub:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-stub:1.80.0=testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-util:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-util:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-util:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-util:1.80.0=testRuntimeClasspath
 io.grpc:grpc-xds:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-xds:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-xds:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-xds:1.80.0=testRuntimeClasspath
 io.netty:netty-buffer:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 io.netty:netty-buffer:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.netty:netty-codec-http2:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
@@ -330,33 +365,34 @@ io.opencensus:opencensus-exporter-metrics-util:0.31.0=compileClasspath,deploy_ja
 io.opencensus:opencensus-exporter-stats-stackdriver:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-impl-core:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-impl:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opentelemetry.contrib:opentelemetry-gcp-resources:1.37.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opentelemetry.contrib:opentelemetry-gcp-resources:1.37.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry.contrib:opentelemetry-gcp-resources:1.45.0-alpha=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.instrumentation:opentelemetry-grpc-1.6:2.1.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.instrumentation:opentelemetry-instrumentation-api-incubator:2.1.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.instrumentation:opentelemetry-instrumentation-api:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.semconv:opentelemetry-semconv:1.29.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-api-incubator:1.42.1-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-api:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-api:1.59.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-api:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-bom:1.42.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-common:1.59.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-common:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-context:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-context:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-exporter-logging:1.59.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-context:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-exporter-logging:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-extension-incubator:1.35.0-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-sdk-common:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-common:1.59.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-common:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:1.59.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-sdk-logs:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-logs:1.59.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-logs:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-sdk-metrics:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-metrics:1.59.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-metrics:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-sdk-trace:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-trace:1.59.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-trace:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-sdk:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk:1.59.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-semconv:1.26.0-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.outfoxx:swiftpoet:1.3.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.perfmark:perfmark-api:0.27.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
@@ -381,7 +417,7 @@ net.arnx:nashorn-promise:0.1.1=testRuntimeClasspath
 net.bytebuddy:byte-buddy-agent:1.17.7=testCompileClasspath,testRuntimeClasspath
 net.bytebuddy:byte-buddy:1.14.12=compileClasspath,nonprodCompileClasspath
 net.bytebuddy:byte-buddy:1.17.8=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-net.bytebuddy:byte-buddy:1.18.5=testCompileClasspath,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.18.8-jdk5=testCompileClasspath,testRuntimeClasspath
 net.java.dev.jna:jna:5.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.ltgt.gradle.incap:incap:0.2=annotationProcessor,testAnnotationProcessor
 net.sf.saxon:Saxon-HE:12.5=checkstyle
@@ -436,17 +472,17 @@ org.apache.maven.doxia:doxia-logging-api:1.12.0=checkstyle
 org.apache.maven.doxia:doxia-module-xdoc:1.12.0=checkstyle
 org.apache.maven.doxia:doxia-sink-api:1.12.0=checkstyle
 org.apache.mina:mina-core:2.2.4=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-common:3.0.0-M2=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-core:3.0.0-M2=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-scp:3.0.0-M2=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-sftp:3.0.0-M2=testCompileClasspath,testRuntimeClasspath
-org.apache.tomcat:tomcat-annotations-api:11.0.20=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-common:3.0.0-M3=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-core:3.0.0-M3=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-scp:3.0.0-M3=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-sftp:3.0.0-M3=testCompileClasspath,testRuntimeClasspath
+org.apache.tomcat:tomcat-annotations-api:11.0.21=testCompileClasspath,testRuntimeClasspath
 org.apache.xbean:xbean-reflect:3.7=checkstyle
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
-org.bouncycastle:bcpg-jdk18on:1.83=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcpkix-jdk18on:1.83=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcprov-jdk18on:1.83=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcutil-jdk18on:1.83=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpg-jdk18on:1.84=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpkix-jdk18on:1.84=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcprov-jdk18on:1.84=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcutil-jdk18on:1.84=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.checkerframework:checker-compat-qual:2.5.3=annotationProcessor,compileClasspath,nonprodCompileClasspath,soy,testAnnotationProcessor,testCompileClasspath
 org.checkerframework:checker-compat-qual:2.5.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.19.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
@@ -454,29 +490,31 @@ org.checkerframework:checker-qual:3.33.0=soy
 org.checkerframework:checker-qual:3.49.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 org.checkerframework:checker-qual:3.49.3=checkstyle
 org.checkerframework:checker-qual:3.52.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.codehaus.mojo:animal-sniffer-annotations:1.24=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.codehaus.mojo:animal-sniffer-annotations:1.24=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+org.codehaus.mojo:animal-sniffer-annotations:1.26=testCompileClasspath,testRuntimeClasspath
 org.codehaus.plexus:plexus-classworlds:2.6.0=checkstyle
 org.codehaus.plexus:plexus-component-annotations:2.1.0=checkstyle
 org.codehaus.plexus:plexus-container-default:2.1.0=checkstyle
 org.codehaus.plexus:plexus-utils:3.3.0=checkstyle
+org.codehaus.woodstox:stax2-api:4.2.2=testCompileClasspath,testRuntimeClasspath
 org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.angus:angus-activation:2.0.3=jaxb
 org.eclipse.angus:angus-activation:2.1.0-M1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.eclipse.angus:jakarta.mail:2.1.0-M1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.eclipse.collections:eclipse-collections-api:11.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.collections:eclipse-collections:11.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee10:jetty-ee10-servlet:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee10:jetty-ee10-webapp:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee:jetty-ee-webapp:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-http:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-io:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-security:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-server:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-session:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-util:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-xml:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-core:12.3.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-database-postgresql:12.3.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.ee10:jetty-ee10-servlet:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.ee10:jetty-ee10-webapp:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.ee:jetty-ee-webapp:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-http:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-io:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-security:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-server:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-session:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-xml:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-core:12.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-database-postgresql:12.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:codemodel:4.0.7=jaxb
 org.glassfish.jaxb:jaxb-core:4.0.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-core:4.0.7=jaxb
@@ -563,23 +601,23 @@ org.pcollections:pcollections:4.0.1=annotationProcessor,nonprodAnnotationProcess
 org.postgresql:postgresql:42.7.10=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.reflections:reflections:0.10.2=checkstyle
 org.rnorth.duct-tape:duct-tape:1.0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-api:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-chrome-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-chromium-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v143:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v144:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v145:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-edge-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-firefox-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-http:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-ie-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-java:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-json:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-manager:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-os:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-remote-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-safari-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-support:4.41.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-api:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-chrome-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-chromium-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v145:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v146:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v147:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-edge-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-firefox-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-http:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-ie-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-java:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-json:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-manager:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-os:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-remote-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-safari-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-support:4.43.0=testCompileClasspath,testRuntimeClasspath
 org.slf4j:jcl-over-slf4j:1.7.36=testCompileClasspath,testRuntimeClasspath
 org.slf4j:jul-to-slf4j:1.7.30=testRuntimeClasspath
 org.slf4j:slf4j-api:2.0.17=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -597,16 +635,16 @@ org.webjars.npm:viz.js-graphviz-java:2.1.3=testRuntimeClasspath
 org.xerial.snappy:snappy-java:1.1.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.xmlresolver:xmlresolver:5.2.2=checkstyle
 org.yaml:snakeyaml:2.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-tools.jackson.core:jackson-core:3.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-tools.jackson.core:jackson-databind:3.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-tools.jackson:jackson-bom:3.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+tools.jackson.core:jackson-core:3.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+tools.jackson.core:jackson-databind:3.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+tools.jackson:jackson-bom:3.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-api:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-diagram:17.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-operations:17.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-postgresql:17.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-text:17.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-diagram:17.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-operations:17.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-postgresql:17.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-text:17.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-tools:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-utility:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler:17.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler:17.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 xerces:xmlParserAPIs:2.6.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 empty=devtool,shadow
--- a/core/src/main/java/google/registry/flows/EppXmlSanitizer.java
+++ b/core/src/main/java/google/registry/flows/EppXmlSanitizer.java
@@ -15,6 +15,7 @@
 package google.registry.flows;

 import static com.google.common.base.Preconditions.checkState;
+import static google.registry.xml.XmlTransformer.createXmlInputFactory;

 import com.google.common.base.CharMatcher;
 import com.google.common.collect.ImmutableSet;
@@ -72,8 +73,8 @@ public class EppXmlSanitizer {
  private static final String DEFAULT_MASK = "*";

  private static final XMLInputFactory XML_INPUT_FACTORY = createXmlInputFactory();
-  private static final XMLOutputFactory XML_OUTPUT_FACTORY = XMLOutputFactory.newFactory();
-  private static final XMLEventFactory XML_EVENT_FACTORY = XMLEventFactory.newFactory();
+  private static final XMLOutputFactory XML_OUTPUT_FACTORY = XMLOutputFactory.newDefaultFactory();
+  private static final XMLEventFactory XML_EVENT_FACTORY = XMLEventFactory.newDefaultFactory();

  /**
   * Returns sanitized EPP XML message. For malformed XML messages, base64-encoded raw bytes will be
@@ -158,16 +159,4 @@ public class EppXmlSanitizer {
  private static boolean isMatchingEndEvent(XMLEvent xmlEvent, QName startEventName) {
    return xmlEvent.isEndElement() && xmlEvent.asEndElement().getName().equals(startEventName);
  }
-
-  private static XMLInputFactory createXmlInputFactory() {
-    XMLInputFactory xmlInputFactory = XMLInputFactory.newFactory();
-    // Coalesce adjacent data, so that all chars in a string will be grouped as one item.
-    xmlInputFactory.setProperty(XMLInputFactory.IS_COALESCING, true);
-    // Preserve Name Space information.
-    xmlInputFactory.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, true);
-    // Prevent XXE attacks.
-    xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
-    xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
-    return xmlInputFactory;
-  }
 }
--- a/core/src/main/java/google/registry/keyring/KeyringModule.java
+++ b/core/src/main/java/google/registry/keyring/KeyringModule.java
@@ -14,6 +14,7 @@

 package google.registry.keyring;

+import com.google.common.collect.ImmutableList;
 import dagger.Binds;
 import dagger.Module;
 import dagger.Provides;
@@ -21,7 +22,6 @@ import google.registry.config.RegistryConfig.Config;
 import google.registry.keyring.api.Keyring;
 import google.registry.keyring.secretmanager.SecretManagerKeyring;
 import jakarta.inject.Singleton;
-import java.util.Optional;

 /** Dagger module for {@link Keyring} */
@Module
@@ -38,9 +38,10 @@ public abstract class KeyringModule {
  }

  @Provides
-  @Config("cloudSqlReplicaInstanceConnectionName")
-  public static Optional<String> provideCloudSqlReplicaInstanceConnectionName(Keyring keyring) {
-    return Optional.ofNullable(keyring.getSqlReplicaConnectionName());
+  @Config("cloudSqlReplicaInstanceConnectionNames")
+  public static ImmutableList<String> provideCloudSqlReplicaInstanceConnectionNames(
+      Keyring keyring) {
+    return ImmutableList.copyOf(keyring.getSqlReplicaConnectionNames());
  }

  @Provides
--- a/core/src/main/java/google/registry/keyring/api/Keyring.java
+++ b/core/src/main/java/google/registry/keyring/api/Keyring.java
@@ -14,6 +14,7 @@

 package google.registry.keyring.api;

+import com.google.common.collect.ImmutableList;
 import javax.annotation.concurrent.ThreadSafe;
 import org.bouncycastle.openpgp.PGPKeyPair;
 import org.bouncycastle.openpgp.PGPPrivateKey;
@@ -151,9 +152,17 @@ public interface Keyring extends AutoCloseable {
  /** Returns the Cloud SQL connection name of the primary database instance. */
  String getSqlPrimaryConnectionName();

-  /** Returns the Cloud SQL connection name of the replica database instance. */
+  /**
+   * Returns the Cloud SQL connection name of the replica database instance.
+   *
+   * <p>Note: It is likely a better idea to use multiple replicas and {@link
+   * #getSqlReplicaConnectionNames()} instead.
+   */
  String getSqlReplicaConnectionName();

+  /** Returns the Cloud SQL connection names of the replica database instances. */
+  ImmutableList<String> getSqlReplicaConnectionNames();
+
  // Don't throw so try-with-resources works better.
  @Override
  void close();
--- a/core/src/main/java/google/registry/keyring/secretmanager/SecretManagerKeyring.java
+++ b/core/src/main/java/google/registry/keyring/secretmanager/SecretManagerKeyring.java
@@ -17,6 +17,8 @@ package google.registry.keyring.secretmanager;
 import static com.google.common.base.CaseFormat.LOWER_HYPHEN;
 import static com.google.common.base.CaseFormat.UPPER_UNDERSCORE;

+import com.google.common.base.Splitter;
+import com.google.common.collect.ImmutableList;
 import google.registry.keyring.api.KeySerializer;
 import google.registry.keyring.api.Keyring;
 import google.registry.keyring.api.KeyringException;
@@ -66,7 +68,8 @@ public class SecretManagerKeyring implements Keyring {
    RDE_SSH_CLIENT_PUBLIC_STRING,
    SAFE_BROWSING_API_KEY,
    SQL_PRIMARY_CONN_NAME,
-    SQL_REPLICA_CONN_NAME;
+    SQL_REPLICA_CONN_NAME,
+    SQL_REPLICA_CONN_NAMES;

    String getLabel() {
      return UPPER_UNDERSCORE.to(LOWER_HYPHEN, name());
@@ -157,7 +160,25 @@ public class SecretManagerKeyring implements Keyring {

  @Override
  public String getSqlReplicaConnectionName() {
-    return getString(StringKeyLabel.SQL_REPLICA_CONN_NAME);
+    try {
+      return getString(StringKeyLabel.SQL_REPLICA_CONN_NAME);
+    } catch (KeyringException e) {
+      return null;
+    }
+  }
+
+  @Override
+  public ImmutableList<String> getSqlReplicaConnectionNames() {
+    try {
+      String names = getString(StringKeyLabel.SQL_REPLICA_CONN_NAMES);
+      return ImmutableList.copyOf(
+          Splitter.on('\n').trimResults().omitEmptyStrings().splitToList(names));
+    } catch (KeyringException e) {
+      String replicaConnectionName = getSqlReplicaConnectionName();
+      return replicaConnectionName == null
+          ? ImmutableList.of()
+          : ImmutableList.of(replicaConnectionName);
+    }
  }

  /** No persistent resources are maintained for this Keyring implementation. */
--- a/core/src/main/java/google/registry/keyring/secretmanager/SecretManagerKeyringUpdater.java
+++ b/core/src/main/java/google/registry/keyring/secretmanager/SecretManagerKeyringUpdater.java
@@ -34,6 +34,7 @@ import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringK
 import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringKeyLabel.SAFE_BROWSING_API_KEY;
 import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringKeyLabel.SQL_PRIMARY_CONN_NAME;
 import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringKeyLabel.SQL_REPLICA_CONN_NAME;
+import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringKeyLabel.SQL_REPLICA_CONN_NAMES;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;

 import com.google.common.flogger.FluentLogger;
@@ -134,6 +135,10 @@ public final class SecretManagerKeyringUpdater {
    return setString(name, SQL_REPLICA_CONN_NAME);
  }

+  public SecretManagerKeyringUpdater setSqlReplicaConnectionNames(String names) {
+    return setString(names, SQL_REPLICA_CONN_NAMES);
+  }
+
  /**
   * Persists the secrets in the Secret Manager.
   *
--- a/core/src/main/java/google/registry/model/eppcommon/EppXmlTransformer.java
+++ b/core/src/main/java/google/registry/model/eppcommon/EppXmlTransformer.java
@@ -14,7 +14,6 @@

 package google.registry.model.eppcommon;

-import static com.google.common.collect.ImmutableList.toImmutableList;
 import static java.nio.charset.StandardCharsets.UTF_8;

 import com.google.common.annotations.VisibleForTesting;
@@ -28,7 +27,6 @@ import google.registry.model.domain.fee06.FeeInfoResponseExtensionV06;
 import google.registry.model.eppinput.EppInput;
 import google.registry.model.eppoutput.EppOutput;
 import google.registry.model.eppoutput.EppResponse;
-import google.registry.util.RegistryEnvironment;
 import google.registry.xml.ValidationMode;
 import google.registry.xml.XmlException;
 import google.registry.xml.XmlTransformer;
@@ -71,13 +69,9 @@ public class EppXmlTransformer  {
  private static final XmlTransformer OUTPUT_TRANSFORMER =
      new XmlTransformer(getSchemas(), EppOutput.class);

+  // TODO(b/159033801): remove method and inline ALL_SCHEMA.
  @VisibleForTesting
  public static ImmutableList<String> getSchemas() {
-    if (RegistryEnvironment.get().equals(RegistryEnvironment.PRODUCTION)) {
-      return ALL_SCHEMAS.stream()
-          .filter(s -> !NON_PROD_SCHEMAS.contains(s))
-          .collect(toImmutableList());
-    }
    return ALL_SCHEMAS;
  }

--- a/core/src/main/java/google/registry/persistence/PersistenceModule.java
+++ b/core/src/main/java/google/registry/persistence/PersistenceModule.java
@@ -15,6 +15,7 @@
 package google.registry.persistence;

 import static com.google.common.base.Preconditions.checkState;
+import static com.google.common.collect.ImmutableList.toImmutableList;
 import static google.registry.config.RegistryConfig.getHibernateConnectionIsolation;
 import static google.registry.config.RegistryConfig.getHibernateHikariConnectionTimeout;
 import static google.registry.config.RegistryConfig.getHibernateHikariIdleTimeout;
@@ -28,6 +29,7 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import com.google.auth.oauth2.GoogleCredentials;
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Ascii;
+import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.Maps;
 import dagger.BindsOptionalOf;
@@ -36,6 +38,7 @@ import dagger.Module;
 import dagger.Provides;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.persistence.transaction.CloudSqlCredentialSupplier;
+import google.registry.persistence.transaction.DelegatingReplicaJpaTransactionManager;
 import google.registry.persistence.transaction.JpaTransactionManager;
 import google.registry.persistence.transaction.JpaTransactionManagerImpl;
 import google.registry.persistence.transaction.TransactionManager;
@@ -59,6 +62,7 @@ import java.util.HashMap;
 import java.util.Map;
 import java.util.Optional;
 import java.util.Properties;
+import java.util.Random;
 import java.util.function.Supplier;
 import javax.annotation.Nullable;
 import org.hibernate.cfg.Environment;
@@ -264,16 +268,13 @@ public abstract class PersistenceModule {
  static JpaTransactionManager provideReadOnlyReplicaJpaTm(
      SqlCredentialStore credentialStore,
      @PartialCloudSqlConfigs ImmutableMap<String, String> cloudSqlConfigs,
-      @Config("cloudSqlReplicaInstanceConnectionName")
-          Optional<String> replicaInstanceConnectionName,
-      Clock clock) {
+      @Config("cloudSqlReplicaInstanceConnectionNames")
+          ImmutableList<String> replicaInstanceConnectionNames,
+      Clock clock,
+      Random random) {
    HashMap<String, String> overrides = Maps.newHashMap(cloudSqlConfigs);
    setSqlCredential(credentialStore, new RobotUser(RobotId.NOMULUS), overrides);
-    replicaInstanceConnectionName.ifPresent(
-        name -> overrides.put(HIKARI_DS_CLOUD_SQL_INSTANCE, name));
-    overrides.put(
-        Environment.ISOLATION, TransactionIsolationLevel.TRANSACTION_REPEATABLE_READ.name());
-    return new JpaTransactionManagerImpl(create(overrides), clock, true);
+    return createReplicaJpaTm(overrides, replicaInstanceConnectionNames, clock, random);
  }

  @Provides
@@ -281,15 +282,34 @@ public abstract class PersistenceModule {
  @BeamReadOnlyReplicaJpaTm
  static JpaTransactionManager provideBeamReadOnlyReplicaJpaTm(
      @BeamPipelineCloudSqlConfigs ImmutableMap<String, String> beamCloudSqlConfigs,
-      @Config("cloudSqlReplicaInstanceConnectionName")
-          Optional<String> replicaInstanceConnectionName,
-      Clock clock) {
+      @Config("cloudSqlReplicaInstanceConnectionNames")
+          ImmutableList<String> replicaInstanceConnectionNames,
+      Clock clock,
+      Random random) {
    HashMap<String, String> overrides = Maps.newHashMap(beamCloudSqlConfigs);
-    replicaInstanceConnectionName.ifPresent(
-        name -> overrides.put(HIKARI_DS_CLOUD_SQL_INSTANCE, name));
-    overrides.put(
+    return createReplicaJpaTm(overrides, replicaInstanceConnectionNames, clock, random);
+  }
+
+  private static JpaTransactionManager createReplicaJpaTm(
+      Map<String, String> baseOverrides,
+      ImmutableList<String> replicaInstanceConnectionNames,
+      Clock clock,
+      Random random) {
+    baseOverrides.put(
        Environment.ISOLATION, TransactionIsolationLevel.TRANSACTION_REPEATABLE_READ.name());
-    return new JpaTransactionManagerImpl(create(overrides), clock, true);
+    if (replicaInstanceConnectionNames.isEmpty()) {
+      return new JpaTransactionManagerImpl(create(baseOverrides), clock, true);
+    }
+    ImmutableList<JpaTransactionManager> replicas =
+        replicaInstanceConnectionNames.stream()
+            .map(
+                name -> {
+                  HashMap<String, String> overrides = Maps.newHashMap(baseOverrides);
+                  overrides.put(HIKARI_DS_CLOUD_SQL_INSTANCE, name);
+                  return new JpaTransactionManagerImpl(create(overrides), clock, true);
+                })
+            .collect(toImmutableList());
+    return new DelegatingReplicaJpaTransactionManager(replicas, random);
  }

  /** Constructs the {@link EntityManagerFactory} instance. */
--- a/core/src/main/java/google/registry/persistence/transaction/DelegatingReplicaJpaTransactionManager.java
+++ b/core/src/main/java/google/registry/persistence/transaction/DelegatingReplicaJpaTransactionManager.java
@@ -0,0 +1,361 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence.transaction;
+
+import static com.google.common.base.Preconditions.checkArgument;
+
+import com.google.common.collect.ImmutableCollection;
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMap;
+import google.registry.model.ImmutableObject;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
+import google.registry.persistence.VKey;
+import jakarta.persistence.EntityManager;
+import jakarta.persistence.Query;
+import jakarta.persistence.TypedQuery;
+import jakarta.persistence.criteria.CriteriaQuery;
+import jakarta.persistence.metamodel.Metamodel;
+import java.time.Instant;
+import java.util.Optional;
+import java.util.Random;
+import java.util.concurrent.Callable;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.function.Function;
+import java.util.stream.Stream;
+import org.joda.time.DateTime;
+
+/**
+ * A {@link JpaTransactionManager} that load-balances across multiple read-only replicas.
+ *
+ * <p>For each top-level transaction, one replica is chosen and used for the duration of the
+ * transaction. For non-transactional methods, a replica is chosen for each call.
+ */
+public class DelegatingReplicaJpaTransactionManager implements JpaTransactionManager {
+
+  private final ImmutableList<JpaTransactionManager> replicas;
+  private final Random random;
+  private static final AtomicLong nextId = new AtomicLong(1);
+
+  private static final ThreadLocal<JpaTransactionManager> activeReplica = new ThreadLocal<>();
+
+  public DelegatingReplicaJpaTransactionManager(
+      ImmutableList<JpaTransactionManager> replicas, Random random) {
+    checkArgument(!replicas.isEmpty(), "At least one replica must be provided");
+    this.replicas = replicas;
+    this.random = random;
+  }
+
+  private JpaTransactionManager getReplica() {
+    JpaTransactionManager replica = activeReplica.get();
+    if (replica != null) {
+      return replica;
+    }
+    return getRandomReplica();
+  }
+
+  private <T> T runMaybeAssigningReplica(Function<JpaTransactionManager, T> work) {
+    JpaTransactionManager existing = activeReplica.get();
+    if (existing != null) {
+      return work.apply(existing);
+    }
+    JpaTransactionManager replica = getRandomReplica();
+    activeReplica.set(replica);
+    try {
+      return work.apply(replica);
+    } finally {
+      activeReplica.remove();
+    }
+  }
+
+  private JpaTransactionManager getRandomReplica() {
+    return replicas.get(random.nextInt(replicas.size()));
+  }
+
+  @Override
+  public boolean inTransaction() {
+    var replica = activeReplica.get();
+    return replica != null && replica.inTransaction();
+  }
+
+  @Override
+  public void assertInTransaction() {
+    JpaTransactionManager replica = activeReplica.get();
+    if (replica == null) {
+      throw new IllegalStateException("Not in a transaction");
+    }
+    replica.assertInTransaction();
+  }
+
+  @Override
+  public long allocateId() {
+    return nextId.getAndIncrement();
+  }
+
+  @Override
+  public <T> T transact(Callable<T> work) {
+    return transact(null, work, false);
+  }
+
+  @Override
+  public <T> T transact(TransactionIsolationLevel isolationLevel, Callable<T> work) {
+    return transact(isolationLevel, work, false);
+  }
+
+  @Override
+  public <T> T transactNoRetry(Callable<T> work) {
+    return transactNoRetry(null, work, false);
+  }
+
+  @Override
+  public <T> T transactNoRetry(TransactionIsolationLevel isolationLevel, Callable<T> work) {
+    return transactNoRetry(isolationLevel, work, false);
+  }
+
+  @Override
+  public <T> T reTransact(Callable<T> work) {
+    return runMaybeAssigningReplica(replica -> replica.reTransact(work));
+  }
+
+  @Override
+  public void transact(ThrowingRunnable work) {
+    transact(
+        () -> {
+          work.run();
+          return null;
+        });
+  }
+
+  @Override
+  public void transact(TransactionIsolationLevel isolationLevel, ThrowingRunnable work) {
+    transact(
+        isolationLevel,
+        () -> {
+          work.run();
+          return null;
+        });
+  }
+
+  @Override
+  public void reTransact(ThrowingRunnable work) {
+    reTransact(
+        () -> {
+          work.run();
+          return null;
+        });
+  }
+
+  @Override
+  public DateTime getTransactionTime() {
+    return getReplica().getTransactionTime();
+  }
+
+  @Override
+  public Instant getTxTime() {
+    return getReplica().getTxTime();
+  }
+
+  @Override
+  public void insert(Object entity) {
+    getReplica().insert(entity);
+  }
+
+  @Override
+  public void insertAll(ImmutableCollection<?> entities) {
+    throw new UnsupportedOperationException("This is a replica database");
+  }
+
+  @Override
+  public void insertAll(ImmutableObject... entities) {
+    throw new UnsupportedOperationException("This is a replica database");
+  }
+
+  @Override
+  public void put(Object entity) {
+    throw new UnsupportedOperationException("This is a replica database");
+  }
+
+  @Override
+  public void putAll(ImmutableObject... entities) {
+    throw new UnsupportedOperationException("This is a replica database");
+  }
+
+  @Override
+  public void putAll(ImmutableCollection<?> entities) {
+    throw new UnsupportedOperationException("This is a replica database");
+  }
+
+  @Override
+  public void update(Object entity) {
+    throw new UnsupportedOperationException("This is a replica database");
+  }
+
+  @Override
+  public void updateAll(ImmutableCollection<?> entities) {
+    throw new UnsupportedOperationException("This is a replica database");
+  }
+
+  @Override
+  public void updateAll(ImmutableObject... entities) {
+    throw new UnsupportedOperationException("This is a replica database");
+  }
+
+  @Override
+  public boolean exists(Object entity) {
+    return getReplica().exists(entity);
+  }
+
+  @Override
+  public <T> boolean exists(VKey<T> key) {
+    return getReplica().exists(key);
+  }
+
+  @Override
+  public <T> Optional<T> loadByKeyIfPresent(VKey<T> key) {
+    return getReplica().loadByKeyIfPresent(key);
+  }
+
+  @Override
+  public <T> ImmutableMap<VKey<? extends T>, T> loadByKeysIfPresent(
+      Iterable<? extends VKey<? extends T>> keys) {
+    return getReplica().loadByKeysIfPresent(keys);
+  }
+
+  @Override
+  public <T> ImmutableList<T> loadByEntitiesIfPresent(Iterable<T> entities) {
+    return getReplica().loadByEntitiesIfPresent(entities);
+  }
+
+  @Override
+  public <T> T loadByKey(VKey<T> key) {
+    return getReplica().loadByKey(key);
+  }
+
+  @Override
+  public <T> ImmutableMap<VKey<? extends T>, T> loadByKeys(
+      Iterable<? extends VKey<? extends T>> keys) {
+    return getReplica().loadByKeys(keys);
+  }
+
+  @Override
+  public <T> T loadByEntity(T entity) {
+    return getReplica().loadByEntity(entity);
+  }
+
+  @Override
+  public <T> ImmutableList<T> loadByEntities(Iterable<T> entities) {
+    return getReplica().loadByEntities(entities);
+  }
+
+  @Override
+  public <T> ImmutableList<T> loadAllOf(Class<T> clazz) {
+    return getReplica().loadAllOf(clazz);
+  }
+
+  @Override
+  public <T> Stream<T> loadAllOfStream(Class<T> clazz) {
+    return getReplica().loadAllOfStream(clazz);
+  }
+
+  @Override
+  public <T> Optional<T> loadSingleton(Class<T> clazz) {
+    return getReplica().loadSingleton(clazz);
+  }
+
+  @Override
+  public void delete(VKey<?> key) {
+    throw new UnsupportedOperationException("This is a replica database");
+  }
+
+  @Override
+  public void delete(Iterable<? extends VKey<?>> keys) {
+    throw new UnsupportedOperationException("This is a replica database");
+  }
+
+  @Override
+  public <T> T delete(T entity) {
+    throw new UnsupportedOperationException("This is a replica database");
+  }
+
+  @Override
+  public <T> QueryComposer<T> createQueryComposer(Class<T> entity) {
+    return getReplica().createQueryComposer(entity);
+  }
+
+  @Override
+  public EntityManager getStandaloneEntityManager() {
+    return getReplica().getStandaloneEntityManager();
+  }
+
+  @Override
+  public Metamodel getMetaModel() {
+    return getReplica().getMetaModel();
+  }
+
+  @Override
+  public EntityManager getEntityManager() {
+    return getReplica().getEntityManager();
+  }
+
+  @Override
+  public <T> TypedQuery<T> query(String sqlString, Class<T> resultClass) {
+    return getReplica().query(sqlString, resultClass);
+  }
+
+  @Override
+  public <T> TypedQuery<T> criteriaQuery(CriteriaQuery<T> criteriaQuery) {
+    return getReplica().criteriaQuery(criteriaQuery);
+  }
+
+  @Override
+  public Query query(String sqlString) {
+    return getReplica().query(sqlString);
+  }
+
+  @Override
+  public <T> void assertDelete(VKey<T> key) {
+    throw new UnsupportedOperationException("This is a replica database");
+  }
+
+  @Override
+  public void teardown() {
+    for (JpaTransactionManager replica : replicas) {
+      replica.teardown();
+    }
+  }
+
+  @Override
+  public TransactionIsolationLevel getDefaultTransactionIsolationLevel() {
+    return replicas.get(0).getDefaultTransactionIsolationLevel();
+  }
+
+  @Override
+  public TransactionIsolationLevel getCurrentTransactionIsolationLevel() {
+    return getReplica().getCurrentTransactionIsolationLevel();
+  }
+
+  @Override
+  public <T> T transact(
+      TransactionIsolationLevel isolationLevel, Callable<T> work, boolean logSqlStatements) {
+    return runMaybeAssigningReplica(
+        replica -> replica.transact(isolationLevel, work, logSqlStatements));
+  }
+
+  @Override
+  public <T> T transactNoRetry(
+      TransactionIsolationLevel isolationLevel, Callable<T> work, boolean logSqlStatements) {
+    return runMaybeAssigningReplica(
+        replica -> replica.transactNoRetry(isolationLevel, work, logSqlStatements));
+  }
+}
--- a/core/src/main/java/google/registry/tools/GetKeyringSecretCommand.java
+++ b/core/src/main/java/google/registry/tools/GetKeyringSecretCommand.java
@@ -14,6 +14,7 @@

 package google.registry.tools;

+
 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
 import google.registry.keyring.api.KeySerializer;
@@ -95,6 +96,10 @@ final class GetKeyringSecretCommand implements Command {
          out.write(KeySerializer.serializeString(keyring.getSqlPrimaryConnectionName()));
      case SQL_REPLICA_CONN_NAME ->
          out.write(KeySerializer.serializeString(keyring.getSqlReplicaConnectionName()));
+      case SQL_REPLICA_CONN_NAMES ->
+          out.write(
+              KeySerializer.serializeString(
+                  String.join("\n", keyring.getSqlReplicaConnectionNames())));
    }
  }
 }
--- a/core/src/main/java/google/registry/tools/UniformRapidSuspensionCommand.java
+++ b/core/src/main/java/google/registry/tools/UniformRapidSuspensionCommand.java
@@ -146,7 +146,7 @@ final class UniformRapidSuspensionCommand extends MutatingEppToolCommand {
              ? ImmutableSet.of(StatusValue.CLIENT_HOLD.getXmlName())
              : ImmutableSet.of();
    } else {
-      statusesToApply = URS_LOCKS;
+      statusesToApply = ImmutableSet.copyOf(difference(URS_LOCKS, existingLocks));
    }

    // trigger renew flow
--- a/core/src/main/java/google/registry/tools/UpdateKeyringSecretCommand.java
+++ b/core/src/main/java/google/registry/tools/UpdateKeyringSecretCommand.java
@@ -100,6 +100,8 @@ final class UpdateKeyringSecretCommand implements Command {
          secretManagerKeyringUpdater.setSqlPrimaryConnectionName(deserializeString(input));
      case SQL_REPLICA_CONN_NAME ->
          secretManagerKeyringUpdater.setSqlReplicaConnectionName(deserializeString(input));
+      case SQL_REPLICA_CONN_NAMES ->
+          secretManagerKeyringUpdater.setSqlReplicaConnectionNames(deserializeString(input));
    }

    secretManagerKeyringUpdater.update();
--- a/core/src/main/java/google/registry/tools/params/KeyringKeyName.java
+++ b/core/src/main/java/google/registry/tools/params/KeyringKeyName.java
@@ -38,5 +38,6 @@ public enum KeyringKeyName {
  RDE_STAGING_PUBLIC_KEY,
  SAFE_BROWSING_API_KEY,
  SQL_PRIMARY_CONN_NAME,
-  SQL_REPLICA_CONN_NAME
+  SQL_REPLICA_CONN_NAME,
+  SQL_REPLICA_CONN_NAMES
 }
--- a/core/src/main/java/google/registry/xml/XmlTransformer.java
+++ b/core/src/main/java/google/registry/xml/XmlTransformer.java
@@ -41,7 +41,6 @@ import java.util.Collection;
 import java.util.Map;
 import javax.annotation.Nullable;
 import javax.xml.XMLConstants;
-import javax.xml.stream.FactoryConfigurationError;
 import javax.xml.stream.XMLInputFactory;
 import javax.xml.stream.XMLStreamException;
 import javax.xml.transform.OutputKeys;
@@ -69,7 +68,7 @@ public class XmlTransformer {
  private final JAXBContext jaxbContext;

  /** A factory for setting flags to disable XXE attacks. */
-  private static final XMLInputFactory XML_INPUT_FACTORY = createInputFactory();
+  private static final XMLInputFactory XML_INPUT_FACTORY = createXmlInputFactory();

  /** A {@link Schema} to validate XML. */
  private final Schema schema;
@@ -107,9 +106,13 @@ public class XmlTransformer {
    }
  }

-  private static XMLInputFactory createInputFactory() throws FactoryConfigurationError {
+  public static XMLInputFactory createXmlInputFactory() {
+    XMLInputFactory xmlInputFactory = XMLInputFactory.newDefaultFactory();
+    // Coalesce adjacent data, so that all chars in a string will be grouped as one item.
+    xmlInputFactory.setProperty(XMLInputFactory.IS_COALESCING, true);
+    // Preserve Name Space information.
+    xmlInputFactory.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, true);
    // Prevent XXE attacks.
-    XMLInputFactory xmlInputFactory = XMLInputFactory.newFactory();
    xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
    xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
    return xmlInputFactory;
--- a/core/src/test/java/google/registry/keyring/secretmanager/SecretManagerKeyringUpdaterTest.java
+++ b/core/src/test/java/google/registry/keyring/secretmanager/SecretManagerKeyringUpdaterTest.java
@@ -120,6 +120,23 @@ public class SecretManagerKeyringUpdaterTest {
    verifyPersistedSecret("sql-replica-conn-name", name);
  }

+  @Test
+  void sqlReplicaConnectionNames() {
+    String names = "name1\nname2";
+    updater.setSqlReplicaConnectionNames(names).update();
+
+    assertThat(keyring.getSqlReplicaConnectionNames()).containsExactly("name1", "name2").inOrder();
+    verifyPersistedSecret("sql-replica-conn-names", names);
+  }
+
+  @Test
+  void sqlReplicaConnectionNames_fallback() {
+    String name = "name";
+    updater.setSqlReplicaConnectionName(name).update();
+
+    assertThat(keyring.getSqlReplicaConnectionNames()).containsExactly(name);
+  }
+
  @Test
  void marksdbDnlLoginAndPassword() {
    String secret = "marksdbDnlLoginAndPassword";
--- a/core/src/test/java/google/registry/model/eppcommon/EppXmlTransformerTest.java
+++ b/core/src/test/java/google/registry/model/eppcommon/EppXmlTransformerTest.java
@@ -82,11 +82,11 @@ class EppXmlTransformerTest {
  }

  @Test
-  void testSchemas_inProduction_skipsFee1Point0() {
+  void testSchemas_inProduction_includesFee1Point0() {
    var currentEnv = RegistryEnvironment.get();
    try {
      RegistryEnvironment.PRODUCTION.setup();
-      assertThat(EppXmlTransformer.getSchemas()).doesNotContain("fee-std-v1.xsd");
+      assertThat(EppXmlTransformer.getSchemas()).contains("fee-std-v1.xsd");
    } finally {
      currentEnv.setup();
    }
--- a/core/src/test/java/google/registry/persistence/transaction/DelegatingReplicaJpaTransactionManagerTest.java
+++ b/core/src/test/java/google/registry/persistence/transaction/DelegatingReplicaJpaTransactionManagerTest.java
@@ -0,0 +1,135 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence.transaction;
+
+import static com.google.common.truth.Truth.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import com.google.common.collect.ImmutableList;
+import java.util.Random;
+import java.util.concurrent.Callable;
+import org.junit.jupiter.api.Test;
+
+/** Tests for {@link DelegatingReplicaJpaTransactionManager}. */
+public class DelegatingReplicaJpaTransactionManagerTest {
+
+  private JpaTransactionManager replica1 = mock(JpaTransactionManager.class);
+  private JpaTransactionManager replica2 = mock(JpaTransactionManager.class);
+  private Random random = mock(Random.class);
+  private DelegatingReplicaJpaTransactionManager transactionManager =
+      new DelegatingReplicaJpaTransactionManager(ImmutableList.of(replica1, replica2), random);
+
+  @Test
+  void testGetReplica_rotates() {
+    when(random.nextInt(2)).thenReturn(0).thenReturn(1);
+
+    transactionManager.loadByKey(null);
+    verify(replica1).loadByKey(null);
+
+    transactionManager.loadByKey(null);
+    verify(replica2).loadByKey(null);
+  }
+
+  @Test
+  void testTransact_usesSameReplica() throws Exception {
+    when(random.nextInt(2)).thenReturn(1);
+    when(replica2.transact(any(), any(), anyBoolean()))
+        .thenAnswer(
+            invocation -> {
+              Callable<Object> work = invocation.getArgument(1);
+              return work.call();
+            });
+
+    transactionManager.transact(
+        () -> {
+          transactionManager.loadByKey(null);
+          return null;
+        });
+
+    verify(replica2).transact(any(), any(), anyBoolean());
+    // The loadByKey inside the transact should also use replica2.
+    verify(replica2).loadByKey(null);
+    // And it should NOT have called random again for the nested call.
+    verify(random).nextInt(2);
+  }
+
+  @Test
+  void testTransactNoRetry_usesSameReplica() throws Exception {
+    when(random.nextInt(2)).thenReturn(0);
+    when(replica1.transactNoRetry(any(), any(), anyBoolean()))
+        .thenAnswer(
+            invocation -> {
+              Callable<Object> work = invocation.getArgument(1);
+              return work.call();
+            });
+
+    transactionManager.transactNoRetry(
+        () -> {
+          transactionManager.loadByKey(null);
+          return null;
+        });
+
+    verify(replica1).transactNoRetry(any(), any(), anyBoolean());
+    verify(replica1).loadByKey(null);
+    verify(random).nextInt(2);
+  }
+
+  @Test
+  void testReTransactNoRetry_usesSameReplica() throws Exception {
+    when(random.nextInt(2)).thenReturn(0);
+    when(replica1.reTransact(any(Callable.class)))
+        .thenAnswer(
+            invocation -> {
+              Callable<Object> work = invocation.getArgument(0);
+              return work.call();
+            });
+
+    transactionManager.reTransact(
+        () -> {
+          transactionManager.loadByKey(null);
+          return null;
+        });
+
+    verify(replica1).reTransact(any(Callable.class));
+    verify(replica1).loadByKey(null);
+    verify(random).nextInt(2);
+  }
+
+  @Test
+  void testInTransaction() {
+    when(random.nextInt(2)).thenReturn(0);
+    when(replica1.inTransaction()).thenReturn(true);
+
+    // Not in transaction yet
+    assertThat(transactionManager.inTransaction()).isFalse();
+
+    transactionManager.transact(
+        () -> {
+          assertThat(transactionManager.inTransaction()).isTrue();
+          return null;
+        });
+  }
+
+  @Test
+  void testTeardown_tearsDownAllReplicas() {
+    transactionManager.teardown();
+    verify(replica1).teardown();
+    verify(replica2).teardown();
+  }
+}
--- a/core/src/test/java/google/registry/testing/FakeKeyringModule.java
+++ b/core/src/test/java/google/registry/testing/FakeKeyringModule.java
@@ -19,6 +19,7 @@ import static google.registry.keyring.api.PgpHelper.KeyRequirement.SIGN;
 import static google.registry.testing.TestDataHelper.loadBytes;
 import static google.registry.testing.TestDataHelper.loadFile;

+import com.google.common.collect.ImmutableList;
 import com.google.common.io.ByteSource;
 import dagger.Module;
 import dagger.Provides;
@@ -57,7 +58,8 @@ public final class FakeKeyringModule {
  private static final String MARKSDB_SMDRL_LOGIN_AND_PASSWORD = "smdrl:yolo";
  private static final String BSA_API_KEY = "bsaapikey";
  private static final String SQL_PRIMARY_CONNECTION = "project:primary-region:primary-name";
-  private static final String SQL_REPLICA_CONNECTION = "project:replica-region:replica-name";
+  private static final String SQL_REPLICA_CONNECTION_1 = "project:replica-region:replica-name";
+  private static final String SQL_REPLICA_CONNECTION_2 = "project:replica-region:replica-name-2";

  @Provides
  public Keyring get() {
@@ -160,7 +162,12 @@ public final class FakeKeyringModule {

      @Override
      public String getSqlReplicaConnectionName() {
-        return SQL_REPLICA_CONNECTION;
+        return SQL_REPLICA_CONNECTION_1;
+      }
+
+      @Override
+      public ImmutableList<String> getSqlReplicaConnectionNames() {
+        return ImmutableList.of(SQL_REPLICA_CONNECTION_1, SQL_REPLICA_CONNECTION_2);
      }

      @Override
--- a/core/src/test/java/google/registry/tools/UniformRapidSuspensionCommandTest.java
+++ b/core/src/test/java/google/registry/tools/UniformRapidSuspensionCommandTest.java
@@ -94,6 +94,34 @@ class UniformRapidSuspensionCommandTest
    assertNotInStdout("--restore_client_hold");
  }

+  @Test
+  void testCommand_respectExistingStatuses() throws Exception {
+    persistDomainWithHosts(
+        defaultDomain
+            .asBuilder()
+            .addStatusValues(ImmutableSet.of(StatusValue.SERVER_DELETE_PROHIBITED))
+            .build(),
+        defaultDsData,
+        ns1,
+        ns2);
+    runCommandForced(
+        "--domain_name=evil.tld",
+        "--hosts=urs1.example.com,urs2.example.com",
+        "--dsdata=1 1 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
+        "--renew_one_year=false");
+    eppVerifier
+        .expectRegistrarId("CharlestonRoad")
+        .expectSuperuser()
+        .verifySent("uniform_rapid_suspension_with_forbid_delete.xml")
+        .verifyNoMoreSent();
+    assertInStdout("uniform_rapid_suspension --undo");
+    assertInStdout("--domain_name evil.tld");
+    assertInStdout("--hosts ns1.example.com,ns2.example.com");
+    assertInStdout("--dsdata 1 2 3 DEAD,4 5 6 BEEF");
+    assertInStdout("--locks_to_preserve serverDeleteProhibited");
+    assertNotInStdout("--restore_client_hold");
+  }
+
  @Test
  void testCommand_respectsExistingHost() throws Exception {
    persistDomainWithHosts(defaultDomain, defaultDsData, urs2, ns1);
--- a/core/src/test/resources/google/registry/tools/server/uniform_rapid_suspension_with_forbid_delete.xml
+++ b/core/src/test/resources/google/registry/tools/server/uniform_rapid_suspension_with_forbid_delete.xml
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
+  <command>
+    <update>
+      <domain:update xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
+        <domain:name>evil.tld</domain:name>
+        <domain:add>
+          <domain:ns>
+            <domain:hostObj>urs1.example.com</domain:hostObj>
+            <domain:hostObj>urs2.example.com</domain:hostObj>
+          </domain:ns>
+          <domain:status s="serverTransferProhibited" />
+          <domain:status s="serverUpdateProhibited" />
+        </domain:add>
+        <domain:rem>
+          <domain:ns>
+            <domain:hostObj>ns2.example.com</domain:hostObj>
+            <domain:hostObj>ns1.example.com</domain:hostObj>
+          </domain:ns>
+        </domain:rem>
+      </domain:update>
+    </update>
+    <extension>
+      <secDNS:update xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
+        <secDNS:rem>
+          <secDNS:all>true</secDNS:all>
+        </secDNS:rem>
+        <secDNS:add>
+          <secDNS:dsData>
+            <secDNS:keyTag>1</secDNS:keyTag>
+            <secDNS:alg>1</secDNS:alg>
+            <secDNS:digestType>1</secDNS:digestType>
+            <secDNS:digest>A94A8FE5CCB19BA61C4C0873D391E987982FBBD3</secDNS:digest>
+          </secDNS:dsData>
+        </secDNS:add>
+      </secDNS:update>
+      <superuser:domainUpdate xmlns:superuser="urn:google:params:xml:ns:superuser-1.0">
+        <superuser:autorenews>false</superuser:autorenews>
+      </superuser:domainUpdate>
+      <metadata:metadata xmlns:metadata="urn:google:params:xml:ns:metadata-1.0">
+        <metadata:reason>Uniform Rapid Suspension</metadata:reason>
+        <metadata:requestedByRegistrar>false</metadata:requestedByRegistrar>
+      </metadata:metadata>
+    </extension>
+    <clTRID>RegistryTool</clTRID>
+  </command>
+</epp>
--- a/db/buildscript-gradle.lockfile
+++ b/db/buildscript-gradle.lockfile
@@ -4,9 +4,9 @@
 com.fasterxml.jackson.core:jackson-annotations:2.21=classpath
 gradle.plugin.org.flywaydb:gradle-plugin-publishing:12.2.0=classpath
 org.flywaydb.flyway:org.flywaydb.flyway.gradle.plugin:12.2.0=classpath
-org.flywaydb:flyway-core:12.3.0=classpath
-org.flywaydb:flyway-database-postgresql:12.3.0=classpath
-tools.jackson.core:jackson-core:3.1.0=classpath
-tools.jackson.core:jackson-databind:3.1.0=classpath
-tools.jackson:jackson-bom:3.1.0=classpath
+org.flywaydb:flyway-core:12.4.0=classpath
+org.flywaydb:flyway-database-postgresql:12.4.0=classpath
+tools.jackson.core:jackson-core:3.1.1=classpath
+tools.jackson.core:jackson-databind:3.1.1=classpath
+tools.jackson:jackson-bom:3.1.1=classpath
 empty=
--- a/db/gradle.lockfile
+++ b/db/gradle.lockfile
@@ -110,8 +110,8 @@ org.codehaus.plexus:plexus-classworlds:2.6.0=checkstyle
 org.codehaus.plexus:plexus-component-annotations:2.1.0=checkstyle
 org.codehaus.plexus:plexus-container-default:2.1.0=checkstyle
 org.codehaus.plexus:plexus-utils:3.3.0=checkstyle
-org.flywaydb:flyway-core:12.3.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-database-postgresql:12.3.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-core:12.4.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-database-postgresql:12.4.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.hamcrest:hamcrest-core:1.3=testCompileClasspath,testRuntimeClasspath
 org.jacoco:org.jacoco.agent:0.8.14=jacocoAgent,jacocoAnt
 org.jacoco:org.jacoco.ant:0.8.14=jacocoAnt
@@ -149,7 +149,7 @@ org.testcontainers:postgresql:1.21.4=testCompileClasspath,testRuntimeClasspath
 org.testcontainers:testcontainers:1.21.4=testCompileClasspath,testRuntimeClasspath
 org.testcontainers:testcontainers:2.0.4=compileClasspath,deploy_jar,runtimeClasspath
 org.xmlresolver:xmlresolver:5.2.2=checkstyle
-tools.jackson.core:jackson-core:3.1.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-tools.jackson.core:jackson-databind:3.1.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-tools.jackson:jackson-bom:3.1.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+tools.jackson.core:jackson-core:3.1.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+tools.jackson.core:jackson-databind:3.1.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+tools.jackson:jackson-bom:3.1.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 empty=implementationApi,integration,schema,shadow
--- a/java_common.gradle
+++ b/java_common.gradle
@@ -88,6 +88,7 @@ test {
 // A typical use case is to run tests from desktop that accesses Cloud resources.
 tasks.withType(Test).configureEach {
  maxHeapSize = "4096m"
+  jvmArgs "--sun-misc-unsafe-memory-access=allow", "--enable-native-access=ALL-UNNAMED"
  def gcp_integration_env_property = 'test.gcp_integration.env'

  if (project.hasProperty(gcp_integration_env_property)) {
--- a/jetty/Dockerfile
+++ b/jetty/Dockerfile
@@ -1,10 +1,15 @@
-FROM jetty:12-jdk21
+FROM jetty:12-jdk25
 ADD --chown=jetty:jetty build/jetty-base /jetty-base
 ADD --chown=jetty:jetty start.sh /
 ADD --chown=jetty:jetty logging.properties /

 USER root

+# wget is not installed by default in :12-jdk25
+RUN apt-get update && \
+    apt-get install -y wget && \
+    rm -rf /var/lib/apt/lists/*
+
 # Create a directory, download and extract the Cloud Profiler agent, version locked to "cloud-profiler-java-agent_20241028_RC00.tar.gz".
 RUN mkdir -p /opt/cprof && \
    wget -q -O- https://storage.googleapis.com/cloud-profiler/java/cloud-profiler-java-agent_20241028_RC00.tar.gz\
@@ -14,6 +19,6 @@ RUN mkdir -p /opt/cprof && \
 USER jetty

 EXPOSE 8080
-# jetty:12-jdk21 has bash. We can afford the extra 200M in image size over
+# jetty:12-jdk25 has bash. We can afford the extra 200M in image size over
 # the -alpine flavor.
 ENTRYPOINT ["/bin/bash", "/start.sh"]
--- a/jetty/build.gradle
+++ b/jetty/build.gradle
@@ -85,6 +85,7 @@ tasks.register('run', JavaExec) {
    }
    def jetty_home = System.getenv('JETTY_HOME')
    def environment = rootProject.environment
+    jvmArgs "--sun-misc-unsafe-memory-access=allow", "--enable-native-access=ALL-UNNAMED"
    workingDir(layout.buildDirectory.dir('jetty-base'))
    classpath = files(jetty_home + '/start.jar')
    systemProperty('google.registry.environment', environment)
@@ -109,7 +110,8 @@ tasks.register('deployCloudScheduler', Exec) {
    commandLine './deployer',
        "${rootDir}/core/src/main/java/google/registry/config/files/nomulus-config-${rootProject.environment}.yaml",
        "${rootDir}/core/src/main/java/google/registry/config/files/tasks/cloud-scheduler-tasks-${rootProject.environment}.xml",
-        rootProject.gcpProject, '--gke'
+        rootProject.gcpProject == null ? "gcpProject" : rootProject.gcpProject,
+        '--gke'
    // Only deploy the tasks after Nomulus itself is deployed.
    mustRunAfter(tasks.named('deployToGke'))
 }
@@ -120,7 +122,8 @@ tasks.register('deployQueue', Exec) {
    commandLine './deployer',
        "${rootDir}/core/src/main/java/google/registry/config/files/nomulus-config-${rootProject.environment}.yaml",
        "${rootDir}/core/src/main/java/google/registry/config/files/cloud-tasks-queue.xml",
-        rootProject.gcpProject, '--gke'
+        rootProject.gcpProject == null ? "gcpProject" : rootProject.gcpProject,
+        '--gke'
    // Only deploy the queues after Nomulus itself is deployed.
    mustRunAfter(tasks.named('deployToGke'))
 }
--- a/jetty/gradle.lockfile
+++ b/jetty/gradle.lockfile
@@ -73,9 +73,9 @@ com.google.api:gax:2.74.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-admin-directory:directory_v1-rev20260227-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-bigquery:v2-rev20240815-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20240310-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-dataflow:v1b3-rev20260213-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-dns:v1-rev20260219-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-drive:v3-rev20260322-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-dataflow:v1b3-rev20260405-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-dns:v1-rev20260402-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-drive:v3-rev20260405-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-gmail:v1-rev20260112-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20220614-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240130-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -323,10 +323,10 @@ org.apache.maven.doxia:doxia-logging-api:1.12.0=checkstyle
 org.apache.maven.doxia:doxia-module-xdoc:1.12.0=checkstyle
 org.apache.maven.doxia:doxia-sink-api:1.12.0=checkstyle
 org.apache.xbean:xbean-reflect:3.7=checkstyle
-org.bouncycastle:bcpg-jdk18on:1.83=deploy_jar,runtimeClasspath,testRuntimeClasspath
-org.bouncycastle:bcpkix-jdk18on:1.83=deploy_jar,runtimeClasspath,testRuntimeClasspath
-org.bouncycastle:bcprov-jdk18on:1.83=deploy_jar,runtimeClasspath,testRuntimeClasspath
-org.bouncycastle:bcutil-jdk18on:1.83=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.bouncycastle:bcpg-jdk18on:1.84=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.bouncycastle:bcpkix-jdk18on:1.84=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.bouncycastle:bcprov-jdk18on:1.84=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.bouncycastle:bcutil-jdk18on:1.84=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.checkerframework:checker-compat-qual:2.5.6=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.19.0=annotationProcessor,testAnnotationProcessor
 org.checkerframework:checker-qual:3.49.3=checkstyle
@@ -341,8 +341,8 @@ org.eclipse.angus:angus-activation:2.1.0-M1=deploy_jar,runtimeClasspath,testRunt
 org.eclipse.angus:jakarta.mail:2.1.0-M1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.eclipse.collections:eclipse-collections-api:11.1.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.eclipse.collections:eclipse-collections:11.1.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-org.flywaydb:flyway-core:12.3.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-org.flywaydb:flyway-database-postgresql:12.3.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.flywaydb:flyway-core:12.4.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.flywaydb:flyway-database-postgresql:12.4.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-core:4.0.6=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-runtime:4.0.6=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.glassfish.jaxb:txw2:4.0.6=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -403,16 +403,16 @@ org.w3c.css:sac:1.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.xerial.snappy:snappy-java:1.1.10.4=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.xmlresolver:xmlresolver:5.2.2=checkstyle
 org.yaml:snakeyaml:2.4=deploy_jar,runtimeClasspath,testRuntimeClasspath
-tools.jackson.core:jackson-core:3.1.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-tools.jackson.core:jackson-databind:3.1.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-tools.jackson:jackson-bom:3.1.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+tools.jackson.core:jackson-core:3.1.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+tools.jackson.core:jackson-databind:3.1.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+tools.jackson:jackson-bom:3.1.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-api:17.1.7=deploy_jar,runtimeClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-diagram:17.9.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-operations:17.9.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-postgresql:17.9.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-text:17.9.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-diagram:17.10.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-operations:17.10.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-postgresql:17.10.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-text:17.10.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-tools:17.1.7=deploy_jar,runtimeClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-utility:17.1.7=deploy_jar,runtimeClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler:17.9.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler:17.10.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 xerces:xmlParserAPIs:2.6.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 empty=compileClasspath,providedCompile,providedRuntime,shadow,testCompileClasspath
--- a/load-testing/gradle.lockfile
+++ b/load-testing/gradle.lockfile
@@ -9,7 +9,7 @@ com.google.auto:auto-common:1.2.2=annotationProcessor,testAnnotationProcessor
 com.google.code.findbugs:jsr305:3.0.2=checkstyle
 com.google.errorprone:error_prone_annotation:2.48.0=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.36.0=checkstyle
-com.google.errorprone:error_prone_annotations:2.41.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.47.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotations:2.48.0=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_check_api:2.48.0=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.48.0=annotationProcessor,testAnnotationProcessor
@@ -18,7 +18,8 @@ com.google.flogger:flogger:0.9=compileClasspath,deploy_jar,runtimeClasspath,test
 com.google.googlejavaformat:google-java-format:1.34.1=annotationProcessor,testAnnotationProcessor
 com.google.guava:failureaccess:1.0.3=annotationProcessor,checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.guava:guava:33.4.8-jre=checkstyle
-com.google.guava:guava:33.5.0-jre=annotationProcessor,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava:33.5.0-jre=annotationProcessor,testAnnotationProcessor
+com.google.guava:guava:33.6.0-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.j2objc:j2objc-annotations:3.0.0=checkstyle
 com.google.j2objc:j2objc-annotations:3.1=annotationProcessor,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
@@ -54,10 +55,10 @@ org.apache.maven.doxia:doxia-logging-api:1.12.0=checkstyle
 org.apache.maven.doxia:doxia-module-xdoc:1.12.0=checkstyle
 org.apache.maven.doxia:doxia-sink-api:1.12.0=checkstyle
 org.apache.xbean:xbean-reflect:3.7=checkstyle
-org.bouncycastle:bcpg-jdk18on:1.83=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcpkix-jdk18on:1.83=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcprov-jdk18on:1.83=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcutil-jdk18on:1.83=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpg-jdk18on:1.84=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpkix-jdk18on:1.84=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcprov-jdk18on:1.84=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcutil-jdk18on:1.84=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.19.0=annotationProcessor,testAnnotationProcessor
 org.checkerframework:checker-qual:3.49.3=checkstyle
 org.codehaus.plexus:plexus-classworlds:2.6.0=checkstyle
--- a/networking/gradle.lockfile
+++ b/networking/gradle.lockfile
@@ -36,8 +36,8 @@ com.google.dagger:dagger:2.59.2=annotationProcessor,compileClasspath,deploy_jar,
 com.google.devtools.ksp:symbol-processing-api:2.2.20-2.0.3=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotation:2.48.0=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.36.0=checkstyle
-com.google.errorprone:error_prone_annotations:2.41.0=compileClasspath
 com.google.errorprone:error_prone_annotations:2.43.0=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.47.0=compileClasspath
 com.google.errorprone:error_prone_annotations:2.48.0=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_check_api:2.48.0=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.48.0=annotationProcessor,testAnnotationProcessor
@@ -48,7 +48,8 @@ com.google.guava:failureaccess:1.0.2=testCompileClasspath
 com.google.guava:failureaccess:1.0.3=annotationProcessor,checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
 com.google.guava:guava:33.4.3-android=testCompileClasspath
 com.google.guava:guava:33.4.8-jre=checkstyle
-com.google.guava:guava:33.5.0-jre=annotationProcessor,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
+com.google.guava:guava:33.5.0-jre=annotationProcessor,deploy_jar,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
+com.google.guava:guava:33.6.0-jre=compileClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-apache-v2:1.45.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-gson:2.1.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -130,9 +131,9 @@ org.apache.maven.doxia:doxia-module-xdoc:1.12.0=checkstyle
 org.apache.maven.doxia:doxia-sink-api:1.12.0=checkstyle
 org.apache.xbean:xbean-reflect:3.7=checkstyle
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
-org.bouncycastle:bcpkix-jdk18on:1.83=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcprov-jdk18on:1.83=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcutil-jdk18on:1.83=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpkix-jdk18on:1.84=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcprov-jdk18on:1.84=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcutil-jdk18on:1.84=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.checkerframework:checker-compat-qual:2.5.3=annotationProcessor,testAnnotationProcessor
 org.checkerframework:checker-compat-qual:2.5.6=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.19.0=annotationProcessor,testAnnotationProcessor
--- a/prober/gradle.lockfile
+++ b/prober/gradle.lockfile
@@ -38,8 +38,8 @@ com.google.dagger:dagger:2.59.2=annotationProcessor,compileClasspath,deploy_jar,
 com.google.devtools.ksp:symbol-processing-api:2.2.20-2.0.3=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotation:2.48.0=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.36.0=checkstyle
-com.google.errorprone:error_prone_annotations:2.41.0=compileClasspath
 com.google.errorprone:error_prone_annotations:2.43.0=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.47.0=compileClasspath
 com.google.errorprone:error_prone_annotations:2.48.0=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_check_api:2.48.0=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.48.0=annotationProcessor,testAnnotationProcessor
@@ -50,7 +50,8 @@ com.google.guava:failureaccess:1.0.2=testCompileClasspath
 com.google.guava:failureaccess:1.0.3=annotationProcessor,checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
 com.google.guava:guava:33.4.3-android=testCompileClasspath
 com.google.guava:guava:33.4.8-jre=checkstyle
-com.google.guava:guava:33.5.0-jre=annotationProcessor,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
+com.google.guava:guava:33.5.0-jre=annotationProcessor,deploy_jar,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
+com.google.guava:guava:33.6.0-jre=compileClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-apache-v2:1.45.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-gson:2.1.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -137,9 +138,9 @@ org.apache.maven.doxia:doxia-module-xdoc:1.12.0=checkstyle
 org.apache.maven.doxia:doxia-sink-api:1.12.0=checkstyle
 org.apache.xbean:xbean-reflect:3.7=checkstyle
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
-org.bouncycastle:bcpkix-jdk18on:1.83=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcprov-jdk18on:1.83=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcutil-jdk18on:1.83=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpkix-jdk18on:1.84=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcprov-jdk18on:1.84=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcutil-jdk18on:1.84=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.checkerframework:checker-compat-qual:2.5.3=annotationProcessor,testAnnotationProcessor
 org.checkerframework:checker-compat-qual:2.5.6=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.19.0=annotationProcessor,testAnnotationProcessor
--- a/processor/gradle.lockfile
+++ b/processor/gradle.lockfile
@@ -9,14 +9,15 @@ com.google.auto:auto-common:1.2.2=annotationProcessor,testAnnotationProcessor
 com.google.code.findbugs:jsr305:3.0.2=checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotation:2.48.0=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.36.0=checkstyle
-com.google.errorprone:error_prone_annotations:2.41.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.47.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotations:2.48.0=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_check_api:2.48.0=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.48.0=annotationProcessor,testAnnotationProcessor
 com.google.googlejavaformat:google-java-format:1.34.1=annotationProcessor,testAnnotationProcessor
 com.google.guava:failureaccess:1.0.3=annotationProcessor,checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.guava:guava:33.4.8-jre=checkstyle
-com.google.guava:guava:33.5.0-jre=annotationProcessor,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava:33.5.0-jre=annotationProcessor,testAnnotationProcessor
+com.google.guava:guava:33.6.0-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.j2objc:j2objc-annotations:3.0.0=checkstyle
 com.google.j2objc:j2objc-annotations:3.1=annotationProcessor,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
--- a/proxy/gradle.lockfile
+++ b/proxy/gradle.lockfile
@@ -168,9 +168,9 @@ org.apache.maven.doxia:doxia-module-xdoc:1.12.0=checkstyle
 org.apache.maven.doxia:doxia-sink-api:1.12.0=checkstyle
 org.apache.xbean:xbean-reflect:3.7=checkstyle
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
-org.bouncycastle:bcpkix-jdk18on:1.83=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcprov-jdk18on:1.83=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcutil-jdk18on:1.83=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpkix-jdk18on:1.84=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcprov-jdk18on:1.84=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcutil-jdk18on:1.84=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.checkerframework:checker-compat-qual:2.5.3=annotationProcessor,testAnnotationProcessor
 org.checkerframework:checker-compat-qual:2.5.6=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.19.0=annotationProcessor,testAnnotationProcessor
--- a/release/cloudbuild-kythe.yaml
+++ b/release/cloudbuild-kythe.yaml
@@ -31,6 +31,7 @@ steps:
    export JAVAC_EXTRACTOR_JAR="$${PWD}/kythe/extractors/javac_extractor.jar"
    jvmopts="--add-exports=jdk.compiler/com.sun.tools.javac.main=ALL-UNNAMED"
    jvmopts="$${jvmopts} --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED"
+    jvmopts="$${jvmopts} --add-exports=jdk.compiler/com.sun.tools.javac.model=ALL-UNNAMED"
    jvmopts="$${jvmopts} --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED"
    jvmopts="$${jvmopts} --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED"
    jvmopts="$${jvmopts} --add-exports=jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED"
--- a/release/cloudbuild-nomulus.yaml
+++ b/release/cloudbuild-nomulus.yaml
@@ -27,7 +27,7 @@ steps:
 - name: 'gcr.io/${PROJECT_ID}/builder:latest'
  # Set home for Gradle caches. Must be consistent with last step below
  # and ./build_nomulus_for_env.sh
-  env: [ 'GRADLE_USER_HOME=/workspace/cloudbuild-caches' ]
+  env: [ 'GRADLE_USER_HOME=/workspace/cloudbuild-caches', 'DOCKER_API_VERSION=1.41' ]
  entrypoint: /bin/bash
  args:
  - -c
@@ -45,7 +45,7 @@ steps:
 - name: 'gcr.io/${PROJECT_ID}/builder:latest'
  # Set home for Gradle caches. Must be consistent with last step below
  # and ./build_nomulus_for_env.sh
-  env: [ 'GRADLE_USER_HOME=/workspace/cloudbuild-caches' ]
+  env: [ 'GRADLE_USER_HOME=/workspace/cloudbuild-caches', 'DOCKER_API_VERSION=1.41' ]
  entrypoint: /bin/bash
  args:
  - -c
@@ -102,6 +102,7 @@ steps:
 # nomulus.jar built earlier.
 - name: 'gcr.io/${PROJECT_ID}/builder:latest'
  entrypoint: /bin/bash
+  env: [ 'DOCKER_API_VERSION=1.41' ]
  args:
  - -c
  - |
@@ -119,6 +120,7 @@ steps:
 # nomulus.jar built earlier.
 - name: 'gcr.io/${PROJECT_ID}/builder:latest'
  entrypoint: /bin/bash
+  env: [ 'DOCKER_API_VERSION=1.41' ]
  args:
  - -c
  - |
--- a/release/cloudbuild-release.yaml
+++ b/release/cloudbuild-release.yaml
@@ -67,14 +67,14 @@ steps:
    docker tag gcr.io/${PROJECT_ID}/builder:${TAG_NAME} gcr.io/${PROJECT_ID}/builder:latest
    docker push gcr.io/${PROJECT_ID}/builder:${TAG_NAME}
    docker push gcr.io/${PROJECT_ID}/builder:latest
-    docker pull jetty:12-jdk21
-    docker tag jetty:12-jdk21 gcr.io/${PROJECT_ID}/jetty:${TAG_NAME}
-    docker tag jetty:12-jdk21 gcr.io/${PROJECT_ID}/jetty:latest
+    docker pull jetty:12-jdk25
+    docker tag jetty:12-jdk25 gcr.io/${PROJECT_ID}/jetty:${TAG_NAME}
+    docker tag jetty:12-jdk25 gcr.io/${PROJECT_ID}/jetty:latest
    docker push gcr.io/${PROJECT_ID}/jetty:${TAG_NAME}
    docker push gcr.io/${PROJECT_ID}/jetty:latest
-    docker pull eclipse-temurin:21
-    docker tag eclipse-temurin:21 gcr.io/${PROJECT_ID}/temurin:${TAG_NAME}
-    docker tag eclipse-temurin:21 gcr.io/${PROJECT_ID}/temurin:latest
+    docker pull eclipse-temurin:25
+    docker tag eclipse-temurin:25 gcr.io/${PROJECT_ID}/temurin:${TAG_NAME}
+    docker tag eclipse-temurin:25 gcr.io/${PROJECT_ID}/temurin:latest
    docker push gcr.io/${PROJECT_ID}/temurin:${TAG_NAME}
    docker push gcr.io/${PROJECT_ID}/temurin:latest
  dir: 'release/builder/'
@@ -91,9 +91,9 @@ steps:
      --format='get(digest)' --filter='tags = ${TAG_NAME}')
    temurin_digest=$(gcloud container images list-tags gcr.io/${PROJECT_ID}/temurin \
      --format='get(digest)' --filter='tags = ${TAG_NAME}')
-    sed -i s%eclipse-temurin:21%gcr.io/${PROJECT_ID}/temurin@$temurin_digest%g proxy/Dockerfile
-    sed -i s%eclipse-temurin:21%gcr.io/${PROJECT_ID}/temurin@$temurin_digest%g core/Dockerfile
-    sed -i s%jetty:12-jdk21%gcr.io/${PROJECT_ID}/jetty@$jetty_digest%g jetty/Dockerfile
+    sed -i s%eclipse-temurin:25%gcr.io/${PROJECT_ID}/temurin@$temurin_digest%g proxy/Dockerfile
+    sed -i s%eclipse-temurin:25%gcr.io/${PROJECT_ID}/temurin@$temurin_digest%g core/Dockerfile
+    sed -i s%jetty:12-jdk25%gcr.io/${PROJECT_ID}/jetty@$jetty_digest%g jetty/Dockerfile
    sed -i s/builder:latest/builder@$builder_digest/g release/cloudbuild-proxy.yaml
    sed -i s/builder:latest/builder@$builder_digest/g release/cloudbuild-nomulus.yaml
    sed -i s/builder:latest/builder@$builder_digest/g release/cloudbuild-deploy-gke.yaml
--- a/release/schema-deployer/deploy_sql_schema.sh
+++ b/release/schema-deployer/deploy_sql_schema.sh
@@ -78,7 +78,7 @@ if ! pgrep cloud_sql_proxy; then
  exit 1
 fi

-/flyway/flyway -postgresql.transactional.lock=false -community \
+/flyway/flyway -postgresql.transactional.lock=false \
  -user=${db_user} -password=${db_password} \
  -url=jdbc:postgresql://localhost:5432/postgres \
  -locations=classpath:sql/flyway \
@@ -87,7 +87,7 @@ migration_result=$?

 if [ ${flyway_action} == "migrate" ]; then
  # After deployment, log the current schema.
-  /flyway/flyway -community -user=${db_user} -password=${db_password} \
+  /flyway/flyway -user=${db_user} -password=${db_password} \
    -url=jdbc:postgresql://localhost:5432/postgres \
    -locations=classpath:sql/flyway \
    info
--- a/util/gradle.lockfile
+++ b/util/gradle.lockfile
@@ -37,7 +37,8 @@ com.google.devtools.ksp:symbol-processing-api:2.2.20-2.0.3=annotationProcessor,t
 com.google.errorprone:error_prone_annotation:2.48.0=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.36.0=checkstyle
 com.google.errorprone:error_prone_annotations:2.42.0=compileClasspath
-com.google.errorprone:error_prone_annotations:2.43.0=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.43.0=deploy_jar,runtimeClasspath
+com.google.errorprone:error_prone_annotations:2.47.0=testCompileClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotations:2.48.0=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_check_api:2.48.0=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.48.0=annotationProcessor,testAnnotationProcessor
@@ -45,9 +46,10 @@ com.google.flogger:flogger-system-backend:0.9=compileClasspath,deploy_jar,runtim
 com.google.flogger:flogger:0.9=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.googlejavaformat:google-java-format:1.34.1=annotationProcessor,testAnnotationProcessor
 com.google.guava:failureaccess:1.0.3=annotationProcessor,checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.guava:guava-testlib:33.5.0-jre=testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava-testlib:33.6.0-jre=testCompileClasspath,testRuntimeClasspath
 com.google.guava:guava:33.4.8-jre=checkstyle
-com.google.guava:guava:33.5.0-jre=annotationProcessor,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava:33.5.0-jre=annotationProcessor,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor
+com.google.guava:guava:33.6.0-jre=testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-apache-v2:1.45.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-gson:2.1.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -123,9 +125,9 @@ org.apache.maven.doxia:doxia-module-xdoc:1.12.0=checkstyle
 org.apache.maven.doxia:doxia-sink-api:1.12.0=checkstyle
 org.apache.xbean:xbean-reflect:3.7=checkstyle
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
-org.bouncycastle:bcpkix-jdk18on:1.83=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcprov-jdk18on:1.83=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcutil-jdk18on:1.83=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpkix-jdk18on:1.84=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcprov-jdk18on:1.84=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcutil-jdk18on:1.84=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.checkerframework:checker-compat-qual:2.5.3=annotationProcessor,testAnnotationProcessor
 org.checkerframework:checker-compat-qual:2.5.6=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.19.0=annotationProcessor,testAnnotationProcessor
Author	SHA1	Message	Date
gbrodman	db733aa50f	Fix XML parsing issues that occur on dependency update (#3012 ) We want to make sure that we use the same XML factories no matter what, so we use "newDefaultFactory" instead of "newFactory" (to avoid picking up some random thing on the classpath). This also fixes an exception that occurs if you haven't synced the internal repo with the public repo.	2026-04-16 20:15:02 +00:00
Weimin Yu	409a7ba66f	Change language and bytecode levels to Java 25 (#3009 ) Release/Build tested in alpha. Deployed in crash.	2026-04-15 16:34:52 +00:00
Weimin Yu	e85f48beba	Fix urs command after DomainUpdateFlow change (#3008 ) PR 2930 forbids adding statuses that already exist on a domain. This PR updates the uniform_rapid_suspension command to conform. PR 2930 also forbids removing non-existent statuses, but it does not apply to this command.	2026-04-13 20:52:29 +00:00
gbrodman	b78d12e73f	Add a DelegatingReplicaJpaTransactionManager to handle multiple replicas (#3005 ) This will allow us to spread the load across multiple Postgres replica instances which should help with latency and stability.	2026-04-10 20:46:06 +00:00
Weimin Yu	4a1d0609f3	Support Fee-1.0 XML parser in all environments (#3007 ) Add the Fee-1.0 schema in production, allowing the requests with this extension to be parsed. This allows us to test this extension before hand. The announcement of this extension in greeting is controlled by a feature flag in ProtocolDefinition.java. As long as it is not announced, we do not expect real customers to use this extension.	2026-04-09 20:45:36 +00:00
gbrodman	61b121f464	Fix Gradle issues when running devTool (#3006 ) I think this may have been introduced as part of Gradle 9? Not sure why it's not showing up in the remote builds but without this, I can't run any "devTool" commands. Note: the fixes were suggested by gemini-cli	2026-04-09 20:11:44 +00:00
Weimin Yu	074f78cfb3	Fix docker client api version on CloudBuild (#3004 ) The docker engine provided by CloudBuild only supports up to 1.41. Explicitly set API version for downloaded client for now.	2026-04-08 18:13:26 +00:00
Weimin Yu	7be5fe4c01	Fix Flyway script (#3003 ) Removing the obsolete command line argument `community`.	2026-04-07 20:40:04 +00:00
Weimin Yu	1876e2c3e8	Fix Kyeth for Java 25 (#3002 )	2026-04-06 21:42:11 +00:00