Replay Cloud SQL transactions against datastore (#738 )

* Replay Cloud SQL transactions against datastore Implement the ReplicateToDatastore cron job that will apply all Cloud SQL transactions to the datastore. The last transaction id is stored in a LastSqlTransaction entity in datastore. Note that this will not be activated in production until a) the cron configuration is updated and b) the cloudSql.replicateTransactions flag is set to true in the nomulus config file. * Post-review changes Fixed immutability issues with LastSqlTransaction, write a single transaction at a time to datastore. * Changes requested in review * Get a batch of SQL transactions Read a batch of SQL transactions at a time and then process them transactionally against datastore. * Bring this up-to-date with the codebase * Changes requested in review * Fixed date in copyright
Clean up Gradle Flyway tasks in :db (#990 )
2026-05-17 05:11:50 +00:00 · 2021-03-05 10:35:30 -05:00 · 2021-03-04 19:58:09 -05:00 · 2021-03-04 08:25:47 -05:00 · 2021-03-03 21:02:06 -05:00 · 2021-03-03 19:31:08 -05:00
556 changed files with 24932 additions and 14242 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -75,7 +75,7 @@ local.properties
 autogenerated/

 # IDEA
-nomulus.iml
+**/*.iml
 nomulus.ipr
 nomulus.iws

--- a/2
+++ b/2
@@ -34,3 +34,5 @@ Guy Bensky <guyben@google.com>
 Weimin Yu <weiminyu@google.com>
 Shicong Huang <shicong@google.com>
 Gustav Brodman <gbrodman@google.com>
+Sarah Botwinick <sarahbot@google.com>
+Legina Chen <legina@google.com>
--- a/build.gradle
+++ b/build.gradle
@@ -40,7 +40,7 @@ plugins {
  id 'com.github.johnrengelman.shadow' version '5.1.0'

  // NodeJs plugin
-  id "com.moowork.node" version "1.2.0"
+  id "com.github.node-gradle.node" version "3.0.1"

  id 'idea'
  id 'com.diffplug.gradle.spotless' version '3.25.0'
@@ -49,6 +49,12 @@ plugins {
  id 'com.dorongold.task-tree' version '1.5'
 }

+node {
+  download = true
+  version = "14.15.5"
+  npmVersion = "6.14.11"
+}
+
 wrapper {
  distributionType = Wrapper.DistributionType.ALL
 }
@@ -115,7 +121,7 @@ task stage {
 // App-engine environment configuration.  We set up all of the variables in
 // the root project.

-def environments = ['production', 'sandbox', 'alpha', 'crash']
+def environments = ['production', 'sandbox', 'alpha', 'crash', 'qa']

 def gcpProject = null

@@ -149,7 +155,7 @@ def verifyDeploymentParams() {
        System.err.println('-----------------------------------------------------------------')
        throw new GradleException('Aborting. See prominent error above.')
    } else if (gcpProject == null) {
-        def error = 'You must specify -P environment={alpha,crash}'
+        def error = 'You must specify -P environment={alpha,crash,qa}'
        System.err.println("\033[33;1m${error}\033[0m")
        throw GradleException("Aborting:  ${error}")
    }
--- a/buildSrc/build.gradle
+++ b/buildSrc/build.gradle
@@ -71,12 +71,13 @@ dependencies {
  def deps = dependencyMap
  compile deps['com.google.auth:google-auth-library-credentials']
  compile deps['com.google.auth:google-auth-library-oauth2-http']
-  compile deps['com.google.cloud:google-cloud-core']
-  compile deps['com.google.guava:guava']
  compile deps['com.google.auto.value:auto-value-annotations']
+  compile deps['com.google.cloud:google-cloud-core']
  compile deps['com.google.cloud:google-cloud-storage']
-  compile deps['org.apache.commons:commons-text']
+  compile deps['com.google.guava:guava']
+  compile deps['com.google.protobuf:protobuf-java']
  compile deps['com.google.template:soy']
+  compile deps['org.apache.commons:commons-text']
  annotationProcessor deps['com.google.auto.value:auto-value']
  testCompile deps['com.google.truth:truth']
  testCompile deps['com.google.truth.extensions:truth-java8-extension']
--- a/buildSrc/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/buildSrc/gradle/dependency-locks/annotationProcessor.lockfile
@@ -3,7 +3,7 @@
 # This file is expected to be part of source control.
 com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.google.auto.value:auto-value:1.6.3
+com.google.auto.value:auto-value:1.7.4
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
--- a/buildSrc/gradle/dependency-locks/checkstyle.lockfile
+++ b/buildSrc/gradle/dependency-locks/checkstyle.lockfile
@@ -3,16 +3,17 @@
 # This file is expected to be part of source control.
 antlr:antlr:2.7.7
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
-com.puppycrawl.tools:checkstyle:8.27
+com.puppycrawl.tools:checkstyle:8.37
 commons-beanutils:commons-beanutils:1.9.4
 commons-collections:commons-collections:3.2.2
-info.picocli:picocli:4.1.1
-net.sf.saxon:Saxon-HE:9.9.1-5
-org.antlr:antlr4-runtime:4.7.2
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+info.picocli:picocli:4.5.2
+net.sf.saxon:Saxon-HE:10.3
+org.antlr:antlr4-runtime:4.8-1
+org.checkerframework:checker-qual:2.11.1
+org.javassist:javassist:3.26.0-GA
+org.reflections:reflections:0.9.12
--- a/buildSrc/gradle/dependency-locks/compile.lockfile
+++ b/buildSrc/gradle/dependency-locks/compile.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.ibm.icu:icu4j:57.1
 commons-codec:commons-codec:1.11
--- a/buildSrc/gradle/dependency-locks/compileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/compileClasspath.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.ibm.icu:icu4j:57.1
 commons-codec:commons-codec:1.11
--- a/buildSrc/gradle/dependency-locks/deploy_jar.lockfile
+++ b/buildSrc/gradle/dependency-locks/deploy_jar.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.ibm.icu:icu4j:57.1
 commons-codec:commons-codec:1.11
--- a/buildSrc/gradle/dependency-locks/jacocoAgent.lockfile
+++ b/buildSrc/gradle/dependency-locks/jacocoAgent.lockfile
@@ -1,4 +1,4 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-org.jacoco:org.jacoco.agent:0.8.5
+org.jacoco:org.jacoco.agent:0.8.6
--- a/buildSrc/gradle/dependency-locks/jacocoAnt.lockfile
+++ b/buildSrc/gradle/dependency-locks/jacocoAnt.lockfile
@@ -1,11 +1,11 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-org.jacoco:org.jacoco.agent:0.8.5
-org.jacoco:org.jacoco.ant:0.8.5
-org.jacoco:org.jacoco.core:0.8.5
-org.jacoco:org.jacoco.report:0.8.5
-org.ow2.asm:asm-analysis:7.2
-org.ow2.asm:asm-commons:7.2
-org.ow2.asm:asm-tree:7.2
-org.ow2.asm:asm:7.2
+org.jacoco:org.jacoco.agent:0.8.6
+org.jacoco:org.jacoco.ant:0.8.6
+org.jacoco:org.jacoco.core:0.8.6
+org.jacoco:org.jacoco.report:0.8.6
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:8.0.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm:8.0.1
--- a/buildSrc/gradle/dependency-locks/runtime.lockfile
+++ b/buildSrc/gradle/dependency-locks/runtime.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.ibm.icu:icu4j:57.1
 commons-codec:commons-codec:1.11
--- a/buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.ibm.icu:icu4j:57.1
 commons-codec:commons-codec:1.11
--- a/buildSrc/gradle/dependency-locks/testCompile.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompile.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
 com.google.truth:truth:1.0
@@ -50,8 +50,8 @@ javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
 junit:junit:4.12
-net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.5
+net.bytebuddy:byte-buddy-agent:1.10.19
+net.bytebuddy:byte-buddy:1.10.19
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
@@ -66,8 +66,8 @@ org.junit.jupiter:junit-jupiter-engine:5.6.2
 org.junit.platform:junit-platform-commons:1.6.2
 org.junit.platform:junit-platform-engine:1.6.2
 org.junit:junit-bom:5.6.2
-org.mockito:mockito-core:3.3.3
-org.objenesis:objenesis:2.6
+org.mockito:mockito-core:3.7.7
+org.objenesis:objenesis:3.1
 org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
 com.google.truth:truth:1.0
@@ -50,8 +50,8 @@ javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
 junit:junit:4.12
-net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.5
+net.bytebuddy:byte-buddy-agent:1.10.19
+net.bytebuddy:byte-buddy:1.10.19
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
@@ -66,8 +66,8 @@ org.junit.jupiter:junit-jupiter-engine:5.6.2
 org.junit.platform:junit-platform-commons:1.6.2
 org.junit.platform:junit-platform-engine:1.6.2
 org.junit:junit-bom:5.6.2
-org.mockito:mockito-core:3.3.3
-org.objenesis:objenesis:2.6
+org.mockito:mockito-core:3.7.7
+org.objenesis:objenesis:3.1
 org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/testRuntime.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntime.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
 com.google.truth:truth:1.0
@@ -50,8 +50,8 @@ javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
 junit:junit:4.12
-net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.5
+net.bytebuddy:byte-buddy-agent:1.10.19
+net.bytebuddy:byte-buddy:1.10.19
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
@@ -66,8 +66,8 @@ org.junit.jupiter:junit-jupiter-engine:5.6.2
 org.junit.platform:junit-platform-commons:1.6.2
 org.junit.platform:junit-platform-engine:1.6.2
 org.junit:junit-bom:5.6.2
-org.mockito:mockito-core:3.3.3
-org.objenesis:objenesis:2.6
+org.mockito:mockito-core:3.7.7
+org.objenesis:objenesis:3.1
 org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -13,7 +13,7 @@ com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
 com.google.auth:google-auth-library-credentials:0.16.1
 com.google.auth:google-auth-library-oauth2-http:0.16.1
-com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
 com.google.cloud:google-cloud-storage:1.59.0
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -33,7 +33,7 @@ com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
-com.google.protobuf:protobuf-java:3.6.1
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
 com.google.truth:truth:1.0
@@ -50,8 +50,8 @@ javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
 junit:junit:4.12
-net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.5
+net.bytebuddy:byte-buddy-agent:1.10.19
+net.bytebuddy:byte-buddy:1.10.19
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
@@ -66,8 +66,8 @@ org.junit.jupiter:junit-jupiter-engine:5.6.2
 org.junit.platform:junit-platform-commons:1.6.2
 org.junit.platform:junit-platform-engine:1.6.2
 org.junit:junit-bom:5.6.2
-org.mockito:mockito-core:3.3.3
-org.objenesis:objenesis:2.6
+org.mockito:mockito-core:3.7.7
+org.objenesis:objenesis:3.1
 org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/src/test/resources/mockito-extensions/org.mockito.plugins.MockMaker
+++ b/buildSrc/src/test/resources/mockito-extensions/org.mockito.plugins.MockMaker
@@ -0,0 +1 @@
+mock-maker-inline
--- a/common/gradle/dependency-locks/checkstyle.lockfile
+++ b/common/gradle/dependency-locks/checkstyle.lockfile
@@ -3,16 +3,17 @@
 # This file is expected to be part of source control.
 antlr:antlr:2.7.7
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
-com.puppycrawl.tools:checkstyle:8.27
+com.puppycrawl.tools:checkstyle:8.37
 commons-beanutils:commons-beanutils:1.9.4
 commons-collections:commons-collections:3.2.2
-info.picocli:picocli:4.1.1
-net.sf.saxon:Saxon-HE:9.9.1-5
-org.antlr:antlr4-runtime:4.7.2
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+info.picocli:picocli:4.5.2
+net.sf.saxon:Saxon-HE:10.3
+org.antlr:antlr4-runtime:4.8-1
+org.checkerframework:checker-qual:2.11.1
+org.javassist:javassist:3.26.0-GA
+org.reflections:reflections:0.9.12
--- a/common/gradle/dependency-locks/compile.lockfile
+++ b/common/gradle/dependency-locks/compile.lockfile
@@ -4,7 +4,7 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
--- a/common/gradle/dependency-locks/compileClasspath.lockfile
+++ b/common/gradle/dependency-locks/compileClasspath.lockfile
@@ -4,7 +4,7 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
--- a/common/gradle/dependency-locks/default.lockfile
+++ b/common/gradle/dependency-locks/default.lockfile
@@ -4,7 +4,7 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
--- a/common/gradle/dependency-locks/deploy_jar.lockfile
+++ b/common/gradle/dependency-locks/deploy_jar.lockfile
@@ -4,7 +4,7 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
--- a/common/gradle/dependency-locks/jacocoAgent.lockfile
+++ b/common/gradle/dependency-locks/jacocoAgent.lockfile
@@ -1,4 +1,4 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-org.jacoco:org.jacoco.agent:0.8.5
+org.jacoco:org.jacoco.agent:0.8.6
--- a/common/gradle/dependency-locks/jacocoAnt.lockfile
+++ b/common/gradle/dependency-locks/jacocoAnt.lockfile
@@ -1,11 +1,11 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-org.jacoco:org.jacoco.agent:0.8.5
-org.jacoco:org.jacoco.ant:0.8.5
-org.jacoco:org.jacoco.core:0.8.5
-org.jacoco:org.jacoco.report:0.8.5
-org.ow2.asm:asm-analysis:7.2
-org.ow2.asm:asm-commons:7.2
-org.ow2.asm:asm-tree:7.2
-org.ow2.asm:asm:7.2
+org.jacoco:org.jacoco.agent:0.8.6
+org.jacoco:org.jacoco.ant:0.8.6
+org.jacoco:org.jacoco.core:0.8.6
+org.jacoco:org.jacoco.report:0.8.6
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:8.0.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm:8.0.1
--- a/common/gradle/dependency-locks/runtime.lockfile
+++ b/common/gradle/dependency-locks/runtime.lockfile
@@ -4,7 +4,7 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
--- a/common/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -4,7 +4,7 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
--- a/common/gradle/dependency-locks/testCompile.lockfile
+++ b/common/gradle/dependency-locks/testCompile.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
--- a/common/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/common/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
--- a/common/gradle/dependency-locks/testRuntime.lockfile
+++ b/common/gradle/dependency-locks/testRuntime.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
--- a/common/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
--- a/common/gradle/dependency-locks/testingCompile.lockfile
+++ b/common/gradle/dependency-locks/testingCompile.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
--- a/common/gradle/dependency-locks/testingCompileClasspath.lockfile
+++ b/common/gradle/dependency-locks/testingCompileClasspath.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
--- a/common/gradle/dependency-locks/testingRuntime.lockfile
+++ b/common/gradle/dependency-locks/testingRuntime.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
--- a/common/gradle/dependency-locks/testingRuntimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/testingRuntimeClasspath.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
--- a/config/dependency-license/allowed_licenses.json
+++ b/config/dependency-license/allowed_licenses.json
@@ -72,9 +72,15 @@
    {
      "moduleLicense": "The 3-Clause BSD License"
    },
+    {
+      "moduleLicense": "BSD Licence 3"
+    },
    {
      "moduleLicense": "BSD License"
    },
+    {
+      "moduleLicense": "BSD License 3"
+    },
    {
      "moduleLicense": "BSD New License"
    },
@@ -230,6 +236,13 @@
      "moduleLicense": "Public Domain",
      "moduleName": "org.tukaani:xz"
    },
+    {
+      // "Apache License, Version 2.0". The plugin is able to parse
+      // 2.11.3 correctly but not this version.
+      "moduleLicense": null,
+      "moduleVersion": "2.12.1",
+      "moduleName": "com.fasterxml.jackson:jackson-bom"
+    },
    {
      // Actually Eclipse Public License v2.0
      "moduleLicense": null,
--- a/config/nom_build.py
+++ b/config/nom_build.py
@@ -111,8 +111,8 @@ PROPERTIES = [

    # Cloud SQL properties
    Property('dbServer',
-             'A registry environment name (e.g., "alpha") or a host[:port] '
-             'string'),
+             'The host[:port] of a database that accepts direct IP access. '
+             'This is typically used with a testing database.'),
    Property('dbName',
             'Database name to use in connection.',
             'postgres'),
--- a/config/presubmits.py
+++ b/config/presubmits.py
@@ -23,7 +23,7 @@ import sys
 import re

 # We should never analyze any generated files
-UNIVERSALLY_SKIPPED_PATTERNS = {"/build/", "cloudbuild-caches", "/out/", ".git/"}
+UNIVERSALLY_SKIPPED_PATTERNS = {"/build/", "cloudbuild-caches", "/out/", ".git/", ".gradle/"}
 # We can't rely on CI to have the Enum package installed so we do this instead.
 FORBIDDEN = 1
 REQUIRED = 2
@@ -65,7 +65,7 @@ class PresubmitCheck:
    for pattern in self.skipped_patterns:
      if pattern in file:
        return False
-    with open(file, "r") as f:
+    with open(file, "r", encoding='utf8') as f:
      file_content = f.read()
      matches = re.match(self.regex, file_content, re.DOTALL)
      if self.regex_type == FORBIDDEN:
@@ -176,7 +176,47 @@ PRESUBMITS = {
        "js",
        {"/node_modules/", "google/registry/ui/js/util.js", "registrar_bin."},
    ):
-        "JavaScript files should not include console logging."
+        "JavaScript files should not include console logging.",
+    # SQL injection protection rule for java source file:
+    # The sql template passed to createQuery/createNativeQuery methods must be
+    # a variable name in UPPER_CASE_UNDERSCORE format, i.e., a static final
+    # String variable. This forces the use of parameter-binding on all queries
+    # that take parameters.
+    # The rule would forbid invocation of createQuery(Criteria). However, this
+    # can be handled by adding a helper method in an exempted class to make
+    # the calls.
+    # TODO(b/179158393): enable the 'ConstantName' Java style check to ensure
+    # that non-final variables do not use the UPPER_CASE_UNDERSCORE format.
+    PresubmitCheck(
+        # Line 1: the method names we check and the opening parenthesis, which
+        #    marks the beginning of the first parameter
+        # Line 2: The first parameter is a match if is NOT any of the following:
+        #    - final variable name: \s*([A-Z_]+
+        #    - string literal: "([^"]|\\")*"
+        #    - concatenation of literals: (\s*\+\s*"([^"]|\\")*")*
+        # Line 3: , or the closing parenthesis, marking the end of the first
+        #    parameter
+        r'.*\.create(Native)?Query\('
+        r'(?!(\s*([A-Z_]+|"([^"]|\\")*"(\s*\+\s*"([^"]|\\")*")*)'
+        r'(,|\s*\))))',
+        "java",
+        # ActivityReportingQueryBuilder deals with Dremel queries
+        {"src/test", "ActivityReportingQueryBuilder.java",
+         # TODO(b/179158393): Remove everything below, which should be done
+         # using Criteria
+         "ForeignKeyIndex.java",
+         "HistoryEntryDao.java",
+         "JpaTransactionManagerImpl.java",
+         # CriteriaQueryBuilder is a false positive
+         "CriteriaQueryBuilder.java",
+         "RdapSearchActionBase.java",
+         },
+    ):
+        "The first String parameter to EntityManager.create(Native)Query "
+        "methods must be one of the following:\n"
+        "  - A String literal\n"
+        "  - Concatenation of String literals only\n"
+        "  - The name of a static final String variable"
 }

 # Note that this regex only works for one kind of Flyway file.  If we want to
@@ -241,7 +281,7 @@ def verify_flyway_index():

  # Remove the sequence numbers and compare against the index file contents.
  files = [filename[1] for filename in sorted(files)]
-  with open('db/src/main/resources/sql/flyway.txt') as index:
+  with open('db/src/main/resources/sql/flyway.txt', encoding='utf8') as index:
    indexed_files = index.read().splitlines()
  if files != indexed_files:
    unindexed = set(files) - set(indexed_files)
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -172,6 +172,8 @@ dependencies {

  compile deps['com.beust:jcommander']
  compile deps['com.google.api:gax']
+  compile deps['com.google.api.grpc:proto-google-cloud-datastore-v1']
+  compile deps['com.google.api.grpc:proto-google-common-protos']
  compile deps['com.google.api.grpc:proto-google-cloud-secretmanager-v1']
  compile deps['com.google.api-client:google-api-client']
  compile deps['com.google.api-client:google-api-client-appengine']
@@ -196,10 +198,13 @@ dependencies {
  compile deps['com.google.appengine:appengine-remote-api']
  compile deps['com.google.auth:google-auth-library-credentials']
  compile deps['com.google.auth:google-auth-library-oauth2-http']
+  compile deps['com.google.cloud.bigdataoss:util']
+  compile deps['com.google.cloud.datastore:datastore-v1-proto-client']
  compile deps['com.google.cloud.sql:jdbc-socket-factory-core']
  runtimeOnly deps['com.google.cloud.sql:postgres-socket-factory']
  compile deps['com.google.cloud:google-cloud-secretmanager']
  compile deps['com.google.code.gson:gson']
+  compile deps['com.google.auto.service:auto-service-annotations']
  compile deps['com.google.auto.value:auto-value-annotations']
  compile deps['com.google.code.findbugs:jsr305']
  compile deps['com.google.dagger:dagger']
@@ -296,11 +301,7 @@ dependencies {
  compile project(path: ':db', configuration: 'compileApi')
  testRuntime project(':db')

-  // Include auto-value in compile until nebula-lint understands
-  // annotationProcessor
-  gradleLint.ignore('unused-dependency') {
-    compile deps['com.google.auto.value:auto-value']
-  }
+  annotationProcessor deps['com.google.auto.service:auto-service']
  annotationProcessor deps['com.google.auto.value:auto-value']
  testAnnotationProcessor deps['com.google.auto.value:auto-value']
  annotationProcessor deps['com.google.dagger:dagger-compiler']
@@ -313,7 +314,7 @@ dependencies {
  testCompile deps['com.google.monitoring-client:contrib']
  testCompile deps['com.google.truth:truth']
  testCompile deps['com.google.truth.extensions:truth-java8-extension']
-  testCompile deps['org.hamcrest:hamcrest-all']
+  testCompile deps['org.hamcrest:hamcrest']
  testCompile deps['org.hamcrest:hamcrest-core']
  testCompile deps['org.hamcrest:hamcrest-library']
  testCompile deps['junit:junit']
@@ -343,6 +344,8 @@ dependencies {
  jaxb deps['com.sun.xml.bind:jaxb-osgi']

  // Dependency needed for soy to java compilation.
+  soy deps['com.google.inject:guice']
+  soy deps['com.google.protobuf:protobuf-java']
  soy deps['com.google.template:soy']

  // Dependencies needed for compiling stylesheets to javascript
@@ -600,7 +603,6 @@ task compileProdJS(type: JavaExec) {
  closureArgs << "--js=${jsDir}/soyutils_usegoog.js"
  closureArgs << "--js=${cssSourceDir}/registrar_bin.css.js"
  closureArgs << "--js=${jsSourceDir}/**.js"
-  // TODO(shicong) Verify the compiled JS file works in Alpha
  closureArgs << "--js=${externsDir}/json.js"
  closureArgs << "--js=${soySourceDir}/**.js"
  args closureArgs
@@ -713,6 +715,10 @@ createToolTask(
    'google.registry.tools.DevTool',
    sourceSets.nonprod)

+
+createToolTask(
+        'jpaDemoPipeline', 'google.registry.beam.common.JpaDemoPipeline')
+
 project.tasks.create('initSqlPipeline', JavaExec) {
  main = 'google.registry.beam.initsql.InitSqlPipeline'

@@ -737,6 +743,13 @@ project.tasks.create('initSqlPipeline', JavaExec) {
  }
 }

+// Caller must provide projectId, GCP region, runner, and the kinds to delete
+// (comma-separated kind names or '*' for all). E.g.:
+// nom_build :core:bulkDeleteDatastore --args="--project=domain-registry-crash \
+//     --region=us-central1 --runner=DataflowRunner --kindsToDelete=*"
+createToolTask(
+    'bulkDeleteDatastore', 'google.registry.beam.datastore.BulkDeletePipeline')
+
 project.tasks.create('generateSqlSchema', JavaExec) {
  classpath = sourceSets.nonprod.runtimeClasspath
  main = 'google.registry.tools.DevTool'
@@ -828,9 +841,8 @@ task buildToolImage(dependsOn: nomulus, type: Exec) {
  commandLine 'docker', 'build', '-t', 'nomulus-tool', '.'
 }

-task generateInitSqlPipelineGraph(type: Test) {
-  include "**/InitSqlPipelineGraphTest.*"
-  testNameIncludePatterns = ["**createPipeline_compareGraph"]
+task generateInitSqlPipelineGraph(type: FilteringTest) {
+  tests = ['InitSqlPipelineGraphTest.createPipeline_compareGraph']
  ignoreFailures = true
 }

--- a/core/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/annotationProcessor.lockfile
@@ -3,7 +3,9 @@
 # This file is expected to be part of source control.
 com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.google.auto.value:auto-value:1.6.3
+com.google.auto.service:auto-service-annotations:1.0-rc7
+com.google.auto.service:auto-service:1.0-rc7
+com.google.auto.value:auto-value:1.7.4
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
@@ -19,7 +21,7 @@ com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.errorprone:javac-shaded:9-dev-r4023-3
 com.google.googlejavaformat:google-java-format:1.5
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.protobuf:protobuf-java:3.4.0
--- a/core/gradle/dependency-locks/checkstyle.lockfile
+++ b/core/gradle/dependency-locks/checkstyle.lockfile
@@ -3,16 +3,17 @@
 # This file is expected to be part of source control.
 antlr:antlr:2.7.7
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotations:2.3.2
+com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.1-jre
+com.google.guava:guava:29.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
-com.puppycrawl.tools:checkstyle:8.27
+com.puppycrawl.tools:checkstyle:8.37
 commons-beanutils:commons-beanutils:1.9.4
 commons-collections:commons-collections:3.2.2
-info.picocli:picocli:4.1.1
-net.sf.saxon:Saxon-HE:9.9.1-5
-org.antlr:antlr4-runtime:4.7.2
-org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+info.picocli:picocli:4.5.2
+net.sf.saxon:Saxon-HE:10.3
+org.antlr:antlr4-runtime:4.8-1
+org.checkerframework:checker-qual:2.11.1
+org.javassist:javassist:3.26.0-GA
+org.reflections:reflections:0.9.12
--- a/core/gradle/dependency-locks/compile.lockfile
+++ b/core/gradle/dependency-locks/compile.lockfile
@@ -6,10 +6,14 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -18,90 +22,103 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -109,56 +126,49 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -178,27 +188,26 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.12
+junit:junit:4.13.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.13
@@ -208,17 +217,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-core:1.3
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -226,9 +236,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -242,14 +251,12 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/compileClasspath.lockfile
+++ b/core/gradle/dependency-locks/compileClasspath.lockfile
@@ -6,10 +6,14 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -18,88 +22,101 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -107,56 +124,47 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -176,25 +184,24 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.13
@@ -204,15 +211,17 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -220,9 +229,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -236,14 +244,12 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/default.lockfile
+++ b/core/gradle/dependency-locks/default.lockfile
@@ -10,10 +10,14 @@ com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -22,91 +26,104 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud.sql:postgres-socket-factory:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -114,27 +131,23 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 guru.nidi.com.kitfox:svgSalamander:1.1.3
@@ -142,31 +155,28 @@ guru.nidi:graphviz-java-all-j2v8:0.17.0
 guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -186,28 +196,27 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.12
+junit:junit:4.13.1
 net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
@@ -219,17 +228,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-core:1.3
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -237,9 +247,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -253,17 +262,15 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:jcl-over-slf4j:1.7.30
 org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.webjars.npm:viz.js-for-graphviz-java:2.1.3
--- a/core/gradle/dependency-locks/deploy_jar.lockfile
+++ b/core/gradle/dependency-locks/deploy_jar.lockfile
@@ -10,10 +10,14 @@ com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -22,91 +26,104 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud.sql:postgres-socket-factory:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -114,27 +131,23 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 guru.nidi.com.kitfox:svgSalamander:1.1.3
@@ -142,31 +155,28 @@ guru.nidi:graphviz-java-all-j2v8:0.17.0
 guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -188,25 +198,24 @@ jline:jline:1.0
 joda-time:joda-time:2.10.5
 net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
@@ -218,16 +227,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -235,9 +246,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -251,17 +261,15 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:jcl-over-slf4j:1.7.30
 org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.webjars.npm:viz.js-for-graphviz-java:2.1.3
--- a/core/gradle/dependency-locks/jacocoAgent.lockfile
+++ b/core/gradle/dependency-locks/jacocoAgent.lockfile
@@ -1,4 +1,4 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-org.jacoco:org.jacoco.agent:0.8.5
+org.jacoco:org.jacoco.agent:0.8.6
--- a/core/gradle/dependency-locks/jacocoAnt.lockfile
+++ b/core/gradle/dependency-locks/jacocoAnt.lockfile
@@ -1,11 +1,11 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-org.jacoco:org.jacoco.agent:0.8.5
-org.jacoco:org.jacoco.ant:0.8.5
-org.jacoco:org.jacoco.core:0.8.5
-org.jacoco:org.jacoco.report:0.8.5
-org.ow2.asm:asm-analysis:7.2
-org.ow2.asm:asm-commons:7.2
-org.ow2.asm:asm-tree:7.2
-org.ow2.asm:asm:7.2
+org.jacoco:org.jacoco.agent:0.8.6
+org.jacoco:org.jacoco.ant:0.8.6
+org.jacoco:org.jacoco.core:0.8.6
+org.jacoco:org.jacoco.report:0.8.6
+org.ow2.asm:asm-analysis:8.0.1
+org.ow2.asm:asm-commons:8.0.1
+org.ow2.asm:asm-tree:8.0.1
+org.ow2.asm:asm:8.0.1
--- a/core/gradle/dependency-locks/nonprodCompile.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompile.lockfile
@@ -6,10 +6,14 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -18,90 +22,103 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -109,56 +126,49 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -178,27 +188,26 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.12
+junit:junit:4.13.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.13
@@ -208,17 +217,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-core:1.3
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -226,9 +236,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -242,14 +251,12 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/nonprodCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompileClasspath.lockfile
@@ -6,10 +6,14 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -18,88 +22,101 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -107,56 +124,47 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -175,27 +183,26 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.12
+junit:junit:4.13.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.13
@@ -205,16 +212,17 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-core:1.3
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -222,9 +230,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -238,14 +245,12 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/nonprodRuntime.lockfile
+++ b/core/gradle/dependency-locks/nonprodRuntime.lockfile
@@ -10,10 +10,14 @@ com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -22,90 +26,103 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -113,27 +130,23 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 guru.nidi.com.kitfox:svgSalamander:1.1.3
@@ -141,31 +154,28 @@ guru.nidi:graphviz-java-all-j2v8:0.17.0
 guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -185,28 +195,27 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.12
+junit:junit:4.13.1
 net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
@@ -218,17 +227,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-core:1.3
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -236,9 +246,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -252,16 +261,14 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:jcl-over-slf4j:1.7.30
 org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.webjars.npm:viz.js-for-graphviz-java:2.1.3
--- a/core/gradle/dependency-locks/nonprodRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/nonprodRuntimeClasspath.lockfile
@@ -10,10 +10,14 @@ com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -22,90 +26,103 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -113,27 +130,23 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 guru.nidi.com.kitfox:svgSalamander:1.1.3
@@ -141,31 +154,28 @@ guru.nidi:graphviz-java-all-j2v8:0.17.0
 guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -185,28 +195,27 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.12
+junit:junit:4.13.1
 net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
@@ -218,17 +227,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-core:1.3
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -236,9 +246,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -252,16 +261,14 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:jcl-over-slf4j:1.7.30
 org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.webjars.npm:viz.js-for-graphviz-java:2.1.3
--- a/core/gradle/dependency-locks/runtime.lockfile
+++ b/core/gradle/dependency-locks/runtime.lockfile
@@ -10,10 +10,14 @@ com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -22,90 +26,103 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -113,27 +130,23 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 guru.nidi.com.kitfox:svgSalamander:1.1.3
@@ -141,31 +154,28 @@ guru.nidi:graphviz-java-all-j2v8:0.17.0
 guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -185,28 +195,27 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.12
+junit:junit:4.13.1
 net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
@@ -218,17 +227,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-core:1.3
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -236,9 +246,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -252,16 +261,14 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:jcl-over-slf4j:1.7.30
 org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.webjars.npm:viz.js-for-graphviz-java:2.1.3
--- a/core/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -10,10 +10,14 @@ com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
-com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.10.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -22,91 +26,104 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud.sql:postgres-socket-factory:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -114,27 +131,23 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
-com.squareup.okhttp:okhttp:2.5.0
-com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 guru.nidi.com.kitfox:svgSalamander:1.1.3
@@ -142,31 +155,28 @@ guru.nidi:graphviz-java-all-j2v8:0.17.0
 guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -188,25 +198,24 @@ jline:jline:1.0
 joda-time:joda-time:2.10.5
 net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
@@ -218,16 +227,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:2.1
+org.hamcrest:hamcrest:2.1
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -235,9 +246,8 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
@@ -251,17 +261,15 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.slf4j:jcl-over-slf4j:1.7.30
 org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.webjars.npm:viz.js-for-graphviz-java:2.1.3
--- a/core/gradle/dependency-locks/soy.lockfile
+++ b/core/gradle/dependency-locks/soy.lockfile
@@ -3,19 +3,24 @@
 # This file is expected to be part of source control.
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
-com.google.code.findbugs:jsr305:2.0.3
+com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.guava:guava:21.0
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:30.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.inject.extensions:guice-multibindings:4.1.0
-com.google.inject:guice:4.1.0
-com.google.protobuf:protobuf-java:3.3.0
+com.google.inject:guice:5.0.1
+com.google.j2objc:j2objc-annotations:1.3
+com.google.protobuf:protobuf-java:3.13.0
 com.google.template:soy:2018-03-14
 com.ibm.icu:icu4j:57.1
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/core/gradle/dependency-locks/testAnnotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/testAnnotationProcessor.lockfile
@@ -3,7 +3,7 @@
 # This file is expected to be part of source control.
 com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.google.auto.value:auto-value:1.6.3
+com.google.auto.value:auto-value:1.7.4
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
@@ -19,7 +19,7 @@ com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.errorprone:javac-shaded:9-dev-r4023-3
 com.google.googlejavaformat:google-java-format:1.5
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:30.0-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.protobuf:protobuf-java:3.4.0
--- a/core/gradle/dependency-locks/testCompile.lockfile
+++ b/core/gradle/dependency-locks/testCompile.lockfile
@@ -6,10 +6,14 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.11.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -18,51 +22,61 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
@@ -70,40 +84,43 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:30.0-jre
-com.google.guava:guava:30.0-jre
+com.google.guava:guava-testlib:30.1-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -112,12 +129,12 @@ com.google.monitoring-client:contrib:1.0.7
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -127,46 +144,40 @@ com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp3:okhttp:3.11.0
-com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.14.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -186,29 +197,28 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.13
-net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
+junit:junit:4.13.1
+net.bytebuddy:byte-buddy-agent:1.10.19
+net.bytebuddy:byte-buddy:1.10.19
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-direct-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-direct-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
@@ -228,19 +238,19 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-all:1.3
-org.hamcrest:hamcrest-core:1.3
-org.hamcrest:hamcrest-library:1.3
+org.hamcrest:hamcrest-core:2.2
+org.hamcrest:hamcrest-library:2.2
+org.hamcrest:hamcrest:2.2
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -248,27 +258,26 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
-org.junit.jupiter:junit-jupiter-api:5.6.2
-org.junit.jupiter:junit-jupiter-engine:5.6.2
-org.junit.jupiter:junit-jupiter-migrationsupport:5.6.2
-org.junit.jupiter:junit-jupiter-params:5.6.2
-org.junit.platform:junit-platform-commons:1.6.2
-org.junit.platform:junit-platform-engine:1.6.2
-org.junit.platform:junit-platform-launcher:1.6.2
-org.junit.platform:junit-platform-runner:1.6.2
-org.junit.platform:junit-platform-suite-api:1.6.2
-org.junit:junit-bom:5.6.2
+org.junit.jupiter:junit-jupiter-api:5.7.0
+org.junit.jupiter:junit-jupiter-engine:5.7.0
+org.junit.jupiter:junit-jupiter-migrationsupport:5.7.0
+org.junit.jupiter:junit-jupiter-params:5.7.0
+org.junit.platform:junit-platform-commons:1.7.0
+org.junit.platform:junit-platform-engine:1.7.0
+org.junit.platform:junit-platform-launcher:1.7.0
+org.junit.platform:junit-platform-runner:1.7.0
+org.junit.platform:junit-platform-suite-api:1.7.0
+org.junit:junit-bom:5.7.0
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:3.3.3
-org.mockito:mockito-junit-jupiter:3.3.3
+org.mockito:mockito-core:3.7.7
+org.mockito:mockito-junit-jupiter:3.7.7
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
-org.objenesis:objenesis:2.6
+org.objenesis:objenesis:3.1
 org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:8.0.1
 org.ow2.asm:asm-commons:7.1
@@ -278,8 +287,6 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.seleniumhq.selenium:selenium-api:3.141.59
 org.seleniumhq.selenium:selenium-chrome-driver:3.141.59
 org.seleniumhq.selenium:selenium-edge-driver:3.141.59
@@ -291,13 +298,13 @@ org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:junit-jupiter:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:selenium:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:junit-jupiter:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:selenium:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -6,10 +6,14 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.11.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -18,50 +22,60 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
@@ -69,39 +83,42 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:30.0-jre
-com.google.guava:guava:30.0-jre
+com.google.guava:guava-testlib:30.1-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,12 +127,12 @@ com.google.monitoring-client:contrib:1.0.7
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -125,46 +142,38 @@ com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp3:okhttp:3.11.0
-com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.14.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -183,29 +192,28 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.13
-net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
+junit:junit:4.13.1
+net.bytebuddy:byte-buddy-agent:1.10.19
+net.bytebuddy:byte-buddy:1.10.19
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-direct-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-direct-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
@@ -225,18 +233,18 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-all:1.3
-org.hamcrest:hamcrest-core:1.3
-org.hamcrest:hamcrest-library:1.3
+org.hamcrest:hamcrest-core:2.2
+org.hamcrest:hamcrest-library:2.2
+org.hamcrest:hamcrest:2.2
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -244,27 +252,26 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
-org.junit.jupiter:junit-jupiter-api:5.6.2
-org.junit.jupiter:junit-jupiter-engine:5.6.2
-org.junit.jupiter:junit-jupiter-migrationsupport:5.6.2
-org.junit.jupiter:junit-jupiter-params:5.6.2
-org.junit.platform:junit-platform-commons:1.6.2
-org.junit.platform:junit-platform-engine:1.6.2
-org.junit.platform:junit-platform-launcher:1.6.2
-org.junit.platform:junit-platform-runner:1.6.2
-org.junit.platform:junit-platform-suite-api:1.6.2
-org.junit:junit-bom:5.6.2
+org.junit.jupiter:junit-jupiter-api:5.7.0
+org.junit.jupiter:junit-jupiter-engine:5.7.0
+org.junit.jupiter:junit-jupiter-migrationsupport:5.7.0
+org.junit.jupiter:junit-jupiter-params:5.7.0
+org.junit.platform:junit-platform-commons:1.7.0
+org.junit.platform:junit-platform-engine:1.7.0
+org.junit.platform:junit-platform-launcher:1.7.0
+org.junit.platform:junit-platform-runner:1.7.0
+org.junit.platform:junit-platform-suite-api:1.7.0
+org.junit:junit-bom:5.7.0
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:3.3.3
-org.mockito:mockito-junit-jupiter:3.3.3
+org.mockito:mockito-core:3.7.7
+org.mockito:mockito-junit-jupiter:3.7.7
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
-org.objenesis:objenesis:2.6
+org.objenesis:objenesis:3.1
 org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:8.0.1
 org.ow2.asm:asm-commons:7.1
@@ -274,8 +281,6 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.seleniumhq.selenium:selenium-api:3.141.59
 org.seleniumhq.selenium:selenium-chrome-driver:3.141.59
 org.seleniumhq.selenium:selenium-edge-driver:3.141.59
@@ -287,13 +292,13 @@ org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:junit-jupiter:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:selenium:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:junit-jupiter:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:selenium:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
--- a/core/gradle/dependency-locks/testRuntime.lockfile
+++ b/core/gradle/dependency-locks/testRuntime.lockfile
@@ -10,10 +10,14 @@ com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
-com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.11.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -22,51 +26,61 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
@@ -74,41 +88,44 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud.sql:postgres-socket-factory:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:30.0-jre
-com.google.guava:guava:30.0-jre
+com.google.guava:guava-testlib:30.1-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -117,12 +134,12 @@ com.google.monitoring-client:contrib:1.0.7
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -132,17 +149,14 @@ com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp3:okhttp:3.11.0
-com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.14.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 guru.nidi.com.kitfox:svgSalamander:1.1.3
@@ -151,31 +165,28 @@ guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.github.java-diff-utils:java-diff-utils:4.0
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -195,30 +206,29 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.13
+junit:junit:4.13.1
 net.arnx:nashorn-promise:0.1.1
-net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
+net.bytebuddy:byte-buddy-agent:1.10.19
+net.bytebuddy:byte-buddy:1.10.19
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-direct-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-direct-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
@@ -239,20 +249,20 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-all:1.3
-org.hamcrest:hamcrest-core:1.3
-org.hamcrest:hamcrest-library:1.3
+org.hamcrest:hamcrest-core:2.2
+org.hamcrest:hamcrest-library:2.2
+org.hamcrest:hamcrest:2.2
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -260,27 +270,26 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
-org.junit.jupiter:junit-jupiter-api:5.6.2
-org.junit.jupiter:junit-jupiter-engine:5.6.2
-org.junit.jupiter:junit-jupiter-migrationsupport:5.6.2
-org.junit.jupiter:junit-jupiter-params:5.6.2
-org.junit.platform:junit-platform-commons:1.6.2
-org.junit.platform:junit-platform-engine:1.6.2
-org.junit.platform:junit-platform-launcher:1.6.2
-org.junit.platform:junit-platform-runner:1.6.2
-org.junit.platform:junit-platform-suite-api:1.6.2
-org.junit:junit-bom:5.6.2
+org.junit.jupiter:junit-jupiter-api:5.7.0
+org.junit.jupiter:junit-jupiter-engine:5.7.0
+org.junit.jupiter:junit-jupiter-migrationsupport:5.7.0
+org.junit.jupiter:junit-jupiter-params:5.7.0
+org.junit.platform:junit-platform-commons:1.7.0
+org.junit.platform:junit-platform-engine:1.7.0
+org.junit.platform:junit-platform-launcher:1.7.0
+org.junit.platform:junit-platform-runner:1.7.0
+org.junit.platform:junit-platform-suite-api:1.7.0
+org.junit:junit-bom:5.7.0
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:3.3.3
-org.mockito:mockito-junit-jupiter:3.3.3
+org.mockito:mockito-core:3.7.7
+org.mockito:mockito-junit-jupiter:3.7.7
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
-org.objenesis:objenesis:2.6
+org.objenesis:objenesis:3.1
 org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:8.0.1
 org.ow2.asm:asm-commons:7.1
@@ -290,8 +299,6 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.seleniumhq.selenium:selenium-api:3.141.59
 org.seleniumhq.selenium:selenium-chrome-driver:3.141.59
 org.seleniumhq.selenium:selenium-edge-driver:3.141.59
@@ -305,13 +312,13 @@ org.seleniumhq.selenium:selenium-support:3.141.59
 org.slf4j:jcl-over-slf4j:1.7.30
 org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:junit-jupiter:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:selenium:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:junit-jupiter:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:selenium:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.webjars.npm:viz.js-for-graphviz-java:2.1.3
--- a/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -10,10 +10,14 @@ com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
 com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
-com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.3
-com.fasterxml.jackson.core:jackson-databind:2.11.2
+com.fasterxml.jackson.core:jackson-annotations:2.12.1
+com.fasterxml.jackson.core:jackson-core:2.12.1
+com.fasterxml.jackson.core:jackson-databind:2.12.1
+com.fasterxml.jackson:jackson-bom:2.12.1
 com.fasterxml:classmate:1.5.1
+com.github.docker-java:docker-java-api:3.2.7
+com.github.docker-java:docker-java-transport-zerodep:3.2.7
+com.github.docker-java:docker-java-transport:3.2.7
 com.github.jnr:jffi:1.2.23
 com.github.jnr:jnr-a64asm:1.0.0
 com.github.jnr:jnr-constants:0.9.15
@@ -22,51 +26,61 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
+com.github.rholder:guava-retrying:2.0.0
 com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
-com.google.api-client:google-api-client-jackson2:1.30.9
-com.google.api-client:google-api-client-java6:1.30.9
+com.google.api-client:google-api-client-jackson2:1.30.10
+com.google.api-client:google-api-client-java6:1.30.10
 com.google.api-client:google-api-client-servlet:1.30.8
-com.google.api-client:google-api-client:1.30.9
-com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:grpc-google-common-protos:1.17.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.90.0
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.90.0
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
-com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:2.0.0
-com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api-client:google-api-client:1.30.10
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:1.14.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.90.3
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:grpc-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:grpc-google-common-protos:1.18.1
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:1.5.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.105.5
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.105.5
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.14.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:1.16.1
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.88.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.92.0
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:0.7.0
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.9
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.9
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:2.0.2
+com.google.api.grpc:proto-google-cloud-spanner-v1:2.0.2
+com.google.api.grpc:proto-google-common-protos:2.0.1
+com.google.api.grpc:proto-google-iam-v1:1.0.5
 com.google.api:api-common:1.10.1
-com.google.api:gax-grpc:1.60.0
-com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.60.0
+com.google.api:gax-grpc:1.60.1
+com.google.api:gax-httpjson:0.76.1
+com.google.api:gax:1.60.1
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
-com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
-com.google.apis:google-api-services-clouddebugger:v2-rev20200313-1.30.9
+com.google.apis:google-api-services-bigquery:v2-rev20200916-1.30.10
+com.google.apis:google-api-services-clouddebugger:v2-rev20200501-1.30.10
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200311-1.30.9
-com.google.apis:google-api-services-dataflow:v1b3-rev20200305-1.30.9
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20200720-1.30.10
+com.google.apis:google-api-services-dataflow:v1b3-rev20200713-1.30.10
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
-com.google.apis:google-api-services-healthcare:v1beta1-rev20200525-1.30.9
+com.google.apis:google-api-services-healthcare:v1beta1-rev20200713-1.30.10
+com.google.apis:google-api-services-iamcredentials:v1-rev20201022-1.30.10
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
-com.google.apis:google-api-services-pubsub:v1-rev20200312-1.30.9
+com.google.apis:google-api-services-pubsub:v1-rev20200713-1.30.10
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20190827-1.30.1
-com.google.apis:google-api-services-storage:v1-rev20200326-1.30.9
+com.google.apis:google-api-services-storage:v1-rev20200927-1.30.10
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
 com.google.appengine.tools:appengine-pipeline:0.2.13
@@ -74,41 +88,44 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.22.0
-com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auth:google-auth-library-credentials:0.22.2
+com.google.auth:google-auth-library-oauth2-http:0.22.2
+com.google.auto.service:auto-service-annotations:1.0-rc7
 com.google.auto.value:auto-value-annotations:1.7.4
-com.google.auto.value:auto-value:1.6.3
-com.google.cloud.bigdataoss:gcsio:2.1.3
-com.google.cloud.bigdataoss:util:2.1.3
-com.google.cloud.bigtable:bigtable-client-core:1.13.0
+com.google.auto.value:auto-value:1.7.4
+com.google.cloud.bigdataoss:gcsio:2.1.6
+com.google.cloud.bigdataoss:util:2.1.6
+com.google.cloud.bigtable:bigtable-client-core:1.16.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.3
 com.google.cloud.sql:jdbc-socket-factory-core:1.0.16
 com.google.cloud.sql:postgres-socket-factory:1.0.16
-com.google.cloud:google-cloud-bigquery:1.106.0
-com.google.cloud:google-cloud-bigquerystorage:0.125.0-beta
-com.google.cloud:google-cloud-bigtable:1.9.1
-com.google.cloud:google-cloud-core-grpc:1.92.2
-com.google.cloud:google-cloud-core-http:1.92.4
-com.google.cloud:google-cloud-core:1.92.5
-com.google.cloud:google-cloud-secretmanager:1.2.3
-com.google.cloud:google-cloud-spanner:1.49.1
+com.google.cloud:google-cloud-bigquery:1.122.2
+com.google.cloud:google-cloud-bigquerystorage:1.5.5
+com.google.cloud:google-cloud-bigtable:1.14.0
+com.google.cloud:google-cloud-core-grpc:1.93.9
+com.google.cloud:google-cloud-core-http:1.93.9
+com.google.cloud:google-cloud-core:1.93.9
+com.google.cloud:google-cloud-pubsub:1.110.0
+com.google.cloud:google-cloud-pubsublite:0.7.0
+com.google.cloud:google-cloud-secretmanager:1.2.9
+com.google.cloud:google-cloud-spanner:2.0.2
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.4.0
+com.google.errorprone:error_prone_annotations:2.5.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:30.0-jre
-com.google.guava:guava:30.0-jre
+com.google.guava:guava-testlib:30.1-jre
+com.google.guava:guava:30.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.37.0
+com.google.http-client:google-http-client-appengine:1.36.0
+com.google.http-client:google-http-client-jackson2:1.38.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.37.0
+com.google.http-client:google-http-client:1.38.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -117,12 +134,12 @@ com.google.monitoring-client:contrib:1.0.7
 com.google.monitoring-client:metrics:1.0.7
 com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.30.5
-com.google.oauth-client:google-oauth-client-java6:1.30.6
+com.google.oauth-client:google-oauth-client-java6:1.31.2
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
-com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.13.0
-com.google.protobuf:protobuf-java:3.13.0
+com.google.oauth-client:google-oauth-client:1.31.2
+com.google.protobuf:protobuf-java-util:3.14.0
+com.google.protobuf:protobuf-java:3.14.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -132,17 +149,14 @@ com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
-com.kohlschutter.junixsocket:junixsocket-common:2.0.4
-com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp3:okhttp:3.11.0
-com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.14.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
 com.zaxxer:HikariCP:3.4.5
-commons-codec:commons-codec:1.13
+commons-codec:commons-codec:1.15
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 guru.nidi.com.kitfox:svgSalamander:1.1.3
@@ -151,31 +165,28 @@ guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.github.java-diff-utils:java-diff-utils:4.0
-io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.32.2
-io.grpc:grpc-api:1.32.2
-io.grpc:grpc-auth:1.32.2
-io.grpc:grpc-context:1.32.2
-io.grpc:grpc-core:1.32.2
-io.grpc:grpc-grpclb:1.32.2
-io.grpc:grpc-netty-shaded:1.32.2
-io.grpc:grpc-netty:1.27.2
-io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.32.2
-io.grpc:grpc-protobuf:1.32.2
-io.grpc:grpc-stub:1.32.2
-io.grpc:grpc-testing:1.27.2
-io.netty:netty-buffer:4.1.42.Final
-io.netty:netty-codec-http2:4.1.42.Final
-io.netty:netty-codec-http:4.1.42.Final
-io.netty:netty-codec-socks:4.1.42.Final
-io.netty:netty-codec:4.1.42.Final
-io.netty:netty-common:4.1.42.Final
-io.netty:netty-handler-proxy:4.1.42.Final
-io.netty:netty-handler:4.1.42.Final
-io.netty:netty-resolver:4.1.42.Final
-io.netty:netty-tcnative-boringssl-static:2.0.17.Final
-io.netty:netty-transport:4.1.42.Final
+io.grpc:grpc-alts:1.34.1
+io.grpc:grpc-api:1.34.1
+io.grpc:grpc-auth:1.34.1
+io.grpc:grpc-context:1.34.1
+io.grpc:grpc-core:1.34.1
+io.grpc:grpc-grpclb:1.34.1
+io.grpc:grpc-netty-shaded:1.34.1
+io.grpc:grpc-netty:1.32.2
+io.grpc:grpc-protobuf-lite:1.34.1
+io.grpc:grpc-protobuf:1.34.1
+io.grpc:grpc-stub:1.34.1
+io.netty:netty-buffer:4.1.51.Final
+io.netty:netty-codec-http2:4.1.51.Final
+io.netty:netty-codec-http:4.1.51.Final
+io.netty:netty-codec-socks:4.1.51.Final
+io.netty:netty-codec:4.1.51.Final
+io.netty:netty-common:4.1.51.Final
+io.netty:netty-handler-proxy:4.1.51.Final
+io.netty:netty-handler:4.1.51.Final
+io.netty:netty-resolver:4.1.51.Final
+io.netty:netty-tcnative-boringssl-static:2.0.33.Final
+io.netty:netty-transport:4.1.51.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
@@ -195,30 +206,29 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-junit:junit:4.13
+junit:junit:4.13.1
 net.arnx:nashorn-promise:0.1.1
-net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.17
-net.java.dev.jna:jna-platform:5.5.0
+net.bytebuddy:byte-buddy-agent:1.10.19
+net.bytebuddy:byte-buddy:1.10.19
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-fn-execution:2.23.0
-org.apache.beam:beam-model-job-management:2.23.0
-org.apache.beam:beam-model-pipeline:2.23.0
-org.apache.beam:beam-runners-core-construction-java:2.23.0
-org.apache.beam:beam-runners-direct-java:2.23.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.23.0
-org.apache.beam:beam-runners-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-core:2.23.0
-org.apache.beam:beam-sdks-java-expansion-service:2.23.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.23.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.23.0
-org.apache.beam:beam-sdks-java-fn-execution:2.23.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.23.0
+org.apache.beam:beam-model-fn-execution:2.27.0
+org.apache.beam:beam-model-job-management:2.27.0
+org.apache.beam:beam-model-pipeline:2.27.0
+org.apache.beam:beam-runners-core-construction-java:2.27.0
+org.apache.beam:beam-runners-direct-java:2.27.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.27.0
+org.apache.beam:beam-runners-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-core:2.27.0
+org.apache.beam:beam-sdks-java-expansion-service:2.27.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.27.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.27.0
+org.apache.beam:beam-sdks-java-fn-execution:2.27.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.27.0
 org.apache.beam:beam-vendor-bytebuddy-1_10_8:0.1
 org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
-org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
+org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.27.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
@@ -239,20 +249,20 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:3.5.0
+org.checkerframework:checker-qual:3.7.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.19
-org.conscrypt:conscrypt-openjdk-uber:2.2.1
+org.conscrypt:conscrypt-openjdk-uber:2.5.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-all:1.3
-org.hamcrest:hamcrest-core:1.3
-org.hamcrest:hamcrest-library:1.3
+org.hamcrest:hamcrest-core:2.2
+org.hamcrest:hamcrest-library:2.2
+org.hamcrest:hamcrest:2.2
 org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
 org.hibernate:hibernate-core:5.4.23.Final
 org.hibernate:hibernate-hikaricp:5.4.23.Final
@@ -260,27 +270,26 @@ org.javassist:javassist:3.24.0-GA
 org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
-org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
-org.json:json:20160810
+org.json:json:20200518
 org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
-org.junit.jupiter:junit-jupiter-api:5.6.2
-org.junit.jupiter:junit-jupiter-engine:5.6.2
-org.junit.jupiter:junit-jupiter-migrationsupport:5.6.2
-org.junit.jupiter:junit-jupiter-params:5.6.2
-org.junit.platform:junit-platform-commons:1.6.2
-org.junit.platform:junit-platform-engine:1.6.2
-org.junit.platform:junit-platform-launcher:1.6.2
-org.junit.platform:junit-platform-runner:1.6.2
-org.junit.platform:junit-platform-suite-api:1.6.2
-org.junit:junit-bom:5.6.2
+org.junit.jupiter:junit-jupiter-api:5.7.0
+org.junit.jupiter:junit-jupiter-engine:5.7.0
+org.junit.jupiter:junit-jupiter-migrationsupport:5.7.0
+org.junit.jupiter:junit-jupiter-params:5.7.0
+org.junit.platform:junit-platform-commons:1.7.0
+org.junit.platform:junit-platform-engine:1.7.0
+org.junit.platform:junit-platform-launcher:1.7.0
+org.junit.platform:junit-platform-runner:1.7.0
+org.junit.platform:junit-platform-suite-api:1.7.0
+org.junit:junit-bom:5.7.0
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:3.3.3
-org.mockito:mockito-junit-jupiter:3.3.3
+org.mockito:mockito-core:3.7.7
+org.mockito:mockito-junit-jupiter:3.7.7
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
-org.objenesis:objenesis:2.6
+org.objenesis:objenesis:3.1
 org.opentest4j:opentest4j:1.2.0
 org.ow2.asm:asm-analysis:8.0.1
 org.ow2.asm:asm-commons:7.1
@@ -290,8 +299,6 @@ org.ow2.asm:asm:8.0.1
 org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
-org.rnorth:tcp-unix-socket-proxy:1.0.2
-org.scijava:native-lib-loader:2.0.2
 org.seleniumhq.selenium:selenium-api:3.141.59
 org.seleniumhq.selenium:selenium-chrome-driver:3.141.59
 org.seleniumhq.selenium:selenium-edge-driver:3.141.59
@@ -306,13 +313,13 @@ org.slf4j:jcl-over-slf4j:1.7.30
 org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
-org.testcontainers:database-commons:1.14.3
-org.testcontainers:jdbc:1.14.3
-org.testcontainers:junit-jupiter:1.14.3
-org.testcontainers:postgresql:1.14.3
-org.testcontainers:selenium:1.14.3
-org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.5
+org.testcontainers:database-commons:1.15.1
+org.testcontainers:jdbc:1.15.1
+org.testcontainers:junit-jupiter:1.15.1
+org.testcontainers:postgresql:1.15.1
+org.testcontainers:selenium:1.15.1
+org.testcontainers:testcontainers:1.15.1
+org.threeten:threetenbp:1.5.0
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.webjars.npm:viz.js-for-graphviz-java:2.1.3
--- a/core/src/main/java/google/registry/backup/ReplayCommitLogsToSqlAction.java
+++ b/core/src/main/java/google/registry/backup/ReplayCommitLogsToSqlAction.java
@@ -85,7 +85,7 @@ public class ReplayCommitLogsToSqlAction implements Runnable {
    Optional<Lock> lock =
        Lock.acquire(
            this.getClass().getSimpleName(), null, LEASE_LENGTH, requestStatusChecker, false);
-    if (lock.isEmpty()) {
+    if (!lock.isPresent()) {
      String message = "Can't acquire SQL commit log replay lock, aborting.";
      logger.atSevere().log(message);
      // App Engine will retry on any non-2xx status code, which we don't want in this case.
@@ -140,11 +140,13 @@ public class ReplayCommitLogsToSqlAction implements Runnable {
    transaction.stream()
        .sorted(ReplayCommitLogsToSqlAction::compareByWeight)
        .forEach(
-            versionedEntity ->
-                versionedEntity
-                    .getEntity()
-                    .ifPresentOrElse(
-                        this::handleEntityPut, () -> handleEntityDelete(versionedEntity)));
+            versionedEntity -> {
+              if (versionedEntity.getEntity().isPresent()) {
+                handleEntityPut(versionedEntity.getEntity().get());
+              } else {
+                handleEntityDelete(versionedEntity);
+              }
+            });
  }

  private void handleEntityPut(Entity entity) {
@@ -182,7 +184,7 @@ public class ReplayCommitLogsToSqlAction implements Runnable {
  }

  private static int compareByWeight(VersionedEntity a, VersionedEntity b) {
-    return getEntityPriority(a.key().getKind(), a.getEntity().isEmpty())
-        - getEntityPriority(b.key().getKind(), b.getEntity().isEmpty());
+    return getEntityPriority(a.key().getKind(), !a.getEntity().isPresent())
+        - getEntityPriority(b.key().getKind(), !b.getEntity().isPresent());
  }
 }
--- a/core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java
+++ b/core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java
@@ -345,7 +345,7 @@ public class DeleteContactsAndHostsAction implements Runnable {
      String resourceClientId = resource.getPersistedCurrentSponsorClientId();
      if (resource instanceof HostResource && ((HostResource) resource).isSubordinate()) {
        resourceClientId =
-            tm().load(((HostResource) resource).getSuperordinateDomain())
+            tm().loadByKey(((HostResource) resource).getSuperordinateDomain())
                .cloneProjectedAtTime(now)
                .getCurrentSponsorClientId();
      }
@@ -465,7 +465,7 @@ public class DeleteContactsAndHostsAction implements Runnable {
        if (host.isSubordinate()) {
          dnsQueue.addHostRefreshTask(host.getHostName());
          tm().put(
-                  tm().load(host.getSuperordinateDomain())
+                  tm().loadByKey(host.getSuperordinateDomain())
                      .asBuilder()
                      .removeSubordinateHost(host.getHostName())
                      .build());
--- a/core/src/main/java/google/registry/batch/DeleteExpiredDomainsAction.java
+++ b/core/src/main/java/google/registry/batch/DeleteExpiredDomainsAction.java
@@ -0,0 +1,194 @@
+// Copyright 2021 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.batch;
+
+import static com.google.common.collect.ImmutableList.toImmutableList;
+import static com.google.common.net.MediaType.PLAIN_TEXT_UTF_8;
+import static google.registry.flows.FlowUtils.marshalWithLenientRetry;
+import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.util.DateTimeUtils.END_OF_TIME;
+import static google.registry.util.ResourceUtils.readResourceUtf8;
+import static java.nio.charset.StandardCharsets.UTF_8;
+import static javax.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
+import static javax.servlet.http.HttpServletResponse.SC_NO_CONTENT;
+import static javax.servlet.http.HttpServletResponse.SC_OK;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.flogger.FluentLogger;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.flows.EppController;
+import google.registry.flows.EppRequestSource;
+import google.registry.flows.PasswordOnlyTransportCredentials;
+import google.registry.flows.StatelessRequestSessionMetadata;
+import google.registry.model.domain.DomainBase;
+import google.registry.model.eppcommon.ProtocolDefinition;
+import google.registry.model.eppoutput.EppOutput;
+import google.registry.request.Action;
+import google.registry.request.Action.Method;
+import google.registry.request.Response;
+import google.registry.request.auth.Auth;
+import google.registry.request.lock.LockHandler;
+import google.registry.util.Clock;
+import java.util.Optional;
+import java.util.concurrent.Callable;
+import javax.inject.Inject;
+import org.joda.time.DateTime;
+import org.joda.time.Duration;
+
+/**
+ * An action that deletes all non-renewing domains whose expiration dates have now passed.
+ *
+ * <p>The registry runs on an autorenew domain model, so domains don't ever expire naturally; they
+ * are only ever autorenewed. However, in some situations (such as URS) we don't want this to
+ * happen. Thus, the domains are tagged as non-renewing and are deleted by the next daily invocation
+ * of this action once they are past the date at which they were to expire.
+ *
+ * <p>Note that this action works by running a superuser EPP domain delete command, and as a side
+ * effect of when domains are deleted (just past their expiration date), they are invariably in the
+ * autorenew grace period when this happens.
+ */
+@Action(
+    service = Action.Service.BACKEND,
+    path = DeleteExpiredDomainsAction.PATH,
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN,
+    method = Method.POST)
+public class DeleteExpiredDomainsAction implements Runnable {
+
+  public static final String PATH = "/_dr/task/deleteExpiredDomains";
+  private static final String LOCK_NAME = "Delete expired domains";
+
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+  private final EppController eppController;
+  private final String registryAdminClientId;
+  private final Clock clock;
+  private final LockHandler lockHandler;
+  private final Response response;
+  private final String deleteXmlTmpl;
+
+  @Inject
+  DeleteExpiredDomainsAction(
+      EppController eppController,
+      @Config("registryAdminClientId") String registryAdminClientId,
+      Clock clock,
+      LockHandler lockHandler,
+      Response response) {
+    this.eppController = eppController;
+    this.registryAdminClientId = registryAdminClientId;
+    this.clock = clock;
+    this.lockHandler = lockHandler;
+    this.response = response;
+    this.deleteXmlTmpl =
+        readResourceUtf8(DeleteExpiredDomainsAction.class, "delete_expired_domain.xml");
+  }
+
+  @Override
+  public void run() {
+    response.setContentType(PLAIN_TEXT_UTF_8);
+
+    Callable<Void> runner =
+        () -> {
+          try {
+            runLocked();
+            response.setStatus(SC_OK);
+          } catch (Exception e) {
+            logger.atSevere().withCause(e).log("Errored out during execution.");
+            response.setStatus(SC_INTERNAL_SERVER_ERROR);
+            response.setPayload(String.format("Errored out with cause: %s", e));
+          }
+          return null;
+        };
+
+    if (!lockHandler.executeWithLocks(runner, null, Duration.standardHours(1), LOCK_NAME)) {
+      // Send a 200-series status code to prevent this conflicting action from retrying.
+      response.setStatus(SC_NO_CONTENT);
+      response.setPayload("Could not acquire lock; already running?");
+    }
+  }
+
+  private void runLocked() {
+    DateTime runTime = clock.nowUtc();
+    logger.atInfo().log(
+        "Deleting non-renewing domains with autorenew end times up through %s.", runTime);
+
+    // Note: This query is (and must be) non-transactional, and thus, is only eventually consistent.
+    ImmutableList<DomainBase> domainsToDelete =
+        ofy().load().type(DomainBase.class).filter("autorenewEndTime <=", runTime).list().stream()
+            // Datastore can't do two inequalities in one query, so the second happens in-memory.
+            .filter(d -> d.getDeletionTime().isEqual(END_OF_TIME))
+            .collect(toImmutableList());
+    if (domainsToDelete.isEmpty()) {
+      logger.atInfo().log("Found 0 domains to delete.");
+      response.setPayload("Found 0 domains to delete.");
+      return;
+    }
+
+    logger.atInfo().log(
+        "Found %d domains to delete: %s.",
+        domainsToDelete.size(),
+        String.join(
+            ", ",
+            domainsToDelete.stream().map(DomainBase::getDomainName).collect(toImmutableList())));
+    domainsToDelete.forEach(this::runDomainDeleteFlow);
+    logger.atInfo().log("Finished deleting domains.");
+    response.setPayload("Finished deleting domains.");
+  }
+
+  private void runDomainDeleteFlow(DomainBase domain) {
+    logger.atInfo().log("Attempting to delete domain %s", domain.getDomainName());
+    // Create a new transaction that the flow's execution will be enlisted in that loads the domain
+    // transactionally. This way we can ensure that nothing else has modified the domain in question
+    // in the intervening period since the query above found it.
+    Optional<EppOutput> eppOutput =
+        tm().transact(
+                () -> {
+                  DomainBase transDomain = tm().loadByKey(domain.createVKey());
+                  if (!domain.getAutorenewEndTime().isPresent()
+                      || domain.getAutorenewEndTime().get().isAfter(tm().getTransactionTime())) {
+                    logger.atSevere().log(
+                        "Failed to delete domain %s because of its autorenew end time: %s.",
+                        transDomain.getDomainName(), transDomain.getAutorenewEndTime());
+                    return Optional.empty();
+                  } else if (domain.getDeletionTime().isBefore(END_OF_TIME)) {
+                    logger.atSevere().log(
+                        "Failed to delete domain %s because it was already deleted on %s.",
+                        transDomain.getDomainName(), transDomain.getDeletionTime());
+                    return Optional.empty();
+                  }
+                  return Optional.of(
+                      eppController.handleEppCommand(
+                          new StatelessRequestSessionMetadata(
+                              registryAdminClientId,
+                              ProtocolDefinition.getVisibleServiceExtensionUris()),
+                          new PasswordOnlyTransportCredentials(),
+                          EppRequestSource.BACKEND,
+                          false,
+                          true,
+                          deleteXmlTmpl
+                              .replace("%DOMAIN%", transDomain.getDomainName())
+                              .getBytes(UTF_8)));
+                });
+
+    if (eppOutput.isPresent()) {
+      if (eppOutput.get().isSuccess()) {
+        logger.atInfo().log("Successfully deleted domain %s", domain.getDomainName());
+      } else {
+        logger.atWarning().log(
+            "Failed to delete domain %s; EPP response:\n\n%s",
+            domain.getDomainName(), new String(marshalWithLenientRetry(eppOutput.get()), UTF_8));
+      }
+    }
+  }
+}
--- a/core/src/main/java/google/registry/batch/ResaveAllEppResourcesAction.java
+++ b/core/src/main/java/google/registry/batch/ResaveAllEppResourcesAction.java
@@ -14,6 +14,7 @@

 package google.registry.batch;

+import static google.registry.mapreduce.MapreduceRunner.PARAM_FAST;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

@@ -24,6 +25,7 @@ import google.registry.mapreduce.MapreduceRunner;
 import google.registry.mapreduce.inputs.EppResourceInputs;
 import google.registry.model.EppResource;
 import google.registry.request.Action;
+import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import javax.inject.Inject;
@@ -39,6 +41,14 @@ import javax.inject.Inject;
 * <p>Because there are no auth settings in the {@link Action} annotation, this command can only be
 * run internally, or by pretending to be internal by setting the X-AppEngine-QueueName header,
 * which only admin users can do.
+ *
+ * <p>If the <code>?fast=true</code> querystring parameter is passed, then entities that are not
+ * changed by {@link EppResource#cloneProjectedAtTime} will not be re-saved. This helps prevent
+ * mutation load on the DB and has the beneficial side effect of writing out smaller commit logs.
+ * Note that this does NOT pick up mutations caused by migrations using the {@link
+ * com.googlecode.objectify.annotation.OnLoad} annotation, so if you are running a one-off schema
+ * migration, do not use fast mode. Fast mode defaults to false for this reason, but is used by the
+ * monthly invocation of the mapreduce.
 */
@Action(
    service = Action.Service.BACKEND,
@@ -48,7 +58,13 @@ public class ResaveAllEppResourcesAction implements Runnable {

  @Inject MapreduceRunner mrRunner;
  @Inject Response response;
-  @Inject ResaveAllEppResourcesAction() {}
+
+  @Inject
+  @Parameter(PARAM_FAST)
+  boolean isFast;
+
+  @Inject
+  ResaveAllEppResourcesAction() {}

  /**
   * The number of shards to run the map-only mapreduce on.
@@ -66,7 +82,7 @@ public class ResaveAllEppResourcesAction implements Runnable {
        .setModuleName("backend")
        .setDefaultMapShards(NUM_SHARDS)
        .runMapOnly(
-            new ResaveAllEppResourcesActionMapper(),
+            new ResaveAllEppResourcesActionMapper(isFast),
            ImmutableList.of(EppResourceInputs.createKeyInput(EppResource.class)))
        .sendLinkToMapreduceConsole(response);
  }
@@ -76,23 +92,33 @@ public class ResaveAllEppResourcesAction implements Runnable {
      extends Mapper<Key<EppResource>, Void, Void> {

    private static final long serialVersionUID = -7721628665138087001L;
-    public ResaveAllEppResourcesActionMapper() {}
+
+    private final boolean isFast;
+
+    ResaveAllEppResourcesActionMapper(boolean isFast) {
+      this.isFast = isFast;
+    }

    @Override
    public final void map(final Key<EppResource> resourceKey) {
-      tm()
-          .transact(
-              () -> {
-                EppResource projectedResource =
-                    ofy()
-                        .load()
-                        .key(resourceKey)
-                        .now()
-                        .cloneProjectedAtTime(tm().getTransactionTime());
-                ofy().save().entity(projectedResource).now();
-              });
-      getContext().incrementCounter(String.format("%s entities re-saved", resourceKey.getKind()));
+      boolean resaved =
+          tm().transact(
+                  () -> {
+                    EppResource originalResource = ofy().load().key(resourceKey).now();
+                    EppResource projectedResource =
+                        originalResource.cloneProjectedAtTime(tm().getTransactionTime());
+                    if (isFast && originalResource.equals(projectedResource)) {
+                      return false;
+                    } else {
+                      ofy().save().entity(projectedResource).now();
+                      return true;
+                    }
+                  });
+      getContext()
+          .incrementCounter(
+              String.format(
+                  "%s entities %s",
+                  resourceKey.getKind(), resaved ? "re-saved" : "with no changes skipped"));
    }
  }
 }
-
--- a/core/src/main/java/google/registry/batch/delete_expired_domain.xml
+++ b/core/src/main/java/google/registry/batch/delete_expired_domain.xml
@@ -0,0 +1,17 @@
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
+  <command>
+    <delete>
+      <domain:delete
+       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
+        <domain:name>%DOMAIN%</domain:name>
+      </domain:delete>
+    </delete>
+    <extension>
+      <metadata:metadata xmlns:metadata="urn:google:params:xml:ns:metadata-1.0">
+        <metadata:reason>Non-renewing domain has reached expiration date.</metadata:reason>
+        <metadata:requestedByRegistrar>false</metadata:requestedByRegistrar>
+      </metadata:metadata>
+    </extension>
+    <clTRID>ABC-12345</clTRID>
+  </command>
+</epp>
--- a/core/src/main/java/google/registry/beam/common/JpaDemoPipeline.java
+++ b/core/src/main/java/google/registry/beam/common/JpaDemoPipeline.java
@@ -0,0 +1,81 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.common;
+
+import static com.google.common.base.Verify.verify;
+import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
+
+import google.registry.backup.AppEngineEnvironment;
+import google.registry.persistence.transaction.JpaTransactionManager;
+import java.io.Serializable;
+import org.apache.beam.sdk.Pipeline;
+import org.apache.beam.sdk.metrics.Counter;
+import org.apache.beam.sdk.metrics.Metrics;
+import org.apache.beam.sdk.options.PipelineOptionsFactory;
+import org.apache.beam.sdk.transforms.Create;
+import org.apache.beam.sdk.transforms.DoFn;
+import org.apache.beam.sdk.transforms.ParDo;
+
+/** Toy pipeline that demonstrates how to use {@link JpaTransactionManager} in BEAM pipelines. */
+public class JpaDemoPipeline implements Serializable {
+
+  public static void main(String[] args) {
+    RegistryPipelineOptions options =
+        PipelineOptionsFactory.fromArgs(args).withValidation().as(RegistryPipelineOptions.class);
+    RegistryPipelineOptions.validateRegistryPipelineOptions(options);
+
+    Pipeline pipeline = Pipeline.create(options);
+    pipeline
+        .apply("Start", Create.of((Void) null))
+        .apply(
+            "Generate Elements",
+            ParDo.of(
+                new DoFn<Void, Void>() {
+                  @ProcessElement
+                  public void processElement(OutputReceiver<Void> output) {
+                    for (int i = 0; i < 500; i++) {
+                      output.output(null);
+                    }
+                  }
+                }))
+        .apply(
+            "Make Query",
+            ParDo.of(
+                new DoFn<Void, Void>() {
+                  private Counter counter = Metrics.counter("Demo", "Read");
+
+                  @ProcessElement
+                  public void processElement() {
+                    // AppEngineEnvironment is needed as long as JPA entity classes still depends
+                    // on Objectify.
+                    try (AppEngineEnvironment allowOfyEntity = new AppEngineEnvironment()) {
+                      int result =
+                          (Integer)
+                              jpaTm()
+                                  .transact(
+                                      () ->
+                                          jpaTm()
+                                              .getEntityManager()
+                                              .createNativeQuery("select 1;")
+                                              .getSingleResult());
+                      verify(result == 1, "Expecting 1, got %s.", result);
+                    }
+                    counter.inc();
+                  }
+                }));
+
+    pipeline.run();
+  }
+}
--- a/core/src/main/java/google/registry/beam/common/RegistryPipelineComponent.java
+++ b/core/src/main/java/google/registry/beam/common/RegistryPipelineComponent.java
@@ -0,0 +1,47 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.common;
+
+import dagger.Component;
+import dagger.Lazy;
+import google.registry.config.CredentialModule;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.config.RegistryConfig.ConfigModule;
+import google.registry.persistence.PersistenceModule;
+import google.registry.persistence.PersistenceModule.BeamJpaTm;
+import google.registry.persistence.transaction.JpaTransactionManager;
+import google.registry.privileges.secretmanager.SecretManagerModule;
+import google.registry.util.UtilsModule;
+import javax.inject.Singleton;
+
+/** Component that provides everything needed on a Pipeline worker. */
+@Singleton
+@Component(
+    modules = {
+      ConfigModule.class,
+      CredentialModule.class,
+      PersistenceModule.class,
+      SecretManagerModule.class,
+      UtilsModule.class
+    })
+public interface RegistryPipelineComponent {
+
+  /** Returns the GCP project ID. */
+  @Config("projectId")
+  String getProjectId();
+
+  @BeamJpaTm
+  Lazy<JpaTransactionManager> getJpaTransactionManager();
+}
--- a/core/src/main/java/google/registry/beam/common/RegistryPipelineOptions.java
+++ b/core/src/main/java/google/registry/beam/common/RegistryPipelineOptions.java
@@ -0,0 +1,58 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.common;
+
+import google.registry.config.RegistryEnvironment;
+import java.util.Objects;
+import javax.annotation.Nullable;
+import org.apache.beam.sdk.extensions.gcp.options.GcpOptions;
+import org.apache.beam.sdk.options.Description;
+
+/** Defines Nomulus-specific pipeline options. */
+public interface RegistryPipelineOptions extends GcpOptions {
+
+  @Description("The Registry environment.")
+  @Nullable
+  RegistryEnvironment getRegistryEnvironment();
+
+  void setRegistryEnvironment(RegistryEnvironment environment);
+
+  /**
+   * Validates the GCP project and Registry environment settings in {@code option}. If project is
+   * undefined, it is set according to the Registry environment; if project is defined but
+   * inconsistent with the Registry environment, an {@link IllegalArgumentException} will be thrown.
+   *
+   * <p>This method may modify the system property ("google.registry.environment" which is defined
+   * in {@link RegistryEnvironment}). Tests calling this method must restore the original
+   * environment on completion.
+   */
+  static void validateRegistryPipelineOptions(RegistryPipelineOptions option) {
+    RegistryEnvironment environment = option.getRegistryEnvironment();
+    if (environment == null) {
+      return;
+    }
+    environment.setup();
+    String projectByEnv = DaggerRegistryPipelineComponent.create().getProjectId();
+    if (Objects.equals(option.getProject(), projectByEnv)) {
+      return;
+    }
+    if (option.getProject() == null) {
+      option.setProject(projectByEnv);
+      return;
+    }
+    throw new IllegalArgumentException(
+        "Arguments for --project and --registryEnvironment do not match.");
+  }
+}
--- a/core/src/main/java/google/registry/beam/common/RegistryPipelineWorkerInitializer.java
+++ b/core/src/main/java/google/registry/beam/common/RegistryPipelineWorkerInitializer.java
@@ -0,0 +1,49 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.common;
+
+import com.google.auto.service.AutoService;
+import com.google.common.flogger.FluentLogger;
+import dagger.Lazy;
+import google.registry.config.RegistryEnvironment;
+import google.registry.persistence.transaction.JpaTransactionManager;
+import google.registry.persistence.transaction.TransactionManagerFactory;
+import org.apache.beam.sdk.harness.JvmInitializer;
+import org.apache.beam.sdk.options.PipelineOptions;
+
+/**
+ * Sets up Nomulus environment and initializes JPA on each pipeline worker.
+ *
+ * <p>This class only takes effect in portable beam pipeline runners (including the Cloud Dataflow
+ * runner). It is not invoked in test pipelines.
+ */
+@AutoService(JvmInitializer.class)
+public class RegistryPipelineWorkerInitializer implements JvmInitializer {
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  @Override
+  public void beforeProcessing(PipelineOptions options) {
+    RegistryEnvironment environment =
+        options.as(RegistryPipelineOptions.class).getRegistryEnvironment();
+    if (environment == null || environment.equals(RegistryEnvironment.UNITTEST)) {
+      return;
+    }
+    logger.atInfo().log("Setting up RegistryEnvironment: %s", environment);
+    environment.setup();
+    Lazy<JpaTransactionManager> transactionManagerLazy =
+        DaggerRegistryPipelineComponent.create().getJpaTransactionManager();
+    TransactionManagerFactory.setJpaTmOnBeamWorker(transactionManagerLazy::get);
+  }
+}
--- a/core/src/main/java/google/registry/beam/datastore/BulkDeletePipeline.java
+++ b/core/src/main/java/google/registry/beam/datastore/BulkDeletePipeline.java
@@ -0,0 +1,330 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.datastore;
+
+import static com.google.common.base.Preconditions.checkState;
+import static org.apache.beam.sdk.values.TypeDescriptors.kvs;
+import static org.apache.beam.sdk.values.TypeDescriptors.strings;
+
+import com.google.common.annotations.VisibleForTesting;
+import com.google.common.base.Splitter;
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableSortedSet;
+import com.google.common.flogger.FluentLogger;
+import com.google.datastore.v1.Entity;
+import java.util.Iterator;
+import java.util.Map;
+import org.apache.beam.sdk.Pipeline;
+import org.apache.beam.sdk.extensions.gcp.options.GcpOptions;
+import org.apache.beam.sdk.io.gcp.datastore.DatastoreIO;
+import org.apache.beam.sdk.options.Default;
+import org.apache.beam.sdk.options.Description;
+import org.apache.beam.sdk.options.PipelineOptionsFactory;
+import org.apache.beam.sdk.options.Validation;
+import org.apache.beam.sdk.transforms.Create;
+import org.apache.beam.sdk.transforms.DoFn;
+import org.apache.beam.sdk.transforms.GroupByKey;
+import org.apache.beam.sdk.transforms.MapElements;
+import org.apache.beam.sdk.transforms.PTransform;
+import org.apache.beam.sdk.transforms.ParDo;
+import org.apache.beam.sdk.transforms.Reshuffle;
+import org.apache.beam.sdk.transforms.View;
+import org.apache.beam.sdk.values.KV;
+import org.apache.beam.sdk.values.PBegin;
+import org.apache.beam.sdk.values.PCollection;
+import org.apache.beam.sdk.values.PCollectionTuple;
+import org.apache.beam.sdk.values.PCollectionView;
+import org.apache.beam.sdk.values.TupleTag;
+import org.apache.beam.sdk.values.TupleTagList;
+
+/**
+ * A BEAM pipeline that deletes Datastore entities in bulk.
+ *
+ * <p>This pipeline provides an alternative to the <a
+ * href="https://cloud.google.com/datastore/docs/bulk-delete">GCP builtin template</a> that performs
+ * the same task. It solves the following performance and usability problems in the builtin
+ * template:
+ *
+ * <ul>
+ *   <li>When deleting all data (by using the {@code select __key__} or {@code select *} queries),
+ *       the builtin template cannot parallelize the query, therefore has to query with a single
+ *       worker.
+ *   <li>When deleting all data, the builtin template also attempts to delete Datastore internal
+ *       tables which would cause permission-denied errors, which in turn MAY cause the pipeline to
+ *       abort before all data has been deleted.
+ *   <li>With the builtin template, it is possible to delete multiple entity types in one pipeline
+ *       ONLY if the user can come up with a single literal query that covers all of them. This is
+ *       not the case with most Nomulus entity types.
+ * </ul>
+ *
+ * <p>A user of this pipeline must specify the types of entities to delete using the {@code
+ * --kindsToDelete} command line argument. To delete specific entity types, give a comma-separated
+ * string of their kind names; to delete all data, give {@code "*"}.
+ *
+ * <p>When deleting all data, it is recommended for the user to specify the number of user entity
+ * types in the Datastore using the {@code --numOfKindsHint} argument. If the default value for this
+ * parameter is too low, performance will suffer.
+ */
+public class BulkDeletePipeline {
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  // This tool is not for use in our critical projects.
+  private static final ImmutableSet<String> FORBIDDEN_PROJECTS =
+      ImmutableSet.of("domain-registry", "domain-registry-sandbox");
+
+  private final BulkDeletePipelineOptions options;
+
+  private final Pipeline pipeline;
+
+  BulkDeletePipeline(BulkDeletePipelineOptions options) {
+    this.options = options;
+    pipeline = Pipeline.create(options);
+  }
+
+  public void run() {
+    setupPipeline();
+    pipeline.run();
+  }
+
+  @SuppressWarnings("deprecation") // org.apache.beam.sdk.transforms.Reshuffle
+  private void setupPipeline() {
+    checkState(
+        !FORBIDDEN_PROJECTS.contains(options.getProject()),
+        "Bulk delete is forbidden in %s",
+        options.getProject());
+
+    // Pre-allocated tags to label entities by kind. In the case of delete-all, we must use a guess.
+    TupleTagList deletionTags;
+    PCollection<String> kindsToDelete;
+
+    if (options.getKindsToDelete().equals("*")) {
+      deletionTags = getDeletionTags(options.getNumOfKindsHint());
+      kindsToDelete =
+          pipeline.apply("DiscoverEntityKinds", discoverEntityKinds(options.getProject()));
+    } else {
+      ImmutableList<String> kindsToDeleteParam = parseKindsToDelete(options);
+      checkState(
+          !kindsToDeleteParam.contains("*"),
+          "The --kindsToDelete argument should not contain both '*' and other kinds.");
+      deletionTags = getDeletionTags(kindsToDeleteParam.size());
+      kindsToDelete = pipeline.apply("UseProvidedKinds", Create.of(kindsToDeleteParam));
+    }
+
+    // Map each kind to a tag. The "SplitByKind" stage below will group entities by kind using
+    // this mapping. In practice, this has been effective at avoiding entity group contentions.
+    PCollectionView<Map<String, TupleTag<Entity>>> kindToTagMapping =
+        mapKindsToDeletionTags(kindsToDelete, deletionTags).apply("GetKindsToTagMap", View.asMap());
+
+    PCollectionTuple entities =
+        kindsToDelete
+            .apply("GenerateQueries", ParDo.of(new GenerateQueries()))
+            .apply("ReadEntities", DatastoreV1.read().withProjectId(options.getProject()))
+            .apply(
+                "SplitByKind",
+                ParDo.of(new SplitEntities(kindToTagMapping))
+                    .withSideInputs(kindToTagMapping)
+                    .withOutputTags(getOneDeletionTag("placeholder"), deletionTags));
+
+    for (TupleTag<?> tag : deletionTags.getAll()) {
+      entities
+          .get((TupleTag<Entity>) tag)
+          // Reshuffle calls GroupByKey which is one way to trigger load rebalance in the pipeline.
+          // Using the deprecated "Reshuffle" for convenience given the short life of this tool.
+          .apply("RebalanceLoad", Reshuffle.viaRandomKey())
+          .apply(
+              "DeleteEntities_" + tag.getId(),
+              DatastoreIO.v1().deleteEntity().withProjectId(options.getProject()));
+    }
+  }
+
+  private static String toKeyOnlyQueryForKind(String kind) {
+    return "select __key__ from `" + kind + "`";
+  }
+
+  /**
+   * Returns a {@link TupleTag} that retains the generic type parameter and may be used in a
+   * multi-output {@link ParDo} (e.g. {@link SplitEntities}).
+   *
+   * <p>This method is NOT needed in tests when creating tags for assertions. Simply create them
+   * with {@code new TupleTag<Entity>(String)}.
+   */
+  @VisibleForTesting
+  static TupleTag<Entity> getOneDeletionTag(String id) {
+    // The trailing {} is needed to retain generic param type.
+    return new TupleTag<Entity>(id) {};
+  }
+
+  @VisibleForTesting
+  static ImmutableList<String> parseKindsToDelete(BulkDeletePipelineOptions options) {
+    return ImmutableList.copyOf(
+        Splitter.on(",").omitEmptyStrings().trimResults().split(options.getKindsToDelete().trim()));
+  }
+
+  /**
+   * Returns a list of {@code n} {@link TupleTag TupleTags} numbered from {@code 0} to {@code n-1}.
+   */
+  @VisibleForTesting
+  static TupleTagList getDeletionTags(int n) {
+    ImmutableList.Builder<TupleTag<?>> builder = new ImmutableList.Builder<>();
+    for (int i = 0; i < n; i++) {
+      builder.add(getOneDeletionTag(String.valueOf(i)));
+    }
+    return TupleTagList.of(builder.build());
+  }
+
+  /** Returns a {@link PTransform} that finds all entity kinds in Datastore. */
+  @VisibleForTesting
+  static PTransform<PBegin, PCollection<String>> discoverEntityKinds(String project) {
+    return new PTransform<PBegin, PCollection<String>>() {
+      @Override
+      public PCollection<String> expand(PBegin input) {
+        // Use the __kind__ table to discover entity kinds. Data in the more informational
+        // __Stat_Kind__ table may be up to 48-hour stale.
+        return input
+            .apply(
+                "LoadEntityMetaData",
+                DatastoreIO.v1()
+                    .read()
+                    .withProjectId(project)
+                    .withLiteralGqlQuery("select * from __kind__"))
+            .apply(
+                "GetKindNames",
+                ParDo.of(
+                    new DoFn<Entity, String>() {
+                      @ProcessElement
+                      public void processElement(
+                          @Element Entity entity, OutputReceiver<String> out) {
+                        String kind = entity.getKey().getPath(0).getName();
+                        if (kind.startsWith("_")) {
+                          return;
+                        }
+                        out.output(kind);
+                      }
+                    }));
+      }
+    };
+  }
+
+  @VisibleForTesting
+  static PCollection<KV<String, TupleTag<Entity>>> mapKindsToDeletionTags(
+      PCollection<String> kinds, TupleTagList tags) {
+    // The first two stages send all strings in the 'kinds' PCollection to one worker which
+    // performs the mapping in the last stage.
+    return kinds
+        .apply(
+            "AssignSingletonKeyToKinds",
+            MapElements.into(kvs(strings(), strings())).via(kind -> KV.of("", kind)))
+        .apply("GatherKindsIntoCollection", GroupByKey.create())
+        .apply("MapKindsToTag", ParDo.of(new MapKindsToTags(tags)));
+  }
+
+  /** Transforms each {@code kind} string into a Datastore query for that kind. */
+  @VisibleForTesting
+  static class GenerateQueries extends DoFn<String, String> {
+    @ProcessElement
+    public void processElement(@Element String kind, OutputReceiver<String> out) {
+      out.output(toKeyOnlyQueryForKind(kind));
+    }
+  }
+
+  private static class MapKindsToTags
+      extends DoFn<KV<String, Iterable<String>>, KV<String, TupleTag<Entity>>> {
+    private final TupleTagList tupleTags;
+
+    MapKindsToTags(TupleTagList tupleTags) {
+      this.tupleTags = tupleTags;
+    }
+
+    @ProcessElement
+    public void processElement(
+        @Element KV<String, Iterable<String>> kv,
+        OutputReceiver<KV<String, TupleTag<Entity>>> out) {
+      // Sort kinds so that mapping is deterministic.
+      ImmutableSortedSet<String> sortedKinds = ImmutableSortedSet.copyOf(kv.getValue());
+      Iterator<String> kinds = sortedKinds.iterator();
+      Iterator<TupleTag<?>> tags = tupleTags.getAll().iterator();
+
+      while (kinds.hasNext() && tags.hasNext()) {
+        out.output(KV.of(kinds.next(), (TupleTag<Entity>) tags.next()));
+      }
+
+      if (kinds.hasNext()) {
+        logger.atWarning().log(
+            "There are more kinds to delete (%s) than our estimate (%s). "
+                + "Performance may suffer.",
+            sortedKinds.size(), tupleTags.size());
+      }
+      // Round robin assignment so that mapping is deterministic
+      while (kinds.hasNext()) {
+        tags = tupleTags.getAll().iterator();
+        while (kinds.hasNext() && tags.hasNext()) {
+          out.output(KV.of(kinds.next(), (TupleTag<Entity>) tags.next()));
+        }
+      }
+    }
+  }
+
+  /**
+   * {@link DoFn} that splits one {@link PCollection} of mixed kinds into multiple single-kind
+   * {@code PCollections}.
+   */
+  @VisibleForTesting
+  static class SplitEntities extends DoFn<Entity, Entity> {
+    private final PCollectionView<Map<String, TupleTag<Entity>>> kindToTagMapping;
+
+    SplitEntities(PCollectionView<Map<String, TupleTag<Entity>>> kindToTagMapping) {
+      super();
+      this.kindToTagMapping = kindToTagMapping;
+    }
+
+    @ProcessElement
+    public void processElement(ProcessContext context) {
+      Entity entity = context.element();
+      com.google.datastore.v1.Key entityKey = entity.getKey();
+      String kind = entityKey.getPath(entityKey.getPathCount() - 1).getKind();
+      TupleTag<Entity> tag = context.sideInput(kindToTagMapping).get(kind);
+      context.output(tag, entity);
+    }
+  }
+
+  public static void main(String[] args) {
+    BulkDeletePipelineOptions options =
+        PipelineOptionsFactory.fromArgs(args).withValidation().as(BulkDeletePipelineOptions.class);
+    BulkDeletePipeline pipeline = new BulkDeletePipeline(options);
+    pipeline.run();
+    System.exit(0);
+  }
+
+  public interface BulkDeletePipelineOptions extends GcpOptions {
+
+    @Description(
+        "The Datastore KINDs to be deleted. The format may be:\n"
+            + "\t- The list of kinds to be deleted as a comma-separated string, or\n"
+            + "\t- '*', which causes all kinds to be deleted.")
+    @Validation.Required
+    String getKindsToDelete();
+
+    void setKindsToDelete(String kinds);
+
+    @Description(
+        "An estimate of the number of KINDs to be deleted. "
+            + "This is recommended if --kindsToDelete is '*' and the default value is too low.")
+    @Default.Integer(30)
+    int getNumOfKindsHint();
+
+    void setNumOfKindsHint(int numOfKindsHint);
+  }
+}
--- a/core/src/main/java/google/registry/beam/datastore/DatastoreV1.java
+++ b/core/src/main/java/google/registry/beam/datastore/DatastoreV1.java
@@ -0,0 +1,765 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// This class is adapted from the Apache BEAM SDK. The original license may
+// be found at <a href="https://github.com/apache/beam/blob/master/LICENSE">
+// this link</a>.
+
+package google.registry.beam.datastore;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Verify.verify;
+import static com.google.datastore.v1.PropertyFilter.Operator.EQUAL;
+import static com.google.datastore.v1.PropertyOrder.Direction.DESCENDING;
+import static com.google.datastore.v1.QueryResultBatch.MoreResultsType.NOT_FINISHED;
+import static com.google.datastore.v1.client.DatastoreHelper.makeAndFilter;
+import static com.google.datastore.v1.client.DatastoreHelper.makeFilter;
+import static com.google.datastore.v1.client.DatastoreHelper.makeOrder;
+import static com.google.datastore.v1.client.DatastoreHelper.makeValue;
+
+import com.google.api.client.http.HttpRequestInitializer;
+import com.google.auth.Credentials;
+import com.google.auth.http.HttpCredentialsAdapter;
+import com.google.auto.value.AutoValue;
+import com.google.cloud.hadoop.util.ChainingHttpRequestInitializer;
+import com.google.common.base.Strings;
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.flogger.FluentLogger;
+import com.google.datastore.v1.Entity;
+import com.google.datastore.v1.EntityResult;
+import com.google.datastore.v1.GqlQuery;
+import com.google.datastore.v1.PartitionId;
+import com.google.datastore.v1.Query;
+import com.google.datastore.v1.QueryResultBatch;
+import com.google.datastore.v1.RunQueryRequest;
+import com.google.datastore.v1.RunQueryResponse;
+import com.google.datastore.v1.client.Datastore;
+import com.google.datastore.v1.client.DatastoreException;
+import com.google.datastore.v1.client.DatastoreFactory;
+import com.google.datastore.v1.client.DatastoreHelper;
+import com.google.datastore.v1.client.DatastoreOptions;
+import com.google.datastore.v1.client.QuerySplitter;
+import com.google.protobuf.Int32Value;
+import com.google.rpc.Code;
+import java.io.Serializable;
+import java.util.List;
+import java.util.NoSuchElementException;
+import javax.annotation.Nullable;
+import org.apache.beam.sdk.extensions.gcp.options.GcpOptions;
+import org.apache.beam.sdk.extensions.gcp.util.RetryHttpRequestInitializer;
+import org.apache.beam.sdk.metrics.Counter;
+import org.apache.beam.sdk.metrics.Metrics;
+import org.apache.beam.sdk.options.PipelineOptions;
+import org.apache.beam.sdk.transforms.DoFn;
+import org.apache.beam.sdk.transforms.PTransform;
+import org.apache.beam.sdk.transforms.ParDo;
+import org.apache.beam.sdk.transforms.Reshuffle;
+import org.apache.beam.sdk.transforms.display.DisplayData;
+import org.apache.beam.sdk.transforms.display.HasDisplayData;
+import org.apache.beam.sdk.util.BackOff;
+import org.apache.beam.sdk.util.BackOffUtils;
+import org.apache.beam.sdk.util.FluentBackoff;
+import org.apache.beam.sdk.util.Sleeper;
+import org.apache.beam.sdk.values.KV;
+import org.apache.beam.sdk.values.PCollection;
+import org.joda.time.Duration;
+
+/**
+ * Contains an adaptation of {@link org.apache.beam.sdk.io.gcp.datastore.DatastoreV1.Read}. See
+ * {@link MultiRead} for details.
+ */
+public class DatastoreV1 {
+
+  // A package-private constructor to prevent direct instantiation from outside of this package
+  DatastoreV1() {}
+
+  /**
+   * Non-retryable errors. See https://cloud.google.com/datastore/docs/concepts/errors#Error_Codes .
+   */
+  private static final ImmutableSet<Code> NON_RETRYABLE_ERRORS =
+      ImmutableSet.of(
+          Code.FAILED_PRECONDITION,
+          Code.INVALID_ARGUMENT,
+          Code.PERMISSION_DENIED,
+          Code.UNAUTHENTICATED);
+
+  /**
+   * Returns an empty {@link MultiRead} builder. Configure the source {@code projectId}, {@code
+   * query}, and optionally {@code namespace} and {@code numQuerySplits} using {@link
+   * MultiRead#withProjectId}, {@link MultiRead#withNamespace}, {@link
+   * MultiRead#withNumQuerySplits}.
+   */
+  public static MultiRead read() {
+    return new AutoValue_DatastoreV1_MultiRead.Builder().setNumQuerySplits(0).build();
+  }
+
+  /**
+   * A {@link PTransform} that executes every Cloud SQL queries in a {@link PCollection } and reads
+   * their result rows as {@code Entity} objects.
+   *
+   * <p>This class is adapted from {@link org.apache.beam.sdk.io.gcp.datastore.DatastoreV1.Read}. It
+   * uses literal GQL queries in the input {@link PCollection} instead of a constant query provided
+   * to the builder. Only the {@link #expand} method is modified from the original. Everything else
+   * including comments have been copied verbatim.
+   */
+  @AutoValue
+  public abstract static class MultiRead
+      extends PTransform<PCollection<String>, PCollection<Entity>> {
+    private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+    /** An upper bound on the number of splits for a query. */
+    public static final int NUM_QUERY_SPLITS_MAX = 50000;
+
+    /** A lower bound on the number of splits for a query. */
+    static final int NUM_QUERY_SPLITS_MIN = 12;
+
+    /** Default bundle size of 64MB. */
+    static final long DEFAULT_BUNDLE_SIZE_BYTES = 64L * 1024L * 1024L;
+
+    /**
+     * Maximum number of results to request per query.
+     *
+     * <p>Must be set, or it may result in an I/O error when querying Cloud Datastore.
+     */
+    static final int QUERY_BATCH_LIMIT = 500;
+
+    public abstract @Nullable String getProjectId();
+
+    public abstract @Nullable String getNamespace();
+
+    public abstract int getNumQuerySplits();
+
+    public abstract @Nullable String getLocalhost();
+
+    @Override
+    public abstract String toString();
+
+    abstract Builder toBuilder();
+
+    @AutoValue.Builder
+    abstract static class Builder {
+      abstract Builder setProjectId(String projectId);
+
+      abstract Builder setNamespace(String namespace);
+
+      abstract Builder setNumQuerySplits(int numQuerySplits);
+
+      abstract Builder setLocalhost(String localhost);
+
+      abstract MultiRead build();
+    }
+
+    /**
+     * Computes the number of splits to be performed on the given query by querying the estimated
+     * size from Cloud Datastore.
+     */
+    static int getEstimatedNumSplits(Datastore datastore, Query query, @Nullable String namespace) {
+      int numSplits;
+      try {
+        long estimatedSizeBytes = getEstimatedSizeBytes(datastore, query, namespace);
+        logger.atInfo().log("Estimated size bytes for the query is: %s", estimatedSizeBytes);
+        numSplits =
+            (int)
+                Math.min(
+                    NUM_QUERY_SPLITS_MAX,
+                    Math.round(((double) estimatedSizeBytes) / DEFAULT_BUNDLE_SIZE_BYTES));
+      } catch (Exception e) {
+        logger.atWarning().log("Failed the fetch estimatedSizeBytes for query: %s", query, e);
+        // Fallback in case estimated size is unavailable.
+        numSplits = NUM_QUERY_SPLITS_MIN;
+      }
+      return Math.max(numSplits, NUM_QUERY_SPLITS_MIN);
+    }
+
+    /**
+     * Cloud Datastore system tables with statistics are periodically updated. This method fetches
+     * the latest timestamp (in microseconds) of statistics update using the {@code __Stat_Total__}
+     * table.
+     */
+    private static long queryLatestStatisticsTimestamp(
+        Datastore datastore, @Nullable String namespace) throws DatastoreException {
+      Query.Builder query = Query.newBuilder();
+      // Note: namespace either being null or empty represents the default namespace, in which
+      // case we treat it as not provided by the user.
+      if (Strings.isNullOrEmpty(namespace)) {
+        query.addKindBuilder().setName("__Stat_Total__");
+      } else {
+        query.addKindBuilder().setName("__Stat_Ns_Total__");
+      }
+      query.addOrder(makeOrder("timestamp", DESCENDING));
+      query.setLimit(Int32Value.newBuilder().setValue(1));
+      RunQueryRequest request = makeRequest(query.build(), namespace);
+
+      RunQueryResponse response = datastore.runQuery(request);
+      QueryResultBatch batch = response.getBatch();
+      if (batch.getEntityResultsCount() == 0) {
+        throw new NoSuchElementException("Datastore total statistics unavailable");
+      }
+      Entity entity = batch.getEntityResults(0).getEntity();
+      return entity.getProperties().get("timestamp").getTimestampValue().getSeconds() * 1000000;
+    }
+
+    /** Retrieve latest table statistics for a given kind, namespace, and datastore. */
+    private static Entity getLatestTableStats(
+        String ourKind, @Nullable String namespace, Datastore datastore) throws DatastoreException {
+      long latestTimestamp = queryLatestStatisticsTimestamp(datastore, namespace);
+      logger.atInfo().log("Latest stats timestamp for kind %s is %s", ourKind, latestTimestamp);
+
+      Query.Builder queryBuilder = Query.newBuilder();
+      if (Strings.isNullOrEmpty(namespace)) {
+        queryBuilder.addKindBuilder().setName("__Stat_Kind__");
+      } else {
+        queryBuilder.addKindBuilder().setName("__Stat_Ns_Kind__");
+      }
+
+      queryBuilder.setFilter(
+          makeAndFilter(
+              makeFilter("kind_name", EQUAL, makeValue(ourKind).build()).build(),
+              makeFilter("timestamp", EQUAL, makeValue(latestTimestamp).build()).build()));
+
+      RunQueryRequest request = makeRequest(queryBuilder.build(), namespace);
+
+      long now = System.currentTimeMillis();
+      RunQueryResponse response = datastore.runQuery(request);
+      logger.atFine().log(
+          "Query for per-kind statistics took %sms", System.currentTimeMillis() - now);
+
+      QueryResultBatch batch = response.getBatch();
+      if (batch.getEntityResultsCount() == 0) {
+        throw new NoSuchElementException(
+            "Datastore statistics for kind " + ourKind + " unavailable");
+      }
+      return batch.getEntityResults(0).getEntity();
+    }
+
+    /**
+     * Get the estimated size of the data returned by the given query.
+     *
+     * <p>Cloud Datastore provides no way to get a good estimate of how large the result of a query
+     * entity kind being queried, using the __Stat_Kind__ system table, assuming exactly 1 kind is
+     * specified in the query.
+     *
+     * <p>See https://cloud.google.com/datastore/docs/concepts/stats.
+     */
+    static long getEstimatedSizeBytes(Datastore datastore, Query query, @Nullable String namespace)
+        throws DatastoreException {
+      String ourKind = query.getKind(0).getName();
+      Entity entity = getLatestTableStats(ourKind, namespace, datastore);
+      return entity.getProperties().get("entity_bytes").getIntegerValue();
+    }
+
+    private static PartitionId.Builder forNamespace(@Nullable String namespace) {
+      PartitionId.Builder partitionBuilder = PartitionId.newBuilder();
+      // Namespace either being null or empty represents the default namespace.
+      // Datastore Client libraries expect users to not set the namespace proto field in
+      // either of these cases.
+      if (!Strings.isNullOrEmpty(namespace)) {
+        partitionBuilder.setNamespaceId(namespace);
+      }
+      return partitionBuilder;
+    }
+
+    /** Builds a {@link RunQueryRequest} from the {@code query} and {@code namespace}. */
+    static RunQueryRequest makeRequest(Query query, @Nullable String namespace) {
+      return RunQueryRequest.newBuilder()
+          .setQuery(query)
+          .setPartitionId(forNamespace(namespace))
+          .build();
+    }
+
+    /** Builds a {@link RunQueryRequest} from the {@code GqlQuery} and {@code namespace}. */
+    private static RunQueryRequest makeRequest(GqlQuery gqlQuery, @Nullable String namespace) {
+      return RunQueryRequest.newBuilder()
+          .setGqlQuery(gqlQuery)
+          .setPartitionId(forNamespace(namespace))
+          .build();
+    }
+
+    /**
+     * A helper function to get the split queries, taking into account the optional {@code
+     * namespace}.
+     */
+    private static List<Query> splitQuery(
+        Query query,
+        @Nullable String namespace,
+        Datastore datastore,
+        QuerySplitter querySplitter,
+        int numSplits)
+        throws DatastoreException {
+      // If namespace is set, include it in the split request so splits are calculated accordingly.
+      return querySplitter.getSplits(query, forNamespace(namespace).build(), numSplits, datastore);
+    }
+
+    /**
+     * Translates a Cloud Datastore gql query string to {@link Query}.
+     *
+     * <p>Currently, the only way to translate a gql query string to a Query is to run the query
+     * against Cloud Datastore and extract the {@code Query} from the response. To prevent reading
+     * any data, we set the {@code LIMIT} to 0 but if the gql query already has a limit set, we
+     * catch the exception with {@code INVALID_ARGUMENT} error code and retry the translation
+     * without the zero limit.
+     *
+     * <p>Note: This may result in reading actual data from Cloud Datastore but the service has a
+     * cap on the number of entities returned for a single rpc request, so this should not be a
+     * problem in practice.
+     */
+    private static Query translateGqlQueryWithLimitCheck(
+        String gql, Datastore datastore, String namespace) throws DatastoreException {
+      String gqlQueryWithZeroLimit = gql + " LIMIT 0";
+      try {
+        Query translatedQuery = translateGqlQuery(gqlQueryWithZeroLimit, datastore, namespace);
+        // Clear the limit that we set.
+        return translatedQuery.toBuilder().clearLimit().build();
+      } catch (DatastoreException e) {
+        // Note: There is no specific error code or message to detect if the query already has a
+        // limit, so we just check for INVALID_ARGUMENT and assume that that the query might have
+        // a limit already set.
+        if (e.getCode() == Code.INVALID_ARGUMENT) {
+          logger.atWarning().log(
+              "Failed to translate Gql query '%s': %s", gqlQueryWithZeroLimit, e.getMessage());
+          logger.atWarning().log(
+              "User query might have a limit already set, so trying without zero limit");
+          // Retry without the zero limit.
+          return translateGqlQuery(gql, datastore, namespace);
+        } else {
+          throw e;
+        }
+      }
+    }
+
+    /** Translates a gql query string to {@link Query}. */
+    private static Query translateGqlQuery(String gql, Datastore datastore, String namespace)
+        throws DatastoreException {
+      logger.atInfo().log("Translating gql %s", gql);
+      GqlQuery gqlQuery = GqlQuery.newBuilder().setQueryString(gql).setAllowLiterals(true).build();
+      RunQueryRequest req = makeRequest(gqlQuery, namespace);
+      return datastore.runQuery(req).getQuery();
+    }
+
+    /**
+     * Returns a new {@link MultiRead} that reads from the Cloud Datastore for the specified
+     * project.
+     */
+    public MultiRead withProjectId(String projectId) {
+      checkArgument(projectId != null, "projectId can not be null");
+      return toBuilder().setProjectId(projectId).build();
+    }
+
+    /** Returns a new {@link MultiRead} that reads from the given namespace. */
+    public MultiRead withNamespace(String namespace) {
+      return toBuilder().setNamespace(namespace).build();
+    }
+
+    /**
+     * Returns a new {@link MultiRead} that reads by splitting the given {@code query} into {@code
+     * numQuerySplits}.
+     *
+     * <p>The semantics for the query splitting is defined below:
+     *
+     * <ul>
+     *   <li>Any value less than or equal to 0 will be ignored, and the number of splits will be
+     *       chosen dynamically at runtime based on the query data size.
+     *   <li>Any value greater than {@link MultiRead#NUM_QUERY_SPLITS_MAX} will be capped at {@code
+     *       NUM_QUERY_SPLITS_MAX}.
+     *   <li>If the {@code query} has a user limit set, then {@code numQuerySplits} will be ignored
+     *       and no split will be performed.
+     *   <li>Under certain cases Cloud Datastore is unable to split query to the requested number of
+     *       splits. In such cases we just use whatever the Cloud Datastore returns.
+     * </ul>
+     */
+    public MultiRead withNumQuerySplits(int numQuerySplits) {
+      return toBuilder()
+          .setNumQuerySplits(Math.min(Math.max(numQuerySplits, 0), NUM_QUERY_SPLITS_MAX))
+          .build();
+    }
+
+    /**
+     * Returns a new {@link MultiRead} that reads from a Datastore Emulator running at the given
+     * localhost address.
+     */
+    public MultiRead withLocalhost(String localhost) {
+      return toBuilder().setLocalhost(localhost).build();
+    }
+
+    /** Returns Number of entities available for reading. */
+    public long getNumEntities(
+        PipelineOptions options, String ourKind, @Nullable String namespace) {
+      try {
+        V1Options v1Options = V1Options.from(getProjectId(), getNamespace(), getLocalhost());
+        V1DatastoreFactory datastoreFactory = new V1DatastoreFactory();
+        Datastore datastore =
+            datastoreFactory.getDatastore(
+                options, v1Options.getProjectId(), v1Options.getLocalhost());
+
+        Entity entity = getLatestTableStats(ourKind, namespace, datastore);
+        return entity.getProperties().get("count").getIntegerValue();
+      } catch (Exception e) {
+        return -1;
+      }
+    }
+
+    @Override
+    public PCollection<Entity> expand(PCollection<String> gqlQueries) {
+      checkArgument(getProjectId() != null, "projectId cannot be null");
+
+      V1Options v1Options = V1Options.from(getProjectId(), getNamespace(), getLocalhost());
+
+      /*
+       * This composite transform involves the following steps:
+       *   1. Apply a {@link ParDo} that translates each query in {@code gqlQueries} into a {@code
+       *   query}.
+       *
+       *   2. A {@link ParDo} splits the resulting query into {@code numQuerySplits} and
+       *   assign each split query a unique {@code Integer} as the key. The resulting output is
+       *   of the type {@code PCollection<KV<Integer, Query>>}.
+       *
+       *   If the value of {@code numQuerySplits} is less than or equal to 0, then the number of
+       *   splits will be computed dynamically based on the size of the data for the {@code query}.
+       *
+       *   3. The resulting {@code PCollection} is sharded using a {@link GroupByKey} operation. The
+       *   queries are extracted from they {@code KV<Integer, Iterable<Query>>} and flattened to
+       *   output a {@code PCollection<Query>}.
+       *
+       *   4. In the third step, a {@code ParDo} reads entities for each query and outputs
+       *   a {@code PCollection<Entity>}.
+       */
+
+      PCollection<Query> inputQuery =
+          gqlQueries.apply(ParDo.of(new GqlQueryTranslateFn(v1Options)));
+
+      return inputQuery
+          .apply("Split", ParDo.of(new SplitQueryFn(v1Options, getNumQuerySplits())))
+          .apply("Reshuffle", Reshuffle.viaRandomKey())
+          .apply("Read", ParDo.of(new ReadFn(v1Options)));
+    }
+
+    @Override
+    public void populateDisplayData(DisplayData.Builder builder) {
+      super.populateDisplayData(builder);
+      builder
+          .addIfNotNull(DisplayData.item("projectId", getProjectId()).withLabel("ProjectId"))
+          .addIfNotNull(DisplayData.item("namespace", getNamespace()).withLabel("Namespace"));
+    }
+
+    private static class V1Options implements HasDisplayData, Serializable {
+      private final String project;
+      private final @Nullable String namespace;
+      private final @Nullable String localhost;
+
+      private V1Options(String project, @Nullable String namespace, @Nullable String localhost) {
+        this.project = project;
+        this.namespace = namespace;
+        this.localhost = localhost;
+      }
+
+      public static V1Options from(
+          String projectId, @Nullable String namespace, @Nullable String localhost) {
+        return new V1Options(projectId, namespace, localhost);
+      }
+
+      public String getProjectId() {
+        return project;
+      }
+
+      public @Nullable String getNamespace() {
+        return namespace;
+      }
+
+      public @Nullable String getLocalhost() {
+        return localhost;
+      }
+
+      @Override
+      public void populateDisplayData(DisplayData.Builder builder) {
+        builder
+            .addIfNotNull(DisplayData.item("projectId", getProjectId()).withLabel("ProjectId"))
+            .addIfNotNull(DisplayData.item("namespace", getNamespace()).withLabel("Namespace"));
+      }
+    }
+
+    /** A DoFn that translates a Cloud Datastore gql query string to {@code Query}. */
+    static class GqlQueryTranslateFn extends DoFn<String, Query> {
+      private final V1Options v1Options;
+      private transient Datastore datastore;
+      private final V1DatastoreFactory datastoreFactory;
+
+      GqlQueryTranslateFn(V1Options options) {
+        this(options, new V1DatastoreFactory());
+      }
+
+      GqlQueryTranslateFn(V1Options options, V1DatastoreFactory datastoreFactory) {
+        this.v1Options = options;
+        this.datastoreFactory = datastoreFactory;
+      }
+
+      @StartBundle
+      public void startBundle(StartBundleContext c) throws Exception {
+        datastore =
+            datastoreFactory.getDatastore(
+                c.getPipelineOptions(), v1Options.getProjectId(), v1Options.getLocalhost());
+      }
+
+      @ProcessElement
+      public void processElement(ProcessContext c) throws Exception {
+        String gqlQuery = c.element();
+        logger.atInfo().log("User query: '%s'", gqlQuery);
+        Query query =
+            translateGqlQueryWithLimitCheck(gqlQuery, datastore, v1Options.getNamespace());
+        logger.atInfo().log("User gql query translated to Query(%s)", query);
+        c.output(query);
+      }
+    }
+
+    /**
+     * A {@link DoFn} that splits a given query into multiple sub-queries, assigns them unique keys
+     * and outputs them as {@link KV}.
+     */
+    private static class SplitQueryFn extends DoFn<Query, Query> {
+      private final V1Options options;
+      // number of splits to make for a given query
+      private final int numSplits;
+
+      private final V1DatastoreFactory datastoreFactory;
+      // Datastore client
+      private transient Datastore datastore;
+      // Query splitter
+      private transient QuerySplitter querySplitter;
+
+      public SplitQueryFn(V1Options options, int numSplits) {
+        this(options, numSplits, new V1DatastoreFactory());
+      }
+
+      private SplitQueryFn(V1Options options, int numSplits, V1DatastoreFactory datastoreFactory) {
+        this.options = options;
+        this.numSplits = numSplits;
+        this.datastoreFactory = datastoreFactory;
+      }
+
+      @StartBundle
+      public void startBundle(StartBundleContext c) throws Exception {
+        datastore =
+            datastoreFactory.getDatastore(
+                c.getPipelineOptions(), options.getProjectId(), options.getLocalhost());
+        querySplitter = datastoreFactory.getQuerySplitter();
+      }
+
+      @ProcessElement
+      public void processElement(ProcessContext c) throws Exception {
+        Query query = c.element();
+
+        // If query has a user set limit, then do not split.
+        if (query.hasLimit()) {
+          c.output(query);
+          return;
+        }
+
+        int estimatedNumSplits;
+        // Compute the estimated numSplits if numSplits is not specified by the user.
+        if (numSplits <= 0) {
+          estimatedNumSplits = getEstimatedNumSplits(datastore, query, options.getNamespace());
+        } else {
+          estimatedNumSplits = numSplits;
+        }
+
+        logger.atInfo().log("Splitting the query into %s splits", estimatedNumSplits);
+        List<Query> querySplits;
+        try {
+          querySplits =
+              splitQuery(
+                  query, options.getNamespace(), datastore, querySplitter, estimatedNumSplits);
+        } catch (Exception e) {
+          logger.atWarning().log("Unable to parallelize the given query: %s", query, e);
+          querySplits = ImmutableList.of(query);
+        }
+
+        // assign unique keys to query splits.
+        for (Query subquery : querySplits) {
+          c.output(subquery);
+        }
+      }
+
+      @Override
+      public void populateDisplayData(DisplayData.Builder builder) {
+        super.populateDisplayData(builder);
+        builder.include("options", options);
+        if (numSplits > 0) {
+          builder.add(
+              DisplayData.item("numQuerySplits", numSplits)
+                  .withLabel("Requested number of Query splits"));
+        }
+      }
+    }
+
+    /** A {@link DoFn} that reads entities from Cloud Datastore for each query. */
+    private static class ReadFn extends DoFn<Query, Entity> {
+      private final V1Options options;
+      private final V1DatastoreFactory datastoreFactory;
+      // Datastore client
+      private transient Datastore datastore;
+      private final Counter rpcErrors = Metrics.counter(ReadFn.class, "datastoreRpcErrors");
+      private final Counter rpcSuccesses = Metrics.counter(ReadFn.class, "datastoreRpcSuccesses");
+      private static final int MAX_RETRIES = 5;
+      private static final FluentBackoff RUNQUERY_BACKOFF =
+          FluentBackoff.DEFAULT
+              .withMaxRetries(MAX_RETRIES)
+              .withInitialBackoff(Duration.standardSeconds(5));
+
+      public ReadFn(V1Options options) {
+        this(options, new V1DatastoreFactory());
+      }
+
+      private ReadFn(V1Options options, V1DatastoreFactory datastoreFactory) {
+        this.options = options;
+        this.datastoreFactory = datastoreFactory;
+      }
+
+      @StartBundle
+      public void startBundle(StartBundleContext c) throws Exception {
+        datastore =
+            datastoreFactory.getDatastore(
+                c.getPipelineOptions(), options.getProjectId(), options.getLocalhost());
+      }
+
+      private RunQueryResponse runQueryWithRetries(RunQueryRequest request) throws Exception {
+        Sleeper sleeper = Sleeper.DEFAULT;
+        BackOff backoff = RUNQUERY_BACKOFF.backoff();
+        while (true) {
+          try {
+            RunQueryResponse response = datastore.runQuery(request);
+            rpcSuccesses.inc();
+            return response;
+          } catch (DatastoreException exception) {
+            rpcErrors.inc();
+
+            if (NON_RETRYABLE_ERRORS.contains(exception.getCode())) {
+              throw exception;
+            }
+            if (!BackOffUtils.next(sleeper, backoff)) {
+              logger.atSevere().log("Aborting after %s retries.", MAX_RETRIES);
+              throw exception;
+            }
+          }
+        }
+      }
+
+      /** Read and output entities for the given query. */
+      @ProcessElement
+      public void processElement(ProcessContext context) throws Exception {
+        Query query = context.element();
+        String namespace = options.getNamespace();
+        int userLimit = query.hasLimit() ? query.getLimit().getValue() : Integer.MAX_VALUE;
+
+        boolean moreResults = true;
+        QueryResultBatch currentBatch = null;
+
+        while (moreResults) {
+          Query.Builder queryBuilder = query.toBuilder();
+          queryBuilder.setLimit(
+              Int32Value.newBuilder().setValue(Math.min(userLimit, QUERY_BATCH_LIMIT)));
+
+          if (currentBatch != null && !currentBatch.getEndCursor().isEmpty()) {
+            queryBuilder.setStartCursor(currentBatch.getEndCursor());
+          }
+
+          RunQueryRequest request = makeRequest(queryBuilder.build(), namespace);
+          RunQueryResponse response = runQueryWithRetries(request);
+
+          currentBatch = response.getBatch();
+
+          // MORE_RESULTS_AFTER_LIMIT is not implemented yet:
+          // https://groups.google.com/forum/#!topic/gcd-discuss/iNs6M1jA2Vw, so
+          // use result count to determine if more results might exist.
+          int numFetch = currentBatch.getEntityResultsCount();
+          if (query.hasLimit()) {
+            verify(
+                userLimit >= numFetch,
+                "Expected userLimit %s >= numFetch %s, because query limit %s must be <= userLimit",
+                userLimit,
+                numFetch,
+                query.getLimit());
+            userLimit -= numFetch;
+          }
+
+          // output all the entities from the current batch.
+          for (EntityResult entityResult : currentBatch.getEntityResultsList()) {
+            context.output(entityResult.getEntity());
+          }
+
+          // Check if we have more entities to be read.
+          moreResults =
+              // User-limit does not exist (so userLimit == MAX_VALUE) and/or has not been satisfied
+              (userLimit > 0)
+                  // All indications from the API are that there are/may be more results.
+                  && ((numFetch == QUERY_BATCH_LIMIT)
+                      || (currentBatch.getMoreResults() == NOT_FINISHED));
+        }
+      }
+
+      @Override
+      public void populateDisplayData(DisplayData.Builder builder) {
+        super.populateDisplayData(builder);
+        builder.include("options", options);
+      }
+    }
+  }
+
+  /**
+   * A wrapper factory class for Cloud Datastore singleton classes {@link DatastoreFactory} and
+   * {@link QuerySplitter}
+   *
+   * <p>{@link DatastoreFactory} and {@link QuerySplitter} are not java serializable, hence wrapping
+   * them under this class, which implements {@link Serializable}.
+   */
+  private static class V1DatastoreFactory implements Serializable {
+
+    /** Builds a Cloud Datastore client for the given pipeline options and project. */
+    public Datastore getDatastore(PipelineOptions pipelineOptions, String projectId) {
+      return getDatastore(pipelineOptions, projectId, null);
+    }
+
+    /**
+     * Builds a Cloud Datastore client for the given pipeline options, project and an optional
+     * locahost.
+     */
+    public Datastore getDatastore(
+        PipelineOptions pipelineOptions, String projectId, @Nullable String localhost) {
+      Credentials credential = pipelineOptions.as(GcpOptions.class).getGcpCredential();
+      HttpRequestInitializer initializer;
+      if (credential != null) {
+        initializer =
+            new ChainingHttpRequestInitializer(
+                new HttpCredentialsAdapter(credential), new RetryHttpRequestInitializer());
+      } else {
+        initializer = new RetryHttpRequestInitializer();
+      }
+
+      DatastoreOptions.Builder builder =
+          new DatastoreOptions.Builder().projectId(projectId).initializer(initializer);
+
+      if (localhost != null) {
+        builder.localHost(localhost);
+      } else {
+        builder.host("batch-datastore.googleapis.com");
+      }
+
+      return DatastoreFactory.get().create(builder.build());
+    }
+
+    /** Builds a Cloud Datastore {@link QuerySplitter}. */
+    public QuerySplitter getQuerySplitter() {
+      return DatastoreHelper.getQuerySplitter();
+    }
+  }
+}
--- a/core/src/main/java/google/registry/beam/initsql/BeamJpaModule.java
+++ b/core/src/main/java/google/registry/beam/initsql/BeamJpaModule.java
@@ -30,7 +30,9 @@ import google.registry.keyring.kms.KmsModule;
 import google.registry.persistence.PersistenceModule;
 import google.registry.persistence.PersistenceModule.JdbcJpaTm;
 import google.registry.persistence.PersistenceModule.SocketFactoryJpaTm;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.persistence.transaction.JpaTransactionManager;
+import google.registry.privileges.secretmanager.SecretManagerModule;
 import google.registry.util.UtilsModule;
 import java.io.BufferedReader;
 import java.io.IOException;
@@ -56,6 +58,7 @@ public class BeamJpaModule {

  @Nullable private final String sqlAccessInfoFile;
  @Nullable private final String cloudKmsProjectId;
+  @Nullable private final TransactionIsolationLevel isolationOverride;

  /**
   * Constructs a new instance of {@link BeamJpaModule}.
@@ -72,10 +75,20 @@ public class BeamJpaModule {
   *     real encrypted file on GCS as returned by {@link
   *     BackupPaths#getCloudSQLCredentialFilePatterns} or an unencrypted file on local filesystem
   *     with credentials to a test database.
+   * @param cloudKmsProjectId the GCP project where the credential decryption key can be found
+   * @param isolationOverride the desired Transaction Isolation level for all JDBC connections
   */
-  public BeamJpaModule(@Nullable String sqlAccessInfoFile, @Nullable String cloudKmsProjectId) {
+  public BeamJpaModule(
+      @Nullable String sqlAccessInfoFile,
+      @Nullable String cloudKmsProjectId,
+      @Nullable TransactionIsolationLevel isolationOverride) {
    this.sqlAccessInfoFile = sqlAccessInfoFile;
    this.cloudKmsProjectId = cloudKmsProjectId;
+    this.isolationOverride = isolationOverride;
+  }
+
+  public BeamJpaModule(@Nullable String sqlAccessInfoFile, @Nullable String cloudKmsProjectId) {
+    this(sqlAccessInfoFile, cloudKmsProjectId, null);
  }

  /** Returns true if the credential file is on GCS (and therefore expected to be encrypted). */
@@ -153,6 +166,13 @@ public class BeamJpaModule {
    return "nomulus-tool-keyring";
  }

+  @Provides
+  @Config("beamIsolationOverride")
+  @Nullable
+  TransactionIsolationLevel providesIsolationOverride() {
+    return isolationOverride;
+  }
+
  @Provides
  @Config("beamHibernateHikariMaximumPoolSize")
  static int getBeamHibernateHikariMaximumPoolSize() {
@@ -168,6 +188,7 @@ public class BeamJpaModule {
        BeamJpaModule.class,
        KmsModule.class,
        PersistenceModule.class,
+        SecretManagerModule.class,
        UtilsModule.class
      })
  public interface JpaTransactionManagerComponent {
--- a/core/src/main/java/google/registry/beam/initsql/DomainBaseUtil.java
+++ b/core/src/main/java/google/registry/beam/initsql/DomainBaseUtil.java
@@ -26,17 +26,15 @@ final class DomainBaseUtil {
  private DomainBaseUtil() {}

  /**
-   * Removes {@link google.registry.model.billing.BillingEvent.Recurring}, {@link
-   * google.registry.model.poll.PollMessage PollMessages} and {@link
-   * google.registry.model.host.HostResource name servers} from a Datastore {@link Entity} that
-   * represents an Ofy {@link google.registry.model.domain.DomainBase}. This breaks the cycle of
-   * foreign key constraints between these entity kinds, allowing {@code DomainBases} to be inserted
-   * into the SQL database. See {@link InitSqlPipeline} for a use case, where the full {@code
-   * DomainBases} are written again during the last stage of the pipeline.
+   * Removes properties that contain foreign keys from a Datastore {@link Entity} that represents an
+   * Ofy {@link google.registry.model.domain.DomainBase}. This breaks the cycle of foreign key
+   * constraints between entity kinds, allowing {@code DomainBases} to be inserted into the SQL
+   * database. See {@link InitSqlPipeline} for a use case, where the full {@code DomainBases} are
+   * written again during the last stage of the pipeline.
   *
   * <p>The returned object may be in bad state. Specifically, {@link
   * google.registry.model.eppcommon.StatusValue#INACTIVE} is not added after name servers are
-   * removed. This only impacts tests.
+   * removed. This only impacts tests that manipulate Datastore entities directly.
   *
   * <p>This operation is performed on an Datastore {@link Entity} instead of Ofy Java object
   * because Objectify requires access to a Datastore service when converting an Ofy object to a
@@ -70,6 +68,9 @@ final class DomainBaseUtil {
    domainBase.getProperties().keySet().stream()
        .filter(s -> s.startsWith("transferData."))
        .forEach(s -> clone.removeProperty(s));
+    domainBase.getProperties().keySet().stream()
+        .filter(s -> s.startsWith("gracePeriods."))
+        .forEach(s -> clone.removeProperty(s));
    return clone;
  }
 }
--- a/core/src/main/java/google/registry/beam/initsql/InitSqlPipeline.java
+++ b/core/src/main/java/google/registry/beam/initsql/InitSqlPipeline.java
@@ -34,6 +34,7 @@ import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarContact;
 import google.registry.model.registry.Registry;
 import google.registry.model.reporting.HistoryEntry;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.persistence.transaction.JpaTransactionManager;
 import java.io.Serializable;
 import java.util.Collection;
@@ -77,14 +78,22 @@ import org.joda.time.DateTime;
 *       HistoryEntry}.
 *   <li>{@link BillingEvent.OneTime}: references {@code Registrar}, {@code DomainBase}, {@code
 *       BillingEvent.Recurring}, {@code HistoryEntry} and {@code AllocationToken}.
- *   <li>{@link BillingEvent.Modification}: SQL model TBD. Will reference {@code Registrar}, {@code
- *       DomainBase} and {@code BillingEvent.OneTime}.
 *   <li>{@link BillingEvent.Cancellation}: references {@code Registrar}, {@code DomainBase}, {@code
 *       BillingEvent.Recurring}, {@code BillingEvent.OneTime}, and {@code HistoryEntry}.
 *   <li>{@link PollMessage}: references {@code Registrar}, {@code DomainBase}, {@code
 *       ContactResource}, {@code HostResource}, and {@code HistoryEntry}.
 *   <li>{@link DomainBase}, original copy from Datastore.
 * </ol>
+ *
+ * <p>This pipeline expects that the source Datastore has at least one entity in each of the types
+ * above. This assumption allows us to construct a simpler pipeline graph that can be visually
+ * examined, and is true in all intended use cases. However, tests must not violate this assumption
+ * when setting up data, otherwise they may run into foreign key constraint violations. The reason
+ * is that this pipeline uses the {@link Wait} transform to order the persistence by entity type.
+ * However, the wait is skipped if the target type has no data, resulting in subsequent entity types
+ * starting prematurely. E.g., if a Datastore has no {@code RegistrarContact} entities, the pipeline
+ * may start writing {@code DomainBase} entities before all {@code Registry}, {@code Registrar} and
+ * {@code ContactResource} entities have been persisted.
 */
 public class InitSqlPipeline implements Serializable {

@@ -93,24 +102,23 @@ public class InitSqlPipeline implements Serializable {
   * DomainBase}.
   */
  private static final ImmutableList<Class<?>> PHASE_ONE_ORDERED =
-      ImmutableList.of(Registry.class, Registrar.class, ContactResource.class);
+      ImmutableList.of(
+          Registry.class, Registrar.class, ContactResource.class, RegistrarContact.class);

  /**
   * Datastore kinds to be written to the SQL database after the cleansed version of {@link
   * DomainBase}.
-   *
-   * <p>The following entities are missing from the list:
-   *
-   * <ul>
-   *   <li>Those not modeled in JPA yet, e.g., {@code BillingEvent.Modification}.
-   *   <li>Those waiting for sanitation, e.g., {@code HistoryEntry}, which would have duplicate keys
-   *       after converting to SQL model.
-   *   <li>Those that have foreign key constraints on the above.
-   * </ul>
   */
-  // TODO(weiminyu): add more entities when available.
  private static final ImmutableList<Class<?>> PHASE_TWO_ORDERED =
-      ImmutableList.of(HostResource.class);
+      ImmutableList.of(
+          HostResource.class,
+          HistoryEntry.class,
+          AllocationToken.class,
+          BillingEvent.Recurring.class,
+          BillingEvent.OneTime.class,
+          BillingEvent.Cancellation.class,
+          PollMessage.class,
+          DomainBase.class);

  private final InitSqlPipelineOptions options;

@@ -226,7 +234,11 @@ public class InitSqlPipeline implements Serializable {
            transformId,
            options.getMaxConcurrentSqlWriters(),
            options.getSqlWriteBatchSize(),
-            new JpaSupplierFactory(credentialFileUrl, options.getCloudKmsProjectId(), jpaGetter)));
+            new JpaSupplierFactory(
+                credentialFileUrl,
+                options.getCloudKmsProjectId(),
+                jpaGetter,
+                TransactionIsolationLevel.TRANSACTION_READ_UNCOMMITTED)));
  }

  private static ImmutableList<String> toKindStrings(Collection<Class<?>> entityClasses) {
--- a/core/src/main/java/google/registry/beam/initsql/JpaSupplierFactory.java
+++ b/core/src/main/java/google/registry/beam/initsql/JpaSupplierFactory.java
@@ -16,6 +16,7 @@ package google.registry.beam.initsql;

 import google.registry.beam.initsql.BeamJpaModule.JpaTransactionManagerComponent;
 import google.registry.beam.initsql.Transforms.SerializableSupplier;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.persistence.transaction.JpaTransactionManager;
 import javax.annotation.Nullable;
 import org.apache.beam.sdk.transforms.SerializableFunction;
@@ -28,21 +29,32 @@ public class JpaSupplierFactory implements SerializableSupplier<JpaTransactionMa
  @Nullable private final String cloudKmsProjectId;
  private final SerializableFunction<JpaTransactionManagerComponent, JpaTransactionManager>
      jpaGetter;
+  @Nullable private final TransactionIsolationLevel isolationLevelOverride;

  public JpaSupplierFactory(
      String credentialFileUrl,
      @Nullable String cloudKmsProjectId,
      SerializableFunction<JpaTransactionManagerComponent, JpaTransactionManager> jpaGetter) {
+    this(credentialFileUrl, cloudKmsProjectId, jpaGetter, null);
+  }
+
+  public JpaSupplierFactory(
+      String credentialFileUrl,
+      @Nullable String cloudKmsProjectId,
+      SerializableFunction<JpaTransactionManagerComponent, JpaTransactionManager> jpaGetter,
+      @Nullable TransactionIsolationLevel isolationLevelOverride) {
    this.credentialFileUrl = credentialFileUrl;
    this.cloudKmsProjectId = cloudKmsProjectId;
    this.jpaGetter = jpaGetter;
+    this.isolationLevelOverride = isolationLevelOverride;
  }

  @Override
  public JpaTransactionManager get() {
    return jpaGetter.apply(
        DaggerBeamJpaModule_JpaTransactionManagerComponent.builder()
-            .beamJpaModule(new BeamJpaModule(credentialFileUrl, cloudKmsProjectId))
+            .beamJpaModule(
+                new BeamJpaModule(credentialFileUrl, cloudKmsProjectId, isolationLevelOverride))
            .build());
  }
 }
--- a/core/src/main/java/google/registry/beam/initsql/Transforms.java
+++ b/core/src/main/java/google/registry/beam/initsql/Transforms.java
@@ -17,11 +17,9 @@ package google.registry.beam.initsql;
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Preconditions.checkState;
-import static com.google.common.base.Throwables.throwIfUnchecked;
 import static google.registry.beam.initsql.BackupPaths.getCommitLogTimestamp;
 import static google.registry.beam.initsql.BackupPaths.getExportFilePatterns;
 import static google.registry.model.ofy.ObjectifyService.ofy;
-import static google.registry.persistence.JpaRetries.isFailedTxnRetriable;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.setJpaTm;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
@@ -38,28 +36,34 @@ import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.Streams;
+import com.googlecode.objectify.Key;
 import google.registry.backup.AppEngineEnvironment;
 import google.registry.backup.CommitLogImports;
 import google.registry.backup.VersionedEntity;
 import google.registry.model.domain.DomainBase;
 import google.registry.model.ofy.ObjectifyService;
-import google.registry.model.ofy.Ofy;
+import google.registry.model.reporting.HistoryEntry;
 import google.registry.persistence.transaction.JpaTransactionManager;
+import google.registry.schema.replay.DatastoreAndSqlEntity;
+import google.registry.schema.replay.SqlEntity;
 import google.registry.tools.LevelDbLogReader;
-import google.registry.util.SystemSleeper;
 import java.io.Serializable;
 import java.util.Collection;
 import java.util.Iterator;
+import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.ThreadLocalRandom;
 import java.util.function.Supplier;
+import javax.annotation.Nullable;
 import org.apache.beam.sdk.coders.StringUtf8Coder;
 import org.apache.beam.sdk.io.Compression;
 import org.apache.beam.sdk.io.FileIO;
 import org.apache.beam.sdk.io.FileIO.ReadableFile;
 import org.apache.beam.sdk.io.fs.EmptyMatchTreatment;
 import org.apache.beam.sdk.io.fs.MatchResult.Metadata;
+import org.apache.beam.sdk.metrics.Counter;
+import org.apache.beam.sdk.metrics.Metrics;
 import org.apache.beam.sdk.transforms.Create;
 import org.apache.beam.sdk.transforms.DoFn;
 import org.apache.beam.sdk.transforms.Flatten;
@@ -79,7 +83,6 @@ import org.apache.beam.sdk.values.TupleTag;
 import org.apache.beam.sdk.values.TupleTagList;
 import org.apache.beam.sdk.values.TypeDescriptor;
 import org.joda.time.DateTime;
-import org.joda.time.Duration;

 /**
 * {@link PTransform Pipeline transforms} used in pipelines that load from both Datastore export
@@ -289,7 +292,7 @@ public final class Transforms {
        maxWriters,
        batchSize,
        jpaSupplier,
-        (e) -> ofy().toPojo(e.getEntity().get()),
+        Transforms::convertVersionedEntityToSqlEntity,
        TypeDescriptor.of(VersionedEntity.class));
  }

@@ -330,11 +333,50 @@ public final class Transforms {
            .apply("Batch output by shard " + transformId, GroupIntoBatches.ofSize(batchSize))
            .apply(
                "Write in batch for " + transformId,
-                ParDo.of(new SqlBatchWriter<T>(jpaSupplier, jpaConverter)));
+                ParDo.of(new SqlBatchWriter<T>(transformId, jpaSupplier, jpaConverter)));
      }
    };
  }

+  private static Key toOfyKey(Object ofyEntity) {
+    return Key.create(ofyEntity);
+  }
+
+  private static boolean isMigratable(Entity entity) {
+    if (entity.getKind().equals("HistoryEntry")) {
+      // DOMAIN_APPLICATION_CREATE is deprecated type and should not be migrated.
+      // The Enum name DOMAIN_APPLICATION_CREATE no longer exists in Java and cannot
+      // be deserialized.
+      return !Objects.equals(entity.getProperty("type"), "DOMAIN_APPLICATION_CREATE");
+    }
+    return true;
+  }
+
+  private static SqlEntity toSqlEntity(Object ofyEntity) {
+    if (ofyEntity instanceof HistoryEntry) {
+      HistoryEntry ofyHistory = (HistoryEntry) ofyEntity;
+      return (SqlEntity) ofyHistory.toChildHistoryEntity();
+    }
+    return ((DatastoreAndSqlEntity) ofyEntity).toSqlEntity().get();
+  }
+
+  /**
+   * Converts a {@link VersionedEntity} to an JPA entity for persistence.
+   *
+   * @return An object to be persisted to SQL, or null if the input is not to be migrated. (Not
+   *     using Optional in return because as a one-use method, we do not want to invest the effort
+   *     to make Optional work with BEAM)
+   */
+  @Nullable
+  private static Object convertVersionedEntityToSqlEntity(VersionedEntity dsEntity) {
+    return dsEntity
+        .getEntity()
+        .filter(Transforms::isMigratable)
+        .map(e -> ofy().toPojo(e))
+        .map(Transforms::toSqlEntity)
+        .orElse(null);
+  }
+
  /** Interface for serializable {@link Supplier suppliers}. */
  public interface SerializableSupplier<T> extends Supplier<T>, Serializable {}

@@ -429,26 +471,24 @@ public final class Transforms {
    private static int instanceCount = 0;
    private static JpaTransactionManager originalJpa;

+    private Counter counter;
+
    private final SerializableSupplier<JpaTransactionManager> jpaSupplier;
    private final SerializableFunction<T, Object> jpaConverter;

-    private transient Ofy ofy;
-    private transient SystemSleeper sleeper;
-
    SqlBatchWriter(
+        String type,
        SerializableSupplier<JpaTransactionManager> jpaSupplier,
        SerializableFunction<T, Object> jpaConverter) {
+      counter = Metrics.counter("SQL_WRITE", type);
      this.jpaSupplier = jpaSupplier;
      this.jpaConverter = jpaConverter;
    }

    @Setup
    public void setup() {
-      sleeper = new SystemSleeper();
-
      try (AppEngineEnvironment env = new AppEngineEnvironment()) {
        ObjectifyService.initOfy();
-        ofy = ObjectifyService.ofy();
      }

      synchronized (SqlBatchWriter.class) {
@@ -477,31 +517,29 @@ public final class Transforms {
        ImmutableList<Object> ofyEntities =
            Streams.stream(kv.getValue())
                .map(this.jpaConverter::apply)
+                // TODO(b/177340730): post migration delete the line below.
+                .filter(Objects::nonNull)
                .collect(ImmutableList.toImmutableList());
-        retry(() -> jpaTm().transact(() -> jpaTm().putAll(ofyEntities)));
+        try {
+          jpaTm().transact(() -> jpaTm().putAll(ofyEntities));
+          counter.inc(ofyEntities.size());
+        } catch (RuntimeException e) {
+          processSingly(ofyEntities);
+        }
      }
    }

-    // TODO(b/160632289): Enhance Retrier and use it here.
-    private void retry(Runnable runnable) {
-      int maxAttempts = 5;
-      int initialDelayMillis = 100;
-      double jitterRatio = 0.2;
-
-      for (int attempt = 0; attempt < maxAttempts; attempt++) {
+    /**
+     * Writes entities in a failed batch one by one to identify the first bad entity and throws a
+     * {@link RuntimeException} on it.
+     */
+    private void processSingly(ImmutableList<Object> ofyEntities) {
+      for (Object ofyEntity : ofyEntities) {
        try {
-          runnable.run();
-          return;
-        } catch (Throwable throwable) {
-          if (!isFailedTxnRetriable(throwable)) {
-            throwIfUnchecked(throwable);
-            throw new RuntimeException(throwable);
-          }
-          int sleepMillis = (1 << attempt) * initialDelayMillis;
-          int jitter =
-              ThreadLocalRandom.current().nextInt((int) (sleepMillis * jitterRatio))
-                  - (int) (sleepMillis * jitterRatio / 2);
-          sleeper.sleepUninterruptibly(Duration.millis(sleepMillis + jitter));
+          jpaTm().transact(() -> jpaTm().put(ofyEntity));
+          counter.inc();
+        } catch (RuntimeException e) {
+          throw new RuntimeException(toOfyKey(ofyEntity).toString(), e);
        }
      }
    }
--- a/core/src/main/java/google/registry/env/alpha/default/WEB-INF/cron.xml
+++ b/core/src/main/java/google/registry/env/alpha/default/WEB-INF/cron.xml
@@ -80,7 +80,7 @@
  </cron>

  <cron>
-    <url><![CDATA[/_dr/task/resaveAllEppResources]]></url>
+    <url><![CDATA[/_dr/task/resaveAllEppResources?fast=true]]></url>
    <description>
      This job resaves all our resources, projected in time to "now".
      It is needed for "deleteOldCommitLogs" to work correctly.
--- a/core/src/main/java/google/registry/env/common/backend/WEB-INF/web.xml
+++ b/core/src/main/java/google/registry/env/common/backend/WEB-INF/web.xml
@@ -337,12 +337,18 @@
    <url-pattern>/_dr/task/refreshDnsOnHostRename</url-pattern>
  </servlet-mapping>

-  <!--  Mapreduce to expand recurring billing events into OneTimes. -->
+  <!-- Mapreduce to expand recurring billing events into OneTimes. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/expandRecurringBillingEvents</url-pattern>
  </servlet-mapping>

+  <!-- Background action to delete domains past end of autorenewal. -->
+  <servlet-mapping>
+    <servlet-name>backend-servlet</servlet-name>
+    <url-pattern>/_dr/task/deleteExpiredDomains</url-pattern>
+  </servlet-mapping>
+
  <!-- Mapreduce to import contacts from escrow file -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
--- a/core/src/main/java/google/registry/env/common/default/WEB-INF/datastore-indexes.xml
+++ b/core/src/main/java/google/registry/env/common/default/WEB-INF/datastore-indexes.xml
@@ -25,11 +25,6 @@
    <property name="tld" direction="asc"/>
    <property name="creationTime" direction="desc"/>
  </datastore-index>
-  <!-- For finding non-autorenewing domains to be deleted. -->
-  <datastore-index kind="DomainBase" ancestor="false" source="manual">
-    <property name="autorenewEndTime" direction="asc"/>
-    <property name="deletionTime" direction="asc"/>
-  </datastore-index>
  <!-- For finding host resources by registrar. -->
  <datastore-index kind="HostResource" ancestor="false" source="manual">
    <property name="currentSponsorClientId" direction="asc"/>
--- a/core/src/main/java/google/registry/env/production/default/WEB-INF/cron.xml
+++ b/core/src/main/java/google/registry/env/production/default/WEB-INF/cron.xml
@@ -103,7 +103,7 @@
  </cron>

  <cron>
-    <url><![CDATA[/_dr/task/resaveAllEppResources]]></url>
+    <url><![CDATA[/_dr/task/resaveAllEppResources?fast=true]]></url>
    <description>
      This job resaves all our resources, projected in time to "now".
      It is needed for "deleteOldCommitLogs" to work correctly.
@@ -280,7 +280,7 @@
  </cron>

  <cron>
-    <url><![CDATA[/_dr/task/icannReportingUpload]]></url>
+    <url><![CDATA[/_dr/cron/fanout?queue=retryable-cron-tasks&endpoint=/_dr/task/icannReportingUpload&runInEmpty]]></url>
    <description>
      Checks if the monthly ICANN reports have been successfully uploaded. If they have not, attempts to upload them again.
      Most of the time, this job should not do anything since the uploads are triggered when the reports are staged.
--- a/core/src/main/java/google/registry/env/qa/default/WEB-INF/cron.xml
+++ b/core/src/main/java/google/registry/env/qa/default/WEB-INF/cron.xml
@@ -21,7 +21,7 @@
  </cron>

  <cron>
-    <url><![CDATA[/_dr/task/resaveAllEppResources]]></url>
+    <url><![CDATA[/_dr/task/resaveAllEppResources?fast=true]]></url>
    <description>
      This job resaves all our resources, projected in time to "now".
      It is needed for "deleteOldCommitLogs" to work correctly.
--- a/core/src/main/java/google/registry/env/sandbox/default/WEB-INF/cron.xml
+++ b/core/src/main/java/google/registry/env/sandbox/default/WEB-INF/cron.xml
@@ -87,7 +87,7 @@
  </cron>

  <cron>
-    <url><![CDATA[/_dr/task/resaveAllEppResources]]></url>
+    <url><![CDATA[/_dr/task/resaveAllEppResources?fast=true]]></url>
    <description>
      This job resaves all our resources, projected in time to "now".
      It is needed for "deleteOldCommitLogs" to work correctly.
--- a/core/src/main/java/google/registry/export/BigqueryPollJobAction.java
+++ b/core/src/main/java/google/registry/export/BigqueryPollJobAction.java
@@ -45,13 +45,16 @@ import org.joda.time.Duration;
 /**
 * An action which polls the state of a bigquery job. If it is completed then it will log its
 * completion state; otherwise it will return a failure code so that the task will be retried.
+ *
+ * <p>Note that this is AUTH_INTERNAL_ONLY: we don't allow "admin" for this to mitigate a
+ * vulnerability, see b/177308043.
 */
@Action(
    service = Action.Service.BACKEND,
    path = BigqueryPollJobAction.PATH,
    method = {Action.Method.GET, Action.Method.POST},
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
+    auth = Auth.AUTH_INTERNAL_ONLY)
 public class BigqueryPollJobAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
--- a/core/src/main/java/google/registry/export/ExportPremiumTermsAction.java
+++ b/core/src/main/java/google/registry/export/ExportPremiumTermsAction.java
@@ -17,7 +17,6 @@ package google.registry.export;
 import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.base.Strings.isNullOrEmpty;
 import static com.google.common.net.MediaType.PLAIN_TEXT_UTF_8;
-import static google.registry.model.registry.label.PremiumListUtils.loadPremiumListEntries;
 import static google.registry.request.Action.Method.POST;
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static javax.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
@@ -32,7 +31,8 @@ import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.registry.Registry;
-import google.registry.model.registry.label.PremiumList;
+import google.registry.model.registry.label.PremiumList.PremiumListEntry;
+import google.registry.model.registry.label.PremiumListDualDao;
 import google.registry.request.Action;
 import google.registry.request.Parameter;
 import google.registry.request.RequestParameters;
@@ -137,11 +137,12 @@ public class ExportPremiumTermsAction implements Runnable {
  }

  private String getFormattedPremiumTerms(Registry registry) {
-    Optional<PremiumList> premiumList = PremiumList.getCached(registry.getPremiumList().getName());
-    checkState(premiumList.isPresent(), "Could not load premium list for " + tld);
+    String premiumListName = registry.getPremiumList().getName();
+    checkState(
+        PremiumListDualDao.exists(premiumListName), "Could not load premium list for " + tld);
    SortedSet<String> premiumTerms =
-        Streams.stream(loadPremiumListEntries(premiumList.get()))
-            .map(entry -> Joiner.on(",").join(entry.getLabel(), entry.getValue()))
+        Streams.stream(PremiumListDualDao.loadAllPremiumListEntries(premiumListName))
+            .map(PremiumListEntry::toString)
            .collect(ImmutableSortedSet.toImmutableSortedSet(String::compareTo));

    return Joiner.on("\n")
--- a/core/src/main/java/google/registry/flows/EppRequestHandler.java
+++ b/core/src/main/java/google/registry/flows/EppRequestHandler.java
@@ -25,6 +25,7 @@ import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
 import google.registry.model.eppoutput.EppOutput;
 import google.registry.request.Response;
+import google.registry.util.ProxyHttpHeaders;
 import javax.inject.Inject;

 /** Handle an EPP request and response. */
@@ -72,7 +73,7 @@ public class EppRequestHandler {
      // See: https://tools.ietf.org/html/rfc5734#section-2
      if (eppOutput.isResponse()
          && eppOutput.getResponse().getResult().getCode() == SUCCESS_AND_CLOSE) {
-        response.setHeader("Epp-Session", "close");
+        response.setHeader(ProxyHttpHeaders.EPP_SESSION, "close");
      }
      // If a login request returns a success, a logged-in header is added to the response to inform
      // the proxy that it is no longer necessary to send the full client certificate to the backend
@@ -80,7 +81,7 @@ public class EppRequestHandler {
      if (eppOutput.isResponse()
          && eppOutput.getResponse().isLoginResponse()
          && eppOutput.isSuccess()) {
-        response.setHeader("Logged-In", "true");
+        response.setHeader(ProxyHttpHeaders.LOGGED_IN, "true");
      }
    } catch (Exception e) {
      logger.atWarning().withCause(e).log("handleEppCommand general exception");
--- a/core/src/main/java/google/registry/flows/EppRequestSource.java
+++ b/core/src/main/java/google/registry/flows/EppRequestSource.java
@@ -22,5 +22,6 @@ public enum EppRequestSource {
  TLS,
  TOOL,
  CHECK_API,
-  UNIT_TEST
+  UNIT_TEST,
+  BACKEND
 }
--- a/core/src/main/java/google/registry/flows/ExtensionManager.java
+++ b/core/src/main/java/google/registry/flows/ExtensionManager.java
@@ -47,8 +47,8 @@ public final class ExtensionManager {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();

-  /** Blacklist of extension URIs that cause an error if they are used without being declared. */
-  private static final ImmutableSet<String> UNDECLARED_URIS_BLACKLIST = FEE_EXTENSION_URIS;
+  /** Denylist of extension URIs that cause an error if they are used without being declared. */
+  private static final ImmutableSet<String> UNDECLARED_URIS_DENYLIST = FEE_EXTENSION_URIS;

  private final ImmutableSet.Builder<Class<? extends CommandExtension>> implementedBuilder =
      new ImmutableSet.Builder<>();
@@ -95,7 +95,7 @@ public final class ExtensionManager {
    if (undeclaredUris.isEmpty()) {
      return;
    }
-    Set<String> undeclaredUrisThatError = intersection(undeclaredUris, UNDECLARED_URIS_BLACKLIST);
+    Set<String> undeclaredUrisThatError = intersection(undeclaredUris, UNDECLARED_URIS_DENYLIST);
    if (!undeclaredUrisThatError.isEmpty()) {
      throw new UndeclaredServiceExtensionException(undeclaredUrisThatError);
    }
@@ -104,11 +104,14 @@ public final class ExtensionManager {
        clientId, flowClass.getSimpleName(), undeclaredUris);
  }

+  private static final ImmutableSet<EppRequestSource> ALLOWED_METADATA_EPP_REQUEST_SOURCES =
+      ImmutableSet.of(EppRequestSource.TOOL, EppRequestSource.BACKEND);
+
  private void checkForRestrictedExtensions(
      ImmutableSet<Class<? extends CommandExtension>> suppliedExtensions)
      throws OnlyToolCanPassMetadataException, UnauthorizedForSuperuserExtensionException {
    if (suppliedExtensions.contains(MetadataExtension.class)
-        && !eppRequestSource.equals(EppRequestSource.TOOL)) {
+        && !ALLOWED_METADATA_EPP_REQUEST_SOURCES.contains(eppRequestSource)) {
      throw new OnlyToolCanPassMetadataException();
    }
    // Can't use suppliedExtension.contains() here because the SuperuserExtension has child classes.
--- a/core/src/main/java/google/registry/flows/ResourceFlowUtils.java
+++ b/core/src/main/java/google/registry/flows/ResourceFlowUtils.java
@@ -15,8 +15,8 @@
 package google.registry.flows;

 import static com.google.common.collect.Sets.intersection;
+import static google.registry.model.EppResourceUtils.getLinkedDomainKeys;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
-import static google.registry.model.EppResourceUtils.queryForLinkedDomains;
 import static google.registry.model.index.ForeignKeyIndex.loadAndGetKey;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
@@ -94,14 +94,13 @@ public final class ResourceFlowUtils {
                   * actual reference then we can reliably fail. If we don't find any, we can't
                   * trust the query and need to do the full mapreduce.
                   */
-                  Iterable<Key<DomainBase>> keys =
-                      queryForLinkedDomains(fki.getResourceKey().getOfyKey(), now)
-                          .limit(FAILFAST_CHECK_COUNT)
-                          .keys();
+                  Iterable<VKey<DomainBase>> keys =
+                      getLinkedDomainKeys(fki.getResourceKey(), now, FAILFAST_CHECK_COUNT);
+
                  VKey<R> resourceVKey = fki.getResourceKey();
                  Predicate<DomainBase> predicate =
                      domain -> getPotentialReferences.apply(domain).contains(resourceVKey);
-                  return ofy().load().keys(keys).values().stream().anyMatch(predicate)
+                  return tm().loadByKeys(keys).values().stream().anyMatch(predicate)
                      ? new ResourceToDeleteIsReferencedException()
                      : null;
                });
@@ -139,7 +138,7 @@ public final class ResourceFlowUtils {
      Class<R> clazz, String targetId, DateTime now, String clientId) throws EppException {
    VKey<R> key = loadAndGetKey(clazz, targetId, now);
    if (key != null) {
-      R resource = tm().load(key);
+      R resource = tm().loadByKey(key);
      // These are similar exceptions, but we can track them internally as log-based metrics.
      if (Objects.equals(clientId, resource.getPersistedCurrentSponsorClientId())) {
        throw new ResourceAlreadyExistsForThisClientException(targetId);
--- a/core/src/main/java/google/registry/flows/TlsCredentials.java
+++ b/core/src/main/java/google/registry/flows/TlsCredentials.java
@@ -15,9 +15,8 @@
 package google.registry.flows;

 import static com.google.common.base.MoreObjects.toStringHelper;
-import static com.google.common.base.Strings.isNullOrEmpty;
 import static google.registry.request.RequestParameters.extractOptionalHeader;
-import static google.registry.request.RequestParameters.extractRequiredHeader;
+import static google.registry.util.X509Utils.loadCertificate;

 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableList;
@@ -27,14 +26,24 @@ import com.google.common.net.InetAddresses;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.config.RegistryConfig.Config;
+import google.registry.config.RegistryEnvironment;
 import google.registry.flows.EppException.AuthenticationErrorException;
+import google.registry.flows.certs.CertificateChecker;
+import google.registry.flows.certs.CertificateChecker.InsecureCertificateException;
 import google.registry.model.registrar.Registrar;
 import google.registry.request.Header;
 import google.registry.util.CidrAddressBlock;
+import google.registry.util.Clock;
+import google.registry.util.ProxyHttpHeaders;
+import java.io.ByteArrayInputStream;
 import java.net.InetAddress;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.Base64;
 import java.util.Optional;
 import javax.inject.Inject;
 import javax.servlet.http.HttpServletRequest;
+import org.joda.time.DateTime;

 /**
 * Container and validation for TLS certificate and IP-allow-listing.
@@ -44,6 +53,9 @@ import javax.servlet.http.HttpServletRequest;
 * <dl>
 *   <dt>X-SSL-Certificate
 *   <dd>This field should contain a base64 encoded digest of the client's TLS certificate. It is
+ *       used only if the validation of the full certificate fails.
+ *   <dt>X-SSL-Full-Certificate
+ *   <dd>This field should contain a base64 encoding of the client's TLS certificate. It is
 *       validated during an EPP login command against a known good value that is transmitted out of
 *       band.
 *   <dt>X-Forwarded-For
@@ -54,19 +66,30 @@ import javax.servlet.http.HttpServletRequest;
 public class TlsCredentials implements TransportCredentials {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+  private static final DateTime CERT_ENFORCEMENT_START_TIME =
+      DateTime.parse("2021-03-01T16:00:00Z");

  private final boolean requireSslCertificates;
-  private final String clientCertificateHash;
-  private final InetAddress clientInetAddr;
+  private final Optional<String> clientCertificateHash;
+  private final Optional<String> clientCertificate;
+  private final Optional<InetAddress> clientInetAddr;
+  private final CertificateChecker certificateChecker;
+  private final Clock clock;

  @Inject
  public TlsCredentials(
      @Config("requireSslCertificates") boolean requireSslCertificates,
-      @Header("X-SSL-Certificate") String clientCertificateHash,
-      @Header("X-Forwarded-For") Optional<String> clientAddress) {
+      @Header(ProxyHttpHeaders.CERTIFICATE_HASH) Optional<String> clientCertificateHash,
+      @Header(ProxyHttpHeaders.FULL_CERTIFICATE) Optional<String> clientCertificate,
+      @Header(ProxyHttpHeaders.IP_ADDRESS) Optional<String> clientAddress,
+      CertificateChecker certificateChecker,
+      Clock clock) {
    this.requireSslCertificates = requireSslCertificates;
    this.clientCertificateHash = clientCertificateHash;
-    this.clientInetAddr = clientAddress.isPresent() ? parseInetAddress(clientAddress.get()) : null;
+    this.clientCertificate = clientCertificate;
+    this.clientInetAddr = clientAddress.map(TlsCredentials::parseInetAddress);
+    this.certificateChecker = certificateChecker;
+    this.clock = clock;
  }

  static InetAddress parseInetAddress(String asciiAddr) {
@@ -93,14 +116,18 @@ public class TlsCredentials implements TransportCredentials {
    ImmutableList<CidrAddressBlock> ipAddressAllowList = registrar.getIpAddressAllowList();
    if (ipAddressAllowList.isEmpty()) {
      logger.atInfo().log(
-          "Skipping IP allow list check because %s doesn't have an IP allow list",
+          "Skipping IP allow list check because %s doesn't have an IP allow list.",
          registrar.getClientId());
      return;
    }
-    for (CidrAddressBlock cidrAddressBlock : ipAddressAllowList) {
-      if (cidrAddressBlock.contains(clientInetAddr)) {
-        // IP address is in allow list; return early.
-        return;
+    // In the rare unexpected case that the client inet address wasn't passed along at all, then
+    // by default deny access.
+    if (clientInetAddr.isPresent()) {
+      for (CidrAddressBlock cidrAddressBlock : ipAddressAllowList) {
+        if (cidrAddressBlock.contains(clientInetAddr.get())) {
+          // IP address is in allow list; return early.
+          return;
+        }
      }
    }
    logger.atInfo().log(
@@ -113,13 +140,88 @@ public class TlsCredentials implements TransportCredentials {
  /**
   * Verifies client SSL certificate is permitted to issue commands as {@code registrar}.
   *
-   * @throws MissingRegistrarCertificateException if frontend didn't send certificate hash header
+   * @throws MissingRegistrarCertificateException if frontend didn't send certificate header
   * @throws BadRegistrarCertificateException if registrar requires certificate and it didn't match
   */
  @VisibleForTesting
  void validateCertificate(Registrar registrar) throws AuthenticationErrorException {
-    if (isNullOrEmpty(registrar.getClientCertificateHash())
-        && isNullOrEmpty(registrar.getFailoverClientCertificateHash())) {
+    // Check that certificate is present in registrar object
+    if (!registrar.getClientCertificate().isPresent()
+        && !registrar.getFailoverClientCertificate().isPresent()) {
+      // Log an error and validate using certificate hash instead
+      // TODO(sarahbot): throw a RegistrarCertificateNotConfiguredException once hash is no longer
+      // used as failover
+      logger.atWarning().log(
+          "There is no certificate configured for registrar %s.", registrar.getClientId());
+    } else if (!clientCertificate.isPresent()) {
+      // Check that the request included the full certificate
+      // Log an error and validate using certificate hash instead
+      // TODO(sarahbot): throw a MissingRegistrarCertificateException once hash is no longer used as
+      // failover
+      logger.atWarning().log(
+          "Request from registrar %s did not include X-SSL-Full-Certificate.",
+          registrar.getClientId());
+    } else {
+      X509Certificate passedCert;
+      Optional<X509Certificate> storedCert;
+      Optional<X509Certificate> storedFailoverCert;
+
+      try {
+        storedCert = deserializePemCert(registrar.getClientCertificate());
+        storedFailoverCert = deserializePemCert(registrar.getFailoverClientCertificate());
+        passedCert = decodeCertString(clientCertificate.get());
+      } catch (Exception e) {
+        // TODO(Sarahbot@): remove this catch once we know it's working
+        logger.atWarning().log(
+            "Error converting certificate string to certificate for %s: %s",
+            registrar.getClientId(), e);
+        validateCertificateHash(registrar);
+        return;
+      }
+
+      // Check if the certificate is equal to the one on file for the registrar.
+      if (passedCert.equals(storedCert.orElse(null))
+          || passedCert.equals(storedFailoverCert.orElse(null))) {
+        // Check certificate for any requirement violations
+        // TODO(Sarahbot@): Throw exceptions instead of just logging once requirement enforcement
+        // begins
+        try {
+          certificateChecker.validateCertificate(passedCert);
+        } catch (InsecureCertificateException e) {
+          // TODO(Sarahbot@): Remove this if statement after March 1. After March 1, exception
+          // should be thrown in all environments.
+          // throw exception in unit tests and Sandbox
+          if (RegistryEnvironment.get().equals(RegistryEnvironment.UNITTEST)
+              || RegistryEnvironment.get().equals(RegistryEnvironment.SANDBOX)
+              || clock.nowUtc().isAfter(CERT_ENFORCEMENT_START_TIME)) {
+            throw new CertificateContainsSecurityViolationsException(e);
+          }
+          logger.atWarning().log(
+              "Registrar certificate used for %s does not meet certificate requirements: %s",
+              registrar.getClientId(), e.getMessage());
+        } catch (Exception e) {
+          logger.atWarning().log(
+              "Error validating certificate for %s: %s", registrar.getClientId(), e);
+        }
+        // successfully validated, return here since hash validation is not necessary
+        return;
+      }
+      // Log an error and validate using certificate hash instead
+      // TODO(sarahbot): throw a BadRegistrarCertificateException once hash is no longer used as
+      // failover
+      logger.atWarning().log("Non-matching certificate for registrar %s.", registrar.getClientId());
+    }
+    validateCertificateHash(registrar);
+  }
+
+  private void validateCertificateHash(Registrar registrar) throws AuthenticationErrorException {
+    logger.atWarning().log(
+        "Error validating certificate for %s, attempting to validate using certificate hash.",
+        registrar.getClientId());
+    // Check the certificate hash as a failover
+    // TODO(sarahbot): Remove hash checks once certificate checks are working.
+    if (!registrar.getClientCertificateHash().isPresent()
+        && !registrar.getFailoverClientCertificateHash().isPresent()) {
      if (requireSslCertificates) {
        throw new RegistrarCertificateNotConfiguredException();
      } else {
@@ -128,14 +230,17 @@ public class TlsCredentials implements TransportCredentials {
        return;
      }
    }
-    if (isNullOrEmpty(clientCertificateHash)) {
-      logger.atInfo().log("Request did not include X-SSL-Certificate");
+    // Check that the request included the certificate hash
+    if (!clientCertificateHash.isPresent()) {
+      logger.atInfo().log(
+          "Request from registrar %s did not include X-SSL-Certificate.", registrar.getClientId());
      throw new MissingRegistrarCertificateException();
    }
+    // Check if the certificate hash is equal to the one on file for the registrar.
    if (!clientCertificateHash.equals(registrar.getClientCertificateHash())
        && !clientCertificateHash.equals(registrar.getFailoverClientCertificateHash())) {
      logger.atWarning().log(
-          "bad certificate hash (%s) for %s, wanted either %s or %s",
+          "Non-matching certificate hash (%s) for %s, wanted either %s or %s.",
          clientCertificateHash,
          registrar.getClientId(),
          registrar.getClientCertificateHash(),
@@ -151,24 +256,55 @@ public class TlsCredentials implements TransportCredentials {
    }
  }

+  // Converts a PEM formatted certificate string into an X509Certificate
+  private Optional<X509Certificate> deserializePemCert(Optional<String> certificateString)
+      throws CertificateException {
+    if (certificateString.isPresent()) {
+      return Optional.of(loadCertificate(certificateString.get()));
+    }
+    return Optional.empty();
+  }
+
+  // Decodes the string representation of an encoded certificate back into an X509Certificate
+  private X509Certificate decodeCertString(String encodedCertString) throws CertificateException {
+    byte decodedCert[] = Base64.getDecoder().decode(encodedCertString);
+    ByteArrayInputStream inputStream = new ByteArrayInputStream(decodedCert);
+    return loadCertificate(inputStream);
+  }
+
  @Override
  public String toString() {
    return toStringHelper(getClass())
-        .add("clientCertificateHash", clientCertificateHash)
-        .add("clientAddress", clientInetAddr)
+        .add("clientCertificate", clientCertificate.orElse(null))
+        .add("clientCertificateHash", clientCertificateHash.orElse(null))
+        .add("clientAddress", clientInetAddr.orElse(null))
        .toString();
  }

  /** Registrar certificate does not match stored certificate. */
  public static class BadRegistrarCertificateException extends AuthenticationErrorException {
-    public BadRegistrarCertificateException() {
+    BadRegistrarCertificateException() {
      super("Registrar certificate does not match stored certificate");
    }
  }

+  /** Registrar certificate contains the following security violations: ... */
+  public static class CertificateContainsSecurityViolationsException
+      extends AuthenticationErrorException {
+    InsecureCertificateException exception;
+
+    CertificateContainsSecurityViolationsException(InsecureCertificateException exception) {
+      super(
+          String.format(
+              "Registrar certificate contains the following security violations:\n%s",
+              exception.getMessage()));
+      this.exception = exception;
+    }
+  }
+
  /** Registrar certificate not present. */
  public static class MissingRegistrarCertificateException extends AuthenticationErrorException {
-    public MissingRegistrarCertificateException() {
+    MissingRegistrarCertificateException() {
      super("Registrar certificate not present");
    }
  }
@@ -176,14 +312,14 @@ public class TlsCredentials implements TransportCredentials {
  /** Registrar certificate is not configured. */
  public static class RegistrarCertificateNotConfiguredException
      extends AuthenticationErrorException {
-    public RegistrarCertificateNotConfiguredException() {
+    RegistrarCertificateNotConfiguredException() {
      super("Registrar certificate is not configured");
    }
  }

  /** Registrar IP address is not in stored allow list. */
  public static class BadRegistrarIpAddressException extends AuthenticationErrorException {
-    public BadRegistrarIpAddressException() {
+    BadRegistrarIpAddressException() {
      super("Registrar IP address is not in stored allow list");
    }
  }
@@ -191,16 +327,27 @@ public class TlsCredentials implements TransportCredentials {
  /** Dagger module for the EPP TLS endpoint. */
  @Module
  public static final class EppTlsModule {
+
    @Provides
-    @Header("X-SSL-Certificate")
-    static String provideClientCertificateHash(HttpServletRequest req) {
-      return extractRequiredHeader(req, "X-SSL-Certificate");
+    @Header(ProxyHttpHeaders.CERTIFICATE_HASH)
+    static Optional<String> provideClientCertificateHash(HttpServletRequest req) {
+      // Note: This header is actually required, we just want to handle its absence explicitly
+      // by throwing an EPP exception rather than a generic Bad Request exception.
+      return extractOptionalHeader(req, ProxyHttpHeaders.CERTIFICATE_HASH);
    }

    @Provides
-    @Header("X-Forwarded-For")
-    static Optional<String> provideForwardedFor(HttpServletRequest req) {
-      return extractOptionalHeader(req, "X-Forwarded-For");
+    @Header(ProxyHttpHeaders.FULL_CERTIFICATE)
+    static Optional<String> provideClientCertificate(HttpServletRequest req) {
+      // Note: This header is actually required, we just want to handle its absence explicitly
+      // by throwing an EPP exception rather than a generic Bad Request exception.
+      return extractOptionalHeader(req, ProxyHttpHeaders.FULL_CERTIFICATE);
+    }
+
+    @Provides
+    @Header(ProxyHttpHeaders.IP_ADDRESS)
+    static Optional<String> provideIpAddress(HttpServletRequest req) {
+      return extractOptionalHeader(req, ProxyHttpHeaders.IP_ADDRESS);
    }
  }
 }
--- a/core/src/main/java/google/registry/flows/certs/CertificateChecker.java
+++ b/core/src/main/java/google/registry/flows/certs/CertificateChecker.java
@@ -89,14 +89,26 @@ public class CertificateChecker {
   * Checks the given certificate string for violations and throws an exception if any violations
   * exist.
   */
-  public void validateCertificate(String certificateString) {
-    ImmutableSet<CertificateViolation> violations = checkCertificate(certificateString);
+  public void validateCertificate(String certificateString) throws InsecureCertificateException {
+    handleCertViolations(checkCertificate(certificateString));
+  }
+
+  /**
+   * Checks the given certificate string for violations and throws an exception if any violations
+   * exist.
+   */
+  public void validateCertificate(X509Certificate certificate) throws InsecureCertificateException {
+    handleCertViolations(checkCertificate(certificate));
+  }
+
+  private void handleCertViolations(ImmutableSet<CertificateViolation> violations)
+      throws InsecureCertificateException {
    if (!violations.isEmpty()) {
      String displayMessages =
          violations.stream()
              .map(violation -> getViolationDisplayMessage(violation))
              .collect(Collectors.joining("\n"));
-      throw new IllegalArgumentException(displayMessages);
+      throw new InsecureCertificateException(violations, displayMessages);
    }
  }

@@ -258,4 +270,14 @@ public class CertificateChecker {
      return certificateChecker.getViolationDisplayMessage(this);
    }
  }
+
+  /** Exception to throw when a certificate has security violations. */
+  public static class InsecureCertificateException extends Exception {
+    ImmutableSet<CertificateViolation> violations;
+
+    InsecureCertificateException(ImmutableSet<CertificateViolation> violations, String message) {
+      super(message);
+      this.violations = violations;
+    }
+  }
 }
--- a/core/src/main/java/google/registry/flows/contact/ContactCreateFlow.java
+++ b/core/src/main/java/google/registry/flows/contact/ContactCreateFlow.java
@@ -19,9 +19,9 @@ import static google.registry.flows.ResourceFlowUtils.verifyResourceDoesNotExist
 import static google.registry.flows.contact.ContactFlowUtils.validateAsciiPostalInfo;
 import static google.registry.flows.contact.ContactFlowUtils.validateContactAgainstPolicy;
 import static google.registry.model.EppResourceUtils.createRepoId;
-import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

+import com.google.common.collect.ImmutableSet;
 import com.googlecode.objectify.Key;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.flows.EppException;
@@ -95,11 +95,12 @@ public final class ContactCreateFlow implements TransactionalFlow {
        .setModificationTime(now)
        .setXmlBytes(null)  // We don't want to store contact details in the history entry.
        .setParent(Key.create(newContact));
-    ofy().save().entities(
-        newContact,
-        historyBuilder.build(),
-        ForeignKeyIndex.create(newContact, newContact.getDeletionTime()),
-        EppResourceIndex.create(Key.create(newContact)));
+    tm().insertAll(
+            ImmutableSet.of(
+                newContact,
+                historyBuilder.build().toChildHistoryEntity(),
+                ForeignKeyIndex.create(newContact, newContact.getDeletionTime()),
+                EppResourceIndex.create(Key.create(newContact))));
    return responseBuilder
        .setResData(ContactCreateData.create(newContact.getContactId(), now))
        .build();
--- a/core/src/main/java/google/registry/flows/contact/ContactDeleteFlow.java
+++ b/core/src/main/java/google/registry/flows/contact/ContactDeleteFlow.java
@@ -21,7 +21,6 @@ import static google.registry.flows.ResourceFlowUtils.verifyNoDisallowedStatuses
 import static google.registry.flows.ResourceFlowUtils.verifyOptionalAuthInfo;
 import static google.registry.flows.ResourceFlowUtils.verifyResourceOwnership;
 import static google.registry.model.eppoutput.Result.Code.SUCCESS_WITH_ACTION_PENDING;
-import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

 import com.google.common.collect.ImmutableSet;
@@ -101,7 +100,8 @@ public final class ContactDeleteFlow implements TransactionalFlow {
        .setType(HistoryEntry.Type.CONTACT_PENDING_DELETE)
        .setModificationTime(now)
        .setParent(Key.create(existingContact));
-    ofy().save().<Object>entities(newContact, historyBuilder.build());
+    tm().insert(historyBuilder.build().toChildHistoryEntity());
+    tm().update(newContact);
    return responseBuilder.setResultFromCode(SUCCESS_WITH_ACTION_PENDING).build();
  }
 }
--- a/core/src/main/java/google/registry/flows/contact/ContactInfoFlow.java
+++ b/core/src/main/java/google/registry/flows/contact/ContactInfoFlow.java
@@ -20,7 +20,6 @@ import static google.registry.flows.ResourceFlowUtils.verifyResourceOwnership;
 import static google.registry.model.EppResourceUtils.isLinked;

 import com.google.common.collect.ImmutableSet;
-import com.googlecode.objectify.Key;
 import google.registry.flows.EppException;
 import google.registry.flows.ExtensionManager;
 import google.registry.flows.Flow;
@@ -77,7 +76,7 @@ public final class ContactInfoFlow implements Flow {
        clientId.equals(contact.getCurrentSponsorClientId()) || authInfo.isPresent();
    ImmutableSet.Builder<StatusValue> statusValues = new ImmutableSet.Builder<>();
    statusValues.addAll(contact.getStatusValues());
-    if (isLinked(Key.create(contact), now)) {
+    if (isLinked(contact.createVKey(), now)) {
      statusValues.add(StatusValue.LINKED);
    }
    return responseBuilder
--- a/core/src/main/java/google/registry/flows/contact/ContactTransferApproveFlow.java
+++ b/core/src/main/java/google/registry/flows/contact/ContactTransferApproveFlow.java
@@ -22,9 +22,9 @@ import static google.registry.flows.ResourceFlowUtils.verifyResourceOwnership;
 import static google.registry.flows.contact.ContactFlowUtils.createGainingTransferPollMessage;
 import static google.registry.flows.contact.ContactFlowUtils.createTransferResponse;
 import static google.registry.model.ResourceTransferUtils.approvePendingTransfer;
-import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

+import com.google.common.collect.ImmutableSet;
 import com.googlecode.objectify.Key;
 import google.registry.flows.EppException;
 import google.registry.flows.ExtensionManager;
@@ -94,7 +94,8 @@ public final class ContactTransferApproveFlow implements TransactionalFlow {
    // Create a poll message for the gaining client.
    PollMessage gainingPollMessage =
        createGainingTransferPollMessage(targetId, newContact.getTransferData(), historyEntry);
-    ofy().save().<Object>entities(newContact, historyEntry, gainingPollMessage);
+    tm().insertAll(ImmutableSet.of(historyEntry.toChildHistoryEntity(), gainingPollMessage));
+    tm().update(newContact);
    // Delete the billing event and poll messages that were written in case the transfer would have
    // been implicitly server approved.
    tm().delete(existingContact.getTransferData().getServerApproveEntities());
--- a/core/src/main/java/google/registry/flows/contact/ContactTransferCancelFlow.java
+++ b/core/src/main/java/google/registry/flows/contact/ContactTransferCancelFlow.java
@@ -22,9 +22,9 @@ import static google.registry.flows.ResourceFlowUtils.verifyTransferInitiator;
 import static google.registry.flows.contact.ContactFlowUtils.createLosingTransferPollMessage;
 import static google.registry.flows.contact.ContactFlowUtils.createTransferResponse;
 import static google.registry.model.ResourceTransferUtils.denyPendingTransfer;
-import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

+import com.google.common.collect.ImmutableSet;
 import com.googlecode.objectify.Key;
 import google.registry.flows.EppException;
 import google.registry.flows.ExtensionManager;
@@ -90,7 +90,8 @@ public final class ContactTransferCancelFlow implements TransactionalFlow {
    // Create a poll message for the losing client.
    PollMessage losingPollMessage =
        createLosingTransferPollMessage(targetId, newContact.getTransferData(), historyEntry);
-    ofy().save().<Object>entities(newContact, historyEntry, losingPollMessage);
+    tm().insertAll(ImmutableSet.of(historyEntry.toChildHistoryEntity(), losingPollMessage));
+    tm().update(newContact);
    // Delete the billing event and poll messages that were written in case the transfer would have
    // been implicitly server approved.
    tm().delete(existingContact.getTransferData().getServerApproveEntities());
--- a/core/src/main/java/google/registry/flows/contact/ContactTransferRejectFlow.java
+++ b/core/src/main/java/google/registry/flows/contact/ContactTransferRejectFlow.java
@@ -22,9 +22,9 @@ import static google.registry.flows.ResourceFlowUtils.verifyResourceOwnership;
 import static google.registry.flows.contact.ContactFlowUtils.createGainingTransferPollMessage;
 import static google.registry.flows.contact.ContactFlowUtils.createTransferResponse;
 import static google.registry.model.ResourceTransferUtils.denyPendingTransfer;
-import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

+import com.google.common.collect.ImmutableSet;
 import com.googlecode.objectify.Key;
 import google.registry.flows.EppException;
 import google.registry.flows.ExtensionManager;
@@ -87,7 +87,8 @@ public final class ContactTransferRejectFlow implements TransactionalFlow {
        .build();
    PollMessage gainingPollMessage =
        createGainingTransferPollMessage(targetId, newContact.getTransferData(), historyEntry);
-    ofy().save().<Object>entities(newContact, historyEntry, gainingPollMessage);
+    tm().insertAll(ImmutableSet.of(historyEntry.toChildHistoryEntity(), gainingPollMessage));
+    tm().update(newContact);
    // Delete the billing event and poll messages that were written in case the transfer would have
    // been implicitly server approved.
    tm().delete(existingContact.getTransferData().getServerApproveEntities());
--- a/core/src/main/java/google/registry/flows/contact/ContactTransferRequestFlow.java
+++ b/core/src/main/java/google/registry/flows/contact/ContactTransferRequestFlow.java
@@ -23,7 +23,6 @@ import static google.registry.flows.contact.ContactFlowUtils.createGainingTransf
 import static google.registry.flows.contact.ContactFlowUtils.createLosingTransferPollMessage;
 import static google.registry.flows.contact.ContactFlowUtils.createTransferResponse;
 import static google.registry.model.eppoutput.Result.Code.SUCCESS_WITH_ACTION_PENDING;
-import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

 import com.google.common.collect.ImmutableSet;
@@ -145,12 +144,13 @@ public final class ContactTransferRequestFlow implements TransactionalFlow {
        .setTransferData(pendingTransferData)
        .addStatusValue(StatusValue.PENDING_TRANSFER)
        .build();
-    ofy().save().<Object>entities(
-        newContact,
-        historyEntry,
-        requestPollMessage,
-        serverApproveGainingPollMessage,
-        serverApproveLosingPollMessage);
+    tm().update(newContact);
+    tm().insertAll(
+            ImmutableSet.of(
+                historyEntry.toChildHistoryEntity(),
+                requestPollMessage,
+                serverApproveGainingPollMessage,
+                serverApproveLosingPollMessage));
    return responseBuilder
        .setResultFromCode(SUCCESS_WITH_ACTION_PENDING)
        .setResData(createTransferResponse(targetId, newContact.getTransferData()))
--- a/core/src/main/java/google/registry/flows/contact/ContactUpdateFlow.java
+++ b/core/src/main/java/google/registry/flows/contact/ContactUpdateFlow.java
@@ -24,7 +24,6 @@ import static google.registry.flows.ResourceFlowUtils.verifyOptionalAuthInfo;
 import static google.registry.flows.ResourceFlowUtils.verifyResourceOwnership;
 import static google.registry.flows.contact.ContactFlowUtils.validateAsciiPostalInfo;
 import static google.registry.flows.contact.ContactFlowUtils.validateContactAgainstPolicy;
-import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

 import com.google.common.collect.ImmutableSet;
@@ -151,7 +150,8 @@ public final class ContactUpdateFlow implements TransactionalFlow {
    }
    validateAsciiPostalInfo(newContact.getInternationalizedPostalInfo());
    validateContactAgainstPolicy(newContact);
-    ofy().save().<Object>entities(newContact, historyBuilder.build());
+    tm().insert(historyBuilder.build().toChildHistoryEntity());
+    tm().update(newContact);
    return responseBuilder.build();
  }

--- a/core/src/main/java/google/registry/flows/domain/DomainCheckFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainCheckFlow.java
@@ -301,6 +301,7 @@ public final class DomainCheckFlow implements Flow {
          feeCheck.getItems().stream()
              .filter(fc -> fc.getCommandName() == CommandName.RESTORE)
              .map(FeeCheckCommandExtensionItem::getDomainName)
+              .distinct()
              .collect(toImmutableList());
    } else if (feeCheck.getItems().stream()
        .anyMatch(fc -> fc.getCommandName() == CommandName.RESTORE)) {
--- a/core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java
@@ -110,7 +110,6 @@ import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.persistence.DomainHistoryVKey;
 import google.registry.persistence.VKey;
 import google.registry.tmch.LordnTaskUtils;
 import java.util.Optional;
@@ -372,7 +371,7 @@ public class DomainCreateFlow implements TransactionalFlow {
        && TokenType.SINGLE_USE.equals(allocationToken.get().getTokenType())) {
      entitiesToSave.add(
          allocationTokenFlowUtils.redeemToken(
-              allocationToken.get(), DomainHistoryVKey.create(Key.create(historyEntry))));
+              allocationToken.get(), HistoryEntry.createVKey(Key.create(historyEntry))));
    }
    enqueueTasks(newDomain, hasSignedMarks, hasClaimsNotice);

--- a/core/src/main/java/google/registry/flows/domain/DomainDeleteFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainDeleteFlow.java
@@ -225,7 +225,7 @@ public final class DomainDeleteFlow implements TransactionalFlow {
        if (gracePeriod.getOneTimeBillingEvent() != null) {
          // Take the amount of amount of registration time being refunded off the expiration time.
          // This can be either add grace periods or renew grace periods.
-          BillingEvent.OneTime oneTime = tm().load(gracePeriod.getOneTimeBillingEvent());
+          BillingEvent.OneTime oneTime = tm().loadByKey(gracePeriod.getOneTimeBillingEvent());
          newExpirationTime = newExpirationTime.minusYears(oneTime.getPeriodYears());
        } else if (gracePeriod.getRecurringBillingEvent() != null) {
          // Take 1 year off the registration if in the autorenew grace period (no need to load the
@@ -372,12 +372,12 @@ public final class DomainDeleteFlow implements TransactionalFlow {
  private Money getGracePeriodCost(GracePeriod gracePeriod, DateTime now) {
    if (gracePeriod.getType() == GracePeriodStatus.AUTO_RENEW) {
      DateTime autoRenewTime =
-          tm().load(checkNotNull(gracePeriod.getRecurringBillingEvent()))
+          tm().loadByKey(checkNotNull(gracePeriod.getRecurringBillingEvent()))
              .getRecurrenceTimeOfYear()
              .getLastInstanceBeforeOrAt(now);
      return getDomainRenewCost(targetId, autoRenewTime, 1);
    }
-    return tm().load(checkNotNull(gracePeriod.getOneTimeBillingEvent())).getCost();
+    return tm().loadByKey(checkNotNull(gracePeriod.getOneTimeBillingEvent())).getCost();
  }

  @Nullable
--- a/Show More
+++ b/Show More