add additional label to nomulus deployments (#3046)

* add README

* updating comments/files

.gitignore

@@ -1,5 +1,5 @@
-/bazel-*
 **/.idea/**
+.jetskicli
 
 ######################################################################
 # Java Ignores
@@ -115,11 +115,5 @@ cloudbuild-caches/
 **/node_modules/**
 /repos/
 
-# Compiled JS/CSS code
-core/**/registrar_bin*.js
-core/**/registrar_dbg*.js
-core/**/registrar_bin*.css
-core/**/registrar_dbg*.css
-
 # jEnv
 .java-version

GEMINI.md

@@ -13,21 +13,14 @@ This document outlines foundational mandates, architectural patterns, and projec
 - **Verification**: Before finalizing any change, scan the imports section for redundancy.
 - **License Headers**: When creating new files, ensure the license header uses the current year (e.g., 2026). Existing files should retain their original year.
 
-## 2. Time and Precision Handling (java.time Migration)
+## 2. Time and Precision Handling
 
-- **Idiomatic java.time Usage:** Avoid redundant conversions between `Instant` and `DateTime`. If a field or parameter is an `Instant`, use it directly. Do not convert to `DateTime` just to call a deprecated method if an `Instant` alternative exists or can be easily created. Furthermore, you should not call `toInstant()` or `toDateTime()` conversion methods when not strictly necessary; always prefer to use an alternative method that returns the correct type if one exists (e.g. use `tm().getTxTime()` which returns an `Instant` instead of calling `tm().getTransactionTime().toInstant()`).
-- **CRITICAL MISTAKES TO AVOID:**
-    - NEVER use `toInstant(clock.nowUtc())` or `toInstant(fakeClock.nowUtc())`. Both `Clock` and `FakeClock` have a `now()` method that natively returns a `java.time.Instant`. You MUST use `clock.now()` or `fakeClock.now()` directly.
-    - NEVER double-wrap conversions like `toInstant(toDateTime(...))` or `toDateTime(toInstant(...))`.
-    - NEVER mark method parameters or local variables as `final` unnecessarily, as it clutters the codebase. For class fields and constants, use `final` where applicable (i.e. when the field is assigned once and never mutated) to enforce and communicate immutability.
-    - When using test helpers like `assertThatCommand().atTime(...)` or `ForeignKeyUtils.loadResource(...)`, ALWAYS use the `Instant` overloads. DO NOT wrap `Instant` instances in `toDateTime(...)` just to pass them to deprecated overloads.
 - **UTC Timezones:** Do not use `ZoneId.of("UTC")`. Use a statically imported `UTC` from `ZoneOffset` instead (`import static java.time.ZoneOffset.UTC;`).
-- **Millisecond Precision:** Always truncate `Instant.now()` to milliseconds (using `.truncatedTo(ChronoUnit.MILLIS)`) to maintain consistency with Joda `DateTime` and the PostgreSQL schema (which enforces millisecond precision via JPA converters).
 - **Clock Injection:**
-    - Avoid direct calls to `Instant.now()`, `DateTime.now()`, `ZonedDateTime.now()`, or `System.currentTimeMillis()`.
+    - Avoid direct calls to `Instant.now()`, `OffsetDateTime.now()`, or `System.currentTimeMillis()`.
     - Inject `google.registry.util.Clock` (production) or `google.registry.testing.FakeClock` (tests).
-    - Use `clock.nowDate()` to get a `ZonedDateTime` in UTC.
-    - When defining timestamps for tests, prefer using a fixed, static constant (e.g., `Instant.parse("2024-03-27T10:15:30.105Z")`) over capturing `clock.now()` to prevent flaky tests caused by the passage of real time. Avoid using the Unix epoch (`START_INSTANT`) unless specifically testing epoch-related logic; instead, use realistic dates and vary them across different test suites to ensure logic isn't dependent on a specific "standard" date.
+    - Use `clock.nowDate()` to get a `LocalDate` in UTC, or `clock.nowDateTime()` to get an `OffsetDateTime` in UTC.
+    - When defining timestamps for tests, prefer using a fixed, static constant (e.g., `Instant.parse("2024-03-27T10:15:30.105Z")`) over capturing `clock.now()` to prevent flaky tests caused by the passage of real time.
 - **Beam Pipelines:**
     - Ensure `Clock` is serializable (it is by default in this project) when used in Beam `DoFn`s.
     - Pass the `Clock` through the constructor or via Dagger provider methods in the pipeline module.
@@ -42,7 +35,6 @@ This document outlines foundational mandates, architectural patterns, and projec
 - **Test Components:** Use `TestRegistryToolComponent` for command-line tool tests to bridge the gap between `main` and `nonprod/test` source sets.
 
 ### 4. Database Consistency
-- **JPA Converters:** Be aware that JPA converters (like `DateTimeConverter`) may perform truncation or transformation. Ensure application-level logic matches these transformations to avoid "dirty" state or unexpected diffs.
 - **Transaction Management:**
     - **Top-Level:** Define database transactions (`tm().transact(...)`) at the highest possible level in the call chain (e.g., in an Action, a Command, or a Flow). This ensures all operations are atomic and handled by the retry logic.
     - **DAO Methods:** Avoid declaring transactions inside low-level DAO methods. Use `tm().assertInTransaction()` to ensure that these methods are only called within a valid transactional context.
@@ -57,6 +49,7 @@ This document outlines foundational mandates, architectural patterns, and projec
 - **FakeClock and Sleeper:** Use `FakeClock` and `Sleeper` for any logic involving timeouts, delays, or expiration.
 - **Empirical Reproduction:** Before fixing a bug, always create a test case that reproduces the failure.
 - **Base Classes:** Leverage `CommandTestCase`, `EppToolCommandTestCase`, etc., to reduce boilerplate and ensure consistent setup (e.g., clock initialization).
+- **Gradle Test Patterns:** When running tests to investigate fixes in the "core" directory, try to first use the "standardTest" Gradle task. It is faster than the "test" task, which includes the "fragileTest" task. Only run the full "test" task after "standardTest" succeeds.
 
 ### 6. Project Dependencies
 - **Common Module:** When using `Clock` or other core utilities in a new or separate module (like `load-testing`), ensure `implementation project(':common')` is added to the module's `build.gradle`.
@@ -95,9 +88,8 @@ This document captures high-level architectural patterns, lessons learned from l
 - **Transaction Management:** The codebase uses a custom wrapper around JPA. Always use `tm()` (from `TransactionManagerFactory`) to interact with the database.
 - **Dependency Injection:** Dagger 2 is used extensively. If you see "cannot find symbol" errors for classes starting with `Dagger...`, the project is in a state where annotation processing failed. Fix compilation in core models first to restore generated code.
 - **Value Types:** AutoValue and "ImmutableObject" patterns are dominant. Most models follow a `Buildable` pattern with a nested `Builder`.
-- **Temporal Logic:** The project is migrating from Joda-Time to `java.time`.
+- **Temporal Logic:** The project uses `java.time` for all temporal representations.
   - Core boundaries: `DateTimeUtils.START_INSTANT` (Unix Epoch) and `DateTimeUtils.END_INSTANT` (Long.MAX_VALUE / 1000).
-  - Year Arithmetic: Use `DateTimeUtils.plusYears()` and `DateTimeUtils.minusYears()` to handle February 29th logic correctly.
 
 ## Source Control
 - **Committing:** Always create a new commit on the branch if one hasn't been created yet for the branch's specific work. Only perform amending (`git commit --amend --no-edit`) for subsequent changes once the initial commit has been successfully created.
@@ -115,14 +107,11 @@ This document captures high-level architectural patterns, lessons learned from l
 ## Self-Review Guidelines
 Before finalizing any PR or declaring a task complete, you MUST perform a thorough, rigorous self-review of your entire diff. Run `git diff HEAD^` (or review the staged changes) and actively verify the following against every modified line:
 
-1. **Imports & FQNs:** Did I leave any fully-qualified class names or static variables inline? Did I add the necessary imports for them? *Crucial Exception:* If the file already imports a class with the identical name (e.g., it uses both `java.time.Duration` and `org.joda.time.Duration`), one MUST remain fully qualified to avoid a compilation conflict.
-2. **Redundant Conversions:** Did I use `toDateTime(clock.now())` where `clock.nowUtc()` would suffice? Did I use `toDateTime(END_INSTANT)` instead of `END_OF_TIME`? Did I use `.toInstant()` or `.toDateTime()` on something that could be avoided by using a different method overload (e.g., `tm().getTxTime()`)?
-3. **Verbose Math:** Did I write any verbose time conversions inline? Are there `DateTimeUtils` methods I should be using instead? If not, should I abstract this math into `DateTimeUtils`?
-4. **Assertion Cleanliness:** Am I polluting test assertions with `toDateTime(...)` wraps? If so, I need to add overloaded assertions to the Truth Subjects instead.
-5. **Diff Scope:** Are there any formatting-only changes in files that I did not functionally modify? If so, revert them. Does the total line count of the diff align with the approved scope (e.g., ~1,000 lines for migrations)?
-6. **Commit Message:** Does the commit message title fit within 50 characters? Does the body encapsulate the entirety of the changes across the diff cleanly and professionally?
-7. **Missing Tests & Coverage:** *Perform a structured check for any new methods or modified behavior.* Did I add a new utility method (like `plusMonths(Instant, int)`) or change core logic? If so, I MUST open the corresponding test file and write tests to cover the new functionality (including edge cases, negative values, and leap years) before considering the task complete. A code review is not thorough if it only checks for compilation. I must actively ensure every new branch of logic has a test.
-8. **Package Lock:** Did I include `console-webapp/package-lock.json` in my diff? If so, I MUST revert it (`git checkout console-webapp/package-lock.json`) unless I explicitly intended to modify NPM dependencies. This file is often modified by the build process and should not be committed accidentally.
+1. **Imports & FQNs:** Did I leave any fully-qualified class names or static variables inline? Did I add the necessary imports for them? *Crucial Exception:* If the file already imports a class with the identical name (e.g., it uses both `java.util.Date` and `java.sql.Date`), one MUST remain fully qualified to avoid a compilation conflict.
+2. **Diff Scope:** Are there any formatting-only changes in files that I did not functionally modify? If so, revert them. Does the total line count of the diff align with the approved scope (e.g., ~1,000 lines for migrations)?
+3. **Commit Message:** Does the commit message title fit within 50 characters? Does the body encapsulate the entirety of the changes across the diff cleanly and professionally?
+4. **Missing Tests & Coverage:** *Perform a structured check for any new methods or modified behavior.* Did I add a new utility method (like `plusMonths(Instant, int)`) or change core logic? If so, I MUST open the corresponding test file and write tests to cover the new functionality (including edge cases, negative values, and leap years) before considering the task complete. A code review is not thorough if it only checks for compilation. I must actively ensure every new branch of logic has a test.
+5. **Package Lock:** Did I include `console-webapp/package-lock.json` in my diff? If so, I MUST revert it (`git checkout console-webapp/package-lock.json`) unless I explicitly intended to modify NPM dependencies. This file is often modified by the build process and should not be committed accidentally.
 
 Only after actively confirming these checks against your diff are you permitted to finalize the task.
 
@@ -131,30 +120,16 @@ Only after actively confirming these checks against your diff are you permitted
 
 ### 1. Compiler Warnings are Errors (`-Werror`)
 This project treats Error Prone warnings as errors.
-- **`@InlineMeSuggester`**: When creating deprecated Joda-Time bridge methods (e.g., `getTimestamp() -> return toDateTime(getTimestampInstant())`), you **MUST** immediately add `@SuppressWarnings("InlineMeSuggester")`. If you don't, the build will fail.
 - **Repeatable Annotations**: `@SuppressWarnings` is **NOT** repeatable in this environment. If a method or class already has a suppression (e.g., `@SuppressWarnings("unchecked")`), you must merge them:
-  - ❌ `@SuppressWarnings("unchecked") @SuppressWarnings("InlineMeSuggester")`
-  - ✅ `@SuppressWarnings({"unchecked", "InlineMeSuggester"})`
+  - ❌ `@SuppressWarnings("unchecked") @SuppressWarnings("MustBeClosedChecker")`
+  - ✅ `@SuppressWarnings({"unchecked", "MustBeClosedChecker"})`
 
-### 2. Resolving Ambiguity
-- **Null Overloads**: Adding an `Instant` overload to a method that previously took `DateTime` will break all `create(null)` calls. You must cast them: `create((Instant) null)`.
-- **Type Erasure**: Methods taking `Optional<DateTime>` and `Optional<Instant>` will clash due to erasure. Use distinct names, e.g., `setAutorenewEndTimeInstant(Optional<Instant> time)`.
-
-### 3. Build Strategy
-- **Surgical Changes**: In large-scale migrations, focus on "leaf" nodes first (Utilities -> Models -> Flows -> Actions).
-- **PR Size**: Minimize PR size by retaining Joda-Time bridge methods for high-level "Action" and "Flow" classes unless a full migration is requested. Reverting changes to DNS and Reporting logic while updating the underlying models is a valid strategy to keep PRs reviewable.
+### 2. Build Strategy
 - **Validation**: Always run `./gradlew build -x test` before attempting to run unit tests. Unit tests will not run if there are compilation errors in any part of the `core` module. Before finalizing a PR or declaring a task done, you MUST verify your changes. **Prefer scoped builds** (e.g., `./gradlew :core:build`) if you are only modifying backend Java code. Running the global `./gradlew build` triggers the frontend `console-webapp` build, which unnecessarily runs `npmInstallDeps` and modifies `package-lock.json`. If you must run a global build, you must revert `console-webapp/package-lock.json` afterwards. Do not declare success if formatting checks (e.g., `spotlessCheck` or `javaIncrementalFormatCheck`) or tests fail. If formatting fails, run `./gradlew spotlessApply` and then re-run your build command to verify everything passes.
 
 ## 🚫 Common Pitfalls to Avoid
 
-- **Mixing Joda and Java Durations:** Methods like `Tld.get().getRenewGracePeriodLength()` return a **Joda** `Duration`, which cannot be passed directly to `Instant.plus(...)` because it doesn't implement `TemporalAmount`. You MUST use `.plusMillis(duration.getMillis())` instead.
 - **Serialization Precision (`.000Z`):** When asserting against or generating XML/YAML files, remember that millisecond precision (`.000Z`) is required. Always use `DateTimeUtils.formatInstant(...)` to format `Instant` objects (it preserves the `.000Z` suffix) instead of `Instant.toString()` (which drops it for exact seconds). We have added custom Jackson `InstantKeySerializer`s for this purpose, but you must keep this precision in mind when manually updating `.xml` or `.yaml` test data.
-- **Static Imports:** Methods like `toDateTime`, `toInstant`, `plusYears`, `plusMonths`, and `minusDays` from `DateTimeUtils` MUST be statically imported. Do NOT use them fully qualified (e.g., `DateTimeUtils.plusMonths(...)`).
-
-- **Redundant Parses:** Never write `toDateTime(Instant.parse(...))` or `toInstant(DateTime.parse(...))`. If you need a `DateTime`, use `DateTime.parse(...)` directly. If you need an `Instant`, use `Instant.parse(...)` directly.
-- **cloneProjectedAtTime vs cloneProjectedAtTime:** When converting tests and logic that use `clock.now()` to project resource state into the future or past, do not wrap the Java `Instant` in `toDateTime()` just to call `cloneProjectedAtTime()`. Instead, switch the method call to use the native `cloneProjectedAtTime()` method which is available on all `EppResource` models.
-- **Do not go in circles with the build:** If you see an `InlineMeSuggester` error, apply the suppression to **ALL** similar methods in that file and related files in one turn. Do not fix them one by one. Furthermore, do not run a global `./gradlew build` when a scoped `./gradlew :core:build` or `./gradlew :core:test` is faster and more appropriate. Run global builds only when doing final verification.
-- **Exception Conversion in Tests:** When migrating time types (e.g., from Joda `DateTime` to Java `Instant`), be extremely careful with tests that verify parsing failures (e.g., `assertThrows(IllegalArgumentException.class, ...)`). Joda's `DateTime.parse()` throws an `IllegalArgumentException` on failure, but `Instant.parse()` throws a `java.time.format.DateTimeParseException`. You must update the expected exception type in these tests to ensure they actually test the correct behavior, and verify the tests are not failing prematurely on the first line if it contains invalid data meant to be ignored.
 - Dagger/AutoValue corruption: If you modify a builder or a component incorrectly, Dagger will fail to generate code, leading to hundreds of "cannot find symbol" errors. If this happens, `git checkout` the last working state of the specific file and re-apply changes more surgically.
 - **`replace` tool context**: When using `replace` on large files (like `Tld.java` or `DomainBase.java`), provide significant surrounding context. These files have many similar method signatures (getters/setters) that can lead to incorrect replacements.
 

common/build.gradle

@@ -58,7 +58,6 @@ dependencies {
   implementation deps['com.google.code.findbugs:jsr305']
   implementation deps['com.google.guava:guava']
   implementation deps['jakarta.inject:jakarta.inject-api']
-  implementation deps['joda-time:joda-time']
   implementation deps['com.google.flogger:flogger']
   implementation deps['io.github.java-diff-utils:java-diff-utils']
   implementation deps['com.google.truth:truth']

common/gradle.lockfile

@@ -2,7 +2,7 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-com.github.ben-manes.caffeine:caffeine:3.2.3=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.github.ben-manes.caffeine:caffeine:3.2.4=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
 com.google.auto.service:auto-service-annotations:1.0.1=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
 com.google.auto.value:auto-value-annotations:1.11.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
@@ -11,8 +11,8 @@ com.google.auto:auto-common:1.2.2=annotationProcessor,testAnnotationProcessor,te
 com.google.code.findbugs:jsr305:3.0.2=checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.google.errorprone:error_prone_annotation:2.48.0=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.36.0=checkstyle
-com.google.errorprone:error_prone_annotations:2.43.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.google.errorprone:error_prone_annotations:2.48.0=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
+com.google.errorprone:error_prone_annotations:2.49.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.google.errorprone:error_prone_check_api:2.48.0=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
 com.google.errorprone:error_prone_core:2.48.0=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
 com.google.flogger:flogger:0.9=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
@@ -37,7 +37,6 @@ io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,testAnnotatio
 io.github.java-diff-utils:java-diff-utils:4.16=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 jakarta.inject:jakarta.inject-api:2.0.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 javax.inject:javax.inject:1=annotationProcessor,testAnnotationProcessor,testingAnnotationProcessor
-joda-time:joda-time:2.14.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 junit:junit:4.13.2=testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 net.sf.saxon:Saxon-HE:12.5=checkstyle
 org.antlr:antlr4-runtime:4.13.2=checkstyle

common/src/main/java/google/registry/util/Clock.java

@@ -16,15 +16,16 @@ package google.registry.util;
 
 import java.io.Serializable;
 import java.time.Instant;
+import java.time.LocalDate;
+import java.time.OffsetDateTime;
 import java.time.ZoneOffset;
-import java.time.ZonedDateTime;
 import javax.annotation.concurrent.ThreadSafe;
 
 /**
  * A clock that tells the current time in milliseconds or nanoseconds.
  *
  * <p>Clocks are technically serializable because they are either a stateless wrapper around the
- * system clock, or for testing, are just a wrapper around a DateTime. This means that if you
+ * system clock, or for testing, are just a wrapper around an Instant. This means that if you
  * serialize a clock and deserialize it elsewhere, you won't necessarily get the same time or time
  * zone -- what you will get is a functioning clock.
  */
@@ -34,8 +35,18 @@ public interface Clock extends Serializable {
   /** Returns current Instant (which is always in UTC). */
   Instant now();
 
-  /** Returns the current time as a {@link ZonedDateTime} in UTC. */
-  default ZonedDateTime nowDate() {
-    return ZonedDateTime.ofInstant(now(), ZoneOffset.UTC);
+  /** Returns the current time as an {@link OffsetDateTime} in UTC. */
+  default OffsetDateTime nowDateTime() {
+    return OffsetDateTime.ofInstant(now(), ZoneOffset.UTC);
+  }
+
+  /** Returns the current time as a {@link LocalDate} in UTC. */
+  default LocalDate nowDate() {
+    return LocalDate.ofInstant(now(), ZoneOffset.UTC);
+  }
+
+  /** Returns the current time in milliseconds since the epoch. */
+  default long nowMillis() {
+    return now().toEpochMilli();
   }
 }

common/src/main/java/google/registry/util/DateTimeUtils.java

@@ -15,7 +15,6 @@
 package google.registry.util;
 
 import static com.google.common.base.Preconditions.checkArgument;
-import static org.joda.time.DateTimeZone.UTC;
 
 import com.google.common.collect.Iterables;
 import com.google.common.collect.Lists;
@@ -24,14 +23,8 @@ import java.time.Instant;
 import java.time.LocalDate;
 import java.time.ZoneOffset;
 import java.time.format.DateTimeFormatter;
-import java.time.format.DateTimeFormatterBuilder;
 import java.time.format.DateTimeParseException;
-import java.time.format.SignStyle;
-import java.time.temporal.ChronoField;
 import java.time.temporal.ChronoUnit;
-import javax.annotation.Nullable;
-import org.joda.time.DateTime;
-import org.joda.time.ReadableDuration;
 
 public abstract class DateTimeUtils {
 
@@ -52,15 +45,15 @@ public abstract class DateTimeUtils {
    *
    * <p>Example: {@code 2024-03-27T10:15:30.105Z}
    *
-   * <p>Handles large/negative years by using a sign prefix if necessary, compatible with {@link
-   * Instant#parse}.
+   * <p>Note: We deliberately strip the leading {@code +} sign from the formatted year field if
+   * present. While standard ISO 8601 specifies that years with more than 4 digits should be
+   * prefixed with a {@code +} sign, W3C XML Schema 1.0 (which our EPP RDE XSD uses) strictly
+   * forbids leading plus signs in {@code xsd:dateTime} strings. Suppressing the plus sign ensures
+   * our generated XML continues to pass strict XSD validation for large years (e.g. {@code
+   * 294247-01-10T04:00:54.775Z}).
    */
   private static final DateTimeFormatter ISO_8601_FORMATTER =
-      new DateTimeFormatterBuilder()
-          .appendValue(ChronoField.YEAR, 4, 10, SignStyle.NOT_NEGATIVE)
-          .appendPattern("-MM-dd'T'HH:mm:ss.SSS'Z'")
-          .toFormatter()
-          .withZone(ZoneOffset.UTC);
+      DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'").withZone(ZoneOffset.UTC);
 
   /** A formatter that produces lowercase, filename-safe and job-name-safe timestamps. */
   public static final DateTimeFormatter LOWERCASE_TIMESTAMP_FORMATTER =
@@ -68,7 +61,8 @@ public abstract class DateTimeUtils {
 
   /** Formats an {@link Instant} to an ISO-8601 string. */
   public static String formatInstant(Instant instant) {
-    return ISO_8601_FORMATTER.format(instant);
+    String formatted = ISO_8601_FORMATTER.format(instant);
+    return formatted.startsWith("+") ? formatted.substring(1) : formatted;
   }
 
   /**
@@ -79,9 +73,15 @@ public abstract class DateTimeUtils {
    * large years (e.g. {@code 294247-01-10T04:00:54.775Z}).
    */
   public static Instant parseInstant(String timestamp) {
+    if (!timestamp.startsWith("+") && !timestamp.startsWith("-")) {
+      int dashIndex = timestamp.indexOf('-');
+      if (dashIndex > 4) {
+        timestamp = "+" + timestamp;
+      }
+    }
     try {
       // Try the standard millisecond precision format first.
-      return Instant.from(ISO_8601_FORMATTER.parse(timestamp));
+      return Instant.from(DateTimeFormatter.ISO_INSTANT.parse(timestamp));
     } catch (DateTimeParseException e) {
       // Fall back to the standard ISO instant parser which handles varied precision.
       return Instant.parse(timestamp);
@@ -93,7 +93,7 @@ public abstract class DateTimeUtils {
     return earliestOf(Lists.asList(first, rest));
   }
 
-  /** Returns the earliest element in a {@link Instant} iterable. */
+  /** Returns the earliest element in an {@link Instant} iterable. */
   public static Instant earliestOf(Iterable<Instant> instants) {
     checkArgument(!Iterables.isEmpty(instants));
     return Ordering.<Instant>natural().min(instants);
@@ -104,24 +104,12 @@ public abstract class DateTimeUtils {
     return latestOf(Lists.asList(first, rest));
   }
 
-  /** Returns the latest element in a {@link Instant} iterable. */
+  /** Returns the latest element in an {@link Instant} iterable. */
   public static Instant latestOf(Iterable<Instant> instants) {
     checkArgument(!Iterables.isEmpty(instants));
     return Ordering.<Instant>natural().max(instants);
   }
 
-  /** Converts a Joda-Time Duration to a java.time.Duration. */
-  @Nullable
-  public static java.time.Duration toJavaDuration(@Nullable ReadableDuration duration) {
-    return duration == null ? null : java.time.Duration.ofMillis(duration.getMillis());
-  }
-
-  /** Converts a java.time.Duration to a Joda-Time Duration. */
-  @Nullable
-  public static org.joda.time.Duration toJodaDuration(@Nullable java.time.Duration duration) {
-    return duration == null ? null : org.joda.time.Duration.millis(duration.toMillis());
-  }
-
   /** Returns whether the first {@link Instant} is equal to or earlier than the second. */
   public static boolean isBeforeOrAt(Instant timeToCheck, Instant timeToCompareTo) {
     return !timeToCheck.isAfter(timeToCompareTo);
@@ -134,7 +122,7 @@ public abstract class DateTimeUtils {
 
   /**
    * Adds years to a date, in the {@code Duration} sense of semantic years. Use this instead of
-   * {@link java.time.ZonedDateTime#plusYears} to ensure that we never end up on February 29.
+   * {@link java.time.OffsetDateTime#plusYears} to ensure that we never end up on February 29.
    */
   public static Instant plusYears(Instant now, int years) {
     checkArgument(years >= 0);
@@ -157,7 +145,7 @@ public abstract class DateTimeUtils {
 
   /**
    * Subtracts years from a date, in the {@code Duration} sense of semantic years. Use this instead
-   * of {@link java.time.ZonedDateTime#minusYears} to ensure that we never end up on February 29.
+   * of {@link java.time.OffsetDateTime#minusYears} to ensure that we never end up on February 29.
    */
   public static Instant minusYears(Instant now, long years) {
     checkArgument(years >= 0);
@@ -171,24 +159,6 @@ public abstract class DateTimeUtils {
     return instant.atZone(ZoneOffset.UTC).toLocalDate();
   }
 
-  /** Convert a joda {@link DateTime} to a java.time {@link Instant}, null-safe. */
-  @Nullable
-  public static Instant toInstant(@Nullable DateTime dateTime) {
-    return (dateTime == null) ? null : Instant.ofEpochMilli(dateTime.getMillis());
-  }
-
-  /** Convert a java.time {@link Instant} to a joda {@link DateTime}, null-safe. */
-  @Nullable
-  public static DateTime toDateTime(@Nullable Instant instant) {
-    return (instant == null) ? null : new DateTime(instant.toEpochMilli(), UTC);
-  }
-
-  /** Convert a java.time {@link java.time.Instant} to a joda {@link org.joda.time.Instant}. */
-  @Nullable
-  public static org.joda.time.Instant toJodaInstant(@Nullable java.time.Instant instant) {
-    return (instant == null) ? null : org.joda.time.Instant.ofEpochMilli(instant.toEpochMilli());
-  }
-
   public static Instant plusHours(Instant instant, long hours) {
     return instant.plus(hours, ChronoUnit.HOURS);
   }

common/src/main/java/google/registry/util/SystemClock.java

@@ -31,10 +31,9 @@ public class SystemClock implements Clock {
 
   @Override
   public Instant now() {
-    // Truncate to milliseconds to match the precision of Joda DateTime and our database schema
-    // (which uses millisecond precision via DateTimeConverter). This prevents subtle comparison
-    // bugs where a high-precision Instant would be considered "after" a truncated database
-    // timestamp.
+    // Truncate to milliseconds to match the precision of our database schema.
+    // This prevents subtle comparison bugs where a high-precision Instant would be
+    // considered "after" a truncated database timestamp.
     return Instant.now().truncatedTo(MILLIS);
   }
 }

common/src/testing/java/google/registry/testing/FakeClock.java

@@ -21,8 +21,6 @@ import java.time.Duration;
 import java.time.Instant;
 import java.util.concurrent.atomic.AtomicLong;
 import javax.annotation.concurrent.ThreadSafe;
-import org.joda.time.ReadableDuration;
-import org.joda.time.ReadableInstant;
 
 /** A mock clock for testing purposes that supports telling, setting, and advancing the time. */
 @ThreadSafe
@@ -41,12 +39,6 @@ public final class FakeClock implements Clock {
     this(START_INSTANT);
   }
 
-  /** Creates a FakeClock initialized to a specific time. */
-  @Deprecated
-  public FakeClock(ReadableInstant startTime) {
-    setTo(startTime);
-  }
-
   /** Creates a FakeClock initialized to a specific time. */
   public FakeClock(Instant startTime) {
     setTo(startTime);
@@ -66,12 +58,6 @@ public final class FakeClock implements Clock {
    * @param autoIncrementStep the new auto increment duration
    * @return this
    */
-  @Deprecated
-  public FakeClock setAutoIncrementStep(ReadableDuration autoIncrementStep) {
-    this.autoIncrementStepMs = autoIncrementStep.getMillis();
-    return this;
-  }
-
   /**
    * Sets the increment applied to the clock whenever it is queried. The increment is zero by
    * default: the clock is left unchanged when queried.
@@ -91,23 +77,11 @@ public final class FakeClock implements Clock {
     advanceBy(Duration.ofMillis(1));
   }
 
-  /** Advances clock by some duration. */
-  @Deprecated
-  public void advanceBy(ReadableDuration duration) {
-    currentTimeMillis.addAndGet(duration.getMillis());
-  }
-
   /** Advances clock by some duration. */
   public void advanceBy(Duration duration) {
     currentTimeMillis.addAndGet(duration.toMillis());
   }
 
-  /** Sets the time to the specified instant. */
-  @Deprecated
-  public void setTo(ReadableInstant time) {
-    currentTimeMillis.set(time.getMillis());
-  }
-
   /** Sets the time to the specified instant. */
   public void setTo(Instant time) {
     currentTimeMillis.set(time.toEpochMilli());

config/nom_build.py

@@ -409,4 +409,3 @@ if __name__ == '__main__':
         sys.exit(main(sys.argv))
     except Abort as ex:
         sys.exit(1)
-

config/presubmits.py

@@ -102,6 +102,22 @@ PRESUBMITS = {
                    {"node_modules/", ".idea"}, REQUIRED):
         "Source files must end in a newline.",
 
+    # Files must not end with extraneous blank lines
+    PresubmitCheck(
+        r".*\n\n$",
+        ("java", "js", "soy", "sql", "py", "sh", "gradle", "ts", "xml"),
+        {"node_modules/", ".idea", "nomulus.golden.sql"},
+    ):
+        "Source files must not end with extraneous blank lines.",
+
+    # Duplicate empty lines
+    PresubmitCheck(
+        r".*\n\n\n.*",
+        ("java", "js", "soy", "sh", "gradle", "ts", "xml"),
+        {"node_modules/", ".idea"},
+    ):
+        "Source files must not contain duplicate empty lines.",
+
     # System.(out|err).println should only appear in tools/ or load-testing/
     PresubmitCheck(
         r".*\bSystem\s*\.\s*(?:out|err)\s*\.\s*print.*", "java", {
@@ -160,7 +176,8 @@ PRESUBMITS = {
             "SelfSignedCaCertificate.java",
             "X509Utils.java",
             "TmchCertificateAuthority.java",
-            "DelegatedCredentials.java"
+            "DelegatedCredentials.java",
+            "SslInitializerTestUtils.java"
         },
     ):
         "Do not use java.util.Date. Use classes in java.time package instead.",
@@ -202,85 +219,24 @@ PRESUBMITS = {
         {},
     ):
         "Do not use .isEqualTo(Optional.of(...)). Use Truth's .hasValue(...) instead.",
-    # TODO: Remove the java.time migration presubmit checks below once the entire codebase has been migrated to java.time.
     PresubmitCheck(
-        r".*toDateTime\(\s*toInstant\(.*",
-        "java",
-        {"DateTimeUtilsTest.java"},
-    ):
-        "Do not double-wrap toDateTime(toInstant(...)).",
-    PresubmitCheck(
-        r".*toInstant\(\s*toDateTime\(.*",
-        "java",
-        {"DateTimeUtilsTest.java"},
-    ):
-        "Do not double-wrap toInstant(toDateTime(...)).",
-    PresubmitCheck(
-        r".*toInstant\([^;]*[cC]lock\.now\(\).*",
+        r".*java\.time\.ZonedDateTime.*",
         "java",
         {},
     ):
-        "Do not use toInstant(clock.now()). Use clock.now() instead.",
-    PresubmitCheck(
-        r".*toDateTime\([^;]*[cC]lock\.now\(\).*",
-        "java",
-        {},
-    ):
-        "Do not use toDateTime(clock.now()). Use clock.now() and Instant overloads instead.",
-    PresubmitCheck(
-        r".*toInstant\([^;]*tm\(\)\.getTxTime\(\).*",
-        "java",
-        {},
-    ):
-        "Do not use toInstant(tm().getTxTime()). Use tm().getTxTime() instead.",
-    PresubmitCheck(
-        r".*toDateTime\([^;]*tm\(\)\.getTxTime\(\).*",
-        "java",
-        {},
-    ):
-        "Do not use toDateTime(tm().getTxTime()). Use tm().getTxTime() and Instant overloads instead.",
-    PresubmitCheck(
-        r".*\(\s*Instant\s*\)\s*(?:this\.)?(?:fakeClock|clock)\.now\(\s*\).*",
-        "java",
-        {},
-    ):
-        "Do not unnecessarily cast clock.now() to Instant.",
-    PresubmitCheck(
-        r".*toDateTime\(\s*Instant\.now\(.*",
-        "java",
-        {},
-    ):
-        "Do not wrap Instant.now() in toDateTime. Use DateTime.now(UTC) directly.",
-    PresubmitCheck(
-        r".*toInstant\(\s*DateTime\.now\(.*",
-        "java",
-        {},
-    ):
-        "Do not wrap DateTime.now() in toInstant. Use Instant.now().truncatedTo(ChronoUnit.MILLIS) directly.",
-    PresubmitCheck(
-        r".*toDateTime\(\s*Instant\.parse\(.*",
-        "java",
-        {"DateTimeUtilsTest.java"},
-    ):
-        "Do not wrap Instant.parse in toDateTime. Use DateTime.parse directly.",
-    PresubmitCheck(
-        r".*toInstant\(\s*DateTime\.parse\(.*",
-        "java",
-        {"DateTimeUtilsTest.java"},
-    ):
-        "Do not wrap DateTime.parse in toInstant. Use Instant.parse directly.",
-    PresubmitCheck(
-        r".*cloneProjectedAtTime\(\s*toDateTime\(.*",
-        "java",
-        {},
-    ):
-        "Do not use cloneProjectedAtTime(toDateTime(...)). Use cloneProjectedAtTime(...) instead.",
+        "Do not use java.time.ZonedDateTime. Use java.time.OffsetDateTime per go/avoid-zdt.",
     PresubmitCheck(
         r".*ZoneId\.of\(\s*\"UTC\"\s*\).*",
         "java",
         {},
     ):
-        "Do not use ZoneId.of(\"UTC\"). Use java.time.ZoneOffset.UTC."
+        "Do not use ZoneId.of(\"UTC\"). Use java.time.ZoneOffset.UTC.",
+    PresubmitCheck(
+        r".*org\.joda\.time.*",
+        "java",
+        {"SafeBrowsingTransforms.java"},
+    ):
+        "Do not use Joda-Time. Use java.time instead.",
 }
 
 # Note that this regex only works for one kind of Flyway file.  If we want to

console-webapp/package-lock.json

@@ -629,15 +629,15 @@
       }
     },
     "node_modules/@angular/build/node_modules/@types/node": {
-      "version": "25.6.0",
-      "resolved": "https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/@types/node/-/node-25.6.0.tgz",
-      "integrity": "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ==",
+      "version": "25.7.0",
+      "resolved": "https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/@types/node/-/node-25.7.0.tgz",
+      "integrity": "sha512-z+pdZyxE+RTQE9AcboAZCb4otwcrvgHD+GlBpPgn0emDVt0ohrTMhAwlr2Wd9nZ+nihhYFxO2pThz3C5qSu2Eg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "peer": true,
       "dependencies": {
-        "undici-types": "~7.19.0"
+        "undici-types": "~7.21.0"
       }
     },
     "node_modules/@angular/build/node_modules/@vitejs/plugin-basic-ssl": {
@@ -744,9 +744,9 @@
       }
     },
     "node_modules/@angular/build/node_modules/undici-types": {
-      "version": "7.19.2",
-      "resolved": "https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/undici-types/-/undici-types-7.19.2.tgz",
-      "integrity": "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg==",
+      "version": "7.21.0",
+      "resolved": "https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/undici-types/-/undici-types-7.21.0.tgz",
+      "integrity": "sha512-w9IMgQrz4O0YN1LtB7K5P63vhlIOvC7opSmouCJ+ZywlPAlO9gIkJ+otk6LvGpAs2wg4econaCz3TvQ9xPoyuQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,

core/build.gradle

@@ -198,7 +198,6 @@ dependencies {
   implementation deps['jakarta.persistence:jakarta.persistence-api']
   implementation deps['jakarta.servlet:jakarta.servlet-api']
   implementation deps['jakarta.xml.bind:jakarta.xml.bind-api']
-  implementation deps['joda-time:joda-time']
   implementation deps['org.antlr:antlr4']
   implementation deps['org.antlr:antlr4-runtime']
   implementation deps['org.apache.avro:avro']
@@ -479,7 +478,6 @@ Optional<List<String>> getToolArgsList() {
   return Optional.empty()
 }
 
-
 // To run the nomulus tools with these command line tokens:
 // "--foo", "bar baz", "--qux=quz"
 //   gradle core:registryTool --args="--foo 'bar baz' --qux=quz"
@@ -819,7 +817,6 @@ test {
   // TODO(weiminyu): Remove dependency on sqlIntegrationTest
 }.dependsOn(fragileTest, standardTest, registryToolIntegrationTest, sqlIntegrationTest)
 
-
 // When we override tests, we also break the cleanTest command.
 cleanTest.dependsOn(cleanFragileTest, cleanStandardTest,
                     cleanRegistryToolIntegrationTest, cleanSqlIntegrationTest)

core/gradle.lockfile

@@ -13,9 +13,8 @@ com.fasterxml.jackson.datatype:jackson-datatype-joda:2.20.2=compileClasspath,dep
 com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson:jackson-bom:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.woodstox:woodstox-core:7.0.0=testCompileClasspath,testRuntimeClasspath
-com.fasterxml:classmate:1.7.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.github.ben-manes.caffeine:caffeine:3.2.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.ben-manes.caffeine:caffeine:3.2.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.docker-java:docker-java-api:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.docker-java:docker-java-transport-zerodep:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.docker-java:docker-java-transport:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -36,7 +35,7 @@ com.google.api-client:google-api-client-servlet:2.7.0=deploy_jar,nonprodRuntimeC
 com.google.api-client:google-api-client-servlet:2.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.api-client:google-api-client:2.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:gapic-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.67.0=testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.68.0=testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.193.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.193.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -47,7 +46,7 @@ com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.111.0=compileC
 com.google.api.grpc:grpc-google-cloud-spanner-v1:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-storage-control-v2:2.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.67.0=testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.68.0=testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-common-protos:2.65.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha:3.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -68,27 +67,27 @@ com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.111.0=compile
 com.google.api.grpc:proto-google-cloud-spanner-v1:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-storage-control-v2:2.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.67.0=testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.68.0=testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.141.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.141.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-common-protos:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-iam-v1:1.60.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.api.grpc:proto-google-iam-v1:1.65.0=testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.66.0=testCompileClasspath,testRuntimeClasspath
 com.google.api:api-common:2.57.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.api:api-common:2.62.0=testCompileClasspath,testRuntimeClasspath
+com.google.api:api-common:2.63.0=testCompileClasspath,testRuntimeClasspath
 com.google.api:gax-grpc:2.74.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.api:gax-grpc:2.79.0=testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-grpc:2.80.0=testCompileClasspath,testRuntimeClasspath
 com.google.api:gax-httpjson:2.74.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.api:gax-httpjson:2.79.0=testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-httpjson:2.80.0=testCompileClasspath,testRuntimeClasspath
 com.google.api:gax:2.74.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-admin-directory:directory_v1-rev20260227-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-bigquery:v2-rev20251012-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20250606-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-dataflow:v1b3-rev20260405-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-dns:v1-rev20260402-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-drive:v3-rev20260405-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-gmail:v1-rev20260413-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-dns:v1-rev20260421-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-drive:v3-rev20260428-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-gmail:v1-rev20260427-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20220614-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240130-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-iam:v2-rev20250502-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -99,8 +98,10 @@ com.google.apis:google-api-services-sheets:v4-rev20260213-2.0.0=compileClasspath
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20260317-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20251118-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20260204-2.0.0=testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-credentials:1.46.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-oauth2-http:1.46.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-credentials:1.46.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.auth:google-auth-library-credentials:1.47.0=testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-oauth2-http:1.46.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.auth:google-auth-library-oauth2-http:1.47.0=testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service-annotations:1.0.1=nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.auto.service:auto-service-annotations:1.1.1=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service:1.1.1=annotationProcessor
@@ -121,13 +122,13 @@ com.google.cloud:google-cloud-bigquerystorage:3.21.0=compileClasspath,deploy_jar
 com.google.cloud:google-cloud-bigtable:2.73.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-compute:1.82.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-grpc:2.64.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.69.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.70.0=testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-http:2.54.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.cloud:google-cloud-core-http:2.69.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.70.0=testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-firestore:3.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-monitoring:3.85.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-nio:0.131.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-nio:0.132.0=testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-pubsub:1.148.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-secretmanager:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-spanner:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -194,10 +195,10 @@ com.google.oauth-client:google-oauth-client-servlet:1.36.0=deploy_jar,nonprodRun
 com.google.oauth-client:google-oauth-client-servlet:1.39.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.oauth-client:google-oauth-client:1.39.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java-util:4.33.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.protobuf:protobuf-java-util:4.35.0-RC1=testCompileClasspath,testRuntimeClasspath
+com.google.protobuf:protobuf-java-util:4.35.0-RC2=testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java:3.21.7=soy
 com.google.protobuf:protobuf-java:4.33.2=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.protobuf:protobuf-java:4.35.0-RC1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.protobuf:protobuf-java:4.35.0-RC2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.re2j:re2j:1.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.template:soy:2024-02-26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.google.truth:truth:1.4.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -228,8 +229,8 @@ com.squareup:kotlinpoet:1.11.0=annotationProcessor,testAnnotationProcessor
 com.squareup:kotlinpoet:1.15.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.sun.istack:istack-commons-runtime:4.1.2=deploy_jar,jaxb,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.sun.istack:istack-commons-tools:4.1.2=jaxb
-com.sun.xml.bind.external:relaxng-datatype:4.0.7=jaxb
-com.sun.xml.bind.external:rngom:4.0.7=jaxb
+com.sun.xml.bind.external:relaxng-datatype:4.0.8=jaxb
+com.sun.xml.bind.external:rngom:4.0.8=jaxb
 com.sun.xml.dtd-parser:dtd-parser:1.5.1=jaxb
 com.zaxxer:HikariCP:7.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 commons-beanutils:commons-beanutils:1.10.1=checkstyle
@@ -254,41 +255,41 @@ io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,nonprodAnnota
 io.github.java-diff-utils:java-diff-utils:4.16=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.github.ss-bhatt:testcontainers-valkey:1.0.0=testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-alts:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-alts:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-alts:1.81.0=testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-api:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-api:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.81.0=testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-auth:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-auth:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-auth:1.81.0=testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-census:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-context:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-context:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.81.0=testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-core:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-core:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-core:1.81.0=testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-googleapis:1.76.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-googleapis:1.80.0=testRuntimeClasspath
+io.grpc:grpc-googleapis:1.81.0=testRuntimeClasspath
 io.grpc:grpc-grpclb:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-grpclb:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-grpclb:1.81.0=testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-inprocess:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-inprocess:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-inprocess:1.81.0=testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-netty-shaded:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-netty-shaded:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-netty-shaded:1.81.0=testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-netty:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-opentelemetry:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-opentelemetry:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-opentelemetry:1.81.0=testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-protobuf-lite:1.76.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-protobuf-lite:1.80.0=testRuntimeClasspath
+io.grpc:grpc-protobuf-lite:1.81.0=testRuntimeClasspath
 io.grpc:grpc-protobuf:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-protobuf:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf:1.81.0=testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-rls:1.76.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-rls:1.80.0=testRuntimeClasspath
+io.grpc:grpc-rls:1.81.0=testRuntimeClasspath
 io.grpc:grpc-services:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-io.grpc:grpc-services:1.80.0=testRuntimeClasspath
+io.grpc:grpc-services:1.81.0=testRuntimeClasspath
 io.grpc:grpc-stub:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-stub:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-stub:1.81.0=testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-util:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-io.grpc:grpc-util:1.80.0=testRuntimeClasspath
+io.grpc:grpc-util:1.81.0=testRuntimeClasspath
 io.grpc:grpc-xds:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-io.grpc:grpc-xds:1.80.0=testRuntimeClasspath
+io.grpc:grpc-xds:1.81.0=testRuntimeClasspath
 io.netty:netty-buffer:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-codec-http2:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-codec-http:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -320,26 +321,26 @@ io.opentelemetry.instrumentation:opentelemetry-instrumentation-api-incubator:2.1
 io.opentelemetry.instrumentation:opentelemetry-instrumentation-api:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.semconv:opentelemetry-semconv:1.29.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-api:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-api:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-api:1.62.0=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-bom:1.42.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-common:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-common:1.62.0=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-context:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-context:1.60.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-exporter-logging:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-context:1.62.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-exporter-logging:1.62.0=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-extension-incubator:1.35.0-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-sdk-common:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-common:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-common:1.62.0=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.60.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.62.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:1.62.0=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-sdk-logs:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-logs:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-logs:1.62.0=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-sdk-metrics:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-metrics:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-metrics:1.62.0=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-sdk-trace:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-trace:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-trace:1.62.0=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-sdk:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk:1.62.0=testCompileClasspath,testRuntimeClasspath
 io.outfoxx:swiftpoet:1.3.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.perfmark:perfmark-api:0.27.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.protostuff:protostuff-api:1.8.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -348,14 +349,16 @@ io.protostuff:protostuff-core:1.8.0=compileClasspath,deploy_jar,nonprodCompileCl
 io.protostuff:protostuff-runtime:1.8.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 jakarta-regexp:jakarta-regexp:1.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 jakarta.activation:jakarta.activation-api:2.1.4=jaxb
-jakarta.activation:jakarta.activation-api:2.2.0-M1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+jakarta.activation:jakarta.activation-api:2.2.0-M1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+jakarta.activation:jakarta.activation-api:2.2.0-M2=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 jakarta.inject:jakarta.inject-api:2.0.1=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 jakarta.mail:jakarta.mail-api:2.2.0-M1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 jakarta.persistence:jakarta.persistence-api:3.2.0=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 jakarta.servlet:jakarta.servlet-api:6.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 jakarta.transaction:jakarta.transaction-api:2.0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 jakarta.xml.bind:jakarta.xml.bind-api:4.0.4=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-jakarta.xml.bind:jakarta.xml.bind-api:4.0.5=compileClasspath,jaxb,nonprodCompileClasspath,testCompileClasspath
+jakarta.xml.bind:jakarta.xml.bind-api:4.0.5=jaxb
+jakarta.xml.bind:jakarta.xml.bind-api:4.1.0-M1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 javax.annotation:javax.annotation-api:1.3.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 javax.annotation:jsr250-api:1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 javax.inject:javax.inject:1=annotationProcessor,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
@@ -366,8 +369,8 @@ junit:junit:4.13.2=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileCl
 net.arnx:nashorn-promise:0.1.1=testRuntimeClasspath
 net.bytebuddy:byte-buddy-agent:1.17.7=testCompileClasspath,testRuntimeClasspath
 net.bytebuddy:byte-buddy:1.17.7=compileClasspath,nonprodCompileClasspath
-net.bytebuddy:byte-buddy:1.17.8=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-net.bytebuddy:byte-buddy:1.18.8-jdk5=testCompileClasspath,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.18.8=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.18.8-jdk5=testCompileClasspath
 net.java.dev.jna:jna:5.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.ltgt.gradle.incap:incap:0.2=annotationProcessor,testAnnotationProcessor
 net.sf.saxon:Saxon-HE:12.5=checkstyle
@@ -428,7 +431,7 @@ org.apache.sshd:sshd-common:3.0.0-M3=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-core:3.0.0-M3=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-scp:3.0.0-M3=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-sftp:3.0.0-M3=testCompileClasspath,testRuntimeClasspath
-org.apache.tomcat:tomcat-annotations-api:11.0.21=testCompileClasspath,testRuntimeClasspath
+org.apache.tomcat:tomcat-annotations-api:11.0.22=testCompileClasspath,testRuntimeClasspath
 org.apache.xbean:xbean-reflect:3.7=checkstyle
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
 org.bouncycastle:bcpg-jdk18on:1.84=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -439,11 +442,10 @@ org.checkerframework:checker-compat-qual:2.5.3=annotationProcessor,compileClassp
 org.checkerframework:checker-compat-qual:2.5.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.19.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 org.checkerframework:checker-qual:3.33.0=soy
-org.checkerframework:checker-qual:3.49.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+org.checkerframework:checker-qual:3.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.49.3=checkstyle
-org.checkerframework:checker-qual:3.52.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.codehaus.mojo:animal-sniffer-annotations:1.24=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-org.codehaus.mojo:animal-sniffer-annotations:1.26=testCompileClasspath,testRuntimeClasspath
+org.codehaus.mojo:animal-sniffer-annotations:1.27=testCompileClasspath,testRuntimeClasspath
 org.codehaus.plexus:plexus-classworlds:2.6.0=checkstyle
 org.codehaus.plexus:plexus-component-annotations:2.1.0=checkstyle
 org.codehaus.plexus:plexus-container-default:2.1.0=checkstyle
@@ -453,43 +455,43 @@ org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,deploy_jar,nonprodCo
 org.eclipse.angus:angus-activation:2.0.3=jaxb
 org.eclipse.angus:angus-activation:2.1.0-M1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.eclipse.angus:jakarta.mail:2.1.0-M1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee10:jetty-ee10-servlet:12.1.8=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee10:jetty-ee10-webapp:12.1.8=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee:jetty-ee-webapp:12.1.8=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-http:12.1.8=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-io:12.1.8=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-security:12.1.8=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-server:12.1.8=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-session:12.1.8=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-util:12.1.8=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-xml:12.1.8=testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-core:12.5.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-database-postgresql:12.5.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.glassfish.jaxb:codemodel:4.0.7=jaxb
+org.eclipse.jetty.ee10:jetty-ee10-servlet:12.1.9=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.ee10:jetty-ee10-webapp:12.1.9=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.ee:jetty-ee-webapp:12.1.9=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-http:12.1.9=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-io:12.1.9=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-security:12.1.9=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-server:12.1.9=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-session:12.1.9=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util:12.1.9=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-xml:12.1.9=testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-core:12.6.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-database-postgresql:12.6.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.glassfish.jaxb:codemodel:4.0.8=jaxb
 org.glassfish.jaxb:jaxb-core:4.0.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.glassfish.jaxb:jaxb-core:4.0.7=jaxb
+org.glassfish.jaxb:jaxb-core:4.0.8=jaxb
 org.glassfish.jaxb:jaxb-runtime:4.0.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.glassfish.jaxb:jaxb-runtime:4.0.7=jaxb
-org.glassfish.jaxb:jaxb-xjc:4.0.7=jaxb
+org.glassfish.jaxb:jaxb-runtime:4.0.8=jaxb
+org.glassfish.jaxb:jaxb-xjc:4.0.8=jaxb
 org.glassfish.jaxb:txw2:4.0.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.glassfish.jaxb:txw2:4.0.7=jaxb
-org.glassfish.jaxb:xsom:4.0.7=jaxb
+org.glassfish.jaxb:txw2:4.0.8=jaxb
+org.glassfish.jaxb:xsom:4.0.8=jaxb
 org.gwtproject:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.hamcrest:hamcrest-core:1.3=nonprodCompileClasspath,nonprodRuntimeClasspath
 org.hamcrest:hamcrest-core:3.0=testCompileClasspath,testRuntimeClasspath
 org.hamcrest:hamcrest-library:3.0=testCompileClasspath,testRuntimeClasspath
 org.hamcrest:hamcrest:2.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 org.hamcrest:hamcrest:3.0=testCompileClasspath,testRuntimeClasspath
-org.hibernate.models:hibernate-models:1.0.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.hibernate.orm:hibernate-ant:7.2.7.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.hibernate.orm:hibernate-core:7.2.7.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.hibernate.orm:hibernate-hikaricp:7.2.7.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.hibernate.models:hibernate-models:1.1.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+org.hibernate.orm:hibernate-ant:7.3.4.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.hibernate.orm:hibernate-core:7.3.4.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.hibernate.orm:hibernate-hikaricp:7.3.4.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jacoco:org.jacoco.agent:0.8.14=jacocoAgent,jacocoAnt
 org.jacoco:org.jacoco.ant:0.8.14=jacocoAnt
 org.jacoco:org.jacoco.core:0.8.14=jacocoAnt
 org.jacoco:org.jacoco.report:0.8.14=jacocoAnt
 org.javassist:javassist:3.28.0-GA=checkstyle
-org.jboss.logging:jboss-logging:3.6.1.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+org.jboss.logging:jboss-logging:3.6.3.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.jcommander:jcommander:2.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-bom:1.4.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-metadata-jvm:2.2.20=annotationProcessor,testAnnotationProcessor
@@ -548,26 +550,26 @@ org.ow2.asm:asm:9.7.1=compileClasspath,nonprodCompileClasspath
 org.ow2.asm:asm:9.8=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm:9.9=jacocoAnt
 org.pcollections:pcollections:4.0.1=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-org.postgresql:postgresql:42.7.10=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.postgresql:postgresql:42.7.11=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.reflections:reflections:0.10.2=checkstyle
 org.rnorth.duct-tape:duct-tape:1.0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-api:4.43.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-chrome-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-chromium-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v145:4.43.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v146:4.43.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v147:4.43.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-edge-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-firefox-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-http:4.43.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-ie-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-java:4.43.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-json:4.43.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-manager:4.43.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-os:4.43.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-remote-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-safari-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-support:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-api:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-chrome-driver:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-chromium-driver:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v146:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v147:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v148:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-edge-driver:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-firefox-driver:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-http:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-ie-driver:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-java:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-json:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-manager:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-os:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-remote-driver:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-safari-driver:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-support:4.44.0=testCompileClasspath,testRuntimeClasspath
 org.slf4j:jcl-over-slf4j:1.7.36=testCompileClasspath,testRuntimeClasspath
 org.slf4j:jul-to-slf4j:1.7.30=testRuntimeClasspath
 org.slf4j:slf4j-api:2.0.17=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -591,12 +593,12 @@ tools.jackson.core:jackson-core:3.1.1=compileClasspath,deploy_jar,nonprodCompile
 tools.jackson.core:jackson-databind:3.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 tools.jackson:jackson-bom:3.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-api:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-diagram:17.10.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-operations:17.10.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-postgresql:17.10.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-text:17.10.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-diagram:17.11.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-operations:17.11.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-postgresql:17.11.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-text:17.11.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-tools:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-utility:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler:17.10.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler:17.11.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 xerces:xmlParserAPIs:2.6.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 empty=devtool,shadow

core/src/main/java/google/registry/batch/BatchModule.java

@@ -54,9 +54,15 @@ public class BatchModule {
   static final int DEFAULT_MAX_QPS = 10;
 
   @Provides
-  @Parameter("url")
-  static String provideUrl(HttpServletRequest req) {
-    return extractRequiredParameter(req, "url");
+  @Parameter("sender")
+  static String provideSender(HttpServletRequest req) {
+    return extractRequiredParameter(req, "sender");
+  }
+
+  @Provides
+  @Parameter("receiver")
+  static String provideReceiver(HttpServletRequest req) {
+    return extractRequiredParameter(req, "receiver");
   }
 
   @Provides

core/src/main/java/google/registry/batch/CannedScriptExecutionAction.java

@@ -16,30 +16,32 @@ package google.registry.batch;
 
 import static google.registry.request.Action.Method.GET;
 import static google.registry.request.Action.Method.POST;
-import static java.nio.charset.StandardCharsets.UTF_8;
 
+import com.google.api.services.gmail.Gmail;
 import com.google.common.flogger.FluentLogger;
+import dagger.Lazy;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.groups.GmailClient;
 import google.registry.request.Action;
 import google.registry.request.Parameter;
 import google.registry.request.Response;
-import google.registry.request.UrlConnectionService;
-import google.registry.request.UrlConnectionUtils;
 import google.registry.request.auth.Auth;
+import google.registry.util.EmailMessage;
+import google.registry.util.Retrier;
 import jakarta.inject.Inject;
-import java.net.URL;
-import javax.net.ssl.HttpsURLConnection;
+import jakarta.mail.internet.AddressException;
+import jakarta.mail.internet.InternetAddress;
 
 /**
  * Action that executes a canned script specified by the caller.
  *
  * <p>This class provides a hook for invoking hard-coded methods. The main use case is to verify in
  * Sandbox and Production environments new features that depend on environment-specific
- * configurations. For example, the {@code DelegatedCredential}, which requires correct GWorkspace
- * configuration, has been tested this way. Since it is a hassle to add or remove endpoints, we keep
- * this class all the time.
+ * configurations.
  *
  * <p>This action can be invoked using the Nomulus CLI command: {@code nomulus -e ${env} curl
- * --service BACKEND -X POST -u '/_dr/task/executeCannedScript}'}
+ * --service BACKEND -X POST -d 'sender=sender@example.com' -d 'receiver=receiver@example.com' -u
+ * '/_dr/task/executeCannedScript'}
  */
 @Action(
     service = Action.Service.BACKEND,
@@ -50,39 +52,50 @@ import javax.net.ssl.HttpsURLConnection;
 public class CannedScriptExecutionAction implements Runnable {
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
-  @Inject UrlConnectionService urlConnectionService;
+  @Inject Lazy<Gmail> gmail;
+  @Inject Retrier retrier;
+
+  @Inject
+  @Config("isEmailSendingEnabled")
+  boolean isEmailSendingEnabled;
+
   @Inject Response response;
 
   @Inject
-  @Parameter("url")
-  String url;
+  @Parameter("sender")
+  String sender;
+
+  @Inject
+  @Parameter("receiver")
+  String receiver;
 
   @Inject
   CannedScriptExecutionAction() {}
 
   @Override
   public void run() {
-    Integer responseCode = null;
-    String responseContent = null;
+    // For b/510340944, validating a new G Workspace user can send email. Code below can be
+    // removed or changed afterward.
     try {
-      logger.atInfo().log("Connecting to: %s", url);
-      HttpsURLConnection connection =
-          (HttpsURLConnection) urlConnectionService.createConnection(new URL(url));
-      responseCode = connection.getResponseCode();
-      logger.atInfo().log("Code: %d", responseCode);
-      logger.atInfo().log("Headers: %s", connection.getHeaderFields());
-      responseContent = new String(UrlConnectionUtils.getResponseBytes(connection), UTF_8);
-      logger.atInfo().log("Response: %s", responseContent);
+      logger.atInfo().log("Sending email from %s to %s", sender, receiver);
+      GmailClient gmailClient =
+          new GmailClient(
+              gmail, retrier, isEmailSendingEnabled, sender, sender, new InternetAddress(sender));
+      gmailClient.sendEmail(
+          EmailMessage.newBuilder()
+              .addRecipient(new InternetAddress(receiver))
+              .setSubject(String.format("Email send test from %s", sender))
+              .setBody(String.format("This is a test email sent from %s to %s.", sender, receiver))
+              .build());
+      response.setPayload("Email sent successfully.");
+    } catch (AddressException e) {
+      logger.atWarning().withCause(e).log(
+          "Invalid email address: sender=%s, receiver=%s", sender, receiver);
+      response.setStatus(400);
+      response.setPayload("Invalid email address provided.");
     } catch (Exception e) {
-      logger.atWarning().withCause(e).log("Connection to %s failed", url);
+      logger.atSevere().withCause(e).log("Failed to send email");
       throw new RuntimeException(e);
-    } finally {
-      if (responseCode != null) {
-        response.setStatus(responseCode);
-      }
-      if (responseContent != null) {
-        response.setPayload(responseContent);
-      }
     }
   }
 }

core/src/main/java/google/registry/batch/DeleteProberDataAction.java

@@ -92,7 +92,7 @@ public class DeleteProberDataAction implements Runnable {
   //    prevents accidental double-map with the same key from immediately deleting active domains)
   //
   // Note: creationTime must be compared to a Java object (CreateAutoTimestamp) but deletionTime can
-  // be compared directly to the SQL timestamp (it's a DateTime)
+  // be compared directly to the SQL timestamp (it's an Instant)
   private static final String DOMAIN_QUERY_STRING =
       "FROM Domain d WHERE d.tld IN :tlds AND d.domainName NOT LIKE 'nic.%%' AND"
           + " (d.subordinateHosts IS NULL OR array_length(d.subordinateHosts) = 0) AND"

core/src/main/java/google/registry/beam/billing/BillingEvent.java

@@ -39,8 +39,8 @@ import org.jetbrains.annotations.NotNull;
  * A record representing a single billable event, parsed from a {@code SchemaAndRecord}.
  *
  * @param id The unique ID for the {@code BillingEvent} associated with this event.
- * @param billingTime The DateTime (in UTC) this event becomes billable.
- * @param eventTime The DateTime (in UTC) this event was generated.
+ * @param billingTime The Instant (in UTC) this event becomes billable.
+ * @param eventTime The Instant (in UTC) this event was generated.
  * @param registrarId The billed registrar's name.
  * @param billingId The billed registrar's billing account key.
  * @param poNumber The Purchase Order number.
@@ -225,7 +225,6 @@ public record BillingEvent(
             "UnitPriceCurrency",
             "PONumber");
 
-
     /** Generates the CSV header for the overall invoice. */
     static String invoiceHeader() {
       return Joiner.on(",").join(INVOICE_HEADERS);

core/src/main/java/google/registry/beam/common/RegistryQuery.java

@@ -22,12 +22,10 @@ import jakarta.persistence.Query;
 import jakarta.persistence.TypedQuery;
 import jakarta.persistence.criteria.CriteriaQuery;
 import java.io.Serializable;
-import java.time.Instant;
 import java.util.Map;
 import java.util.function.Supplier;
 import java.util.stream.Stream;
 import javax.annotation.Nullable;
-import org.joda.time.DateTime;
 
 /** Interface for query instances used by {@link RegistryJpaIO.Read}. */
 public interface RegistryQuery<T> extends Serializable {
@@ -61,11 +59,7 @@ public interface RegistryQuery<T> extends Serializable {
       if (parameters != null) {
         parameters.forEach(
             (key, value) -> {
-              if (value instanceof DateTime dt) {
-                query.setParameter(key, Instant.ofEpochMilli(dt.getMillis()));
-              } else {
-                query.setParameter(key, value);
-              }
+              query.setParameter(key, value);
             });
       }
       JpaTransactionManager.setQueryFetchSize(query, QUERY_FETCH_SIZE);

core/src/main/java/google/registry/beam/rde/RdeIO.java

@@ -220,6 +220,9 @@ public class RdeIO {
           }
         }
 
+        output.write(marshaller.marshalRdeEppParams());
+        counter.increment(RdeResourceType.EPP_PARAMS);
+
         // Output XML that says how many resources were emitted.
         header = counter.makeHeader(tld, mode);
         output.write(marshaller.marshalOrDie(new XjcRdeHeaderElement(header)));

core/src/main/java/google/registry/beam/spec11/SafeBrowsingTransforms.java

@@ -14,7 +14,6 @@
 
 package google.registry.beam.spec11;
 
-import static google.registry.util.DateTimeUtils.toJodaInstant;
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.apache.http.HttpStatus.SC_OK;
 
@@ -132,7 +131,13 @@ public class SafeBrowsingTransforms {
       if (!domainNameInfoBuffer.isEmpty()) {
         ImmutableSet<KV<DomainNameInfo, ThreatMatch>> results = evaluateAndFlush();
         results.forEach(
-            (kv) -> context.output(kv, toJodaInstant(clock.now()), GlobalWindow.INSTANCE));
+            kv -> {
+              // The Apache Beam API requires org.joda.time.Instant here.
+              @SuppressWarnings("UnnecessarilyFullyQualified")
+              org.joda.time.Instant timestamp =
+                  org.joda.time.Instant.ofEpochMilli(clock.nowMillis());
+              context.output(kv, timestamp, GlobalWindow.INSTANCE);
+            });
       }
     }
 

core/src/main/java/google/registry/bsa/persistence/DownloadScheduler.java

@@ -114,11 +114,7 @@ public final class DownloadScheduler {
   }
 
   private boolean isTimeAgain(BsaDownload mostRecent, Duration interval) {
-    return mostRecent
-        .getCreationTime()
-        .plusMillis(interval.toMillis())
-        .minusMillis(CRON_JITTER.toMillis())
-        .isBefore(clock.now());
+    return mostRecent.getCreationTime().plus(interval).minus(CRON_JITTER).isBefore(clock.now());
   }
 
   /**

core/src/main/java/google/registry/cache/CacheMetrics.java

@@ -0,0 +1,51 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import com.google.common.collect.ImmutableSet;
+import com.google.monitoring.metrics.IncrementableMetric;
+import com.google.monitoring.metrics.LabelDescriptor;
+import com.google.monitoring.metrics.MetricRegistryImpl;
+import jakarta.inject.Inject;
+import jakarta.inject.Singleton;
+
+/** Metrics tracking effectiveness of local and remote EPP resource caching. */
+@Singleton
+public class CacheMetrics {
+
+  public enum CacheHitType {
+    LOCAL,
+    REMOTE,
+    MISS,
+    MISS_NONEXISTENT
+  }
+
+  private static final ImmutableSet<LabelDescriptor> LABEL_DESCRIPTORS =
+      ImmutableSet.of(
+          LabelDescriptor.create("cache_name", "The type of the cache (domain/host)."),
+          LabelDescriptor.create("hit_type", "The type of cache hit or miss."));
+
+  private static final IncrementableMetric cacheLookups =
+      MetricRegistryImpl.getDefault()
+          .newIncrementableMetric(
+              "/cache/lookups", "Count of cache lookups", "count", LABEL_DESCRIPTORS);
+
+  @Inject
+  public CacheMetrics() {}
+
+  public void recordLookup(String cacheName, CacheHitType hitType) {
+    cacheLookups.increment(cacheName, hitType.toString());
+  }
+}

core/src/main/java/google/registry/cache/CacheModule.java

@@ -92,22 +92,23 @@ public final class CacheModule {
   @Provides
   @Singleton
   public static DomainCache provideDomainCache(
-      Optional<SimplifiedJedisClient> domainJedisClient, Clock clock) {
-    if (domainJedisClient.isEmpty()) {
+      Optional<SimplifiedJedisClient> jedisClient, Clock clock, CacheMetrics cacheMetrics) {
+    if (jedisClient.isEmpty()) {
       return domainName ->
           ForeignKeyUtils.loadResourceByCache(Domain.class, domainName, clock.now());
     }
-    return new MultilayerDomainCache(domainJedisClient.get(), clock);
+    return new MultilayerDomainCache(jedisClient.get(), clock, cacheMetrics);
   }
 
   @Provides
   @Singleton
-  public static HostCache provideHostCache(Optional<SimplifiedJedisClient> hostJedisClient) {
-    if (hostJedisClient.isEmpty()) {
+  public static HostCache provideHostCache(
+      Optional<SimplifiedJedisClient> jedisClient, CacheMetrics cacheMetrics) {
+    if (jedisClient.isEmpty()) {
       return repoId ->
           Optional.ofNullable(EppResource.loadByCache(VKey.create(Host.class, repoId)));
     }
-    return new MultilayerHostCache(hostJedisClient.get());
+    return new MultilayerHostCache(jedisClient.get(), cacheMetrics);
   }
 
   @Provides

core/src/main/java/google/registry/cache/MultilayerDomainCache.java

@@ -32,8 +32,9 @@ public class MultilayerDomainCache extends MultilayerEppResourceCache<Domain>
 
   private final Clock clock;
 
-  public MultilayerDomainCache(SimplifiedJedisClient jedisClient, Clock clock) {
-    super(jedisClient);
+  public MultilayerDomainCache(
+      SimplifiedJedisClient jedisClient, Clock clock, CacheMetrics cacheMetrics) {
+    super(jedisClient, cacheMetrics);
     this.clock = clock;
   }
 

core/src/main/java/google/registry/cache/MultilayerEppResourceCache.java

@@ -36,9 +36,12 @@ public abstract class MultilayerEppResourceCache<V extends EppResource> {
           .build();
 
   private final SimplifiedJedisClient jedisClient;
+  private final CacheMetrics cacheMetrics;
 
-  protected MultilayerEppResourceCache(SimplifiedJedisClient jedisClient) {
+  protected MultilayerEppResourceCache(
+      SimplifiedJedisClient jedisClient, CacheMetrics cacheMetrics) {
     this.jedisClient = jedisClient;
+    this.cacheMetrics = cacheMetrics;
   }
 
   protected abstract Optional<V> loadFromDatabase(String key);
@@ -51,6 +54,7 @@ public abstract class MultilayerEppResourceCache<V extends EppResource> {
     // hopefully the resource is in the local cache
     Optional<V> possibleValue = Optional.ofNullable(localCache.getIfPresent(key));
     if (possibleValue.isPresent()) {
+      cacheMetrics.recordLookup(clazz.getSimpleName(), CacheMetrics.CacheHitType.LOCAL);
       return possibleValue;
     }
 
@@ -58,19 +62,22 @@ public abstract class MultilayerEppResourceCache<V extends EppResource> {
     possibleValue = jedisClient.get(clazz, key);
     if (possibleValue.isPresent()) {
       localCache.put(key, possibleValue.get());
+      cacheMetrics.recordLookup(clazz.getSimpleName(), CacheMetrics.CacheHitType.REMOTE);
       return possibleValue;
     }
 
     // lastly, try the DB
-    return loadFromDatabase(key)
-        .map(
-            v -> {
-              // Optional has no direct "peek" functionality to fill the caches
-              if (shouldPersistToRemoteCache(v)) {
-                jedisClient.set(new SimplifiedJedisClient.JedisResource<>(key, v));
-              }
-              localCache.put(key, v);
-              return v;
-            });
+    possibleValue = loadFromDatabase(key);
+    if (possibleValue.isEmpty()) {
+      cacheMetrics.recordLookup(clazz.getSimpleName(), CacheMetrics.CacheHitType.MISS_NONEXISTENT);
+      return possibleValue;
+    }
+    V value = possibleValue.get();
+    if (shouldPersistToRemoteCache(value)) {
+      jedisClient.set(new SimplifiedJedisClient.JedisResource<>(key, value));
+    }
+    localCache.put(key, value);
+    cacheMetrics.recordLookup(clazz.getSimpleName(), CacheMetrics.CacheHitType.MISS);
+    return possibleValue;
   }
 }

core/src/main/java/google/registry/cache/MultilayerHostCache.java

@@ -27,8 +27,8 @@ import java.util.Optional;
  */
 public class MultilayerHostCache extends MultilayerEppResourceCache<Host> implements HostCache {
 
-  public MultilayerHostCache(SimplifiedJedisClient jedisClient) {
-    super(jedisClient);
+  public MultilayerHostCache(SimplifiedJedisClient jedisClient, CacheMetrics cacheMetrics) {
+    super(jedisClient, cacheMetrics);
   }
 
   @Override

core/src/main/java/google/registry/config/DelegatedCredentials.java

@@ -155,7 +155,7 @@ public class DelegatedCredentials extends GoogleCredentials {
   @Override
   public AccessToken refreshAccessToken() throws IOException {
     JsonFactory jsonFactory = JSON_FACTORY;
-    long currentTime = clock.now().toEpochMilli();
+    long currentTime = clock.nowMillis();
     String assertion = createAssertion(jsonFactory, currentTime);
 
     GenericData tokenRequest = new GenericData();

core/src/main/java/google/registry/config/RegistryConfig.java

@@ -50,6 +50,7 @@ import java.lang.annotation.Documented;
 import java.lang.annotation.Retention;
 import java.net.URI;
 import java.net.URL;
+import java.time.DayOfWeek;
 import java.time.Duration;
 import java.time.Instant;
 import java.util.Map.Entry;
@@ -57,7 +58,6 @@ import java.util.Optional;
 import java.util.function.Supplier;
 import java.util.stream.Collectors;
 import javax.annotation.Nullable;
-import org.joda.time.DateTimeConstants;
 
 /**
  * Central clearing-house for all configuration.
@@ -271,7 +271,7 @@ public final class RegistryConfig {
     @Provides
     @Config("brdaDayOfWeek")
     public static int provideBrdaDayOfWeek() {
-      return DateTimeConstants.TUESDAY;
+      return DayOfWeek.TUESDAY.getValue();
     }
 
     /**
@@ -1637,7 +1637,6 @@ public final class RegistryConfig {
     return CONFIG_SETTINGS.get().registryPolicy.contactAndHostRoidSuffix;
   }
 
-
   /** A discount for all sunrise domain creates, between 0.0 (no discount) and 1.0 (free). */
   public static double getSunriseDomainCreateDiscount() {
     return CONFIG_SETTINGS.get().registryPolicy.sunriseDomainCreateDiscount;

core/src/main/java/google/registry/config/files/cloud-tasks-queue.xml

@@ -71,7 +71,6 @@
     <max-backoff>180s</max-backoff>
   </queue>
 
-
   <!-- Queue for tasks that communicate with TMCH MarksDB webserver. -->
   <queue>
     <name>marksdb</name>

core/src/main/java/google/registry/flows/EppTlsAction.java

@@ -49,4 +49,3 @@ public class EppTlsAction implements Runnable {
         inputXmlBytes);
   }
 }
-

core/src/main/java/google/registry/flows/StatelessRequestSessionMetadata.java

@@ -71,6 +71,4 @@ public class StatelessRequestSessionMetadata extends SessionMetadata {
     throw new UnsupportedOperationException();
   }
 
-
 }
-

core/src/main/java/google/registry/flows/contact/ContactCheckFlow.java

@@ -14,7 +14,6 @@
 
 package google.registry.flows.contact;
 
-
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;

core/src/main/java/google/registry/flows/contact/ContactCreateFlow.java

@@ -14,7 +14,6 @@
 
 package google.registry.flows.contact;
 
-
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;

core/src/main/java/google/registry/flows/contact/ContactDeleteFlow.java

@@ -14,7 +14,6 @@
 
 package google.registry.flows.contact;
 
-
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;

core/src/main/java/google/registry/flows/contact/ContactInfoFlow.java

@@ -14,7 +14,6 @@
 
 package google.registry.flows.contact;
 
-
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;

core/src/main/java/google/registry/flows/contact/ContactTransferApproveFlow.java

@@ -14,7 +14,6 @@
 
 package google.registry.flows.contact;
 
-
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;

core/src/main/java/google/registry/flows/contact/ContactTransferCancelFlow.java

@@ -14,7 +14,6 @@
 
 package google.registry.flows.contact;
 
-
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;

core/src/main/java/google/registry/flows/contact/ContactTransferQueryFlow.java

@@ -14,7 +14,6 @@
 
 package google.registry.flows.contact;
 
-
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;

core/src/main/java/google/registry/flows/contact/ContactTransferRejectFlow.java

@@ -14,7 +14,6 @@
 
 package google.registry.flows.contact;
 
-
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;

core/src/main/java/google/registry/flows/contact/ContactTransferRequestFlow.java

@@ -14,7 +14,6 @@
 
 package google.registry.flows.contact;
 
-
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;

core/src/main/java/google/registry/flows/contact/ContactUpdateFlow.java

@@ -14,7 +14,6 @@
 
 package google.registry.flows.contact;
 
-
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;

core/src/main/java/google/registry/groups/GmailClient.java

@@ -56,8 +56,9 @@ public final class GmailClient {
   private final InternetAddress outgoingEmailAddressWithUsername;
   private final InternetAddress replyToEmailAddress;
 
+  // TODO(b/510340944): make package private after feature is rolled out
   @Inject
-  GmailClient(
+  public GmailClient(
       Lazy<Gmail> gmail,
       Retrier retrier,
       @Config("isEmailSendingEnabled") boolean isEmailSendingEnabled,

core/src/main/java/google/registry/keyring/api/KeySerializer.java

@@ -41,7 +41,6 @@ import org.bouncycastle.openpgp.operator.jcajce.JcaPGPDigestCalculatorProviderBu
  */
 public final class KeySerializer {
 
-
   private KeySerializer() {}
 
   /**

core/src/main/java/google/registry/loadtest/LoadTestModule.java

@@ -21,7 +21,6 @@ import dagger.Module;
 import dagger.Provides;
 import google.registry.request.Parameter;
 import jakarta.servlet.http.HttpServletRequest;
-import org.joda.time.Minutes;
 
 /**
  * Dagger module for loadtest package.
@@ -42,15 +41,13 @@ public final class LoadTestModule {
   @Provides
   @Parameter("delaySeconds")
   static int provideDelaySeconds(HttpServletRequest req) {
-    return extractOptionalIntParameter(req, "delaySeconds")
-        .orElse(Minutes.ONE.toStandardSeconds().getSeconds());
+    return extractOptionalIntParameter(req, "delaySeconds").orElse(60);
   }
 
   @Provides
   @Parameter("runSeconds")
   static int provideRunSeconds(HttpServletRequest req) {
-    return extractOptionalIntParameter(req, "runSeconds")
-        .orElse(Minutes.ONE.toStandardSeconds().getSeconds());
+    return extractOptionalIntParameter(req, "runSeconds").orElse(60);
   }
 
   @Provides

core/src/main/java/google/registry/model/common/Cursor.java

@@ -90,9 +90,9 @@ public class Cursor extends UpdateAutoTimestampEntity {
     RECURRING_BILLING(false),
 
     /**
-     * Cursor for {@link google.registry.export.sheet.SyncRegistrarsSheetAction}. The DateTime
-     * stored is the last time that registrar changes were successfully synced to the sheet. If
-     * there were no changes since the last time the action run, the cursor is not updated.
+     * Cursor for {@link google.registry.export.sheet.SyncRegistrarsSheetAction}. The Instant stored
+     * is the last time that registrar changes were successfully synced to the sheet. If there were
+     * no changes since the last time the action run, the cursor is not updated.
      */
     SYNC_REGISTRAR_SHEET(false),
 

core/src/main/java/google/registry/model/common/TimeOfYear.java

@@ -33,7 +33,7 @@ import jakarta.persistence.Embeddable;
 import java.time.Instant;
 import java.time.LocalDate;
 import java.time.LocalTime;
-import java.time.ZonedDateTime;
+import java.time.OffsetDateTime;
 import java.util.List;
 
 /**
@@ -63,7 +63,7 @@ public class TimeOfYear extends ImmutableObject implements UnsafeSerializable {
    * February 28. It is impossible to construct a {@link TimeOfYear} for February 29th.
    */
   public static TimeOfYear fromInstant(Instant instant) {
-    ZonedDateTime zdt = ZonedDateTime.ofInstant(instant, UTC);
+    OffsetDateTime zdt = OffsetDateTime.ofInstant(instant, UTC);
     int month = zdt.getMonthValue();
     int day = zdt.getDayOfMonth();
     if (month == 2 && day == 29) {
@@ -88,8 +88,8 @@ public class TimeOfYear extends ImmutableObject implements UnsafeSerializable {
     Range<Instant> normalizedRange = range.intersection(Range.closed(START_INSTANT, END_INSTANT));
     Range<Integer> yearRange =
         Range.closed(
-            ZonedDateTime.ofInstant(normalizedRange.lowerEndpoint(), UTC).getYear(),
-            ZonedDateTime.ofInstant(normalizedRange.upperEndpoint(), UTC).getYear());
+            OffsetDateTime.ofInstant(normalizedRange.lowerEndpoint(), UTC).getYear(),
+            OffsetDateTime.ofInstant(normalizedRange.upperEndpoint(), UTC).getYear());
     return ContiguousSet.create(yearRange, integers()).stream()
         .map(this::toInstantWithYear)
         .filter(normalizedRange)
@@ -112,13 +112,13 @@ public class TimeOfYear extends ImmutableObject implements UnsafeSerializable {
 
   /** Get the first {@link Instant} with this month/day/millis that is at or after the start. */
   public Instant getNextInstanceAtOrAfter(Instant start) {
-    Instant withSameYear = toInstantWithYear(ZonedDateTime.ofInstant(start, UTC).getYear());
+    Instant withSameYear = toInstantWithYear(OffsetDateTime.ofInstant(start, UTC).getYear());
     return isAtOrAfter(withSameYear, start) ? withSameYear : plusYears(withSameYear, 1);
   }
 
   /** Get the first {@link Instant} with this month/day/millis that is at or before the end. */
   public Instant getLastInstanceBeforeOrAt(Instant end) {
-    Instant withSameYear = toInstantWithYear(ZonedDateTime.ofInstant(end, UTC).getYear());
+    Instant withSameYear = toInstantWithYear(OffsetDateTime.ofInstant(end, UTC).getYear());
     return isBeforeOrAt(withSameYear, end) ? withSameYear : minusYears(withSameYear, 1);
   }
 

core/src/main/java/google/registry/model/contact/package-info.java

@@ -17,9 +17,7 @@
     xmlns = @XmlNs(prefix = "contact", namespaceURI = "urn:ietf:params:xml:ns:contact-1.0"),
     elementFormDefault = XmlNsForm.QUALIFIED)
 @XmlAccessorType(XmlAccessType.FIELD)
-@XmlJavaTypeAdapters({
-  @XmlJavaTypeAdapter(UtcInstantAdapter.class)
-})
+@XmlJavaTypeAdapters({@XmlJavaTypeAdapter(UtcInstantAdapter.class)})
 package google.registry.model.contact;
 
 import google.registry.xml.UtcInstantAdapter;

core/src/main/java/google/registry/model/domain/Domain.java

@@ -14,7 +14,6 @@
 
 package google.registry.model.domain;
 
-
 import google.registry.model.EppResource;
 import google.registry.model.EppResource.ForeignKeyedEppResource;
 import google.registry.model.annotations.ExternalMessagingName;
@@ -145,6 +144,7 @@ public class Domain extends DomainBase implements ForeignKeyedEppResource {
     // TODO(b/188044616): Determine why Eager loading doesn't work here.
     Hibernate.initialize(dsData);
     Hibernate.initialize(gracePeriods);
+    Hibernate.initialize(nsHosts);
   }
 
   @Override

core/src/main/java/google/registry/model/domain/DomainBase.java

@@ -246,7 +246,7 @@ public class DomainBase extends EppResource {
    *
    * <p>When a domain is scheduled to not autorenew, this field is set to the current value of its
    * {@link #registrationExpirationTime}, after which point the next invocation of a periodic
-   * cronjob will explicitly delete the domain. This field is a DateTime and not a boolean because
+   * cronjob will explicitly delete the domain. This field is an Instant and not a boolean because
    * of edge cases that occur during the autorenew grace period. We need to be able to tell the
    * difference domains that have reached their life and must be deleted now, and domains that
    * happen to be in the autorenew grace period now but should be deleted in roughly a year.
@@ -358,13 +358,7 @@ public class DomainBase extends EppResource {
     return nullToEmptyImmutableCopy(nsHosts);
   }
 
-  // Hibernate needs this in order to populate nsHosts but no one else should ever use it
-  @SuppressWarnings("unused")
-  private void setNsHosts(Set<VKey<Host>> nsHosts) {
-    this.nsHosts = forceEmptyToNull(nsHosts);
-  }
-
-  // Note: for the two methods below, how we wish to treat the Hibernate setters depends on the
+  // Note: for the three methods below, how we wish to treat the Hibernate setters depends on the
   // current state of the object and what's passed in. The key principle is that we wish to maintain
   // the link between parent and child objects, meaning that we should keep around whichever of the
   // two sets (the parameter vs the class variable and clear/populate that as appropriate).
@@ -373,6 +367,20 @@ public class DomainBase extends EppResource {
   // an exception "A collection with cascade=”all-delete-orphan” was no longer referenced by the
   // owning entity instance". See https://stackoverflow.com/questions/5587482 for more details.
 
+  // Hibernate needs this in order to populate nsHosts but no one else should ever use it
+  @SuppressWarnings("unused")
+  private void setNsHosts(Set<VKey<Host>> nsHosts) {
+    if (this.nsHosts instanceof PersistentSet) {
+      Set<VKey<Host>> nonNullNsHosts = nullToEmpty(nsHosts);
+      this.nsHosts.retainAll(nonNullNsHosts);
+      this.nsHosts.addAll(nonNullNsHosts);
+    } else if (nsHosts instanceof PersistentSet) {
+      this.nsHosts = nsHosts;
+    } else {
+      this.nsHosts = forceEmptyToNull(nsHosts);
+    }
+  }
+
   // Hibernate needs this in order to populate gracePeriods but no one else should ever use it
   @SuppressWarnings("unused")
   private void setInternalGracePeriods(Set<GracePeriod> gracePeriods) {
@@ -642,6 +650,7 @@ public class DomainBase extends EppResource {
       // cascadable operations and orphan removal.
       newDomain.gracePeriods =
           newDomain.gracePeriods == null ? ImmutableSet.of() : newDomain.gracePeriods;
+      newDomain.nsHosts = newDomain.nsHosts == null ? ImmutableSet.of() : newDomain.nsHosts;
       newDomain.dsData =
           newDomain.dsData == null
               ? ImmutableSet.of()

core/src/main/java/google/registry/model/domain/DomainRenewData.java

@@ -14,7 +14,6 @@
 
 package google.registry.model.domain;
 
-
 import google.registry.model.eppoutput.EppResponse.ResponseData;
 import google.registry.xml.UtcInstantAdapter;
 import jakarta.xml.bind.annotation.XmlElement;

core/src/main/java/google/registry/model/domain/GracePeriodBase.java

@@ -14,7 +14,6 @@
 
 package google.registry.model.domain;
 
-
 import google.registry.model.ImmutableObject;
 import google.registry.model.UnsafeSerializable;
 import google.registry.model.billing.BillingEvent;

core/src/main/java/google/registry/model/domain/fee/BaseFee.java

@@ -31,8 +31,8 @@ import jakarta.xml.bind.annotation.XmlValue;
 import jakarta.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
 import java.math.BigDecimal;
 import java.time.Instant;
+import java.time.Period;
 import java.util.stream.Stream;
-import org.joda.time.Period;
 
 /** Base class for the fee and credit types. */
 @XmlTransient

core/src/main/java/google/registry/model/domain/fee/FeeCheckResponseExtensionItem.java

@@ -34,4 +34,3 @@ public abstract class FeeCheckResponseExtensionItem extends FeeQueryResponseExte
     }
   }
 }
-

core/src/main/java/google/registry/model/domain/fee06/FeeInfoCommandExtensionV06.java

@@ -69,4 +69,3 @@ public class FeeInfoCommandExtensionV06
     return Optional.empty();
   }
 }
-

core/src/main/java/google/registry/model/domain/fee06/FeeInfoResponseExtensionV06.java

@@ -36,7 +36,6 @@ public class FeeInfoResponseExtensionV06
   /** The command that was checked. */
   FeeExtensionCommandDescriptor command;
 
-
   /** Builder for {@link FeeInfoResponseExtensionV06}. */
   public static class Builder
       extends FeeQueryResponseExtensionItem.Builder<FeeInfoResponseExtensionV06, Builder> {

core/src/main/java/google/registry/model/domain/fee11/FeeCheckResponseExtensionV11.java

@@ -34,7 +34,6 @@ public class FeeCheckResponseExtensionV11
   @XmlElement(name = "cd")
   ImmutableList<FeeCheckResponseExtensionItemV11> items;
 
-
   @Override
   public void setCurrencyIfSupported(CurrencyUnit currency) {}
 

core/src/main/java/google/registry/model/domain/launch/package-info.java

@@ -17,9 +17,7 @@
     xmlns = @XmlNs(prefix = "launch", namespaceURI = "urn:ietf:params:xml:ns:launch-1.0"),
     elementFormDefault = XmlNsForm.QUALIFIED)
 @XmlAccessorType(XmlAccessType.FIELD)
-@XmlJavaTypeAdapters({
-  @XmlJavaTypeAdapter(UtcInstantAdapter.class)
-})
+@XmlJavaTypeAdapters({@XmlJavaTypeAdapter(UtcInstantAdapter.class)})
 package google.registry.model.domain.launch;
 
 import google.registry.xml.UtcInstantAdapter;

core/src/main/java/google/registry/model/domain/token/AllocationToken.java

@@ -335,8 +335,6 @@ public class AllocationToken extends UpdateAutoTimestampEntity implements Builda
     return tokenType;
   }
 
-
-
   @JsonIgnore
   public TimedTransitionProperty<TokenStatus> getTokenStatusTransitions() {
     return tokenStatusTransitions;

core/src/main/java/google/registry/model/eppinput/package-info.java

@@ -17,9 +17,7 @@
     xmlns = @XmlNs(prefix = "", namespaceURI = "urn:ietf:params:xml:ns:epp-1.0"),
     elementFormDefault = XmlNsForm.QUALIFIED)
 @XmlAccessorType(XmlAccessType.FIELD)
-@XmlJavaTypeAdapters({
-  @XmlJavaTypeAdapter(UtcInstantAdapter.class)
-})
+@XmlJavaTypeAdapters({@XmlJavaTypeAdapter(UtcInstantAdapter.class)})
 package google.registry.model.eppinput;
 
 import google.registry.xml.UtcInstantAdapter;

core/src/main/java/google/registry/model/eppoutput/package-info.java

@@ -17,9 +17,7 @@
     xmlns = @XmlNs(prefix = "", namespaceURI = "urn:ietf:params:xml:ns:epp-1.0"),
     elementFormDefault = XmlNsForm.QUALIFIED)
 @XmlAccessorType(XmlAccessType.FIELD)
-@XmlJavaTypeAdapters({
-  @XmlJavaTypeAdapter(UtcInstantAdapter.class)
-})
+@XmlJavaTypeAdapters({@XmlJavaTypeAdapter(UtcInstantAdapter.class)})
 package google.registry.model.eppoutput;
 
 import google.registry.xml.UtcInstantAdapter;

core/src/main/java/google/registry/model/poll/PollMessageExternalKeyConverter.java

@@ -18,7 +18,7 @@ import static java.time.ZoneOffset.UTC;
 
 import com.google.common.base.Splitter;
 import google.registry.persistence.VKey;
-import java.time.ZonedDateTime;
+import java.time.OffsetDateTime;
 import java.util.List;
 
 /**
@@ -46,7 +46,7 @@ public final class PollMessageExternalKeyConverter {
   public static String makePollMessageExternalId(PollMessage pollMessage) {
     return String.format(
         "%d-%d",
-        pollMessage.getId(), ZonedDateTime.ofInstant(pollMessage.getEventTime(), UTC).getYear());
+        pollMessage.getId(), OffsetDateTime.ofInstant(pollMessage.getEventTime(), UTC).getYear());
   }
 
   /**

core/src/main/java/google/registry/model/poll/package-info.java

@@ -17,9 +17,7 @@
     xmlns = @XmlNs(prefix = "", namespaceURI = "urn:ietf:params:xml:ns:epp-1.0"),
     elementFormDefault = XmlNsForm.QUALIFIED)
 @XmlAccessorType(XmlAccessType.FIELD)
-@XmlJavaTypeAdapters({
-  @XmlJavaTypeAdapter(UtcInstantAdapter.class)
-})
+@XmlJavaTypeAdapters({@XmlJavaTypeAdapter(UtcInstantAdapter.class)})
 package google.registry.model.poll;
 
 import google.registry.xml.UtcInstantAdapter;

core/src/main/java/google/registry/model/transfer/BaseTransferObject.java

@@ -14,7 +14,6 @@
 
 package google.registry.model.transfer;
 
-
 import google.registry.model.Buildable.GenericBuilder;
 import google.registry.model.ImmutableObject;
 import google.registry.model.UnsafeSerializable;

core/src/main/java/google/registry/model/transfer/TransferResponse.java

@@ -14,7 +14,6 @@
 
 package google.registry.model.transfer;
 
-
 import google.registry.model.EppResource;
 import google.registry.model.eppoutput.EppResponse.ResponseData;
 import google.registry.xml.UtcInstantAdapter;

core/src/main/java/google/registry/model/transfer/package-info.java

@@ -17,9 +17,7 @@
     xmlns = @XmlNs(prefix = "", namespaceURI = "urn:ietf:params:xml:ns:epp-1.0"),
     elementFormDefault = XmlNsForm.QUALIFIED)
 @XmlAccessorType(XmlAccessType.FIELD)
-@XmlJavaTypeAdapters({
-  @XmlJavaTypeAdapter(UtcInstantAdapter.class)
-})
+@XmlJavaTypeAdapters({@XmlJavaTypeAdapter(UtcInstantAdapter.class)})
 package google.registry.model.transfer;
 
 import google.registry.xml.UtcInstantAdapter;

core/src/main/java/google/registry/monitoring/whitebox/CheckApiMetric.java

@@ -81,7 +81,6 @@ public record CheckApiMetric(
     }
   }
 
-
   public static Builder builder(Clock clock) {
     return new AutoBuilder_CheckApiMetric_Builder().startTimestamp(clock.now()).setClock(clock);
   }

core/src/main/java/google/registry/persistence/converter/DateTimeConverter.java

@@ -1,43 +0,0 @@
-// Copyright 2019 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.persistence.converter;
-import static org.joda.time.DateTimeZone.UTC;
-
-import jakarta.persistence.AttributeConverter;
-import jakarta.persistence.Converter;
-import java.time.Instant;
-import java.time.ZoneOffset;
-import java.time.ZonedDateTime;
-import javax.annotation.Nullable;
-import org.joda.time.DateTime;
-
-/** JPA converter to for storing/retrieving {@link org.joda.time.DateTime} objects. */
-@Converter(autoApply = true)
-public class DateTimeConverter implements AttributeConverter<DateTime, ZonedDateTime> {
-
-  @Override
-  @Nullable
-  public ZonedDateTime convertToDatabaseColumn(@Nullable DateTime attribute) {
-    return attribute == null
-        ? null
-        : ZonedDateTime.ofInstant(Instant.ofEpochMilli(attribute.getMillis()), ZoneOffset.UTC);
-  }
-
-  @Override
-  @Nullable
-  public DateTime convertToEntityAttribute(@Nullable ZonedDateTime dbData) {
-    return (dbData == null) ? null : new DateTime(dbData.toInstant().toEpochMilli(), UTC);
-  }
-}

core/src/main/java/google/registry/persistence/converter/MapUserType.java

@@ -14,7 +14,6 @@
 
 package google.registry.persistence.converter;
 
-
 import java.io.Serializable;
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;

core/src/main/java/google/registry/privileges/secretmanager/SecretManagerModule.java

@@ -14,7 +14,6 @@
 
 package google.registry.privileges.secretmanager;
 
-
 import com.google.cloud.secretmanager.v1.SecretManagerServiceClient;
 import com.google.cloud.secretmanager.v1.SecretManagerServiceSettings;
 import dagger.Module;

core/src/main/java/google/registry/rdap/AbstractJsonableObject.java

@@ -40,7 +40,6 @@ import java.util.HashSet;
 import java.util.Map;
 import java.util.Optional;
 import javax.annotation.Nullable;
-import org.joda.time.DateTime;
 
 /**
  * An Jsonable that can turn itself into a JSON object using reflection.
@@ -53,16 +52,12 @@ import org.joda.time.DateTime;
  * will be "JSONified" and added to the generated JSON object.
  *
  * <p>This implementation is geared towards RDAP replies, and hence has RDAP-specific quirks.
- * Specifically:
- * - Fields with empty arrays are not shown at all
- * - VCards are a built-in special case (Not implemented yet)
- * - DateTime conversion is specifically supported as if it were a primitive
- * - Arrays are considered to be SETS rather than lists, meaning repeated values are removed and the
- *   order isn't guaranteed
+ * Specifically: - Fields with empty arrays are not shown at all - VCards are a built-in special
+ * case (Not implemented yet) - Instant conversion is specifically supported as if it were a
+ * primitive - Arrays are considered to be SETS rather than lists, meaning repeated values are
+ * removed and the order isn't guaranteed
  *
- * Usage:
- * {@link JsonableElement}
- * -----------------------
+ * <p>Usage: {@link JsonableElement} -----------------------
  *
  * <pre>
  * - JsonableElement annotates Members that become JSON object fields:
@@ -90,7 +85,7 @@ import org.joda.time.DateTime;
  *   "b": "value1"
  * }
  *
- * - the supported object types are String, Boolean, Number, DateTime, Jsonable. In addition,
+ * - the supported object types are String, Boolean, Number, Instant, Jsonable. In addition,
  *   Iterable and Optional are respected.
  *
  * - An Optional that's empty is skipped, while a present Optional acts exactly like the object it
@@ -134,8 +129,7 @@ import org.joda.time.DateTime;
  * }
  * </pre>
  *
- * {@link RestrictJsonNames}
- * -------------------------
+ * {@link RestrictJsonNames} -------------------------
  *
  * <pre>
  * - RestrictJsonNames is a way to prevent typos in the JsonableElement names.
@@ -334,12 +328,6 @@ abstract class AbstractJsonableObject implements Jsonable {
     if (object instanceof Boolean b) {
       return new JsonPrimitive(b);
     }
-    if (object instanceof DateTime) {
-      // According to RFC 9083 section 3, the syntax of dates and times is defined in RFC3339.
-      //
-      // According to RFC3339, we should use ISO8601, which is what DateTime.toString does!
-      return new JsonPrimitive(object.toString());
-    }
     if (object instanceof Instant instant) {
       // According to RFC 9083 section 3, the syntax of dates and times is defined in RFC3339.
       //

core/src/main/java/google/registry/rdap/RdapActionBase.java

@@ -32,6 +32,7 @@ import com.google.gson.GsonBuilder;
 import com.google.gson.JsonArray;
 import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
+import google.registry.cache.DomainCache;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.EppResource;
 import google.registry.model.registrar.Registrar;
@@ -88,6 +89,7 @@ public abstract class RdapActionBase implements Runnable {
   @Inject @Parameter("formatOutput") Optional<Boolean> formatOutputParam;
   @Inject @Config("rdapResultSetMaxSize") int rdapResultSetMaxSize;
   @Inject RdapMetrics rdapMetrics;
+  @Inject DomainCache domainCache;
   @Inject Clock clock;
 
   /** Builder for metric recording. */
@@ -117,14 +119,14 @@ public abstract class RdapActionBase implements Runnable {
   /**
    * Does the actual search and returns an RDAP JSON object.
    *
-   * RFC7480 4.1 - we have to support GET and HEAD.
+   * <p>RFC7480 4.1 - we have to support GET and HEAD.
    *
    * @param pathSearchString the search string in the URL path
    * @param isHeadRequest whether the returned map will actually be used. HTTP HEAD requests don't
-   *        actually return anything. However, we usually still want to go through the process of
-   *        building a map, to make sure that the request would return a 500 status if it were
-   *        invoked using GET. So this field should usually be ignored, unless there's some
-   *        expensive task required to create the map which will never result in a request failure.
+   *     actually return anything. However, we usually still want to go through the process of
+   *     building a map, to make sure that the request would return a 500 status if it were invoked
+   *     using GET. So this field should usually be ignored, unless there's some expensive task
+   *     required to create the map which will never result in a request failure.
    * @return A map (probably containing nested maps and lists) with the final JSON response data.
    */
   abstract ReplyPayloadBase getJsonObjectForResource(

core/src/main/java/google/registry/rdap/RdapDataStructures.java

@@ -244,7 +244,6 @@ final class RdapDataStructures {
 
     @JsonableElement abstract ImmutableList<Link> links();
 
-
     abstract static class Builder<B extends Builder<?>> {
       abstract B setEventAction(EventAction eventAction);
 
@@ -304,7 +303,6 @@ final class RdapDataStructures {
       return new AutoValue_RdapDataStructures_EventWithoutActor.Builder();
     }
 
-
     @AutoValue.Builder
     abstract static class Builder extends EventBase.Builder<Builder> {
       abstract EventWithoutActor build();
@@ -321,7 +319,6 @@ final class RdapDataStructures {
       return new AutoValue_RdapDataStructures_Event.Builder();
     }
 
-
     @AutoValue.Builder
     abstract static class Builder extends EventBase.Builder<Builder> {
       abstract Builder setEventActor(String eventActor);

core/src/main/java/google/registry/rdap/RdapDomainAction.java

@@ -67,10 +67,9 @@ public class RdapDomainAction extends RdapActionBase {
     }
     // The query string is not used; the RDAP syntax is /rdap/domain/mydomain.com.
     Optional<Domain> domain =
-        ForeignKeyUtils.loadResourceByCache(
-            Domain.class,
-            pathSearchString,
-            shouldIncludeDeleted() ? START_INSTANT : getRequestTime());
+        shouldIncludeDeleted() // the remote domain cache cannot handle times in the past
+            ? ForeignKeyUtils.loadResourceByCache(Domain.class, pathSearchString, START_INSTANT)
+            : domainCache.loadByDomainName(pathSearchString);
     if (domain.isEmpty() || !isAuthorized(domain.get())) {
       handlePossibleBsaBlock(domainName);
       // RFC7480 5.3 - if the server wishes to respond that it doesn't have data satisfying the

core/src/main/java/google/registry/rdap/RdapDomainSearchAction.java

@@ -181,11 +181,10 @@ public class RdapDomainSearchAction extends RdapSearchActionBase {
   /** Searches for domains by domain name without a wildcard or interest in deleted entries. */
   private DomainSearchResponse searchByDomainNameWithoutWildcard(
       final RdapSearchPattern partialStringQuery) {
-    Optional<Domain> domain =
-        ForeignKeyUtils.loadResourceByCache(
-            Domain.class, partialStringQuery.getInitialString(), getRequestTime());
     return makeSearchResults(
-        shouldBeVisible(domain) ? ImmutableList.of(domain.get()) : ImmutableList.of());
+        domainCache.loadByDomainName(partialStringQuery.getInitialString()).stream()
+            .filter(this::shouldBeVisible)
+            .toList());
   }
 
   /** Searches for domains by domain name with an initial string, wildcard and possible suffix. */
@@ -359,8 +358,8 @@ public class RdapDomainSearchAction extends RdapSearchActionBase {
     // through the subordinate hosts. This is more efficient, and lets us permit wildcard searches
     // with no initial string.
     Domain domain =
-        ForeignKeyUtils.loadResourceByCache(
-                Domain.class, partialStringQuery.getSuffix(), timeToQuery)
+        domainCache
+            .loadByDomainName(partialStringQuery.getSuffix())
             .orElseThrow(
                 () ->
                     new UnprocessableEntityException(

core/src/main/java/google/registry/rdap/RdapJsonFormatter.java

@@ -32,6 +32,7 @@ import com.google.common.collect.Streams;
 import com.google.common.flogger.FluentLogger;
 import com.google.common.net.InetAddresses;
 import com.google.gson.JsonArray;
+import google.registry.cache.HostCache;
 import google.registry.config.RegistryConfig;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.CacheUtils;
@@ -122,6 +123,7 @@ public class RdapJsonFormatter {
   @Inject @RequestServerName String serverName;
   @Inject RdapAuthorization rdapAuthorization;
   @Inject Clock clock;
+  @Inject HostCache hostCache;
 
   @Inject
   RdapJsonFormatter() {}
@@ -393,20 +395,11 @@ public class RdapJsonFormatter {
           domain.getDomainName(), domain.getRepoId());
     }
 
-    // We're just trying to load the hosts by cache here, but the generics and casting require
-    // a lot of boilerplate to make the compiler happy
-    Iterable<VKey<? extends EppResource>> nameservers =
-        ImmutableSet.copyOf(domain.getNameservers());
     ImmutableSet<Host> loadedHosts =
-        replicaTm()
-            .transact(
-                () -> {
-                  ImmutableSet.Builder<Host> hostBuilder = new ImmutableSet.Builder<>();
-                  for (EppResource host : EppResource.loadByCacheIfEnabled(nameservers).values()) {
-                    hostBuilder.add((Host) host);
-                  }
-                  return hostBuilder.build();
-                });
+        domain.getNameservers().stream()
+            .map(key -> hostCache.loadByRepoId((String) key.getKey()))
+            .flatMap(Optional::stream)
+            .collect(toImmutableSet());
 
     // Add the nameservers to the data; the load was kicked off above for efficiency.
     // RDAP Response Profile 2.8: we MUST have the nameservers

core/src/main/java/google/registry/rdap/RdapMetrics.java

@@ -272,7 +272,6 @@ public class RdapMetrics {
       RdapMetricInformation build();
     }
 
-
     static Builder builder() {
       return new AutoBuilder_RdapMetrics_RdapMetricInformation_Builder()
           .setSearchType(SearchType.NONE)

core/src/main/java/google/registry/rdap/RdapNameserverSearchAction.java

@@ -175,9 +175,7 @@ public class RdapNameserverSearchAction extends RdapSearchActionBase {
   /** Searches for nameservers by name using the superordinate domain as a suffix. */
   private NameserverSearchResponse searchByNameUsingSuperordinateDomain(
       RdapSearchPattern partialStringQuery) {
-    Optional<Domain> domain =
-        ForeignKeyUtils.loadResourceByCache(
-            Domain.class, partialStringQuery.getSuffix(), getRequestTime());
+    Optional<Domain> domain = domainCache.loadByDomainName(partialStringQuery.getSuffix());
     if (domain.isEmpty()) {
       // Don't allow wildcards with suffixes which are not domains we manage. That would risk a
       // table scan in many easily foreseeable cases. The user might ask for ns*.zombo.com,

core/src/main/java/google/registry/rdap/RdapObjectClasses.java

@@ -235,7 +235,6 @@ final class RdapObjectClasses {
       this.objectClassName = objectClassName;
     }
 
-
     abstract static class Builder<B extends Builder<?>> {
       abstract B setHandle(String handle);
       abstract ImmutableList.Builder<PublicId> publicIdsBuilder();

core/src/main/java/google/registry/rdap/RdapSearchPattern.java

@@ -14,7 +14,6 @@
 
 package google.registry.rdap;
 
-
 import com.google.common.base.Strings;
 import google.registry.request.HttpException.BadRequestException;
 import google.registry.request.HttpException.UnprocessableEntityException;

core/src/main/java/google/registry/rde/BrdaCopyAction.java

@@ -14,7 +14,6 @@
 
 package google.registry.rde;
 
-
 import static google.registry.model.common.Cursor.CursorType.BRDA;
 import static google.registry.model.common.Cursor.getCursorTimeOrStartOfTime;
 import static google.registry.model.rde.RdeMode.THIN;

core/src/main/java/google/registry/rde/PendingDeposit.java

@@ -14,7 +14,6 @@
 
 package google.registry.rde;
 
-
 import google.registry.model.common.Cursor.CursorType;
 import google.registry.model.rde.RdeMode;
 import java.io.IOException;

core/src/main/java/google/registry/rde/RdeMarshaller.java

@@ -20,15 +20,26 @@ import static java.nio.charset.StandardCharsets.UTF_8;
 import com.google.common.flogger.FluentLogger;
 import google.registry.model.ImmutableObject;
 import google.registry.model.domain.Domain;
+import google.registry.model.eppcommon.ProtocolDefinition;
 import google.registry.model.host.Host;
 import google.registry.model.rde.RdeMode;
 import google.registry.model.registrar.Registrar;
 import google.registry.tldconfig.idn.IdnTable;
 import google.registry.xjc.XjcXmlTransformer;
+import google.registry.xjc.epp.XjcEppDcpAccessType;
+import google.registry.xjc.epp.XjcEppDcpOursType;
+import google.registry.xjc.epp.XjcEppDcpPurposeType;
+import google.registry.xjc.epp.XjcEppDcpRecipientType;
+import google.registry.xjc.epp.XjcEppDcpRetentionType;
+import google.registry.xjc.epp.XjcEppDcpStatementType;
+import google.registry.xjc.epp.XjcEppDcpType;
+import google.registry.xjc.epp.XjcEppExtURIType;
 import google.registry.xjc.rde.XjcRdeContentsType;
 import google.registry.xjc.rde.XjcRdeDeposit;
 import google.registry.xjc.rde.XjcRdeDepositTypeType;
 import google.registry.xjc.rde.XjcRdeMenuType;
+import google.registry.xjc.rdeeppparams.XjcRdeEppParams;
+import google.registry.xjc.rdeeppparams.XjcRdeEppParamsElement;
 import google.registry.xjc.rdeidn.XjcRdeIdn;
 import google.registry.xjc.rdeidn.XjcRdeIdnElement;
 import google.registry.xjc.rdepolicy.XjcRdePolicy;
@@ -151,6 +162,43 @@ public final class RdeMarshaller implements Serializable {
     return marshalOrDie(new XjcRdeIdnElement(bean));
   }
 
+  public String marshalRdeEppParams() {
+    XjcRdeEppParams bean = new XjcRdeEppParams();
+    bean.getVersions().add("1.0");
+    bean.getLangs().add("en");
+    bean.getObjURIs().add(RdeResourceType.DOMAIN.getUri());
+    bean.getObjURIs().add(RdeResourceType.HOST.getUri());
+
+    XjcEppExtURIType serviceExtensions = new XjcEppExtURIType();
+    serviceExtensions.getExtURIs().addAll(ProtocolDefinition.getVisibleServiceExtensionUris());
+    bean.setSvcExtension(serviceExtensions);
+
+    XjcEppDcpType dcpType = new XjcEppDcpType();
+    XjcEppDcpAccessType accessType = new XjcEppDcpAccessType();
+    accessType.setAll(new XjcEppDcpAccessType.All());
+    dcpType.setAccess(accessType);
+
+    XjcEppDcpStatementType statementType = new XjcEppDcpStatementType();
+
+    XjcEppDcpPurposeType purposeType = new XjcEppDcpPurposeType();
+    purposeType.setAdmin(new XjcEppDcpPurposeType.Admin());
+    purposeType.setProv(new XjcEppDcpPurposeType.Prov());
+    statementType.setPurpose(purposeType);
+
+    XjcEppDcpRecipientType recipientType = new XjcEppDcpRecipientType();
+    recipientType.getOurs().add(new XjcEppDcpOursType());
+    recipientType.setPublic(new XjcEppDcpRecipientType.Public());
+    statementType.setRecipient(recipientType);
+
+    XjcEppDcpRetentionType retentionType = new XjcEppDcpRetentionType();
+    retentionType.setStated(new XjcEppDcpRetentionType.Stated());
+    statementType.setRetention(retentionType);
+
+    dcpType.getStatements().add(statementType);
+    bean.setDcp(dcpType);
+    return marshalOrDie(new XjcRdeEppParamsElement(bean));
+  }
+
   private DepositFragment marshalResource(
       RdeResourceType type, ImmutableObject resource, JAXBElement<?> element) {
     String xml = "";

core/src/main/java/google/registry/rde/RdeReportAction.java

@@ -14,7 +14,6 @@
 
 package google.registry.rde;
 
-
 import static com.google.common.base.Verify.verify;
 import static com.google.common.net.MediaType.PLAIN_TEXT_UTF_8;
 import static google.registry.model.common.Cursor.getCursorTimeOrStartOfTime;

core/src/main/java/google/registry/rde/RdeResourceType.java

@@ -29,7 +29,8 @@ public enum RdeResourceType {
   HOST("urn:ietf:params:xml:ns:rdeHost-1.0", EnumSet.of(FULL)),
   REGISTRAR("urn:ietf:params:xml:ns:rdeRegistrar-1.0", EnumSet.of(FULL, THIN)),
   IDN("urn:ietf:params:xml:ns:rdeIDN-1.0", EnumSet.of(FULL)),
-  HEADER("urn:ietf:params:xml:ns:rdeHeader-1.0", EnumSet.of(FULL, THIN));
+  HEADER("urn:ietf:params:xml:ns:rdeHeader-1.0", EnumSet.of(FULL, THIN)),
+  EPP_PARAMS("urn:ietf:params:xml:ns:rdeEppParams-1.0", EnumSet.of(FULL, THIN));
 
   private final String uri;
   private final ImmutableSet<RdeMode> modes;

core/src/main/java/google/registry/rde/RdeUploadAction.java

@@ -14,7 +14,6 @@
 
 package google.registry.rde;
 
-
 import static com.google.common.base.Verify.verify;
 import static com.google.common.net.MediaType.PLAIN_TEXT_UTF_8;
 import static com.jcraft.jsch.ChannelSftp.OVERWRITE;

core/src/main/java/google/registry/rde/RydeTar.java

@@ -16,8 +16,6 @@ package google.registry.rde;
 
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkState;
-import static google.registry.util.DateTimeUtils.toDateTime;
-import static google.registry.util.DateTimeUtils.toInstant;
 
 import com.google.common.io.ByteStreams;
 import google.registry.util.ImprovedInputStream;
@@ -53,7 +51,7 @@ final class RydeTar {
           new PosixTarHeader.Builder()
               .setName(filename)
               .setSize(expectedSize)
-              .setMtime(toDateTime(modified))
+              .setMtime(modified)
               .build()
               .getBytes());
       return new ImprovedOutputStream("RydeTarWriter", os) {
@@ -96,7 +94,7 @@ final class RydeTar {
 
     /** Returns the creation/modification time of the file archived in this TAR. */
     Instant getModified() {
-      return toInstant(header.getMtime());
+      return header.getMtime();
     }
   }
 

core/src/main/java/google/registry/reporting/ReportingModule.java

@@ -17,7 +17,6 @@ package google.registry.reporting;
 import static google.registry.request.RequestParameters.extractOptionalBooleanParameter;
 import static google.registry.request.RequestParameters.extractOptionalParameter;
 import static google.registry.request.RequestParameters.extractRequiredParameter;
-import static java.time.ZoneOffset.UTC;
 
 import com.google.api.services.dataflow.Dataflow;
 import dagger.Module;
@@ -129,7 +128,7 @@ public class ReportingModule {
   @Provides
   @Parameter(PARAM_DATE)
   static LocalDate provideDate(HttpServletRequest req, Clock clock) {
-    return provideDateOptional(req).orElseGet(() -> LocalDate.ofInstant(clock.now(), UTC));
+    return provideDateOptional(req).orElseGet(() -> clock.nowDate());
   }
 
   /** Constructs a {@link Dataflow} API client with default settings. */

core/src/main/java/google/registry/reporting/billing/BillingModule.java

@@ -37,7 +37,6 @@ public final class BillingModule {
   static final String PARAM_SHOULD_PUBLISH = "shouldPublish";
   static final String CRON_QUEUE = "retryable-cron-tasks";
 
-
   @Provides
   @Parameter(PARAM_SHOULD_PUBLISH)
   static boolean provideShouldPublish(

core/src/main/java/google/registry/reporting/icann/IcannReportingUploadAction.java

@@ -100,7 +100,7 @@ public final class IcannReportingUploadAction implements Runnable {
   IcannReportingUploadAction() {}
 
   /**
-   * Get the scheduled time for the next month of the given {@link DateTime}.
+   * Get the scheduled time for the next month of the given {@link Instant}.
    *
    * <p>The scheduled time is always the second day of next month at 10AM UTC. This is because the
    * staging action is scheduled to run at 9AM UTC on that day, and there is no reason to run the

core/src/main/java/google/registry/request/Action.java

@@ -14,7 +14,6 @@
 
 package google.registry.request;
 
-
 import google.registry.config.RegistryConfig;
 import google.registry.request.auth.Auth;
 import java.lang.annotation.ElementType;

core/src/main/java/google/registry/request/RequestParameters.java

@@ -30,7 +30,6 @@ import java.time.Instant;
 import java.time.format.DateTimeParseException;
 import java.util.Optional;
 import javax.annotation.Nullable;
-import org.joda.time.DateTime;
 
 /** Utilities for extracting parameters from HTTP requests. */
 public final class RequestParameters {
@@ -298,33 +297,6 @@ public final class RequestParameters {
    * @throws BadRequestException if request parameter named {@code name} is absent, empty, or could
    *     not be parsed as an ISO 8601 timestamp
    */
-  public static DateTime extractRequiredDatetimeParameter(HttpServletRequest req, String name) {
-    String stringValue = extractRequiredParameter(req, name);
-    try {
-      return DateTime.parse(stringValue);
-    } catch (IllegalArgumentException e) {
-      throw new BadRequestException("Bad ISO 8601 timestamp: " + name);
-    }
-  }
-
-  /**
-   * Returns first request parameter associated with {@code name} parsed as an <a
-   * href="https://goo.gl/pk5Q2k">ISO 8601</a> timestamp, e.g. {@code 1984-12-18TZ}, {@code
-   * 2000-01-01T16:20:00Z}.
-   *
-   * @throws BadRequestException if request parameter is present but not a valid {@link DateTime}.
-   */
-  public static Optional<DateTime> extractOptionalDatetimeParameter(
-      HttpServletRequest req, String name) {
-    String stringParam = req.getParameter(name);
-    try {
-      return isNullOrEmpty(stringParam)
-          ? Optional.empty()
-          : Optional.of(DateTime.parse(stringParam));
-    } catch (IllegalArgumentException e) {
-      throw new BadRequestException("Bad ISO 8601 timestamp: " + name);
-    }
-  }
 
   public static ImmutableSet<Instant> extractSetOfInstantParameters(
       HttpServletRequest req, String name) {
@@ -338,26 +310,6 @@ public final class RequestParameters {
     }
   }
 
-  /**
-   * Returns all GET or POST date parameters associated with {@code name}, or an empty set if none.
-   *
-   * <p>Dates are parsed as an <a href="https://goo.gl/pk5Q2k">ISO 8601</a> timestamp, e.g. {@code
-   * 1984-12-18TZ}, {@code 2000-01-01T16:20:00Z}.
-   *
-   * @throws BadRequestException if one of the parameter values is not a valid {@link DateTime}.
-   */
-  public static ImmutableSet<DateTime> extractSetOfDatetimeParameters(
-      HttpServletRequest req, String name) {
-    try {
-      return extractSetOfParameters(req, name).stream()
-          .filter(not(String::isEmpty))
-          .map(DateTime::parse)
-          .collect(toImmutableSet());
-    } catch (IllegalArgumentException e) {
-      throw new BadRequestException("Bad ISO 8601 timestamp: " + name);
-    }
-  }
-
   private static boolean equalsFalse(@Nullable String value) {
     return nullToEmpty(value).equalsIgnoreCase("false");
   }

core/src/main/java/google/registry/security/XsrfTokenManager.java

@@ -56,7 +56,7 @@ public final class XsrfTokenManager {
   /** Generates an XSRF token for a given user based on email address. */
   public String generateToken(String email) {
     checkArgumentNotNull(email);
-    long timestampMillis = clock.now().toEpochMilli();
+    long timestampMillis = clock.nowMillis();
     return encodeToken(ServerSecret.get().asBytes(), email, timestampMillis);
   }
 

core/src/main/java/google/registry/tools/CreateOrUpdateBulkPricingPackageCommand.java

@@ -16,20 +16,18 @@ package google.registry.tools;
 
 import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.util.DateTimeUtils.toInstant;
 
 import com.beust.jcommander.Parameter;
 import google.registry.model.domain.token.AllocationToken;
 import google.registry.model.domain.token.AllocationToken.TokenType;
 import google.registry.model.domain.token.BulkPricingPackage;
 import google.registry.persistence.VKey;
-import google.registry.tools.params.DateTimeParameter;
+import google.registry.tools.params.InstantParameter;
 import java.time.Instant;
 import java.util.List;
 import java.util.Optional;
 import javax.annotation.Nullable;
 import org.joda.money.Money;
-import org.joda.time.DateTime;
 
 /** Shared base class for commands to create or update a {@link BulkPricingPackage} object. */
 abstract class CreateOrUpdateBulkPricingPackageCommand extends MutatingCommand {
@@ -58,10 +56,10 @@ abstract class CreateOrUpdateBulkPricingPackageCommand extends MutatingCommand {
   @Nullable
   @Parameter(
       names = "--next_billing_date",
-      validateWith = DateTimeParameter.class,
+      validateWith = InstantParameter.class,
       description =
           "The next date that the bulk pricing package should be billed for its annual fee")
-  DateTime nextBillingDate;
+  Instant nextBillingDate;
 
   /** Returns the existing BulkPricingPackage or null if it does not exist. */
   @Nullable
@@ -108,8 +106,7 @@ abstract class CreateOrUpdateBulkPricingPackageCommand extends MutatingCommand {
                 Optional.ofNullable(maxCreates).ifPresent(builder::setMaxCreates);
                 Optional.ofNullable(price).ifPresent(builder::setBulkPrice);
                 Optional.ofNullable(nextBillingDate)
-                    .ifPresent(
-                        nextBillingDate -> builder.setNextBillingDate(toInstant(nextBillingDate)));
+                    .ifPresent(nextBillingDate -> builder.setNextBillingDate(nextBillingDate));
                 if (clearLastNotificationSent()) {
                   builder.setLastNotificationSent((Instant) null);
                 }

core/src/main/java/google/registry/tools/CreateRegistrarGroupsCommand.java

@@ -88,4 +88,3 @@ public class CreateRegistrarGroupsCommand extends ConfirmingCommand
     return "Success!";
   }
 }
-

core/src/main/java/google/registry/tools/GenerateEscrowDepositCommand.java

@@ -32,10 +32,12 @@ import com.google.common.collect.ImmutableMultimap;
 import google.registry.batch.CloudTasksUtils;
 import google.registry.model.rde.RdeMode;
 import google.registry.rde.RdeStagingAction;
+import google.registry.util.DateTimeUtils;
 import jakarta.inject.Inject;
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
 import java.util.List;
 import java.util.stream.Collectors;
-import org.joda.time.DateTime;
 
 /**
  * Command to kick off the server-side generation of an XML RDE or BRDA escrow deposit, which will
@@ -54,7 +56,7 @@ final class GenerateEscrowDepositCommand implements Command {
       names = {"-w", "--watermark"},
       description = "Point-in-time timestamp(s) for which time the deposit should be generated",
       required = true)
-  private List<DateTime> watermarks;
+  private List<Instant> watermarks;
 
   @Parameter(
       names = {"-m", "--mode"},
@@ -88,14 +90,14 @@ final class GenerateEscrowDepositCommand implements Command {
     }
 
     // We need to test for cases where "--watermark=" is passed in as a parameter, because it would
-    // first be converted to an empty list, and as such the DateTime converter would not be called.
+    // first be converted to an empty list, and as such the Instant converter would not be called.
     if (tlds.isEmpty()) {
       throw new ParameterException("At least one TLD must be specified");
     }
     assertTldsExist(tlds);
 
-    for (DateTime watermark : watermarks) {
-      if (!watermark.withTimeAtStartOfDay().equals(watermark)) {
+    for (Instant watermark : watermarks) {
+      if (!watermark.truncatedTo(ChronoUnit.DAYS).equals(watermark)) {
         throw new ParameterException("Each watermark date must be the start of a day");
       }
     }
@@ -117,7 +119,9 @@ final class GenerateEscrowDepositCommand implements Command {
             .put(PARAM_TLDS, tlds.stream().collect(Collectors.joining(",")))
             .put(
                 PARAM_WATERMARKS,
-                watermarks.stream().map(DateTime::toString).collect(Collectors.joining(",")));
+                watermarks.stream()
+                    .map(DateTimeUtils::formatInstant)
+                    .collect(Collectors.joining(",")));
 
     if (revision != null) {
       paramsBuilder.put(PARAM_REVISION, String.valueOf(revision));
@@ -126,5 +130,4 @@ final class GenerateEscrowDepositCommand implements Command {
         RDE_REPORT_QUEUE,
         cloudTasksUtils.createTask(RdeStagingAction.class, POST, paramsBuilder.build()));
   }
-
 }

core/src/main/java/google/registry/tools/GenerateZoneFilesCommand.java

@@ -15,8 +15,6 @@
 package google.registry.tools;
 
 import static google.registry.model.tld.Tlds.assertTldsExist;
-import static google.registry.util.DateTimeUtils.toLocalDate;
-import static java.time.ZoneOffset.UTC;
 
 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
@@ -28,6 +26,7 @@ import jakarta.inject.Inject;
 import java.io.IOException;
 import java.time.Duration;
 import java.time.Instant;
+import java.time.temporal.ChronoUnit;
 import java.util.List;
 import java.util.Map;
 
@@ -61,8 +60,7 @@ final class GenerateZoneFilesCommand implements CommandWithConnection {
   @Override
   public void run() throws IOException {
     if (exportDate == null) {
-      exportDate =
-          toLocalDate(clock.now().minus(Duration.ofMinutes(2))).atStartOfDay(UTC).toInstant();
+      exportDate = clock.now().minus(Duration.ofMinutes(2)).truncatedTo(ChronoUnit.DAYS);
     }
     assertTldsExist(mainParameters);
     ImmutableMap<String, Object> params = ImmutableMap.of(

core/src/main/java/google/registry/tools/GetKeyringSecretCommand.java

@@ -14,7 +14,6 @@
 
 package google.registry.tools;
 
-
 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
 import google.registry.keyring.api.KeySerializer;

core/src/main/java/google/registry/tools/GsonUtils.java

@@ -26,7 +26,6 @@ import google.registry.model.adapters.CurrencyJsonAdapter;
 import google.registry.model.adapters.SerializableJsonTypeAdapter;
 import google.registry.util.CidrAddressBlock;
 import google.registry.util.CidrAddressBlock.CidrAddressBlockAdapter;
-import google.registry.util.DateTimeTypeAdapter;
 import google.registry.util.DurationTypeAdapter;
 import google.registry.util.InstantTypeAdapter;
 import java.io.IOException;
@@ -34,7 +33,6 @@ import java.io.Serializable;
 import java.time.Duration;
 import java.time.Instant;
 import org.joda.money.CurrencyUnit;
-import org.joda.time.DateTime;
 
 /** Utility class for methods related to GSON and necessary GSON processing. */
 public class GsonUtils {
@@ -78,7 +76,7 @@ public class GsonUtils {
     return new GsonBuilder()
         .registerTypeAdapter(CidrAddressBlock.class, new CidrAddressBlockAdapter())
         .registerTypeAdapter(CurrencyUnit.class, new CurrencyJsonAdapter())
-        .registerTypeAdapter(DateTime.class, new DateTimeTypeAdapter())
+        .registerTypeAdapter(Instant.class, new InstantTypeAdapter())
         .registerTypeAdapter(Duration.class, new DurationTypeAdapter())
         .registerTypeAdapter(Instant.class, new InstantTypeAdapter())
         .registerTypeAdapter(Serializable.class, new SerializableJsonTypeAdapter())

core/src/main/java/google/registry/tools/SetupOteCommand.java

@@ -126,7 +126,6 @@ final class SetupOteCommand extends ConfirmingCommand {
           String.format(
 """
 
-
 WARNING: Running against %s environment. Are \
 you sure you didn't mean to run this against sandbox (e.g. "-e SANDBOX")?\
 """,

core/src/main/java/google/registry/tools/UpdateKeyringSecretCommand.java

@@ -107,4 +107,3 @@ final class UpdateKeyringSecretCommand implements Command {
     secretManagerKeyringUpdater.update();
   }
 }
-