Fix: Provide specific error for invalid SSL certificate

.github/workflows/codeql.yml

@@ -31,7 +31,7 @@ jobs:
       uses: actions/setup-java@v4
       with:
         distribution: 'temurin'
-        java-version: '25'
+        java-version: '21'
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.gitignore

@@ -18,13 +18,6 @@ gjf.out
 # virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
 hs_err_pid*
 
-# Environment-specific configuration files
-core/src/main/java/google/registry/config/files/nomulus-config-alpha.yaml
-core/src/main/java/google/registry/config/files/nomulus-config-crash.yaml
-core/src/main/java/google/registry/config/files/nomulus-config-production.yaml
-core/src/main/java/google/registry/config/files/nomulus-config-qa.yaml
-core/src/main/java/google/registry/config/files/nomulus-config-sandbox.yaml
-
 ######################################################################
 # Eclipse Ignores
 
@@ -121,5 +114,9 @@ core/**/registrar_dbg*.js
 core/**/registrar_bin*.css
 core/**/registrar_dbg*.css
 
+# Appengine generated files
+core/WEB-INF/appengine-generated/*.bin
+core/WEB-INF/appengine-generated/*.xml
+
 # jEnv
 .java-version

GEMINI.md

@@ -1,52 +0,0 @@
-# Engineering Standards for Gemini CLI
-
-This document outlines foundational mandates, architectural patterns, and project-specific conventions to ensure high-quality, idiomatic, and consistent code from the first iteration.
-
-## Core Mandates
-
-### 1. Rigorous Import Management
-- **Addition:** When adding new symbols, ensure the corresponding import is added.
-- **Removal:** When removing the last usage of a class or symbol from a file (e.g., removing a `@Inject Clock clock;` field), **immediately remove the associated import**. Do not wait for a build failure to identify unused imports.
-- **Checkstyle:** Proactively fix common checkstyle errors (line length > 100, formatting, unused imports) during the initial code write. Do not wait for CI/build failures to address these, as iterative fixes are inefficient.
-- **Verification:** Before finalizing any change, scan the imports section for redundancy.
-
-### 2. Time and Precision Handling (java.time Migration)
-- **Millisecond Precision:** Always truncate `Instant.now()` to milliseconds (using `.truncatedTo(ChronoUnit.MILLIS)`) to maintain consistency with Joda `DateTime` and the PostgreSQL schema (which enforces millisecond precision via JPA converters).
-- **Clock Injection:**
-    - Avoid direct calls to `Instant.now()`, `DateTime.now()`, `ZonedDateTime.now()`, or `System.currentTimeMillis()`.
-    - Inject `google.registry.util.Clock` (production) or `google.registry.testing.FakeClock` (tests).
-    - Use `clock.nowDate()` to get a `ZonedDateTime` in UTC.
-- **Beam Pipelines:**
-    - Ensure `Clock` is serializable (it is by default in this project) when used in Beam `DoFn`s.
-    - Pass the `Clock` through the constructor or via Dagger provider methods in the pipeline module.
-- **Command-Line Tools:**
-    - Use `@Inject Clock clock;` in `Command` implementations.
-    - The `clock` field should be **package-private** (no access modifier) to allow manual initialization in corresponding test classes.
-    - In test classes (e.g., `UpdateDomainCommandTest`), manually set `command.clock = fakeClock;` in the `@BeforeEach` method.
-    - Base test classes like `EppToolCommandTestCase` should handle this assignment for their generic command types where applicable.
-
-### 3. Dependency Injection (Dagger)
-- **Concrete Types:** Dagger `inject` methods must use explicit concrete types. Generic `inject(Command)` methods will not work.
-- **Test Components:** Use `TestRegistryToolComponent` for command-line tool tests to bridge the gap between `main` and `nonprod/test` source sets.
-
-### 4. Database Consistency
-- **JPA Converters:** Be aware that JPA converters (like `DateTimeConverter`) may perform truncation or transformation. Ensure application-level logic matches these transformations to avoid "dirty" state or unexpected diffs.
-- **Transaction Management:**
-    - **Top-Level:** Define database transactions (`tm().transact(...)`) at the highest possible level in the call chain (e.g., in an Action, a Command, or a Flow). This ensures all operations are atomic and handled by the retry logic.
-    - **DAO Methods:** Avoid declaring transactions inside low-level DAO methods. Use `tm().assertInTransaction()` to ensure that these methods are only called within a valid transactional context.
-    - **Utility/Cache Methods:** Use `tm().reTransact(...)` for utility methods or Caffeine cache loaders that might be invoked from both transactional and non-transactional paths.
-        - `reTransact` will join an existing transaction if one is present (acting as a no-op) or start a new one if not.
-        - This is particularly useful for in-memory caches where the loader must be able to fetch data regardless of whether the caller is currently in a transaction.
-    - **Transactional Time:** Ensure code that relies on `tm().getTransactionTime()` is executed within a transaction context.
-
-### 5. Testing Best Practices
-- **FakeClock and Sleeper:** Use `FakeClock` and `Sleeper` for any logic involving timeouts, delays, or expiration.
-- **Empirical Reproduction:** Before fixing a bug, always create a test case that reproduces the failure.
-- **Base Classes:** Leverage `CommandTestCase`, `EppToolCommandTestCase`, etc., to reduce boilerplate and ensure consistent setup (e.g., clock initialization).
-
-### 6. Project Dependencies
-- **Common Module:** When using `Clock` or other core utilities in a new or separate module (like `load-testing`), ensure `implementation project(':common')` is added to the module's `build.gradle`.
-
-## Performance and Efficiency
-- **Turn Minimization:** Aim for "perfect" code in the first iteration. Iterative fixes for checkstyle or compilation errors consume significant context and time.
-- **Context Management:** Use sub-agents for batch refactoring or high-volume output tasks to keep the main session history lean and efficient.

README.md

@@ -59,6 +59,8 @@ Nomulus has the following capabilities:
     implementation that works with BIND. If you are using Google Cloud DNS, you
     may need to understand its capabilities and provide your own
     multi-[AS](https://en.wikipedia.org/wiki/Autonomous_system_\(Internet\)) solution.
+*   **[WHOIS](https://en.wikipedia.org/wiki/WHOIS)**: A text-based protocol that
+    returns ownership and contact information on registered domain names.
 *   **[Registration Data Access Protocol
     (RDAP)](https://en.wikipedia.org/wiki/Registration_Data_Access_Protocol)**:
     A JSON API that returns structured, machine-readable information about

appengine_war.gradle

@@ -0,0 +1,108 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+apply plugin: 'war'
+
+def environment = rootProject.environment
+def gcpProject = rootProject.gcpProject
+
+// Set this directory before applying the appengine plugin so that the
+// plugin will recognize this as an app-engine standard app (and also
+// obtains the appengine-web.xml from the correct location)
+project.convention.plugins['war'].webAppDirName =
+        "../../core/src/main/java/google/registry/env/${environment}/${project.name}"
+
+apply plugin: 'com.google.cloud.tools.appengine'
+
+def coreResourcesDir = "${rootDir}/core/build/resources/main"
+def coreLibsDir = "${rootDir}/core/build/libs"
+
+// Get the web.xml file for the service.
+war {
+    webInf {
+        from "../../core/src/main/java/google/registry/env/common/${project.name}/WEB-INF"
+    }
+}
+
+war {
+    from("${coreResourcesDir}/google/registry/ui/html") {
+        include "*.html"
+    }
+    from("${coreLibsDir}") {
+        include "core.jar"
+        into("WEB-INF/lib")
+    }
+}
+
+if (project.path == ":services:default") {
+    war {
+        from("${coreResourcesDir}/google/registry/ui/html") {
+            include "*.html"
+            into("registrar")
+        }
+    }
+}
+
+appengine {
+    deploy {
+        // appengineDeployAll task requires the version to be set. So,
+        // this config lets gcloud select a version name when deploying
+        // to alpha or sandbox from our workstation.
+        if (!rootProject.prodOrSandboxEnv) {
+            version = 'GCLOUD_CONFIG'
+        }
+
+        // Don't set gcpProject directly, it gets overriden in ./build.gradle.
+        // Do -P environment={crash,alpha} instead.  For sandbox/production,
+        // use Spinnaker.
+        projectId = gcpProject
+    }
+}
+
+dependencies {
+    implementation project(path: ':core', configuration: 'deploy_jar')
+}
+
+// The tools.jar file gets pulled in from the java environment and for some
+// reason gets exploded "readonly", causing subsequent builds to fail when
+// they can't overwrite it.  The hack below makes the file writable after
+// we're done exploding it.
+//
+// Fun fact: We only use this jar for documentation generation and as such we
+// don't need it in our warfile, as it is not used by the application at
+// runtime.  But it's not clear how to exclude it, as we seem to be
+// constructing the jar from the entire WEB-INF directory and per-file
+// exclude rules don't seem to work on it.  Better solutions are welcome :-)
+explodeWar.doLast {
+    file("${it.explodedAppDirectory}/WEB-INF/lib/tools.jar").setWritable(true)
+}
+
+appengineDeployAll.mustRunAfter ':console-webapp:deploy'
+appengineDeployAll.finalizedBy ':deployCloudSchedulerAndQueue'
+
+rootProject.stage.dependsOn appengineStage
+tasks['war'].dependsOn ':core:processResources'
+tasks['war'].dependsOn ':core:jar'
+
+// Impose verification for all of the deployment tasks.  We haven't found a
+// better way to do this other than to apply to each of them independently.
+// If a new task gets added, it will still fail if "environment"  is not defined
+// because gcpProject is null.  We just won't get as friendly an error message.
+appengineDeployAll.configure rootProject.verifyDeploymentConfig
+appengineDeploy.configure rootProject.verifyDeploymentConfig
+appengineDeployCron.configure rootProject.verifyDeploymentConfig
+appengineDeployDispatch.configure rootProject.verifyDeploymentConfig
+appengineDeployDos.configure rootProject.verifyDeploymentConfig
+appengineDeployIndex.configure rootProject.verifyDeploymentConfig
+appengineDeployQueue.configure rootProject.verifyDeploymentConfig

build.gradle

@@ -11,6 +11,7 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
+
 import org.gradle.api.tasks.testing.logging.TestExceptionFormat
 import org.gradle.api.tasks.testing.logging.TestLogEvent
 
@@ -27,9 +28,8 @@ buildscript {
   }
 
   dependencies {
-    classpath 'com.google.cloud.tools:appengine-gradle-plugin:2.5.0'
-    classpath 'net.ltgt.gradle:gradle-errorprone-plugin:5.1.0'
-    classpath 'com.gradleup.shadow:com.gradleup.shadow.gradle.plugin:9.4.0'
+    classpath 'com.google.cloud.tools:appengine-gradle-plugin:2.4.1'
+    classpath 'net.ltgt.gradle:gradle-errorprone-plugin:3.1.0'
     classpath 'org.sonatype.aether:aether-api:1.13.1'
     classpath 'org.sonatype.aether:aether-impl:1.13.1'
   }
@@ -40,15 +40,15 @@ plugins {
 
   // Re-enable when compatible with Gradle 8
   // id 'nebula.lint' version '16.0.2'
-  id 'net.ltgt.errorprone' version '5.1.0'
+  id 'net.ltgt.errorprone' version '3.1.0'
   id 'checkstyle'
-  id 'com.gradleup.shadow' version '9.4.0' apply false
+  id 'com.github.johnrengelman.shadow' version '8.1.1'
 
   // NodeJs plugin
-  id "com.github.node-gradle.node" version "7.1.0"
+  id "com.github.node-gradle.node" version "3.0.1"
 
   id 'idea'
-  id 'com.diffplug.spotless' version '8.4.0'
+  id 'com.diffplug.spotless' version '6.20.0'
 
   id 'jacoco'
   id 'com.dorongold.task-tree' version '2.1.0'
@@ -73,15 +73,7 @@ apply from: 'dependency_lic.gradle'
 
 apply from: 'utils.gradle'
 
-// The license-report plugin must run with --no-parallel due to
-// complex cross-subject references. The `mutex` pattern does not
-// help because a mutex does not enforce task execution order.
-// For now we separate checkLicense from build so that the latter may
-// still take advantage of parallelism, which cuts down the build time
-// by about 20%. The presubmit and release procedures that want to check
-// licenses must invoke checkLicense explicitly with the `--no-parallel`
-// flag.
-// tasks.build.dependsOn(tasks.checkLicense)
+tasks.build.dependsOn(tasks.checkLicense)
 
 // Provide defaults for all of the project properties.
 
@@ -92,10 +84,10 @@ apply from: 'utils.gradle'
 // Paths to main and test sources.
 ext.projectRootDir = "${rootDir}"
 
-// Tasks to deploy/stage all services
+// Tasks to deploy/stage all App Engine services
 task deploy {
   group = 'deployment'
-  description = 'Deploys all services.'
+  description = 'Deploys all services to App Engine.'
 }
 
 task stage {
@@ -161,7 +153,7 @@ allprojects {
     if (!mavenUrl.isEmpty()) {
       maven {
         println "Java dependencies: Using repo ${mavenUrl}..."
-        url = mavenUrl
+        url mavenUrl
         allowInsecureProtocol = allowInsecure == "true"
       }
     } else {
@@ -169,7 +161,7 @@ allprojects {
       mavenCentral()
       google()
       maven {
-        url = "https://packages.confluent.io/maven/"
+        url "https://packages.confluent.io/maven/"
         content {
           includeGroup "io.confluent"
         }
@@ -200,7 +192,6 @@ allprojects {
                                 "--add-exports",
                                 "jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED"]
         options.forkOptions.jvmArgs = ["-J--add-exports=jdk.compiler/com.sun.tools.javac.main=ALL-UNNAMED",
-                                       "-J--add-exports=jdk.compiler/com.sun.tools.javac.model=ALL-UNNAMED",
                                        "-J--add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED",
                                        "-J--add-exports=jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED",
                                        "-J--add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED",
@@ -264,14 +255,6 @@ subprojects {
   // Skip no-op project
   if (project.name == 'services') return
 
-  apply plugin: 'com.gradleup.shadow'
-
-  tasks.configureEach {
-    if (it.class.name.contains('ShadowJar')) {
-      it.zip64 = true
-    }
-  }
-
   ext.createUberJar = {
       taskName,
       binaryName,
@@ -280,8 +263,7 @@ subprojects {
       List<SourceSetOutput> srcOutput = [project.sourceSets.main.output],
       List<String> excludes = [] ->
     project.tasks.create(
-        taskName, project.tasks.shadowJar.class) {
-      zip64 = true
+        taskName, com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar) {
       mergeServiceFiles()
       archiveBaseName = binaryName
       if (mainClass != '') {
@@ -309,7 +291,7 @@ subprojects {
       // We do seem to get duplicates when constructing uber-jars, either
       // this is a product of something in gradle 7 or a product of gradle 7
       // now giving an error about them when it didn't previously.
-      duplicatesStrategy = DuplicatesStrategy.WARN
+      duplicatesStrategy DuplicatesStrategy.WARN
     }
   }
 
@@ -333,14 +315,14 @@ subprojects {
       // exception.
       //
       // For all other projects, due to problem with the gradle-license-report
-      // plugin, the `detached` configurations by this plugin must opt out of
+      // plugin, the dependencyLicenseReport configuration must opt out of
       // dependency-locking. See dependency_lic.gradle for the reason why.
       //
       // To selectively activate dependency locking without hardcoding them
       // in the 'configurations' block, the following code must run after
       // project evaluation, when all configurations have been created.
-      configurations.all {
-        if (!it.name.contains('detachedConfiguration')) {
+      configurations.each {
+        if (it.name != 'dependencyLicenseReport' && it.name != 'integration') {
           it.resolutionStrategy.activateDependencyLocking()
         }
       }
@@ -349,6 +331,9 @@ subprojects {
 
   // Set up all of the deployment projects.
   if (services.contains(project.path)) {
+
+    apply from: "${rootDir.path}/appengine_war.gradle"
+
     // Return early, do not apply the settings below.
     return
   }
@@ -359,12 +344,8 @@ subprojects {
   // search for `flex-template-base-image` and update the parameter value.
   // There are at least two instances, one in core/build.gradle, one in
   // release/stage_beam_pipeline.sh
-  java {
-    // TODO(b/457758757): change to V_25 once Java in all environments are
-    // upgraded.
-    sourceCompatibility = JavaVersion.VERSION_21
-    targetCompatibility = JavaVersion.VERSION_21
-  }
+  sourceCompatibility = JavaVersion.VERSION_21
+  targetCompatibility = JavaVersion.VERSION_21
 
   project.tasks.test.dependsOn runPresubmits
 
@@ -391,19 +372,25 @@ subprojects {
 
   // No need to produce javadoc for the jetty subproject, which has no APIs to
   // expose to users.
-  if (project.name != 'jetty' && !services.contains(project.path)) {
+  if (project.name != 'jetty') {
     javadocSource << project.sourceSets.main.allJava
-    javadocClasspath << { project.sourceSets.main.runtimeClasspath.files }
+    javadocClasspath << project.sourceSets.main.runtimeClasspath
     javadocClasspath << "${buildDir}/generated/sources/annotationProcessor/java/main"
-    if (project.tasks.findByName('compileJava')) {
-      javadocDependentTasks << project.tasks.compileJava
-    }
-    if (project.tasks.findByName('processResources')) {
-      javadocDependentTasks << project.tasks.processResources
-    }
+    javadocDependentTasks << project.tasks.compileJava
   }
 }
 
+// Force SDK download and deployment to be sequential, otherwise parallel tasks
+// will fail. For SDK download, they will try to write to the same location to
+// upgrade gcloud. For deployment, they will try to deploy different services to
+// the same project at the same time.
+for (int i = 1; i < services.size(); i++) {
+  project("${services[i]}").downloadCloudSdk
+          .dependsOn(project("${services[i - 1]}").downloadCloudSdk)
+  project("${services[i]}").appengineDeployAll
+          .dependsOn(project("${services[i - 1]}").appengineDeployAll)
+}
+
 // If "-P verboseTestOutput=true" is passed in, configure all subprojects to dump all of their
 // output and final test status (pass/fail, errors) for each test class.
 //
@@ -536,10 +523,7 @@ task javadoc(type: Javadoc) {
   // In a lot of places we don't write @return so suppress warnings about that.
   // We don't report HTML lint errors because XJB-generated POJO files have
   // incorrect tags (like dangling </p> without the corresponding open tag.
-  // Starting in Java 25, references to primitives and arrays are forbidden.
-  // The JAXB-generated classes have array references, and we suppress the
-  // error with '-reference'.
-  options.addBooleanOption('Xdoclint:all,-missing,-html,-reference', true)
+  options.addBooleanOption('Xdoclint:all,-missing,-html', true)
   options.addBooleanOption("-allow-script-in-comments",true)
   options.tags = ["type:a:Generic Type",
                   "error:a:Expected Error",
@@ -559,14 +543,6 @@ task coreDev {
   dependsOn 'checkLicense'
   dependsOn ':core:check'
   dependsOn 'assemble'
-
-  if (gradle.startParameter.parallelProjectExecutionEnabled
-      && gradle.startParameter.taskNames.contains("coreDev")) {
-    throw new GradleException(
-        "ERROR: 'coreDev' cannot run with --parallel due to checkLicense constraints.\n"
-            + "Please run: ./gradlew coreDev --no-parallel"
-    )
-  }
 }
 
 javadocDependentTasks.each { tasks.javadoc.dependsOn(it) }

buildscript-gradle.lockfile

@@ -4,68 +4,59 @@
 com.diffplug.durian:durian-collect:1.2.0=classpath
 com.diffplug.durian:durian-core:1.2.0=classpath
 com.diffplug.durian:durian-io:1.2.0=classpath
-com.diffplug.durian:durian-swt.os:4.3.0=classpath
-com.diffplug.spotless:com.diffplug.spotless.gradle.plugin:8.4.0=classpath
-com.diffplug.spotless:spotless-lib-extra:4.5.0=classpath
-com.diffplug.spotless:spotless-lib:4.5.0=classpath
-com.diffplug.spotless:spotless-plugin-gradle:8.4.0=classpath
+com.diffplug.durian:durian-swt.os:4.2.0=classpath
+com.diffplug.spotless:com.diffplug.spotless.gradle.plugin:6.20.0=classpath
+com.diffplug.spotless:spotless-lib-extra:2.40.0=classpath
+com.diffplug.spotless:spotless-lib:2.40.0=classpath
+com.diffplug.spotless:spotless-plugin-gradle:6.20.0=classpath
 com.dorongold.plugins:task-tree:2.1.0=classpath
 com.dorongold.task-tree:com.dorongold.task-tree.gradle.plugin:2.1.0=classpath
-com.fasterxml.jackson.core:jackson-annotations:2.14.2=classpath
-com.fasterxml.jackson.core:jackson-core:2.14.2=classpath
-com.fasterxml.jackson.core:jackson-databind:2.14.2=classpath
-com.fasterxml.jackson:jackson-bom:2.14.2=classpath
-com.fasterxml.woodstox:woodstox-core:7.1.1=classpath
-com.github.node-gradle.node:com.github.node-gradle.node.gradle.plugin:7.1.0=classpath
-com.github.node-gradle:gradle-node-plugin:7.1.0=classpath
-com.google.cloud.tools:appengine-gradle-plugin:2.5.0=classpath
-com.google.cloud.tools:appengine-plugins-core:0.10.0=classpath
+com.github.johnrengelman.shadow:com.github.johnrengelman.shadow.gradle.plugin:8.1.1=classpath
+com.github.johnrengelman:shadow:8.1.1=classpath
+com.github.node-gradle.node:com.github.node-gradle.node.gradle.plugin:3.0.1=classpath
+com.github.node-gradle:gradle-node-plugin:3.0.1=classpath
+com.google.cloud.tools:appengine-gradle-plugin:2.4.1=classpath
+com.google.cloud.tools:appengine-plugins-core:0.9.1=classpath
 com.google.code.findbugs:jsr305:3.0.2=classpath
-com.google.code.gson:gson:2.10.1=classpath
-com.google.errorprone:error_prone_annotations:2.18.0=classpath
+com.google.code.gson:gson:2.8.6=classpath
+com.google.errorprone:error_prone_annotations:2.3.4=classpath
 com.google.guava:failureaccess:1.0.1=classpath
-com.google.guava:guava-parent:32.1.2-jre=classpath
-com.google.guava:guava:32.1.2-jre=classpath
+com.google.guava:guava:28.2-jre=classpath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=classpath
+com.google.j2objc:j2objc-annotations:1.3=classpath
 com.googlecode.concurrent-trees:concurrent-trees:2.6.1=classpath
 com.googlecode.javaewah:JavaEWAH:1.2.3=classpath
-com.gradleup.shadow:com.gradleup.shadow.gradle.plugin:9.4.0=classpath
-com.gradleup.shadow:shadow-gradle-plugin:9.4.0=classpath
-com.squareup.okhttp3:okhttp:4.12.0=classpath
-com.squareup.okio:okio-jvm:3.6.0=classpath
-com.squareup.okio:okio:3.6.0=classpath
-commons-codec:commons-codec:1.21.0=classpath
-commons-io:commons-io:2.21.0=classpath
-dev.equo.ide:solstice:1.8.1=classpath
-net.ltgt.errorprone:net.ltgt.errorprone.gradle.plugin:5.1.0=classpath
-net.ltgt.gradle:gradle-errorprone-plugin:5.1.0=classpath
-org.apache.ant:ant-launcher:1.10.15=classpath
-org.apache.ant:ant:1.10.15=classpath
-org.apache.commons:commons-compress:1.21=classpath
+com.squareup.okhttp3:okhttp:4.10.0=classpath
+com.squareup.okio:okio-jvm:3.0.0=classpath
+com.squareup.okio:okio:3.0.0=classpath
+commons-io:commons-io:2.11.0=classpath
+dev.equo.ide:solstice:1.3.1=classpath
+net.ltgt.errorprone:net.ltgt.errorprone.gradle.plugin:3.1.0=classpath
+net.ltgt.gradle:gradle-errorprone-plugin:3.1.0=classpath
+org.apache.ant:ant-launcher:1.10.13=classpath
+org.apache.ant:ant:1.10.13=classpath
+org.apache.commons:commons-compress:1.20=classpath
 org.apache.commons:commons-lang3:3.5=classpath
-org.apache.maven:maven-api-annotations:4.0.0-rc-5=classpath
-org.apache.maven:maven-api-xml:4.0.0-rc-5=classpath
-org.apache.maven:maven-xml:4.0.0-rc-5=classpath
-org.checkerframework:checker-qual:3.33.0=classpath
-org.codehaus.plexus:plexus-utils:4.0.2=classpath
-org.codehaus.plexus:plexus-xml:4.1.1=classpath
-org.codehaus.woodstox:stax2-api:4.2.2=classpath
-org.eclipse.jgit:org.eclipse.jgit:7.5.0.202512021534-r=classpath
-org.eclipse.platform:org.eclipse.osgi:3.24.100=classpath
+org.checkerframework:checker-qual:2.10.0=classpath
+org.codehaus.plexus:plexus-utils:3.5.1=classpath
+org.eclipse.jgit:org.eclipse.jgit:6.6.0.202305301015-r=classpath
+org.eclipse.platform:org.eclipse.osgi:3.18.300=classpath
 org.glassfish:javax.json:1.0.4=classpath
 org.jdom:jdom2:2.0.6.1=classpath
-org.jetbrains.kotlin:kotlin-metadata-jvm:2.3.20-RC3=classpath
-org.jetbrains.kotlin:kotlin-stdlib-common:2.3.20-RC3=classpath
-org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.10=classpath
-org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.10=classpath
-org.jetbrains.kotlin:kotlin-stdlib:2.3.20-RC3=classpath
+org.jetbrains.kotlin:kotlin-stdlib-common:1.6.20=classpath
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.5.31=classpath
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.5.31=classpath
+org.jetbrains.kotlin:kotlin-stdlib:1.6.20=classpath
 org.jetbrains:annotations:13.0=classpath
-org.slf4j:slf4j-api:2.0.17=classpath
+org.ow2.asm:asm-commons:9.4=classpath
+org.ow2.asm:asm-tree:9.4=classpath
+org.ow2.asm:asm:9.4=classpath
+org.slf4j:slf4j-api:1.7.36=classpath
 org.sonatype.aether:aether-api:1.13.1=classpath
 org.sonatype.aether:aether-impl:1.13.1=classpath
 org.sonatype.aether:aether-spi:1.13.1=classpath
 org.sonatype.aether:aether-util:1.13.1=classpath
 org.tukaani:xz:1.9=classpath
-org.vafer:jdependency:2.15=classpath
-org.yaml:snakeyaml:2.0=classpath
+org.vafer:jdependency:2.8.0=classpath
+org.yaml:snakeyaml:1.21=classpath
 empty=

common/gradle.lockfile

@@ -1,85 +1,71 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-com.github.ben-manes.caffeine:caffeine:3.2.3=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-com.google.auto.service:auto-service-annotations:1.0.1=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
+aopalliance:aopalliance:1.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.github.ben-manes.caffeine:caffeine:3.2.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.google.auto.service:auto-service-annotations:1.0.1=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.auto.value:auto-value-annotations:1.11.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-com.google.auto.value:auto-value-annotations:1.9=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-com.google.auto:auto-common:1.2.2=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-com.google.code.findbugs:jsr305:3.0.2=checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-com.google.errorprone:error_prone_annotation:2.48.0=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.36.0=checkstyle
-com.google.errorprone:error_prone_annotations:2.43.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-com.google.errorprone:error_prone_annotations:2.48.0=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-com.google.errorprone:error_prone_check_api:2.48.0=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-com.google.errorprone:error_prone_core:2.48.0=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-com.google.flogger:flogger:0.9=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-com.google.googlejavaformat:google-java-format:1.34.1=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
+com.google.auto.value:auto-value-annotations:1.9=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.google.auto:auto-common:1.2.1=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
+com.google.errorprone:error_prone_annotation:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.google.errorprone:error_prone_annotations:2.36.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.errorprone:error_prone_annotations:2.7.1=checkstyle
+com.google.errorprone:error_prone_check_api:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.google.errorprone:error_prone_core:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.google.errorprone:error_prone_type_annotations:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.google.errorprone:javac:9+181-r4173-1=errorproneJavac
+com.google.flogger:flogger:0.8=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.guava:failureaccess:1.0.1=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.guava:failureaccess:1.0.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-com.google.guava:failureaccess:1.0.3=annotationProcessor,checkstyle,testAnnotationProcessor,testingAnnotationProcessor
-com.google.guava:guava:33.4.3-android=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-com.google.guava:guava:33.4.8-jre=checkstyle
-com.google.guava:guava:33.5.0-jre=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
-com.google.j2objc:j2objc-annotations:3.0.0=checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-com.google.j2objc:j2objc-annotations:3.1=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-com.google.protobuf:protobuf-java:4.33.2=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-com.google.truth:truth:1.4.5=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-com.puppycrawl.tools:checkstyle:10.24.0=checkstyle
-commons-beanutils:commons-beanutils:1.10.1=checkstyle
-commons-codec:commons-codec:1.15=checkstyle
+com.google.guava:guava-parent:32.1.1-jre=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.google.guava:guava:31.0.1-jre=checkstyle
+com.google.guava:guava:32.1.1-jre=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.google.guava:guava:33.2.1-android=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.inject:guice:5.1.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.google.j2objc:j2objc-annotations:1.3=checkstyle
+com.google.j2objc:j2objc-annotations:3.0.0=compileClasspath,testCompileClasspath,testingCompileClasspath
+com.google.protobuf:protobuf-java:3.19.6=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.google.truth:truth:1.4.4=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.puppycrawl.tools:checkstyle:9.3=checkstyle
+commons-beanutils:commons-beanutils:1.9.4=checkstyle
 commons-collections:commons-collections:3.2.2=checkstyle
-info.picocli:picocli:4.7.7=checkstyle
-io.github.eisop:dataflow-errorprone:3.41.0-eisop1=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-io.github.java-diff-utils:java-diff-utils:4.16=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+info.picocli:picocli:4.6.2=checkstyle
+io.github.eisop:dataflow-errorprone:3.34.0-eisop1=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+io.github.java-diff-utils:java-diff-utils:4.15=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 jakarta.inject:jakarta.inject-api:2.0.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-javax.inject:javax.inject:1=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-joda-time:joda-time:2.14.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+javax.inject:javax.inject:1=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+joda-time:joda-time:2.13.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 junit:junit:4.13.2=testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-net.sf.saxon:Saxon-HE:12.5=checkstyle
-org.antlr:antlr4-runtime:4.13.2=checkstyle
-org.apache.commons:commons-lang3:3.8.1=checkstyle
-org.apache.commons:commons-text:1.3=checkstyle
-org.apache.httpcomponents.client5:httpclient5:5.1.3=checkstyle
-org.apache.httpcomponents.core5:httpcore5-h2:5.1.3=checkstyle
-org.apache.httpcomponents.core5:httpcore5:5.1.3=checkstyle
-org.apache.httpcomponents:httpclient:4.5.13=checkstyle
-org.apache.httpcomponents:httpcore:4.4.14=checkstyle
-org.apache.maven.doxia:doxia-core:1.12.0=checkstyle
-org.apache.maven.doxia:doxia-logging-api:1.12.0=checkstyle
-org.apache.maven.doxia:doxia-module-xdoc:1.12.0=checkstyle
-org.apache.maven.doxia:doxia-sink-api:1.12.0=checkstyle
-org.apache.xbean:xbean-reflect:3.7=checkstyle
+net.sf.saxon:Saxon-HE:10.6=checkstyle
+org.antlr:antlr4-runtime:4.9.3=checkstyle
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
-org.checkerframework:checker-qual:3.19.0=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-org.checkerframework:checker-qual:3.43.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-org.checkerframework:checker-qual:3.49.3=checkstyle
-org.codehaus.plexus:plexus-classworlds:2.6.0=checkstyle
-org.codehaus.plexus:plexus-component-annotations:2.1.0=checkstyle
-org.codehaus.plexus:plexus-container-default:2.1.0=checkstyle
-org.codehaus.plexus:plexus-utils:3.3.0=checkstyle
+org.checkerframework:checker-compat-qual:2.5.3=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+org.checkerframework:checker-qual:3.12.0=checkstyle
+org.checkerframework:checker-qual:3.33.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+org.checkerframework:checker-qual:3.42.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 org.hamcrest:hamcrest-core:1.3=testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-org.jacoco:org.jacoco.agent:0.8.14=jacocoAgent,jacocoAnt
-org.jacoco:org.jacoco.ant:0.8.14=jacocoAnt
-org.jacoco:org.jacoco.core:0.8.14=jacocoAnt
-org.jacoco:org.jacoco.report:0.8.14=jacocoAnt
+org.jacoco:org.jacoco.agent:0.8.12=jacocoAgent,jacocoAnt
+org.jacoco:org.jacoco.ant:0.8.12=jacocoAnt
+org.jacoco:org.jacoco.core:0.8.12=jacocoAnt
+org.jacoco:org.jacoco.report:0.8.12=jacocoAnt
 org.javassist:javassist:3.28.0-GA=checkstyle
-org.jspecify:jspecify:1.0.0=annotationProcessor,checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
-org.junit.jupiter:junit-jupiter-api:5.13.4=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-engine:5.13.4=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.13.4=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-engine:1.13.4=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-launcher:1.13.4=testCompileClasspath,testRuntimeClasspath
-org.junit:junit-bom:5.13.4=testCompileClasspath,testRuntimeClasspath
+org.jspecify:jspecify:1.0.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+org.junit.jupiter:junit-jupiter-api:5.12.1=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-engine:5.12.1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.12.1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-engine:1.12.1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-launcher:1.12.1=testCompileClasspath,testRuntimeClasspath
+org.junit:junit-bom:5.12.1=testCompileClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
-org.ow2.asm:asm-commons:9.9=jacocoAnt
-org.ow2.asm:asm-tree:9.9=jacocoAnt
-org.ow2.asm:asm:9.8=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-org.ow2.asm:asm:9.9=jacocoAnt
-org.pcollections:pcollections:4.0.1=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
+org.ow2.asm:asm-commons:9.7=jacocoAnt
+org.ow2.asm:asm-tree:9.7=jacocoAnt
+org.ow2.asm:asm:9.7=compileClasspath,deploy_jar,jacocoAnt,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+org.pcollections:pcollections:3.1.4=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 org.reflections:reflections:0.10.2=checkstyle
-org.xmlresolver:xmlresolver:5.2.2=checkstyle
-empty=shadow,testingCompile,testingRuntime,testingRuntimeClasspath
+empty=testingCompile,testingRuntime,testingRuntimeClasspath

common/src/main/java/google/registry/util/Clock.java

@@ -15,9 +15,6 @@
 package google.registry.util;
 
 import java.io.Serializable;
-import java.time.Instant;
-import java.time.ZoneOffset;
-import java.time.ZonedDateTime;
 import javax.annotation.concurrent.ThreadSafe;
 import org.joda.time.DateTime;
 
@@ -33,14 +30,5 @@ import org.joda.time.DateTime;
 public interface Clock extends Serializable {
 
   /** Returns current time in UTC timezone. */
-  @Deprecated
   DateTime nowUtc();
-
-  /** Returns current Instant (which is always in UTC). */
-  Instant now();
-
-  /** Returns the current time as a {@link ZonedDateTime} in UTC. */
-  default ZonedDateTime nowDate() {
-    return ZonedDateTime.ofInstant(now(), ZoneOffset.UTC);
-  }
 }

common/src/main/java/google/registry/util/DateTimeUtils.java

@@ -20,9 +20,6 @@ import com.google.common.collect.Iterables;
 import com.google.common.collect.Lists;
 import com.google.common.collect.Ordering;
 import java.sql.Date;
-import java.time.Instant;
-import java.time.ZoneOffset;
-import javax.annotation.Nullable;
 import org.joda.time.DateTime;
 import org.joda.time.DateTimeZone;
 import org.joda.time.LocalDate;
@@ -31,52 +28,28 @@ import org.joda.time.LocalDate;
 public abstract class DateTimeUtils {
 
   /** The start of the epoch, in a convenient constant. */
-  @Deprecated public static final DateTime START_OF_TIME = new DateTime(0, DateTimeZone.UTC);
-
-  /** The start of the UNIX epoch (which is defined in UTC), in a convenient constant. */
-  public static final Instant START_INSTANT = Instant.ofEpochMilli(0);
+  public static final DateTime START_OF_TIME = new DateTime(0, DateTimeZone.UTC);
 
   /**
    * A date in the far future that we can treat as infinity.
    *
-   * <p>This value is (2^63-1)/1000 rounded down. Postgres can store dates as 64 bit microseconds,
-   * but Java uses milliseconds, so this is the largest representable date that will survive a
+   * <p>This value is (2^63-1)/1000 rounded down. AppEngine stores dates as 64 bit microseconds, but
+   * Java uses milliseconds, so this is the largest representable date that will survive a
    * round-trip through the database.
    */
-  @Deprecated
   public static final DateTime END_OF_TIME = new DateTime(Long.MAX_VALUE / 1000, DateTimeZone.UTC);
 
-  /**
-   * An instant in the far future that we can treat as infinity.
-   *
-   * <p>This value is (2^63-1)/1000 rounded down. Postgres can store dates as 64 bit microseconds,
-   * but Java uses milliseconds, so this is the largest representable date that will survive a
-   * round-trip through the database.
-   */
-  public static final Instant END_INSTANT = Instant.ofEpochMilli(Long.MAX_VALUE / 1000);
-
   /** Returns the earliest of a number of given {@link DateTime} instances. */
   public static DateTime earliestOf(DateTime first, DateTime... rest) {
-    return earliestDateTimeOf(Lists.asList(first, rest));
-  }
-
-  /** Returns the earliest of a number of given {@link Instant} instances. */
-  public static Instant earliestOf(Instant first, Instant... rest) {
     return earliestOf(Lists.asList(first, rest));
   }
 
   /** Returns the earliest element in a {@link DateTime} iterable. */
-  public static DateTime earliestDateTimeOf(Iterable<DateTime> dates) {
+  public static DateTime earliestOf(Iterable<DateTime> dates) {
     checkArgument(!Iterables.isEmpty(dates));
     return Ordering.<DateTime>natural().min(dates);
   }
 
-  /** Returns the earliest element in a {@link Instant} iterable. */
-  public static Instant earliestOf(Iterable<Instant> instants) {
-    checkArgument(!Iterables.isEmpty(instants));
-    return Ordering.<Instant>natural().min(instants);
-  }
-
   /** Returns the latest of a number of given {@link DateTime} instances. */
   public static DateTime latestOf(DateTime first, DateTime... rest) {
     return latestOf(Lists.asList(first, rest));
@@ -93,63 +66,29 @@ public abstract class DateTimeUtils {
     return !timeToCheck.isAfter(timeToCompareTo);
   }
 
-  /** Returns whether the first {@link Instant} is equal to or earlier than the second. */
-  public static boolean isBeforeOrAt(Instant timeToCheck, Instant timeToCompareTo) {
-    return !timeToCheck.isAfter(timeToCompareTo);
-  }
-
   /** Returns whether the first {@link DateTime} is equal to or later than the second. */
   public static boolean isAtOrAfter(DateTime timeToCheck, DateTime timeToCompareTo) {
     return !timeToCheck.isBefore(timeToCompareTo);
   }
 
-  /** Returns whether the first {@link Instant} is equal to or later than the second. */
-  public static boolean isAtOrAfter(Instant timeToCheck, Instant timeToCompareTo) {
-    return !timeToCheck.isBefore(timeToCompareTo);
-  }
-
   /**
    * Adds years to a date, in the {@code Duration} sense of semantic years. Use this instead of
    * {@link DateTime#plusYears} to ensure that we never end up on February 29.
    */
-  @Deprecated
   public static DateTime leapSafeAddYears(DateTime now, int years) {
     checkArgument(years >= 0);
     return years == 0 ? now : now.plusYears(1).plusYears(years - 1);
   }
 
-  /**
-   * Adds years to a date, in the {@code Duration} sense of semantic years. Use this instead of
-   * {@link java.time.ZonedDateTime#plusYears} to ensure that we never end up on February 29.
-   */
-  public static Instant leapSafeAddYears(Instant now, long years) {
-    checkArgument(years >= 0);
-    return (years == 0)
-        ? now
-        : now.atZone(ZoneOffset.UTC).plusYears(1).plusYears(years - 1).toInstant();
-  }
-
   /**
    * Subtracts years from a date, in the {@code Duration} sense of semantic years. Use this instead
    * of {@link DateTime#minusYears} to ensure that we never end up on February 29.
    */
-  @Deprecated
   public static DateTime leapSafeSubtractYears(DateTime now, int years) {
     checkArgument(years >= 0);
     return years == 0 ? now : now.minusYears(1).minusYears(years - 1);
   }
 
-  /**
-   * Subtracts years from a date, in the {@code Duration} sense of semantic years. Use this instead
-   * of {@link java.time.ZonedDateTime#minusYears} to ensure that we never end up on February 29.
-   */
-  public static Instant leapSafeSubtractYears(Instant now, int years) {
-    checkArgument(years >= 0);
-    return (years == 0)
-        ? now
-        : now.atZone(ZoneOffset.UTC).minusYears(1).minusYears(years - 1).toInstant();
-  }
-
   public static Date toSqlDate(LocalDate localDate) {
     return new Date(localDate.toDateTimeAtStartOfDay().getMillis());
   }
@@ -157,34 +96,4 @@ public abstract class DateTimeUtils {
   public static LocalDate toLocalDate(Date date) {
     return new LocalDate(date.getTime(), DateTimeZone.UTC);
   }
-
-  /** Convert a joda {@link DateTime} to a java.time {@link Instant}, null-safe. */
-  @Nullable
-  public static Instant toInstant(@Nullable DateTime dateTime) {
-    return (dateTime == null) ? null : Instant.ofEpochMilli(dateTime.getMillis());
-  }
-
-  /** Convert a java.time {@link Instant} to a joda {@link DateTime}, null-safe. */
-  @Nullable
-  public static DateTime toDateTime(@Nullable Instant instant) {
-    return (instant == null) ? null : new DateTime(instant.toEpochMilli(), DateTimeZone.UTC);
-  }
-
-  /** Convert a java.time {@link java.time.Instant} to a joda {@link org.joda.time.Instant}. */
-  @Nullable
-  public static org.joda.time.Instant toJodaInstant(@Nullable java.time.Instant instant) {
-    return (instant == null) ? null : org.joda.time.Instant.ofEpochMilli(instant.toEpochMilli());
-  }
-
-  public static Instant plusYears(Instant instant, int years) {
-    return instant.atZone(ZoneOffset.UTC).plusYears(years).toInstant();
-  }
-
-  public static Instant plusDays(Instant instant, int days) {
-    return instant.atZone(ZoneOffset.UTC).plusDays(days).toInstant();
-  }
-
-  public static Instant minusDays(Instant instant, int days) {
-    return instant.atZone(ZoneOffset.UTC).minusDays(days).toInstant();
-  }
 }

common/src/main/java/google/registry/util/SystemClock.java

@@ -17,7 +17,6 @@ package google.registry.util;
 import static org.joda.time.DateTimeZone.UTC;
 
 import jakarta.inject.Inject;
-import java.time.Instant;
 import javax.annotation.concurrent.ThreadSafe;
 import org.joda.time.DateTime;
 
@@ -35,13 +34,4 @@ public class SystemClock implements Clock {
   public DateTime nowUtc() {
     return DateTime.now(UTC);
   }
-
-  @Override
-  public Instant now() {
-    // Truncate to milliseconds to match the precision of Joda DateTime and our database schema
-    // (which uses millisecond precision via DateTimeConverter). This prevents subtle comparison
-    // bugs where a high-precision Instant would be considered "after" a truncated database
-    // timestamp.
-    return Instant.now().truncatedTo(java.time.temporal.ChronoUnit.MILLIS);
-  }
 }

common/src/testing/java/google/registry/testing/FakeClock.java

@@ -19,7 +19,6 @@ import static org.joda.time.DateTimeZone.UTC;
 import static org.joda.time.Duration.millis;
 
 import google.registry.util.Clock;
-import java.time.Instant;
 import java.util.concurrent.atomic.AtomicLong;
 import javax.annotation.concurrent.ThreadSafe;
 import org.joda.time.DateTime;
@@ -55,11 +54,6 @@ public final class FakeClock implements Clock {
     return new DateTime(currentTimeMillis.addAndGet(autoIncrementStepMs), UTC);
   }
 
-  @Override
-  public Instant now() {
-    return Instant.ofEpochMilli(currentTimeMillis.addAndGet(autoIncrementStepMs));
-  }
-
   /**
    * Sets the increment applied to the clock whenever it is queried. The increment is zero by
    * default: the clock is left unchanged when queried.

common/src/testing/java/google/registry/testing/truth/TextDiffSubject.java

@@ -92,19 +92,17 @@ public class TextDiffSubject extends Subject {
 
   private ImmutableList<String> filterComments(List<String> lines) {
     return lines.stream()
-        .filter(line -> !line.isBlank())
         .filter(line -> comments.stream().noneMatch(line::startsWith))
         .collect(ImmutableList.toImmutableList());
   }
 
   public void hasSameContentAs(List<String> expectedContent) {
     checkNotNull(expectedContent, "expectedContent");
-    ImmutableList<String> filteredExpected = filterComments(expectedContent);
-    ImmutableList<String> filteredActual = filterComments(actual);
-    if (filteredExpected.equals(filteredActual)) {
+    ImmutableList<String> expected = filterComments(expectedContent);
+    if (filterComments(expected).equals(filterComments(actual))) {
       return;
     }
-    String diffString = diffFormat.generateDiff(filteredExpected, filteredActual);
+    String diffString = diffFormat.generateDiff(expected, actual);
     failWithoutActual(
         Fact.simpleFact(
             Joiner.on('\n')

config/dependency-license/allowed_licenses.json

@@ -244,12 +244,6 @@
     {
       "moduleLicense": "The JSON License"
     },
-    {
-      "moduleLicense": "LGPL-2.1-or-later"
-    },
-    {
-      "moduleLicense": "Apache License version 2.0"
-    },
     {
       "moduleLicense": "LGPL-2.1+"
     },
@@ -308,11 +302,6 @@
       "moduleLicense": null,
       "moduleName": "com.fasterxml.jackson:jackson-bom"
     },
-    {
-      // "Apache License, Version 2.0".
-      "moduleLicense": null,
-      "moduleName": "tools.jackson:jackson-bom"
-    },
     {
       // "Apache License, Version 2.0".
       "moduleLicense": null,

config/nom_build.py

@@ -56,7 +56,7 @@ PROPERTIES_HEADER = """\
 # nom_build), run ./nom_build --help.
 #
 # DO NOT EDIT THIS FILE BY HAND
-org.gradle.jvmargs=-Xmx4096m
+org.gradle.jvmargs=-Xmx1024m
 org.gradle.caching=true
 org.gradle.parallel=true
 """
@@ -104,7 +104,7 @@ PROPERTIES = [
     Property('testFilter',
              'Comma separated list of test patterns, if specified run only '
              'these.'),
-    Property('environment', 'Environment for deployment and staging.'),
+    Property('environment', 'GAE Environment for deployment and staging.'),
 
     # Cloud SQL properties
     Property('dbServer',
@@ -117,19 +117,28 @@ PROPERTIES = [
     Property('dbUser', 'Database user name for use in connection'),
     Property('dbPassword', 'Database password for use in connection'),
 
+    Property('publish_repo',
+             'Maven repository that hosts the Cloud SQL schema jar and the '
+             'registry server test jars. Such jars are needed for '
+             'server/schema integration tests. Please refer to <a '
+             'href="./integration/README.md">integration project</a> for more '
+             'information.'),
+    Property('baseSchemaTag',
+             'The nomulus version tag of the schema for use in the schema'
+             'deployment integration test (:db:schemaIncrementalDeployTest)'),
+    Property('schema_version',
+             'The nomulus version tag of the schema for use in a database'
+             'integration test.'),
+    Property('nomulus_version',
+             'The version of nomulus to test against in a database '
+             'integration test.'),
     Property('dot_path',
              'The path to "dot", part of the graphviz package that converts '
              'a BEAM pipeline to image. Setting this property to empty string '
              'will disable image generation.',
              '/usr/bin/dot'),
     Property('pipeline',
-             'The name of the Beam pipeline being staged.'),
-    Property('nomulus_env',
-             'For use by scripts. Normally not set manually.'),
-    Property('schema_env',
-             'For use by scripts. Normally not set manually.'),
-    Property('schemaTestArtifactsDir',
-             'For use by scripts. Normally not set manually.')
+             'The name of the Beam pipeline being staged.')
 ]
 
 GRADLE_FLAGS = [

config/presubmits.py

@@ -98,15 +98,16 @@ PRESUBMITS = {
         "File did not include the license header.",
 
     # Files must end in a newline
-    PresubmitCheck(r".*\n$", ("java", "js", "soy", "sql", "py", "sh", "gradle", "ts", "xml"),
-                   {"node_modules/", ".idea"}, REQUIRED):
+    PresubmitCheck(r".*\n$", ("java", "js", "soy", "sql", "py", "sh", "gradle", "ts"),
+                   {"node_modules/"}, REQUIRED):
         "Source files must end in a newline.",
 
     # System.(out|err).println should only appear in tools/ or load-testing/
     PresubmitCheck(
         r".*\bSystem\.(out|err)\.print", "java", {
-            "/tools/", "/example/", "/load-testing/",
-            "RegistryTestServerMain.java", "TestServerExtension.java"
+            "StackdriverDashboardBuilder.java", "/tools/", "/example/",
+            "/load-testing/", "RegistryTestServerMain.java",
+            "TestServerExtension.java", "FlowDocumentationTool.java"
         }):
         "System.(out|err).println is only allowed in tools/ packages. Please "
         "use a logger instead.",
@@ -119,7 +120,7 @@ PRESUBMITS = {
     ):
         "In SOY please use the ({@param name: string} /** User name. */) style"
         " parameter passing instead of the ( * @param name User name.) style "
-        "parameter passing.",
+        "parameter pasing.",
     PresubmitCheck(
         r'.*\{[^}]+\w+:\s+"',
         "soy",
@@ -138,6 +139,41 @@ PRESUBMITS = {
         {},
     ):
         "All soy templates must use strict autoescaping",
+
+    # various JS linting checks
+    PresubmitCheck(
+        r".*goog\.base\(",
+        "js",
+        {"/node_modules/"},
+    ):
+        "Use of goog.base is not allowed.",
+    PresubmitCheck(
+        r".*goog\.dom\.classes",
+        "js",
+        {"/node_modules/"},
+    ):
+        "Instead of goog.dom.classes, use goog.dom.classlist which is smaller "
+        "and faster.",
+    PresubmitCheck(
+        r".*goog\.getMsg",
+        "js",
+        {"/node_modules/"},
+    ):
+        "Put messages in Soy, instead of using goog.getMsg().",
+    PresubmitCheck(
+        r".*(innerHTML|outerHTML)\s*(=|[+]=)([^=]|$)",
+        "js",
+        {"/node_modules/", "registrar_bin."},
+    ):
+        "Do not assign directly to the dom. Use goog.dom.setTextContent to set"
+        " to plain text, goog.dom.removeChildren to clear, or "
+        "soy.renderElement to render anything else",
+    PresubmitCheck(
+        r".*console\.(log|info|warn|error)",
+        "js",
+        {"/node_modules/", "google/registry/ui/js/util.js", "registrar_bin."},
+    ):
+        "JavaScript files should not include console logging.",
     PresubmitCheck(
         r".*\nimport (static )?.*\.shaded\..*",
         "java",
@@ -180,14 +216,6 @@ PRESUBMITS = {
         {"/node_modules/"},
     ):
         "Do not use javax.inject.* Use jakarta.inject.* instead.",
-    PresubmitCheck(
-        r".*import jakarta.persistence.(Pre|Post)(Persist|Load|Remove|Update);",
-        "java",
-        {"EntityCallbacksListener.java"},
-    ):
-        "Hibernate lifecycle events aren't called for embedded entities, so it's "
-        "usually best to avoid them. Instead, use the annotations defined in "
-        "EntityCallbacksListener.java"
 }
 
 # Note that this regex only works for one kind of Flyway file.  If we want to
@@ -275,6 +303,26 @@ def verify_flyway_index():
   return not success
 
 
+def verify_javascript_deps():
+  """Verifies that we haven't introduced any new javascript dependencies."""
+  with open('package.json') as f:
+    package = json.load(f)
+
+  deps = list(package['dependencies'].keys())
+  if deps != EXPECTED_JS_PACKAGES:
+    print('Unexpected javascript dependencies.  Was expecting '
+          '%s, got %s.' % (EXPECTED_JS_PACKAGES, deps))
+    print(textwrap.dedent("""
+        * If the new dependencies are intentional, please verify that the
+        * license is one of the allowed licenses (see
+        * config/dependency-license/allowed_licenses.json) and add an entry
+        * for the package (with the license in a comment) to the
+        * EXPECTED_JS_PACKAGES variable in config/presubmits.py.
+        """))
+    return True
+  return False
+
+
 def get_files():
   for root, dirnames, filenames in os.walk("."):
     for filename in filenames:
@@ -282,6 +330,7 @@ def get_files():
 
 
 if __name__ == "__main__":
+  print('python version is %s' % sys.version)
   failed = False
   for file in get_files():
     error_messages = []
@@ -298,5 +347,8 @@ if __name__ == "__main__":
   # when we put it here it fails fast before all of the tests are run.
   failed |= verify_flyway_index()
 
+  # Make sure we haven't introduced any javascript dependencies.
+  failed |= verify_javascript_deps()
+
   if failed:
     sys.exit(1)

console-webapp/README.md

@@ -9,7 +9,7 @@ expected to change.
 
 ## Deployment
 
-The webapp is deployed with the nomulus default service war to GKE.
+Webapp is deployed with the nomulus default service war to Google App Engine.
 During nomulus default service war build task, gradle script triggers the
 following:
 

console-webapp/angular.json

@@ -15,7 +15,7 @@
       "prefix": "app",
       "architect": {
         "build": {
-          "builder": "@angular/build:application",
+          "builder": "@angular-devkit/build-angular:application",
           "options": {
             "outputPath": {
               "base": "staged/dist/",
@@ -112,7 +112,7 @@
           "defaultConfiguration": "production"
         },
         "serve": {
-          "builder": "@angular/build:dev-server",
+          "builder": "@angular-devkit/build-angular:dev-server",
           "configurations": {
             "production": {
               "buildTarget": "console-webapp:build:production"
@@ -136,18 +136,16 @@
           "defaultConfiguration": "development"
         },
         "extract-i18n": {
-          "builder": "@angular/build:extract-i18n",
+          "builder": "@angular-devkit/build-angular:extract-i18n",
           "options": {
             "buildTarget": "console-webapp:build"
           }
         },
         "test": {
-          "builder": "@angular/build:karma",
+          "builder": "@angular-devkit/build-angular:karma",
           "options": {
             "main": "src/test.ts",
-            "polyfills": [
-              "src/polyfills.ts"
-            ],
+            "polyfills": "src/polyfills.ts",
             "tsConfig": "tsconfig.spec.json",
             "karmaConfig": "karma.conf.js",
             "inlineStyleLanguage": "scss",
@@ -185,31 +183,5 @@
     "schematicCollections": [
       "@angular-eslint/schematics"
     ]
-  },
-  "schematics": {
-    "@schematics/angular:component": {
-      "type": "component"
-    },
-    "@schematics/angular:directive": {
-      "type": "directive"
-    },
-    "@schematics/angular:service": {
-      "type": "service"
-    },
-    "@schematics/angular:guard": {
-      "typeSeparator": "."
-    },
-    "@schematics/angular:interceptor": {
-      "typeSeparator": "."
-    },
-    "@schematics/angular:module": {
-      "typeSeparator": "."
-    },
-    "@schematics/angular:pipe": {
-      "typeSeparator": "."
-    },
-    "@schematics/angular:resolver": {
-      "typeSeparator": "."
-    }
   }
 }

console-webapp/gradle.lockfile

@@ -1,63 +1,47 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,testAnnotationProcessor
-com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,testAnnotationProcessor
-com.google.auto.service:auto-service-annotations:1.0.1=annotationProcessor,testAnnotationProcessor
-com.google.auto.value:auto-value-annotations:1.9=annotationProcessor,testAnnotationProcessor
-com.google.auto:auto-common:1.2.2=annotationProcessor,testAnnotationProcessor
-com.google.code.findbugs:jsr305:3.0.2=checkstyle
-com.google.errorprone:error_prone_annotation:2.48.0=annotationProcessor,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.36.0=checkstyle
-com.google.errorprone:error_prone_annotations:2.48.0=annotationProcessor,testAnnotationProcessor
-com.google.errorprone:error_prone_check_api:2.48.0=annotationProcessor,testAnnotationProcessor
-com.google.errorprone:error_prone_core:2.48.0=annotationProcessor,testAnnotationProcessor
-com.google.googlejavaformat:google-java-format:1.34.1=annotationProcessor,testAnnotationProcessor
-com.google.guava:failureaccess:1.0.3=annotationProcessor,checkstyle,testAnnotationProcessor
-com.google.guava:guava:33.4.8-jre=checkstyle
-com.google.guava:guava:33.5.0-jre=annotationProcessor,testAnnotationProcessor
-com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,testAnnotationProcessor
-com.google.j2objc:j2objc-annotations:3.0.0=checkstyle
-com.google.j2objc:j2objc-annotations:3.1=annotationProcessor,testAnnotationProcessor
-com.google.protobuf:protobuf-java:4.33.2=annotationProcessor,testAnnotationProcessor
-com.puppycrawl.tools:checkstyle:10.24.0=checkstyle
-commons-beanutils:commons-beanutils:1.10.1=checkstyle
-commons-codec:commons-codec:1.15=checkstyle
+aopalliance:aopalliance:1.0=annotationProcessor,errorprone,testAnnotationProcessor
+com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,errorprone,testAnnotationProcessor
+com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.auto.service:auto-service-annotations:1.0.1=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.auto.value:auto-value-annotations:1.9=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.auto:auto-common:1.2.1=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor
+com.google.errorprone:error_prone_annotation:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.errorprone:error_prone_annotations:2.7.1=checkstyle
+com.google.errorprone:error_prone_check_api:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.errorprone:error_prone_core:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.errorprone:error_prone_type_annotations:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.errorprone:javac:9+181-r4173-1=errorproneJavac
+com.google.guava:failureaccess:1.0.1=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor
+com.google.guava:guava-parent:32.1.1-jre=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.guava:guava:31.0.1-jre=checkstyle
+com.google.guava:guava:32.1.1-jre=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=checkstyle
+com.google.inject:guice:5.1.0=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.j2objc:j2objc-annotations:1.3=checkstyle
+com.google.protobuf:protobuf-java:3.19.6=annotationProcessor,errorprone,testAnnotationProcessor
+com.puppycrawl.tools:checkstyle:9.3=checkstyle
+commons-beanutils:commons-beanutils:1.9.4=checkstyle
 commons-collections:commons-collections:3.2.2=checkstyle
-info.picocli:picocli:4.7.7=checkstyle
-io.github.eisop:dataflow-errorprone:3.41.0-eisop1=annotationProcessor,testAnnotationProcessor
-io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,testAnnotationProcessor
-javax.inject:javax.inject:1=annotationProcessor,testAnnotationProcessor
-net.sf.saxon:Saxon-HE:12.5=checkstyle
-org.antlr:antlr4-runtime:4.13.2=checkstyle
-org.apache.commons:commons-lang3:3.8.1=checkstyle
-org.apache.commons:commons-text:1.3=checkstyle
-org.apache.httpcomponents.client5:httpclient5:5.1.3=checkstyle
-org.apache.httpcomponents.core5:httpcore5-h2:5.1.3=checkstyle
-org.apache.httpcomponents.core5:httpcore5:5.1.3=checkstyle
-org.apache.httpcomponents:httpclient:4.5.13=checkstyle
-org.apache.httpcomponents:httpcore:4.4.14=checkstyle
-org.apache.maven.doxia:doxia-core:1.12.0=checkstyle
-org.apache.maven.doxia:doxia-logging-api:1.12.0=checkstyle
-org.apache.maven.doxia:doxia-module-xdoc:1.12.0=checkstyle
-org.apache.maven.doxia:doxia-sink-api:1.12.0=checkstyle
-org.apache.xbean:xbean-reflect:3.7=checkstyle
-org.checkerframework:checker-qual:3.19.0=annotationProcessor,testAnnotationProcessor
-org.checkerframework:checker-qual:3.49.3=checkstyle
-org.codehaus.plexus:plexus-classworlds:2.6.0=checkstyle
-org.codehaus.plexus:plexus-component-annotations:2.1.0=checkstyle
-org.codehaus.plexus:plexus-container-default:2.1.0=checkstyle
-org.codehaus.plexus:plexus-utils:3.3.0=checkstyle
-org.jacoco:org.jacoco.agent:0.8.14=jacocoAgent,jacocoAnt
-org.jacoco:org.jacoco.ant:0.8.14=jacocoAnt
-org.jacoco:org.jacoco.core:0.8.14=jacocoAnt
-org.jacoco:org.jacoco.report:0.8.14=jacocoAnt
+info.picocli:picocli:4.6.2=checkstyle
+io.github.eisop:dataflow-errorprone:3.34.0-eisop1=annotationProcessor,errorprone,testAnnotationProcessor
+io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,errorprone,testAnnotationProcessor
+javax.inject:javax.inject:1=annotationProcessor,errorprone,testAnnotationProcessor
+net.sf.saxon:Saxon-HE:10.6=checkstyle
+org.antlr:antlr4-runtime:4.9.3=checkstyle
+org.checkerframework:checker-qual:3.12.0=checkstyle
+org.checkerframework:checker-qual:3.33.0=annotationProcessor,errorprone,testAnnotationProcessor
+org.jacoco:org.jacoco.agent:0.8.12=jacocoAgent,jacocoAnt
+org.jacoco:org.jacoco.ant:0.8.12=jacocoAnt
+org.jacoco:org.jacoco.core:0.8.12=jacocoAnt
+org.jacoco:org.jacoco.report:0.8.12=jacocoAnt
 org.javassist:javassist:3.28.0-GA=checkstyle
-org.jspecify:jspecify:1.0.0=annotationProcessor,checkstyle,testAnnotationProcessor
-org.ow2.asm:asm-commons:9.9=jacocoAnt
-org.ow2.asm:asm-tree:9.9=jacocoAnt
-org.ow2.asm:asm:9.9=jacocoAnt
-org.pcollections:pcollections:4.0.1=annotationProcessor,testAnnotationProcessor
+org.ow2.asm:asm-commons:9.7=jacocoAnt
+org.ow2.asm:asm-tree:9.7=jacocoAnt
+org.ow2.asm:asm:9.7=jacocoAnt
+org.pcollections:pcollections:3.1.4=annotationProcessor,errorprone,testAnnotationProcessor
 org.reflections:reflections:0.10.2=checkstyle
-org.xmlresolver:xmlresolver:5.2.2=checkstyle
-empty=compileClasspath,deploy_jar,runtimeClasspath,shadow,testCompileClasspath,testRuntimeClasspath
+empty=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

console-webapp/karma.conf.js

@@ -21,7 +21,7 @@ module.exports = function (config) {
       require('karma-chrome-launcher'),
       require('karma-jasmine-html-reporter'),
       require('karma-coverage'),
-      
+      require('@angular-devkit/build-angular/plugins/karma')
     ],
     client: {
       jasmine: {

console-webapp/package.json

@@ -16,29 +16,29 @@
   },
   "private": true,
   "dependencies": {
-    "@angular/animations": "^21.1.5",
-    "@angular/cdk": "^21.1.5",
-    "@angular/common": "^21.1.5",
-    "@angular/compiler": "^21.1.5",
-    "@angular/core": "^21.1.5",
-    "@angular/forms": "^21.1.5",
-    "@angular/material": "^21.1.5",
-    "@angular/platform-browser": "^21.1.5",
-    "@angular/platform-browser-dynamic": "^21.1.5",
-    "@angular/router": "^21.1.5",
+    "@angular/animations": "^19.1.4",
+    "@angular/cdk": "^19.1.2",
+    "@angular/common": "^19.1.4",
+    "@angular/compiler": "^19.1.4",
+    "@angular/core": "^19.1.4",
+    "@angular/forms": "^19.1.4",
+    "@angular/material": "^19.1.2",
+    "@angular/platform-browser": "^19.1.4",
+    "@angular/platform-browser-dynamic": "^19.1.4",
+    "@angular/router": "^19.1.4",
     "rxjs": "~7.5.0",
     "tslib": "^2.3.0",
     "zone.js": "~0.15.0"
   },
   "devDependencies": {
+    "@angular-devkit/build-angular": "^19.1.5",
     "@angular-eslint/builder": "19.0.2",
     "@angular-eslint/eslint-plugin": "19.0.2",
     "@angular-eslint/eslint-plugin-template": "19.0.2",
     "@angular-eslint/schematics": "19.0.2",
     "@angular-eslint/template-parser": "19.0.2",
-    "@angular/build": "^21.1.4",
-    "@angular/cli": "~21.1.4",
-    "@angular/compiler-cli": "^21.1.5",
+    "@angular/cli": "~19.1.5",
+    "@angular/compiler-cli": "^19.1.4",
     "@types/jasmine": "~4.0.0",
     "@types/node": "^18.19.74",
     "@typescript-eslint/eslint-plugin": "^7.2.0",
@@ -52,6 +52,6 @@
     "karma-jasmine": "~5.1.0",
     "karma-jasmine-html-reporter": "~2.0.0",
     "prettier": "2.8.7",
-    "typescript": "^5.9.3"
+    "typescript": "^5.7.3"
   }
-}
+}

console-webapp/src/app/app-routing.module.ts

@@ -26,8 +26,6 @@ import SecurityComponent from './settings/security/security.component';
 import { SettingsComponent } from './settings/settings.component';
 import { SupportComponent } from './support/support.component';
 import RdapComponent from './settings/rdap/rdap.component';
-import { HistoryComponent } from './history/history.component';
-import { PasswordResetVerifyComponent } from './shared/components/passwordReset/passwordResetVerify.component';
 
 export interface RouteWithIcon extends Route {
   iconName?: string;
@@ -40,10 +38,6 @@ export const PATHS = {
 };
 export const routes: RouteWithIcon[] = [
   { path: '', redirectTo: '/home', pathMatch: 'full' },
-  {
-    path: PasswordResetVerifyComponent.PATH,
-    component: PasswordResetVerifyComponent,
-  },
   {
     path: RegistryLockVerifyComponent.PATH,
     component: RegistryLockVerifyComponent,
@@ -65,18 +59,13 @@ export const routes: RouteWithIcon[] = [
     title: 'Dashboard',
     iconName: 'view_comfy_alt',
   },
+  // { path: 'tlds', component: TldsComponent, title: "TLDs", iconName: "event_list" },
   {
     path: DomainListComponent.PATH,
     component: DomainListComponent,
     title: 'Domains',
     iconName: 'view_list',
   },
-  {
-    path: HistoryComponent.PATH,
-    component: HistoryComponent,
-    // title: 'History',
-    // iconName: 'history',
-  },
   {
     path: SettingsComponent.PATH,
     component: SettingsComponent,

console-webapp/src/app/app.component.html

@@ -1,9 +1,10 @@
 <div class="console-app mat-typography">
   <app-header (toggleNavOpen)="toggleSidenav()"></app-header>
   <div class="console-app__global-spinner">
-    @if (globalLoader.isLoading) {
-    <mat-progress-bar mode="indeterminate"></mat-progress-bar>
-    }
+    <mat-progress-bar
+      mode="indeterminate"
+      *ngIf="globalLoader.isLoading"
+    ></mat-progress-bar>
   </div>
   <mat-sidenav-container class="console-app__container">
     <mat-sidenav-content class="console-app__content-wrapper">

console-webapp/src/app/app.module.ts

@@ -56,14 +56,11 @@ import { GlobalLoaderService } from './shared/services/globalLoader.service';
 import { UserDataService } from './shared/services/userData.service';
 import { SnackBarModule } from './snackbar.module';
 import { SupportComponent } from './support/support.component';
+import { TldsComponent } from './tlds/tlds.component';
 import { ForceFocusDirective } from './shared/directives/forceFocus.directive';
 import RdapComponent from './settings/rdap/rdap.component';
 import RdapEditComponent from './settings/rdap/rdapEdit.component';
 import { PocReminderComponent } from './shared/components/pocReminder/pocReminder.component';
-import { PasswordResetVerifyComponent } from './shared/components/passwordReset/passwordResetVerify.component';
-import { PasswordInputForm } from './shared/components/passwordReset/passwordInputForm.component';
-import { HistoryComponent } from './history/history.component';
-import { HistoryListComponent } from './history/historyList.component';
 
 @NgModule({
   declarations: [SelectedRegistrarWrapper],
@@ -82,19 +79,15 @@ export class SelectedRegistrarModule {}
     EppPasswordEditComponent,
     ForceFocusDirective,
     HeaderComponent,
-    HistoryComponent,
-    HistoryListComponent,
     HomeComponent,
     LocationBackDirective,
     NavigationComponent,
     NewRegistrarComponent,
     NotificationsComponent,
-    PasswordInputForm,
-    PasswordResetVerifyComponent,
-    PocReminderComponent,
     RdapComponent,
     RdapEditComponent,
     ReasonDialogComponent,
+    PocReminderComponent,
     RegistrarComponent,
     RegistrarDetailsComponent,
     RegistrarSelectorComponent,
@@ -107,6 +100,7 @@ export class SelectedRegistrarModule {}
     SettingsComponent,
     SettingsContactComponent,
     SupportComponent,
+    TldsComponent,
     UserLevelVisibility,
   ],
   bootstrap: [AppComponent],

console-webapp/src/app/domains/domainList.component.html

@@ -143,14 +143,13 @@
             <ng-container matColumnDef="domainName">
               <mat-header-cell *matHeaderCellDef>Domain Name</mat-header-cell>
               <mat-cell *matCellDef="let element">
-                @if (getOperationMessage(element.domainName)) {
                 <mat-icon
+                  *ngIf="getOperationMessage(element.domainName)"
                   [matTooltip]="getOperationMessage(element.domainName)"
                   matTooltipPosition="above"
                   class="primary-text"
                   >info</mat-icon
                 >
-                }
                 <span>{{ element.domainName }}</span>
               </mat-cell>
             </ng-container>
@@ -210,9 +209,9 @@
             <mat-row *matRowDef="let row; columns: displayedColumns"></mat-row>
 
             <!-- Row shown when there is no matching data. -->
-            <tr class="mat-row" *matNoDataRow>
-              <td class="mat-cell" colspan="6">No domains found</td>
-            </tr>
+            <mat-row *matNoDataRow>
+              <mat-cell colspan="6">No domains found</mat-cell>
+            </mat-row>
           </mat-table>
           <mat-paginator
             [length]="totalResults"

console-webapp/src/app/domains/domainList.component.ts

@@ -33,7 +33,6 @@ import {
   MatDialogRef,
 } from '@angular/material/dialog';
 import { RESTRICTED_ELEMENTS } from '../shared/directives/userLevelVisiblity.directive';
-import { CdkColumnDef } from '@angular/cdk/table';
 
 interface DomainResponse {
   message: string;
@@ -115,7 +114,6 @@ export class ReasonDialogComponent {
   templateUrl: './domainList.component.html',
   styleUrls: ['./domainList.component.scss'],
   standalone: false,
-  providers: [CdkColumnDef],
 })
 export class DomainListComponent {
   public static PATH = 'domain-list';

console-webapp/src/app/header/header.component.html

@@ -1,15 +1,14 @@
 <p class="console-app__header">
   <mat-toolbar>
-    @if (breakpointObserver.isMobileView()) {
     <button
       mat-icon-button
       aria-label="Open navigation menu"
       (click)="toggleNavPane()"
+      *ngIf="breakpointObserver.isMobileView()"
       class="console-app__menu-btn"
     >
       <mat-icon>menu</mat-icon>
     </button>
-    }
     <a
       [routerLink]="'/home'"
       routerLinkActive="active"
@@ -66,9 +65,7 @@
       </svg>
     </a>
     <span class="spacer"></span>
-    @if (!breakpointObserver.isMobileView()) {
-    <app-registrar-selector />
-    }
+    <app-registrar-selector *ngIf="!breakpointObserver.isMobileView()" />
     <button
       class="console-app__header-user-icon"
       mat-mini-fab
@@ -82,7 +79,5 @@
       <button mat-menu-item (click)="logOut()">Log out</button>
     </mat-menu>
   </mat-toolbar>
-  @if (breakpointObserver.isMobileView()) {
-  <app-registrar-selector />
-  }
+  <app-registrar-selector *ngIf="breakpointObserver.isMobileView()" />
 </p>

console-webapp/src/app/history/history.component.html

@@ -1,62 +0,0 @@
-<app-selected-registrar-wrapper>
-  <div class="history-log">
-    <h1 class="mat-headline-4" forceFocus>
-      Registrar Console Activity History
-    </h1>
-    <mat-tab-group
-      [elementId]="getElementIdForUserLog()"
-      class="history-log__tabs"
-    >
-      <mat-tab label="Registrar Activity">
-        <div class="spacer"></div>
-
-        <app-history-list
-          [historyRecords]="historyService.historyRecordsRegistrar()"
-          [isLoading]="isLoading"
-        />
-      </mat-tab>
-      <mat-tab label="User Activity">
-        <div class="spacer"></div>
-        <form (ngSubmit)="loadHistory()" #form="ngForm">
-          <section>
-            <mat-form-field appearance="outline">
-              <mat-label>Console User Email: </mat-label>
-              <input
-                matInput
-                id="email"
-                type="email"
-                name="consoleUserEmail"
-                required
-                email
-                [(ngModel)]="consoleUserEmail"
-                #emailControl="ngModel"
-              />
-            </mat-form-field>
-          </section>
-          <div class="spacer"></div>
-          <button
-            mat-flat-button
-            color="primary"
-            type="submit"
-            aria-label="Search user history"
-            [disabled]="!form.valid"
-          >
-            Search
-          </button>
-        </form>
-        <div class="spacer"></div>
-        <app-history-list
-          [historyRecords]="historyService.historyRecordsUser()"
-          [isLoading]="isLoading"
-        />
-      </mat-tab>
-    </mat-tab-group>
-  </div>
-
-  <app-history-list
-    [elementId]="getElementIdForUserLog()"
-    [isReverse]="true"
-    [historyRecords]="historyService.historyRecordsUser()"
-    [isLoading]="isLoading"
-  />
-</app-selected-registrar-wrapper>

console-webapp/src/app/history/history.component.ts

@@ -1,80 +0,0 @@
-// Copyright 2025 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import { Component, effect } from '@angular/core';
-import { UserDataService } from '../shared/services/userData.service';
-import { BackendService } from '../shared/services/backend.service';
-import { RegistrarService } from '../registrar/registrar.service';
-import { HistoryService } from './history.service';
-import { MatSnackBar } from '@angular/material/snack-bar';
-import {
-  GlobalLoader,
-  GlobalLoaderService,
-} from '../shared/services/globalLoader.service';
-import { HttpErrorResponse } from '@angular/common/http';
-import { RESTRICTED_ELEMENTS } from '../shared/directives/userLevelVisiblity.directive';
-
-@Component({
-  selector: 'app-history',
-  templateUrl: './history.component.html',
-  styleUrls: ['./history.component.scss'],
-  providers: [HistoryService],
-  standalone: false,
-})
-export class HistoryComponent implements GlobalLoader {
-  public static PATH = 'history';
-
-  consoleUserEmail: string = '';
-  isLoading: boolean = false;
-
-  constructor(
-    private backendService: BackendService,
-    private registrarService: RegistrarService,
-    protected historyService: HistoryService,
-    protected globalLoader: GlobalLoaderService,
-    protected userDataService: UserDataService,
-    private _snackBar: MatSnackBar
-  ) {
-    effect(() => {
-      if (registrarService.registrarId()) {
-        this.loadHistory();
-      }
-    });
-  }
-
-  getElementIdForUserLog() {
-    return RESTRICTED_ELEMENTS.ACTIVITY_PER_USER;
-  }
-
-  loadingTimeout() {
-    this._snackBar.open('Timeout loading records history');
-  }
-
-  loadHistory() {
-    this.globalLoader.startGlobalLoader(this);
-    this.isLoading = true;
-    this.historyService
-      .getHistoryLog(this.registrarService.registrarId(), this.consoleUserEmail)
-      .subscribe({
-        error: (err: HttpErrorResponse) => {
-          this._snackBar.open(err.error || err.message);
-          this.isLoading = false;
-        },
-        next: () => {
-          this.globalLoader.stopGlobalLoader(this);
-          this.isLoading = false;
-        },
-      });
-  }
-}

console-webapp/src/app/history/history.service.ts

@@ -1,46 +0,0 @@
-// Copyright 2025 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import { Injectable, signal } from '@angular/core';
-import { BackendService } from '../shared/services/backend.service';
-import { tap } from 'rxjs';
-
-export interface HistoryRecord {
-  modificationTime: string;
-  type: string;
-  description: string;
-  actingUser: {
-    emailAddress: string;
-  };
-}
-
-@Injectable()
-export class HistoryService {
-  historyRecordsRegistrar = signal<HistoryRecord[]>([]);
-  historyRecordsUser = signal<HistoryRecord[]>([]);
-
-  constructor(private backendService: BackendService) {}
-
-  getHistoryLog(registrarId: string, userEmail?: string) {
-    return this.backendService.getHistoryLog(registrarId, userEmail).pipe(
-      tap((historyRecords: HistoryRecord[]) => {
-        if (userEmail) {
-          this.historyRecordsUser.set(historyRecords);
-        } else {
-          this.historyRecordsRegistrar.set(historyRecords);
-        }
-      })
-    );
-  }
-}

console-webapp/src/app/history/historyList.component.html

@@ -1,45 +0,0 @@
-@if (!isLoading && historyRecords.length == 0) {
-<div class="history-list__no-records">
-  <mat-icon class="history-list__no-records-icon secondary-text"
-    >apps_outage</mat-icon
-  >
-  <h1>No records found</h1>
-</div>
-} @else {
-<mat-card>
-  <mat-card-content>
-    <mat-list role="list">
-      @for (item of historyRecords; track item; let last = $last) {
-      <mat-list-item class="history-list__item">
-        <mat-icon
-          [ngClass]="getIconClass(item.type)"
-          class="history-list__icon"
-        >
-          {{ getIconForType(item.type) }}
-        </mat-icon>
-        <div class="history-list__content">
-          <div class="history-list__description">
-            <span class="history-list__description--main">{{ item.type }}</span>
-            <div>
-              @if (parseDescription(item.description).detail) {
-              <mat-chip class="history-list__chip">
-                {{ parseDescription(item.description).detail }}
-              </mat-chip>
-              }
-            </div>
-          </div>
-          <div class="history-list__user">
-            <b>User - {{ item.actingUser.emailAddress }}</b>
-          </div>
-        </div>
-        <span class="history-list__timestamp">
-          {{ item.modificationTime | date : "MMM d, y, h:mm a" }}
-        </span>
-      </mat-list-item>
-      @if (!last) {
-      <mat-divider></mat-divider>
-      } }
-    </mat-list>
-  </mat-card-content>
-</mat-card>
-}

console-webapp/src/app/history/historyList.component.scss

@@ -1,81 +0,0 @@
-// Copyright 2025 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-.history-list {
-  font-family: "Roboto", sans-serif;
-  &__item {
-    display: flex;
-    align-items: center;
-    // Override default mat-list-item height to fit content
-    height: auto !important;
-    padding: 16px 0;
-  }
-
-  &__no-records {
-    display: flex;
-    justify-content: center;
-    align-items: center;
-    flex-direction: column;
-  }
-  &__no-records-icon {
-    width: 4rem;
-    height: 4rem;
-    font-size: 4rem;
-    margin-top: 1.5rem;
-  }
-
-  &__icon {
-    margin-right: 16px;
-
-    &--update {
-      color: #1976d2;
-    }
-
-    &--security {
-      color: #d32f2f;
-    }
-  }
-
-  &__description {
-    &--main {
-      font-size: 1rem;
-      font-weight: 500;
-      color: rgba(0, 0, 0, 0.87);
-      margin-bottom: 1em;
-    }
-  }
-
-  &__content {
-    flex-grow: 1;
-    display: flex;
-    flex-direction: column;
-    gap: 4px;
-    margin-right: 16px;
-  }
-
-  &__chip {
-    margin: 0.5rem 0;
-  }
-
-  &__user {
-    font-size: 0.9rem;
-    color: rgba(0, 0, 0, 0.6);
-  }
-
-  &__timestamp {
-    color: rgba(0, 0, 0, 0.6);
-    white-space: nowrap;
-    text-align: right;
-  }
-}

console-webapp/src/app/history/historyList.component.ts

@@ -1,66 +0,0 @@
-// Copyright 2025 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import { ChangeDetectionStrategy, Component, Input } from '@angular/core';
-import { HistoryRecord } from './history.service';
-
-@Component({
-  selector: 'app-history-list',
-  templateUrl: './historyList.component.html',
-  styleUrls: ['./historyList.component.scss'],
-  changeDetection: ChangeDetectionStrategy.OnPush,
-  standalone: false,
-})
-export class HistoryListComponent {
-  @Input() historyRecords: HistoryRecord[] = [];
-  @Input() isLoading: boolean = false;
-
-  getIconForType(type: string): string {
-    switch (type) {
-      case 'REGISTRAR_UPDATE':
-        return 'edit';
-      case 'REGISTRAR_SECURITY_UPDATE':
-        return 'security';
-      default:
-        return 'history'; // A fallback icon
-    }
-  }
-
-  getIconClass(type: string): string {
-    switch (type) {
-      case 'REGISTRAR_UPDATE':
-        return 'history-log__icon--update';
-      case 'REGISTRAR_SECURITY_UPDATE':
-        return 'history-log__icon--security';
-      default:
-        return '';
-    }
-  }
-
-  parseDescription(description: string): {
-    main: string;
-    detail: string | null;
-  } {
-    if (!description) {
-      return { main: 'N/A', detail: null };
-    }
-    const parts = description.split('|');
-    const detail = parts.length > 1 ? parts[1].replace(/_/g, ' ') : parts[0];
-
-    return {
-      main: parts[0],
-      detail: detail,
-    };
-  }
-}

console-webapp/src/app/home/home.component.spec.ts

@@ -17,9 +17,6 @@ import { ComponentFixture, TestBed } from '@angular/core/testing';
 import { HomeComponent } from './home.component';
 import { MaterialModule } from '../material.module';
 import { AppModule } from '../app.module';
-import { BackendService } from '../shared/services/backend.service';
-import { provideHttpClient } from '@angular/common/http';
-import { provideHttpClientTesting } from '@angular/common/http/testing';
 
 describe('HomeComponent', () => {
   let component: HomeComponent;
@@ -29,11 +26,6 @@ describe('HomeComponent', () => {
     await TestBed.configureTestingModule({
       imports: [MaterialModule, AppModule],
       declarations: [HomeComponent],
-      providers: [
-        BackendService,
-        provideHttpClient(),
-        provideHttpClientTesting(),
-      ],
     }).compileComponents();
 
     fixture = TestBed.createComponent(HomeComponent);

console-webapp/src/app/navigation/navigation.component.html

@@ -12,11 +12,9 @@
     [class.active]="router.url.includes(node.path)"
     [elementId]="getElementId(node)"
   >
-    @if (node.iconName) {
-    <mat-icon class="console-app__nav-icon">
+    <mat-icon class="console-app__nav-icon" *ngIf="node.iconName">
       {{ node.iconName }}
     </mat-icon>
-    }
     {{ node.title }}
   </mat-tree-node>
   <mat-nested-tree-node
@@ -36,11 +34,9 @@
           {{ treeControl.isExpanded(node) ? "expand_more" : "chevron_right" }}
         </mat-icon>
       </button>
-      @if (node.iconName) {
-      <mat-icon class="console-app__nav-icon">
+      <mat-icon class="console-app__nav-icon" *ngIf="node.iconName">
         {{ node.iconName }}
       </mat-icon>
-      }
       {{ node.title }}
     </div>
     <div

console-webapp/src/app/ote/oteStatus.component.html

@@ -1,28 +1,25 @@
 <h1 class="mat-headline-4">OT&E Status Check</h1>
 @if(registrarId() === null) {
 <h1>Missing registrarId param</h1>
-} @else if(isOte()) { @if (oteStatusResponse().length) {
-<h1>
+} @else if(isOte()) {
+<h1 *ngIf="oteStatusResponse().length">
   Status:
   <span>{{ oteStatusUnfinished().length ? "Unfinished" : "Completed" }}</span>
 </h1>
-}
 <div class="console-app__ote-status">
   @if(oteStatusCompleted().length) {
   <div class="console-app__ote-status_completed">
     <h1>Completed</h1>
-    @for (entry of oteStatusCompleted(); track entry) {
-    <div><mat-icon>check_box</mat-icon>{{ entry.description }}</div>
-    }
+    <div *ngFor="let entry of oteStatusCompleted()">
+      <mat-icon>check_box</mat-icon>{{ entry.description }}
+    </div>
   </div>
   } @if(oteStatusUnfinished().length) {
   <div class="console-app__ote-status_unfinished">
     <h1>Unfinished</h1>
-    @for (entry of oteStatusUnfinished(); track entry) {
-    <div>
+    <div *ngFor="let entry of oteStatusUnfinished()">
       <mat-icon>check_box_outline_blank</mat-icon>{{ entry.description }}
     </div>
-    }
   </div>
   }
 </div>

console-webapp/src/app/ote/oteStatus.component.ts

@@ -18,7 +18,7 @@ import { MatSnackBar } from '@angular/material/snack-bar';
 import { RegistrarService } from '../registrar/registrar.service';
 import { MaterialModule } from '../material.module';
 import { SnackBarModule } from '../snackbar.module';
-
+import { CommonModule } from '@angular/common';
 import { ActivatedRoute, ParamMap } from '@angular/router';
 import { take } from 'rxjs';
 
@@ -31,7 +31,7 @@ export interface OteStatusResponse {
 
 @Component({
   selector: 'app-ote-status',
-  imports: [MaterialModule, SnackBarModule],
+  imports: [MaterialModule, SnackBarModule, CommonModule],
   templateUrl: './oteStatus.component.html',
   styleUrls: ['./oteStatus.component.scss'],
 })

console-webapp/src/app/registrar/registrarDetails.component.html

@@ -11,8 +11,9 @@
         <mat-icon>arrow_back</mat-icon>
       </button>
       <div class="spacer"></div>
-      @if(!inEdit && !registrarNotFound) { @if (oteButtonVisible) {
+      @if(!inEdit && !registrarNotFound) {
       <button
+        *ngIf="oteButtonVisible"
         mat-stroked-button
         (click)="checkOteStatus()"
         aria-label="Check OT&E account status"
@@ -20,7 +21,6 @@
       >
         Check OT&E Status
       </button>
-      }
       <button
         mat-flat-button
         color="primary"
@@ -39,11 +39,10 @@
     <h1>Registrar not found</h1>
     } @else {
     <h1>{{ registrarInEdit.registrarId }}</h1>
-    @if (registrarInEdit.registrarName !== registrarInEdit.registrarId) {
-    <h2>
+    <h2 *ngIf="registrarInEdit.registrarName !== registrarInEdit.registrarId">
       {{ registrarInEdit.registrarName }}
     </h2>
-    } @if(inEdit) {
+    @if(inEdit) {
     <form (ngSubmit)="saveAndClose()">
       <div>
         <mat-form-field appearance="outline">
@@ -61,14 +60,15 @@
         <mat-form-field appearance="outline">
           <mat-label>Onboarded TLDs: </mat-label>
           <mat-chip-grid #chipGrid aria-label="Enter TLD">
-            @for (tld of registrarInEdit.allowedTlds; track tld) {
-            <mat-chip-row (removed)="removeTLD(tld)">
+            <mat-chip-row
+              *ngFor="let tld of registrarInEdit.allowedTlds"
+              (removed)="removeTLD(tld)"
+            >
               {{ tld }}
               <button matChipRemove aria-label="'remove ' + tld">
                 <mat-icon>cancel</mat-icon>
               </button>
             </mat-chip-row>
-            }
           </mat-chip-grid>
           <input
             placeholder="New tld..."

console-webapp/src/app/registrar/registrarSelector.component.ts

@@ -25,10 +25,7 @@ export class RegistrarSelectorComponent {
   registrarInput = signal<string>(this.registrarService.registrarId());
   filteredOptions?: string[];
   allRegistrarIds = computed(() =>
-    this.registrarService
-      .registrars()
-      .map((r) => r.registrarId)
-      .sort()
+    this.registrarService.registrars().map((r) => r.registrarId)
   );
 
   constructor(protected registrarService: RegistrarService) {

console-webapp/src/app/registrar/registrarsTable.component.html

@@ -5,16 +5,15 @@
   <div class="console-app__registrars-header">
     <h1 class="mat-headline-4" forceFocus>Registrars</h1>
     <div class="spacer"></div>
-    @if (oteButtonVisible) {
     <button
       mat-stroked-button
+      *ngIf="oteButtonVisible"
       (click)="createOteAccount()"
       aria-label="Generate OT&E accounts"
       [elementId]="getElementIdForOteBlock()"
     >
       Create OT&E accounts
     </button>
-    }
     <button
       class="console-app__registrars-new"
       mat-flat-button
@@ -44,8 +43,10 @@
         class="console-app__registrars-table"
         matSort
       >
-        @for (column of columns; track column) {
-        <ng-container [matColumnDef]="column.columnDef">
+        <ng-container
+          *ngFor="let column of columns"
+          [matColumnDef]="column.columnDef"
+        >
           <mat-header-cell *matHeaderCellDef>
             {{ column.header }}
           </mat-header-cell>
@@ -54,7 +55,6 @@
             [innerHTML]="column.cell(row)"
           ></mat-cell>
         </ng-container>
-        }
         <mat-header-row *matHeaderRowDef="displayedColumns"></mat-header-row>
         <mat-row
           *matRowDef="let row; columns: displayedColumns"

console-webapp/src/app/settings/contact/contact.component.html

@@ -22,12 +22,13 @@
   </div>
   } @else {
   <mat-table [dataSource]="dataSource" class="mat-elevation-z0">
-    @for (column of columns; track column) {
-    <ng-container [matColumnDef]="column.columnDef">
+    <ng-container
+      *ngFor="let column of columns"
+      [matColumnDef]="column.columnDef"
+    >
       <mat-header-cell *matHeaderCellDef> {{ column.header }} </mat-header-cell>
       <mat-cell *matCellDef="let row" [innerHTML]="column.cell(row)"></mat-cell>
     </ng-container>
-    }
     <mat-header-row *matHeaderRowDef="displayedColumns"></mat-header-row>
     <mat-row
       *matRowDef="let row; columns: displayedColumns"

console-webapp/src/app/settings/contact/contact.service.ts

@@ -47,9 +47,9 @@ export interface Contact {
   registrarId?: string;
   faxNumber?: string;
   types: Array<contactType>;
-  visibleInRdapAsAdmin?: boolean;
-  visibleInRdapAsTech?: boolean;
-  visibleInDomainRdapAsAbuse?: boolean;
+  visibleInWhoisAsAdmin?: boolean;
+  visibleInWhoisAsTech?: boolean;
+  visibleInDomainWhoisAsAbuse?: boolean;
 }
 
 export interface ViewReadyContact extends Contact {

console-webapp/src/app/settings/contact/contactDetails.component.html

@@ -1,5 +1,9 @@
-@if (contactService.contactInEdit) {
-<div class="console-app__contact" cdkTrapFocus [cdkTrapFocusAutoCapture]="true">
+<div
+  class="console-app__contact"
+  *ngIf="contactService.contactInEdit"
+  cdkTrapFocus
+  [cdkTrapFocusAutoCapture]="true"
+>
   <div class="console-app__contact-controls">
     <button
       mat-icon-button
@@ -28,6 +32,7 @@
     </button>
     }
   </div>
+
   @if(isEditing || contactService.isContactNewView) {
   <h1>Contact Details</h1>
   <form (ngSubmit)="save($event)">
@@ -41,6 +46,7 @@
           [ngModelOptions]="{ standalone: true }"
         />
       </mat-form-field>
+
       <mat-form-field appearance="outline">
         <mat-label>Primary account email: </mat-label>
         <input
@@ -51,13 +57,9 @@
           [(ngModel)]="contactService.contactInEdit.emailAddress"
           [ngModelOptions]="{ standalone: true }"
           [disabled]="emailAddressIsDisabled()"
-          [matTooltip]="
-            emailAddressIsDisabled()
-              ? 'Reach out to registry customer support to update email address'
-              : ''
-          "
         />
       </mat-form-field>
+
       <mat-form-field appearance="outline">
         <mat-label>Phone: </mat-label>
         <input
@@ -67,6 +69,7 @@
           placeholder="+0.0000000000"
         />
       </mat-form-field>
+
       <mat-form-field appearance="outline">
         <mat-label>Fax: </mat-label>
         <input
@@ -76,44 +79,49 @@
         />
       </mat-form-field>
     </section>
+
     <section>
       <h1>Contact Type</h1>
       <p class="console-app__contact-required">
         <mat-icon color="accent">error</mat-icon>Required to select at least one
-        (primary contact can't be updated)
       </p>
       <div class="">
-        @for (contactType of contactTypeToTextMap | keyvalue; track contactType)
-        { @if (shouldDisplayCheckbox(contactType.key)) {
-        <mat-checkbox
-          [checked]="checkboxIsChecked(contactType.key)"
-          (change)="checkboxOnChange($event, contactType.key)"
-          [disabled]="checkboxIsDisabled(contactType.key)"
+        <ng-container
+          *ngFor="let contactType of contactTypeToTextMap | keyvalue"
         >
-          {{ contactType.value }}
-        </mat-checkbox>
-        } }
+          <mat-checkbox
+            *ngIf="shouldDisplayCheckbox(contactType.key)"
+            [checked]="checkboxIsChecked(contactType.key)"
+            (change)="checkboxOnChange($event, contactType.key)"
+            [disabled]="checkboxIsDisabled(contactType.key)"
+          >
+            {{ contactType.value }}
+          </mat-checkbox>
+        </ng-container>
       </div>
     </section>
+
     <section>
       <h1>RDAP Preferences</h1>
       <div>
         <mat-checkbox
-          [(ngModel)]="contactService.contactInEdit.visibleInRdapAsAdmin"
+          [(ngModel)]="contactService.contactInEdit.visibleInWhoisAsAdmin"
           [ngModelOptions]="{ standalone: true }"
           >Show in Registrar RDAP record as admin contact</mat-checkbox
         >
       </div>
+
       <div>
         <mat-checkbox
-          [(ngModel)]="contactService.contactInEdit.visibleInRdapAsTech"
+          [(ngModel)]="contactService.contactInEdit.visibleInWhoisAsTech"
           [ngModelOptions]="{ standalone: true }"
           >Show in Registrar RDAP record as technical contact</mat-checkbox
         >
       </div>
+
       <div>
         <mat-checkbox
-          [(ngModel)]="contactService.contactInEdit.visibleInDomainRdapAsAbuse"
+          [(ngModel)]="contactService.contactInEdit.visibleInDomainWhoisAsAbuse"
           [ngModelOptions]="{ standalone: true }"
           >Show Phone and Email in Domain RDAP Record as registrar abuse contact
           (per CL&D requirements)</mat-checkbox
@@ -175,22 +183,24 @@
         <mat-list-item role="listitem">
           <h2>RDAP Preferences</h2>
         </mat-list-item>
-        @if(contactService.contactInEdit.visibleInRdapAsAdmin) {
+        @if(contactService.contactInEdit.visibleInWhoisAsAdmin) {
         <mat-divider></mat-divider>
         <mat-list-item role="listitem">
           <span class="console-app__list-value"
             >Show in Registrar RDAP record as admin contact</span
           >
         </mat-list-item>
-        } @if(contactService.contactInEdit.visibleInRdapAsTech) {
+        } @if(contactService.contactInEdit.visibleInWhoisAsTech) {
         <mat-divider></mat-divider>
-        @if (contactService.contactInEdit.visibleInRdapAsTech) {
-        <mat-list-item role="listitem">
+        <mat-list-item
+          role="listitem"
+          *ngIf="contactService.contactInEdit.visibleInWhoisAsTech"
+        >
           <span class="console-app__list-value"
             >Show in Registrar RDAP record as technical contact</span
           >
         </mat-list-item>
-        } } @if(contactService.contactInEdit.visibleInDomainRdapAsAbuse) {
+        } @if(contactService.contactInEdit.visibleInDomainWhoisAsAbuse) {
         <mat-divider></mat-divider>
         <mat-list-item role="listitem">
           <span class="console-app__list-value"
@@ -204,4 +214,3 @@
   </mat-card>
   }
 </div>
-}

console-webapp/src/app/settings/rdap/rdapEdit.component.html

@@ -1,6 +1,6 @@
-@if (registrarInEdit) {
 <div
   class="console-app__rdap-edit"
+  *ngIf="registrarInEdit"
   cdkTrapFocus
   [cdkTrapFocusAutoCapture]="true"
 >
@@ -12,6 +12,7 @@
   >
     <mat-icon>arrow_back</mat-icon>
   </button>
+
   <div class="console-app__rdap-edit-controls">
     <span>
       General registrar information for your RDAP record. This information is
@@ -19,8 +20,10 @@
     </span>
     <div class="spacer"></div>
   </div>
+
   <div class="console-app__rdap-edit">
     <h1>Personal info</h1>
+
     <form (ngSubmit)="save($event)">
       <mat-form-field appearance="outline">
         <mat-label>Email: </mat-label>
@@ -31,6 +34,7 @@
           [ngModelOptions]="{ standalone: true }"
         />
       </mat-form-field>
+
       <mat-form-field appearance="outline">
         <mat-label>Phone: </mat-label>
         <input
@@ -40,6 +44,7 @@
           [ngModelOptions]="{ standalone: true }"
         />
       </mat-form-field>
+
       <mat-form-field appearance="outline">
         <mat-label>Fax: </mat-label>
         <input
@@ -49,6 +54,7 @@
           [ngModelOptions]="{ standalone: true }"
         />
       </mat-form-field>
+
       <mat-form-field appearance="outline">
         <mat-label>Street Address (line 1): </mat-label>
         <input
@@ -58,6 +64,7 @@
           [(ngModel)]="registrarInEdit.localizedAddress.street![0]"
         />
       </mat-form-field>
+
       <mat-form-field appearance="outline">
         <mat-label>Street Address (line 2): </mat-label>
         <input
@@ -67,6 +74,7 @@
           [(ngModel)]="registrarInEdit.localizedAddress.street![1]"
         />
       </mat-form-field>
+
       <mat-form-field appearance="outline">
         <mat-label>City: </mat-label>
         <input
@@ -76,6 +84,7 @@
           [(ngModel)]="(registrarInEdit.localizedAddress || {}).city"
         />
       </mat-form-field>
+
       <mat-form-field appearance="outline">
         <mat-label>State or Province: </mat-label>
         <input
@@ -85,6 +94,7 @@
           [(ngModel)]="(registrarInEdit.localizedAddress || {}).state"
         />
       </mat-form-field>
+
       <mat-form-field appearance="outline">
         <mat-label>Country: </mat-label>
         <input
@@ -94,6 +104,7 @@
           [(ngModel)]="(registrarInEdit.localizedAddress || {}).countryCode"
         />
       </mat-form-field>
+
       <mat-form-field appearance="outline">
         <mat-label>Postal code: </mat-label>
         <input
@@ -103,6 +114,7 @@
           [(ngModel)]="(registrarInEdit.localizedAddress || {}).zip"
         />
       </mat-form-field>
+
       <button
         mat-flat-button
         color="primary"
@@ -114,4 +126,3 @@
     </form>
   </div>
 </div>
-}

console-webapp/src/app/settings/security/eppPasswordEdit.component.html

@@ -16,20 +16,65 @@
   <p class="secondary-text">
     Passwords must be between 6 and 16 alphanumeric characters
   </p>
-  <password-input-form-component
-    [displayOldPasswordField]="true"
+  <form
+    (ngSubmit)="save()"
     [formGroup]="passwordUpdateForm"
-    (submitResults)="save($event)"
-  />
-  <div class="settings-security__reset-password-field">
-    <h2>Need to reset your EPP password?</h2>
+    class="settings-security__edit-password-form"
+  >
+    <div class="settings-security__edit-password-field">
+      <mat-form-field appearance="outline">
+        <mat-label>Old password: </mat-label>
+        <input
+          matInput
+          type="text"
+          formControlName="oldPassword"
+          required
+          autocomplete="current-password"
+        />
+        <mat-error *ngIf="hasError('oldPassword') as errorText">{{
+          errorText
+        }}</mat-error>
+      </mat-form-field>
+    </div>
+    <div class="settings-security__edit-password-field">
+      <mat-form-field appearance="outline">
+        <mat-label>New password: </mat-label>
+        <input
+          matInput
+          type="text"
+          formControlName="newPassword"
+          required
+          autocomplete="new-password"
+        />
+        <mat-error *ngIf="hasError('newPassword') as errorText">{{
+          errorText
+        }}</mat-error>
+      </mat-form-field>
+    </div>
+    <div class="settings-security__edit-password-field">
+      <mat-form-field appearance="outline">
+        <mat-label>Confirm new password: </mat-label>
+        <input
+          matInput
+          type="text"
+          formControlName="newPasswordRepeat"
+          required
+          autocomplete="new-password"
+        />
+        <mat-error *ngIf="hasError('newPasswordRepeat') as errorText">{{
+          errorText
+        }}</mat-error>
+      </mat-form-field>
+    </div>
     <button
       mat-flat-button
       color="primary"
-      aria-label="Reset EPP password via email"
-      (click)="requestEppPasswordReset()"
+      [disabled]="!passwordUpdateForm.valid"
+      aria-label="Save epp password update"
+      type="submit"
+      class="settings-security__edit-password-save"
     >
-      Reset EPP password via email
+      Save
     </button>
-  </div>
+  </form>
 </div>

console-webapp/src/app/settings/security/eppPasswordEdit.component.scss

@@ -1,19 +1,16 @@
-// Copyright 2025 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-.settings-security {
-  &__reset-password-field {
-    margin-top: 60px;
+.settings-security__edit-password {
+  max-width: 616px;
+  &-field {
+    width: 100%;
+    mat-form-field {
+      margin-bottom: 20px;
+      width: 100%;
+    }
+  }
+  &-form {
+    margin-top: 30px;
+  }
+  &-save {
+    margin-top: 30px;
   }
 }

console-webapp/src/app/settings/security/eppPasswordEdit.component.ts

@@ -14,46 +14,20 @@
 
 import { HttpErrorResponse } from '@angular/common/http';
 import { Component } from '@angular/core';
-import { FormControl, FormGroup, Validators } from '@angular/forms';
+import {
+  AbstractControl,
+  FormControl,
+  FormGroup,
+  ValidatorFn,
+  Validators,
+} from '@angular/forms';
 import { MatSnackBar } from '@angular/material/snack-bar';
 import { RegistrarService } from 'src/app/registrar/registrar.service';
 import { SecurityService } from './security.service';
-import { UserDataService } from 'src/app/shared/services/userData.service';
-import { MatDialog, MatDialogRef } from '@angular/material/dialog';
 
-import { MaterialModule } from 'src/app/material.module';
-import { filter, switchMap, take } from 'rxjs';
-import { BackendService } from 'src/app/shared/services/backend.service';
-import {
-  PasswordInputForm,
-  PasswordResults,
-} from 'src/app/shared/components/passwordReset/passwordInputForm.component';
+type errorCode = 'required' | 'maxlength' | 'minlength' | 'passwordsDontMatch';
 
-@Component({
-  selector: 'app-reset-epp-password-dialog',
-  template: `
-    <h2 mat-dialog-title>Please confirm the password reset:</h2>
-    <mat-dialog-content>
-      This will send an EPP password reset email to the admin POC.
-    </mat-dialog-content>
-    <mat-dialog-actions>
-      <button mat-button (click)="onCancel()">Cancel</button>
-      <button mat-button color="warn" (click)="onSave()">Confirm</button>
-    </mat-dialog-actions>
-  `,
-  imports: [MaterialModule],
-})
-export class ResetEppPasswordComponent {
-  constructor(public dialogRef: MatDialogRef<ResetEppPasswordComponent>) {}
-
-  onSave(): void {
-    this.dialogRef.close(true);
-  }
-
-  onCancel(): void {
-    this.dialogRef.close(false);
-  }
-}
+type errorFriendlyText = { [type in errorCode]: String };
 
 @Component({
   selector: 'app-epp-password-edit',
@@ -62,38 +36,76 @@ export class ResetEppPasswordComponent {
   standalone: false,
 })
 export default class EppPasswordEditComponent {
-  static EPP_VALIDATORS = [
-    Validators.required,
-    Validators.minLength(6),
-    Validators.maxLength(16),
-    PasswordInputForm.newPasswordsMatch,
-  ];
+  MIN_MAX_LENGHT = new String(
+    'Passwords must be between 6 and 16 alphanumeric characters'
+  );
+
+  errorTextMap: errorFriendlyText = {
+    required: "This field can't be empty",
+    maxlength: this.MIN_MAX_LENGHT,
+    minlength: this.MIN_MAX_LENGHT,
+    passwordsDontMatch: "Passwords don't match",
+  };
+
+  constructor(
+    public securityService: SecurityService,
+    private _snackBar: MatSnackBar,
+    public registrarService: RegistrarService
+  ) {}
+
+  hasError(controlName: string) {
+    const maybeErrors = this.passwordUpdateForm.get(controlName)?.errors;
+    const maybeError =
+      maybeErrors && (Object.keys(maybeErrors)[0] as errorCode);
+    if (maybeError) {
+      return this.errorTextMap[maybeError];
+    }
+    return '';
+  }
+
+  newPasswordsMatch: ValidatorFn = (control: AbstractControl) => {
+    if (
+      this.passwordUpdateForm?.get('newPassword')?.value ===
+      this.passwordUpdateForm?.get('newPasswordRepeat')?.value
+    ) {
+      this.passwordUpdateForm?.get('newPasswordRepeat')?.setErrors(null);
+    } else {
+      // latest angular just won't detect the error without setTimeout
+      setTimeout(() => {
+        this.passwordUpdateForm
+          ?.get('newPasswordRepeat')
+          ?.setErrors({ passwordsDontMatch: control.value });
+      });
+    }
+    return null;
+  };
 
   passwordUpdateForm = new FormGroup({
     oldPassword: new FormControl('', [Validators.required]),
-    newPassword: new FormControl('', EppPasswordEditComponent.EPP_VALIDATORS),
-    newPasswordRepeat: new FormControl(
-      '',
-      EppPasswordEditComponent.EPP_VALIDATORS
-    ),
+    newPassword: new FormControl('', [
+      Validators.required,
+      Validators.minLength(6),
+      Validators.maxLength(16),
+      this.newPasswordsMatch,
+    ]),
+    newPasswordRepeat: new FormControl('', [
+      Validators.required,
+      Validators.minLength(6),
+      Validators.maxLength(16),
+      this.newPasswordsMatch,
+    ]),
   });
 
-  constructor(
-    public registrarService: RegistrarService,
-    public securityService: SecurityService,
-    protected userDataService: UserDataService,
-    private backendService: BackendService,
-    private resetPasswordDialog: MatDialog,
-    private _snackBar: MatSnackBar
-  ) {}
-
-  save(passwordResults: PasswordResults) {
+  save() {
+    const { oldPassword, newPassword, newPasswordRepeat } =
+      this.passwordUpdateForm.value;
+    if (!oldPassword || !newPassword || !newPasswordRepeat) return;
     this.securityService
       .saveEppPassword({
         registrarId: this.registrarService.registrarId(),
-        oldPassword: passwordResults.oldPassword!,
-        newPassword: passwordResults.newPassword,
-        newPasswordRepeat: passwordResults.newPasswordRepeat,
+        oldPassword,
+        newPassword,
+        newPasswordRepeat,
       })
       .subscribe({
         complete: () => {
@@ -108,26 +120,4 @@ export default class EppPasswordEditComponent {
   goBack() {
     this.securityService.isEditingPassword = false;
   }
-
-  sendEppPasswordResetRequest() {
-    return this.backendService.requestEppPasswordReset(
-      this.registrarService.registrarId()
-    );
-  }
-
-  requestEppPasswordReset() {
-    const dialogRef = this.resetPasswordDialog.open(ResetEppPasswordComponent);
-    dialogRef
-      .afterClosed()
-      .pipe(
-        take(1),
-        filter((result) => !!result)
-      )
-      .pipe(switchMap((_) => this.sendEppPasswordResetRequest()))
-      .subscribe({
-        next: (_) => this.goBack(),
-        error: (err: HttpErrorResponse) =>
-          this._snackBar.open(err.error || err.message),
-      });
-  }
 }

console-webapp/src/app/settings/security/security.component.html

@@ -68,7 +68,7 @@
           >
         </mat-list-item>
         <mat-divider></mat-divider>
-        @for (item of dataSource.ipAddressAllowList; track $index){
+        @for (item of dataSource.ipAddressAllowList; track item.value) {
         <mat-list-item role="listitem">
           <span class="console-app__list-value">{{ item.value }}</span>
         </mat-list-item>

console-webapp/src/app/settings/security/security.component.spec.ts

@@ -12,13 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-import {
-  ComponentFixture,
-  fakeAsync,
-  TestBed,
-  tick,
-  waitForAsync,
-} from '@angular/core/testing';
+import { ComponentFixture, TestBed, waitForAsync } from '@angular/core/testing';
 
 import { provideHttpClient } from '@angular/common/http';
 import { provideHttpClientTesting } from '@angular/common/http/testing';
@@ -36,32 +30,43 @@ import { MOCK_REGISTRAR_SERVICE } from 'src/testdata/registrar/registrar.service
 describe('SecurityComponent', () => {
   let component: SecurityComponent;
   let fixture: ComponentFixture<SecurityComponent>;
+  let fetchSecurityDetailsSpy: Function;
   let saveSpy: Function;
-  let securityServiceStub: Partial<SecurityService>;
 
   beforeEach(async () => {
-    securityServiceStub = {
-      isEditingSecurity: false,
-      isEditingPassword: false,
-      saveChanges: jasmine.createSpy('saveChanges').and.returnValue(of({})),
-    };
+    const securityServiceSpy = jasmine.createSpyObj(SecurityService, [
+      'fetchSecurityDetails',
+      'saveChanges',
+    ]);
+
+    fetchSecurityDetailsSpy =
+      securityServiceSpy.fetchSecurityDetails.and.returnValue(of());
+
+    saveSpy = securityServiceSpy.saveChanges.and.returnValue(of());
 
     await TestBed.configureTestingModule({
       declarations: [SecurityEditComponent, SecurityComponent],
       imports: [MaterialModule, BrowserAnimationsModule, FormsModule],
       providers: [
         BackendService,
-        { provide: SecurityService, useValue: securityServiceStub },
+        SecurityService,
         { provide: RegistrarService, useValue: MOCK_REGISTRAR_SERVICE },
         provideHttpClient(),
         provideHttpClientTesting(),
       ],
-    }).compileComponents();
-
-    saveSpy = securityServiceStub.saveChanges as jasmine.Spy;
+    })
+      .overrideComponent(SecurityComponent, {
+        set: {
+          providers: [
+            { provide: SecurityService, useValue: securityServiceSpy },
+          ],
+        },
+      })
+      .compileComponents();
 
     fixture = TestBed.createComponent(SecurityComponent);
     component = fixture.componentInstance;
+    fixture.detectChanges();
   });
 
   it('should create', () => {
@@ -88,36 +93,17 @@ describe('SecurityComponent', () => {
     });
   }));
 
-  it('should remove ip', fakeAsync(() => {
-    fixture.detectChanges();
-    tick();
-
-    const editBtn = fixture.nativeElement.querySelector(
-      'button[aria-label="Edit security settings"]'
-    );
-    editBtn.click();
-
-    tick();
-    fixture.detectChanges();
-
-    const removeIpBtn = fixture.nativeElement.querySelector(
-      '.console-app__removeIp'
-    );
-    removeIpBtn.click();
-
-    tick();
-    fixture.detectChanges();
-
-    const saveBtn = fixture.nativeElement.querySelector(
-      '.settings-security__edit-save'
-    );
-    saveBtn.click();
-
-    tick();
-    fixture.detectChanges();
-
-    expect(saveSpy).toHaveBeenCalledWith({
-      ipAddressAllowList: [],
+  it('should remove ip', waitForAsync(() => {
+    component.dataSource.ipAddressAllowList =
+      component.dataSource.ipAddressAllowList?.splice(1);
+    fixture.whenStable().then(() => {
+      fixture.detectChanges();
+      let listElems: Array<HTMLElement> = Array.from(
+        fixture.nativeElement.querySelectorAll('span.console-app__list-value')
+      );
+      expect(listElems.map((e) => e.textContent)).toContain(
+        'No IP addresses on file.'
+      );
     });
   }));
 
@@ -133,34 +119,21 @@ describe('SecurityComponent', () => {
     expect(component.securityService.isEditingPassword).toBeTrue();
   });
 
-  it('should call save', fakeAsync(() => {
+  it('should call save', waitForAsync(async () => {
+    component.editSecurity();
+    await fixture.whenStable();
     fixture.detectChanges();
-    tick();
-
-    const editBtn = fixture.nativeElement.querySelector(
-      'button[aria-label="Edit security settings"]'
-    );
-    editBtn.click();
-
-    tick();
-    fixture.detectChanges();
-
     const el = fixture.nativeElement.querySelector(
       '.console-app__clientCertificateValue'
     );
     el.value = 'test';
     el.dispatchEvent(new Event('input'));
-
-    tick();
     fixture.detectChanges();
-
-    const saveBtn = fixture.nativeElement.querySelector(
-      '.settings-security__edit-save'
-    );
-    saveBtn.click();
-
-    tick();
-    expect(saveSpy).toHaveBeenCalledWith({
+    await fixture.whenStable();
+    fixture.nativeElement
+      .querySelector('.settings-security__edit-save')
+      .click();
+    expect(saveSpy).toHaveBeenCalledOnceWith({
       ipAddressAllowList: [{ value: '123.123.123.123' }],
       clientCertificate: 'test',
     });

console-webapp/src/app/settings/security/securityEdit.component.html

@@ -23,11 +23,9 @@
       <button
         matSuffix
         mat-icon-button
-        class="console-app__removeIp"
         [attr.aria-label]="'Remove IP entry ' + ip.value"
         (click)="removeIpEntry(ip)"
         [disabled]="isUpdating"
-        type="button"
       >
         <mat-icon>close</mat-icon>
       </button>

console-webapp/src/app/shared/components/passwordReset/passwordInputForm.component.html

@@ -1,63 +0,0 @@
-<form
-  (ngSubmit)="save()"
-  [formGroup]="formGroup()!"
-  class="console-app__password-input-form"
->
-  @if (displayOldPasswordField()) {
-  <div class="console-app__password-input-form-field">
-    <mat-form-field appearance="outline">
-      <mat-label>Old password: </mat-label>
-      <input
-        matInput
-        type="text"
-        formControlName="oldPassword"
-        required
-        autocomplete="current-password"
-      />
-      @if (hasError('oldPassword'); as errorText) {
-      <mat-error>{{ errorText }}</mat-error>
-      }
-    </mat-form-field>
-  </div>
-  }
-  <div class="console-app__password-input-form-field">
-    <mat-form-field appearance="outline">
-      <mat-label>New password: </mat-label>
-      <input
-        matInput
-        type="text"
-        formControlName="newPassword"
-        required
-        autocomplete="new-password"
-      />
-      @if (hasError('newPassword'); as errorText) {
-      <mat-error>{{ errorText }}</mat-error>
-      }
-    </mat-form-field>
-  </div>
-  <div class="console-app__password-input-form-field">
-    <mat-form-field appearance="outline">
-      <mat-label>Confirm new password: </mat-label>
-      <input
-        matInput
-        type="text"
-        formControlName="newPasswordRepeat"
-        required
-        autocomplete="new-password"
-      />
-      @if (hasError('newPasswordRepeat'); as errorText) {
-      <mat-error>{{ errorText }}</mat-error>
-      }
-    </mat-form-field>
-  </div>
-  <button
-    mat-flat-button
-    color="primary"
-    [disabled]="!formGroup()?.valid"
-    aria-label="Save new password"
-    type="submit"
-    class="console-app__password-input-form-save"
-  >
-    Save
-  </button>
-</form>

console-webapp/src/app/shared/components/passwordReset/passwordInputForm.component.ts

@@ -1,82 +0,0 @@
-// Copyright 2025 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import { Component, EventEmitter, input, Output } from '@angular/core';
-import { AbstractControl, FormGroup, ValidatorFn } from '@angular/forms';
-
-type errorCode = 'required' | 'maxlength' | 'minlength' | 'passwordsDontMatch';
-
-type errorFriendlyText = { [type in errorCode]: String };
-
-export interface PasswordResults {
-  oldPassword: string | null;
-  newPassword: string;
-  newPasswordRepeat: string;
-}
-
-@Component({
-  selector: 'password-input-form-component',
-  templateUrl: './passwordInputForm.component.html',
-  styleUrls: ['./passwordInputForm.component.scss'],
-  standalone: false,
-})
-export class PasswordInputForm {
-  static newPasswordsMatch: ValidatorFn = (control: AbstractControl) => {
-    const parent = control.parent;
-    if (
-      parent?.get('newPassword')?.value ===
-      parent?.get('newPasswordRepeat')?.value
-    ) {
-      parent?.get('newPasswordRepeat')?.setErrors(null);
-    } else {
-      // latest angular just won't detect the error without setTimeout
-      setTimeout(() => {
-        parent
-          ?.get('newPasswordRepeat')
-          ?.setErrors({ passwordsDontMatch: control.value });
-      });
-    }
-    return null;
-  };
-
-  MIN_MAX_LENGTH = 'Passwords must be between 6 and 16 alphanumeric characters';
-
-  errorTextMap: errorFriendlyText = {
-    required: "This field can't be empty",
-    maxlength: this.MIN_MAX_LENGTH,
-    minlength: this.MIN_MAX_LENGTH,
-    passwordsDontMatch: "Passwords don't match",
-  };
-
-  displayOldPasswordField = input<boolean>(false);
-  formGroup = input<FormGroup>();
-  @Output() submitResults = new EventEmitter<PasswordResults>();
-
-  hasError(controlName: string) {
-    const maybeErrors = this.formGroup()!.get(controlName)?.errors;
-    const maybeError =
-      maybeErrors && (Object.keys(maybeErrors)[0] as errorCode);
-    if (maybeError) {
-      return this.errorTextMap[maybeError];
-    }
-    return '';
-  }
-
-  save() {
-    const results: PasswordResults = this.formGroup()!.value;
-    if (this.displayOldPasswordField() && !results.oldPassword) return;
-    if (!results.newPassword || !results.newPasswordRepeat) return;
-    this.submitResults.emit(results);
-  }
-}

console-webapp/src/app/shared/components/passwordReset/passwordResetVerify.component.html

@@ -1,27 +0,0 @@
-<p>
-  <button mat-icon-button aria-label="Go home" [routerLink]="['']">
-    <mat-icon>arrow_back</mat-icon>
-  </button>
-</p>
-@if (isLoading) {
-<div class="console-app__password-reset-verify-spinner">
-  <mat-spinner />
-</div>
-} @else if (errorMessage) {
-<h1 class="mat-headline-4">Failure</h1>
-<div class="console-app__password-reset-content">
-  <div class="console-app__password-reset-subhead">
-    An error occurred: {{ errorMessage }}.<br /><br />Please double-check the
-    verification code and try again.
-  </div>
-</div>
-} @else {
-<div class="console-app__password-reset-verify">
-  <h1 class="mat-headline-4">{{ type }} password reset</h1>
-  <password-input-form-component
-    [displayOldPasswordField]="false"
-    [formGroup]="passwordUpdateForm!"
-    (submitResults)="save($event)"
-  />
-</div>
-}

console-webapp/src/app/shared/components/passwordReset/passwordResetVerify.component.ts

@@ -1,110 +0,0 @@
-// Copyright 2025 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import { Component } from '@angular/core';
-import { ActivatedRoute, ParamMap, Router } from '@angular/router';
-import { HttpErrorResponse } from '@angular/common/http';
-import { take } from 'rxjs';
-import { RegistrarService } from 'src/app/registrar/registrar.service';
-import { BackendService } from '../../services/backend.service';
-import { FormControl, FormGroup, Validators } from '@angular/forms';
-import {
-  PasswordInputForm,
-  PasswordResults,
-} from './passwordInputForm.component';
-import EppPasswordEditComponent from 'src/app/settings/security/eppPasswordEdit.component';
-import { MatSnackBar } from '@angular/material/snack-bar';
-
-export interface PasswordResetVerifyResponse {
-  registrarId: string;
-  type: string;
-}
-
-@Component({
-  selector: 'app-password-reset-verify',
-  templateUrl: './passwordResetVerify.component.html',
-  standalone: false,
-})
-export class PasswordResetVerifyComponent {
-  public static PATH = 'password-reset-verify';
-
-  REGISTRY_LOCK_PASSWORD_VALIDATORS = [
-    Validators.required,
-    PasswordInputForm.newPasswordsMatch,
-  ];
-
-  isLoading = true;
-  type?: string;
-  errorMessage?: string;
-  requestVerificationCode = '';
-
-  passwordUpdateForm: FormGroup<any> | null = null;
-
-  constructor(
-    protected backendService: BackendService,
-    protected registrarService: RegistrarService,
-    private route: ActivatedRoute,
-    private router: Router,
-    private _snackBar: MatSnackBar
-  ) {}
-
-  ngOnInit() {
-    this.route.queryParamMap.pipe(take(1)).subscribe((params: ParamMap) => {
-      this.requestVerificationCode =
-        params.get('resetRequestVerificationCode') || '';
-      this.backendService
-        .getPasswordResetInformation(this.requestVerificationCode)
-        .subscribe({
-          error: (err: HttpErrorResponse) => {
-            this.isLoading = false;
-            this.errorMessage = err.error;
-          },
-          next: this.presentData.bind(this),
-        });
-    });
-  }
-
-  presentData(verificationResponse: PasswordResetVerifyResponse) {
-    this.type = verificationResponse.type === 'EPP' ? 'EPP' : 'Registry lock';
-    this.registrarService.registrarId.set(verificationResponse.registrarId);
-    const validators =
-      verificationResponse.type === 'EPP'
-        ? EppPasswordEditComponent.EPP_VALIDATORS
-        : this.REGISTRY_LOCK_PASSWORD_VALIDATORS;
-
-    this.passwordUpdateForm = new FormGroup({
-      newPassword: new FormControl('', validators),
-      newPasswordRepeat: new FormControl('', validators),
-    });
-    this.isLoading = false;
-  }
-
-  save(passwordResults: PasswordResults) {
-    this.backendService
-      .finalizePasswordReset(
-        this.requestVerificationCode,
-        passwordResults.newPassword
-      )
-      .subscribe({
-        error: (err: HttpErrorResponse) => {
-          this.isLoading = false;
-          this.errorMessage = err.error;
-        },
-        next: (_) => {
-          this.router.navigate(['']);
-          this._snackBar.open('Password reset completed successfully');
-        },
-      });
-  }
-}

console-webapp/src/app/shared/directives/userLevelVisiblity.directive.ts

@@ -16,7 +16,6 @@ import { Directive, ElementRef, Input, effect } from '@angular/core';
 import { UserDataService } from '../services/userData.service';
 
 export enum RESTRICTED_ELEMENTS {
-  ACTIVITY_PER_USER,
   REGISTRAR_ELEMENT,
   OTE,
   USERS,
@@ -41,8 +40,6 @@ export const DISABLED_ELEMENTS_PER_ROLE = {
 export class UserLevelVisibility {
   @Input() elementId!: RESTRICTED_ELEMENTS | null;
 
-  @Input() isReverse: boolean = false;
-
   constructor(
     private userDataService: UserDataService,
     private el: ElementRef
@@ -59,9 +56,9 @@ export class UserLevelVisibility {
       // @ts-ignore
       (DISABLED_ELEMENTS_PER_ROLE[globalRole] || []).includes(this.elementId)
     ) {
-      this.el.nativeElement.style.display = this.isReverse ? '' : 'none';
+      this.el.nativeElement.style.display = 'none';
     } else {
-      this.el.nativeElement.style.display = this.isReverse ? 'none' : '';
+      this.el.nativeElement.style.display = '';
     }
   }
 }

console-webapp/src/app/shared/services/backend.service.ts

@@ -30,8 +30,6 @@ import {
 import { Contact } from '../../settings/contact/contact.service';
 import { EppPasswordBackendModel } from '../../settings/security/security.service';
 import { UserData } from './userData.service';
-import { PasswordResetVerifyResponse } from '../components/passwordReset/passwordResetVerify.component';
-import { HistoryRecord } from '../../history/history.service';
 
 @Injectable()
 export class BackendService {
@@ -124,16 +122,6 @@ export class BackendService {
       .pipe(catchError((err) => this.errorCatcher<DomainListResult>(err)));
   }
 
-  getHistoryLog(registrarId: string, userEmail?: string) {
-    return this.http
-      .get<HistoryRecord[]>(
-        userEmail
-          ? `/console-api/history?registrarId=${registrarId}&consoleUserEmail=${userEmail}`
-          : `/console-api/history?registrarId=${registrarId}`
-      )
-      .pipe(catchError((err) => this.errorCatcher<HistoryRecord[]>(err)));
-  }
-
   getRegistrars(): Observable<Registrar[]> {
     return this.http
       .get<Registrar[]>('/console-api/registrars')
@@ -303,26 +291,4 @@ export class BackendService {
       registryLockEmail,
     });
   }
-
-  requestEppPasswordReset(registrarId: string) {
-    return this.http.post('/console-api/password-reset-request', {
-      type: 'EPP',
-      registrarId,
-    });
-  }
-
-  getPasswordResetInformation(
-    verificationCode: string
-  ): Observable<PasswordResetVerifyResponse> {
-    return this.http.get<PasswordResetVerifyResponse>(
-      `/console-api/password-reset-verify?resetRequestVerificationCode=${verificationCode}`
-    );
-  }
-
-  finalizePasswordReset(verificationCode: string, newPassword: string) {
-    return this.http.post(
-      `/console-api/password-reset-verify?resetRequestVerificationCode=${verificationCode}`,
-      newPassword
-    );
-  }
 }

console-webapp/src/app/tlds/tlds.component.html

@@ -0,0 +1 @@
+<div class="console-tlds__cards"></div>

console-webapp/src/app/tlds/tlds.component.scss

@@ -1,4 +1,4 @@
-// Copyright 2025 The Nomulus Authors. All Rights Reserved.
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -12,19 +12,17 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-.console-app__password-input-form {
-  max-width: 450px;
-  &-field {
-    width: 100%;
-    mat-form-field {
-      margin-bottom: 20px;
-      width: 100%;
-    }
+.console-tlds {
+  &__cards {
+    display: flex;
+    border-top: 1px solid #ddd;
+    padding: 1rem;
   }
-  &-form {
-    margin-top: 30px;
+  &__card {
+    max-width: 300px;
   }
-  &-save {
-    margin-top: 30px;
+  &__card-links {
+    display: flex;
+    flex-direction: column;
   }
 }

console-webapp/src/app/tlds/tlds.component.spec.ts

@@ -0,0 +1,38 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+
+import { TldsComponent } from './tlds.component';
+import { MaterialModule } from '../material.module';
+
+describe('TldsComponent', () => {
+  let component: TldsComponent;
+  let fixture: ComponentFixture<TldsComponent>;
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      imports: [MaterialModule],
+      declarations: [TldsComponent],
+    }).compileComponents();
+
+    fixture = TestBed.createComponent(TldsComponent);
+    component = fixture.componentInstance;
+    fixture.detectChanges();
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+});

console-webapp/src/app/tlds/tlds.component.ts

@@ -0,0 +1,23 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { Component } from '@angular/core';
+
+@Component({
+  selector: 'app-tlds',
+  templateUrl: './tlds.component.html',
+  styleUrls: ['./tlds.component.scss'],
+  standalone: false,
+})
+export class TldsComponent {}

console-webapp/src/app/users/userDetails.component.html

@@ -50,17 +50,15 @@
       <mat-icon>delete</mat-icon>
     </button>
   </div>
-  @if (isNewUser) {
-  <div class="console-app__user-details-save-password">
+  <div *ngIf="isNewUser" class="console-app__user-details-save-password">
     <mat-icon>priority_high</mat-icon>
     Please save the password. For your security, we do not store passwords in a
     recoverable format.
   </div>
-  } @if (isLoading) {
-  <p>
+
+  <p *ngIf="isLoading">
     <mat-progress-bar mode="query"></mat-progress-bar>
   </p>
-  }
 
   <mat-card appearance="outlined">
     <mat-card-content>

console-webapp/src/app/users/userDetails.component.ts

@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+import { CommonModule } from '@angular/common';
 import { Component, computed } from '@angular/core';
 import { MatSnackBar } from '@angular/material/snack-bar';
 import { SelectedRegistrarModule } from '../app.module';
@@ -30,6 +31,7 @@ import { UserEditFormComponent } from './userEditForm.component';
     FormsModule,
     MaterialModule,
     SnackBarModule,
+    CommonModule,
     SelectedRegistrarModule,
     UserEditFormComponent,
   ],

console-webapp/src/app/users/userEditForm.component.html

@@ -1,7 +1,6 @@
 <div class="console-app__user-edit">
   <form (ngSubmit)="saveEdit($event)" #form>
-    @if (isNew()) {
-    <p>
+    <p *ngIf="isNew()">
       <mat-form-field appearance="outline">
         <mat-label
           >User name prefix:
@@ -20,7 +19,6 @@
         />
       </mat-form-field>
     </p>
-    }
     <p>
       <mat-form-field appearance="outline">
         <mat-label
@@ -31,7 +29,7 @@
           ></mat-label
         >
         <mat-select [(ngModel)]="user().role" name="userRole">
-          <mat-option value="TECH_CONTACT">Editor</mat-option>
+          <mat-option value="PRIMARY_CONTACT">Editor</mat-option>
           <mat-option value="ACCOUNT_MANAGER">Viewer</mat-option>
         </mat-select>
       </mat-form-field>
@@ -46,6 +44,7 @@
       Save
     </button>
   </form>
+  @if(userDataService.userData()?.isAdmin) {
   <button
     mat-flat-button
     color="primary"
@@ -54,4 +53,5 @@
   >
     Reset registry lock password
   </button>
+  }
 </div>

console-webapp/src/app/users/userEditForm.component.ts

@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+import { CommonModule } from '@angular/common';
 import {
   Component,
   ElementRef,
@@ -49,7 +50,7 @@ import { HttpErrorResponse } from '@angular/common/http';
       <button mat-button color="warn" (click)="onSave()">Confirm</button>
     </mat-dialog-actions>
   `,
-  imports: [MaterialModule],
+  imports: [CommonModule, MaterialModule],
 })
 export class ResetRegistryLockPasswordComponent {
   constructor(
@@ -71,7 +72,7 @@ export class ResetRegistryLockPasswordComponent {
   selector: 'app-user-edit-form',
   templateUrl: './userEditForm.component.html',
   styleUrls: ['./userEditForm.component.scss'],
-  imports: [FormsModule, MaterialModule],
+  imports: [FormsModule, MaterialModule, CommonModule],
   providers: [],
 })
 export class UserEditFormComponent {

console-webapp/src/app/users/users.component.ts

@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+import { CommonModule } from '@angular/common';
 import { HttpErrorResponse } from '@angular/common/http';
 import { Component, effect } from '@angular/core';
 import { MatSnackBar } from '@angular/material/snack-bar';
@@ -21,6 +22,7 @@ import { RegistrarService } from '../registrar/registrar.service';
 import { SnackBarModule } from '../snackbar.module';
 import { UserDetailsComponent } from './userDetails.component';
 import { User, UsersService } from './users.service';
+import { UserDataService } from '../shared/services/userData.service';
 import { FormsModule } from '@angular/forms';
 import { UsersListComponent } from './usersList.component';
 import { MatSelectChange } from '@angular/material/select';
@@ -34,6 +36,7 @@ import { UserEditFormComponent } from './userEditForm.component';
     FormsModule,
     MaterialModule,
     SnackBarModule,
+    CommonModule,
     SelectedRegistrarModule,
     UsersListComponent,
     UserEditFormComponent,
@@ -52,6 +55,7 @@ export class UsersComponent {
   constructor(
     protected registrarService: RegistrarService,
     protected usersService: UsersService,
+    private userDataService: UserDataService,
     private _snackBar: MatSnackBar
   ) {
     effect(() => {

console-webapp/src/app/users/usersList.component.html

@@ -5,14 +5,15 @@
     class="console-app__users-table"
     matSort
   >
-    @for (column of columns; track column) {
-    <ng-container [matColumnDef]="column.columnDef">
+    <ng-container
+      *ngFor="let column of columns"
+      [matColumnDef]="column.columnDef"
+    >
       <mat-header-cell *matHeaderCellDef>
         {{ column.header }}
       </mat-header-cell>
       <mat-cell *matCellDef="let row" [innerHTML]="column.cell(row)"></mat-cell>
     </ng-container>
-    }
     <mat-header-row *matHeaderRowDef="displayedColumns"></mat-header-row>
     <mat-row
       *matRowDef="let row; columns: displayedColumns"

console-webapp/src/app/users/usersList.component.ts

@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+import { CommonModule } from '@angular/common';
 import {
   Component,
   effect,
@@ -42,7 +43,7 @@ export const columns = [
   selector: 'app-users-list',
   templateUrl: './usersList.component.html',
   styleUrls: ['./usersList.component.scss'],
-  imports: [MaterialModule],
+  imports: [MaterialModule, CommonModule],
   providers: [],
 })
 export class UsersListComponent {

console-webapp/src/main.ts

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-import { enableProdMode, provideZoneChangeDetection } from '@angular/core';
+import { enableProdMode } from '@angular/core';
 import { platformBrowserDynamic } from '@angular/platform-browser-dynamic';
 
 import { AppModule } from './app/app.module';
@@ -23,7 +23,5 @@ if (environment.production || environment.sandbox) {
 }
 
 platformBrowserDynamic()
-  .bootstrapModule(AppModule, {
-    applicationProviders: [provideZoneChangeDetection()],
-  })
+  .bootstrapModule(AppModule)
   .catch((err) => console.error(err));

console-webapp/tsconfig.json

@@ -14,10 +14,14 @@
     "sourceMap": true,
     "declaration": false,
     "experimentalDecorators": true,
-    "moduleResolution": "bundler",
+    "moduleResolution": "node",
     "importHelpers": true,
     "target": "ES2022",
     "module": "es2020",
+    "lib": [
+      "es2020",
+      "dom"
+    ],
     "useDefineForClassFields": false
   },
   "angularCompilerOptions": {

core/Dockerfile

@@ -1,3 +1,3 @@
-FROM eclipse-temurin:25
+FROM eclipse-temurin:21
 ADD build/libs/nomulus.jar /nomulus.jar
 ENTRYPOINT ["java", "-jar", "/nomulus.jar"]

core/build.gradle

@@ -17,7 +17,7 @@ import java.util.Optional
 
 plugins {
   id 'java-library'
-  id "org.flywaydb.flyway" version "12.2.0"
+  id "org.flywaydb.flyway" version "11.0.1"
   id 'maven-publish'
 }
 
@@ -30,6 +30,7 @@ def screenshotsForGoldensDir = "${project.buildDir}/screenshots_for_goldens"
 def newGoldensDir = "${project.buildDir}/new_golden_images"
 def goldensDir =
   "${javaTestDir}/google/registry/webdriver/goldens/chrome-linux"
+def jsDir = "${project.projectDir}/src/main/javascript"
 
 // Tests that fail when running Gradle in a docker container, e. g. when
 // building the release artifacts in Google Cloud Build.
@@ -54,8 +55,9 @@ def dockerIncompatibleTestPatterns = [
 // objects retained by frameworks.
 // TODO(weiminyu): identify cause and fix offending tests.
 def fragileTestPatterns = [
-    // Breaks random other tests when running with standardTests.
-    "google/registry/bsa/UploadBsaUnavailableDomainsActionTest.*",
+    // Changes cache timeouts and for some reason appears to have contention
+    // with other tests.
+    "google/registry/whois/WhoisCommandFactoryTest.*",
     // Currently changes a global configuration parameter that for some reason
     // results in timestamp inversions for other tests.  TODO(mmuller): fix.
     "google/registry/flows/host/HostInfoFlowTest.*",
@@ -74,7 +76,11 @@ sourceSets {
   nonprod {
     java {
       compileClasspath += main.output
-      runtimeClasspath += main.output
+
+      // Add the DB runtime classpath to nonprod so we can load the flyway
+      // scripts.
+      runtimeClasspath += main.output +
+          rootProject.project(":db").sourceSets.main.runtimeClasspath
     }
   }
   test {
@@ -98,24 +104,15 @@ configurations {
   devtool
 
   nonprodImplementation.extendsFrom implementation
-  nonprodRuntimeOnly.extendsFrom runtimeOnly
 
   testImplementation.extendsFrom nonprodImplementation
 
   // Published jars that are used for server/schema compatibility tests.
   // See <a href="../integration/README.md">the integration project</a>
   // for details.
-  nomulus_test {
-    canBeConsumed = true
-    canBeResolved = false
-  }
-  testRuntimeElements {
-    canBeConsumed = true
-    canBeResolved = false
-    extendsFrom testRuntimeOnly
-  }
+  nomulus_test
 
-  // Exclude non-canonical servlet-api jars. Our deployment uses
+  // Exclude non-canonical servlet-api jars. Our AppEngine deployment uses
   // javax.servlet:servlet-api:2.5
   // For reasons we do not understand, marking the following dependencies as
   // compileOnly instead of compile does not exclude them from runtimeClasspath.
@@ -256,7 +253,6 @@ dependencies {
   implementation project(':util')
   // Import NomulusPostreSql from ':db' for implementation but exclude dependencies.
   implementation project(path: ':db', configuration: 'implementationApi')
-  nonprodRuntimeOnly project(':db')
   testRuntimeOnly project(':db')
 
   annotationProcessor deps['com.google.auto.service:auto-service']
@@ -276,6 +272,7 @@ dependencies {
   testImplementation deps['org.hamcrest:hamcrest']
   testImplementation deps['org.hamcrest:hamcrest-core']
   testImplementation deps['org.hamcrest:hamcrest-library']
+  testImplementation deps['junit:junit']
   testImplementation deps['org.junit.jupiter:junit-jupiter-api']
   testImplementation deps['org.junit.jupiter:junit-jupiter-engine']
   testImplementation deps['org.junit.jupiter:junit-jupiter-migrationsupport']
@@ -299,6 +296,9 @@ dependencies {
   // Dependency needed for soy to java compilation.
   soy deps['com.google.template:soy']
 
+  // Tool dependencies.  used for doc generation.
+  implementation files("${System.properties['java.home']}/../lib/tools.jar")
+
   // Flyway classes needed to generate the golden file.
   implementation deps['org.flywaydb:flyway-core']
   implementation deps['org.flywaydb:flyway-database-postgresql']
@@ -342,7 +342,7 @@ task jaxbToJava {
             destdir: "${generatedDir}",
             binding: "${xjcTempSourceDir}/bindings.xjb",
             removeOldOutput: 'yes', extension: 'true') {
-      fileTree(
+      project.fileTree(
               dir: new File("$xjcTempSourceDir"),
               include: ['**/*.xsd'])
               .addToAntBuilder(ant, 'schema', FileCollection.AntType.FileSet)
@@ -380,13 +380,13 @@ task soyToJava {
   }
 
   ext.soyToJava = { javaPackage, outputDirectory, soyFiles ->
-    project.services.get(ExecOperations).javaexec {
-      mainClass = "com.google.template.soy.SoyParseInfoGenerator"
-      classpath = configurations.soy
-      args = ["--javaPackage", "${javaPackage}",
+    javaexec {
+      main = "com.google.template.soy.SoyParseInfoGenerator"
+      classpath configurations.soy
+      args "--javaPackage", "${javaPackage}",
               "--outputDirectory", "${outputDirectory}",
               "--javaClassNameSource", "filename",
-              "--srcs", "${soyFiles.join(',')}"]
+              "--srcs", "${soyFiles.join(',')}"
     }
 
     // Replace the "@link" tags after the "@deprecated" tags in the generated
@@ -400,8 +400,8 @@ task soyToJava {
     }
 
     outputs.each { file ->
-      project.services.get(ExecOperations).exec {
-        commandLine = ['sed', '-i""', '-e', 's/@link/LINK/g', file.getCanonicalPath()]
+      exec {
+        commandLine 'sed', '-i""', '-e', 's/@link/LINK/g', file.getCanonicalPath()
       }
     }
   }
@@ -432,12 +432,12 @@ task testJar(type: Jar) {
 }
 
 artifacts {
-  add('testRuntimeElements', testJar)
+  testRuntimeOnly testJar
 }
 
 task findGoldenImages(type: JavaExec) {
   classpath = sourceSets.test.runtimeClasspath
-  mainClass = 'google.registry.webdriver.GoldenImageFinder'
+  main = 'google.registry.webdriver.GoldenImageFinder'
 
   def arguments = []
   arguments << "--screenshots_for_goldens_dir=${screenshotsForGoldensDir}"
@@ -484,11 +484,11 @@ Optional<List<String>> getToolArgsList() {
 // parameter.
 ext.createToolTask = {
     taskName,
-    mainClassName,
+    mainClass,
     sourceSet = sourceSets.main ->
   project.tasks.create(taskName, JavaExec) {
     classpath = sourceSet.runtimeClasspath
-    mainClass = mainClassName
+    main = mainClass
 
     doFirst {
       getToolArgsList().ifPresent {
@@ -505,7 +505,7 @@ createToolTask(
 
 project.tasks.create('generateSqlSchema', JavaExec) {
   classpath = sourceSets.nonprod.runtimeClasspath
-  mainClass = 'google.registry.tools.DevTool'
+  main = 'google.registry.tools.DevTool'
   args = [
       '-e', 'alpha',
       'generate_sql_schema', '--start_postgresql', '-o',
@@ -518,7 +518,7 @@ task generateGoldenImages(type: FilteringTest) {
   tests = ["**/webdriver/*"]
 
   // Sets the maximum number of test executors that may exist at the same time.
-  maxParallelForks = 5
+  maxParallelForks 5
 
   systemProperty 'test.screenshot.dir', screenshotsForGoldensDir
   systemProperty 'test.screenshot.runAllAttempts', 'true'
@@ -572,6 +572,11 @@ if (environment == 'alpha') {
               mainClass: 'google.registry.beam.resave.ResaveAllEppResourcesPipeline',
               metaData: 'google/registry/beam/resave_all_epp_resources_pipeline_metadata.json'
           ],
+      wipeOutContactHistoryPii:
+              [
+                      mainClass: 'google.registry.beam.wipeout.WipeOutContactHistoryPiiPipeline',
+                      metaData: 'google/registry/beam/wipe_out_contact_history_pii_pipeline_metadata.json'
+              ],
   ]
   project.tasks.create("stageBeamPipelines") {
     doLast {
@@ -591,7 +596,7 @@ if (environment == 'alpha') {
             gs://${gcpProject}-deploy/live/beam/${metaDataBaseName} \
             --image-gcr-path ${imageName}:live \
             --sdk-language JAVA \
-            --flex-template-base-image gcr.io/dataflow-templates-base/java25-template-launcher-base:latest \
+            --flex-template-base-image gcr.io/dataflow-templates-base/java21-template-launcher-base:latest \
             --metadata-file ${projectDir}/src/main/resources/${metaData} \
             --jar ${uberJarName} \
             --env FLEX_TEMPLATE_JAVA_MAIN_CLASS=${mainClass} \
@@ -644,6 +649,23 @@ artifacts {
   nomulus_test testUberJar
 }
 
+publishing {
+  repositories {
+    maven {
+      url project.publish_repo
+    }
+  }
+  publications {
+    nomulusTestsPublication(MavenPublication) {
+      groupId 'google.registry'
+      artifactId 'nomulus_test'
+      version project.nomulus_version
+      artifact nomulusFossJar
+      artifact testUberJar
+    }
+  }
+}
+
 task buildToolImage(dependsOn: nomulus, type: Exec) {
   commandLine 'docker', 'build', '-t', 'nomulus-tool', '.'
 }
@@ -662,7 +684,7 @@ artifacts {
 }
 
 task runTestServer(type: JavaExec) {
-  mainClass = 'google.registry.server.RegistryTestServerMain'
+  main = 'google.registry.server.RegistryTestServerMain'
   classpath = sourceSets.test.runtimeClasspath
   dependsOn(rootProject.project('console-webapp').tasks.named('buildConsoleWebapp'))
 }
@@ -688,8 +710,6 @@ abstract class FilteringTest extends Test {
 
   FilteringTest() {
     useJUnitPlatform();
-    testClassesDirs = project.sourceSets.test.output.classesDirs
-    classpath = project.sourceSets.test.runtimeClasspath
   }
 
   private void applyTestFilter() {
@@ -744,7 +764,7 @@ task fragileTest(type: FilteringTest) {
   }
 
   // Run every test class in a freshly started process.
-  forkEvery = 1
+  forkEvery 1
 
   doFirst {
     new File(screenshotsDir).deleteDir()
@@ -759,9 +779,6 @@ task sqlIntegrationTest(type: FilteringTest) {
   useJUnit()
   excludeTestCases = false
   tests = ['google/registry/schema/integration/SqlIntegrationTestSuite.*']
-
-  testClassesDirs = sourceSets.test.output.classesDirs
-  classpath = sourceSets.test.runtimeClasspath
 }
 
 // Verifies that RegistryTool can be instantiated:
@@ -787,13 +804,13 @@ task standardTest(type: FilteringTest) {
   // Run every test class in its own process.
   // Uncomment to unblock build while troubleshooting inexplicable test errors.
   // This setting makes the build take 35 minutes, without it it takes about 10.
-  // forkEvery = 1
+  // forkEvery 1
 
   // Sets the maximum number of test executors that may exist at the same time.
   // Also, Gradle executes tests in 1 thread and some of our test infrastructures
   // depend on that, e.g. DualDatabaseTestInvocationContextProvider injects
   // different implementation of TransactionManager into TransactionManagerFactory.
-  maxParallelForks = 64
+  maxParallelForks 64
 
   systemProperty 'test.projectRoot', rootProject.projectRootDir
   systemProperty 'test.resourcesDir', resourcesDir

core/buildscript-gradle.lockfile

@@ -1,11 +1,13 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-com.fasterxml.jackson.core:jackson-annotations:2.21=classpath
-gradle.plugin.org.flywaydb:gradle-plugin-publishing:12.2.0=classpath
-org.flywaydb.flyway:org.flywaydb.flyway.gradle.plugin:12.2.0=classpath
-org.flywaydb:flyway-core:12.2.0=classpath
-tools.jackson.core:jackson-core:3.1.0=classpath
-tools.jackson.core:jackson-databind:3.1.0=classpath
-tools.jackson:jackson-bom:3.1.0=classpath
+com.fasterxml.jackson.core:jackson-annotations:2.15.2=classpath
+com.fasterxml.jackson.core:jackson-core:2.15.2=classpath
+com.fasterxml.jackson.core:jackson-databind:2.15.2=classpath
+com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.15.2=classpath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.15.2=classpath
+com.fasterxml.jackson:jackson-bom:2.15.2=classpath
+gradle.plugin.org.flywaydb:gradle-plugin-publishing:11.0.1=classpath
+org.flywaydb.flyway:org.flywaydb.flyway.gradle.plugin:11.0.1=classpath
+org.flywaydb:flyway-core:11.0.1=classpath
 empty=

core/gradle.lockfile

@@ -1,179 +1,176 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-aopalliance:aopalliance:1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
+aopalliance:aopalliance:1.0=annotationProcessor,compileClasspath,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 args4j:args4j:2.33=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.charleskorn.kaml:kaml:0.20.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.21=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-joda:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml:classmate:1.7.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.github.ben-manes.caffeine:caffeine:3.2.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.docker-java:docker-java-api:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.docker-java:docker-java-transport-zerodep:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.docker-java:docker-java-transport:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jffi:1.3.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.18.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.18.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.18.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.18.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-joda:2.18.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.18.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml:classmate:1.5.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
+com.github.ben-manes.caffeine:caffeine:3.2.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.docker-java:docker-java-api:3.4.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.docker-java:docker-java-transport-zerodep:3.4.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.docker-java:docker-java-transport:3.4.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jffi:1.3.13=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-a64asm:1.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-constants:0.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-enxio:0.32.19=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-ffi:2.2.18=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-posix:3.1.21=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-unixsocket:0.38.24=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-enxio:0.32.18=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-ffi:2.2.17=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-posix:3.1.20=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-unixsocket:0.38.23=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-x86asm:1.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
+com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.android:annotations:4.1.1.4=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-jackson2:2.0.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.api-client:google-api-client-jackson2:2.7.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-java6:2.1.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-servlet:2.7.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-servlet:2.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api-client:google-api-client:2.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.181.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.181.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.181.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.181.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.44.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.114.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.115.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.14.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.14.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-common-protos:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-common-protos:2.45.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.9.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha:3.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha:3.9.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.181.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.181.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.181.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.181.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.44.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-v2:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-v2:2.44.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-compute-v1:1.82.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.112.2=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.113.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-firestore-v1:3.25.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-firestore-v1:3.26.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-monitoring-v3:3.52.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.114.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.115.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.14.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.14.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-executor-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-spanner-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-spanner-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.141.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.141.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-common-protos:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-iam-v1:1.50.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:api-common:2.57.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-grpc:2.64.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-httpjson:2.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax:2.74.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-admin-directory:directory_v1-rev20260227-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-bigquery:v2-rev20240815-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-servlet:2.7.2=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.api-client:google-api-client:2.7.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.44.1-beta=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.50.0=testCompileClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.11.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.183.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.183.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.51.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.118.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.15.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.85.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.85.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-v1:6.85.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-control-v2:2.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.44.1-beta=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.50.0=testCompileClasspath
+com.google.api.grpc:grpc-google-common-protos:2.50.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.11.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha:3.11.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.183.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.183.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.51.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigtable-v2:2.51.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-compute-v1:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.116.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-firestore-v1:3.30.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-monitoring-v3:3.57.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.118.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.15.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.51.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.59.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:2.59.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta2:2.51.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta2:2.59.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.85.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.85.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-v1:6.85.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-control-v2:2.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.44.1-beta=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.50.0=testCompileClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2:2.51.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2:2.59.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.141.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.149.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.141.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.149.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-common-protos:2.53.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-common-protos:2.54.1=testCompileClasspath
+com.google.api.grpc:proto-google-iam-v1:1.45.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.48.0=compileClasspath,nonprodCompileClasspath
+com.google.api.grpc:proto-google-iam-v1:1.49.1=testCompileClasspath
+com.google.api:api-common:2.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api:api-common:2.46.1=testCompileClasspath
+com.google.api:gax-grpc:2.59.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api:gax-grpc:2.62.0=compileClasspath,nonprodCompileClasspath
+com.google.api:gax-grpc:2.63.1=testCompileClasspath
+com.google.api:gax-httpjson:2.62.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api:gax-httpjson:2.63.1=testCompileClasspath
+com.google.api:gax:2.62.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api:gax:2.63.1=testCompileClasspath
+com.google.apis:google-api-services-admin-directory:directory_v1-rev20250217-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-bigquery:v2-rev20241222-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20240310-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-dataflow:v1b3-rev20260213-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-dns:v1-rev20260219-2.0.0=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-dns:v1-rev20260402-2.0.0=compileClasspath,nonprodCompileClasspath,nonprodRuntimeClasspath
-com.google.apis:google-api-services-drive:v3-rev20260322-2.0.0=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-drive:v3-rev20260405-2.0.0=compileClasspath,nonprodCompileClasspath,nonprodRuntimeClasspath
-com.google.apis:google-api-services-gmail:v1-rev20260112-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-dataflow:v1b3-rev20250310-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-dns:v1-rev20250227-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-drive:v3-rev20250220-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-gmail:v1-rev20240520-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20220614-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240130-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-iam:v2-rev20250502-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-iam:v2-rev20250213-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-monitoring:v3-rev20260129-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-monitoring:v3-rev20250227-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20260213-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sqladmin:v1beta4-rev20251201-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20250312-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20251118-2.0.0=testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-credentials:1.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-oauth2-http:1.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auto.service:auto-service-annotations:1.0.1=nonprodAnnotationProcessor,testAnnotationProcessor
+com.google.apis:google-api-services-sheets:v4-rev20250211-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20250205-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20241206-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20250224-2.0.0=testCompileClasspath
+com.google.auth:google-auth-library-credentials:1.33.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-oauth2-http:1.33.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auto.service:auto-service-annotations:1.0.1=errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.auto.service:auto-service-annotations:1.1.1=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service:1.1.1=annotationProcessor
 com.google.auto.value:auto-value-annotations:1.11.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auto.value:auto-value-annotations:1.9=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.auto.value:auto-value:1.11.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auto.value:auto-value:1.11.1=annotationProcessor,testAnnotationProcessor
-com.google.auto:auto-common:1.2.2=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.cloud.bigdataoss:gcsio:2.2.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.bigdataoss:util:2.2.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auto.value:auto-value-annotations:1.9=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
+com.google.auto.value:auto-value:1.11.0=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.auto:auto-common:1.2.1=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
+com.google.cloud.bigdataoss:gcsio:2.2.26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.bigdataoss:util:2.2.26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.bigtable:bigtable-client-core-config:1.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.datastore:datastore-v1-proto-client:2.21.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.opentelemetry:detector-resources-support:0.31.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud.opentelemetry:detector-resources-support:0.33.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud.datastore:datastore-v1-proto-client:2.25.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.opentelemetry:detector-resources-support:0.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.opentelemetry:exporter-metrics:0.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.opentelemetry:shared-resourcemapping:0.33.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud.sql:jdbc-socket-factory-core:1.28.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.28.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-bigquerystorage:3.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-bigquerystorage:3.9.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-bigtable:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-bigtable:2.44.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-compute:1.82.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.54.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-http:2.54.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-firestore:3.25.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-firestore:3.26.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-monitoring:3.52.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-nio:0.129.0-rc1=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-pubsub:1.132.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-pubsub:1.133.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-pubsublite:1.14.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-pubsublite:1.14.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-secretmanager:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-spanner:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-spanner:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-tasks:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:jdbc-socket-factory-core:1.23.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.23.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-bigquerystorage:3.11.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-bigtable:2.51.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-compute:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.49.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.53.1=testCompileClasspath
+com.google.cloud:google-cloud-core-http:2.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.53.1=testCompileClasspath
+com.google.cloud:google-cloud-core:2.49.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core:2.53.1=testCompileClasspath
+com.google.cloud:google-cloud-firestore:3.30.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-monitoring:3.57.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-nio:0.127.24=testRuntimeClasspath
+com.google.cloud:google-cloud-nio:0.127.33=testCompileClasspath
+com.google.cloud:google-cloud-pubsub:1.136.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-pubsublite:1.15.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-secretmanager:2.51.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-secretmanager:2.59.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.cloud:google-cloud-spanner:6.85.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage-control:2.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage:2.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage:2.50.0=testCompileClasspath
+com.google.cloud:google-cloud-tasks:2.51.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-tasks:2.59.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.cloud:grpc-gcp:1.6.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:libraries-bom:26.48.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.25.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.26.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.30.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.code.gson:gson:2.10.1=soy
 com.google.code.gson:gson:2.12.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.common.html.types:types:1.0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-com.google.dagger:dagger-compiler:2.59.2=annotationProcessor,testAnnotationProcessor
-com.google.dagger:dagger-spi:2.59.2=annotationProcessor,testAnnotationProcessor
-com.google.dagger:dagger:2.59.2=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.devtools.ksp:symbol-processing-api:2.2.20-2.0.3=annotationProcessor,testAnnotationProcessor
-com.google.errorprone:error_prone_annotation:2.48.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
+com.google.dagger:dagger-compiler:2.55=annotationProcessor,testAnnotationProcessor
+com.google.dagger:dagger-spi:2.55=annotationProcessor,testAnnotationProcessor
+com.google.dagger:dagger:2.55=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.devtools.ksp:symbol-processing-api:2.0.21-1.0.28=annotationProcessor,testAnnotationProcessor
+com.google.errorprone:error_prone_annotation:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.20.0=soy
-com.google.errorprone:error_prone_annotations:2.36.0=checkstyle
-com.google.errorprone:error_prone_annotations:2.48.0=annotationProcessor,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.errorprone:error_prone_check_api:2.48.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.errorprone:error_prone_core:2.48.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
+com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
+com.google.errorprone:error_prone_annotations:2.36.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.7.1=checkstyle
+com.google.errorprone:error_prone_check_api:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
+com.google.errorprone:error_prone_core:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
+com.google.errorprone:error_prone_type_annotations:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
+com.google.errorprone:javac-shaded:9-dev-r4023-3=annotationProcessor,testAnnotationProcessor
+com.google.errorprone:javac:9+181-r4173-1=errorproneJavac
 com.google.escapevelocity:escapevelocity:1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.google.flatbuffers:flatbuffers-java:23.5.26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flogger:flogger-system-backend:0.7.4=soy
@@ -182,27 +179,31 @@ com.google.flogger:flogger:0.7.4=soy
 com.google.flogger:flogger:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flogger:google-extensions:0.7.4=soy
 com.google.flogger:google-extensions:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.googlejavaformat:google-java-format:1.34.1=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.guava:failureaccess:1.0.1=soy
-com.google.guava:failureaccess:1.0.3=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.guava:guava-parent:32.1.1-jre=soy
+com.google.googlejavaformat:google-java-format:1.5=annotationProcessor,testAnnotationProcessor
+com.google.guava:failureaccess:1.0.1=checkstyle,errorprone,nonprodAnnotationProcessor,soy
+com.google.guava:failureaccess:1.0.2=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava-parent:32.1.1-jre=errorprone,nonprodAnnotationProcessor,soy
 com.google.guava:guava-testlib:33.3.0-jre=testRuntimeClasspath
-com.google.guava:guava-testlib:33.5.0-jre=testCompileClasspath
-com.google.guava:guava:32.1.1-jre=soy
-com.google.guava:guava:33.4.8-jre=checkstyle
-com.google.guava:guava:33.5.0-jre=annotationProcessor,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava-testlib:33.4.0-jre=testCompileClasspath
+com.google.guava:guava:31.0.1-jre=checkstyle
+com.google.guava:guava:32.1.1-jre=errorprone,nonprodAnnotationProcessor,soy
+com.google.guava:guava:33.0.0-jre=annotationProcessor,testAnnotationProcessor
+com.google.guava:guava:33.4.0-jre=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-appengine:1.46.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-gson:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-jackson2:1.46.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-protobuf:1.44.2=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.http-client:google-http-client-protobuf:1.45.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.45.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.46.3=testCompileClasspath
+com.google.http-client:google-http-client-appengine:1.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-appengine:1.46.3=testCompileClasspath
+com.google.http-client:google-http-client-gson:1.46.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-jackson2:1.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-jackson2:1.46.3=testCompileClasspath
+com.google.http-client:google-http-client-protobuf:1.45.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client:1.46.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.inject:guice:5.1.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.inject:guice:7.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-com.google.j2objc:j2objc-annotations:3.0.0=checkstyle
-com.google.j2objc:j2objc-annotations:3.1=annotationProcessor,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.j2objc:j2objc-annotations:1.3=checkstyle
+com.google.j2objc:j2objc-annotations:3.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.jsinterop:jsinterop-annotations:1.0.1=soy
 com.google.jsinterop:jsinterop-annotations:2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.monitoring-client:contrib:1.0.7=testCompileClasspath,testRuntimeClasspath
@@ -214,20 +215,20 @@ com.google.oauth-client:google-oauth-client-jetty:1.36.0=deploy_jar,nonprodRunti
 com.google.oauth-client:google-oauth-client-jetty:1.39.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.oauth-client:google-oauth-client-servlet:1.36.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.oauth-client:google-oauth-client-servlet:1.39.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.oauth-client:google-oauth-client:1.39.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.protobuf:protobuf-java-util:4.33.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.protobuf:protobuf-java-util:4.34.1=testCompileClasspath,testRuntimeClasspath
+com.google.oauth-client:google-oauth-client:1.37.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.oauth-client:google-oauth-client:1.39.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.protobuf:protobuf-java-util:4.29.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.protobuf:protobuf-java:3.19.6=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.protobuf:protobuf-java:3.21.7=soy
-com.google.protobuf:protobuf-java:4.33.2=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.protobuf:protobuf-java:4.34.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.protobuf:protobuf-java:3.25.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.re2j:re2j:1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.template:soy:2024-02-26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-com.google.truth:truth:1.4.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.truth:truth:1.4.4=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.googlecode.json-simple:json-simple:1.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.ibm.icu:icu4j:73.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.jcraft:jsch:0.1.55=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.lmax:disruptor:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.puppycrawl.tools:checkstyle:10.24.0=checkstyle
+com.puppycrawl.tools:checkstyle:9.3=checkstyle
 com.squareup.okhttp3:okhttp:4.12.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.squareup.okio:okio-bom:3.0.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.squareup.okio:okio-fakefilesystem-jvm:3.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -248,19 +249,19 @@ com.squareup:javapoet:1.13.0=annotationProcessor,compileClasspath,deploy_jar,non
 com.squareup:kotlinpoet-jvm:1.15.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.squareup:kotlinpoet:1.11.0=annotationProcessor,testAnnotationProcessor
 com.squareup:kotlinpoet:1.15.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.sun.istack:istack-commons-runtime:4.1.2=deploy_jar,jaxb,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.sun.istack:istack-commons-runtime:4.1.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.sun.istack:istack-commons-runtime:4.1.2=jaxb
 com.sun.istack:istack-commons-tools:4.1.2=jaxb
-com.sun.xml.bind.external:relaxng-datatype:4.0.7=jaxb
-com.sun.xml.bind.external:rngom:4.0.7=jaxb
+com.sun.xml.bind.external:relaxng-datatype:4.0.5=jaxb
+com.sun.xml.bind.external:rngom:4.0.5=jaxb
 com.sun.xml.dtd-parser:dtd-parser:1.5.1=jaxb
-com.zaxxer:HikariCP:7.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-commons-beanutils:commons-beanutils:1.10.1=checkstyle
-commons-codec:commons-codec:1.15=checkstyle
-commons-codec:commons-codec:1.19.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.zaxxer:HikariCP:6.2.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+commons-beanutils:commons-beanutils:1.9.4=checkstyle
+commons-codec:commons-codec:1.18.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 commons-collections:commons-collections:3.2.2=checkstyle
-commons-io:commons-io:2.20.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+commons-io:commons-io:2.18.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 commons-logging:commons-logging:1.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-dnsjava:dnsjava:3.6.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+dnsjava:dnsjava:3.6.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 guru.nidi.com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0=testRuntimeClasspath
 guru.nidi.com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0=testRuntimeClasspath
 guru.nidi.com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0=testRuntimeClasspath
@@ -268,59 +269,55 @@ guru.nidi.com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0=testRuntimeClasspath
 guru.nidi.com.kitfox:svgSalamander:1.1.3=testRuntimeClasspath
 guru.nidi:graphviz-java-all-j2v8:0.18.1=testRuntimeClasspath
 guru.nidi:graphviz-java:0.18.1=testRuntimeClasspath
-info.picocli:picocli:4.7.7=checkstyle
+info.picocli:picocli:4.6.2=checkstyle
 io.apicurio:apicurio-registry-protobuf-schema-utilities:3.0.0.M2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.github.classgraph:classgraph:4.8.162=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.github.eisop:dataflow-errorprone:3.41.0-eisop1=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-io.github.java-diff-utils:java-diff-utils:4.16=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-alts:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.70.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-api:1.71.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-auth:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-census:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-census:1.68.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.71.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-core:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-googleapis:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-grpclb:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-inprocess:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-netty-shaded:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-netty:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-netty:1.68.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-opentelemetry:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf-lite:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-rls:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-services:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-services:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-stub:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-util:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-util:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-xds:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-xds:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-buffer:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-buffer:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-codec-http2:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-codec-http2:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-codec-http:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-codec-http:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.github.eisop:dataflow-errorprone:3.34.0-eisop1=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
+io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
+io.github.java-diff-utils:java-diff-utils:4.15=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-alts:1.69.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-alts:1.70.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-api:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-auth:1.69.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-auth:1.70.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-census:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-core:1.69.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-core:1.70.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-googleapis:1.69.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-grpclb:1.69.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-grpclb:1.70.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-inprocess:1.69.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-inprocess:1.70.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-netty-shaded:1.69.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-netty-shaded:1.70.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-netty:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-opentelemetry:1.67.1=compileClasspath,nonprodCompileClasspath
+io.grpc:grpc-opentelemetry:1.68.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-opentelemetry:1.70.0=testCompileClasspath
+io.grpc:grpc-protobuf-lite:1.67.1=compileClasspath,nonprodCompileClasspath
+io.grpc:grpc-protobuf-lite:1.69.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf:1.69.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf:1.70.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-rls:1.69.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-services:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-stub:1.69.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-stub:1.70.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-util:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-xds:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-buffer:4.1.110.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-http2:4.1.110.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-http:4.1.110.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-codec-socks:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-codec:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-codec:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-common:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-common:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.netty:netty-codec:4.1.110.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-common:4.1.110.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-handler-proxy:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-handler:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-handler:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-resolver:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-resolver:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.netty:netty-handler:4.1.110.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-resolver:4.1.110.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-tcnative-boringssl-static:2.0.52.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-tcnative-classes:2.0.52.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-transport-native-unix-common:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-transport-native-unix-common:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-transport:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-transport:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.netty:netty-transport-native-unix-common:4.1.110.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-transport:4.1.110.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-api:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-contrib-exemplar-util:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-contrib-grpc-metrics:0.31.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
@@ -332,181 +329,175 @@ io.opencensus:opencensus-exporter-metrics-util:0.31.0=compileClasspath,deploy_ja
 io.opencensus:opencensus-exporter-stats-stackdriver:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-impl-core:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-impl:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-proto:0.2.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.opentelemetry.contrib:opentelemetry-gcp-resources:1.37.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.instrumentation:opentelemetry-grpc-1.6:2.1.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.instrumentation:opentelemetry-instrumentation-api-incubator:2.1.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.instrumentation:opentelemetry-instrumentation-api:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opentelemetry.semconv:opentelemetry-semconv:1.29.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-api-incubator:1.42.1-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-api:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-api:1.59.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry.semconv:opentelemetry-semconv:1.27.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry.semconv:opentelemetry-semconv:1.28.0-alpha=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-api-incubator:1.45.0-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-api-incubator:1.46.0-alpha=testRuntimeClasspath
+io.opentelemetry:opentelemetry-api:1.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-api:1.46.0=testRuntimeClasspath
+io.opentelemetry:opentelemetry-api:1.47.0=testCompileClasspath
 io.opentelemetry:opentelemetry-bom:1.42.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-common:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-context:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-context:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-exporter-logging:1.59.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-context:1.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-context:1.46.0=testRuntimeClasspath
+io.opentelemetry:opentelemetry-context:1.47.0=testCompileClasspath
+io.opentelemetry:opentelemetry-exporter-logging:1.46.0=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-extension-incubator:1.35.0-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-common:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-common:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-logs:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-logs:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-metrics:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-metrics:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-trace:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-trace:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-semconv:1.26.0-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-common:1.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-common:1.46.0=testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-common:1.47.0=testCompileClasspath
+io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.42.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.46.0=testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.47.0=testCompileClasspath
+io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:1.46.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-logs:1.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-logs:1.46.0=testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-logs:1.47.0=testCompileClasspath
+io.opentelemetry:opentelemetry-sdk-metrics:1.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-metrics:1.46.0=testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-metrics:1.47.0=testCompileClasspath
+io.opentelemetry:opentelemetry-sdk-trace:1.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-trace:1.46.0=testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-trace:1.47.0=testCompileClasspath
+io.opentelemetry:opentelemetry-sdk:1.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk:1.46.0=testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk:1.47.0=testCompileClasspath
+io.opentelemetry:opentelemetry-semconv:1.26.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.outfoxx:swiftpoet:1.3.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.perfmark:perfmark-api:0.27.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.smallrye:jandex:3.1.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 jakarta-regexp:jakarta-regexp:1.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-jakarta.activation:jakarta.activation-api:2.1.4=jaxb
-jakarta.activation:jakarta.activation-api:2.2.0-M1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+jakarta.activation:jakarta.activation-api:2.1.3=compileClasspath,deploy_jar,jaxb,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 jakarta.inject:jakarta.inject-api:2.0.1=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-jakarta.mail:jakarta.mail-api:2.2.0-M1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+jakarta.mail:jakarta.mail-api:2.1.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 jakarta.persistence:jakarta.persistence-api:3.2.0=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-jakarta.servlet:jakarta.servlet-api:6.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+jakarta.servlet:jakarta.servlet-api:6.0.0=testCompileClasspath,testRuntimeClasspath
+jakarta.servlet:jakarta.servlet-api:6.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 jakarta.transaction:jakarta.transaction-api:2.0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-jakarta.xml.bind:jakarta.xml.bind-api:4.0.4=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-jakarta.xml.bind:jakarta.xml.bind-api:4.0.5=compileClasspath,jaxb,nonprodCompileClasspath,testCompileClasspath
+jakarta.xml.bind:jakarta.xml.bind-api:4.0.2=compileClasspath,deploy_jar,jaxb,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 javax.annotation:javax.annotation-api:1.3.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 javax.annotation:jsr250-api:1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-javax.inject:javax.inject:1=annotationProcessor,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+javax.inject:javax.inject:1=annotationProcessor,compileClasspath,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 javax.jdo:jdo2-api:2.3-20090302111651=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 javax.validation:validation-api:1.0.0.GA=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 joda-time:joda-time:2.12.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 junit:junit:4.13.2=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.arnx:nashorn-promise:0.1.1=testRuntimeClasspath
-net.bytebuddy:byte-buddy-agent:1.17.7=testCompileClasspath,testRuntimeClasspath
+net.bytebuddy:byte-buddy-agent:1.15.11=testCompileClasspath,testRuntimeClasspath
 net.bytebuddy:byte-buddy:1.14.12=compileClasspath,nonprodCompileClasspath
-net.bytebuddy:byte-buddy:1.17.8=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-net.bytebuddy:byte-buddy:1.18.5=testCompileClasspath,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.14.15=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testRuntimeClasspath
 net.java.dev.jna:jna:5.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.ltgt.gradle.incap:incap:0.2=annotationProcessor,testAnnotationProcessor
-net.sf.saxon:Saxon-HE:12.5=checkstyle
+net.sf.saxon:Saxon-HE:10.6=checkstyle
 org.abego.treelayout:org.abego.treelayout.core:1.0.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.antlr:ST4:4.3.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.antlr:antlr-runtime:3.5.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.antlr:antlr4-runtime:4.13.2=checkstyle,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.antlr:antlr4-runtime:4.13.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.antlr:antlr4-runtime:4.9.3=checkstyle
 org.antlr:antlr4:4.13.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.arrow:arrow-format:15.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.arrow:arrow-memory-core:15.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.arrow:arrow-vector:15.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.avro:avro:1.12.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-fn-execution:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-job-management:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-pipeline:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.avro:avro:1.11.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-fn-execution:2.63.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-job-management:2.63.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-pipeline:2.63.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-runners-core-construction-java:2.54.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-core-java:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-direct-java:2.60.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-java-fn-execution:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-core:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-expansion-service:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-arrow:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-avro:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-core-java:2.63.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-direct-java:2.63.0=testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.63.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-java-fn-execution:2.63.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-core:2.63.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-expansion-service:2.63.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-arrow:2.63.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-avro:2.63.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.63.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.63.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-sdks-java-fn-execution:2.54.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-harness:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-transform-service-launcher:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-vendor-grpc-1_60_1:0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-harness:2.63.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.63.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-transform-service-launcher:2.63.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-vendor-grpc-1_60_1:0.1=testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-vendor-grpc-1_69_0:0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-vendor-guava-32_1_2-jre:0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-compress:1.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-csv:1.14.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-exec:1.3=testRuntimeClasspath
-org.apache.commons:commons-lang3:3.18.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-org.apache.commons:commons-lang3:3.20.0=testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-lang3:3.8.1=checkstyle
-org.apache.commons:commons-text:1.15.0=testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-text:1.3=checkstyle
+org.apache.commons:commons-compress:1.26.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-csv:1.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-exec:1.4.0=testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-lang3:3.14.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+org.apache.commons:commons-lang3:3.17.0=testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-text:1.13.0=testCompileClasspath,testRuntimeClasspath
 org.apache.ftpserver:ftplet-api:1.2.1=testCompileClasspath,testRuntimeClasspath
 org.apache.ftpserver:ftpserver-core:1.2.1=testCompileClasspath,testRuntimeClasspath
-org.apache.httpcomponents.client5:httpclient5:5.1.3=checkstyle
-org.apache.httpcomponents.core5:httpcore5-h2:5.1.3=checkstyle
-org.apache.httpcomponents.core5:httpcore5:5.1.3=checkstyle
-org.apache.httpcomponents:httpclient:4.5.13=checkstyle
 org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.httpcomponents:httpcore:4.4.14=checkstyle
 org.apache.httpcomponents:httpcore:4.4.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.maven.doxia:doxia-core:1.12.0=checkstyle
-org.apache.maven.doxia:doxia-logging-api:1.12.0=checkstyle
-org.apache.maven.doxia:doxia-module-xdoc:1.12.0=checkstyle
-org.apache.maven.doxia:doxia-sink-api:1.12.0=checkstyle
 org.apache.mina:mina-core:2.2.4=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-common:3.0.0-M2=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-core:3.0.0-M2=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-scp:3.0.0-M2=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-sftp:3.0.0-M2=testCompileClasspath,testRuntimeClasspath
-org.apache.tomcat:tomcat-annotations-api:11.0.20=testCompileClasspath,testRuntimeClasspath
-org.apache.xbean:xbean-reflect:3.7=checkstyle
+org.apache.sshd:sshd-common:2.15.0=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-core:2.15.0=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-scp:2.15.0=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-sftp:2.15.0=testCompileClasspath,testRuntimeClasspath
+org.apache.tomcat:tomcat-annotations-api:11.0.5=testCompileClasspath,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
-org.bouncycastle:bcpg-jdk18on:1.83=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcpkix-jdk18on:1.83=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcprov-jdk18on:1.83=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcutil-jdk18on:1.83=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.checkerframework:checker-compat-qual:2.5.3=annotationProcessor,compileClasspath,nonprodCompileClasspath,soy,testAnnotationProcessor,testCompileClasspath
+org.bouncycastle:bcpg-jdk18on:1.80=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpkix-jdk18on:1.80=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcprov-jdk18on:1.80=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcutil-jdk18on:1.80=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.checkerframework:checker-compat-qual:2.5.3=compileClasspath,nonprodCompileClasspath,soy,testCompileClasspath
+org.checkerframework:checker-compat-qual:2.5.5=annotationProcessor,testAnnotationProcessor
 org.checkerframework:checker-compat-qual:2.5.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.checkerframework:checker-qual:3.19.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-org.checkerframework:checker-qual:3.33.0=soy
-org.checkerframework:checker-qual:3.49.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-org.checkerframework:checker-qual:3.49.3=checkstyle
-org.checkerframework:checker-qual:3.52.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+org.checkerframework:checker-qual:3.12.0=checkstyle
+org.checkerframework:checker-qual:3.33.0=errorprone,nonprodAnnotationProcessor,soy
+org.checkerframework:checker-qual:3.41.0=annotationProcessor,testAnnotationProcessor
+org.checkerframework:checker-qual:3.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.codehaus.mojo:animal-sniffer-annotations:1.24=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.codehaus.plexus:plexus-classworlds:2.6.0=checkstyle
-org.codehaus.plexus:plexus-component-annotations:2.1.0=checkstyle
-org.codehaus.plexus:plexus-container-default:2.1.0=checkstyle
-org.codehaus.plexus:plexus-utils:3.3.0=checkstyle
 org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.eclipse.angus:angus-activation:2.0.3=jaxb
-org.eclipse.angus:angus-activation:2.1.0-M1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.eclipse.angus:jakarta.mail:2.1.0-M1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+org.eclipse.angus:angus-activation:2.0.2=deploy_jar,jaxb,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+org.eclipse.angus:jakarta.mail:2.0.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.eclipse.collections:eclipse-collections-api:11.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.collections:eclipse-collections:11.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee10:jetty-ee10-servlet:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee10:jetty-ee10-webapp:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee:jetty-ee-webapp:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-http:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-io:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-security:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-server:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-session:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-util:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-xml:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-core:12.3.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-database-postgresql:12.3.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.glassfish.jaxb:codemodel:4.0.7=jaxb
-org.glassfish.jaxb:jaxb-core:4.0.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.glassfish.jaxb:jaxb-core:4.0.7=jaxb
-org.glassfish.jaxb:jaxb-runtime:4.0.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.glassfish.jaxb:jaxb-runtime:4.0.7=jaxb
-org.glassfish.jaxb:jaxb-xjc:4.0.7=jaxb
-org.glassfish.jaxb:txw2:4.0.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.glassfish.jaxb:txw2:4.0.7=jaxb
-org.glassfish.jaxb:xsom:4.0.7=jaxb
+org.eclipse.jetty.ee10:jetty-ee10-servlet:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.ee10:jetty-ee10-webapp:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-ee:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-http:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-io:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-security:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-server:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-session:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-xml:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-core:11.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-database-postgresql:11.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.glassfish.jaxb:codemodel:4.0.5=jaxb
+org.glassfish.jaxb:jaxb-core:4.0.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+org.glassfish.jaxb:jaxb-core:4.0.5=jaxb
+org.glassfish.jaxb:jaxb-runtime:4.0.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+org.glassfish.jaxb:jaxb-runtime:4.0.5=jaxb
+org.glassfish.jaxb:jaxb-xjc:4.0.5=jaxb
+org.glassfish.jaxb:txw2:4.0.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+org.glassfish.jaxb:txw2:4.0.5=jaxb
+org.glassfish.jaxb:xsom:4.0.5=jaxb
 org.gwtproject:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.hamcrest:hamcrest-core:1.3=nonprodCompileClasspath,nonprodRuntimeClasspath
 org.hamcrest:hamcrest-core:3.0=testCompileClasspath,testRuntimeClasspath
 org.hamcrest:hamcrest-library:3.0=testCompileClasspath,testRuntimeClasspath
 org.hamcrest:hamcrest:2.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 org.hamcrest:hamcrest:3.0=testCompileClasspath,testRuntimeClasspath
-org.hibernate.models:hibernate-models:1.0.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.hibernate.orm:hibernate-ant:7.2.7.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.hibernate.orm:hibernate-core:7.2.7.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.hibernate.orm:hibernate-hikaricp:7.2.7.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jacoco:org.jacoco.agent:0.8.14=jacocoAgent,jacocoAnt
-org.jacoco:org.jacoco.ant:0.8.14=jacocoAnt
-org.jacoco:org.jacoco.core:0.8.14=jacocoAnt
-org.jacoco:org.jacoco.report:0.8.14=jacocoAnt
+org.hibernate.common:hibernate-commons-annotations:6.0.6.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+org.hibernate.orm:hibernate-ant:6.5.3.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.hibernate.orm:hibernate-core:6.5.3.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.hibernate.orm:hibernate-hikaricp:6.5.3.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jacoco:org.jacoco.agent:0.8.12=jacocoAgent,jacocoAnt
+org.jacoco:org.jacoco.ant:0.8.12=jacocoAnt
+org.jacoco:org.jacoco.core:0.8.12=jacocoAnt
+org.jacoco:org.jacoco.report:0.8.12=jacocoAnt
 org.javassist:javassist:3.28.0-GA=checkstyle
-org.jboss.logging:jboss-logging:3.6.1.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+org.jboss.logging:jboss-logging:3.5.0.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.jcommander:jcommander:2.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-bom:1.4.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-metadata-jvm:2.2.20=annotationProcessor,testAnnotationProcessor
 org.jetbrains.kotlin:kotlin-reflect:1.6.10=annotationProcessor,testAnnotationProcessor
 org.jetbrains.kotlin:kotlin-reflect:1.9.20=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib-common:1.9.20=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -515,7 +506,7 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.10=compileClasspath,deploy_jar,nonpr
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.8.0=annotationProcessor,testAnnotationProcessor
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.10=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib:1.9.20=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-stdlib:2.2.20=annotationProcessor,testAnnotationProcessor
+org.jetbrains.kotlin:kotlin-stdlib:2.0.21=annotationProcessor,testAnnotationProcessor
 org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.5.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-coroutines-core:1.5.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-datetime-jvm:0.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -524,96 +515,87 @@ org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.0.1=deploy_jar,nonprodRun
 org.jetbrains.kotlinx:kotlinx-serialization-core:1.0.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.jetbrains:annotations:13.0=annotationProcessor,testAnnotationProcessor
 org.jetbrains:annotations:17.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jline:jline:3.30.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.joda:joda-money:2.0.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jline:jline:3.29.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.joda:joda-money:2.0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.json:json:20230618=soy
-org.json:json:20240303=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jsoup:jsoup:1.22.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jspecify:jspecify:1.0.0=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+org.json:json:20250107=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jsoup:jsoup:1.19.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jspecify:jspecify:1.0.0=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 org.junit-pioneer:junit-pioneer:2.3.0=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.13.4=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-engine:5.13.4=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-migrationsupport:5.13.4=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-params:5.13.4=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.14.3=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-engine:1.14.3=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-launcher:1.14.3=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-runner:1.13.3=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-suite-api:1.14.3=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-suite-commons:1.14.3=testRuntimeClasspath
-org.junit:junit-bom:5.14.3=testCompileClasspath,testRuntimeClasspath
-org.mockito:mockito-core:5.23.0=testCompileClasspath,testRuntimeClasspath
-org.mockito:mockito-junit-jupiter:5.23.0=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-api:5.12.1=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-engine:5.12.1=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-migrationsupport:5.12.1=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-params:5.12.1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.12.1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-engine:1.12.1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-launcher:1.12.1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-runner:1.12.1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-suite-api:1.12.1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-suite-commons:1.12.1=testRuntimeClasspath
+org.junit:junit-bom:5.12.1=testCompileClasspath,testRuntimeClasspath
+org.mockito:mockito-core:5.16.0=testCompileClasspath,testRuntimeClasspath
+org.mockito:mockito-junit-jupiter:5.16.0=testCompileClasspath,testRuntimeClasspath
 org.objenesis:objenesis:3.3=testRuntimeClasspath
 org.ogce:xpp3:1.1.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm-analysis:9.5=soy
 org.ow2.asm:asm-analysis:9.7.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm-commons:9.5=soy
+org.ow2.asm:asm-commons:9.7=jacocoAnt
 org.ow2.asm:asm-commons:9.7.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.ow2.asm:asm-commons:9.9=jacocoAnt
 org.ow2.asm:asm-tree:9.5=soy
+org.ow2.asm:asm-tree:9.7=jacocoAnt
 org.ow2.asm:asm-tree:9.7.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.ow2.asm:asm-tree:9.9=jacocoAnt
 org.ow2.asm:asm-util:9.5=soy
 org.ow2.asm:asm-util:9.7.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm:9.5=soy
-org.ow2.asm:asm:9.7.1=compileClasspath,nonprodCompileClasspath
-org.ow2.asm:asm:9.8=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.ow2.asm:asm:9.9=jacocoAnt
-org.pcollections:pcollections:4.0.1=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-org.postgresql:postgresql:42.7.10=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.ow2.asm:asm:9.7=jacocoAnt
+org.ow2.asm:asm:9.7.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.pcollections:pcollections:3.1.4=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
+org.postgresql:postgresql:42.7.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.reflections:reflections:0.10.2=checkstyle
 org.rnorth.duct-tape:duct-tape:1.0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-api:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-chrome-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-chromium-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v143:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v144:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v145:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-edge-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-firefox-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-http:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-ie-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-java:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-json:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-manager:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-os:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-remote-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-safari-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-support:4.41.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-api:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-chrome-driver:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-chromium-driver:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v131:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v132:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v133:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v85:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-edge-driver:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-firefox-driver:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-http:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-ie-driver:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-java:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-json:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-manager:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-os:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-remote-driver:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-safari-driver:4.29.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-support:4.29.0=testCompileClasspath,testRuntimeClasspath
 org.slf4j:jcl-over-slf4j:1.7.36=testCompileClasspath,testRuntimeClasspath
 org.slf4j:jul-to-slf4j:1.7.30=testRuntimeClasspath
-org.slf4j:slf4j-api:2.0.17=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.slf4j:slf4j-jdk14:2.0.17=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.slf4j:slf4j-api:2.0.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.slf4j:slf4j-jdk14:2.0.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.snakeyaml:snakeyaml-engine:2.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.testcontainers:database-commons:1.21.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:jdbc:1.21.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:junit-jupiter:1.21.4=testCompileClasspath,testRuntimeClasspath
-org.testcontainers:postgresql:1.21.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:selenium:1.21.4=testCompileClasspath,testRuntimeClasspath
-org.testcontainers:testcontainers:1.21.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:database-commons:1.20.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:jdbc:1.20.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:junit-jupiter:1.20.6=testCompileClasspath,testRuntimeClasspath
+org.testcontainers:postgresql:1.20.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:selenium:1.20.6=testCompileClasspath,testRuntimeClasspath
+org.testcontainers:testcontainers:1.20.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.threeten:threetenbp:1.7.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.w3c.css:sac:1.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.webjars.npm:viz.js-graphviz-java:2.1.3=testRuntimeClasspath
 org.xerial.snappy:snappy-java:1.1.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.xmlresolver:xmlresolver:5.2.2=checkstyle
-org.yaml:snakeyaml:2.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-tools.jackson.core:jackson-core:3.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-tools.jackson.core:jackson-databind:3.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-tools.jackson:jackson-bom:3.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-api:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-diagram:17.10.0=compileClasspath,nonprodCompileClasspath,nonprodRuntimeClasspath
-us.fatehi:schemacrawler-diagram:17.9.0=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-operations:17.10.0=compileClasspath,nonprodCompileClasspath,nonprodRuntimeClasspath
-us.fatehi:schemacrawler-operations:17.9.0=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-postgresql:17.10.0=compileClasspath,nonprodCompileClasspath,nonprodRuntimeClasspath
-us.fatehi:schemacrawler-postgresql:17.9.0=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-text:17.10.0=compileClasspath,nonprodCompileClasspath,nonprodRuntimeClasspath
-us.fatehi:schemacrawler-text:17.9.0=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-tools:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-utility:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler:17.10.0=compileClasspath,nonprodCompileClasspath,nonprodRuntimeClasspath
-us.fatehi:schemacrawler:17.9.0=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.yaml:snakeyaml:2.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-api:16.25.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-diagram:16.25.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-loader:16.25.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-postgresql:16.25.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-text:16.25.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-tools:16.25.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-utility:16.25.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler:16.25.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 xerces:xmlParserAPIs:2.6.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-empty=devtool,shadow
+empty=devtool,nomulus_test

core/src/main/java/google/registry/batch/BatchModule.java

@@ -28,20 +28,11 @@ import static google.registry.request.RequestParameters.extractRequiredDatetimeP
 import static google.registry.request.RequestParameters.extractRequiredParameter;
 import static google.registry.request.RequestParameters.extractSetOfDatetimeParameters;
 
-import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
-import com.google.common.util.concurrent.RateLimiter;
-import com.google.gson.Gson;
-import com.google.gson.JsonElement;
-import com.google.gson.reflect.TypeToken;
 import dagger.Module;
 import dagger.Provides;
-import google.registry.request.HttpException.BadRequestException;
-import google.registry.request.OptionalJsonPayload;
 import google.registry.request.Parameter;
-import jakarta.inject.Named;
 import jakarta.servlet.http.HttpServletRequest;
-import java.util.List;
 import java.util.Optional;
 import org.joda.time.DateTime;
 
@@ -51,8 +42,6 @@ public class BatchModule {
 
   public static final String PARAM_FAST = "fast";
 
-  static final int DEFAULT_MAX_QPS = 10;
-
   @Provides
   @Parameter("url")
   static String provideUrl(HttpServletRequest req) {
@@ -131,6 +120,12 @@ public class BatchModule {
     return extractOptionalDatetimeParameter(req, ExpandBillingRecurrencesAction.PARAM_END_TIME);
   }
 
+  @Provides
+  @Parameter(WipeOutContactHistoryPiiAction.PARAM_CUTOFF_TIME)
+  static Optional<DateTime> provideCutoffTime(HttpServletRequest req) {
+    return extractOptionalDatetimeParameter(req, WipeOutContactHistoryPiiAction.PARAM_CUTOFF_TIME);
+  }
+
   @Provides
   @Parameter(ExpandBillingRecurrencesAction.PARAM_ADVANCE_CURSOR)
   static boolean provideAdvanceCursor(HttpServletRequest req) {
@@ -142,50 +137,4 @@ public class BatchModule {
   static boolean provideIsFast(HttpServletRequest req) {
     return extractBooleanParameter(req, PARAM_FAST);
   }
-
-  @Provides
-  @Parameter("maxQps")
-  static int provideMaxQps(HttpServletRequest req) {
-    return extractOptionalIntParameter(req, "maxQps").orElse(DEFAULT_MAX_QPS);
-  }
-
-  @Provides
-  @Named("standardRateLimiter")
-  static RateLimiter provideStandardRateLimiter(@Parameter("maxQps") int maxQps) {
-    return RateLimiter.create(maxQps);
-  }
-
-  @Provides
-  @Parameter("gainingRegistrarId")
-  static String provideGainingRegistrarId(HttpServletRequest req) {
-    return extractRequiredParameter(req, "gainingRegistrarId");
-  }
-
-  @Provides
-  @Parameter("losingRegistrarId")
-  static String provideLosingRegistrarId(HttpServletRequest req) {
-    return extractRequiredParameter(req, "losingRegistrarId");
-  }
-
-  @Provides
-  @Parameter("bulkTransferDomainNames")
-  static ImmutableList<String> provideBulkTransferDomainNames(
-      Gson gson, @OptionalJsonPayload Optional<JsonElement> optionalJsonElement) {
-    return optionalJsonElement
-        .map(je -> ImmutableList.copyOf(gson.fromJson(je, new TypeToken<List<String>>() {})))
-        .orElseThrow(
-            () -> new BadRequestException("Missing POST body of bulk transfer domain names"));
-  }
-
-  @Provides
-  @Parameter("requestedByRegistrar")
-  static boolean provideRequestedByRegistrar(HttpServletRequest req) {
-    return extractBooleanParameter(req, "requestedByRegistrar");
-  }
-
-  @Provides
-  @Parameter("reason")
-  static String provideReason(HttpServletRequest req) {
-    return extractRequiredParameter(req, "reason");
-  }
 }

core/src/main/java/google/registry/batch/BulkDomainTransferAction.java

@@ -1,242 +0,0 @@
-// Copyright 2025 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.batch;
-
-import static com.google.common.net.MediaType.PLAIN_TEXT_UTF_8;
-import static google.registry.flows.FlowUtils.marshalWithLenientRetry;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.util.DateTimeUtils.END_INSTANT;
-import static jakarta.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
-import static jakarta.servlet.http.HttpServletResponse.SC_NO_CONTENT;
-import static jakarta.servlet.http.HttpServletResponse.SC_OK;
-import static java.nio.charset.StandardCharsets.US_ASCII;
-
-import com.google.common.collect.ImmutableList;
-import com.google.common.flogger.FluentLogger;
-import com.google.common.util.concurrent.RateLimiter;
-import google.registry.flows.EppController;
-import google.registry.flows.EppRequestSource;
-import google.registry.flows.PasswordOnlyTransportCredentials;
-import google.registry.flows.StatelessRequestSessionMetadata;
-import google.registry.model.ForeignKeyUtils;
-import google.registry.model.domain.Domain;
-import google.registry.model.eppcommon.ProtocolDefinition;
-import google.registry.model.eppcommon.StatusValue;
-import google.registry.model.eppoutput.EppOutput;
-import google.registry.request.Action;
-import google.registry.request.Parameter;
-import google.registry.request.Response;
-import google.registry.request.auth.Auth;
-import google.registry.request.lock.LockHandler;
-import jakarta.inject.Inject;
-import jakarta.inject.Named;
-import java.util.Optional;
-import java.util.concurrent.Callable;
-import java.util.logging.Level;
-import org.joda.time.Duration;
-
-/**
- * An action that transfers a set of domains from one registrar to another.
- *
- * <p>This should be used as part of the BTAPPA (Bulk Transfer After a Partial Portfolio
- * Acquisition) process in order to transfer a (possibly large) list of domains from one registrar
- * to another, though it may be used in other situations as well.
- *
- * <p>The body of the HTTP post request should be a JSON list of the domains to be transferred.
- * Because the list of domains to process can be quite large, this action should be called by a tool
- * that batches the list of domains into reasonable sizes if necessary. The recommended usage path
- * is to call this through the {@link google.registry.tools.BulkDomainTransferCommand}, which
- * handles batching and input handling.
- *
- * <p>This runs as a single-threaded idempotent action that runs a superuser domain transfer on each
- * domain to process. We go through the standard EPP process to make sure that we have an accurate
- * historical representation of events (rather than force-modifying the domains in place).
- *
- * <p>Consider passing in an "maxQps" parameter based on the number of domains being transferred,
- * otherwise the default is {@link BatchModule#DEFAULT_MAX_QPS}.
- */
-@Action(
-    service = Action.Service.BACKEND,
-    path = BulkDomainTransferAction.PATH,
-    method = Action.Method.POST,
-    auth = Auth.AUTH_ADMIN)
-public class BulkDomainTransferAction implements Runnable {
-
-  public static final String PATH = "/_dr/task/bulkDomainTransfer";
-
-  private static final String SUPERUSER_TRANSFER_XML_FORMAT =
-"""
-<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
-  <command>
-    <transfer op="request">
-      <domain:transfer xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
-        <domain:name>%DOMAIN_NAME%</domain:name>
-      </domain:transfer>
-    </transfer>
-    <extension>
-      <superuser:domainTransferRequest xmlns:superuser="urn:google:params:xml:ns:superuser-1.0">
-        <superuser:renewalPeriod unit="y">0</superuser:renewalPeriod>
-        <superuser:automaticTransferLength>0</superuser:automaticTransferLength>
-      </superuser:domainTransferRequest>
-      <metadata:metadata xmlns:metadata="urn:google:params:xml:ns:metadata-1.0">
-        <metadata:reason>%REASON%</metadata:reason>
-        <metadata:requestedByRegistrar>%REQUESTED_BY_REGISTRAR%</metadata:requestedByRegistrar>
-      </metadata:metadata>
-    </extension>
-    <clTRID>BulkDomainTransferAction</clTRID>
-  </command>
-</epp>
-""";
-
-  private static final String LOCK_NAME = "Domain bulk transfer";
-
-  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
-
-  private final EppController eppController;
-  private final LockHandler lockHandler;
-  private final RateLimiter rateLimiter;
-  private final ImmutableList<String> bulkTransferDomainNames;
-  private final String gainingRegistrarId;
-  private final String losingRegistrarId;
-  private final boolean requestedByRegistrar;
-  private final String reason;
-  private final Response response;
-
-  private int successes = 0;
-  private int alreadyTransferred = 0;
-  private int pendingDelete = 0;
-  private int missingDomains = 0;
-  private int errors = 0;
-
-  @Inject
-  BulkDomainTransferAction(
-      EppController eppController,
-      LockHandler lockHandler,
-      @Named("standardRateLimiter") RateLimiter rateLimiter,
-      @Parameter("bulkTransferDomainNames") ImmutableList<String> bulkTransferDomainNames,
-      @Parameter("gainingRegistrarId") String gainingRegistrarId,
-      @Parameter("losingRegistrarId") String losingRegistrarId,
-      @Parameter("requestedByRegistrar") boolean requestedByRegistrar,
-      @Parameter("reason") String reason,
-      Response response) {
-    this.eppController = eppController;
-    this.lockHandler = lockHandler;
-    this.rateLimiter = rateLimiter;
-    this.bulkTransferDomainNames = bulkTransferDomainNames;
-    this.gainingRegistrarId = gainingRegistrarId;
-    this.losingRegistrarId = losingRegistrarId;
-    this.requestedByRegistrar = requestedByRegistrar;
-    this.reason = reason;
-    this.response = response;
-  }
-
-  @Override
-  public void run() {
-    response.setContentType(PLAIN_TEXT_UTF_8);
-    Callable<Void> runner =
-        () -> {
-          try {
-            runLocked();
-            response.setStatus(SC_OK);
-          } catch (Exception e) {
-            logger.atSevere().withCause(e).log("Errored out during execution.");
-            response.setStatus(SC_INTERNAL_SERVER_ERROR);
-            response.setPayload(String.format("Errored out with cause: %s", e));
-          }
-          return null;
-        };
-
-    if (!lockHandler.executeWithLocks(runner, null, Duration.standardHours(1), LOCK_NAME)) {
-      // Send a 200-series status code to prevent this conflicting action from retrying.
-      response.setStatus(SC_NO_CONTENT);
-      response.setPayload("Could not acquire lock; already running?");
-    }
-  }
-
-  private void runLocked() {
-    logger.atInfo().log("Attempting to transfer %d domains.", bulkTransferDomainNames.size());
-    for (String domainName : bulkTransferDomainNames) {
-      rateLimiter.acquire();
-      tm().transact(() -> runTransferFlowInTransaction(domainName));
-    }
-
-    String msg =
-        String.format(
-            "Finished; %d domains were successfully transferred, %d were previously transferred, %s"
-                + " were missing domains, %s are pending delete, and %d errored out.",
-            successes, alreadyTransferred, missingDomains, pendingDelete, errors);
-    logger.at(errors + missingDomains == 0 ? Level.INFO : Level.WARNING).log(msg);
-    response.setPayload(msg);
-  }
-
-  private void runTransferFlowInTransaction(String domainName) {
-    if (shouldSkipDomain(domainName)) {
-      return;
-    }
-    String xml =
-        SUPERUSER_TRANSFER_XML_FORMAT
-            .replace("%DOMAIN_NAME%", domainName)
-            .replace("%REASON%", reason)
-            .replace("%REQUESTED_BY_REGISTRAR%", String.valueOf(requestedByRegistrar));
-    EppOutput output =
-        eppController.handleEppCommand(
-            new StatelessRequestSessionMetadata(
-                gainingRegistrarId, ProtocolDefinition.getVisibleServiceExtensionUris()),
-            new PasswordOnlyTransportCredentials(),
-            EppRequestSource.TOOL,
-            false,
-            true,
-            xml.getBytes(US_ASCII));
-    if (output.isSuccess()) {
-      logger.atInfo().log("Successfully transferred domain '%s'.", domainName);
-      successes++;
-    } else {
-      logger.atWarning().log(
-          "Failed transferring domain '%s' with error '%s'.",
-          domainName, new String(marshalWithLenientRetry(output), US_ASCII));
-      errors++;
-    }
-  }
-
-  private boolean shouldSkipDomain(String domainName) {
-    Optional<Domain> maybeDomain =
-        ForeignKeyUtils.loadResource(Domain.class, domainName, tm().getTxTime());
-    if (maybeDomain.isEmpty()) {
-      logger.atWarning().log("Domain '%s' was already deleted", domainName);
-      missingDomains++;
-      return true;
-    }
-    Domain domain = maybeDomain.get();
-    String currentRegistrarId = domain.getCurrentSponsorRegistrarId();
-    if (currentRegistrarId.equals(gainingRegistrarId)) {
-      logger.atInfo().log("Domain '%s' was already transferred", domainName);
-      alreadyTransferred++;
-      return true;
-    }
-    if (!currentRegistrarId.equals(losingRegistrarId)) {
-      logger.atWarning().log(
-          "Domain '%s' had unexpected registrar '%s'", domainName, currentRegistrarId);
-      errors++;
-      return true;
-    }
-    if (domain.getStatusValues().contains(StatusValue.PENDING_DELETE)
-        || !domain.getDeletionTime().equals(END_INSTANT)) {
-      logger.atWarning().log("Domain '%s' is in PENDING_DELETE", domainName);
-      pendingDelete++;
-      return true;
-    }
-    return false;
-  }
-}

core/src/main/java/google/registry/batch/CannedScriptExecutionAction.java

@@ -20,6 +20,7 @@ import static java.nio.charset.StandardCharsets.UTF_8;
 
 import com.google.common.flogger.FluentLogger;
 import google.registry.request.Action;
+import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.UrlConnectionService;
@@ -42,7 +43,7 @@ import javax.net.ssl.HttpsURLConnection;
  * --service BACKEND -X POST -u '/_dr/task/executeCannedScript}'}
  */
 @Action(
-    service = Action.Service.BACKEND,
+    service = GaeService.BACKEND,
     path = "/_dr/task/executeCannedScript",
     method = {POST, GET},
     automaticallyPrintOk = true,

core/src/main/java/google/registry/batch/CheckBulkComplianceAction.java

@@ -27,6 +27,7 @@ import google.registry.model.domain.token.AllocationToken;
 import google.registry.model.domain.token.BulkPricingPackage;
 import google.registry.model.registrar.Registrar;
 import google.registry.request.Action;
+import google.registry.request.Action.GaeService;
 import google.registry.request.auth.Auth;
 import google.registry.ui.server.SendEmailUtils;
 import google.registry.util.Clock;
@@ -38,10 +39,7 @@ import org.joda.time.Days;
  * An action that checks all {@link BulkPricingPackage} objects for compliance with their max create
  * limit.
  */
-@Action(
-    service = Action.Service.BACKEND,
-    path = CheckBulkComplianceAction.PATH,
-    auth = Auth.AUTH_ADMIN)
+@Action(service = GaeService.BACKEND, path = CheckBulkComplianceAction.PATH, auth = Auth.AUTH_ADMIN)
 public class CheckBulkComplianceAction implements Runnable {
 
   public static final String PATH = "/_dr/task/checkBulkCompliance";
@@ -104,14 +102,15 @@ public class CheckBulkComplianceAction implements Runnable {
         bulkPricingPackagesOverActiveDomainsLimitBuilder = new ImmutableMap.Builder<>();
     for (BulkPricingPackage bulkPricingPackage : bulkPricingPackages) {
       Long creates =
-          tm().query(
-                  "SELECT COUNT(*) FROM DomainHistory WHERE resource.currentBulkToken ="
-                      + " :token AND modificationTime >= :lastBilling AND type ="
-                      + " 'DOMAIN_CREATE'",
-                  Long.class)
-              .setParameter("token", bulkPricingPackage.getToken())
-              .setParameter("lastBilling", bulkPricingPackage.getNextBillingDate().minusYears(1))
-              .getSingleResult();
+          (Long)
+              tm().query(
+                      "SELECT COUNT(*) FROM DomainHistory WHERE resource.currentBulkToken ="
+                          + " :token AND modificationTime >= :lastBilling AND type ="
+                          + " 'DOMAIN_CREATE'")
+                  .setParameter("token", bulkPricingPackage.getToken())
+                  .setParameter(
+                      "lastBilling", bulkPricingPackage.getNextBillingDate().minusYears(1))
+                  .getSingleResult();
       if (creates > bulkPricingPackage.getMaxCreates()) {
         long overage = creates - bulkPricingPackage.getMaxCreates();
         logger.atInfo().log(

core/src/main/java/google/registry/batch/CloudTasksUtils.java

@@ -43,6 +43,7 @@ import google.registry.config.CredentialModule.ApplicationDefaultCredential;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.request.Action;
 import google.registry.request.Action.Method;
+import google.registry.request.Action.Service;
 import google.registry.util.Clock;
 import google.registry.util.CollectionUtils;
 import google.registry.util.GoogleCredentialsBundle;
@@ -55,6 +56,8 @@ import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.Optional;
 import java.util.Random;
+import java.util.function.BiConsumer;
+import java.util.function.Consumer;
 import java.util.function.Supplier;
 import org.joda.time.Duration;
 
@@ -116,13 +119,19 @@ public class CloudTasksUtils implements Serializable {
    * <p>For GET requests we add them on to the URL, and for POST requests we add them in the body of
    * the request.
    *
+   * <p>The parameters {@code putHeadersFunction} and {@code setBodyFunction} are used so that this
+   * method can be called with either an AppEngine HTTP request or a standard non-AppEngine HTTP
+   * request. The two objects do not have the same methods, but both have ways of setting headers /
+   * body.
+   *
    * @return the resulting path (unchanged for POST requests, with params added for GET requests)
    */
   private static String processRequestParameters(
       String path,
       Method method,
       Multimap<String, String> params,
-      HttpRequest.Builder requestBuilder) {
+      BiConsumer<String, String> putHeadersFunction,
+      Consumer<ByteString> setBodyFunction) {
     if (CollectionUtils.isNullOrEmpty(params)) {
       return path;
     }
@@ -140,8 +149,8 @@ public class CloudTasksUtils implements Serializable {
     if (method.equals(Method.GET)) {
       return String.format("%s?%s", path, encodedParams);
     }
-    requestBuilder.putHeaders(HttpHeaders.CONTENT_TYPE, MediaType.FORM_DATA.toString());
-    requestBuilder.setBody(ByteString.copyFrom(encodedParams, StandardCharsets.UTF_8));
+    putHeadersFunction.accept(HttpHeaders.CONTENT_TYPE, MediaType.FORM_DATA.toString());
+    setBodyFunction.accept(ByteString.copyFrom(encodedParams, StandardCharsets.UTF_8));
     return path;
   }
 
@@ -152,26 +161,29 @@ public class CloudTasksUtils implements Serializable {
    * default service account as the principal. That account must have permission to submit tasks to
    * Cloud Tasks.
    *
-   * <p>The caller of this method is responsible for passing in the appropriate service. Use the
-   * overload that takes an action class if possible.
+   * <p>The caller of this method is responsible for passing in the appropriate service based on the
+   * runtime (GAE/GKE). Use the overload that takes an action class if possible.
    *
    * @param path the relative URI (staring with a slash and ending without one).
    * @param method the HTTP method to be used for the request.
-   * @param service the service to route the request to.
+   * @param service the GAE/GKE service to route the request to.
    * @param params a multimap of URL query parameters. Duplicate keys are saved as is, and it is up
    *     to the server to process the duplicate keys.
    * @return the enqueued task.
-   * @see <a href=https://docs.cloud.google.com/tasks/docs/creating-http-target-tasks#java>Creating
-   *     HTTP target tasks</a>
+   * @see <a
+   *     href=ttps://cloud.google.com/appengine/docs/standard/java/taskqueue/push/creating-tasks#target>Specifyinig
+   *     the worker service</a>
    */
   protected Task createTask(
-      String path, Method method, Action.Service service, Multimap<String, String> params) {
+      String path, Method method, Service service, Multimap<String, String> params) {
     checkArgument(
         path != null && !path.isEmpty() && path.charAt(0) == '/',
         "The path must start with a '/'.");
     HttpRequest.Builder requestBuilder =
         HttpRequest.newBuilder().setHttpMethod(HttpMethod.valueOf(method.name()));
-    path = processRequestParameters(path, method, params, requestBuilder);
+    path =
+        processRequestParameters(
+            path, method, params, requestBuilder::putHeaders, requestBuilder::setBody);
     OidcToken.Builder oidcTokenBuilder =
         OidcToken.newBuilder()
             .setServiceAccountEmail(credential.serviceAccount())
@@ -193,15 +205,16 @@ public class CloudTasksUtils implements Serializable {
    * Cloud Tasks.
    *
    * <p>Prefer this overload over the one where the path and service are explicitly defined, as this
-   * class will automatically determine the service to use based on the action.
+   * class will automatically determine the service to use based on the action and the runtime.
    *
    * @param actionClazz the action class to run, must be annotated with {@link Action}.
    * @param method the HTTP method to be used for the request.
    * @param params a multimap of URL query parameters. Duplicate keys are saved as is, and it is up
    *     to the server to process the duplicate keys.
    * @return the enqueued task.
-   * @see <a href=https://docs.cloud.google.com/tasks/docs/creating-http-target-tasks#java>Creating
-   *     HTTP target tasks</a>
+   * @see <a
+   *     href=ttps://cloud.google.com/appengine/docs/standard/java/taskqueue/push/creating-tasks#target>Specifyinig
+   *     the worker service</a>
    */
   public Task createTask(
       Class<? extends Runnable> actionClazz, Method method, Multimap<String, String> params) {
@@ -218,29 +231,32 @@ public class CloudTasksUtils implements Serializable {
         method,
         actionClazz.getSimpleName(),
         allowedMethods);
-    return createTask(path, method, action.service(), params);
+    Service service =
+        RegistryEnvironment.isOnJetty() ? Action.ServiceGetter.get(action) : action.service();
+    return createTask(path, method, service, params);
   }
 
   /**
    * Create a {@link Task} to be enqueued with a random delay up to {@code jitterSeconds}.
    *
-   * <p>The caller of this method is responsible for passing in the appropriate service. Use the
-   * overload that takes an action class if possible.
+   * <p>The caller of this method is responsible for passing in the appropriate service based on the
+   * runtime (GAE/GKE). Use the overload that takes an action class if possible.
    *
    * @param path the relative URI (staring with a slash and ending without one).
    * @param method the HTTP method to be used for the request.
-   * @param service the service to route the request to.
+   * @param service the GAE/GKE service to route the request to.
    * @param params a multimap of URL query parameters. Duplicate keys are saved as is, and it is up
    *     to the server to process the duplicate keys.
    * @param jitterSeconds the number of seconds that a task is randomly delayed up to.
    * @return the enqueued task.
-   * @see <a href=https://docs.cloud.google.com/tasks/docs/creating-http-target-tasks#java>Creating
-   *     HTTP target tasks</a>
+   * @see <a
+   *     href=ttps://cloud.google.com/appengine/docs/standard/java/taskqueue/push/creating-tasks#target>Specifyinig
+   *     the worker service</a>
    */
   public Task createTaskWithJitter(
       String path,
       Method method,
-      Action.Service service,
+      Service service,
       Multimap<String, String> params,
       Optional<Integer> jitterSeconds) {
     if (jitterSeconds.isEmpty() || jitterSeconds.get() <= 0) {
@@ -258,7 +274,7 @@ public class CloudTasksUtils implements Serializable {
    * Create a {@link Task} to be enqueued with a random delay up to {@code jitterSeconds}.
    *
    * <p>Prefer this overload over the one where the path and service are explicitly defined, as this
-   * class will automatically determine the service to use based on the action.
+   * class will automatically determine the service to use based on the action and the runtime.
    *
    * @param actionClazz the action class to run, must be annotated with {@link Action}.
    * @param method the HTTP method to be used for the request.
@@ -266,8 +282,9 @@ public class CloudTasksUtils implements Serializable {
    *     to the server to process the duplicate keys.
    * @param jitterSeconds the number of seconds that a task is randomly delayed up to.
    * @return the enqueued task.
-   * @see <a href=https://docs.cloud.google.com/tasks/docs/creating-http-target-tasks#java>Creating
-   *     HTTP target tasks</a>
+   * @see <a
+   *     href=ttps://cloud.google.com/appengine/docs/standard/java/taskqueue/push/creating-tasks#target>Specifyinig
+   *     the worker service</a>
    */
   public Task createTaskWithJitter(
       Class<? extends Runnable> actionClazz,
@@ -280,7 +297,9 @@ public class CloudTasksUtils implements Serializable {
         "Action class %s is not annotated with @Action",
         actionClazz.getSimpleName());
     String path = action.path();
-    return createTaskWithJitter(path, method, action.service(), params, jitterSeconds);
+    Service service =
+        RegistryEnvironment.isOnJetty() ? Action.ServiceGetter.get(action) : action.service();
+    return createTaskWithJitter(path, method, service, params, jitterSeconds);
   }
 
   /**
@@ -288,18 +307,19 @@ public class CloudTasksUtils implements Serializable {
    *
    * @param path the relative URI (staring with a slash and ending without one).
    * @param method the HTTP method to be used for the request.
-   * @param service the service to route the request to.
+   * @param service the GAE/GKE service to route the request to.
    * @param params a multimap of URL query parameters. Duplicate keys are saved as is, and it is up
    *     to the server to process the duplicate keys.
    * @param delay the amount of time that a task needs to be delayed for.
    * @return the enqueued task.
-   * @see <a href=https://docs.cloud.google.com/tasks/docs/creating-http-target-tasks#java>Creating
-   *     HTTP target tasks</a>
+   * @see <a
+   *     href=ttps://cloud.google.com/appengine/docs/standard/java/taskqueue/push/creating-tasks#target>Specifyinig
+   *     the worker service</a>
    */
   private Task createTaskWithDelay(
       String path,
       Method method,
-      Action.Service service,
+      Service service,
       Multimap<String, String> params,
       Duration delay) {
     if (delay.isEqual(Duration.ZERO)) {
@@ -315,7 +335,7 @@ public class CloudTasksUtils implements Serializable {
    * Create a {@link Task} to be enqueued with delay of {@code duration}.
    *
    * <p>Prefer this overload over the one where the path and service are explicitly defined, as this
-   * class will automatically determine the service to use based on the action.
+   * class will automatically determine the service to use based on the action and the runtime.
    *
    * @param actionClazz the action class to run, must be annotated with {@link Action}.
    * @param method the HTTP method to be used for the request.
@@ -323,8 +343,9 @@ public class CloudTasksUtils implements Serializable {
    *     to the server to process the duplicate keys.
    * @param delay the amount of time that a task needs to be delayed for.
    * @return the enqueued task.
-   * @see <a href=https://docs.cloud.google.com/tasks/docs/creating-http-target-tasks#java>Creating
-   *     HTTP target tasks</a>
+   * @see <a
+   *     href=ttps://cloud.google.com/appengine/docs/standard/java/taskqueue/push/creating-tasks#target>Specifyinig
+   *     the worker service</a>
    */
   public Task createTaskWithDelay(
       Class<? extends Runnable> actionClazz,
@@ -333,7 +354,9 @@ public class CloudTasksUtils implements Serializable {
       Duration delay) {
     Action action = getAction(actionClazz);
     String path = action.path();
-    return createTaskWithDelay(path, method, action.service(), params, delay);
+    Service service =
+        RegistryEnvironment.isOnJetty() ? Action.ServiceGetter.get(action) : action.service();
+    return createTaskWithDelay(path, method, service, params, delay);
   }
 
   private static Action getAction(Class<? extends Runnable> actionClazz) {

core/src/main/java/google/registry/batch/DeleteExpiredDomainsAction.java

@@ -18,7 +18,6 @@ import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.net.MediaType.PLAIN_TEXT_UTF_8;
 import static google.registry.flows.FlowUtils.marshalWithLenientRetry;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.util.DateTimeUtils.END_INSTANT;
 import static google.registry.util.DateTimeUtils.END_OF_TIME;
 import static google.registry.util.ResourceUtils.readResourceUtf8;
 import static jakarta.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
@@ -38,6 +37,7 @@ import google.registry.model.eppcommon.ProtocolDefinition;
 import google.registry.model.eppoutput.EppOutput;
 import google.registry.persistence.transaction.QueryComposer.Comparator;
 import google.registry.request.Action;
+import google.registry.request.Action.GaeService;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import google.registry.request.lock.LockHandler;
@@ -68,7 +68,7 @@ import org.joda.time.Duration;
  * this action runs, thus alerting us that human action is needed to correctly process the delete.
  */
 @Action(
-    service = Action.Service.BACKEND,
+    service = GaeService.BACKEND,
     path = DeleteExpiredDomainsAction.PATH,
     auth = Auth.AUTH_ADMIN)
 public class DeleteExpiredDomainsAction implements Runnable {
@@ -178,7 +178,7 @@ public class DeleteExpiredDomainsAction implements Runnable {
                         "Failed to delete domain %s because of its autorenew end time: %s.",
                         transDomain.getDomainName(), transDomain.getAutorenewEndTime());
                     return Optional.empty();
-                  } else if (domain.getDeletionTime().isBefore(END_INSTANT)) {
+                  } else if (domain.getDeletionTime().isBefore(END_OF_TIME)) {
                     logger.atSevere().log(
                         "Failed to delete domain %s because it was already deleted on %s.",
                         transDomain.getDomainName(), transDomain.getDeletionTime());

core/src/main/java/google/registry/batch/DeleteLoadTestDataAction.java

@@ -29,6 +29,7 @@ import com.google.common.flogger.FluentLogger;
 import google.registry.flows.poll.PollFlowUtils;
 import google.registry.model.EppResource;
 import google.registry.model.EppResourceUtils;
+import google.registry.model.contact.Contact;
 import google.registry.model.domain.Domain;
 import google.registry.model.host.Host;
 import google.registry.model.poll.PollMessage;
@@ -36,6 +37,7 @@ import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.reporting.HistoryEntryDao;
 import google.registry.persistence.VKey;
 import google.registry.request.Action;
+import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.auth.Auth;
 import google.registry.util.Clock;
@@ -53,7 +55,7 @@ import jakarta.inject.Inject;
  * production.
  */
 @Action(
-    service = Action.Service.BACKEND,
+    service = GaeService.BACKEND,
     path = "/_dr/task/deleteLoadTestData",
     method = POST,
     auth = Auth.AUTH_ADMIN)
@@ -93,6 +95,7 @@ public class DeleteLoadTestDataAction implements Runnable {
             TRANSACTION_REPEATABLE_READ,
             () -> {
               LOAD_TEST_REGISTRARS.forEach(this::deletePollMessages);
+              tm().loadAllOfStream(Contact.class).forEach(this::deleteContact);
               tm().loadAllOfStream(Host.class).forEach(this::deleteHost);
             });
   }
@@ -108,6 +111,21 @@ public class DeleteLoadTestDataAction implements Runnable {
     }
   }
 
+  private void deleteContact(Contact contact) {
+    if (!LOAD_TEST_REGISTRARS.contains(contact.getPersistedCurrentSponsorRegistrarId())) {
+      return;
+    }
+    // We cannot remove contacts from domains in the general case, so we cannot delete contacts
+    // that are linked to domains (since it would break the foreign keys)
+    if (EppResourceUtils.isLinked(contact.createVKey(), clock.nowUtc())) {
+      logger.atWarning().log(
+          "Cannot delete contact with repo ID %s since it is referenced from a domain.",
+          contact.getRepoId());
+      return;
+    }
+    deleteResource(contact);
+  }
+
   private void deleteHost(Host host) {
     if (!LOAD_TEST_REGISTRARS.contains(host.getPersistedCurrentSponsorRegistrarId())) {
       return;

core/src/main/java/google/registry/batch/DeleteProberDataAction.java

@@ -28,6 +28,7 @@ import static google.registry.request.RequestParameters.PARAM_BATCH_SIZE;
 import static google.registry.request.RequestParameters.PARAM_DRY_RUN;
 import static google.registry.request.RequestParameters.PARAM_TLDS;
 import static google.registry.util.RegistryEnvironment.PRODUCTION;
+import static org.joda.time.DateTimeZone.UTC;
 
 import com.google.common.base.Strings;
 import com.google.common.collect.ImmutableList;
@@ -41,9 +42,9 @@ import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.tld.Tld.TldType;
 import google.registry.request.Action;
+import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.auth.Auth;
-import google.registry.util.Clock;
 import google.registry.util.RegistryEnvironment;
 import jakarta.inject.Inject;
 import jakarta.persistence.TypedQuery;
@@ -58,7 +59,7 @@ import org.joda.time.Duration;
  * billing events, along with their ForeignKeyDomainIndex entities.
  */
 @Action(
-    service = Action.Service.BACKEND,
+    service = GaeService.BACKEND,
     path = "/_dr/task/deleteProberData",
     method = POST,
     auth = Auth.AUTH_ADMIN)
@@ -111,20 +112,16 @@ public class DeleteProberDataAction implements Runnable {
 
   String registryAdminRegistrarId;
 
-  private final Clock clock;
-
   @Inject
   DeleteProberDataAction(
       @Parameter(PARAM_DRY_RUN) boolean isDryRun,
       @Parameter(PARAM_TLDS) ImmutableSet<String> tlds,
       @Parameter(PARAM_BATCH_SIZE) Optional<Integer> batchSize,
-      @Config("registryAdminClientId") String registryAdminRegistrarId,
-      Clock clock) {
+      @Config("registryAdminClientId") String registryAdminRegistrarId) {
     this.isDryRun = isDryRun;
     this.tlds = tlds;
     this.batchSize = batchSize.orElse(DEFAULT_BATCH_SIZE);
     this.registryAdminRegistrarId = registryAdminRegistrarId;
-    this.clock = clock;
   }
 
   @Override
@@ -149,7 +146,7 @@ public class DeleteProberDataAction implements Runnable {
     AtomicInteger softDeletedDomains = new AtomicInteger();
     AtomicInteger hardDeletedDomains = new AtomicInteger();
     AtomicReference<ImmutableList<Domain>> domainsBatch = new AtomicReference<>();
-    DateTime startTime = clock.nowUtc();
+    DateTime startTime = DateTime.now(UTC);
     do {
       tm().transact(
               TRANSACTION_REPEATABLE_READ,
@@ -168,7 +165,7 @@ public class DeleteProberDataAction implements Runnable {
           hardDeletedDomains.get(), batchSize);
 
       // Automatically kill the job if it is running for over 20 hours
-    } while (clock.nowUtc().isBefore(startTime.plusHours(20))
+    } while (DateTime.now(UTC).isBefore(startTime.plusHours(20))
         && domainsBatch.get().size() == batchSize);
     logger.atInfo().log(
         "%s %d domains.",

core/src/main/java/google/registry/batch/ExpandBillingRecurrencesAction.java

@@ -35,6 +35,7 @@ import google.registry.model.billing.BillingEvent;
 import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.common.Cursor;
 import google.registry.request.Action;
+import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
@@ -50,7 +51,7 @@ import org.joda.time.DateTime;
  * BillingRecurrence} billing events into synthetic {@link BillingEvent} events.
  */
 @Action(
-    service = Action.Service.BACKEND,
+    service = GaeService.BACKEND,
     path = "/_dr/task/expandBillingRecurrences",
     auth = Auth.AUTH_ADMIN)
 public class ExpandBillingRecurrencesAction implements Runnable {

core/src/main/java/google/registry/batch/RelockDomainAction.java

@@ -15,6 +15,7 @@
 package google.registry.batch;
 
 import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.request.Action.Method.POST;
 import static google.registry.tools.LockOrUnlockDomainCommand.REGISTRY_LOCK_STATUSES;
@@ -29,9 +30,12 @@ import google.registry.groups.GmailClient;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.RegistryLock;
 import google.registry.model.eppcommon.StatusValue;
+import google.registry.model.registrar.Registrar;
+import google.registry.model.registrar.RegistrarPoc;
 import google.registry.model.tld.RegistryLockDao;
 import google.registry.persistence.VKey;
 import google.registry.request.Action;
+import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
@@ -46,7 +50,7 @@ import org.joda.time.Duration;
 
 /** Task that re-locks a previously-Registry-Locked domain after a predetermined period of time. */
 @Action(
-    service = Action.Service.BACKEND,
+    service = GaeService.BACKEND,
     path = RelockDomainAction.PATH,
     method = POST,
     automaticallyPrintOk = true,
@@ -66,14 +70,12 @@ public class RelockDomainAction implements Runnable {
       """
       The domain %s was successfully re-locked.
 
-      Please contact support at %s if you have any questions.\
-      """;
+      Please contact support at %s if you have any questions.""";
   private static final String RELOCK_NON_RETRYABLE_FAILURE_EMAIL_TEMPLATE =
       """
       There was an error when automatically re-locking %s. Error message: %s
 
-      Please contact support at %s if you have any questions.\
-      """;
+      Please contact support at %s if you have any questions.""";
   private static final String RELOCK_TRANSIENT_FAILURE_EMAIL_TEMPLATE =
       "There was an unexpected error when automatically re-locking %s. We will continue retrying "
           + "the lock for five hours. Please contact support at %s if you have any questions";
@@ -112,11 +114,11 @@ public class RelockDomainAction implements Runnable {
   public void run() {
     /* We wish to manually control our retry behavior, in order to limit the number of retries
      * and/or notify registrars / support only after a certain number of retries, or only
-     * with a certain type of failure. Cloud Tasks will automatically retry on any non-2xx status
+     * with a certain type of failure. AppEngine will automatically retry on any non-2xx status
      * code, so return SC_NO_CONTENT (204) by default to avoid this auto-retry.
      *
-     * See https://docs.cloud.google.com/tasks/docs/configuring-queues#retry for more details on
-     * retry behavior. */
+     * See https://cloud.google.com/appengine/docs/standard/java/taskqueue/push/retrying-tasks
+     * for more details on retry behavior. */
     response.setStatus(SC_NO_CONTENT);
     response.setContentType(MediaType.PLAIN_TEXT_UTF_8);
     tm().transact(this::relockDomain);
@@ -169,7 +171,7 @@ public class RelockDomainAction implements Runnable {
     domainLockUtils.administrativelyApplyLock(
         oldLock.getDomainName(),
         oldLock.getRegistrarId(),
-        oldLock.getRegistryLockEmail(),
+        oldLock.getRegistrarPocId(),
         oldLock.isSuperuser());
     logger.atInfo().log("Re-locked domain %s.", oldLock.getDomainName());
     response.setStatus(SC_OK);
@@ -188,7 +190,7 @@ public class RelockDomainAction implements Runnable {
         "Domain %s has a pending delete.",
         domainName);
     checkArgument(
-        !DateTimeUtils.isAtOrAfter(tm().getTxTime(), domain.getDeletionTime()),
+        !DateTimeUtils.isAtOrAfter(tm().getTransactionTime(), domain.getDeletionTime()),
         "Domain %s has been deleted.",
         domainName);
     checkArgument(
@@ -219,7 +221,7 @@ public class RelockDomainAction implements Runnable {
         EmailMessage.newBuilder()
             .setBody(body)
             .setSubject(String.format("Error re-locking domain %s", oldLock.getDomainName()))
-            .setRecipients(ImmutableSet.of(getEmailRecipient(oldLock)))
+            .setRecipients(getEmailRecipients(oldLock.getRegistrarId()))
             .build());
   }
 
@@ -248,7 +250,7 @@ public class RelockDomainAction implements Runnable {
         EmailMessage.newBuilder()
             .setBody(body)
             .setSubject(String.format("Successful re-lock of domain %s", oldLock.getDomainName()))
-            .setRecipients(ImmutableSet.of(getEmailRecipient(oldLock)))
+            .setRecipients(getEmailRecipients(oldLock.getRegistrarId()))
             .build());
   }
 
@@ -259,7 +261,7 @@ public class RelockDomainAction implements Runnable {
     // For an unexpected failure, notify both the lock-enabled contacts and our alerting email
     ImmutableSet<InternetAddress> allRecipients =
         new ImmutableSet.Builder<InternetAddress>()
-            .add(getEmailRecipient(oldLock))
+            .addAll(getEmailRecipients(oldLock.getRegistrarId()))
             .add(alertRecipientAddress)
             .build();
     gmailClient.sendEmail(
@@ -279,12 +281,31 @@ public class RelockDomainAction implements Runnable {
             .build());
   }
 
-  private InternetAddress getEmailRecipient(RegistryLock lock) {
-    try {
-      return new InternetAddress(lock.getRegistryLockEmail());
-    } catch (AddressException e) {
-      // this really shouldn't happen
-      throw new RuntimeException(e);
+  private ImmutableSet<InternetAddress> getEmailRecipients(String registrarId) {
+    Registrar registrar =
+        Registrar.loadByRegistrarIdCached(registrarId)
+            .orElseThrow(
+                () ->
+                    new IllegalStateException(String.format("Unknown registrar %s", registrarId)));
+
+    ImmutableSet<String> registryLockEmailAddresses =
+        registrar.getContacts().stream()
+            .filter(RegistrarPoc::isRegistryLockAllowed)
+            .map(RegistrarPoc::getRegistryLockEmailAddress)
+            .filter(Optional::isPresent)
+            .map(Optional::get)
+            .collect(toImmutableSet());
+
+    ImmutableSet.Builder<InternetAddress> builder = new ImmutableSet.Builder<>();
+    // can't use streams due to the 'throws' in the InternetAddress constructor
+    for (String registryLockEmailAddress : registryLockEmailAddresses) {
+      try {
+        builder.add(new InternetAddress(registryLockEmailAddress));
+      } catch (AddressException e) {
+        // This shouldn't stop any other emails going out, so swallow it
+        logger.atWarning().log("Invalid email address '%s'.", registryLockEmailAddress);
+      }
     }
+    return builder.build();
   }
 }

core/src/main/java/google/registry/batch/ResaveAllEppResourcesPipelineAction.java

@@ -28,6 +28,7 @@ import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.request.Action;
+import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
@@ -53,7 +54,7 @@ import jakarta.inject.Inject;
  * <p>This runs the {@link google.registry.beam.resave.ResaveAllEppResourcesPipeline}.
  */
 @Action(
-    service = Action.Service.BACKEND,
+    service = GaeService.BACKEND,
     path = ResaveAllEppResourcesPipelineAction.PATH,
     auth = Auth.AUTH_ADMIN)
 public class ResaveAllEppResourcesPipelineAction implements Runnable {

core/src/main/java/google/registry/batch/ResaveEntityAction.java

@@ -25,6 +25,7 @@ import com.google.common.flogger.FluentLogger;
 import google.registry.model.EppResource;
 import google.registry.persistence.VKey;
 import google.registry.request.Action;
+import google.registry.request.Action.GaeService;
 import google.registry.request.Action.Method;
 import google.registry.request.Parameter;
 import google.registry.request.Response;
@@ -39,7 +40,7 @@ import org.joda.time.DateTime;
  * <p>{@link EppResource}s will be projected forward to the current time.
  */
 @Action(
-    service = Action.Service.BACKEND,
+    service = GaeService.BACKEND,
     path = ResaveEntityAction.PATH,
     auth = Auth.AUTH_ADMIN,
     method = Method.POST)

core/src/main/java/google/registry/batch/SendExpiringCertificateNotificationEmailAction.java

@@ -19,6 +19,7 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 import static org.apache.http.HttpStatus.SC_INTERNAL_SERVER_ERROR;
 import static org.apache.http.HttpStatus.SC_OK;
+import static org.joda.time.DateTimeZone.UTC;
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableList;
@@ -34,9 +35,9 @@ import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
 import google.registry.model.registrar.RegistrarPoc.Type;
 import google.registry.request.Action;
+import google.registry.request.Action.GaeService;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
-import google.registry.util.Clock;
 import google.registry.util.EmailMessage;
 import jakarta.inject.Inject;
 import jakarta.mail.internet.AddressException;
@@ -49,7 +50,7 @@ import org.joda.time.format.DateTimeFormatter;
 
 /** An action that sends notification emails to registrars whose certificates are expiring soon. */
 @Action(
-    service = Action.Service.BACKEND,
+    service = GaeService.BACKEND,
     path = SendExpiringCertificateNotificationEmailAction.PATH,
     auth = Auth.AUTH_ADMIN)
 public class SendExpiringCertificateNotificationEmailAction implements Runnable {
@@ -73,7 +74,6 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
   private final GmailClient gmailClient;
   private final String expirationWarningEmailSubjectText;
   private final Response response;
-  private final Clock clock;
 
   @Inject
   public SendExpiringCertificateNotificationEmailAction(
@@ -81,14 +81,12 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
       @Config("expirationWarningEmailSubjectText") String expirationWarningEmailSubjectText,
       GmailClient gmailClient,
       CertificateChecker certificateChecker,
-      Response response,
-      Clock clock) {
+      Response response) {
     this.certificateChecker = certificateChecker;
     this.expirationWarningEmailSubjectText = expirationWarningEmailSubjectText;
     this.gmailClient = gmailClient;
     this.expirationWarningEmailBodyText = expirationWarningEmailBodyText;
     this.response = response;
-    this.clock = clock;
   }
 
   @Override
@@ -189,7 +187,7 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
        */
       updateLastNotificationSentDate(
           registrar,
-          clock.nowUtc().minusMinutes((int) UPDATE_TIME_OFFSET.getStandardMinutes()),
+          DateTime.now(UTC).minusMinutes((int) UPDATE_TIME_OFFSET.getStandardMinutes()),
           certificateType);
       return true;
     } catch (Exception e) {
@@ -277,7 +275,7 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
    */
   @VisibleForTesting
   ImmutableSet<InternetAddress> getEmailAddresses(Registrar registrar, Type contactType) {
-    ImmutableSortedSet<RegistrarPoc> contacts = registrar.getPocsOfType(contactType);
+    ImmutableSortedSet<RegistrarPoc> contacts = registrar.getContactsOfType(contactType);
     ImmutableSet.Builder<InternetAddress> recipientEmails = new ImmutableSet.Builder<>();
     for (RegistrarPoc contact : contacts) {
       try {

core/src/main/java/google/registry/batch/WipeOutContactHistoryPiiAction.java

@@ -0,0 +1,143 @@
+// Copyright 2021 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.batch;
+
+import static google.registry.beam.BeamUtils.createJobName;
+import static google.registry.request.RequestParameters.PARAM_DRY_RUN;
+import static jakarta.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
+import static jakarta.servlet.http.HttpServletResponse.SC_OK;
+
+import com.google.api.services.dataflow.Dataflow;
+import com.google.api.services.dataflow.model.LaunchFlexTemplateParameter;
+import com.google.api.services.dataflow.model.LaunchFlexTemplateRequest;
+import com.google.api.services.dataflow.model.LaunchFlexTemplateResponse;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.flogger.FluentLogger;
+import com.google.common.net.MediaType;
+import google.registry.beam.wipeout.WipeOutContactHistoryPiiPipeline;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.model.contact.ContactHistory;
+import google.registry.request.Action;
+import google.registry.request.Action.GaeService;
+import google.registry.request.Parameter;
+import google.registry.request.Response;
+import google.registry.request.auth.Auth;
+import google.registry.util.Clock;
+import google.registry.util.RegistryEnvironment;
+import jakarta.inject.Inject;
+import java.io.IOException;
+import java.util.Optional;
+import org.joda.time.DateTime;
+
+/**
+ * An action that launches {@link WipeOutContactHistoryPiiPipeline} to wipe out Personal
+ * Identifiable Information (PII) fields of {@link ContactHistory} entities.
+ *
+ * <p>{@link ContactHistory} entities should be retained in the database for only certain amount of
+ * time.
+ */
+@Action(
+    service = GaeService.BACKEND,
+    path = WipeOutContactHistoryPiiAction.PATH,
+    auth = Auth.AUTH_ADMIN)
+public class WipeOutContactHistoryPiiAction implements Runnable {
+
+  public static final String PATH = "/_dr/task/wipeOutContactHistoryPii";
+  public static final String PARAM_CUTOFF_TIME = "wipeoutTime";
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+  private static final String PIPELINE_NAME = "wipe_out_contact_history_pii_pipeline";
+
+  private final Clock clock;
+  private final boolean isDryRun;
+  private final Optional<DateTime> maybeCutoffTime;
+  private final int minMonthsBeforeWipeOut;
+  private final String stagingBucketUrl;
+  private final String projectId;
+  private final String jobRegion;
+  private final Dataflow dataflow;
+  private final Response response;
+
+  @Inject
+  public WipeOutContactHistoryPiiAction(
+      Clock clock,
+      @Parameter(PARAM_DRY_RUN) boolean isDryRun,
+      @Parameter(PARAM_CUTOFF_TIME) Optional<DateTime> maybeCutoffTime,
+      @Config("minMonthsBeforeWipeOut") int minMonthsBeforeWipeOut,
+      @Config("beamStagingBucketUrl") String stagingBucketUrl,
+      @Config("projectId") String projectId,
+      @Config("defaultJobRegion") String jobRegion,
+      Dataflow dataflow,
+      Response response) {
+    this.clock = clock;
+    this.isDryRun = isDryRun;
+    this.maybeCutoffTime = maybeCutoffTime;
+    this.minMonthsBeforeWipeOut = minMonthsBeforeWipeOut;
+    this.stagingBucketUrl = stagingBucketUrl;
+    this.projectId = projectId;
+    this.jobRegion = jobRegion;
+    this.dataflow = dataflow;
+    this.response = response;
+  }
+
+  @Override
+  public void run() {
+    response.setContentType(MediaType.PLAIN_TEXT_UTF_8);
+    DateTime cutoffTime =
+        maybeCutoffTime.orElse(clock.nowUtc().minusMonths(minMonthsBeforeWipeOut));
+    LaunchFlexTemplateParameter launchParameter =
+        new LaunchFlexTemplateParameter()
+            .setJobName(
+                createJobName(
+                    String.format(
+                        "contact-history-pii-wipeout-%s",
+                        cutoffTime.toString("yyyy-MM-dd't'HH-mm-ss'z'")),
+                    clock))
+            .setContainerSpecGcsPath(
+                String.format("%s/%s_metadata.json", stagingBucketUrl, PIPELINE_NAME))
+            .setParameters(
+                ImmutableMap.of(
+                    "registryEnvironment",
+                    RegistryEnvironment.get().name(),
+                    "cutoffTime",
+                    cutoffTime.toString("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"),
+                    "isDryRun",
+                    Boolean.toString(isDryRun)));
+    logger.atInfo().log(
+        "Launching Beam pipeline to wipe out all PII of contact history entities prior to %s%s.",
+        cutoffTime, " in dry run mode");
+    try {
+      LaunchFlexTemplateResponse launchResponse =
+          dataflow
+              .projects()
+              .locations()
+              .flexTemplates()
+              .launch(
+                  projectId,
+                  jobRegion,
+                  new LaunchFlexTemplateRequest().setLaunchParameter(launchParameter))
+              .execute();
+      logger.atInfo().log("Got response: %s", launchResponse.getJob().toPrettyString());
+      response.setStatus(SC_OK);
+      response.setPayload(
+          String.format(
+              "Launched contact history PII wipeout pipeline: %s",
+              launchResponse.getJob().getId()));
+    } catch (IOException e) {
+      logger.atWarning().withCause(e).log("Pipeline Launch failed");
+      response.setStatus(SC_INTERNAL_SERVER_ERROR);
+      response.setPayload(String.format("Pipeline launch failed: %s", e.getMessage()));
+    }
+  }
+}

core/src/main/java/google/registry/beam/billing/ExpandBillingRecurrencesPipeline.java

@@ -24,7 +24,6 @@ import static google.registry.util.CollectionUtils.union;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static google.registry.util.DateTimeUtils.earliestOf;
 import static google.registry.util.DateTimeUtils.latestOf;
-import static google.registry.util.DateTimeUtils.toInstant;
 import static org.apache.beam.sdk.values.TypeDescriptors.voids;
 
 import com.google.common.collect.ImmutableMap;
@@ -373,7 +372,7 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
                   // during ARGP).
                   //
                   // See: DomainFlowUtils#createCancellingRecords
-                  domain.getDeletionTime().isBefore(toInstant(billingTime))
+                  domain.getDeletionTime().isBefore(billingTime)
                       ? ImmutableSet.of()
                       : ImmutableSet.of(
                           DomainTransactionRecord.create(

core/src/main/java/google/registry/beam/common/RegistryPipelineWorkerInitializer.java

@@ -40,6 +40,8 @@ public class RegistryPipelineWorkerInitializer implements JvmInitializer {
 
   @Override
   public void beforeProcessing(PipelineOptions options) {
+    // TODO(b/416299900): remove next line after GAE is removed.
+    System.setProperty("google.registry.jetty", "true");
     RegistryPipelineOptions registryOptions = options.as(RegistryPipelineOptions.class);
     RegistryEnvironment environment = registryOptions.getRegistryEnvironment();
     if (environment == null || environment.equals(RegistryEnvironment.UNITTEST)) {

core/src/main/java/google/registry/beam/common/RegistryQuery.java

@@ -19,10 +19,10 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import google.registry.persistence.transaction.JpaTransactionManager;
 import jakarta.persistence.EntityManager;
 import jakarta.persistence.Query;
+import jakarta.persistence.TemporalType;
 import jakarta.persistence.TypedQuery;
 import jakarta.persistence.criteria.CriteriaQuery;
 import java.io.Serializable;
-import java.time.Instant;
 import java.util.Map;
 import java.util.function.Supplier;
 import java.util.stream.Stream;
@@ -61,8 +61,8 @@ public interface RegistryQuery<T> extends Serializable {
       if (parameters != null) {
         parameters.forEach(
             (key, value) -> {
-              if (value instanceof DateTime dt) {
-                query.setParameter(key, Instant.ofEpochMilli(dt.getMillis()));
+              if (value instanceof DateTime) {
+                query.setParameter(key, ((DateTime) value).toDate(), TemporalType.TIMESTAMP);
               } else {
                 query.setParameter(key, value);
               }

core/src/main/java/google/registry/beam/rde/RdePipeline.java

@@ -50,6 +50,8 @@ import google.registry.config.CredentialModule;
 import google.registry.config.RegistryConfig.ConfigModule;
 import google.registry.gcs.GcsUtils;
 import google.registry.model.EppResource;
+import google.registry.model.contact.Contact;
+import google.registry.model.contact.ContactHistory;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.host.Host;
@@ -71,6 +73,7 @@ import jakarta.inject.Inject;
 import jakarta.inject.Singleton;
 import java.io.IOException;
 import java.io.Serializable;
+import java.util.HashSet;
 import org.apache.beam.sdk.Pipeline;
 import org.apache.beam.sdk.PipelineResult;
 import org.apache.beam.sdk.coders.KvCoder;
@@ -135,21 +138,25 @@ import org.joda.time.DateTime;
  * pairs of (contact/host repo ID: pending deposit) for all RDE pending deposits for further
  * processing.
  *
+ * <h3>{@link Contact}</h3>
+ *
+ * We first join most recent contact histories, represented by (contact repo ID: contact history
+ * revision ID) pairs, with referenced contacts, represented by (contact repo ID: pending deposit)
+ * pairs, on the contact repo ID, to remove unreferenced contact histories. Contact resources are
+ * then loaded from the remaining referenced contact histories, and marshalled into (pending
+ * deposit: deposit fragment) pairs.
+ *
  * <h3>{@link Host}</h3>
  *
- * <p>We first join most recent host histories, represented by (host repo ID: host history revision
- * ID) pairs, with referenced hosts, represented by (host repo ID: pending deposit) pairs, on the
- * host repo ID, to remove unreferenced host histories. Host resources are then loaded from the
- * remaining referenced host histories, and marshalled into (pending deposit: deposit fragment)
- * pairs.
- *
- * <p>For subordinate hosts, we need to find the superordinate domain in order to properly handle
- * pending transfer in the deposit as well. So we first find the superordinate domain repo ID from
- * the host and join the (superordinate domain repo ID: (subordinate host repo ID: (pending deposit:
- * revision ID))) pair with the (domain repo ID: revision ID) pair obtained from the domain history
- * query in order to map the host at watermark to the domain at watermark. We then proceed to create
- * the (pending deposit: deposit fragment) pair for subordinate hosts using the added domain
- * information.
+ * Similar to {@link Contact}, we join the most recent host history with referenced hosts to find
+ * most recent referenced hosts. For external hosts we do the same treatment as we did on contacts
+ * and obtain the (pending deposit: deposit fragment) pairs. For subordinate hosts, we need to find
+ * the superordinate domain in order to properly handle pending transfer in the deposit as well. So
+ * we first find the superordinate domain repo ID from the host and join the (superordinate domain
+ * repo ID: (subordinate host repo ID: (pending deposit: revision ID))) pair with the (domain repo
+ * ID: revision ID) pair obtained from the domain history query in order to map the host at
+ * watermark to the domain at watermark. We then proceed to create the (pending deposit: deposit
+ * fragment) pair for subordinate hosts using the added domain information.
  *
  * <h2>Processing {@link DepositFragment}</h2>
  *
@@ -177,10 +184,10 @@ public class RdePipeline implements Serializable {
   private final CloudTasksUtils cloudTasksUtils;
   private final RdeMarshaller marshaller;
 
-  // Registrars to be excluded from data escrow (i.e. all registrar types that have a null IANA
-  // identifier and thus would not be valid according to the RDE schema).
+  // Registrars to be excluded from data escrow. Not including the sandbox-only OTE type so that
+  // if sneaks into production we would get an extra signal.
   private static final ImmutableSet<Type> IGNORED_REGISTRAR_TYPES =
-      Sets.immutableEnumSet(Registrar.Type.MONITORING, Registrar.Type.OTE, Registrar.Type.TEST);
+      Sets.immutableEnumSet(Registrar.Type.MONITORING, Registrar.Type.TEST);
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
@@ -223,6 +230,9 @@ public class RdePipeline implements Serializable {
     PCollection<KV<String, Long>> domainHistories =
         getMostRecentHistoryEntries(pipeline, DomainHistory.class);
 
+    PCollection<KV<String, Long>> contactHistories =
+        getMostRecentHistoryEntries(pipeline, ContactHistory.class);
+
     PCollection<KV<String, Long>> hostHistories =
         getMostRecentHistoryEntries(pipeline, HostHistory.class);
 
@@ -231,6 +241,10 @@ public class RdePipeline implements Serializable {
     PCollection<KV<PendingDeposit, DepositFragment>> domainFragments =
         processedDomainHistories.get(DOMAIN_FRAGMENTS);
 
+    PCollection<KV<PendingDeposit, DepositFragment>> contactFragments =
+        processContactHistories(
+            processedDomainHistories.get(REFERENCED_CONTACTS), contactHistories);
+
     PCollectionTuple processedHosts =
         processHostHistories(processedDomainHistories.get(REFERENCED_HOSTS), hostHistories);
 
@@ -242,6 +256,7 @@ public class RdePipeline implements Serializable {
 
     return PCollectionList.of(registrarFragments)
         .and(domainFragments)
+        .and(contactFragments)
         .and(externalHostFragments)
         .and(subordinateHostFragments)
         .apply(
@@ -422,6 +437,7 @@ public class RdePipeline implements Serializable {
   private PCollectionTuple processDomainHistories(PCollection<KV<String, Long>> domainHistories) {
     Counter activeDomainCounter = Metrics.counter("RDE", "ActiveDomainBase");
     Counter domainFragmentCounter = Metrics.counter("RDE", "DomainFragment");
+    Counter referencedContactCounter = Metrics.counter("RDE", "ReferencedContact");
     Counter referencedHostCounter = Metrics.counter("RDE", "ReferencedHost");
     return domainHistories.apply(
         "Map DomainHistory to DepositFragment " + "and emit referenced Contact and Host",
@@ -447,8 +463,19 @@ public class RdePipeline implements Serializable {
                                       KV.of(
                                           pendingDeposit,
                                           marshaller.marshalDomain(domain, pendingDeposit.mode())));
-                              // Hosts are only deposited in RDE, not BRDA.
+                              // Contacts and hosts are only deposited in RDE, not BRDA.
                               if (pendingDeposit.mode() == RdeMode.FULL) {
+                                HashSet<Serializable> contacts = new HashSet<>();
+                                domain.getAdminContact().ifPresent(c -> contacts.add(c.getKey()));
+                                domain.getTechContact().ifPresent(c -> contacts.add(c.getKey()));
+                                domain.getRegistrant().ifPresent(c -> contacts.add(c.getKey()));
+                                domain.getBillingContact().ifPresent(c -> contacts.add(c.getKey()));
+                                referencedContactCounter.inc(contacts.size());
+                                contacts.forEach(
+                                    contactRepoId ->
+                                        receiver
+                                            .get(REFERENCED_CONTACTS)
+                                            .output(KV.of((String) contactRepoId, pendingDeposit)));
                                 if (domain.getNsHosts() != null) {
                                   referencedHostCounter.inc(domain.getNsHosts().size());
                                   domain
@@ -470,6 +497,38 @@ public class RdePipeline implements Serializable {
                 DOMAIN_FRAGMENTS, TupleTagList.of(REFERENCED_CONTACTS).and(REFERENCED_HOSTS)));
   }
 
+  private PCollection<KV<PendingDeposit, DepositFragment>> processContactHistories(
+      PCollection<KV<String, PendingDeposit>> referencedContacts,
+      PCollection<KV<String, Long>> contactHistories) {
+    Counter contactFragmentCounter = Metrics.counter("RDE", "ContactFragment");
+    return removeUnreferencedResource(referencedContacts, contactHistories, Contact.class)
+        .apply(
+            "Map Contact to DepositFragment",
+            FlatMapElements.into(
+                    kvs(
+                        TypeDescriptor.of(PendingDeposit.class),
+                        TypeDescriptor.of(DepositFragment.class)))
+                .via(
+                    (KV<String, CoGbkResult> kv) -> {
+                      Contact contact =
+                          (Contact)
+                              loadResourceByHistoryEntryId(
+                                  ContactHistory.class,
+                                  kv.getKey(),
+                                  kv.getValue().getAll(REVISION_ID));
+                      DepositFragment fragment = marshaller.marshalContact(contact);
+                      ImmutableSet<KV<PendingDeposit, DepositFragment>> fragments =
+                          Streams.stream(kv.getValue().getAll(PENDING_DEPOSIT))
+                              // The same contact could be used by multiple domains, therefore
+                              // matched to the same pending deposit multiple times.
+                              .distinct()
+                              .map(pendingDeposit -> KV.of(pendingDeposit, fragment))
+                              .collect(toImmutableSet());
+                      contactFragmentCounter.inc(fragments.size());
+                      return fragments;
+                    }));
+  }
+
   private PCollectionTuple processHostHistories(
       PCollection<KV<String, PendingDeposit>> referencedHosts,
       PCollection<KV<String, Long>> hostHistories) {

core/src/main/java/google/registry/beam/resave/ResaveAllEppResourcesPipeline.java

@@ -25,6 +25,7 @@ import com.google.common.collect.Streams;
 import google.registry.beam.common.RegistryJpaIO;
 import google.registry.beam.common.RegistryJpaIO.Read;
 import google.registry.model.EppResource;
+import google.registry.model.contact.Contact;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainBase;
 import google.registry.model.host.Host;
@@ -55,7 +56,7 @@ import org.joda.time.DateTime;
 public class ResaveAllEppResourcesPipeline implements Serializable {
 
   private static final ImmutableSet<Class<? extends EppResource>> EPP_RESOURCE_CLASSES =
-      ImmutableSet.of(Domain.class, Host.class);
+      ImmutableSet.of(Contact.class, Domain.class, Host.class);
 
   /**
    * There exist three possible situations where we know we'll want to project domains to the
@@ -91,12 +92,25 @@ public class ResaveAllEppResourcesPipeline implements Serializable {
 
   void setupPipeline(Pipeline pipeline) {
     if (options.getFast()) {
+      fastResaveContacts(pipeline);
       fastResaveDomains(pipeline);
     } else {
       EPP_RESOURCE_CLASSES.forEach(clazz -> forceResaveAllResources(pipeline, clazz));
     }
   }
 
+  /** Projects to the current time and saves any contacts with expired transfers. */
+  private void fastResaveContacts(Pipeline pipeline) {
+    Read<String, String> repoIdRead =
+        RegistryJpaIO.read(
+                "SELECT repoId FROM Contact WHERE transferData.transferStatus = 'PENDING' AND"
+                    + " transferData.pendingTransferExpirationTime < current_timestamp()",
+                String.class,
+                r -> r)
+            .withCoder(StringUtf8Coder.of());
+    projectAndResaveResources(pipeline, Contact.class, repoIdRead);
+  }
+
   /**
    * Projects to the current time and saves any domains with expired pending actions (e.g.
    * transfers, grace periods).

core/src/main/java/google/registry/beam/spec11/SafeBrowsingTransforms.java

@@ -21,8 +21,6 @@ import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.flogger.FluentLogger;
 import com.google.common.io.CharStreams;
-import google.registry.util.Clock;
-import google.registry.util.DateTimeUtils;
 import google.registry.util.Retrier;
 import java.io.IOException;
 import java.io.InputStreamReader;
@@ -42,6 +40,7 @@ import org.apache.http.entity.ContentType;
 import org.apache.http.impl.client.CloseableHttpClient;
 import org.apache.http.impl.client.HttpClients;
 import org.apache.http.protocol.HTTP;
+import org.joda.time.Instant;
 import org.json.JSONArray;
 import org.json.JSONException;
 import org.json.JSONObject;
@@ -75,8 +74,6 @@ public class SafeBrowsingTransforms {
     /** Provides the SafeBrowsing API key at runtime. */
     private final String apiKey;
 
-    private final Clock clock;
-
     /**
      * Maps a domain name's {@code domainName} to its corresponding {@link DomainNameInfo} to
      * facilitate batching SafeBrowsing API requests.
@@ -104,10 +101,9 @@ public class SafeBrowsingTransforms {
      * HttpClients#createDefault()}.
      */
     @SuppressWarnings("unchecked")
-    EvaluateSafeBrowsingFn(String apiKey, Retrier retrier, Clock clock) {
+    EvaluateSafeBrowsingFn(String apiKey, Retrier retrier) {
       this.apiKey = apiKey;
       this.retrier = retrier;
-      this.clock = clock;
       closeableHttpClientSupplier = (Supplier & Serializable) HttpClients::createDefault;
     }
 
@@ -119,10 +115,9 @@ public class SafeBrowsingTransforms {
      */
     @VisibleForTesting
     EvaluateSafeBrowsingFn(
-        String apiKey, Retrier retrier, Clock clock, Supplier<CloseableHttpClient> clientSupplier) {
+        String apiKey, Retrier retrier, Supplier<CloseableHttpClient> clientSupplier) {
       this.apiKey = apiKey;
       this.retrier = retrier;
-      this.clock = clock;
       closeableHttpClientSupplier = clientSupplier;
     }
 
@@ -131,10 +126,7 @@ public class SafeBrowsingTransforms {
     public void finishBundle(FinishBundleContext context) {
       if (!domainNameInfoBuffer.isEmpty()) {
         ImmutableSet<KV<DomainNameInfo, ThreatMatch>> results = evaluateAndFlush();
-        results.forEach(
-            (kv) ->
-                context.output(
-                    kv, DateTimeUtils.toJodaInstant(clock.now()), GlobalWindow.INSTANCE));
+        results.forEach((kv) -> context.output(kv, Instant.now(), GlobalWindow.INSTANCE));
       }
     }
 

core/src/main/java/google/registry/beam/spec11/Spec11Pipeline.java

@@ -30,7 +30,6 @@ import google.registry.model.reporting.Spec11ThreatMatch;
 import google.registry.model.reporting.Spec11ThreatMatch.ThreatType;
 import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.persistence.VKey;
-import google.registry.util.Clock;
 import google.registry.util.Retrier;
 import google.registry.util.UtilsModule;
 import jakarta.inject.Singleton;
@@ -264,9 +263,8 @@ public class Spec11Pipeline implements Serializable {
     }
 
     @Provides
-    EvaluateSafeBrowsingFn provideSafeBrowsingFn(
-        Spec11PipelineOptions options, Retrier retrier, Clock clock) {
-      return new EvaluateSafeBrowsingFn(options.getSafeBrowsingApiKey(), retrier, clock);
+    EvaluateSafeBrowsingFn provideSafeBrowsingFn(Spec11PipelineOptions options, Retrier retrier) {
+      return new EvaluateSafeBrowsingFn(options.getSafeBrowsingApiKey(), retrier);
     }
 
     @Provides

core/src/main/java/google/registry/beam/wipeout/WipeOutContactHistoryPiiPipeline.java

@@ -0,0 +1,166 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.wipeout;
+
+import static com.google.common.collect.ImmutableList.toImmutableList;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static org.apache.beam.sdk.values.TypeDescriptors.voids;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.Streams;
+import google.registry.beam.common.RegistryJpaIO;
+import google.registry.model.contact.ContactHistory;
+import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
+import google.registry.persistence.VKey;
+import java.io.Serializable;
+import org.apache.beam.sdk.Pipeline;
+import org.apache.beam.sdk.PipelineResult;
+import org.apache.beam.sdk.coders.KvCoder;
+import org.apache.beam.sdk.coders.StringUtf8Coder;
+import org.apache.beam.sdk.coders.VarLongCoder;
+import org.apache.beam.sdk.metrics.Counter;
+import org.apache.beam.sdk.metrics.Metrics;
+import org.apache.beam.sdk.options.PipelineOptionsFactory;
+import org.apache.beam.sdk.transforms.MapElements;
+import org.apache.beam.sdk.transforms.join.CoGroupByKey;
+import org.apache.beam.sdk.transforms.join.KeyedPCollectionTuple;
+import org.apache.beam.sdk.values.KV;
+import org.apache.beam.sdk.values.PCollection;
+import org.apache.beam.sdk.values.TupleTag;
+import org.joda.time.DateTime;
+
+/**
+ * Definition of a Dataflow Flex pipeline template, which finds out {@link ContactHistory} entries
+ * that are older than a given age (excluding the most recent one, even if it falls with the range)
+ * and wipe out PII information in them.
+ *
+ * <p>To stage this template locally, run {@code ./nom_build :core:sBP --environment=alpha \
+ * --pipeline=wipeOutContactHistoryPii}.
+ *
+ * <p>Then, you can run the staged template via the API client library, gCloud or a raw REST call.
+ */
+public class WipeOutContactHistoryPiiPipeline implements Serializable {
+
+  private static final long serialVersionUID = -4111052675715913820L;
+  private static final TupleTag<Long> REVISIONS_TO_WIPE = new TupleTag<>();
+  private static final TupleTag<Long> MOST_RECENT_REVISION = new TupleTag<>();
+
+  private final DateTime cutoffTime;
+  private final boolean dryRun;
+  private final Counter contactsInScope =
+      Metrics.counter("WipeOutContactHistoryPii", "contacts in scope");
+  private final Counter historiesToWipe =
+      Metrics.counter("WipeOutContactHistoryPii", "contact histories to wipe PII from");
+  private final Counter historiesWiped =
+      Metrics.counter("WipeOutContactHistoryPii", "contact histories actually updated");
+
+  WipeOutContactHistoryPiiPipeline(WipeOutContactHistoryPiiPipelineOptions options) {
+    dryRun = options.getIsDryRun();
+    cutoffTime = DateTime.parse(options.getCutoffTime());
+  }
+
+  void setup(Pipeline pipeline) {
+    KeyedPCollectionTuple.of(REVISIONS_TO_WIPE, getHistoryEntriesToWipe(pipeline))
+        .and(MOST_RECENT_REVISION, getMostRecentHistoryEntries(pipeline))
+        .apply("Group by contact", CoGroupByKey.create())
+        .apply(
+            "Wipe out PII",
+            MapElements.into(voids())
+                .via(
+                    kv -> {
+                      String repoId = kv.getKey();
+                      long mostRecentRevision = kv.getValue().getOnly(MOST_RECENT_REVISION);
+                      ImmutableList<Long> revisionsToWipe =
+                          Streams.stream(kv.getValue().getAll(REVISIONS_TO_WIPE))
+                              .filter(e -> e != mostRecentRevision)
+                              .collect(toImmutableList());
+                      if (revisionsToWipe.isEmpty()) {
+                        return null;
+                      }
+                      contactsInScope.inc();
+                      tm().transact(
+                              () -> {
+                                for (long revisionId : revisionsToWipe) {
+                                  historiesToWipe.inc();
+                                  ContactHistory history =
+                                      tm().loadByKey(
+                                              VKey.create(
+                                                  ContactHistory.class,
+                                                  new HistoryEntryId(repoId, revisionId)));
+                                  // In the unlikely case where multiple pipelines run at the
+                                  // same time, or where the runner decides to rerun a particular
+                                  // transform, we might have a history entry that has already been
+                                  // wiped at this point. There's no need to wipe it again.
+                                  if (!dryRun
+                                      && history.getContactBase().isPresent()
+                                      && history.getContactBase().get().getEmailAddress() != null) {
+                                    historiesWiped.inc();
+                                    tm().update(history.asBuilder().wipeOutPii().build());
+                                  }
+                                }
+                              });
+                      return null;
+                    }));
+  }
+
+  PCollection<KV<String, Long>> getHistoryEntriesToWipe(Pipeline pipeline) {
+    return pipeline.apply(
+        "Find contact histories to wipee",
+        // Email is one of the required fields in EPP, meaning it's initially not null when it
+        // is set by EPP flows (even though it is nullalbe in the SQL schema). Therefore,
+        // checking if it's null is one way to avoid processing contact history entities that
+        // have been processed previously. Refer to RFC 5733 for more information.
+        RegistryJpaIO.read(
+                "SELECT repoId, revisionId FROM ContactHistory WHERE resource.email IS NOT NULL"
+                    + " AND modificationTime < :cutoffTime",
+                ImmutableMap.of("cutoffTime", cutoffTime),
+                Object[].class,
+                row -> KV.of((String) row[0], (long) row[1]))
+            .withCoder(KvCoder.of(StringUtf8Coder.of(), VarLongCoder.of())));
+  }
+
+  PCollection<KV<String, Long>> getMostRecentHistoryEntries(Pipeline pipeline) {
+    return pipeline.apply(
+        "Find the most recent historiy entry for each contact",
+        RegistryJpaIO.read(
+                "SELECT repoId, revisionId FROM ContactHistory"
+                    + " WHERE (repoId, modificationTime) IN"
+                    + " (SELECT repoId, MAX(modificationTime) FROM ContactHistory GROUP BY repoId)",
+                ImmutableMap.of(),
+                Object[].class,
+                row -> KV.of((String) row[0], (long) row[1]))
+            .withCoder(KvCoder.of(StringUtf8Coder.of(), VarLongCoder.of())));
+  }
+
+  PipelineResult run(Pipeline pipeline) {
+    setup(pipeline);
+    return pipeline.run();
+  }
+
+  public static void main(String[] args) {
+    PipelineOptionsFactory.register(WipeOutContactHistoryPiiPipelineOptions.class);
+    WipeOutContactHistoryPiiPipelineOptions options =
+        PipelineOptionsFactory.fromArgs(args)
+            .withValidation()
+            .as(WipeOutContactHistoryPiiPipelineOptions.class);
+    // Repeatable read should be more than enough since we are dealing with old history entries that
+    // are otherwise immutable.
+    options.setIsolationOverride(TransactionIsolationLevel.TRANSACTION_REPEATABLE_READ);
+    Pipeline pipeline = Pipeline.create(options);
+    new WipeOutContactHistoryPiiPipeline(options).run(pipeline);
+  }
+}

core/src/main/java/google/registry/beam/wipeout/WipeOutContactHistoryPiiPipelineOptions.java

@@ -0,0 +1,37 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.wipeout;
+
+import google.registry.beam.common.RegistryPipelineOptions;
+import org.apache.beam.sdk.options.Default;
+import org.apache.beam.sdk.options.Description;
+
+public interface WipeOutContactHistoryPiiPipelineOptions extends RegistryPipelineOptions {
+
+  @Description(
+      "A contact history entry with a history modification time before this time will have its PII"
+          + " wiped, unless it is the most entry for the contact.")
+  String getCutoffTime();
+
+  void setCutoffTime(String value);
+
+  @Description(
+      "If true, the wiped out billing events will not be saved but the pipeline metrics counter"
+          + " will still be updated.")
+  @Default.Boolean(false)
+  boolean getIsDryRun();
+
+  void setIsDryRun(boolean value);
+}

core/src/main/java/google/registry/bigquery/BigqueryConnection.java

@@ -24,6 +24,7 @@ import static com.google.common.util.concurrent.Futures.transformAsync;
 import static com.google.common.util.concurrent.MoreExecutors.directExecutor;
 import static google.registry.bigquery.BigqueryUtils.toJobReferenceString;
 import static google.registry.config.RegistryConfig.getProjectId;
+import static org.joda.time.DateTimeZone.UTC;
 
 import com.google.api.client.googleapis.json.GoogleJsonResponseException;
 import com.google.api.client.http.AbstractInputStreamContent;
@@ -57,7 +58,6 @@ import com.google.common.util.concurrent.MoreExecutors;
 import google.registry.bigquery.BigqueryUtils.DestinationFormat;
 import google.registry.bigquery.BigqueryUtils.TableType;
 import google.registry.bigquery.BigqueryUtils.WriteDisposition;
-import google.registry.util.Clock;
 import google.registry.util.NonFinalForTesting;
 import google.registry.util.Sleeper;
 import google.registry.util.SqlTemplate;
@@ -69,6 +69,7 @@ import java.util.List;
 import java.util.Random;
 import java.util.concurrent.ExecutorService;
 import javax.annotation.Nullable;
+import org.joda.time.DateTime;
 import org.joda.time.Duration;
 
 /** Class encapsulating parameters and state for accessing the Bigquery API. */
@@ -93,9 +94,6 @@ public class BigqueryConnection implements AutoCloseable {
   /** Bigquery client instance wrapped by this class. */
   private final Bigquery bigquery;
 
-  /** Clock instance for this connection. */
-  private final Clock clock;
-
   /** Executor service for bigquery jobs. */
   private ListeningExecutorService service;
 
@@ -111,9 +109,8 @@ public class BigqueryConnection implements AutoCloseable {
   /** Duration to wait between polls for job status. */
   private Duration pollInterval = Duration.millis(1000);
 
-  BigqueryConnection(Bigquery bigquery, Clock clock) {
+  BigqueryConnection(Bigquery bigquery) {
     this.bigquery = bigquery;
-    this.clock = clock;
   }
 
   /** Builder for a {@link BigqueryConnection}, since the latter is immutable once created. */
@@ -121,8 +118,8 @@ public class BigqueryConnection implements AutoCloseable {
     private BigqueryConnection instance;
 
     @Inject
-    Builder(Bigquery bigquery, Clock clock) {
-      instance = new BigqueryConnection(bigquery, clock);
+    Builder(Bigquery bigquery) {
+      instance = new BigqueryConnection(bigquery);
     }
 
     /**
@@ -198,11 +195,6 @@ public class BigqueryConnection implements AutoCloseable {
       private final TableReference tableRef = new TableReference();
       private TableType type = TableType.TABLE;
       private WriteDisposition writeDisposition = WriteDisposition.WRITE_EMPTY;
-      private final Clock clock;
-
-      public Builder(Clock clock) {
-        this.clock = clock;
-      }
 
       public Builder datasetId(String datasetId) {
         tableRef.setDatasetId(datasetId);
@@ -225,7 +217,7 @@ public class BigqueryConnection implements AutoCloseable {
       }
 
       public Builder timeToLive(Duration duration) {
-        this.table.setExpirationTime(clock.nowUtc().plus(duration).getMillis());
+        this.table.setExpirationTime(DateTime.now(UTC).plus(duration).getMillis());
         return this;
       }
 
@@ -287,6 +279,20 @@ public class BigqueryConnection implements AutoCloseable {
     private TableReference getTableReference() {
       return table.getTableReference().clone();
     }
+
+    /** Returns a string representation of the TableReference for the wrapped table. */
+    public String getStringReference() {
+      return tableReferenceToString(table.getTableReference());
+    }
+
+    /** Returns a string representation of the given TableReference. */
+    private static String tableReferenceToString(TableReference tableRef) {
+      return String.format(
+          "%s:%s.%s",
+          tableRef.getProjectId(),
+          tableRef.getDatasetId(),
+          tableRef.getTableId());
+    }
   }
 
   /**
@@ -310,7 +316,7 @@ public class BigqueryConnection implements AutoCloseable {
 
   /** Returns a partially built DestinationTable with the default dataset and overwrite behavior. */
   public DestinationTable.Builder buildDestinationTable(String tableName) {
-    return new DestinationTable.Builder(clock)
+    return new DestinationTable.Builder()
         .datasetId(datasetId)
         .type(TableType.TABLE)
         .name(tableName)
@@ -322,7 +328,7 @@ public class BigqueryConnection implements AutoCloseable {
    * temporary table dataset, with the default TTL and overwrite behavior.
    */
   public DestinationTable.Builder buildTemporaryTable() {
-    return new DestinationTable.Builder(clock)
+    return new DestinationTable.Builder()
         .datasetId(TEMP_DATASET_NAME)
         .type(TableType.TABLE)
         .name(getRandomTableName())
@@ -392,12 +398,29 @@ public class BigqueryConnection implements AutoCloseable {
   }
 
   /**
-   * Dumps the results of the specified query into a local ImmutableTable object, row-keyed by the
-   * row number (indexed from 1), column-keyed by the TableFieldSchema for that column, and with the
-   * value object as the cell value.
+   * Starts an asynchronous query job to dump the results of the specified query into a local
+   * ImmutableTable object, row-keyed by the row number (indexed from 1), column-keyed by the
+   * TableFieldSchema for that column, and with the value object as the cell value.  Note that null
+   * values will not actually be null, but they can be checked for using Data.isNull().
    *
-   * <p>Note that null values will not actually be null, but they can be checked for using
-   * Data.isNull()
+   * <p>Returns a ListenableFuture that holds the ImmutableTable on success.
+   */
+  public ListenableFuture<ImmutableTable<Integer, TableFieldSchema, Object>>
+      queryToLocalTable(String querySql) {
+    Job job = new Job()
+        .setConfiguration(new JobConfiguration()
+            .setQuery(new JobConfigurationQuery()
+                .setQuery(querySql)
+                .setDefaultDataset(getDataset())));
+    return transform(runJobToCompletion(job), this::getQueryResults, directExecutor());
+  }
+
+  /**
+   * Returns the result of calling queryToLocalTable, but synchronously to avoid spawning new
+   * background threads, which App Engine doesn't support.
+   *
+   * @see <a href="https://cloud.google.com/appengine/docs/standard/java/runtime#Threads">App Engine
+   *     Runtime</a>
    */
   public ImmutableTable<Integer, TableFieldSchema, Object> queryToLocalTableSync(String querySql) {
     Job job = new Job()
@@ -611,6 +634,10 @@ public class BigqueryConnection implements AutoCloseable {
         });
   }
 
+  private ListenableFuture<Job> runJobToCompletion(final Job job) {
+    return service.submit(() -> runJob(job, null));
+  }
+
   /** Helper that returns true if a dataset with this name exists. */
   public boolean checkDatasetExists(String datasetName) throws IOException {
     try {
@@ -649,6 +676,14 @@ public class BigqueryConnection implements AutoCloseable {
         .setDatasetId(getDatasetId());
   }
 
+  /** Returns table reference with the projectId and datasetId filled out for you. */
+  public TableReference getTable(String tableName) {
+    return new TableReference()
+        .setProjectId(getProjectId())
+        .setDatasetId(getDatasetId())
+        .setTableId(tableName);
+  }
+
   /**
    * Helper that creates a dataset with this name if it doesn't already exist, and returns true if
    * creation took place.

core/src/main/java/google/registry/bsa/BsaDiffCreator.java

@@ -71,7 +71,9 @@ class BsaDiffCreator {
     Optional<String> previousJobName = schedule.latestCompleted().map(CompletedJob::jobName);
     /*
      * Memory usage is a concern when creating a diff, when the newest download needs to be held in
-     * memory in its entirety. Assuming 400K labels, each of which on average included in 5 orders,
+     * memory in its entirety. The top-grade AppEngine VM has 3GB of memory, leaving less than 1.5GB
+     * to application memory footprint after subtracting overheads due to copying garbage collection
+     * and non-heap data etc. Assuming 400K labels, each of which on average included in 5 orders,
      * the memory footprint is at least 300MB when loaded into a Hashset-backed Multimap (64-bit
      * JVM, with 12-byte object header, 16-byte array header, and 16-byte alignment).
      *

core/src/main/java/google/registry/bsa/BsaDownloadAction.java

@@ -41,6 +41,7 @@ import google.registry.bsa.persistence.DownloadScheduler;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.tld.Tlds;
 import google.registry.request.Action;
+import google.registry.request.Action.GaeService;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import google.registry.util.Clock;
@@ -50,7 +51,7 @@ import java.util.Optional;
 import java.util.stream.Stream;
 
 @Action(
-    service = Action.Service.BACKEND,
+    service = GaeService.BSA,
     path = BsaDownloadAction.PATH,
     method = {GET, POST},
     auth = Auth.AUTH_ADMIN)