Add smoke test for BEAM pipelines (#3037)

Created a smoke test to cover unit test gaps wrt BEAM:
- The Java and SDK compatibility in the pipeline container image
- The JPA setup in the pipelines

Both issues above can only be tested in a real pipeline.

This PR defines a new pipeline that performs a lightweight SQL
query and minimal processing. The build process can launch it
in a test environment to verify that the pipelines in the build
can run. The run script is also provided.

.github/workflows/dependency-submission.yml

@@ -20,6 +20,6 @@ jobs:
       uses: actions/setup-java@v4
       with:
         distribution: 'temurin'
-        java-version: '21'
+        java-version: '25'
     - name: Generate and submit dependency graph
       uses: gradle/actions/dependency-submission@v3

GEMINI.md

@@ -1,21 +1,33 @@
 # Engineering Standards for Gemini CLI
 
-This document outlines foundational mandates, architectural patterns, and project-specific conventions to ensure high-quality, idiomatic, and consistent code from the first iteration.
+This document outlines foundational mandates, architectural patterns, and project-specific conventions to ensure high-quality, idiomatic, and consistent code from the first iteration. When modifying this file, always review the full document to prevent the introduction of duplicate instructions and ensure the content remains coherent and logically organized.
 
 ## Core Mandates
 
 ### 1. Rigorous Import Management
 - **Addition:** When adding new symbols, ensure the corresponding import is added.
 - **Removal:** When removing the last usage of a class or symbol from a file (e.g., removing a `@Inject Clock clock;` field), **immediately remove the associated import**. Do not wait for a build failure to identify unused imports.
+- **No Redundant Qualifications:** NEVER use fully qualified class names (e.g., `java.time.temporal.ChronoUnit.DAYS`) in code when an import can be used instead. Always prefer adding an import and using the simple name.
+- **Static Imports for Utilities:** Always statically import methods from utility classes like `DateTimeUtils` or `CacheUtils`. (e.g., use `toInstant(...)` instead of `DateTimeUtils.toInstant(...)`).
 - **Checkstyle:** Proactively fix common checkstyle errors (line length > 100, formatting, unused imports) during the initial code write. Do not wait for CI/build failures to address these, as iterative fixes are inefficient.
-- **Verification:** Before finalizing any change, scan the imports section for redundancy.
+- **Verification**: Before finalizing any change, scan the imports section for redundancy.
+- **License Headers**: When creating new files, ensure the license header uses the current year (e.g., 2026). Existing files should retain their original year.
 
-### 2. Time and Precision Handling (java.time Migration)
+## 2. Time and Precision Handling (java.time Migration)
+
+- **Idiomatic java.time Usage:** Avoid redundant conversions between `Instant` and `DateTime`. If a field or parameter is an `Instant`, use it directly. Do not convert to `DateTime` just to call a deprecated method if an `Instant` alternative exists or can be easily created. Furthermore, you should not call `toInstant()` or `toDateTime()` conversion methods when not strictly necessary; always prefer to use an alternative method that returns the correct type if one exists (e.g. use `tm().getTxTime()` which returns an `Instant` instead of calling `tm().getTransactionTime().toInstant()`).
+- **CRITICAL MISTAKES TO AVOID:**
+    - NEVER use `toInstant(clock.nowUtc())` or `toInstant(fakeClock.nowUtc())`. Both `Clock` and `FakeClock` have a `now()` method that natively returns a `java.time.Instant`. You MUST use `clock.now()` or `fakeClock.now()` directly.
+    - NEVER double-wrap conversions like `toInstant(toDateTime(...))` or `toDateTime(toInstant(...))`.
+    - NEVER mark method parameters or local variables as `final` unnecessarily, as it clutters the codebase. For class fields and constants, use `final` where applicable (i.e. when the field is assigned once and never mutated) to enforce and communicate immutability.
+    - When using test helpers like `assertThatCommand().atTime(...)` or `ForeignKeyUtils.loadResource(...)`, ALWAYS use the `Instant` overloads. DO NOT wrap `Instant` instances in `toDateTime(...)` just to pass them to deprecated overloads.
+- **UTC Timezones:** Do not use `ZoneId.of("UTC")`. Use a statically imported `UTC` from `ZoneOffset` instead (`import static java.time.ZoneOffset.UTC;`).
 - **Millisecond Precision:** Always truncate `Instant.now()` to milliseconds (using `.truncatedTo(ChronoUnit.MILLIS)`) to maintain consistency with Joda `DateTime` and the PostgreSQL schema (which enforces millisecond precision via JPA converters).
 - **Clock Injection:**
     - Avoid direct calls to `Instant.now()`, `DateTime.now()`, `ZonedDateTime.now()`, or `System.currentTimeMillis()`.
     - Inject `google.registry.util.Clock` (production) or `google.registry.testing.FakeClock` (tests).
     - Use `clock.nowDate()` to get a `ZonedDateTime` in UTC.
+    - When defining timestamps for tests, prefer using a fixed, static constant (e.g., `Instant.parse("2024-03-27T10:15:30.105Z")`) over capturing `clock.now()` to prevent flaky tests caused by the passage of real time. Avoid using the Unix epoch (`START_INSTANT`) unless specifically testing epoch-related logic; instead, use realistic dates and vary them across different test suites to ensure logic isn't dependent on a specific "standard" date.
 - **Beam Pipelines:**
     - Ensure `Clock` is serializable (it is by default in this project) when used in Beam `DoFn`s.
     - Pass the `Clock` through the constructor or via Dagger provider methods in the pipeline module.
@@ -47,6 +59,119 @@ This document outlines foundational mandates, architectural patterns, and projec
 ### 6. Project Dependencies
 - **Common Module:** When using `Clock` or other core utilities in a new or separate module (like `load-testing`), ensure `implementation project(':common')` is added to the module's `build.gradle`.
 
+### 7. Search and Discovery
+- **No CodeSearch:** This project is hosted on GitHub, not Google3. Do NOT use `mcp_Coding_search_for_files_codesearch` or other internal Google3 search tools.
+- **Local Grep:** Use local shell commands like `git grep` or `grep` via `run_shell_command` to search the codebase.
+
 ## Performance and Efficiency
 - **Turn Minimization:** Aim for "perfect" code in the first iteration. Iterative fixes for checkstyle or compilation errors consume significant context and time.
 - **Context Management:** Use sub-agents for batch refactoring or high-volume output tasks to keep the main session history lean and efficient.
+- **Code Formatting:** Do not write custom Python scripts or manual regex replacements to fix code formatting issues (e.g., unused imports, import ordering, line length). Instead, use the project's built-in formatting tools: run `./gradlew spotlessApply` to fix unused/unordered imports and `./gradlew javaIncrementalFormatApply` (or `google-java-format --replace <files>`) to automatically fix Java formatting and indentation errors.
+
+## General Code Review Lessons & Avoidable Mistakes
+Based on historical PR reviews, avoid the following common mistakes:
+- **No Unnecessary Casts:** Do not unnecessarily cast objects if the method signature accepts the type directly (e.g., avoid `(Instant) fakeClock.now()` or `(ImmutableSet<String>) bsaQuery(...)` if it compiles without it).
+- **Visibility Modifiers:** Do not use `/* package */` comments to denote package-private visibility. Just leave the modifier blank; it is an established idiom in this codebase.
+
+### Advanced Java & Guava Idioms
+- **Immutable Types:** Declare variables, fields, and return types explicitly as Guava immutable types (e.g., `ImmutableList<T>`, `ImmutableMap<K, V>`) instead of their generic interfaces (`List<T>`, `Map<K, V>`) to clearly communicate immutability contracts to callers. Use `toImmutableList()` and `toImmutableMap()` collectors in streams rather than manually accumulating into an `ArrayList` or `HashMap`.
+- **Constructors:** Do not perform heavy logic, I/O, or external API calls inside constructors. Initialization logic should be deferred or handled in a factory method or a dedicated startup routine.
+- **Exception Handling:** Do not catch generic `Exception` or `Throwable` if a more specific exception is expected. Never "log and re-throw" the same exception; either handle it entirely (and log), or throw it up the chain. For batch processes, catch exceptions at the individual item/chunk level so one failure doesn't abort the entire batch.
+- **Optional Assertions:** Prefer Truth's `.hasValue(...)` over `.isEqualTo(Optional.of(...))` for cleaner and more descriptive assertions on `Optional` types.
+- **Fail Fast:** Validate inputs and fail fast (using `Preconditions.checkArgument` or similar) at the highest level possible rather than passing invalid state (like `null`s) deeper into business logic.
+- **Magic Numbers:** Always document magic numbers or hardcoded limits (like `50.0` or `30`) with inline comments explaining the rationale.
+- **Null Safety and Optional:** Prefer using `Optional` for any variable that is expected to potentially be null. For any other variable that can be null but cannot use an `Optional` (e.g., function parameters or return types where `Optional` is not idiomatic), it MUST be annotated with `@Nullable`. Always use the `javax.annotation.Nullable` annotation.
+
+---
+
+# Gemini Engineering Guide: Nomulus Codebase
+
+This document captures high-level architectural patterns, lessons learned from large-scale refactorings (like the Joda-Time to `java.time` migration), and specific instructions to avoid common pitfalls in this environment.
+
+## 🏛 Architecture Overview
+
+- **Transaction Management:** The codebase uses a custom wrapper around JPA. Always use `tm()` (from `TransactionManagerFactory`) to interact with the database.
+- **Dependency Injection:** Dagger 2 is used extensively. If you see "cannot find symbol" errors for classes starting with `Dagger...`, the project is in a state where annotation processing failed. Fix compilation in core models first to restore generated code.
+- **Value Types:** AutoValue and "ImmutableObject" patterns are dominant. Most models follow a `Buildable` pattern with a nested `Builder`.
+- **Temporal Logic:** The project is migrating from Joda-Time to `java.time`.
+  - Core boundaries: `DateTimeUtils.START_OF_TIME_INSTANT` (Unix Epoch) and `END_OF_TIME_INSTANT` (Long.MAX_VALUE / 1000).
+  - Year Arithmetic: Use `DateTimeUtils.plusYears()` and `DateTimeUtils.minusYears()` to handle February 29th logic correctly.
+
+## Source Control
+- **Committing:** Always create a new commit on the branch if one hasn't been created yet for the branch's specific work. Only perform amending (`git commit --amend --no-edit`) for subsequent changes once the initial commit has been successfully created.
+- **One Commit Per PR:** All changes for a single PR must be squashed into a single commit before merging.
+- **Default to Amend:** Once an initial commit is created for a PR, all subsequent functional changes should be amended into that same commit by default (`git commit --amend --no-edit`). This ensures the PR remains a single, clean unit of work throughout the development lifecycle.
+- **Commit Message Style:** Follow standard Git commit best practices. The subject line (first line) MUST be a maximum of 50 characters, concise, capitalized, and **must not end with punctuation** (e.g., a period). The body MUST explicitly encapsulate and summarize all changes made across the entire diff, detailing the "what" and "why" comprehensively.
+- **Strict Completion Verification:** You MUST NEVER declare a task, commit, or amendment as complete until you have explicitly verified that the workspace is clean. You MUST follow this exact sequence of actions across multiple conversational turns if necessary:
+  1. Execute the `git commit` or `git commit --amend` command.
+  2. Wait for the tool to return successfully.
+  3. Execute `git status`.
+  4. Wait for the tool to return and explicitly verify the output contains `nothing to commit, working tree clean` (or similar indication that no unstaged changes remain). If changes remain, stage them and amend the commit, then repeat this verification loop.
+  5. **Only after** step 4 has successfully returned a clean working directory may you generate a text response to the user declaring that the task is complete.
+- **Diff Review:** Before finalizing a task, review the full diff (e.g., `git diff HEAD^`) to ensure all changes are functional and relevant. Identify and revert any formatting-only changes in files that do not contain functional updates to keep the commit focused.
+
+## Self-Review Guidelines
+Before finalizing any PR or declaring a task complete, you MUST perform a thorough, rigorous self-review of your entire diff. Run `git diff HEAD^` (or review the staged changes) and actively verify the following against every modified line:
+
+1. **Imports & FQNs:** Did I leave any fully-qualified class names or static variables inline? Did I add the necessary imports for them? *Crucial Exception:* If the file already imports a class with the identical name (e.g., it uses both `java.time.Duration` and `org.joda.time.Duration`), one MUST remain fully qualified to avoid a compilation conflict.
+2. **Redundant Conversions:** Did I use `toDateTime(clock.now())` where `clock.nowUtc()` would suffice? Did I use `toDateTime(END_INSTANT)` instead of `END_OF_TIME`? Did I use `.toInstant()` or `.toDateTime()` on something that could be avoided by using a different method overload (e.g., `tm().getTxTime()`)?
+3. **Verbose Math:** Did I write any verbose time conversions inline? Are there `DateTimeUtils` methods I should be using instead? If not, should I abstract this math into `DateTimeUtils`?
+4. **Assertion Cleanliness:** Am I polluting test assertions with `toDateTime(...)` wraps? If so, I need to add overloaded assertions to the Truth Subjects instead.
+5. **Diff Scope:** Are there any formatting-only changes in files that I did not functionally modify? If so, revert them. Does the total line count of the diff align with the approved scope (e.g., ~1,000 lines for migrations)?
+6. **Commit Message:** Does the commit message title fit within 50 characters? Does the body encapsulate the entirety of the changes across the diff cleanly and professionally?
+7. **Missing Tests & Coverage:** *Perform a structured check for any new methods or modified behavior.* Did I add a new utility method (like `plusMonths(Instant, int)`) or change core logic? If so, I MUST open the corresponding test file and write tests to cover the new functionality (including edge cases, negative values, and leap years) before considering the task complete. A code review is not thorough if it only checks for compilation. I must actively ensure every new branch of logic has a test.
+8. **Package Lock:** Did I include `console-webapp/package-lock.json` in my diff? If so, I MUST revert it (`git checkout console-webapp/package-lock.json`) unless I explicitly intended to modify NPM dependencies. This file is often modified by the build process and should not be committed accidentally.
+
+Only after actively confirming these checks against your diff are you permitted to finalize the task.
+
+## Refactoring & Migration Guardrails
+
+
+### 1. Compiler Warnings are Errors (`-Werror`)
+This project treats Error Prone warnings as errors.
+- **`@InlineMeSuggester`**: When creating deprecated Joda-Time bridge methods (e.g., `getTimestamp() -> return toDateTime(getTimestampInstant())`), you **MUST** immediately add `@SuppressWarnings("InlineMeSuggester")`. If you don't, the build will fail.
+- **Repeatable Annotations**: `@SuppressWarnings` is **NOT** repeatable in this environment. If a method or class already has a suppression (e.g., `@SuppressWarnings("unchecked")`), you must merge them:
+  - ❌ `@SuppressWarnings("unchecked") @SuppressWarnings("InlineMeSuggester")`
+  - ✅ `@SuppressWarnings({"unchecked", "InlineMeSuggester"})`
+
+### 2. Resolving Ambiguity
+- **Null Overloads**: Adding an `Instant` overload to a method that previously took `DateTime` will break all `create(null)` calls. You must cast them: `create((Instant) null)`.
+- **Type Erasure**: Methods taking `Optional<DateTime>` and `Optional<Instant>` will clash due to erasure. Use distinct names, e.g., `setAutorenewEndTimeInstant(Optional<Instant> time)`.
+
+### 3. Build Strategy
+- **Surgical Changes**: In large-scale migrations, focus on "leaf" nodes first (Utilities -> Models -> Flows -> Actions).
+- **PR Size**: Minimize PR size by retaining Joda-Time bridge methods for high-level "Action" and "Flow" classes unless a full migration is requested. Reverting changes to DNS and Reporting logic while updating the underlying models is a valid strategy to keep PRs reviewable.
+- **Validation**: Always run `./gradlew build -x test` before attempting to run unit tests. Unit tests will not run if there are compilation errors in any part of the `core` module. Before finalizing a PR or declaring a task done, you MUST verify your changes. **Prefer scoped builds** (e.g., `./gradlew :core:build`) if you are only modifying backend Java code. Running the global `./gradlew build` triggers the frontend `console-webapp` build, which unnecessarily runs `npmInstallDeps` and modifies `package-lock.json`. If you must run a global build, you must revert `console-webapp/package-lock.json` afterwards. Do not declare success if formatting checks (e.g., `spotlessCheck` or `javaIncrementalFormatCheck`) or tests fail. If formatting fails, run `./gradlew spotlessApply` and then re-run your build command to verify everything passes.
+
+## 🚫 Common Pitfalls to Avoid
+
+- **Mixing Joda and Java Durations:** Methods like `Tld.get().getRenewGracePeriodLength()` return a **Joda** `Duration`, which cannot be passed directly to `Instant.plus(...)` because it doesn't implement `TemporalAmount`. You MUST use `.plusMillis(duration.getMillis())` instead.
+- **Serialization Precision (`.000Z`):** When asserting against or generating XML/YAML files, remember that millisecond precision (`.000Z`) is required. Always use `DateTimeUtils.formatInstant(...)` to format `Instant` objects (it preserves the `.000Z` suffix) instead of `Instant.toString()` (which drops it for exact seconds). We have added custom Jackson `InstantKeySerializer`s for this purpose, but you must keep this precision in mind when manually updating `.xml` or `.yaml` test data.
+- **Static Imports:** Methods like `toDateTime`, `toInstant`, `plusYears`, `plusMonths`, and `minusDays` from `DateTimeUtils` MUST be statically imported. Do NOT use them fully qualified (e.g., `DateTimeUtils.plusMonths(...)`).
+
+- **Redundant Parses:** Never write `toDateTime(Instant.parse(...))` or `toInstant(DateTime.parse(...))`. If you need a `DateTime`, use `DateTime.parse(...)` directly. If you need an `Instant`, use `Instant.parse(...)` directly.
+- **cloneProjectedAtTime vs cloneProjectedAtInstant:** When converting tests and logic that use `clock.now()` to project resource state into the future or past, do not wrap the Java `Instant` in `toDateTime()` just to call `cloneProjectedAtTime()`. Instead, switch the method call to use the native `cloneProjectedAtInstant()` method which is available on all `EppResource` models.
+- **Do not go in circles with the build:** If you see an `InlineMeSuggester` error, apply the suppression to **ALL** similar methods in that file and related files in one turn. Do not fix them one by one. Furthermore, do not run a global `./gradlew build` when a scoped `./gradlew :core:build` or `./gradlew :core:test` is faster and more appropriate. Run global builds only when doing final verification.
+- **Exception Conversion in Tests:** When migrating time types (e.g., from Joda `DateTime` to Java `Instant`), be extremely careful with tests that verify parsing failures (e.g., `assertThrows(IllegalArgumentException.class, ...)`). Joda's `DateTime.parse()` throws an `IllegalArgumentException` on failure, but `Instant.parse()` throws a `java.time.format.DateTimeParseException`. You must update the expected exception type in these tests to ensure they actually test the correct behavior, and verify the tests are not failing prematurely on the first line if it contains invalid data meant to be ignored.
+- Dagger/AutoValue corruption: If you modify a builder or a component incorrectly, Dagger will fail to generate code, leading to hundreds of "cannot find symbol" errors. If this happens, `git checkout` the last working state of the specific file and re-apply changes more surgically.
+- **`replace` tool context**: When using `replace` on large files (like `Tld.java` or `DomainBase.java`), provide significant surrounding context. These files have many similar method signatures (getters/setters) that can lead to incorrect replacements.
+
+---
+
+## GitHub and Pull Request Protocol
+
+This protocol defines the standard for interacting with GitHub repositories and processing Pull Request (PR) feedback.
+
+### 1. Interaction via `gh` CLI
+- **Primary Tool:** ALWAYS use the `gh` CLI for all GitHub-related operations (listing PRs, viewing PR content, checking status, adding comments).
+- **Credential Safety:** Never expose tokens or credentials in shell commands.
+
+### 2. Processing PR Feedback
+- **Systematic Review:** When asked to address PR comments, first fetch all comments using `gh pr view <number> --json reviews,comments`.
+- **Minimal Scope Expansion:** Address comments surgically. If a fix requires changes beyond a few lines or expands the PR's original scope significantly, DO NOT implement it without explicit user approval. Instead, report the issue to the user.
+- **Verification:** After addressing feedback, run the full build (`./gradlew build`) and relevant tests to ensure no regressions were introduced.
+
+### 3. PR Lifecycle Management
+- **One Commit Per PR:** Ensure all changes are squashed into a single, clean commit. Use `git commit --amend --no-edit` for follow-up fixes.
+- **Clean Workspace:** Always run `git status` and verify the repository state before declaring a task complete.
+- **Package Lock:** The Gradle build automatically modifies `console-webapp/package-lock.json` via the `npmInstallDeps` task. ALWAYS revert this file (`git checkout console-webapp/package-lock.json`) before staging changes or finalizing a commit unless you explicitly modified NPM dependencies.

build.gradle

@@ -200,6 +200,7 @@ allprojects {
                                 "--add-exports",
                                 "jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED"]
         options.forkOptions.jvmArgs = ["-J--add-exports=jdk.compiler/com.sun.tools.javac.main=ALL-UNNAMED",
+                                       "-J--add-exports=jdk.compiler/com.sun.tools.javac.model=ALL-UNNAMED",
                                        "-J--add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED",
                                        "-J--add-exports=jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED",
                                        "-J--add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED",
@@ -358,11 +359,13 @@ subprojects {
   // search for `flex-template-base-image` and update the parameter value.
   // There are at least two instances, one in core/build.gradle, one in
   // release/stage_beam_pipeline.sh
+  // Also need to change:
+  // - base images in Dockerfiles under core, jetty, and proxy.
+  // - Java installation command in the builder image under release.
+  // - cloudbuild-release.yaml under release.
   java {
-    // TODO(b/457758757): change to V_25 once Java in all environments are
-    // upgraded.
-    sourceCompatibility = JavaVersion.VERSION_21
-    targetCompatibility = JavaVersion.VERSION_21
+    sourceCompatibility = JavaVersion.VERSION_25
+    targetCompatibility = JavaVersion.VERSION_25
   }
 
   project.tasks.test.dependsOn runPresubmits

common/src/main/java/google/registry/util/DateTimeUtils.java

@@ -15,6 +15,7 @@
 package google.registry.util;
 
 import static com.google.common.base.Preconditions.checkArgument;
+import static org.joda.time.DateTimeZone.UTC;
 
 import com.google.common.collect.Iterables;
 import com.google.common.collect.Lists;
@@ -22,16 +23,22 @@ import com.google.common.collect.Ordering;
 import java.sql.Date;
 import java.time.Instant;
 import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
+import java.time.format.DateTimeFormatterBuilder;
+import java.time.format.DateTimeParseException;
+import java.time.format.SignStyle;
+import java.time.temporal.ChronoField;
+import java.time.temporal.ChronoUnit;
 import javax.annotation.Nullable;
 import org.joda.time.DateTime;
-import org.joda.time.DateTimeZone;
 import org.joda.time.LocalDate;
+import org.joda.time.ReadableDuration;
 
 /** Utilities methods and constants related to Joda {@link DateTime} objects. */
 public abstract class DateTimeUtils {
 
   /** The start of the epoch, in a convenient constant. */
-  @Deprecated public static final DateTime START_OF_TIME = new DateTime(0, DateTimeZone.UTC);
+  @Deprecated public static final DateTime START_OF_TIME = new DateTime(0, UTC);
 
   /** The start of the UNIX epoch (which is defined in UTC), in a convenient constant. */
   public static final Instant START_INSTANT = Instant.ofEpochMilli(0);
@@ -43,8 +50,7 @@ public abstract class DateTimeUtils {
    * but Java uses milliseconds, so this is the largest representable date that will survive a
    * round-trip through the database.
    */
-  @Deprecated
-  public static final DateTime END_OF_TIME = new DateTime(Long.MAX_VALUE / 1000, DateTimeZone.UTC);
+  @Deprecated public static final DateTime END_OF_TIME = new DateTime(Long.MAX_VALUE / 1000, UTC);
 
   /**
    * An instant in the far future that we can treat as infinity.
@@ -55,6 +61,47 @@ public abstract class DateTimeUtils {
    */
   public static final Instant END_INSTANT = Instant.ofEpochMilli(Long.MAX_VALUE / 1000);
 
+  /**
+   * Standard ISO 8601 formatter with millisecond precision in UTC.
+   *
+   * <p>Example: {@code 2024-03-27T10:15:30.105Z}
+   *
+   * <p>Handles large/negative years by using a sign prefix if necessary, compatible with {@link
+   * Instant#parse}.
+   */
+  private static final DateTimeFormatter ISO_8601_FORMATTER =
+      new DateTimeFormatterBuilder()
+          .appendValue(ChronoField.YEAR, 4, 10, SignStyle.NORMAL)
+          .appendPattern("-MM-dd'T'HH:mm:ss.SSS'Z'")
+          .toFormatter()
+          .withZone(ZoneOffset.UTC);
+
+  /** A formatter that produces lowercase, filename-safe and job-name-safe timestamps. */
+  public static final DateTimeFormatter LOWERCASE_TIMESTAMP_FORMATTER =
+      DateTimeFormatter.ofPattern("yyyy-MM-dd't'HH-mm-ss'z'").withZone(ZoneOffset.UTC);
+
+  /** Formats an {@link Instant} to an ISO-8601 string. */
+  public static String formatInstant(Instant instant) {
+    return ISO_8601_FORMATTER.format(instant);
+  }
+
+  /**
+   * Parses an ISO-8601 string to an {@link Instant}.
+   *
+   * <p>This method is lenient and supports both strings with and without millisecond precision
+   * (e.g. {@code 2024-03-27T10:15:30Z} and {@code 2024-03-27T10:15:30.105Z}). It also supports
+   * large years (e.g. {@code 294247-01-10T04:00:54.775Z}).
+   */
+  public static Instant parseInstant(String timestamp) {
+    try {
+      // Try the standard millisecond precision format first.
+      return Instant.from(ISO_8601_FORMATTER.parse(timestamp));
+    } catch (DateTimeParseException e) {
+      // Fall back to the standard ISO instant parser which handles varied precision.
+      return Instant.parse(timestamp);
+    }
+  }
+
   /** Returns the earliest of a number of given {@link DateTime} instances. */
   public static DateTime earliestOf(DateTime first, DateTime... rest) {
     return earliestDateTimeOf(Lists.asList(first, rest));
@@ -79,20 +126,43 @@ public abstract class DateTimeUtils {
 
   /** Returns the latest of a number of given {@link DateTime} instances. */
   public static DateTime latestOf(DateTime first, DateTime... rest) {
+    return latestDateTimeOf(Lists.asList(first, rest));
+  }
+
+  /** Returns the latest of a number of given {@link Instant} instances. */
+  public static Instant latestOf(Instant first, Instant... rest) {
     return latestOf(Lists.asList(first, rest));
   }
 
   /** Returns the latest element in a {@link DateTime} iterable. */
-  public static DateTime latestOf(Iterable<DateTime> dates) {
+  public static DateTime latestDateTimeOf(Iterable<DateTime> dates) {
     checkArgument(!Iterables.isEmpty(dates));
     return Ordering.<DateTime>natural().max(dates);
   }
 
+  /** Returns the latest element in a {@link Instant} iterable. */
+  public static Instant latestOf(Iterable<Instant> instants) {
+    checkArgument(!Iterables.isEmpty(instants));
+    return Ordering.<Instant>natural().max(instants);
+  }
+
   /** Returns whether the first {@link DateTime} is equal to or earlier than the second. */
   public static boolean isBeforeOrAt(DateTime timeToCheck, DateTime timeToCompareTo) {
     return !timeToCheck.isAfter(timeToCompareTo);
   }
 
+  /** Converts a Joda-Time Duration to a java.time.Duration. */
+  @Nullable
+  public static java.time.Duration toJavaDuration(@Nullable ReadableDuration duration) {
+    return duration == null ? null : java.time.Duration.ofMillis(duration.getMillis());
+  }
+
+  /** Converts a java.time.Duration to a Joda-Time Duration. */
+  @Nullable
+  public static org.joda.time.Duration toJodaDuration(@Nullable java.time.Duration duration) {
+    return duration == null ? null : org.joda.time.Duration.millis(duration.toMillis());
+  }
+
   /** Returns whether the first {@link Instant} is equal to or earlier than the second. */
   public static boolean isBeforeOrAt(Instant timeToCheck, Instant timeToCompareTo) {
     return !timeToCheck.isAfter(timeToCompareTo);
@@ -112,8 +182,7 @@ public abstract class DateTimeUtils {
    * Adds years to a date, in the {@code Duration} sense of semantic years. Use this instead of
    * {@link DateTime#plusYears} to ensure that we never end up on February 29.
    */
-  @Deprecated
-  public static DateTime leapSafeAddYears(DateTime now, int years) {
+  public static DateTime plusYears(DateTime now, int years) {
     checkArgument(years >= 0);
     return years == 0 ? now : now.plusYears(1).plusYears(years - 1);
   }
@@ -122,19 +191,30 @@ public abstract class DateTimeUtils {
    * Adds years to a date, in the {@code Duration} sense of semantic years. Use this instead of
    * {@link java.time.ZonedDateTime#plusYears} to ensure that we never end up on February 29.
    */
-  public static Instant leapSafeAddYears(Instant now, long years) {
+  public static Instant plusYears(Instant now, int years) {
     checkArgument(years >= 0);
     return (years == 0)
         ? now
         : now.atZone(ZoneOffset.UTC).plusYears(1).plusYears(years - 1).toInstant();
   }
 
+  /** Adds months to a date. */
+  public static Instant plusMonths(Instant now, int months) {
+    checkArgument(months >= 0);
+    return now.atZone(ZoneOffset.UTC).plusMonths(months).toInstant();
+  }
+
+  /** Subtracts months from a date. */
+  public static Instant minusMonths(Instant now, int months) {
+    checkArgument(months >= 0);
+    return now.atZone(ZoneOffset.UTC).minusMonths(months).toInstant();
+  }
+
   /**
    * Subtracts years from a date, in the {@code Duration} sense of semantic years. Use this instead
    * of {@link DateTime#minusYears} to ensure that we never end up on February 29.
    */
-  @Deprecated
-  public static DateTime leapSafeSubtractYears(DateTime now, int years) {
+  public static DateTime minusYears(DateTime now, int years) {
     checkArgument(years >= 0);
     return years == 0 ? now : now.minusYears(1).minusYears(years - 1);
   }
@@ -143,19 +223,47 @@ public abstract class DateTimeUtils {
    * Subtracts years from a date, in the {@code Duration} sense of semantic years. Use this instead
    * of {@link java.time.ZonedDateTime#minusYears} to ensure that we never end up on February 29.
    */
-  public static Instant leapSafeSubtractYears(Instant now, int years) {
+  public static Instant minusYears(Instant now, long years) {
     checkArgument(years >= 0);
     return (years == 0)
         ? now
         : now.atZone(ZoneOffset.UTC).minusYears(1).minusYears(years - 1).toInstant();
   }
 
+  /**
+   * @deprecated Use {@link #plusYears(DateTime, int)}
+   */
+  @Deprecated
+  @SuppressWarnings("InlineMeSuggester")
+  public static DateTime leapSafeAddYears(DateTime now, int years) {
+    return plusYears(now, years);
+  }
+
+  /**
+   * @deprecated Use {@link #minusYears(DateTime, int)}
+   */
+  @Deprecated
+  @SuppressWarnings("InlineMeSuggester")
+  public static DateTime leapSafeSubtractYears(DateTime now, int years) {
+    return minusYears(now, years);
+  }
+
   public static Date toSqlDate(LocalDate localDate) {
     return new Date(localDate.toDateTimeAtStartOfDay().getMillis());
   }
 
   public static LocalDate toLocalDate(Date date) {
-    return new LocalDate(date.getTime(), DateTimeZone.UTC);
+    return new LocalDate(date.getTime(), UTC);
+  }
+
+  /** Converts a java.time.LocalDate to a Joda-Time LocalDate. */
+  public static LocalDate toJodaLocalDate(java.time.LocalDate localDate) {
+    return new LocalDate(localDate.getYear(), localDate.getMonthValue(), localDate.getDayOfMonth());
+  }
+
+  /** Converts an Instant to a Joda-Time LocalDate in UTC. */
+  public static LocalDate toJodaLocalDate(Instant instant) {
+    return new LocalDate(instant.toEpochMilli(), UTC);
   }
 
   /** Convert a joda {@link DateTime} to a java.time {@link Instant}, null-safe. */
@@ -167,7 +275,7 @@ public abstract class DateTimeUtils {
   /** Convert a java.time {@link Instant} to a joda {@link DateTime}, null-safe. */
   @Nullable
   public static DateTime toDateTime(@Nullable Instant instant) {
-    return (instant == null) ? null : new DateTime(instant.toEpochMilli(), DateTimeZone.UTC);
+    return (instant == null) ? null : new DateTime(instant.toEpochMilli(), UTC);
   }
 
   /** Convert a java.time {@link java.time.Instant} to a joda {@link org.joda.time.Instant}. */
@@ -176,8 +284,20 @@ public abstract class DateTimeUtils {
     return (instant == null) ? null : org.joda.time.Instant.ofEpochMilli(instant.toEpochMilli());
   }
 
-  public static Instant plusYears(Instant instant, int years) {
-    return instant.atZone(ZoneOffset.UTC).plusYears(years).toInstant();
+  public static Instant plusHours(Instant instant, long hours) {
+    return instant.plus(hours, ChronoUnit.HOURS);
+  }
+
+  public static Instant minusHours(Instant instant, long hours) {
+    return instant.minus(hours, ChronoUnit.HOURS);
+  }
+
+  public static Instant plusMinutes(Instant instant, long minutes) {
+    return instant.plus(minutes, ChronoUnit.MINUTES);
+  }
+
+  public static Instant minusMinutes(Instant instant, long minutes) {
+    return instant.minus(minutes, ChronoUnit.MINUTES);
   }
 
   public static Instant plusDays(Instant instant, int days) {

common/src/main/java/google/registry/util/Sleeper.java

@@ -14,6 +14,7 @@
 
 package google.registry.util;
 
+import java.time.Duration;
 import javax.annotation.concurrent.ThreadSafe;
 import org.joda.time.ReadableDuration;
 
@@ -32,6 +33,15 @@ public interface Sleeper {
    */
   void sleep(ReadableDuration duration) throws InterruptedException;
 
+  /**
+   * Puts the current thread to sleep.
+   *
+   * @throws InterruptedException if this thread was interrupted
+   */
+  default void sleep(Duration duration) throws InterruptedException {
+    sleep(DateTimeUtils.toJodaDuration(duration));
+  }
+
   /**
    * Puts the current thread to sleep, ignoring interrupts.
    *
@@ -42,6 +52,18 @@ public interface Sleeper {
    */
   void sleepUninterruptibly(ReadableDuration duration);
 
+  /**
+   * Puts the current thread to sleep, ignoring interrupts.
+   *
+   * <p>If {@link InterruptedException} was caught, then {@code Thread.currentThread().interrupt()}
+   * will be called at the end of the {@code duration}.
+   *
+   * @see com.google.common.util.concurrent.Uninterruptibles#sleepUninterruptibly
+   */
+  default void sleepUninterruptibly(Duration duration) {
+    sleepUninterruptibly(DateTimeUtils.toJodaDuration(duration));
+  }
+
   /**
    * Puts the current thread to interruptible sleep.
    *
@@ -57,4 +79,20 @@ public interface Sleeper {
       throw new RuntimeException("Interrupted.", e);
     }
   }
+
+  /**
+   * Puts the current thread to interruptible sleep.
+   *
+   * <p>This is a convenience method for {@link #sleep} that properly converts an {@link
+   * InterruptedException} to a {@link RuntimeException}.
+   */
+  default void sleepInterruptibly(Duration duration) {
+    try {
+      sleep(duration);
+    } catch (InterruptedException e) {
+      // Restore current thread's interrupted state.
+      Thread.currentThread().interrupt();
+      throw new RuntimeException("Interrupted.", e);
+    }
+  }
 }

common/src/main/java/google/registry/util/SystemClock.java

@@ -14,6 +14,7 @@
 
 package google.registry.util;
 
+import static java.time.temporal.ChronoUnit.MILLIS;
 import static org.joda.time.DateTimeZone.UTC;
 
 import jakarta.inject.Inject;
@@ -42,6 +43,6 @@ public class SystemClock implements Clock {
     // (which uses millisecond precision via DateTimeConverter). This prevents subtle comparison
     // bugs where a high-precision Instant would be considered "after" a truncated database
     // timestamp.
-    return Instant.now().truncatedTo(java.time.temporal.ChronoUnit.MILLIS);
+    return Instant.now().truncatedTo(MILLIS);
   }
 }

common/src/main/java/google/registry/util/SystemSleeper.java

@@ -15,6 +15,7 @@
 package google.registry.util;
 
 import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.util.DateTimeUtils.toJavaDuration;
 
 import com.google.common.util.concurrent.Uninterruptibles;
 import jakarta.inject.Inject;
@@ -40,6 +41,6 @@ public final class SystemSleeper implements Sleeper, Serializable {
   @Override
   public void sleepUninterruptibly(ReadableDuration duration) {
     checkArgument(duration.getMillis() >= 0);
-    Uninterruptibles.sleepUninterruptibly(java.time.Duration.ofMillis(duration.getMillis()));
+    Uninterruptibles.sleepUninterruptibly(toJavaDuration(duration));
   }
 }

common/src/testing/java/google/registry/testing/FakeClock.java

@@ -49,6 +49,11 @@ public final class FakeClock implements Clock {
     setTo(startTime);
   }
 
+  /** Creates a FakeClock initialized to a specific time. */
+  public FakeClock(Instant startTime) {
+    setTo(startTime);
+  }
+
   /** Returns the current time. */
   @Override
   public DateTime nowUtc() {
@@ -84,11 +89,21 @@ public final class FakeClock implements Clock {
     currentTimeMillis.addAndGet(duration.getMillis());
   }
 
+  /** Advances clock by some duration. */
+  public void advanceBy(java.time.Duration duration) {
+    currentTimeMillis.addAndGet(duration.toMillis());
+  }
+
   /** Sets the time to the specified instant. */
   public void setTo(ReadableInstant time) {
     currentTimeMillis.set(time.getMillis());
   }
 
+  /** Sets the time to the specified instant. */
+  public void setTo(Instant time) {
+    currentTimeMillis.set(time.toEpochMilli());
+  }
+
   /** Invokes {@link #setAutoIncrementStep} with one millisecond-step. */
   public FakeClock setAutoIncrementByOneMilli() {
     return setAutoIncrementStep(Duration.millis(1));

common/src/testing/java/google/registry/testing/truth/TextDiffSubject.java

@@ -33,6 +33,8 @@ import com.google.common.truth.Fact;
 import com.google.common.truth.FailureMetadata;
 import com.google.common.truth.SimpleSubjectBuilder;
 import com.google.common.truth.Subject;
+import com.google.errorprone.annotations.FormatMethod;
+import com.google.errorprone.annotations.FormatString;
 import java.io.IOException;
 import java.net.URL;
 import java.util.Collection;
@@ -125,8 +127,9 @@ public class TextDiffSubject extends Subject {
     return assertThat(Resources.asCharSource(resourceUrl, UTF_8).readLines());
   }
 
+  @FormatMethod
   public static SimpleSubjectBuilder<TextDiffSubject, URL> assertWithMessageAboutUrlSource(
-      String format, Object... params) {
+      @FormatString String format, Object... params) {
     return assertWithMessage(format, params).about(urlFactory());
   }
 
@@ -192,7 +195,7 @@ public class TextDiffSubject extends Subject {
 
   private record SideBySideRowFormatter(int maxExpectedLineLength, int maxActualLineLength) {
 
-    public String formatRow(String expected, String actual, char padChar) {
+    String formatRow(String expected, String actual, char padChar) {
       return String.format(
           "|%s|%s|",
           Strings.padEnd(expected, maxExpectedLineLength, padChar),

config/presubmits.py

@@ -104,7 +104,7 @@ PRESUBMITS = {
 
     # System.(out|err).println should only appear in tools/ or load-testing/
     PresubmitCheck(
-        r".*\bSystem\.(out|err)\.print", "java", {
+        r".*\bSystem\s*\.\s*(?:out|err)\s*\.\s*print.*", "java", {
             "/tools/", "/example/", "/load-testing/",
             "RegistryTestServerMain.java", "TestServerExtension.java"
         }):
@@ -139,7 +139,7 @@ PRESUBMITS = {
     ):
         "All soy templates must use strict autoescaping",
     PresubmitCheck(
-        r".*\nimport (static )?.*\.shaded\..*",
+        r".*\nimport\s+(?:static\s+)?.*\.shaded\..*",
         "java",
         {"/node_modules/"},
     ):
@@ -153,7 +153,7 @@ PRESUBMITS = {
     PresubmitCheck(
         r".*java\.util\.Date.*",
         "java",
-        {"/node_modules/", "JpaTransactionManagerImpl.java"},
+        {"/node_modules/", "JpaTransactionManagerImpl.java", "DateTimeUtils.java"},
     ):
         "Do not use java.util.Date. Use classes in java.time package instead.",
     PresubmitCheck(
@@ -163,7 +163,7 @@ PRESUBMITS = {
     ):
         "Use status code from jakarta.servlet.http.HttpServletResponse.",
     PresubmitCheck(
-        r".*mock\(Response\.class\).*",
+        r".*mock\(\s*Response\.class\s*\).*",
         "java",
         {"/node_modules/"},
     ):
@@ -181,13 +181,122 @@ PRESUBMITS = {
     ):
         "Do not use javax.inject.* Use jakarta.inject.* instead.",
     PresubmitCheck(
-        r".*import jakarta.persistence.(Pre|Post)(Persist|Load|Remove|Update);",
+        r".*import\s+jakarta\.persistence\.(?:Pre|Post)(?:Persist|Load|Remove|Update)\s*;",
         "java",
         {"EntityCallbacksListener.java"},
     ):
         "Hibernate lifecycle events aren't called for embedded entities, so it's "
         "usually best to avoid them. Instead, use the annotations defined in "
-        "EntityCallbacksListener.java"
+        "EntityCallbacksListener.java",
+    PresubmitCheck(
+        r".*\.isEqualTo\(\s*Optional\.of\(.*",
+        "java",
+        {},
+    ):
+        "Do not use .isEqualTo(Optional.of(...)). Use Truth's .hasValue(...) instead.",
+    # TODO: Remove the java.time migration presubmit checks below once the entire codebase has been migrated to java.time.
+    PresubmitCheck(
+        r".*toDateTime\(\s*toInstant\(.*",
+        "java",
+        {"DateTimeUtilsTest.java"},
+    ):
+        "Do not double-wrap toDateTime(toInstant(...)).",
+    PresubmitCheck(
+        r".*toInstant\(\s*toDateTime\(.*",
+        "java",
+        {"DateTimeUtilsTest.java"},
+    ):
+        "Do not double-wrap toInstant(toDateTime(...)).",
+    PresubmitCheck(
+        r".*toInstant\([^;]*[cC]lock\.nowUtc\(\).*",
+        "java",
+        {},
+    ):
+        "Do not use toInstant(clock.nowUtc()). Use clock.now() instead.",
+    PresubmitCheck(
+        r".*toDateTime\([^;]*[cC]lock\.now\(\).*",
+        "java",
+        {},
+    ):
+        "Do not use toDateTime(clock.now()). Use clock.nowUtc() instead.",
+    PresubmitCheck(
+        r".*toInstant\([^;]*tm\(\)\.getTransactionTime\(\).*",
+        "java",
+        {},
+    ):
+        "Do not use toInstant(tm().getTransactionTime()). Use tm().getTxTime() instead.",
+    PresubmitCheck(
+        r".*toDateTime\([^;]*tm\(\)\.getTxTime\(\).*",
+        "java",
+        {},
+    ):
+        "Do not use toDateTime(tm().getTxTime()). Use tm().getTransactionTime() instead.",
+    PresubmitCheck(
+        r".*\(\s*Instant\s*\)\s*(?:this\.)?(?:fakeClock|clock)\.now\(\s*\).*",
+        "java",
+        {},
+    ):
+        "Do not unnecessarily cast clock.now() to Instant.",
+    PresubmitCheck(
+        r".*toDateTime\(\s*Instant\.now\(.*",
+        "java",
+        {},
+    ):
+        "Do not wrap Instant.now() in toDateTime. Use DateTime.now(UTC) directly.",
+    PresubmitCheck(
+        r".*toInstant\(\s*DateTime\.now\(.*",
+        "java",
+        {},
+    ):
+        "Do not wrap DateTime.now() in toInstant. Use Instant.now().truncatedTo(ChronoUnit.MILLIS) directly.",
+    PresubmitCheck(
+        r".*toDateTime\(\s*Instant\.parse\(.*",
+        "java",
+        {"DateTimeUtilsTest.java"},
+    ):
+        "Do not wrap Instant.parse in toDateTime. Use DateTime.parse directly.",
+    PresubmitCheck(
+        r".*toInstant\(\s*DateTime\.parse\(.*",
+        "java",
+        {"DateTimeUtilsTest.java"},
+    ):
+        "Do not wrap DateTime.parse in toInstant. Use Instant.parse directly.",
+    PresubmitCheck(
+        r".*cloneProjectedAtTime\(\s*toDateTime\(.*",
+        "java",
+        {},
+    ):
+        "Do not use cloneProjectedAtTime(toDateTime(...)). Use cloneProjectedAtInstant(...) instead.",
+    PresubmitCheck(
+        r".*ZoneId\.of\(\s*\"UTC\"\s*\).*",
+        "java",
+        {},
+    ):
+        "Do not use ZoneId.of(\"UTC\"). Use java.time.ZoneOffset.UTC.",
+    PresubmitCheck(
+        r".*toDateTime\(\s*END_INSTANT\s*\).*",
+        "java",
+        {"DateTimeUtilsTest.java"},
+    ):
+        "Do not wrap END_INSTANT in toDateTime. Use END_OF_TIME.",
+    PresubmitCheck(
+        r".*toInstant\(\s*END_OF_TIME\s*\).*",
+        "java",
+        {"DateTimeUtilsTest.java"},
+    ):
+        "Do not wrap END_OF_TIME in toInstant. Use END_INSTANT.",
+    PresubmitCheck(
+        r".*toDateTime\(\s*START_INSTANT\s*\).*",
+        "java",
+        {"DateTimeUtilsTest.java"},
+    ):
+        "Do not wrap START_INSTANT in toDateTime. Use START_OF_TIME.",
+    PresubmitCheck(
+        r".*toInstant\(\s*START_OF_TIME\s*\).*",
+        "java",
+        {"DateTimeUtilsTest.java"},
+    ):
+        "Do not wrap START_OF_TIME in toInstant. Use START_INSTANT."
 }
 
 # Note that this regex only works for one kind of Flyway file.  If we want to

console-webapp/package-lock.json

@@ -629,15 +629,15 @@
       }
     },
     "node_modules/@angular/build/node_modules/@types/node": {
-      "version": "25.5.0",
-      "resolved": "https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/@types/node/-/node-25.5.0.tgz",
-      "integrity": "sha512-jp2P3tQMSxWugkCUKLRPVUpGaL5MVFwF8RDuSRztfwgN1wmqJeMSbKlnEtQqU8UrhTmzEmZdu2I6v2dpp7XIxw==",
+      "version": "25.6.0",
+      "resolved": "https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/@types/node/-/node-25.6.0.tgz",
+      "integrity": "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "peer": true,
       "dependencies": {
-        "undici-types": "~7.18.0"
+        "undici-types": "~7.19.0"
       }
     },
     "node_modules/@angular/build/node_modules/@vitejs/plugin-basic-ssl": {
@@ -744,9 +744,9 @@
       }
     },
     "node_modules/@angular/build/node_modules/undici-types": {
-      "version": "7.18.2",
-      "resolved": "https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/undici-types/-/undici-types-7.18.2.tgz",
-      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
+      "version": "7.19.2",
+      "resolved": "https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/undici-types/-/undici-types-7.19.2.tgz",
+      "integrity": "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg==",
       "dev": true,
       "license": "MIT",
       "optional": true,

core/build.gradle

@@ -74,11 +74,7 @@ sourceSets {
   nonprod {
     java {
       compileClasspath += main.output
-
-      // Add the DB runtime classpath to nonprod so we can load the flyway
-      // scripts.
-      runtimeClasspath += main.output +
-          rootProject.project(":db").sourceSets.main.runtimeClasspath
+      runtimeClasspath += main.output
     }
   }
   test {
@@ -102,6 +98,7 @@ configurations {
   devtool
 
   nonprodImplementation.extendsFrom implementation
+  nonprodRuntimeOnly.extendsFrom runtimeOnly
 
   testImplementation.extendsFrom nonprodImplementation
 
@@ -193,6 +190,9 @@ dependencies {
   testRuntimeOnly deps['guru.nidi:graphviz-java-all-j2v8']
   testImplementation deps['io.github.classgraph:classgraph']
   testRuntimeOnly deps['io.github.java-diff-utils:java-diff-utils']
+  testImplementation deps['io.github.ss-bhatt:testcontainers-valkey']
+  implementation deps['io.protostuff:protostuff-core']
+  implementation deps['io.protostuff:protostuff-runtime']
   implementation deps['jakarta.inject:jakarta.inject-api']
   implementation deps['jakarta.mail:jakarta.mail-api']
   implementation deps['jakarta.persistence:jakarta.persistence-api']
@@ -246,6 +246,7 @@ dependencies {
   implementation deps['org.testcontainers:postgresql']
   testImplementation deps['org.testcontainers:selenium']
   testImplementation deps['org.testcontainers:testcontainers']
+  implementation deps['redis.clients:jedis']
   implementation deps['us.fatehi:schemacrawler']
   implementation deps['us.fatehi:schemacrawler-api']
   implementation deps['us.fatehi:schemacrawler-diagram']
@@ -259,6 +260,7 @@ dependencies {
   implementation project(':util')
   // Import NomulusPostreSql from ':db' for implementation but exclude dependencies.
   implementation project(path: ':db', configuration: 'implementationApi')
+  nonprodRuntimeOnly project(':db')
   testRuntimeOnly project(':db')
 
   annotationProcessor deps['com.google.auto.service:auto-service']
@@ -385,6 +387,7 @@ task soyToJava {
     project.services.get(ExecOperations).javaexec {
       mainClass = "com.google.template.soy.SoyParseInfoGenerator"
       classpath = configurations.soy
+      jvmArgs = ["--sun-misc-unsafe-memory-access=allow", "--enable-native-access=ALL-UNNAMED"]
       args = ["--javaPackage", "${javaPackage}",
               "--outputDirectory", "${outputDirectory}",
               "--javaClassNameSource", "filename",
@@ -440,7 +443,7 @@ artifacts {
 task findGoldenImages(type: JavaExec) {
   classpath = sourceSets.test.runtimeClasspath
   mainClass = 'google.registry.webdriver.GoldenImageFinder'
-
+  jvmArgs "--sun-misc-unsafe-memory-access=allow"
   def arguments = []
   arguments << "--screenshots_for_goldens_dir=${screenshotsForGoldensDir}"
   arguments << "--new_goldens_dir=${newGoldensDir}"
@@ -491,6 +494,7 @@ ext.createToolTask = {
   project.tasks.create(taskName, JavaExec) {
     classpath = sourceSet.runtimeClasspath
     mainClass = mainClassName
+    jvmArgs "--sun-misc-unsafe-memory-access=allow", "--enable-native-access=ALL-UNNAMED"
 
     doFirst {
       getToolArgsList().ifPresent {
@@ -508,6 +512,7 @@ createToolTask(
 project.tasks.create('generateSqlSchema', JavaExec) {
   classpath = sourceSets.nonprod.runtimeClasspath
   mainClass = 'google.registry.tools.DevTool'
+  jvmArgs "--sun-misc-unsafe-memory-access=allow"
   args = [
       '-e', 'alpha',
       'generate_sql_schema', '--start_postgresql', '-o',
@@ -574,6 +579,11 @@ if (environment == 'alpha') {
               mainClass: 'google.registry.beam.resave.ResaveAllEppResourcesPipeline',
               metaData: 'google/registry/beam/resave_all_epp_resources_pipeline_metadata.json'
           ],
+      smokeTest:
+          [
+                  mainClass: 'google.registry.beam.common.SmokeTestPipeline',
+                  metaData: 'google/registry/beam/smoke_test_pipeline_metadata.json'
+          ],
   ]
   project.tasks.create("stageBeamPipelines") {
     doLast {
@@ -666,6 +676,7 @@ artifacts {
 task runTestServer(type: JavaExec) {
   mainClass = 'google.registry.server.RegistryTestServerMain'
   classpath = sourceSets.test.runtimeClasspath
+  jvmArgs "--sun-misc-unsafe-memory-access=allow"
   dependsOn(rootProject.project('console-webapp').tasks.named('buildConsoleWebapp'))
 }
 

core/gradle.lockfile

@@ -7,23 +7,25 @@ com.charleskorn.kaml:kaml:0.20.0=deploy_jar,nonprodRuntimeClasspath,runtimeClass
 com.fasterxml.jackson.core:jackson-annotations:2.21=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson.core:jackson-core:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson.core:jackson-databind:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.20.2=testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson.datatype:jackson-datatype-joda:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson:jackson-bom:2.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.woodstox:woodstox-core:7.0.0=testCompileClasspath,testRuntimeClasspath
 com.fasterxml:classmate:1.7.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.github.ben-manes.caffeine:caffeine:3.2.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.docker-java:docker-java-api:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.docker-java:docker-java-transport-zerodep:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.docker-java:docker-java-transport:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jffi:1.3.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jffi:1.3.15=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-a64asm:1.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-constants:0.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-enxio:0.32.19=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-ffi:2.2.18=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-posix:3.1.21=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-unixsocket:0.38.24=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-enxio:0.32.20=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-ffi:2.2.19=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-posix:3.1.22=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-unixsocket:0.38.25=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-x86asm:1.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.android:annotations:4.1.1.4=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
@@ -33,76 +35,60 @@ com.google.api-client:google-api-client-java6:2.1.4=compileClasspath,deploy_jar,
 com.google.api-client:google-api-client-servlet:2.7.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-servlet:2.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.api-client:google-api-client:2.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.181.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.181.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.181.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.181.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.44.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.114.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.115.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.14.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.14.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-common-protos:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-common-protos:2.45.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.9.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha:3.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha:3.9.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.181.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.181.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.181.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.181.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.44.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-v2:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-v2:2.44.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.67.0=testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.193.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.193.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.73.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.130.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-v1:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-control-v2:2.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.67.0=testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-common-protos:2.65.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha:3.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.193.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.193.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta:3.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.73.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigtable-v2:2.73.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-compute-v1:1.82.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.112.2=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.113.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-firestore-v1:3.25.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-firestore-v1:3.26.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-monitoring-v3:3.52.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.114.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.115.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.14.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.14.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.125.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-firestore-v1:3.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-monitoring-v3:3.85.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.130.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-secretmanager-v1beta2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-executor-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-spanner-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-spanner-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-v1:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-control-v2:2.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.67.0=testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.141.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.141.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-common-protos:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-iam-v1:1.50.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:api-common:2.57.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-grpc:2.64.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-httpjson:2.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.60.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.65.0=testCompileClasspath,testRuntimeClasspath
+com.google.api:api-common:2.57.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api:api-common:2.62.0=testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-grpc:2.74.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api:gax-grpc:2.79.0=testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-httpjson:2.74.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api:gax-httpjson:2.79.0=testCompileClasspath,testRuntimeClasspath
 com.google.api:gax:2.74.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-admin-directory:directory_v1-rev20260227-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-bigquery:v2-rev20240815-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20240310-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-dataflow:v1b3-rev20260213-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-dns:v1-rev20260219-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-drive:v3-rev20260322-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-gmail:v1-rev20260112-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-bigquery:v2-rev20251012-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20250606-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-dataflow:v1b3-rev20260405-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-dns:v1-rev20260402-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-drive:v3-rev20260405-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-gmail:v1-rev20260413-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20220614-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240130-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-iam:v2-rev20250502-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -110,57 +96,50 @@ com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileC
 com.google.apis:google-api-services-monitoring:v3-rev20260129-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sheets:v4-rev20260213-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sqladmin:v1beta4-rev20251201-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20250312-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20251118-2.0.0=testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-credentials:1.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-oauth2-http:1.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20260317-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20251118-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20260204-2.0.0=testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-credentials:1.46.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-oauth2-http:1.46.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service-annotations:1.0.1=nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.auto.service:auto-service-annotations:1.1.1=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service:1.1.1=annotationProcessor
 com.google.auto.value:auto-value-annotations:1.11.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.value:auto-value-annotations:1.9=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.auto.value:auto-value:1.11.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auto.value:auto-value:1.11.1=annotationProcessor,testAnnotationProcessor
+com.google.auto.value:auto-value:1.11.1=annotationProcessor,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
 com.google.auto:auto-common:1.2.2=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.cloud.bigdataoss:gcsio:2.2.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.bigdataoss:util:2.2.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.bigdataoss:gcsio:2.2.26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.bigdataoss:util:2.2.26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.bigtable:bigtable-client-core-config:1.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.datastore:datastore-v1-proto-client:2.21.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.opentelemetry:detector-resources-support:0.31.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud.opentelemetry:detector-resources-support:0.33.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud.datastore:datastore-v1-proto-client:2.34.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.opentelemetry:detector-resources-support:0.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.opentelemetry:exporter-metrics:0.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.opentelemetry:shared-resourcemapping:0.33.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud.sql:jdbc-socket-factory-core:1.28.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.28.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-bigquerystorage:3.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-bigquerystorage:3.9.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-bigtable:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-bigtable:2.44.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud.sql:jdbc-socket-factory-core:1.28.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.28.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-bigquerystorage:3.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-bigtable:2.73.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-compute:1.82.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.54.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-http:2.54.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.64.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.69.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.54.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.cloud:google-cloud-core-http:2.69.0=testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-firestore:3.25.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-firestore:3.26.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-monitoring:3.52.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-nio:0.129.0-rc1=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-pubsub:1.132.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-pubsub:1.133.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-pubsublite:1.14.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-pubsublite:1.14.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-firestore:3.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-monitoring:3.85.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-nio:0.131.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-pubsub:1.148.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-secretmanager:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-spanner:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-spanner:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-spanner:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage-control:2.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-storage:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-tasks:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:grpc-gcp:1.6.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:grpc-gcp:1.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:libraries-bom:26.48.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.25.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.26.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.code.gson:gson:2.10.1=soy
-com.google.code.gson:gson:2.12.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.code.gson:gson:2.13.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.common.html.types:types:1.0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.google.dagger:dagger-compiler:2.59.2=annotationProcessor,testAnnotationProcessor
 com.google.dagger:dagger-spi:2.59.2=annotationProcessor,testAnnotationProcessor
@@ -169,34 +148,35 @@ com.google.devtools.ksp:symbol-processing-api:2.2.20-2.0.3=annotationProcessor,t
 com.google.errorprone:error_prone_annotation:2.48.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.20.0=soy
 com.google.errorprone:error_prone_annotations:2.36.0=checkstyle
-com.google.errorprone:error_prone_annotations:2.48.0=annotationProcessor,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.48.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
+com.google.errorprone:error_prone_annotations:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_check_api:2.48.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.48.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.escapevelocity:escapevelocity:1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-com.google.flatbuffers:flatbuffers-java:23.5.26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.flogger:flogger-system-backend:0.7.4=soy
-com.google.flogger:flogger-system-backend:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.flogger:flogger:0.7.4=soy
-com.google.flogger:flogger:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.flogger:google-extensions:0.7.4=soy
-com.google.flogger:google-extensions:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.flatbuffers:flatbuffers-java:24.3.25=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.flogger:flogger-system-backend:0.7.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
+com.google.flogger:flogger:0.7.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
+com.google.flogger:google-extensions:0.7.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.google.googlejavaformat:google-java-format:1.34.1=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.guava:failureaccess:1.0.1=soy
 com.google.guava:failureaccess:1.0.3=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.guava:guava-parent:32.1.1-jre=soy
 com.google.guava:guava-testlib:33.3.0-jre=testRuntimeClasspath
-com.google.guava:guava-testlib:33.5.0-jre=testCompileClasspath
+com.google.guava:guava-testlib:33.6.0-jre=testCompileClasspath
 com.google.guava:guava:32.1.1-jre=soy
 com.google.guava:guava:33.4.8-jre=checkstyle
-com.google.guava:guava:33.5.0-jre=annotationProcessor,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava:33.5.0-jre=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
+com.google.guava:guava:33.6.0-jre=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-appengine:1.46.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.http-client:google-http-client-apache-v2:2.1.0=testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-appengine:1.46.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.http-client:google-http-client-appengine:2.1.0=testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-gson:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-jackson2:1.46.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-protobuf:1.44.2=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.http-client:google-http-client-protobuf:1.45.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-jackson2:1.46.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.http-client:google-http-client-jackson2:2.1.0=testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-protobuf:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject:guice:7.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.google.j2objc:j2objc-annotations:3.0.0=checkstyle
@@ -214,11 +194,11 @@ com.google.oauth-client:google-oauth-client-servlet:1.36.0=deploy_jar,nonprodRun
 com.google.oauth-client:google-oauth-client-servlet:1.39.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.oauth-client:google-oauth-client:1.39.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java-util:4.33.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.protobuf:protobuf-java-util:4.34.1=testCompileClasspath,testRuntimeClasspath
+com.google.protobuf:protobuf-java-util:4.35.0-RC1=testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java:3.21.7=soy
 com.google.protobuf:protobuf-java:4.33.2=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.protobuf:protobuf-java:4.34.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.re2j:re2j:1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.protobuf:protobuf-java:4.35.0-RC1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.re2j:re2j:1.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.template:soy:2024-02-26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.google.truth:truth:1.4.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.googlecode.json-simple:json-simple:1.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -272,53 +252,56 @@ io.github.classgraph:classgraph:4.8.162=compileClasspath,deploy_jar,nonprodCompi
 io.github.eisop:dataflow-errorprone:3.41.0-eisop1=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 io.github.java-diff-utils:java-diff-utils:4.16=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-alts:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.70.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-api:1.71.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-auth:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-census:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-census:1.68.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.71.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-core:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-googleapis:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-grpclb:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-inprocess:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-netty-shaded:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-netty:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-netty:1.68.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-opentelemetry:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf-lite:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-rls:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-services:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-services:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-stub:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-util:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-util:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-xds:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-xds:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-buffer:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-buffer:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-codec-http2:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-codec-http2:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-codec-http:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-codec-http:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-codec-socks:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-codec:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-codec:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-common:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-common:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-handler-proxy:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-handler:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-handler:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-resolver:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-resolver:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.github.ss-bhatt:testcontainers-valkey:1.0.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-alts:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-alts:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-api:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-auth:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-auth:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-census:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-context:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-core:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-core:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-googleapis:1.76.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-googleapis:1.80.0=testRuntimeClasspath
+io.grpc:grpc-grpclb:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-grpclb:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-inprocess:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-inprocess:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-netty-shaded:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-netty-shaded:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-netty:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-opentelemetry:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-opentelemetry:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf-lite:1.76.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-protobuf-lite:1.80.0=testRuntimeClasspath
+io.grpc:grpc-protobuf:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-protobuf:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-rls:1.76.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-rls:1.80.0=testRuntimeClasspath
+io.grpc:grpc-services:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+io.grpc:grpc-services:1.80.0=testRuntimeClasspath
+io.grpc:grpc-stub:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-stub:1.80.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-util:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+io.grpc:grpc-util:1.80.0=testRuntimeClasspath
+io.grpc:grpc-xds:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+io.grpc:grpc-xds:1.80.0=testRuntimeClasspath
+io.netty:netty-buffer:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-http2:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-http:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-socks:4.1.124.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.netty:netty-codec:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-common:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-handler-proxy:4.1.124.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.netty:netty-handler:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-resolver:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-tcnative-boringssl-static:2.0.52.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-tcnative-classes:2.0.52.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-transport-native-unix-common:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-transport-native-unix-common:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-transport:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-transport:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.netty:netty-transport-native-unix-common:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-transport:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-api:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-contrib-exemplar-util:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-contrib-grpc-metrics:0.31.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
@@ -330,36 +313,39 @@ io.opencensus:opencensus-exporter-metrics-util:0.31.0=compileClasspath,deploy_ja
 io.opencensus:opencensus-exporter-stats-stackdriver:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-impl-core:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-impl:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opentelemetry.contrib:opentelemetry-gcp-resources:1.37.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opentelemetry.contrib:opentelemetry-gcp-resources:1.37.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry.contrib:opentelemetry-gcp-resources:1.45.0-alpha=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.instrumentation:opentelemetry-grpc-1.6:2.1.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.instrumentation:opentelemetry-instrumentation-api-incubator:2.1.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.instrumentation:opentelemetry-instrumentation-api:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.semconv:opentelemetry-semconv:1.29.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-api-incubator:1.42.1-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-api:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-api:1.59.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-api:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-api:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-bom:1.42.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-common:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-context:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-context:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-exporter-logging:1.59.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-common:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-context:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-context:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-exporter-logging:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-extension-incubator:1.35.0-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-common:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-common:1.59.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-common:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-common:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-logs:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-logs:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-metrics:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-metrics:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-trace:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-trace:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk:1.59.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-semconv:1.26.0-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-logs:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-logs:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-metrics:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-metrics:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-trace:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-trace:1.60.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.outfoxx:swiftpoet:1.3.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.perfmark:perfmark-api:0.27.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.protostuff:protostuff-api:1.8.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.protostuff:protostuff-collectionschema:1.8.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.protostuff:protostuff-core:1.8.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.protostuff:protostuff-runtime:1.8.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 jakarta-regexp:jakarta-regexp:1.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 jakarta.activation:jakarta.activation-api:2.1.4=jaxb
 jakarta.activation:jakarta.activation-api:2.2.0-M1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -375,13 +361,13 @@ javax.annotation:jsr250-api:1.0=compileClasspath,deploy_jar,nonprodCompileClassp
 javax.inject:javax.inject:1=annotationProcessor,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 javax.jdo:jdo2-api:2.3-20090302111651=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 javax.validation:validation-api:1.0.0.GA=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-joda-time:joda-time:2.12.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+joda-time:joda-time:2.14.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 junit:junit:4.13.2=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.arnx:nashorn-promise:0.1.1=testRuntimeClasspath
 net.bytebuddy:byte-buddy-agent:1.17.7=testCompileClasspath,testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.14.12=compileClasspath,nonprodCompileClasspath
+net.bytebuddy:byte-buddy:1.17.7=compileClasspath,nonprodCompileClasspath
 net.bytebuddy:byte-buddy:1.17.8=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-net.bytebuddy:byte-buddy:1.18.5=testCompileClasspath,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.18.8-jdk5=testCompileClasspath,testRuntimeClasspath
 net.java.dev.jna:jna:5.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.ltgt.gradle.incap:incap:0.2=annotationProcessor,testAnnotationProcessor
 net.sf.saxon:Saxon-HE:12.5=checkstyle
@@ -390,36 +376,38 @@ org.antlr:ST4:4.3.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodR
 org.antlr:antlr-runtime:3.5.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.antlr:antlr4-runtime:4.13.2=checkstyle,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.antlr:antlr4:4.13.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.arrow:arrow-format:15.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.arrow:arrow-memory-core:15.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.arrow:arrow-vector:15.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.avro:avro:1.12.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-fn-execution:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-job-management:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-pipeline:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.arrow:arrow-format:17.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.arrow:arrow-memory-core:17.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.arrow:arrow-vector:17.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.avro:avro:1.11.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-fn-execution:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-job-management:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-pipeline:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-runners-core-construction-java:2.54.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-core-java:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-direct-java:2.60.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-java-fn-execution:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-core:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-expansion-service:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-arrow:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-avro:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-core-java:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-direct-java:2.72.0=testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-java-fn-execution:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-core:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-expansion-service:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-arrow:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-avro:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-sdks-java-fn-execution:2.54.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-harness:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-transform-service-launcher:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-vendor-grpc-1_60_1:0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-harness:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-transform-service-launcher:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-vendor-grpc-1_60_1:0.1=testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-vendor-grpc-1_69_0:0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-vendor-guava-32_1_2-jre:0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-compress:1.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-compress:1.26.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-csv:1.14.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-exec:1.3=testRuntimeClasspath
 org.apache.commons:commons-lang3:3.18.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 org.apache.commons:commons-lang3:3.20.0=testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-lang3:3.8.1=checkstyle
+org.apache.commons:commons-pool2:2.12.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-text:1.15.0=testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-text:1.3=checkstyle
 org.apache.ftpserver:ftplet-api:1.2.1=testCompileClasspath,testRuntimeClasspath
@@ -436,17 +424,17 @@ org.apache.maven.doxia:doxia-logging-api:1.12.0=checkstyle
 org.apache.maven.doxia:doxia-module-xdoc:1.12.0=checkstyle
 org.apache.maven.doxia:doxia-sink-api:1.12.0=checkstyle
 org.apache.mina:mina-core:2.2.4=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-common:3.0.0-M2=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-core:3.0.0-M2=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-scp:3.0.0-M2=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-sftp:3.0.0-M2=testCompileClasspath,testRuntimeClasspath
-org.apache.tomcat:tomcat-annotations-api:11.0.20=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-common:3.0.0-M3=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-core:3.0.0-M3=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-scp:3.0.0-M3=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-sftp:3.0.0-M3=testCompileClasspath,testRuntimeClasspath
+org.apache.tomcat:tomcat-annotations-api:11.0.21=testCompileClasspath,testRuntimeClasspath
 org.apache.xbean:xbean-reflect:3.7=checkstyle
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
-org.bouncycastle:bcpg-jdk18on:1.83=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcpkix-jdk18on:1.83=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcprov-jdk18on:1.83=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcutil-jdk18on:1.83=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpg-jdk18on:1.84=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpkix-jdk18on:1.84=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcprov-jdk18on:1.84=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcutil-jdk18on:1.84=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.checkerframework:checker-compat-qual:2.5.3=annotationProcessor,compileClasspath,nonprodCompileClasspath,soy,testAnnotationProcessor,testCompileClasspath
 org.checkerframework:checker-compat-qual:2.5.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.19.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
@@ -454,29 +442,29 @@ org.checkerframework:checker-qual:3.33.0=soy
 org.checkerframework:checker-qual:3.49.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 org.checkerframework:checker-qual:3.49.3=checkstyle
 org.checkerframework:checker-qual:3.52.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.codehaus.mojo:animal-sniffer-annotations:1.24=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.codehaus.mojo:animal-sniffer-annotations:1.24=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+org.codehaus.mojo:animal-sniffer-annotations:1.26=testCompileClasspath,testRuntimeClasspath
 org.codehaus.plexus:plexus-classworlds:2.6.0=checkstyle
 org.codehaus.plexus:plexus-component-annotations:2.1.0=checkstyle
 org.codehaus.plexus:plexus-container-default:2.1.0=checkstyle
 org.codehaus.plexus:plexus-utils:3.3.0=checkstyle
+org.codehaus.woodstox:stax2-api:4.2.2=testCompileClasspath,testRuntimeClasspath
 org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.angus:angus-activation:2.0.3=jaxb
 org.eclipse.angus:angus-activation:2.1.0-M1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.eclipse.angus:jakarta.mail:2.1.0-M1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.eclipse.collections:eclipse-collections-api:11.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.eclipse.collections:eclipse-collections:11.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee10:jetty-ee10-servlet:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee10:jetty-ee10-webapp:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee:jetty-ee-webapp:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-http:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-io:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-security:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-server:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-session:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-util:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-xml:12.1.7=testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-core:12.3.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-database-postgresql:12.3.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.ee10:jetty-ee10-servlet:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.ee10:jetty-ee10-webapp:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.ee:jetty-ee-webapp:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-http:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-io:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-security:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-server:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-session:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-xml:12.1.8=testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-core:12.5.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-database-postgresql:12.5.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:codemodel:4.0.7=jaxb
 org.glassfish.jaxb:jaxb-core:4.0.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-core:4.0.7=jaxb
@@ -525,21 +513,21 @@ org.jetbrains:annotations:17.0.0=compileClasspath,deploy_jar,nonprodCompileClass
 org.jline:jline:3.30.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.joda:joda-money:2.0.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.json:json:20230618=soy
-org.json:json:20240303=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jsoup:jsoup:1.22.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.json:json:20251224=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jsoup:jsoup:1.22.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jspecify:jspecify:1.0.0=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 org.junit-pioneer:junit-pioneer:2.3.0=testCompileClasspath,testRuntimeClasspath
 org.junit.jupiter:junit-jupiter-api:5.13.4=testCompileClasspath,testRuntimeClasspath
 org.junit.jupiter:junit-jupiter-engine:5.13.4=testCompileClasspath,testRuntimeClasspath
 org.junit.jupiter:junit-jupiter-migrationsupport:5.13.4=testCompileClasspath,testRuntimeClasspath
 org.junit.jupiter:junit-jupiter-params:5.13.4=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.14.3=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-engine:1.14.3=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-launcher:1.14.3=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.14.4=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-engine:1.14.4=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-launcher:1.14.4=testCompileClasspath,testRuntimeClasspath
 org.junit.platform:junit-platform-runner:1.13.3=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-suite-api:1.14.3=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-suite-commons:1.14.3=testRuntimeClasspath
-org.junit:junit-bom:5.14.3=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-suite-api:1.14.4=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-suite-commons:1.14.4=testRuntimeClasspath
+org.junit:junit-bom:5.14.4=testCompileClasspath,testRuntimeClasspath
 org.mockito:mockito-core:5.23.0=testCompileClasspath,testRuntimeClasspath
 org.mockito:mockito-junit-jupiter:5.23.0=testCompileClasspath,testRuntimeClasspath
 org.objenesis:objenesis:3.3=testRuntimeClasspath
@@ -563,23 +551,23 @@ org.pcollections:pcollections:4.0.1=annotationProcessor,nonprodAnnotationProcess
 org.postgresql:postgresql:42.7.10=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.reflections:reflections:0.10.2=checkstyle
 org.rnorth.duct-tape:duct-tape:1.0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-api:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-chrome-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-chromium-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v143:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v144:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v145:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-edge-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-firefox-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-http:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-ie-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-java:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-json:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-manager:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-os:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-remote-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-safari-driver:4.41.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-support:4.41.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-api:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-chrome-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-chromium-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v145:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v146:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v147:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-edge-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-firefox-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-http:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-ie-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-java:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-json:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-manager:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-os:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-remote-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-safari-driver:4.43.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-support:4.43.0=testCompileClasspath,testRuntimeClasspath
 org.slf4j:jcl-over-slf4j:1.7.36=testCompileClasspath,testRuntimeClasspath
 org.slf4j:jul-to-slf4j:1.7.30=testRuntimeClasspath
 org.slf4j:slf4j-api:2.0.17=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -597,16 +585,18 @@ org.webjars.npm:viz.js-graphviz-java:2.1.3=testRuntimeClasspath
 org.xerial.snappy:snappy-java:1.1.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.xmlresolver:xmlresolver:5.2.2=checkstyle
 org.yaml:snakeyaml:2.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-tools.jackson.core:jackson-core:3.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-tools.jackson.core:jackson-databind:3.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-tools.jackson:jackson-bom:3.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+redis.clients.authentication:redis-authx-core:0.1.1-beta2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+redis.clients:jedis:7.4.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+tools.jackson.core:jackson-core:3.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+tools.jackson.core:jackson-databind:3.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+tools.jackson:jackson-bom:3.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-api:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-diagram:17.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-operations:17.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-postgresql:17.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-text:17.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-diagram:17.10.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-operations:17.10.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-postgresql:17.10.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-text:17.10.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-tools:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-utility:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler:17.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler:17.10.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 xerces:xmlParserAPIs:2.6.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 empty=devtool,shadow

core/src/main/java/google/registry/batch/AsyncTaskEnqueuer.java

@@ -26,8 +26,8 @@ import google.registry.model.EppResource;
 import google.registry.persistence.VKey;
 import google.registry.request.Action;
 import jakarta.inject.Inject;
-import org.joda.time.DateTime;
-import org.joda.time.Duration;
+import java.time.Duration;
+import java.time.Instant;
 
 /** Helper class to enqueue tasks for handling asynchronous operations in flows. */
 public final class AsyncTaskEnqueuer {
@@ -41,7 +41,7 @@ public final class AsyncTaskEnqueuer {
   public static final String QUEUE_ASYNC_ACTIONS = "async-actions";
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
-  private static final Duration MAX_ASYNC_ETA = Duration.standardDays(30);
+  private static final Duration MAX_ASYNC_ETA = Duration.ofDays(30);
 
   private final CloudTasksUtils cloudTasksUtils;
 
@@ -58,12 +58,12 @@ public final class AsyncTaskEnqueuer {
    */
   public void enqueueAsyncResave(
       VKey<? extends EppResource> entityKey,
-      DateTime now,
-      ImmutableSortedSet<DateTime> whenToResave) {
-    DateTime firstResave = whenToResave.first();
+      Instant now,
+      ImmutableSortedSet<Instant> whenToResave) {
+    Instant firstResave = whenToResave.first();
     checkArgument(isBeforeOrAt(now, firstResave), "Can't enqueue a resave to run in the past");
-    Duration etaDuration = new Duration(now, firstResave);
-    if (etaDuration.isLongerThan(MAX_ASYNC_ETA)) {
+    Duration etaDuration = Duration.between(now, firstResave);
+    if (etaDuration.compareTo(MAX_ASYNC_ETA) > 0) {
       logger.atInfo().log(
           "Ignoring async re-save of %s; %s is past the ETA threshold of %s.",
           entityKey, firstResave, MAX_ASYNC_ETA);

core/src/main/java/google/registry/batch/BatchModule.java

@@ -21,12 +21,12 @@ import static google.registry.request.RequestParameters.extractBooleanParameter;
 import static google.registry.request.RequestParameters.extractIntParameter;
 import static google.registry.request.RequestParameters.extractLongParameter;
 import static google.registry.request.RequestParameters.extractOptionalBooleanParameter;
-import static google.registry.request.RequestParameters.extractOptionalDatetimeParameter;
+import static google.registry.request.RequestParameters.extractOptionalInstantParameter;
 import static google.registry.request.RequestParameters.extractOptionalIntParameter;
 import static google.registry.request.RequestParameters.extractOptionalParameter;
-import static google.registry.request.RequestParameters.extractRequiredDatetimeParameter;
+import static google.registry.request.RequestParameters.extractRequiredInstantParameter;
 import static google.registry.request.RequestParameters.extractRequiredParameter;
-import static google.registry.request.RequestParameters.extractSetOfDatetimeParameters;
+import static google.registry.request.RequestParameters.extractSetOfInstantParameters;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
@@ -41,9 +41,9 @@ import google.registry.request.OptionalJsonPayload;
 import google.registry.request.Parameter;
 import jakarta.inject.Named;
 import jakarta.servlet.http.HttpServletRequest;
+import java.time.Instant;
 import java.util.List;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /** Dagger module for injecting common settings for batch actions. */
 @Module
@@ -97,14 +97,14 @@ public class BatchModule {
 
   @Provides
   @Parameter(PARAM_REQUESTED_TIME)
-  static DateTime provideRequestedTime(HttpServletRequest req) {
-    return extractRequiredDatetimeParameter(req, PARAM_REQUESTED_TIME);
+  static Instant provideRequestedTime(HttpServletRequest req) {
+    return extractRequiredInstantParameter(req, PARAM_REQUESTED_TIME);
   }
 
   @Provides
   @Parameter(PARAM_RESAVE_TIMES)
-  static ImmutableSet<DateTime> provideResaveTimes(HttpServletRequest req) {
-    return extractSetOfDatetimeParameters(req, PARAM_RESAVE_TIMES);
+  static ImmutableSet<Instant> provideResaveTimes(HttpServletRequest req) {
+    return extractSetOfInstantParameters(req, PARAM_RESAVE_TIMES);
   }
 
   @Provides
@@ -121,14 +121,14 @@ public class BatchModule {
 
   @Provides
   @Parameter(ExpandBillingRecurrencesAction.PARAM_START_TIME)
-  static Optional<DateTime> provideStartTime(HttpServletRequest req) {
-    return extractOptionalDatetimeParameter(req, ExpandBillingRecurrencesAction.PARAM_START_TIME);
+  static Optional<Instant> provideStartTime(HttpServletRequest req) {
+    return extractOptionalInstantParameter(req, ExpandBillingRecurrencesAction.PARAM_START_TIME);
   }
 
   @Provides
   @Parameter(ExpandBillingRecurrencesAction.PARAM_END_TIME)
-  static Optional<DateTime> provideEndTime(HttpServletRequest req) {
-    return extractOptionalDatetimeParameter(req, ExpandBillingRecurrencesAction.PARAM_END_TIME);
+  static Optional<Instant> provideEndTime(HttpServletRequest req) {
+    return extractOptionalInstantParameter(req, ExpandBillingRecurrencesAction.PARAM_END_TIME);
   }
 
   @Provides

core/src/main/java/google/registry/batch/BulkDomainTransferAction.java

@@ -42,10 +42,10 @@ import google.registry.request.auth.Auth;
 import google.registry.request.lock.LockHandler;
 import jakarta.inject.Inject;
 import jakarta.inject.Named;
+import java.time.Duration;
 import java.util.Optional;
 import java.util.concurrent.Callable;
 import java.util.logging.Level;
-import org.joda.time.Duration;
 
 /**
  * An action that transfers a set of domains from one registrar to another.
@@ -158,7 +158,7 @@ public class BulkDomainTransferAction implements Runnable {
           return null;
         };
 
-    if (!lockHandler.executeWithLocks(runner, null, Duration.standardHours(1), LOCK_NAME)) {
+    if (!lockHandler.executeWithLocks(runner, null, Duration.ofHours(1), LOCK_NAME)) {
       // Send a 200-series status code to prevent this conflicting action from retrying.
       response.setStatus(SC_NO_CONTENT);
       response.setPayload("Could not acquire lock; already running?");

core/src/main/java/google/registry/batch/CheckBulkComplianceAction.java

@@ -15,7 +15,8 @@ package google.registry.batch;
 
 import static google.registry.persistence.PersistenceModule.TransactionIsolationLevel.TRANSACTION_REPEATABLE_READ;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.util.DateTimeUtils.END_OF_TIME;
+import static google.registry.util.DateTimeUtils.END_INSTANT;
+import static google.registry.util.DateTimeUtils.minusYears;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
@@ -31,8 +32,8 @@ import google.registry.request.auth.Auth;
 import google.registry.ui.server.SendEmailUtils;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Duration;
 import java.util.Optional;
-import org.joda.time.Days;
 
 /**
  * An action that checks all {@link BulkPricingPackage} objects for compliance with their max create
@@ -110,7 +111,7 @@ public class CheckBulkComplianceAction implements Runnable {
                       + " 'DOMAIN_CREATE'",
                   Long.class)
               .setParameter("token", bulkPricingPackage.getToken())
-              .setParameter("lastBilling", bulkPricingPackage.getNextBillingDate().minusYears(1))
+              .setParameter("lastBilling", minusYears(bulkPricingPackage.getNextBillingDate(), 1))
               .getSingleResult();
       if (creates > bulkPricingPackage.getMaxCreates()) {
         long overage = creates - bulkPricingPackage.getMaxCreates();
@@ -127,7 +128,7 @@ public class CheckBulkComplianceAction implements Runnable {
                       + " AND deletionTime = :endOfTime",
                   Long.class)
               .setParameter("token", bulkPricingPackage.getToken())
-              .setParameter("endOfTime", END_OF_TIME)
+              .setParameter("endOfTime", END_INSTANT)
               .getSingleResult();
       if (activeDomains > bulkPricingPackage.getMaxDomains()) {
         int overage = Ints.saturatedCast(activeDomains) - bulkPricingPackage.getMaxDomains();
@@ -184,7 +185,7 @@ public class CheckBulkComplianceAction implements Runnable {
       int daysSinceLastNotification =
           bulkPricingPackage
               .getLastNotificationSent()
-              .map(sentDate -> Days.daysBetween(sentDate, clock.nowUtc()).getDays())
+              .map(sentDate -> (int) Duration.between(sentDate, clock.now()).toDays())
               .orElse(Integer.MAX_VALUE);
       // Send a warning email if 30-39 days since last notification and an upgrade email if 40+ days
       if (daysSinceLastNotification >= THIRTY_DAYS) {
@@ -220,7 +221,7 @@ public class CheckBulkComplianceAction implements Runnable {
               bulkPricingPackage.getMaxDomains(),
               activeDomains);
       sendNotification(bulkToken, emailSubject, body, registrar.get());
-      tm().put(bulkPricingPackage.asBuilder().setLastNotificationSent(clock.nowUtc()).build());
+      tm().put(bulkPricingPackage.asBuilder().setLastNotificationSent(clock.now()).build());
     } else {
       throw new IllegalStateException(
           String.format("Could not find registrar for bulk token %s", bulkToken));

core/src/main/java/google/registry/batch/CloudTasksUtils.java

@@ -52,11 +52,11 @@ import jakarta.inject.Inject;
 import java.io.Serial;
 import java.io.Serializable;
 import java.nio.charset.StandardCharsets;
+import java.time.Duration;
 import java.util.Arrays;
 import java.util.Optional;
 import java.util.Random;
 import java.util.function.Supplier;
-import org.joda.time.Duration;
 
 /** Utilities for dealing with Cloud Tasks. */
 public class CloudTasksUtils implements Serializable {
@@ -251,7 +251,7 @@ public class CloudTasksUtils implements Serializable {
         method,
         service,
         params,
-        Duration.millis(random.nextInt((int) SECONDS.toMillis(jitterSeconds.get()))));
+        Duration.ofMillis(random.nextInt((int) SECONDS.toMillis(jitterSeconds.get()))));
   }
 
   /**
@@ -302,12 +302,12 @@ public class CloudTasksUtils implements Serializable {
       Action.Service service,
       Multimap<String, String> params,
       Duration delay) {
-    if (delay.isEqual(Duration.ZERO)) {
+    if (delay.isZero()) {
       return createTask(path, method, service, params);
     }
-    checkArgument(delay.isLongerThan(Duration.ZERO), "Negative duration is not supported.");
+    checkArgument(!delay.isNegative(), "Negative duration is not supported.");
     return Task.newBuilder(createTask(path, method, service, params))
-        .setScheduleTime(Timestamps.fromMillis(clock.nowUtc().plus(delay).getMillis()))
+        .setScheduleTime(Timestamps.fromMillis(clock.now().plus(delay).toEpochMilli()))
         .build();
   }
 

core/src/main/java/google/registry/batch/DeleteExpiredDomainsAction.java

@@ -19,7 +19,6 @@ import static com.google.common.net.MediaType.PLAIN_TEXT_UTF_8;
 import static google.registry.flows.FlowUtils.marshalWithLenientRetry;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.END_INSTANT;
-import static google.registry.util.DateTimeUtils.END_OF_TIME;
 import static google.registry.util.ResourceUtils.readResourceUtf8;
 import static jakarta.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
 import static jakarta.servlet.http.HttpServletResponse.SC_NO_CONTENT;
@@ -43,11 +42,11 @@ import google.registry.request.auth.Auth;
 import google.registry.request.lock.LockHandler;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Duration;
+import java.time.Instant;
 import java.util.Optional;
 import java.util.concurrent.Callable;
 import java.util.logging.Level;
-import org.joda.time.DateTime;
-import org.joda.time.Duration;
 
 /**
  * An action that deletes all non-renewing domains whose expiration dates have now passed.
@@ -117,7 +116,7 @@ public class DeleteExpiredDomainsAction implements Runnable {
           return null;
         };
 
-    if (!lockHandler.executeWithLocks(runner, null, Duration.standardHours(1), LOCK_NAME)) {
+    if (!lockHandler.executeWithLocks(runner, null, Duration.ofHours(1), LOCK_NAME)) {
       // Send a 200-series status code to prevent this conflicting action from retrying.
       response.setStatus(SC_NO_CONTENT);
       response.setPayload("Could not acquire lock; already running?");
@@ -125,7 +124,7 @@ public class DeleteExpiredDomainsAction implements Runnable {
   }
 
   private void runLocked() {
-    DateTime runTime = clock.nowUtc();
+    Instant runTime = clock.now();
     logger.atInfo().log(
         "Deleting non-renewing domains with autorenew end times up through %s.", runTime);
 
@@ -134,7 +133,7 @@ public class DeleteExpiredDomainsAction implements Runnable {
                 () ->
                     tm().createQueryComposer(Domain.class)
                         .where("autorenewEndTime", Comparator.LTE, runTime)
-                        .where("deletionTime", Comparator.EQ, END_OF_TIME)
+                        .where("deletionTime", Comparator.EQ, END_INSTANT)
                         .list());
     if (domainsToDelete.isEmpty()) {
       logger.atInfo().log("Found 0 domains to delete.");
@@ -173,7 +172,7 @@ public class DeleteExpiredDomainsAction implements Runnable {
                 () -> {
                   Domain transDomain = tm().loadByKey(domain.createVKey());
                   if (domain.getAutorenewEndTime().isEmpty()
-                      || domain.getAutorenewEndTime().get().isAfter(tm().getTransactionTime())) {
+                      || domain.getAutorenewEndTime().get().isAfter(tm().getTxTime())) {
                     logger.atSevere().log(
                         "Failed to delete domain %s because of its autorenew end time: %s.",
                         transDomain.getDomainName(), transDomain.getAutorenewEndTime());

core/src/main/java/google/registry/batch/DeleteLoadTestDataAction.java

@@ -20,7 +20,7 @@ import static google.registry.persistence.PersistenceModule.TransactionIsolation
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.request.Action.Method.POST;
 import static google.registry.request.RequestParameters.PARAM_DRY_RUN;
-import static google.registry.util.DateTimeUtils.END_OF_TIME;
+import static google.registry.util.DateTimeUtils.END_INSTANT;
 import static google.registry.util.RegistryEnvironment.PRODUCTION;
 
 import com.google.common.collect.ImmutableList;
@@ -99,7 +99,7 @@ public class DeleteLoadTestDataAction implements Runnable {
 
   private void deletePollMessages(String registrarId) {
     ImmutableList<PollMessage> pollMessages =
-        PollFlowUtils.createPollMessageQuery(registrarId, END_OF_TIME).list();
+        PollFlowUtils.createPollMessageQuery(registrarId, END_INSTANT).list();
     if (isDryRun) {
       logger.atInfo().log(
           "Would delete %d poll messages for registrar %s.", pollMessages.size(), registrarId);
@@ -115,7 +115,7 @@ public class DeleteLoadTestDataAction implements Runnable {
     VKey<Host> hostVKey = host.createVKey();
     // We can remove hosts from linked domains, so we should do so then delete the hosts
     ImmutableSet<VKey<Domain>> linkedDomains =
-        EppResourceUtils.getLinkedDomainKeys(hostVKey, clock.nowUtc(), null);
+        EppResourceUtils.getLinkedDomainKeys(hostVKey, clock.now(), null);
     tm().loadByKeys(linkedDomains)
         .values()
         .forEach(

core/src/main/java/google/registry/batch/DeleteProberDataAction.java

@@ -27,6 +27,7 @@ import static google.registry.request.Action.Method.POST;
 import static google.registry.request.RequestParameters.PARAM_BATCH_SIZE;
 import static google.registry.request.RequestParameters.PARAM_DRY_RUN;
 import static google.registry.request.RequestParameters.PARAM_TLDS;
+import static google.registry.util.DateTimeUtils.toInstant;
 import static google.registry.util.RegistryEnvironment.PRODUCTION;
 
 import com.google.common.base.Strings;
@@ -187,9 +188,10 @@ public class DeleteProberDataAction implements Runnable {
         tm().query(DOMAIN_QUERY_STRING, Domain.class)
             .setParameter("tlds", deletableTlds)
             .setParameter(
-                "creationTimeCutoff", CreateAutoTimestamp.create(now.minus(DOMAIN_USED_DURATION)))
-            .setParameter("nowMinusSoftDeleteDelay", now.minus(SOFT_DELETE_DELAY))
-            .setParameter("now", now);
+                "creationTimeCutoff",
+                CreateAutoTimestamp.create(toInstant(now.minus(DOMAIN_USED_DURATION))))
+            .setParameter("nowMinusSoftDeleteDelay", toInstant(now.minus(SOFT_DELETE_DELAY)))
+            .setParameter("now", toInstant(now));
     ImmutableList<Domain> domainList =
         query.setMaxResults(batchSize).getResultStream().collect(toImmutableList());
       ImmutableList.Builder<String> domainRepoIdsToHardDelete = new ImmutableList.Builder<>();
@@ -216,7 +218,7 @@ public class DeleteProberDataAction implements Runnable {
     // successfully soft-delete the domain (thus leaving its DNS entry published). We soft-delete
     // it now so that the DNS entry can be handled. The domain will then be hard-deleted the next
     // time the job is run.
-    if (EppResourceUtils.isActive(domain, tm().getTransactionTime())) {
+    if (EppResourceUtils.isActive(domain, tm().getTxTime())) {
       if (isDryRun) {
         logger.atInfo().log(
             "Would soft-delete the active domain: %s (%s).",
@@ -303,12 +305,12 @@ public class DeleteProberDataAction implements Runnable {
   // Take a DNS queue + admin registrar id as input so that it can be called from the mapper as well
   private void softDeleteDomain(Domain domain) {
     Domain deletedDomain =
-        domain.asBuilder().setDeletionTime(tm().getTransactionTime()).setStatusValues(null).build();
+        domain.asBuilder().setDeletionTime(tm().getTxTime()).setStatusValues(null).build();
     DomainHistory historyEntry =
         new DomainHistory.Builder()
             .setDomain(domain)
             .setType(DOMAIN_DELETE)
-            .setModificationTime(tm().getTransactionTime())
+            .setModificationTime(tm().getTxTime())
             .setBySuperuser(true)
             .setReason("Deletion of prober data")
             .setRegistrarId(registryAdminRegistrarId)

core/src/main/java/google/registry/batch/ExpandBillingRecurrencesAction.java

@@ -19,7 +19,7 @@ import static google.registry.beam.BeamUtils.createJobName;
 import static google.registry.model.common.Cursor.CursorType.RECURRING_BILLING;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.request.RequestParameters.PARAM_DRY_RUN;
-import static google.registry.util.DateTimeUtils.START_OF_TIME;
+import static google.registry.util.DateTimeUtils.START_INSTANT;
 import static jakarta.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
 import static jakarta.servlet.http.HttpServletResponse.SC_OK;
 
@@ -42,8 +42,9 @@ import google.registry.util.Clock;
 import google.registry.util.RegistryEnvironment;
 import jakarta.inject.Inject;
 import java.io.IOException;
+import java.time.Instant;
+import java.util.Locale;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * An action that kicks off a {@link ExpandBillingRecurrencesPipeline} dataflow job to expand {@link
@@ -74,11 +75,11 @@ public class ExpandBillingRecurrencesAction implements Runnable {
 
   @Inject
   @Parameter(PARAM_START_TIME)
-  Optional<DateTime> startTimeParam;
+  Optional<Instant> startTimeParam;
 
   @Inject
   @Parameter(PARAM_END_TIME)
-  Optional<DateTime> endTimeParam;
+  Optional<Instant> endTimeParam;
 
   @Inject
   @Config("projectId")
@@ -102,33 +103,36 @@ public class ExpandBillingRecurrencesAction implements Runnable {
   @Override
   public void run() {
     checkArgument(!(isDryRun && advanceCursor), "Cannot advance the cursor in a dry run.");
-    DateTime endTime = endTimeParam.orElse(clock.nowUtc());
-    checkArgument(
-        !endTime.isAfter(clock.nowUtc()), "End time (%s) must be at or before now", endTime);
-    DateTime startTime =
+    Instant endTime = endTimeParam.orElse(clock.now());
+    checkArgument(!endTime.isAfter(clock.now()), "End time (%s) must be at or before now", endTime);
+    Instant startTime =
         startTimeParam.orElse(
             tm().transact(
                     () ->
                         tm().loadByKeyIfPresent(Cursor.createGlobalVKey(RECURRING_BILLING))
-                            .orElse(Cursor.createGlobal(RECURRING_BILLING, START_OF_TIME))
+                            .orElse(Cursor.createGlobal(RECURRING_BILLING, START_INSTANT))
                             .getCursorTime()));
     checkArgument(
         startTime.isBefore(endTime),
-        String.format("Start time (%s) must be before end time (%s)", startTime, endTime));
+        "Start time (%s) must be before end time (%s)",
+        startTime,
+        endTime);
     LaunchFlexTemplateParameter launchParameter =
         new LaunchFlexTemplateParameter()
             .setJobName(
                 createJobName(
                     String.format(
-                        "expand-billing-%s", startTime.toString("yyyy-MM-dd't'HH-mm-ss'z'")),
+                            "expand-billing-%s",
+                            startTime.toString().replace(':', '-').replace('.', '-'))
+                        .toLowerCase(Locale.ROOT),
                     clock))
             .setContainerSpecGcsPath(
                 String.format("%s/%s_metadata.json", stagingBucketUrl, PIPELINE_NAME))
             .setParameters(
                 new ImmutableMap.Builder<String, String>()
                     .put("registryEnvironment", RegistryEnvironment.get().name())
-                    .put("startTime", startTime.toString("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"))
-                    .put("endTime", endTime.toString("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"))
+                    .put("startTime", startTime.toString())
+                    .put("endTime", endTime.toString())
                     .put("isDryRun", Boolean.toString(isDryRun))
                     .put("advanceCursor", Boolean.toString(advanceCursor))
                     .build());

core/src/main/java/google/registry/batch/RelockDomainAction.java

@@ -18,6 +18,8 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.request.Action.Method.POST;
 import static google.registry.tools.LockOrUnlockDomainCommand.REGISTRY_LOCK_STATUSES;
+import static google.registry.util.DateTimeUtils.isAtOrAfter;
+import static google.registry.util.DateTimeUtils.toJodaDuration;
 import static jakarta.servlet.http.HttpServletResponse.SC_NO_CONTENT;
 import static jakarta.servlet.http.HttpServletResponse.SC_OK;
 
@@ -36,13 +38,12 @@ import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import google.registry.tools.DomainLockUtils;
-import google.registry.util.DateTimeUtils;
 import google.registry.util.EmailMessage;
 import jakarta.inject.Inject;
 import jakarta.mail.internet.AddressException;
 import jakarta.mail.internet.InternetAddress;
+import java.time.Duration;
 import java.util.Optional;
-import org.joda.time.Duration;
 
 /** Task that re-locks a previously-Registry-Locked domain after a predetermined period of time. */
 @Action(
@@ -59,8 +60,8 @@ public class RelockDomainAction implements Runnable {
 
   static final int ATTEMPTS_BEFORE_SLOWDOWN = 36; // every ten minutes for six hours then every hour
   static final int FAILURES_BEFORE_EMAIL = 2; // email after three failures, one half hour
-  private static final Duration TEN_MINUTES = Duration.standardMinutes(10);
-  private static final Duration ONE_HOUR = Duration.standardHours(1);
+  private static final Duration TEN_MINUTES = Duration.ofMinutes(10);
+  private static final Duration ONE_HOUR = Duration.ofHours(1);
 
   private static final String RELOCK_SUCCESS_EMAIL_TEMPLATE =
       """
@@ -134,7 +135,7 @@ public class RelockDomainAction implements Runnable {
                           String.format("Unknown revision ID %d", oldUnlockRevisionId)));
       domain =
           tm().loadByKey(VKey.create(Domain.class, oldLock.getRepoId()))
-              .cloneProjectedAtTime(tm().getTransactionTime());
+              .cloneProjectedAtTime(tm().getTxTime());
     } catch (Throwable t) {
       handleTransientFailure(Optional.ofNullable(oldLock), t);
       return;
@@ -188,7 +189,7 @@ public class RelockDomainAction implements Runnable {
         "Domain %s has a pending delete.",
         domainName);
     checkArgument(
-        !DateTimeUtils.isAtOrAfter(tm().getTxTime(), domain.getDeletionTime()),
+        !isAtOrAfter(tm().getTxTime(), domain.getDeletionTime()),
         "Domain %s has been deleted.",
         domainName);
     checkArgument(
@@ -237,7 +238,8 @@ public class RelockDomainAction implements Runnable {
       }
     }
     Duration timeBeforeRetry = previousAttempts < ATTEMPTS_BEFORE_SLOWDOWN ? TEN_MINUTES : ONE_HOUR;
-    domainLockUtils.enqueueDomainRelock(timeBeforeRetry, oldUnlockRevisionId, previousAttempts + 1);
+    domainLockUtils.enqueueDomainRelock(
+        toJodaDuration(timeBeforeRetry), oldUnlockRevisionId, previousAttempts + 1);
   }
 
   private void sendSuccessEmail(RegistryLock oldLock) {

core/src/main/java/google/registry/batch/ResaveEntityAction.java

@@ -30,8 +30,8 @@ import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * An action that re-saves a given entity, typically after a certain amount of time has passed.
@@ -50,16 +50,16 @@ public class ResaveEntityAction implements Runnable {
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
   private final String resourceKey;
-  private final DateTime requestedTime;
-  private final ImmutableSortedSet<DateTime> resaveTimes;
+  private final Instant requestedTime;
+  private final ImmutableSortedSet<Instant> resaveTimes;
   private final AsyncTaskEnqueuer asyncTaskEnqueuer;
   private final Response response;
 
   @Inject
   ResaveEntityAction(
       @Parameter(PARAM_RESOURCE_KEY) String resourceKey,
-      @Parameter(PARAM_REQUESTED_TIME) DateTime requestedTime,
-      @Parameter(PARAM_RESAVE_TIMES) ImmutableSet<DateTime> resaveTimes,
+      @Parameter(PARAM_REQUESTED_TIME) Instant requestedTime,
+      @Parameter(PARAM_RESAVE_TIMES) ImmutableSet<Instant> resaveTimes,
       AsyncTaskEnqueuer asyncTaskEnqueuer,
       Response response) {
     this.resourceKey = resourceKey;
@@ -83,7 +83,7 @@ public class ResaveEntityAction implements Runnable {
                     resourceKey);
                 return;
               }
-              tm().put(entity.get().cloneProjectedAtTime(tm().getTransactionTime()));
+              tm().put(entity.get().cloneProjectedAtTime(tm().getTxTime()));
               if (!resaveTimes.isEmpty()) {
                 asyncTaskEnqueuer.enqueueAsyncResave(
                     VKey.createEppVKeyFromString(resourceKey), requestedTime, resaveTimes);

core/src/main/java/google/registry/batch/SendExpiringCertificateNotificationEmailAction.java

@@ -16,7 +16,9 @@ package google.registry.batch;
 
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.util.DateTimeUtils.toDateTime;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+import static java.time.ZoneOffset.UTC;
 import static org.apache.http.HttpStatus.SC_INTERNAL_SERVER_ERROR;
 import static org.apache.http.HttpStatus.SC_OK;
 
@@ -41,11 +43,10 @@ import google.registry.util.EmailMessage;
 import jakarta.inject.Inject;
 import jakarta.mail.internet.AddressException;
 import jakarta.mail.internet.InternetAddress;
+import java.time.Duration;
+import java.time.Instant;
+import java.time.format.DateTimeFormatter;
 import java.util.Optional;
-import org.joda.time.DateTime;
-import org.joda.time.Duration;
-import org.joda.time.format.DateTimeFormat;
-import org.joda.time.format.DateTimeFormatter;
 
 /** An action that sends notification emails to registrars whose certificates are expiring soon. */
 @Action(
@@ -55,6 +56,7 @@ import org.joda.time.format.DateTimeFormatter;
 public class SendExpiringCertificateNotificationEmailAction implements Runnable {
 
   public static final String PATH = "/_dr/task/sendExpiringCertificateNotificationEmail";
+
   /**
    * Used as an offset when storing the last notification email sent date.
    *
@@ -63,10 +65,11 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
    * next day at 2am, the date difference will be less than a day, which will lead to the date
    * difference between two successive email sent date being the expected email interval days + 1;
    */
-  protected static final Duration UPDATE_TIME_OFFSET = Duration.standardMinutes(10);
+  protected static final Duration UPDATE_TIME_OFFSET = Duration.ofMinutes(10);
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
-  private static final DateTimeFormatter DATE_FORMATTER = DateTimeFormat.forPattern("yyyy-MM-dd");
+  private static final DateTimeFormatter DATE_FORMATTER =
+      DateTimeFormatter.ofPattern("yyyy-MM-dd").withZone(UTC);
 
   private final CertificateChecker certificateChecker;
   private final String expirationWarningEmailBodyText;
@@ -128,11 +131,11 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
                     registrar,
                     registrar.getClientCertificate().isPresent()
                         && certificateChecker.shouldReceiveExpiringNotification(
-                            registrar.getLastExpiringCertNotificationSentDate(),
+                            toDateTime(registrar.getLastExpiringCertNotificationSentDate()),
                             registrar.getClientCertificate().get()),
                     registrar.getFailoverClientCertificate().isPresent()
                         && certificateChecker.shouldReceiveExpiringNotification(
-                            registrar.getLastExpiringFailoverCertNotificationSentDate(),
+                            toDateTime(registrar.getLastExpiringFailoverCertNotificationSentDate()),
                             registrar.getFailoverClientCertificate().get())))
         .filter(
             registrarInfo ->
@@ -147,19 +150,19 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
   @VisibleForTesting
   boolean sendNotificationEmail(
       Registrar registrar,
-      DateTime lastExpiringCertNotificationSentDate,
+      Instant lastExpiringCertNotificationSentDate,
       CertificateType certificateType,
       Optional<String> certificate) {
     if (certificate.isEmpty()
         || !certificateChecker.shouldReceiveExpiringNotification(
-            lastExpiringCertNotificationSentDate, certificate.get())) {
+            toDateTime(lastExpiringCertNotificationSentDate), certificate.get())) {
       return false;
     }
     try {
       ImmutableSet<InternetAddress> recipients = getEmailAddresses(registrar, Type.TECH);
       ImmutableSet<InternetAddress> ccs = getEmailAddresses(registrar, Type.ADMIN);
-      DateTime expirationDate =
-          new DateTime(certificateChecker.getCertificate(certificate.get()).getNotAfter());
+      Instant expirationDate =
+          certificateChecker.getCertificate(certificate.get()).getNotAfter().toInstant();
       logger.atInfo().log(
           " %s SSL certificate of registrar '%s' will expire on %s.",
           certificateType.getDisplayName(), registrar.getRegistrarName(), expirationDate);
@@ -188,9 +191,7 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
        * for applicable certificate.
        */
       updateLastNotificationSentDate(
-          registrar,
-          clock.nowUtc().minusMinutes((int) UPDATE_TIME_OFFSET.getStandardMinutes()),
-          certificateType);
+          registrar, clock.now().minus(UPDATE_TIME_OFFSET), certificateType);
       return true;
     } catch (Exception e) {
       throw new RuntimeException(
@@ -203,7 +204,7 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
   /** Updates the last notification sent date in database. */
   @VisibleForTesting
   void updateLastNotificationSentDate(
-      Registrar registrar, DateTime now, CertificateType certificateType) {
+      Registrar registrar, Instant now, CertificateType certificateType) {
     try {
       tm().transact(
               () -> {
@@ -215,7 +216,7 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
                     logger.atInfo().log(
                         "Updated last notification email sent date to %s for %s certificate of "
                             + "registrar %s.",
-                        DATE_FORMATTER.print(now),
+                        DATE_FORMATTER.format(now),
                         certificateType.getDisplayName(),
                         registrar.getRegistrarName());
                   }
@@ -225,7 +226,7 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
                     logger.atInfo().log(
                         "Updated last notification email sent date to %s for %s certificate of "
                             + "registrar %s.",
-                        DATE_FORMATTER.print(now),
+                        DATE_FORMATTER.format(now),
                         certificateType.getDisplayName(),
                         registrar.getRegistrarName());
                   }
@@ -298,7 +299,7 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
   @VisibleForTesting
   @SuppressWarnings("lgtm[java/dereferenced-value-may-be-null]")
   String getEmailBody(
-      String registrarName, CertificateType type, DateTime expirationDate, String registrarId) {
+      String registrarName, CertificateType type, Instant expirationDate, String registrarId) {
     checkArgumentNotNull(expirationDate, "Expiration date cannot be null");
     checkArgumentNotNull(type, "Certificate type cannot be null");
     checkArgumentNotNull(registrarId, "Registrar Id cannot be null");
@@ -306,7 +307,7 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
         expirationWarningEmailBodyText,
         registrarName,
         type.getDisplayName(),
-        DATE_FORMATTER.print(expirationDate),
+        DATE_FORMATTER.format(expirationDate),
         registrarId);
   }
 

core/src/main/java/google/registry/batch/SyncRemoteCacheAction.java

@@ -0,0 +1,192 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.batch;
+
+import static google.registry.model.common.Cursor.CursorType.REMOTE_CACHE_DOMAIN_SYNC;
+import static google.registry.model.common.Cursor.CursorType.REMOTE_CACHE_HOST_SYNC;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.request.Action.Method.POST;
+import static google.registry.util.DateTimeUtils.START_INSTANT;
+import static jakarta.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
+import static jakarta.servlet.http.HttpServletResponse.SC_NO_CONTENT;
+import static jakarta.servlet.http.HttpServletResponse.SC_OK;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Iterables;
+import com.google.common.flogger.FluentLogger;
+import com.google.common.net.MediaType;
+import google.registry.cache.SimplifiedJedisClient;
+import google.registry.model.EppResource;
+import google.registry.model.common.Cursor;
+import google.registry.model.domain.Domain;
+import google.registry.model.host.Host;
+import google.registry.model.tld.Tld;
+import google.registry.model.tld.Tlds;
+import google.registry.request.Action;
+import google.registry.request.Response;
+import google.registry.request.auth.Auth;
+import google.registry.request.lock.LockHandler;
+import jakarta.inject.Inject;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.List;
+import java.util.Optional;
+import java.util.concurrent.Callable;
+import java.util.function.Function;
+
+@Action(
+    service = Action.Service.BACKEND,
+    path = SyncRemoteCacheAction.PATH,
+    method = POST,
+    auth = Auth.AUTH_ADMIN)
+public class SyncRemoteCacheAction implements Runnable {
+
+  public static final String PATH = "/_dr/task/syncRemoteCache";
+
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  private static final String LOCK_NAME = "syncRemoteCacheAction";
+  private static final int BATCH_SIZE = 10000;
+
+  private final LockHandler lockHandler;
+  private final Response response;
+  private final Optional<SimplifiedJedisClient> jedisClient;
+
+  @Inject
+  public SyncRemoteCacheAction(
+      LockHandler lockHandler, Response response, Optional<SimplifiedJedisClient> jedisClient) {
+    this.lockHandler = lockHandler;
+    this.response = response;
+    this.jedisClient = jedisClient;
+  }
+
+  @Override
+  public void run() {
+    response.setContentType(MediaType.PLAIN_TEXT_UTF_8);
+    if (jedisClient.isEmpty()) {
+      response.setStatus(SC_NO_CONTENT);
+      response.setPayload("No Jedis/Valkey configuration found");
+      return;
+    }
+    Callable<Void> runner =
+        () -> {
+          try {
+            runLocked();
+            response.setStatus(SC_OK);
+          } catch (Exception e) {
+            logger.atSevere().withCause(e).log("Errored out during execution.");
+            response.setStatus(SC_INTERNAL_SERVER_ERROR);
+            response.setPayload(String.format("Errored out with cause: %s", e));
+          }
+          return null;
+        };
+
+    if (!lockHandler.executeWithLocks(runner, null, Duration.ofHours(1), LOCK_NAME)) {
+      // Send a 200-series status code to prevent this conflicting action from retrying.
+      response.setStatus(SC_NO_CONTENT);
+      response.setPayload("Could not acquire lock; already running?");
+    }
+  }
+
+  private void runLocked() {
+    // Note: the transaction ordering means that cursors in our database are updated only if all the
+    // operations for the entity type succeeded. There is no downside to processing the same objects
+    // multiple times if, for some reason, saving the cursor to the DB fails.
+    int syncedDomains = tm().transact(this::syncDomains);
+    int syncedHosts = tm().transact(this::syncHosts);
+    String message = String.format("Synced %d domains and %d hosts.", syncedDomains, syncedHosts);
+    logger.atInfo().log(message);
+    response.setPayload(message);
+  }
+
+  private int syncDomains() {
+    Instant domainCursorTime = getPreviousCursorTime(REMOTE_CACHE_DOMAIN_SYNC);
+    ImmutableSet<String> realTlds = Tlds.getTldsOfType(Tld.TldType.REAL);
+    List<Domain> domains =
+        tm().query(
+                "FROM Domain WHERE updateTimestamp.lastUpdateTime > :cursorTime AND tld IN"
+                    + " :realTlds ORDER BY updateTimestamp ASC",
+                Domain.class)
+            .setParameter("cursorTime", domainCursorTime)
+            .setParameter("realTlds", realTlds)
+            .setMaxResults(BATCH_SIZE)
+            .getResultList();
+    if (domains.isEmpty()) {
+      logger.atInfo().log("No domains to process");
+      return 0;
+    }
+    logger.atInfo().log("Processing %d domains", domains.size());
+    processResources(Domain.class, domains, Domain::getDomainName);
+    setNewCursorTime(domains, REMOTE_CACHE_DOMAIN_SYNC);
+    return domains.size();
+  }
+
+  private int syncHosts() {
+    Instant hostCursorTime = getPreviousCursorTime(REMOTE_CACHE_HOST_SYNC);
+    List<Host> hosts =
+        tm().query(
+                "FROM Host WHERE updateTimestamp.lastUpdateTime > :cursorTime ORDER BY"
+                    + " updateTimestamp ASC",
+                Host.class)
+            .setParameter("cursorTime", hostCursorTime)
+            .setMaxResults(BATCH_SIZE)
+            .getResultList();
+    if (hosts.isEmpty()) {
+      logger.atInfo().log("No hosts to process");
+      return 0;
+    }
+    logger.atInfo().log("Processing %d hosts", hosts.size());
+    processResources(Host.class, hosts, Host::getRepoId);
+    setNewCursorTime(hosts, REMOTE_CACHE_HOST_SYNC);
+    return hosts.size();
+  }
+
+  private <T extends EppResource> void processResources(
+      Class<T> clazz, List<T> resources, Function<T, String> getKeyFunction) {
+    ImmutableList.Builder<String> toDeleteBuilder = new ImmutableList.Builder<>();
+    ImmutableList.Builder<SimplifiedJedisClient.JedisResource<T>> toSaveBuilder =
+        new ImmutableList.Builder<>();
+
+    for (T resource : resources) {
+      String key = getKeyFunction.apply(resource);
+      if (resource.getDeletionTime().isAfter(tm().getTxTime())) {
+        toSaveBuilder.add(new SimplifiedJedisClient.JedisResource<>(key, resource));
+      } else {
+        toDeleteBuilder.add(key);
+      }
+    }
+    ImmutableList<String> toDelete = toDeleteBuilder.build();
+    ImmutableList<SimplifiedJedisClient.JedisResource<T>> toSave = toSaveBuilder.build();
+
+    jedisClient.get().deleteAll(clazz, toDelete);
+    logger.atInfo().log("Invalidated %d from the remote cache", toDelete.size());
+    jedisClient.get().setAll(toSave);
+    logger.atInfo().log("Set %d in the remote cache", toSave.size());
+  }
+
+  private Instant getPreviousCursorTime(Cursor.CursorType cursorType) {
+    return tm().loadByKeyIfPresent(Cursor.createGlobalVKey(cursorType))
+        .map(Cursor::getCursorTime)
+        .orElse(START_INSTANT);
+  }
+
+  private void setNewCursorTime(
+      List<? extends EppResource> resources, Cursor.CursorType cursorType) {
+    Instant lastUpdateTime = Iterables.getLast(resources).getUpdateTimestamp().getTimestamp();
+    tm().put(Cursor.createGlobal(cursorType, lastUpdateTime));
+    logger.atInfo().log("Set new %s cursor time to %s", cursorType, lastUpdateTime);
+  }
+}

core/src/main/java/google/registry/beam/BeamUtils.java

@@ -15,6 +15,7 @@
 package google.registry.beam;
 
 import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.util.DateTimeUtils.LOWERCASE_TIMESTAMP_FORMATTER;
 
 import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableList;
@@ -61,7 +62,7 @@ public class BeamUtils {
     // with a letter and ending with a letter or number. So we replace the "T" and "Z" in ISO 8601
     // with lowercase letters.
     String jobName =
-        String.format("%s-%s", prefix, clock.nowUtc().toString("yyyy-MM-dd't'HH-mm-ss'z'"));
+        String.format("%s-%s", prefix, LOWERCASE_TIMESTAMP_FORMATTER.format(clock.now()));
     checkArgument(
         Pattern.compile("^[a-z][-a-z0-9]*[a-z0-9]*").matcher(jobName).matches(),
         "The job name %s is illegal, it consists of only characters [-a-z0-9], "

core/src/main/java/google/registry/beam/billing/BillingEvent.java

@@ -14,12 +14,17 @@
 
 package google.registry.beam.billing;
 
+import static java.time.ZoneOffset.UTC;
+
 import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableList;
 import google.registry.reporting.billing.BillingModule;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
+import java.time.Instant;
+import java.time.ZonedDateTime;
+import java.time.format.DateTimeFormatter;
 import java.util.regex.Pattern;
 import org.apache.beam.sdk.coders.AtomicCoder;
 import org.apache.beam.sdk.coders.Coder;
@@ -29,9 +34,6 @@ import org.apache.beam.sdk.coders.StringUtf8Coder;
 import org.apache.beam.sdk.coders.VarIntCoder;
 import org.apache.beam.sdk.coders.VarLongCoder;
 import org.jetbrains.annotations.NotNull;
-import org.joda.time.DateTime;
-import org.joda.time.format.DateTimeFormat;
-import org.joda.time.format.DateTimeFormatter;
 
 /**
  * A record representing a single billable event, parsed from a {@code SchemaAndRecord}.
@@ -53,8 +55,8 @@ import org.joda.time.format.DateTimeFormatter;
  */
 public record BillingEvent(
     long id,
-    DateTime billingTime,
-    DateTime eventTime,
+    Instant billingTime,
+    Instant eventTime,
     String registrarId,
     String billingId,
     String poNumber,
@@ -68,7 +70,7 @@ public record BillingEvent(
     String flags) {
 
   private static final DateTimeFormatter DATE_TIME_FORMATTER =
-      DateTimeFormat.forPattern("yyyy-MM-dd HH:mm:ss zzz");
+      DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss 'UTC'").withZone(UTC);
 
   private static final Pattern SYNTHETIC_REGEX = Pattern.compile("SYNTHETIC", Pattern.LITERAL);
 
@@ -92,8 +94,8 @@ public record BillingEvent(
   /** Creates a concrete {@link BillingEvent}. */
   static BillingEvent create(
       long id,
-      DateTime billingTime,
-      DateTime eventTime,
+      Instant billingTime,
+      Instant eventTime,
       String registrarId,
       String billingId,
       String poNumber,
@@ -143,8 +145,8 @@ public record BillingEvent(
         .join(
             ImmutableList.of(
                 id(),
-                DATE_TIME_FORMATTER.print(billingTime()),
-                DATE_TIME_FORMATTER.print(eventTime()),
+                DATE_TIME_FORMATTER.format(billingTime()),
+                DATE_TIME_FORMATTER.format(eventTime()),
                 registrarId(),
                 billingId(),
                 poNumber(),
@@ -162,10 +164,10 @@ public record BillingEvent(
   /** Returns the grouping key for this {@code BillingEvent}, to generate the overall invoice. */
   InvoiceGroupingKey getInvoiceGroupingKey() {
     return new InvoiceGroupingKey(
-        billingTime().toLocalDate().withDayOfMonth(1).toString(),
+        ZonedDateTime.ofInstant(billingTime(), UTC).toLocalDate().withDayOfMonth(1).toString(),
         years() == 0
             ? ""
-            : billingTime()
+            : ZonedDateTime.ofInstant(billingTime(), UTC)
                 .toLocalDate()
                 .withDayOfMonth(1)
                 .plusYears(years())
@@ -308,8 +310,8 @@ public record BillingEvent(
     @Override
     public void encode(BillingEvent value, OutputStream outStream) throws IOException {
       longCoder.encode(value.id(), outStream);
-      stringCoder.encode(DATE_TIME_FORMATTER.print(value.billingTime()), outStream);
-      stringCoder.encode(DATE_TIME_FORMATTER.print(value.eventTime()), outStream);
+      stringCoder.encode(DATE_TIME_FORMATTER.format(value.billingTime()), outStream);
+      stringCoder.encode(DATE_TIME_FORMATTER.format(value.eventTime()), outStream);
       stringCoder.encode(value.registrarId(), outStream);
       stringCoder.encode(value.billingId(), outStream);
       stringCoder.encode(value.poNumber(), outStream);
@@ -327,8 +329,8 @@ public record BillingEvent(
     public BillingEvent decode(InputStream inStream) throws IOException {
       return new BillingEvent(
           longCoder.decode(inStream),
-          DATE_TIME_FORMATTER.parseDateTime(stringCoder.decode(inStream)),
-          DATE_TIME_FORMATTER.parseDateTime(stringCoder.decode(inStream)),
+          Instant.from(DATE_TIME_FORMATTER.parse(stringCoder.decode(inStream))),
+          Instant.from(DATE_TIME_FORMATTER.parse(stringCoder.decode(inStream))),
           stringCoder.decode(inStream),
           stringCoder.decode(inStream),
           stringCoder.decode(inStream),

core/src/main/java/google/registry/beam/billing/ExpandBillingRecurrencesPipeline.java

@@ -21,10 +21,11 @@ import static google.registry.model.domain.Period.Unit.YEARS;
 import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_AUTORENEW;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.CollectionUtils.union;
-import static google.registry.util.DateTimeUtils.START_OF_TIME;
+import static google.registry.util.DateTimeUtils.START_INSTANT;
 import static google.registry.util.DateTimeUtils.earliestOf;
 import static google.registry.util.DateTimeUtils.latestOf;
-import static google.registry.util.DateTimeUtils.toInstant;
+import static google.registry.util.DateTimeUtils.minusYears;
+import static google.registry.util.DateTimeUtils.plusYears;
 import static org.apache.beam.sdk.values.TypeDescriptors.voids;
 
 import com.google.common.collect.ImmutableMap;
@@ -54,6 +55,7 @@ import google.registry.util.Clock;
 import google.registry.util.SystemClock;
 import jakarta.inject.Singleton;
 import java.io.Serializable;
+import java.time.Instant;
 import java.util.Optional;
 import java.util.Set;
 import org.apache.beam.sdk.Pipeline;
@@ -73,7 +75,6 @@ import org.apache.beam.sdk.transforms.Wait;
 import org.apache.beam.sdk.values.KV;
 import org.apache.beam.sdk.values.PCollection;
 import org.apache.beam.sdk.values.PDone;
-import org.joda.time.DateTime;
 
 /**
  * Definition of a Dataflow Flex pipeline template, which expands {@link BillingRecurrence} to
@@ -134,9 +135,9 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
   }
 
   // Inclusive lower bound of the expansion window.
-  private final DateTime startTime;
+  private final Instant startTime;
   // Exclusive lower bound of the expansion window.
-  private final DateTime endTime;
+  private final Instant endTime;
   private final boolean isDryRun;
   private final boolean advanceCursor;
   private final Counter recurrencesInScopeCounter =
@@ -151,14 +152,14 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
       Metrics.counter("ExpandBilling", "OneTimes that would be expanded");
 
   ExpandBillingRecurrencesPipeline(ExpandBillingRecurrencesPipelineOptions options, Clock clock) {
-    startTime = DateTime.parse(options.getStartTime());
-    endTime = DateTime.parse(options.getEndTime());
-    checkArgument(
-        !endTime.isAfter(clock.nowUtc()),
-        String.format("End time %s must be at or before now.", endTime));
+    startTime = Instant.parse(options.getStartTime());
+    endTime = Instant.parse(options.getEndTime());
+    checkArgument(!endTime.isAfter(clock.now()), "End time %s must be at or before now.", endTime);
     checkArgument(
         startTime.isBefore(endTime),
-        String.format("[%s, %s) is not a valid window of operation.", startTime, endTime));
+        "[%s, %s) is not a valid window of operation.",
+        startTime,
+        endTime);
     isDryRun = options.getIsDryRun();
     advanceCursor = options.getAdvanceCursor();
   }
@@ -199,7 +200,7 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
                     "startTime",
                     startTime,
                     "oneYearAgo",
-                    endTime.minusYears(1)),
+                    minusYears(endTime, 1)),
                 true,
                 (Long id) -> {
                   recurrencesInScopeCounter.inc();
@@ -268,7 +269,7 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
     // The best way to handle any unexpected behavior is to simply drop the recurrence from
     // expansion, if its new state still calls for an expansion, it would be picked up the next time
     // the pipeline runs.
-    ImmutableSet<DateTime> eventTimes;
+    ImmutableSet<Instant> eventTimes;
     try {
       eventTimes =
           ImmutableSet.copyOf(
@@ -277,7 +278,7 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
                   .getInstancesInRange(
                       Range.closedOpen(
                           latestOf(
-                              billingRecurrence.getRecurrenceLastExpansion().plusYears(1),
+                              plusYears(billingRecurrence.getRecurrenceLastExpansion(), 1),
                               startTime),
                           earliestOf(billingRecurrence.getRecurrenceEndTime(), endTime))));
     } catch (IllegalArgumentException e) {
@@ -289,28 +290,28 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
     // Find the times for which the OneTime billing event are already created, making this expansion
     // idempotent. There is no need to match to the domain repo ID as the cancellation matching
     // billing event itself can only be for a single domain.
-    ImmutableSet<DateTime> existingEventTimes =
+    ImmutableSet<Instant> existingEventTimes =
         ImmutableSet.copyOf(
             tm().query(
                     "SELECT eventTime FROM BillingEvent WHERE cancellationMatchingBillingEvent ="
                         + " :key",
-                    DateTime.class)
+                    Instant.class)
                 .setParameter("key", billingRecurrence.createVKey())
                 .getResultList());
 
-    Set<DateTime> eventTimesToExpand = difference(eventTimes, existingEventTimes);
+    Set<Instant> eventTimesToExpand = difference(eventTimes, existingEventTimes);
 
     if (eventTimesToExpand.isEmpty()) {
       return;
     }
 
-    DateTime recurrenceLastExpansionTime = billingRecurrence.getRecurrenceLastExpansion();
+    Instant recurrenceLastExpansionTime = billingRecurrence.getRecurrenceLastExpansion();
 
     // Create new OneTime and DomainHistory for EventTimes that needs to be expanded.
-    for (DateTime eventTime : eventTimesToExpand) {
+    for (Instant eventTime : eventTimesToExpand) {
       recurrenceLastExpansionTime = latestOf(recurrenceLastExpansionTime, eventTime);
       oneTimesToExpandCounter.inc();
-      DateTime billingTime = eventTime.plus(tld.getAutoRenewGracePeriodLength());
+      Instant billingTime = eventTime.plusMillis(tld.getAutoRenewGracePeriodLength().getMillis());
       // Note that the DomainHistory is created as of transaction time, as opposed to event time.
       // This might be counterintuitive because other DomainHistories are created at the time
       // mutation events occur, such as in DomainDeleteFlow or DomainRenewFlow. Therefore, it is
@@ -337,7 +338,7 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
           new DomainHistory.Builder()
               .setBySuperuser(false)
               .setRegistrarId(billingRecurrence.getRegistrarId())
-              .setModificationTime(tm().getTransactionTime())
+              .setModificationTime(tm().getTxTime())
               .setDomain(domain)
               .setPeriod(Period.create(1, YEARS))
               .setReason("Domain autorenewal by ExpandRecurringBillingEventsPipeline")
@@ -373,7 +374,7 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
                   // during ARGP).
                   //
                   // See: DomainFlowUtils#createCancellingRecords
-                  domain.getDeletionTime().isBefore(toInstant(billingTime))
+                  domain.getDeletionTime().isBefore(billingTime)
                       ? ImmutableSet.of()
                       : ImmutableSet.of(
                           DomainTransactionRecord.create(
@@ -439,11 +440,11 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
                       public void processElement() {
                         tm().transact(
                                 () -> {
-                                  DateTime currentCursorTime =
+                                  Instant currentCursorTime =
                                       tm().loadByKeyIfPresent(
                                               Cursor.createGlobalVKey(RECURRING_BILLING))
                                           .orElse(
-                                              Cursor.createGlobal(RECURRING_BILLING, START_OF_TIME))
+                                              Cursor.createGlobal(RECURRING_BILLING, START_INSTANT))
                                           .getCursorTime();
                                   if (!currentCursorTime.equals(startTime)) {
                                     throw new IllegalStateException(

core/src/main/java/google/registry/beam/common/SmokeTestPipeline.java

@@ -0,0 +1,76 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.common;
+
+import static com.google.common.base.Verify.verify;
+
+import com.google.common.flogger.FluentLogger;
+import google.registry.model.tld.Tld;
+import google.registry.persistence.transaction.CriteriaQueryBuilder;
+import java.io.Serializable;
+import org.apache.beam.sdk.Pipeline;
+import org.apache.beam.sdk.PipelineResult;
+import org.apache.beam.sdk.coders.StringUtf8Coder;
+import org.apache.beam.sdk.options.PipelineOptionsFactory;
+import org.apache.beam.sdk.transforms.Count;
+import org.apache.beam.sdk.transforms.DoFn;
+import org.apache.beam.sdk.transforms.ParDo;
+
+/**
+ * For smoke test in the build/deployment process.
+ *
+ * <p>There two coverage gaps in unit tests for BEAM pipelines:
+ *
+ * <ul>
+ *   <li>The compatibility of the JVM and SDK in the pipeline image
+ *   <li>The JPA setup, which is performed by the {@link RegistryPipelineWorkerInitializer}
+ * </ul>
+ *
+ * <p>This classes defines a pipeline that performs one quick database query. The pipeline is
+ * expected to complete quickly, and the build or deployment process may launch it on GCP and wait
+ * for its completion to be certain that all aspects are tested for Nomulus pipelines.
+ */
+public class SmokeTestPipeline implements Serializable {
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  public static void main(String[] args) {
+    PipelineOptionsFactory.register(RegistryPipelineOptions.class);
+    RegistryPipelineOptions options =
+        PipelineOptionsFactory.fromArgs(args).withValidation().as(RegistryPipelineOptions.class);
+    runPipeline(options);
+  }
+
+  static PipelineResult runPipeline(RegistryPipelineOptions options) {
+    Pipeline pipeline = Pipeline.create(options);
+    pipeline
+        .apply(
+            "Read Tlds",
+            RegistryJpaIO.read(() -> CriteriaQueryBuilder.create(Tld.class).build(), Tld::getTldStr)
+                .withCoder(StringUtf8Coder.of()))
+        .apply("Count Tlds", Count.globally())
+        .apply(
+            "Verify Count",
+            ParDo.of(
+                new DoFn<Long, Void>() {
+                  @DoFn.ProcessElement
+                  public void processElement(@Element Long count) {
+                    logger.atInfo().log("Tld count: %s", count);
+                    verify(count > 0, "Expecting 1 or more, got %s.", count);
+                  }
+                }));
+
+    return pipeline.run();
+  }
+}

core/src/main/java/google/registry/beam/rde/RdeIO.java

@@ -56,6 +56,8 @@ import java.io.OutputStream;
 import java.io.OutputStreamWriter;
 import java.io.Writer;
 import java.security.Security;
+import java.time.Duration;
+import java.time.Instant;
 import java.util.Optional;
 import org.apache.beam.sdk.options.PipelineOptions;
 import org.apache.beam.sdk.transforms.DoFn;
@@ -66,8 +68,6 @@ import org.apache.beam.sdk.values.PCollection;
 import org.apache.beam.sdk.values.PDone;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.bouncycastle.openpgp.PGPPublicKey;
-import org.joda.time.DateTime;
-import org.joda.time.Duration;
 
 public class RdeIO {
 
@@ -133,7 +133,7 @@ public class RdeIO {
     private final byte[] stagingKeyBytes;
     private final RdeMarshaller marshaller;
 
-    protected RdeWriter(
+    RdeWriter(
         GcsUtils gcsUtils,
         String rdeBucket,
         byte[] stagingKeyBytes,
@@ -144,7 +144,7 @@ public class RdeIO {
       this.marshaller = new RdeMarshaller(validationMode);
     }
 
-    @SuppressWarnings("unused")
+    @SuppressWarnings({"EffectivelyPrivate", "unused"})
     @Setup
     public void setup() {
       Security.addProvider(new BouncyCastleProvider());
@@ -163,7 +163,7 @@ public class RdeIO {
       // Determine some basic things about the deposit.
       final RdeMode mode = key.mode();
       final String tld = key.tld();
-      final DateTime watermark = key.watermark();
+      final Instant watermark = key.watermark();
       final int revision =
           Optional.ofNullable(key.revision())
               .orElseGet(() -> RdeRevision.getNextRevision(tld, watermark, mode));
@@ -259,7 +259,7 @@ public class RdeIO {
 
     private static final FluentLogger logger = FluentLogger.forEnclosingClass();
     private static final long serialVersionUID = 5822176227753327224L;
-    private static final Duration ENQUEUE_DELAY = Duration.standardMinutes(1);
+    private static final Duration ENQUEUE_DELAY = Duration.ofMinutes(1);
 
     private final CloudTasksUtils cloudTasksUtils;
 
@@ -276,9 +276,9 @@ public class RdeIO {
                 Tld tld = Tld.get(key.tld());
                 Optional<Cursor> cursor =
                     tm().loadByKeyIfPresent(Cursor.createScopedVKey(key.cursor(), tld));
-                DateTime position = getCursorTimeOrStartOfTime(cursor);
+                Instant position = getCursorTimeOrStartOfTime(cursor);
                 checkState(key.interval() != null, "Interval must be present");
-                DateTime newPosition = key.watermark().plus(key.interval());
+                Instant newPosition = key.watermark().plus(key.interval());
                 if (!position.isBefore(newPosition)) {
                   logger.atWarning().log("Cursor has already been rolled forward.");
                   return;

core/src/main/java/google/registry/beam/rde/RdePipeline.java

@@ -71,6 +71,7 @@ import jakarta.inject.Inject;
 import jakarta.inject.Singleton;
 import java.io.IOException;
 import java.io.Serializable;
+import java.time.Instant;
 import org.apache.beam.sdk.Pipeline;
 import org.apache.beam.sdk.PipelineResult;
 import org.apache.beam.sdk.coders.KvCoder;
@@ -96,7 +97,6 @@ import org.apache.beam.sdk.values.PCollectionTuple;
 import org.apache.beam.sdk.values.TupleTag;
 import org.apache.beam.sdk.values.TupleTagList;
 import org.apache.beam.sdk.values.TypeDescriptor;
-import org.joda.time.DateTime;
 
 /**
  * Definition of a Dataflow Flex template, which generates RDE/BRDA deposits.
@@ -170,7 +170,7 @@ public class RdePipeline implements Serializable {
   private final transient RdePipelineOptions options;
   private final ValidationMode mode;
   private final ImmutableSet<PendingDeposit> pendingDeposits;
-  private final DateTime watermark;
+  private final Instant watermark;
   private final String rdeBucket;
   private final byte[] stagingKeyBytes;
   private final GcsUtils gcsUtils;
@@ -189,7 +189,7 @@ public class RdePipeline implements Serializable {
     this.options = options;
     this.mode = ValidationMode.valueOf(options.getValidationMode());
     this.pendingDeposits = decodePendingDeposits(options.getPendings());
-    ImmutableSet<DateTime> potentialWatermarks =
+    ImmutableSet<Instant> potentialWatermarks =
         pendingDeposits.stream()
             .map(PendingDeposit::watermark)
             .distinct()
@@ -314,12 +314,11 @@ public class RdePipeline implements Serializable {
         String.format("Load most recent %s", historyClass.getSimpleName()),
         RegistryJpaIO.read(
                 ("SELECT repoId, revisionId FROM %entity% WHERE (repoId, modificationTime) IN"
-                     + " (SELECT repoId, MAX(modificationTime) FROM %entity% WHERE"
-                     + " modificationTime <= :watermark GROUP BY repoId) AND resource.deletionTime"
-                     + " > :watermark AND COALESCE(resource.creationRegistrarId, '') NOT LIKE"
-                     + " 'prober-%' AND COALESCE(resource.currentSponsorRegistrarId, '') NOT LIKE"
-                     + " 'prober-%' AND COALESCE(resource.lastEppUpdateRegistrarId, '') NOT LIKE"
-                     + " 'prober-%' "
+                     + " (SELECT repoId, MAX(modificationTime) FROM %entity% WHERE modificationTime"
+                     + " <= :watermark GROUP BY repoId) AND resource.deletionTime > :watermark AND"
+                     + " COALESCE(resource.creationRegistrarId, '') NOT LIKE 'prober-%' AND"
+                     + " COALESCE(resource.currentSponsorRegistrarId, '') NOT LIKE 'prober-%' AND"
+                     + " COALESCE(resource.lastEppUpdateRegistrarId, '') NOT LIKE 'prober-%' "
                         + (historyClass == DomainHistory.class
                             ? "AND resource.tld IN " + "(SELECT id FROM Tld WHERE tldType = 'REAL')"
                             : ""))

core/src/main/java/google/registry/beam/resave/ResaveAllEppResourcesPipeline.java

@@ -16,6 +16,8 @@ package google.registry.beam.resave;
 
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.util.DateTimeUtils.END_INSTANT;
+import static google.registry.util.DateTimeUtils.toInstant;
 import static org.apache.beam.sdk.values.TypeDescriptors.integers;
 
 import com.google.common.collect.ImmutableList;
@@ -30,7 +32,6 @@ import google.registry.model.domain.DomainBase;
 import google.registry.model.host.Host;
 import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.persistence.VKey;
-import google.registry.util.DateTimeUtils;
 import java.io.Serializable;
 import org.apache.beam.sdk.Pipeline;
 import org.apache.beam.sdk.PipelineResult;
@@ -74,7 +75,7 @@ public class ResaveAllEppResourcesPipeline implements Serializable {
       "SELECT repoId FROM Domain d WHERE (d.transferData.transferStatus = 'PENDING' AND"
           + " d.transferData.pendingTransferExpirationTime < current_timestamp()) OR"
           + " (d.registrationExpirationTime < current_timestamp() AND d.deletionTime ="
-          + " (:END_OF_TIME)) OR (EXISTS (SELECT 1 FROM GracePeriod gp WHERE gp.domainRepoId ="
+          + " (:END_INSTANT)) OR (EXISTS (SELECT 1 FROM GracePeriod gp WHERE gp.domainRepoId ="
           + " d.repoId AND gp.expirationTime < current_timestamp()))";
 
   private final ResaveAllEppResourcesPipelineOptions options;
@@ -102,13 +103,13 @@ public class ResaveAllEppResourcesPipeline implements Serializable {
    * transfers, grace periods).
    *
    * <p>The logic of what might have changed is paraphrased from {@link
-   * DomainBase#cloneProjectedAtTime(DateTime)}.
+   * DomainBase#cloneProjectedAtTime(Instant)}.
    */
   private void fastResaveDomains(Pipeline pipeline) {
     Read<String, String> repoIdRead =
         RegistryJpaIO.read(
                 DOMAINS_TO_PROJECT_QUERY,
-                ImmutableMap.of("END_OF_TIME", DateTimeUtils.END_OF_TIME),
+                ImmutableMap.of("END_INSTANT", END_INSTANT),
                 String.class,
                 r -> r)
             .withCoder(StringUtf8Coder.of());
@@ -154,9 +155,7 @@ public class ResaveAllEppResourcesPipeline implements Serializable {
     }
 
     @ProcessElement
-    public void processElement(
-        @Element KV<ShardedKey<Integer>, Iterable<String>> element,
-        OutputReceiver<Void> outputReceiver) {
+    public void processElement(@Element KV<ShardedKey<Integer>, Iterable<String>> element) {
       tm().transact(
               () -> {
                 DateTime now = tm().getTransactionTime();
@@ -166,7 +165,7 @@ public class ResaveAllEppResourcesPipeline implements Serializable {
                         .collect(toImmutableList());
                 ImmutableList<EppResource> mappedResources =
                     tm().loadByKeys(keys).values().stream()
-                        .map(r -> r.cloneProjectedAtTime(now))
+                        .map(r -> r.cloneProjectedAtTime(toInstant(now)))
                         .collect(toImmutableList());
                 tm().putAll(mappedResources);
               });

core/src/main/java/google/registry/beam/spec11/SafeBrowsingTransforms.java

@@ -14,6 +14,7 @@
 
 package google.registry.beam.spec11;
 
+import static google.registry.util.DateTimeUtils.toJodaInstant;
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.apache.http.HttpStatus.SC_OK;
 
@@ -22,7 +23,6 @@ import com.google.common.collect.ImmutableSet;
 import com.google.common.flogger.FluentLogger;
 import com.google.common.io.CharStreams;
 import google.registry.util.Clock;
-import google.registry.util.DateTimeUtils;
 import google.registry.util.Retrier;
 import java.io.IOException;
 import java.io.InputStreamReader;
@@ -132,9 +132,7 @@ public class SafeBrowsingTransforms {
       if (!domainNameInfoBuffer.isEmpty()) {
         ImmutableSet<KV<DomainNameInfo, ThreatMatch>> results = evaluateAndFlush();
         results.forEach(
-            (kv) ->
-                context.output(
-                    kv, DateTimeUtils.toJodaInstant(clock.now()), GlobalWindow.INSTANCE));
+            (kv) -> context.output(kv, toJodaInstant(clock.now()), GlobalWindow.INSTANCE));
       }
     }
 

core/src/main/java/google/registry/beam/spec11/Spec11Pipeline.java

@@ -210,8 +210,8 @@ public class Spec11Pipeline implements Serializable {
                       String registrarId = kv.getKey();
                       checkArgument(
                           kv.getValue().iterator().hasNext(),
-                          String.format(
-                              "Registrar with ID %s had no corresponding threats", registrarId));
+                          "Registrar with ID %s had no corresponding threats",
+                          registrarId);
                       String email = kv.getValue().iterator().next().email();
                       JSONObject output = new JSONObject();
                       try {

core/src/main/java/google/registry/bigquery/BigqueryConnection.java

@@ -64,19 +64,19 @@ import google.registry.util.SqlTemplate;
 import google.registry.util.SystemSleeper;
 import jakarta.inject.Inject;
 import java.io.IOException;
+import java.time.Duration;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Random;
 import java.util.concurrent.ExecutorService;
 import javax.annotation.Nullable;
-import org.joda.time.Duration;
 
 /** Class encapsulating parameters and state for accessing the Bigquery API. */
 public class BigqueryConnection implements AutoCloseable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
-  private static final Duration MIN_POLL_INTERVAL = Duration.millis(500);
+  private static final Duration MIN_POLL_INTERVAL = Duration.ofMillis(500);
 
   @NonFinalForTesting
   private static Sleeper sleeper = new SystemSleeper();
@@ -88,7 +88,7 @@ public class BigqueryConnection implements AutoCloseable {
   private static final String TEMP_DATASET_NAME = "__temp__";
 
   /** Default time to live for temporary tables. */
-  private static final Duration TEMP_TABLE_TTL = Duration.standardHours(24);
+  private static final Duration TEMP_TABLE_TTL = Duration.ofHours(24);
 
   /** Bigquery client instance wrapped by this class. */
   private final Bigquery bigquery;
@@ -109,7 +109,7 @@ public class BigqueryConnection implements AutoCloseable {
   private boolean overwrite = false;
 
   /** Duration to wait between polls for job status. */
-  private Duration pollInterval = Duration.millis(1000);
+  private Duration pollInterval = Duration.ofSeconds(1);
 
   BigqueryConnection(Bigquery bigquery, Clock clock) {
     this.bigquery = bigquery;
@@ -146,9 +146,9 @@ public class BigqueryConnection implements AutoCloseable {
 
     public Builder setPollInterval(Duration pollInterval) {
       checkArgument(
-          !pollInterval.isShorterThan(MIN_POLL_INTERVAL),
+          pollInterval.compareTo(MIN_POLL_INTERVAL) >= 0,
           "poll interval must be at least %s ms",
-          MIN_POLL_INTERVAL.getMillis());
+          MIN_POLL_INTERVAL.toMillis());
       instance.pollInterval = pollInterval;
       return this;
     }
@@ -225,7 +225,7 @@ public class BigqueryConnection implements AutoCloseable {
       }
 
       public Builder timeToLive(Duration duration) {
-        this.table.setExpirationTime(clock.nowUtc().plus(duration).getMillis());
+        this.table.setExpirationTime(clock.now().plus(duration).toEpochMilli());
         return this;
       }
 

core/src/main/java/google/registry/bigquery/BigqueryJobFailureException.java

@@ -29,8 +29,8 @@ public final class BigqueryJobFailureException extends RuntimeException {
 
   /** Delegate {@link IOException} errors, checking for {@link GoogleJsonResponseException} */
   public static BigqueryJobFailureException create(IOException cause) {
-    if (cause instanceof GoogleJsonResponseException) {
-        return create((GoogleJsonResponseException) cause);
+    if (cause instanceof GoogleJsonResponseException googleJsonResponseException) {
+      return create(googleJsonResponseException);
     } else {
       return new BigqueryJobFailureException(cause.getMessage(), cause, null, null);
     }

core/src/main/java/google/registry/bigquery/BigqueryUtils.java

@@ -14,13 +14,16 @@
 
 package google.registry.bigquery;
 
+import static java.time.ZoneOffset.UTC;
+import static java.time.temporal.ChronoUnit.MICROS;
+
 import com.google.api.services.bigquery.model.JobReference;
+import java.time.Instant;
+import java.time.format.DateTimeFormatter;
+import java.time.format.DateTimeFormatterBuilder;
+import java.time.format.SignStyle;
+import java.time.temporal.ChronoField;
 import java.util.concurrent.TimeUnit;
-import org.joda.time.DateTime;
-import org.joda.time.format.DateTimeFormatter;
-import org.joda.time.format.DateTimeFormatterBuilder;
-import org.joda.time.format.DateTimeParser;
-import org.joda.time.format.ISODateTimeFormat;
 
 /** Utilities related to Bigquery. */
 public class BigqueryUtils {
@@ -67,47 +70,56 @@ public class BigqueryUtils {
    *
    * <p>The general format definition is "YYYY-MM-DD HH:MM:SS.SSS[ ZZ]", where the fractional
    * seconds portion can have 0-6 decimal places (although we restrict it to 0-3 here since Joda
-   * DateTime only supports up to millisecond precision) and the zone if not specified defaults to
+   * Instant only supports up to millisecond precision) and the zone if not specified defaults to
    * UTC.
    *
    * <p>Although we expect a zone specification of "UTC" when parsing, we don't emit it when
    * printing because in some cases BigQuery does not allow any time zone specification (instead it
    * assumes UTC for whatever input you provide) for input timestamp strings (see b/16380363).
    *
-   * @see <a href="https://cloud.google.com/bigquery/data-types#timestamp-type">
-   *     BigQuery Data Types - TIMESTAMP</a>
+   * @see <a href="https://cloud.google.com/bigquery/data-types#timestamp-type">BigQuery Data Types
+   *     - TIMESTAMP</a>
    */
-  public static final DateTimeFormatter BIGQUERY_TIMESTAMP_FORMAT = new DateTimeFormatterBuilder()
-      .append(ISODateTimeFormat.date())
-      .appendLiteral(' ')
-      .append(
-          // For printing, always print out the milliseconds.
-          ISODateTimeFormat.hourMinuteSecondMillis().getPrinter(),
-          // For parsing, we need a series of parsers to correctly handle the milliseconds.
-          new DateTimeParser[] {
-              // Try to parse the time with milliseconds first, which requires at least one
-              // fractional second digit, and if that fails try to parse without milliseconds.
-              ISODateTimeFormat.hourMinuteSecondMillis().getParser(),
-              ISODateTimeFormat.hourMinuteSecond().getParser()})
-      // Print UTC as the empty string since BigQuery's TIMESTAMP() function does not accept any
-      // time zone specification, but require "UTC" on parsing.  Since we force this formatter to
-      // always use UTC below, the other arguments do not matter.  If b/16380363 ever gets resolved
-      // this could be simplified to appendLiteral(" UTC").
-      .appendTimeZoneOffset("", " UTC", false, 1, 1)
-      .toFormatter()
-      .withZoneUTC();
+  private static final DateTimeFormatter BIGQUERY_TIMESTAMP_PARSER =
+      new DateTimeFormatterBuilder()
+          .appendValue(ChronoField.YEAR, 4, 10, SignStyle.NOT_NEGATIVE)
+          .appendLiteral('-')
+          .appendValue(ChronoField.MONTH_OF_YEAR, 2)
+          .appendLiteral('-')
+          .appendValue(ChronoField.DAY_OF_MONTH, 2)
+          .appendLiteral(' ')
+          .appendPattern("HH:mm:ss")
+          .optionalStart()
+          .appendFraction(ChronoField.MILLI_OF_SECOND, 0, 3, true)
+          .optionalEnd()
+          .appendLiteral(" UTC")
+          .toFormatter()
+          .withZone(UTC);
+
+  private static final DateTimeFormatter BIGQUERY_TIMESTAMP_PRINTER =
+      new DateTimeFormatterBuilder()
+          .appendValue(ChronoField.YEAR, 4, 10, SignStyle.NOT_NEGATIVE)
+          .appendLiteral('-')
+          .appendValue(ChronoField.MONTH_OF_YEAR, 2)
+          .appendLiteral('-')
+          .appendValue(ChronoField.DAY_OF_MONTH, 2)
+          .appendLiteral(' ')
+          .appendPattern("HH:mm:ss")
+          .appendFraction(ChronoField.MILLI_OF_SECOND, 3, 3, true)
+          .toFormatter()
+          .withZone(UTC);
 
   /**
-   * Returns the human-readable string version of the given DateTime, suitable for conversion
-   * within BigQuery from a string literal into a BigQuery timestamp type.
+   * Returns the human-readable string version of the given Instant, suitable for conversion within
+   * BigQuery from a string literal into a BigQuery timestamp type.
    */
-  public static String toBigqueryTimestampString(DateTime dateTime) {
-    return BIGQUERY_TIMESTAMP_FORMAT.print(dateTime);
+  public static String toBigqueryTimestampString(Instant dateTime) {
+    return BIGQUERY_TIMESTAMP_PRINTER.format(dateTime);
   }
 
-  /** Returns the DateTime for a given human-readable string-formatted BigQuery timestamp. */
-  public static DateTime fromBigqueryTimestampString(String timestampString) {
-    return BIGQUERY_TIMESTAMP_FORMAT.parseDateTime(timestampString);
+  /** Returns the Instant for a given human-readable string-formatted BigQuery timestamp. */
+  public static Instant fromBigqueryTimestampString(String timestampString) {
+    return BIGQUERY_TIMESTAMP_PARSER.parse(timestampString, Instant::from);
   }
 
   /**
@@ -123,15 +135,16 @@ public class BigqueryUtils {
   }
 
   /**
-   * Converts a {@link DateTime} into a numeric string that BigQuery understands as a timestamp:
-   * the decimal number of seconds since the epoch, precise up to microseconds.
+   * Converts a time into a numeric string that BigQuery understands as a timestamp: the decimal
+   * number of seconds since the epoch, precise up to microseconds.
    *
-   * <p>Note that since {@code DateTime} only stores milliseconds, the last 3 digits will be zero.
+   * <p>Note that while {@code Instant} supports nanosecond precision, BigQuery only supports
+   * microsecond precision, so the sub-microsecond precision is truncated.
    *
    * @see <a href="https://developers.google.com/bigquery/timestamp">Data Types</a>
    */
-  public static String toBigqueryTimestamp(DateTime dateTime) {
-    return toBigqueryTimestamp(dateTime.getMillis(), TimeUnit.MILLISECONDS);
+  public static String toBigqueryTimestamp(Instant dateTime) {
+    return toBigqueryTimestamp(MICROS.between(Instant.EPOCH, dateTime), TimeUnit.MICROSECONDS);
   }
 
   /**

core/src/main/java/google/registry/bsa/BlockListFetcher.java

@@ -62,7 +62,7 @@ public class BlockListFetcher {
     // TODO: use more informative exceptions to describe retriable errors
     return retrier.callWithRetry(
         () -> tryFetch(blockListType),
-        e -> e instanceof BsaException && ((BsaException) e).isRetriable());
+        e -> e instanceof BsaException bsaException && bsaException.isRetriable());
   }
 
   LazyBlockList tryFetch(BlockListType blockListType) {

core/src/main/java/google/registry/bsa/BsaDownloadAction.java

@@ -116,7 +116,7 @@ public class BsaDownloadAction implements Runnable {
 
   Void runWithinLock() {
     // Cannot enroll new TLDs after download starts. This may change if b/309175410 is fixed.
-    if (!Tlds.hasActiveBsaEnrollment(clock.nowUtc())) {
+    if (!Tlds.hasActiveBsaEnrollment(clock.now())) {
       logger.atInfo().log("No TLDs enrolled with BSA. Quitting.");
       return null;
     }
@@ -179,9 +179,7 @@ public class BsaDownloadAction implements Runnable {
           gcsClient.writeUnblockableDomains(
               schedule.jobName(),
               batches
-                  .map(
-                      batch ->
-                          applyLabelDiff(batch, lazyIdnChecker.get(), schedule, clock.nowUtc()))
+                  .map(batch -> applyLabelDiff(batch, lazyIdnChecker.get(), schedule, clock.now()))
                   .flatMap(ImmutableList::stream));
         }
         schedule.updateJobStage(DownloadStage.REPORT_START_OF_ORDER_PROCESSING);

core/src/main/java/google/registry/bsa/BsaLock.java

@@ -17,8 +17,8 @@ package google.registry.bsa;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.request.lock.LockHandler;
 import jakarta.inject.Inject;
+import java.time.Duration;
 import java.util.concurrent.Callable;
-import org.joda.time.Duration;
 
 /** Helper for guarding all BSA related work with a common lock. */
 public class BsaLock {

core/src/main/java/google/registry/bsa/BsaRefreshAction.java

@@ -36,9 +36,9 @@ import google.registry.request.auth.Auth;
 import google.registry.util.BatchedStreams;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Duration;
 import java.util.Optional;
 import java.util.stream.Stream;
-import org.joda.time.Duration;
 
 @Action(
     service = Action.Service.BACKEND,
@@ -103,7 +103,7 @@ public class BsaRefreshAction implements Runnable {
   /** Executes the refresh action while holding the BSA lock. */
   Void runWithinLock() {
     // Cannot enroll new TLDs after download starts. This may change if b/309175410 is fixed.
-    if (!Tlds.hasActiveBsaEnrollment(clock.nowUtc())) {
+    if (!Tlds.hasActiveBsaEnrollment(clock.now())) {
       logger.atInfo().log("No TLDs enrolled with BSA. Quitting.");
       return null;
     }
@@ -116,7 +116,7 @@ public class BsaRefreshAction implements Runnable {
     DomainsRefresher refresher =
         new DomainsRefresher(
             schedule.prevRefreshTime(),
-            clock.nowUtc(),
+            clock.now(),
             domainCreateTxnCommitTimeLag,
             transactionBatchSize);
     switch (schedule.stage()) {

core/src/main/java/google/registry/bsa/BsaValidateAction.java

@@ -57,11 +57,11 @@ import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Duration;
+import java.time.Instant;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.stream.Stream;
-import org.joda.time.DateTime;
-import org.joda.time.Duration;
 
 /** Validates the BSA data in the database against the most recent block lists. */
 @Action(
@@ -186,7 +186,7 @@ public class BsaValidateAction implements Runnable {
           ForeignKeyUtils.loadResources(
               Domain.class,
               batch.stream().map(UnblockableDomain::domainName).collect(toImmutableList()),
-              clock.nowUtc());
+              clock.now());
       for (var unblockable : batch) {
         verifyDomainStillUnblockableWithReason(unblockable, activeDomains).ifPresent(errors::add);
       }
@@ -199,7 +199,7 @@ public class BsaValidateAction implements Runnable {
 
   Optional<String> verifyDomainStillUnblockableWithReason(
       UnblockableDomain domain, ImmutableMap<String, Domain> activeDomains) {
-    DateTime now = clock.nowUtc();
+    Instant now = clock.now();
     boolean isRegistered = activeDomains.containsKey(domain.domainName());
     boolean isReserved = isReservedDomain(domain.domainName(), now);
     InternetDomainName domainName = InternetDomainName.from(domain.domainName());
@@ -228,7 +228,7 @@ public class BsaValidateAction implements Runnable {
   }
 
   boolean isStalenessAllowed(Domain domain) {
-    return domain.getCreationTime().plus(maxStaleness).isAfter(clock.nowUtc());
+    return domain.getCreationTime().plus(maxStaleness).isAfter(clock.now());
   }
 
   /** Returns unique labels across all block lists in the download specified by {@code jobName}. */
@@ -262,20 +262,20 @@ public class BsaValidateAction implements Runnable {
   }
 
   ImmutableList<String> checkMissingUnblockableDomains() {
-    DateTime now = clock.nowUtc();
+    Instant now = clock.now();
     ImmutableList.Builder<String> errors = new ImmutableList.Builder<>();
     errors.addAll(checkForMissingReservedUnblockables(now));
     errors.addAll(checkForMissingRegisteredUnblockables(now));
     return errors.build();
   }
 
-  ImmutableList<String> checkForMissingRegisteredUnblockables(DateTime now) {
+  ImmutableList<String> checkForMissingRegisteredUnblockables(Instant now) {
     ImmutableList.Builder<String> errors = new ImmutableList.Builder<>();
     ImmutableList<Tld> bsaEnabledTlds =
         getTldEntitiesOfType(TldType.REAL).stream()
             .filter(tld -> isEnrolledWithBsa(tld, now))
             .collect(toImmutableList());
-    DateTime stalenessThreshold = now.minus(maxStaleness);
+    Instant stalenessThreshold = now.minus(maxStaleness);
     bsaEnabledTlds.stream()
         .map(Tld::getTldStr)
         .map(tld -> bsaQuery(() -> queryMissedRegisteredUnblockables(tld, now)))
@@ -290,7 +290,7 @@ public class BsaValidateAction implements Runnable {
     return errors.build();
   }
 
-  ImmutableList<String> checkForMissingReservedUnblockables(DateTime now) {
+  ImmutableList<String> checkForMissingReservedUnblockables(Instant now) {
     ImmutableList.Builder<String> errors = new ImmutableList.Builder<>();
     try (Stream<ImmutableList<String>> reservedNames =
         toBatches(

core/src/main/java/google/registry/bsa/IdnChecker.java

@@ -29,7 +29,7 @@ import google.registry.tldconfig.idn.IdnLabelValidator;
 import google.registry.tldconfig.idn.IdnTableEnum;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
-import org.joda.time.DateTime;
+import java.time.Instant;
 
 /**
  * Checks labels' validity wrt Idns in TLDs enrolled with BSA.
@@ -45,7 +45,7 @@ public class IdnChecker {
 
   @Inject
   IdnChecker(Clock clock) {
-    this.idnToTlds = getIdnToTldMap(clock.nowUtc());
+    this.idnToTlds = getIdnToTldMap(clock.now());
     allTlds = idnToTlds.values().stream().flatMap(ImmutableSet::stream).collect(toImmutableSet());
   }
 
@@ -79,7 +79,7 @@ public class IdnChecker {
     return Sets.difference(allTlds, getSupportingTlds(idnTables)).immutableCopy();
   }
 
-  private static ImmutableMap<IdnTableEnum, ImmutableSet<Tld>> getIdnToTldMap(DateTime now) {
+  private static ImmutableMap<IdnTableEnum, ImmutableSet<Tld>> getIdnToTldMap(Instant now) {
     var idnToTldMap = new ImmutableMultimap.Builder<IdnTableEnum, Tld>();
     Tlds.getTldEntitiesOfType(TldType.REAL).stream()
         .filter(tld -> isEnrolledWithBsa(tld, now))

core/src/main/java/google/registry/bsa/ReservedDomainsUtils.java

@@ -28,12 +28,12 @@ import google.registry.model.tld.Tld.TldState;
 import google.registry.model.tld.Tld.TldType;
 import google.registry.model.tld.Tlds;
 import google.registry.model.tld.label.ReservedList;
+import java.time.Instant;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
 import java.util.stream.Stream;
-import org.joda.time.DateTime;
 
 /**
  * Utility for looking up reserved domain names.
@@ -45,7 +45,7 @@ public final class ReservedDomainsUtils {
 
   private ReservedDomainsUtils() {}
 
-  public static Stream<String> getAllReservedNames(DateTime now) {
+  public static Stream<String> getAllReservedNames(Instant now) {
     return Tlds.getTldEntitiesOfType(TldType.REAL).stream()
         .filter(tld -> Tld.isEnrolledWithBsa(tld, now))
         .map(tld -> getAllReservedDomainsInTld(tld, now))
@@ -53,7 +53,7 @@ public final class ReservedDomainsUtils {
   }
 
   /** Returns all reserved domains in a given {@code tld} as of {@code now}. */
-  static ImmutableSet<String> getAllReservedDomainsInTld(Tld tld, DateTime now) {
+  static ImmutableSet<String> getAllReservedDomainsInTld(Tld tld, Instant now) {
     return loadReservedLists(tld.getReservedListNames()).stream()
         .map(ReservedList::getReservedListEntries)
         .map(Map::keySet)
@@ -67,7 +67,7 @@ public final class ReservedDomainsUtils {
    * Returns true if {@code domain} is a reserved name that can be registered right now (e.g.,
    * during sunrise or with allocation token), therefore unblockable.
    */
-  public static boolean isReservedDomain(String domain, DateTime now) {
+  public static boolean isReservedDomain(String domain, Instant now) {
     Optional<InternetDomainName> tldStr = findTldForName(InternetDomainName.from(domain));
     verify(tldStr.isPresent(), "Tld for domain [%s] unexpectedly missing.", domain);
     Tld tld = Tld.get(tldStr.get().toString());

core/src/main/java/google/registry/bsa/UploadBsaUnavailableDomainsAction.java

@@ -54,6 +54,7 @@ import java.io.OutputStreamWriter;
 import java.io.PipedInputStream;
 import java.io.PipedOutputStream;
 import java.io.Writer;
+import java.time.Instant;
 import java.util.Optional;
 import java.util.zip.GZIPOutputStream;
 import okhttp3.MediaType;
@@ -65,7 +66,6 @@ import okhttp3.Response;
 import okio.BufferedSink;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
-import org.joda.time.DateTime;
 
 /**
  * Daily action that uploads unavailable domain names on applicable TLDs to BSA.
@@ -122,7 +122,7 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
   public void run() {
     // TODO(mcilwain): Implement a date Cursor, have the cronjob run frequently, and short-circuit
     //                 the run if the daily upload is already completed.
-    DateTime runTime = clock.nowUtc();
+    Instant runTime = clock.now();
     ImmutableSortedSet<String> unavailableDomains = getUnavailableDomains(runTime);
     if (unavailableDomains.isEmpty()) {
       logger.atWarning().log("No unavailable domains found; terminating.");
@@ -141,7 +141,7 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
   }
 
   /** Uploads the unavailable domains list to GCS in the unavailable domains bucket. */
-  boolean uploadToGcs(ImmutableSortedSet<String> unavailableDomains, DateTime runTime) {
+  boolean uploadToGcs(ImmutableSortedSet<String> unavailableDomains, Instant runTime) {
     logger.atInfo().log("Uploading unavailable names file to GCS in bucket %s", gcsBucket);
     BlobId blobId = BlobId.of(gcsBucket, createFilename(runTime));
     // `gcsUtils.openOutputStream` returns a buffered stream
@@ -159,7 +159,7 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
     }
   }
 
-  boolean uploadToBsa(ImmutableSortedSet<String> unavailableDomains, DateTime runTime) {
+  boolean uploadToBsa(ImmutableSortedSet<String> unavailableDomains, Instant runTime) {
     try {
       Hasher sha512Hasher = Hashing.sha512().newHasher();
       unavailableDomains.stream()
@@ -211,11 +211,11 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
     }
   }
 
-  private static String createFilename(DateTime runTime) {
+  private static String createFilename(Instant runTime) {
     return String.format("unavailable_domains_%s.txt", runTime.toString());
   }
 
-  private ImmutableSortedSet<String> getUnavailableDomains(DateTime runTime) {
+  private ImmutableSortedSet<String> getUnavailableDomains(Instant runTime) {
     // Get list of TLDs to process.
     ImmutableSet<Tld> bsaEnabledTlds =
         getTldEntitiesOfType(TldType.REAL).stream()

core/src/main/java/google/registry/bsa/api/BsaCredential.java

@@ -31,12 +31,12 @@ import jakarta.inject.Inject;
 import java.io.IOException;
 import java.net.URL;
 import java.security.GeneralSecurityException;
+import java.time.Duration;
+import java.time.Instant;
 import java.util.Map;
 import javax.annotation.Nullable;
 import javax.annotation.concurrent.ThreadSafe;
 import javax.net.ssl.HttpsURLConnection;
-import org.joda.time.Duration;
-import org.joda.time.Instant;
 
 /**
  * A credential for accessing the BSA API.
@@ -104,7 +104,7 @@ public class BsaCredential {
   }
 
   private void ensureAuthTokenValid() throws IOException, GeneralSecurityException {
-    Instant now = Instant.ofEpochMilli(clock.nowUtc().getMillis());
+    Instant now = clock.now();
     if (authToken != null && lastRefreshTime.plus(authTokenExpiry).isAfter(now)) {
       logger.atInfo().log("AuthToken still valid, reusing.");
       return;

core/src/main/java/google/registry/bsa/api/BsaReportSender.java

@@ -71,19 +71,19 @@ public class BsaReportSender {
   public void sendOrderStatusReport(String payload) {
     retrier.callWithRetry(
         () -> trySendData(this.orderStatusUrl, payload),
-        e -> e instanceof BsaException && ((BsaException) e).isRetriable());
+        e -> e instanceof BsaException bsaException && bsaException.isRetriable());
   }
 
   public void addUnblockableDomainsUpdates(String payload) {
     retrier.callWithRetry(
         () -> trySendData(this.addUnblockableDomainsUrl, payload),
-        e -> e instanceof BsaException && ((BsaException) e).isRetriable());
+        e -> e instanceof BsaException bsaException && bsaException.isRetriable());
   }
 
   public void removeUnblockableDomainsUpdates(String payload) {
     retrier.callWithRetry(
         () -> trySendData(this.removeUnblockableDomainsUrl, payload),
-        e -> e instanceof BsaException && ((BsaException) e).isRetriable());
+        e -> e instanceof BsaException bsaException && bsaException.isRetriable());
   }
 
   Void trySendData(String urlString, String payload) {

core/src/main/java/google/registry/bsa/persistence/BsaDomainRefresh.java

@@ -29,7 +29,7 @@ import jakarta.persistence.Enumerated;
 import jakarta.persistence.GeneratedValue;
 import jakarta.persistence.GenerationType;
 import jakarta.persistence.Id;
-import org.joda.time.DateTime;
+import java.time.Instant;
 
 /**
  * Records of completed and ongoing refresh actions, which recomputes the set of unblockable domains
@@ -46,10 +46,10 @@ class BsaDomainRefresh {
   Long jobId;
 
   @Column(nullable = false)
-  CreateAutoTimestamp creationTime = CreateAutoTimestamp.create(null);
+  CreateAutoTimestamp creationTime = CreateAutoTimestamp.create((Instant) null);
 
   @Column(nullable = false)
-  UpdateAutoTimestamp updateTime = UpdateAutoTimestamp.create(null);
+  UpdateAutoTimestamp updateTime = UpdateAutoTimestamp.create((Instant) null);
 
   @Column(nullable = false)
   @Enumerated(EnumType.STRING)
@@ -61,7 +61,7 @@ class BsaDomainRefresh {
     return jobId;
   }
 
-  DateTime getCreationTime() {
+  Instant getCreationTime() {
     return creationTime.getTimestamp();
   }
 

core/src/main/java/google/registry/bsa/persistence/BsaDownload.java

@@ -17,6 +17,7 @@ package google.registry.bsa.persistence;
 import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static google.registry.bsa.DownloadStage.DONE;
 import static google.registry.bsa.DownloadStage.DOWNLOAD_BLOCK_LISTS;
+import static google.registry.util.DateTimeUtils.formatInstant;
 
 import com.google.common.base.Joiner;
 import com.google.common.base.Objects;
@@ -37,8 +38,8 @@ import jakarta.persistence.GenerationType;
 import jakarta.persistence.Id;
 import jakarta.persistence.Index;
 import jakarta.persistence.Table;
+import java.time.Instant;
 import java.util.Locale;
-import org.joda.time.DateTime;
 
 /** Records of ongoing and completed download jobs. */
 @Entity
@@ -53,10 +54,10 @@ class BsaDownload {
   Long jobId;
 
   @Column(nullable = false)
-  CreateAutoTimestamp creationTime = CreateAutoTimestamp.create(null);
+  CreateAutoTimestamp creationTime = CreateAutoTimestamp.create((Instant) null);
 
   @Column(nullable = false)
-  UpdateAutoTimestamp updateTime = UpdateAutoTimestamp.create(null);
+  UpdateAutoTimestamp updateTime = UpdateAutoTimestamp.create((Instant) null);
 
   @Column(nullable = false)
   String blockListChecksums = "";
@@ -71,7 +72,7 @@ class BsaDownload {
     return jobId;
   }
 
-  DateTime getCreationTime() {
+  Instant getCreationTime() {
     return creationTime.getTimestamp();
   }
 
@@ -83,7 +84,7 @@ class BsaDownload {
    */
   String getJobName() {
     // Return a value based on job start time, which is unique.
-    return getCreationTime().toString().toLowerCase(Locale.ROOT).replace(":", "");
+    return formatInstant(getCreationTime()).toLowerCase(Locale.ROOT).replace(":", "");
   }
 
   boolean isDone() {

core/src/main/java/google/registry/bsa/persistence/BsaLabel.java

@@ -19,7 +19,7 @@ import google.registry.persistence.VKey;
 import jakarta.persistence.Column;
 import jakarta.persistence.Entity;
 import jakarta.persistence.Id;
-import org.joda.time.DateTime;
+import java.time.Instant;
 
 /**
  * Specifies a second-level TLD name that should be blocked from registration in all TLDs except by
@@ -41,12 +41,12 @@ final class BsaLabel {
    */
   @SuppressWarnings("unused")
   @Column(nullable = false)
-  DateTime creationTime;
+  Instant creationTime;
 
   // For Hibernate.
   private BsaLabel() {}
 
-  BsaLabel(String label, DateTime creationTime) {
+  BsaLabel(String label, Instant creationTime) {
     this.label = label;
     this.creationTime = creationTime;
   }

core/src/main/java/google/registry/bsa/persistence/BsaUnblockableDomain.java

@@ -31,6 +31,7 @@ import jakarta.persistence.Enumerated;
 import jakarta.persistence.Id;
 import jakarta.persistence.IdClass;
 import java.io.Serializable;
+import java.time.Instant;
 
 /** A domain matching a BSA label but is in use (registered or reserved), so cannot be blocked. */
 @Entity
@@ -52,7 +53,7 @@ class BsaUnblockableDomain {
    */
   @SuppressWarnings("unused")
   @Column(nullable = false)
-  CreateAutoTimestamp createTime = CreateAutoTimestamp.create(null);
+  CreateAutoTimestamp createTime = CreateAutoTimestamp.create((Instant) null);
 
   // For Hibernate
   BsaUnblockableDomain() {}

core/src/main/java/google/registry/bsa/persistence/DomainsRefresher.java

@@ -45,14 +45,14 @@ import google.registry.model.domain.Domain;
 import google.registry.model.tld.Tld;
 import google.registry.model.tld.Tld.TldType;
 import google.registry.util.BatchedStreams;
+import java.time.Duration;
+import java.time.Instant;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Optional;
 import java.util.stream.Stream;
-import org.joda.time.DateTime;
-import org.joda.time.Duration;
 
 /**
  * Rechecks {@link BsaUnblockableDomain the registered/reserved domain names} in the database for
@@ -89,13 +89,13 @@ import org.joda.time.Duration;
  */
 public final class DomainsRefresher {
 
-  private final DateTime prevRefreshStartTime;
+  private final Instant prevRefreshStartTime;
   private final int transactionBatchSize;
-  private final DateTime now;
+  private final Instant now;
 
   public DomainsRefresher(
-      DateTime prevRefreshStartTime,
-      DateTime now,
+      Instant prevRefreshStartTime,
+      Instant now,
       Duration domainTxnMaxDuration,
       int transactionBatchSize) {
     this.prevRefreshStartTime = prevRefreshStartTime.minus(domainTxnMaxDuration);
@@ -249,7 +249,7 @@ public final class DomainsRefresher {
   }
 
   static ImmutableSet<String> getNewlyCreatedUnblockables(
-      DateTime prevRefreshStartTime, DateTime now) {
+      Instant prevRefreshStartTime, Instant now) {
     ImmutableSet<String> bsaEnabledTlds =
         getTldEntitiesOfType(TldType.REAL).stream()
             .filter(tld -> isEnrolledWithBsa(tld, now))
@@ -260,7 +260,7 @@ public final class DomainsRefresher {
     return getBlockedDomainNames(liveDomains);
   }
 
-  static ImmutableSet<String> getAllReservedUnblockables(DateTime now, int batchSize) {
+  static ImmutableSet<String> getAllReservedUnblockables(Instant now, int batchSize) {
     Stream<String> allReserved = getAllReservedNames(now);
     return BatchedStreams.toBatches(allReserved, batchSize)
         .map(DomainsRefresher::getBlockedDomainNames)

core/src/main/java/google/registry/bsa/persistence/DownloadSchedule.java

@@ -24,8 +24,8 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import com.google.common.collect.ImmutableMap;
 import google.registry.bsa.BlockListType;
 import google.registry.bsa.DownloadStage;
+import java.time.Instant;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * Information needed when handling a download from BSA.
@@ -36,7 +36,7 @@ import org.joda.time.DateTime;
  */
 public record DownloadSchedule(
     long jobId,
-    DateTime jobCreationTime,
+    Instant jobCreationTime,
     String jobName,
     DownloadStage stage,
     Optional<CompletedJob> latestCompleted,

core/src/main/java/google/registry/bsa/persistence/DownloadScheduler.java

@@ -20,7 +20,6 @@ import static google.registry.bsa.DownloadStage.DONE;
 import static google.registry.bsa.DownloadStage.NOP;
 import static google.registry.bsa.persistence.RefreshScheduler.fetchMostRecentRefresh;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static org.joda.time.Duration.standardSeconds;
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableList;
@@ -28,9 +27,9 @@ import google.registry.bsa.persistence.DownloadSchedule.CompletedJob;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Duration;
 import java.util.Objects;
 import java.util.Optional;
-import org.joda.time.Duration;
 
 /**
  * Assigns work for each cron invocation of the BSA Download job.
@@ -57,7 +56,7 @@ import org.joda.time.Duration;
 public final class DownloadScheduler {
 
   /** Allows a new download to proceed if the cron job fires a little early due to NTP drift. */
-  private static final Duration CRON_JITTER = standardSeconds(5);
+  private static final Duration CRON_JITTER = Duration.ofSeconds(5);
 
   private final Duration downloadInterval;
   private final Duration maxNopInterval;
@@ -115,7 +114,11 @@ public final class DownloadScheduler {
   }
 
   private boolean isTimeAgain(BsaDownload mostRecent, Duration interval) {
-    return mostRecent.getCreationTime().plus(interval).minus(CRON_JITTER).isBefore(clock.nowUtc());
+    return mostRecent
+        .getCreationTime()
+        .plusMillis(interval.toMillis())
+        .minusMillis(CRON_JITTER.toMillis())
+        .isBefore(clock.now());
   }
 
   /**

core/src/main/java/google/registry/bsa/persistence/LabelDiffUpdates.java

@@ -37,9 +37,9 @@ import google.registry.bsa.api.UnblockableDomain.Reason;
 import google.registry.model.ForeignKeyUtils;
 import google.registry.model.domain.Domain;
 import google.registry.model.tld.Tld;
+import java.time.Instant;
 import java.util.Map;
 import java.util.stream.Stream;
-import org.joda.time.DateTime;
 
 /** Applies the BSA label diffs from the latest BSA download. */
 public final class LabelDiffUpdates {
@@ -60,7 +60,7 @@ public final class LabelDiffUpdates {
       ImmutableList<BlockLabel> labels,
       IdnChecker idnChecker,
       DownloadSchedule schedule,
-      DateTime now) {
+      Instant now) {
     ImmutableList.Builder<UnblockableDomain> nonBlockedDomains = new ImmutableList.Builder<>();
     ImmutableMap<LabelType, ImmutableList<BlockLabel>> labelsByType =
         ImmutableMap.copyOf(
@@ -134,7 +134,7 @@ public final class LabelDiffUpdates {
   }
 
   static ImmutableList<UnblockableDomain> tallyUnblockableDomainsForNewLabels(
-      ImmutableList<BlockLabel> labels, IdnChecker idnChecker, DateTime now) {
+      ImmutableList<BlockLabel> labels, IdnChecker idnChecker, Instant now) {
     ImmutableList.Builder<UnblockableDomain> nonBlockedDomains = new ImmutableList.Builder<>();
 
     for (BlockLabel label : labels) {

core/src/main/java/google/registry/bsa/persistence/Queries.java

@@ -19,19 +19,16 @@ import static com.google.common.collect.ImmutableList.toImmutableList;
 import static google.registry.bsa.BsaStringUtils.DOMAIN_SPLITTER;
 import static google.registry.bsa.BsaTransactions.bsaQuery;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static org.joda.time.DateTimeZone.UTC;
 
 import com.google.common.collect.ImmutableCollection;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import google.registry.bsa.api.UnblockableDomain;
-import google.registry.model.CreateAutoTimestamp;
 import java.time.Instant;
 import java.util.List;
 import java.util.Optional;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
-import org.joda.time.DateTime;
 
 /** Helpers for querying BSA JPA entities. */
 public final class Queries {
@@ -135,15 +132,15 @@ public final class Queries {
   }
 
   static ImmutableSet<String> queryNewlyCreatedDomains(
-      ImmutableCollection<String> tlds, DateTime minCreationTime, DateTime now) {
+      ImmutableCollection<String> tlds, Instant minCreationTime, Instant now) {
     return ImmutableSet.copyOf(
         tm().getEntityManager()
             .createQuery(
-                "SELECT domainName FROM Domain WHERE creationTime >= :minCreationTime "
+                "SELECT domainName FROM Domain WHERE creationTime.creationTime >= :minCreationTime "
                     + "AND deletionTime > :now "
                     + "AND tld in (:tlds)",
                 String.class)
-            .setParameter("minCreationTime", CreateAutoTimestamp.create(minCreationTime))
+            .setParameter("minCreationTime", minCreationTime)
             .setParameter("now", now)
             .setParameter("tlds", tlds)
             .getResultList());
@@ -156,44 +153,36 @@ public final class Queries {
    * @return The missing unblockables and their creation and deletion time.
    */
   public static ImmutableList<DomainLifeSpan> queryMissedRegisteredUnblockables(
-      String tld, DateTime now) {
+      String tld, Instant now) {
     String sqlTemplate =
         """
-    SELECT l.domain_name, creation_time, deletion_time
-    FROM
-        (SELECT d.domain_name, d.creation_time, d.deletion_time
-         FROM
-             "Domain" d
-         JOIN
-             (SELECT concat(label, '.', :tld) AS domain_name from "BsaLabel") b
-         ON b.domain_name = d.domain_name
-         WHERE deletion_time > :now) l
-    LEFT OUTER JOIN
-        (SELECT concat(label, '.', tld) as domain_name
-         FROM "BsaUnblockableDomain"
-         WHERE tld = :tld and reason = 'REGISTERED') r
-    ON l.domain_name = r.domain_name
-    WHERE r.domain_name is null;
-    """;
+        SELECT l.domain_name, creation_time, deletion_time
+        FROM
+            (SELECT d.domain_name, d.creation_time, d.deletion_time
+             FROM
+                 "Domain" d
+             JOIN
+                 (SELECT concat(label, '.', :tld) AS domain_name from "BsaLabel") b
+             ON b.domain_name = d.domain_name
+             WHERE deletion_time > :now) l
+        LEFT OUTER JOIN
+            (SELECT concat(label, '.', tld) as domain_name
+             FROM "BsaUnblockableDomain"
+             WHERE tld = :tld and reason = 'REGISTERED') r
+        ON l.domain_name = r.domain_name
+        WHERE r.domain_name is null;
+        """;
 
     return ((Stream<?>)
             tm().getEntityManager()
                 .createNativeQuery(sqlTemplate)
                 .setParameter("tld", tld)
-                .setParameter("now", Instant.ofEpochMilli(now.getMillis()))
+                .setParameter("now", now)
                 .getResultStream())
         .map(Object[].class::cast)
-        .map(
-            row ->
-                new DomainLifeSpan(
-                    (String) row[0], toDateTime((Instant) row[1]), toDateTime((Instant) row[2])))
+        .map(row -> new DomainLifeSpan((String) row[0], (Instant) row[1], (Instant) row[2]))
         .collect(toImmutableList());
   }
 
-  // For testing convenience: 'assertEquals' fails between `new DateTime(timestamp)` and below.
-  static DateTime toDateTime(Instant timestamp) {
-    return new DateTime(timestamp.toEpochMilli(), UTC);
-  }
-
-  public record DomainLifeSpan(String domainName, DateTime creationTime, DateTime deletionTime) {}
+  public record DomainLifeSpan(String domainName, Instant creationTime, Instant deletionTime) {}
 }

core/src/main/java/google/registry/bsa/persistence/RefreshSchedule.java

@@ -19,7 +19,7 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 
 import com.google.errorprone.annotations.CanIgnoreReturnValue;
 import google.registry.bsa.RefreshStage;
-import org.joda.time.DateTime;
+import java.time.Instant;
 
 /**
  * Information needed when handling a domain refresh.
@@ -28,10 +28,10 @@ import org.joda.time.DateTime;
  */
 public record RefreshSchedule(
     long jobId,
-    DateTime jobCreationTime,
+    Instant jobCreationTime,
     String jobName,
     RefreshStage stage,
-    DateTime prevRefreshTime) {
+    Instant prevRefreshTime) {
 
   /** Updates the current job to the new stage. */
   @CanIgnoreReturnValue
@@ -50,7 +50,7 @@ public record RefreshSchedule(
             });
   }
 
-  static RefreshSchedule create(BsaDomainRefresh job, DateTime prevJobCreationTime) {
+  static RefreshSchedule create(BsaDomainRefresh job, Instant prevJobCreationTime) {
     return new RefreshSchedule(
         job.getJobId(),
         job.getCreationTime(),

core/src/main/java/google/registry/bsa/persistence/RefreshScheduler.java

@@ -20,8 +20,8 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableList;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /** Assigns work for each cron invocation of domain refresh job. */
 public class RefreshScheduler {
@@ -56,7 +56,7 @@ public class RefreshScheduler {
                 return Optional.empty();
               }
 
-              DateTime prevDownloadTime = mostRecentDownload.get().getCreationTime();
+              Instant prevDownloadTime = mostRecentDownload.get().getCreationTime();
               if (recentJobs.isEmpty()) {
                 return Optional.of(scheduleNewJob(prevDownloadTime));
               } else {
@@ -65,13 +65,13 @@ public class RefreshScheduler {
             });
   }
 
-  RefreshSchedule scheduleNewJob(DateTime prevRefreshTime) {
+  RefreshSchedule scheduleNewJob(Instant prevRefreshTime) {
     BsaDomainRefresh newJob = new BsaDomainRefresh();
     tm().insert(newJob);
     return RefreshSchedule.create(newJob, prevRefreshTime);
   }
 
-  RefreshSchedule rescheduleOngoingJob(BsaDomainRefresh ongoingJob, DateTime prevJobStartTime) {
+  RefreshSchedule rescheduleOngoingJob(BsaDomainRefresh ongoingJob, Instant prevJobStartTime) {
     return RefreshSchedule.create(ongoingJob, prevJobStartTime);
   }
 

core/src/main/java/google/registry/cache/CacheModule.java

@@ -0,0 +1,167 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import static com.google.common.collect.ImmutableList.toImmutableList;
+import static com.google.common.collect.ImmutableSet.toImmutableSet;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Iterables;
+import dagger.Module;
+import dagger.Provides;
+import google.registry.config.CredentialModule.ApplicationDefaultCredential;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.model.EppResource;
+import google.registry.model.ForeignKeyUtils;
+import google.registry.model.domain.Domain;
+import google.registry.model.host.Host;
+import google.registry.persistence.VKey;
+import google.registry.util.Clock;
+import google.registry.util.GoogleCredentialsBundle;
+import jakarta.inject.Singleton;
+import java.io.ByteArrayInputStream;
+import java.nio.charset.StandardCharsets;
+import java.security.GeneralSecurityException;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.util.Optional;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLSocketFactory;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509TrustManager;
+import redis.clients.jedis.DefaultJedisClientConfig;
+import redis.clients.jedis.HostAndPort;
+import redis.clients.jedis.Jedis;
+import redis.clients.jedis.JedisClientConfig;
+import redis.clients.jedis.RedisClient;
+import redis.clients.jedis.RedisClusterClient;
+import redis.clients.jedis.UnifiedJedis;
+
+/** Dagger module to provide the {@link Jedis}-based cache for Valkey. */
+@Module
+public final class CacheModule {
+
+  @Provides
+  @Singleton
+  public static Optional<UnifiedJedis> provideJedis(
+      @ApplicationDefaultCredential GoogleCredentialsBundle credentialsBundle,
+      @Config("valkeyHostsAndPorts") Optional<ImmutableList<String>> valkeyHostsAndPorts,
+      @Config("valkeySslSocketFactory") SSLSocketFactory valkeySslSocketFactory) {
+    if (valkeyHostsAndPorts.map(ImmutableList::isEmpty).orElse(true)) {
+      return Optional.empty();
+    }
+    ImmutableSet<HostAndPort> hostsAndPorts =
+        valkeyHostsAndPorts.get().stream().map(HostAndPort::from).collect(toImmutableSet());
+    JedisClientConfig clientConfig =
+        DefaultJedisClientConfig.builder()
+            .ssl(true)
+            .sslSocketFactory(valkeySslSocketFactory)
+            .credentialsProvider(new ValkeyCredentialsProvider(credentialsBundle))
+            .build();
+    if (hostsAndPorts.size() > 1) {
+      return Optional.of(
+          RedisClusterClient.builder().clientConfig(clientConfig).nodes(hostsAndPorts).build());
+    }
+    return Optional.of(
+        RedisClient.builder()
+            .clientConfig(clientConfig)
+            .hostAndPort(Iterables.getOnlyElement(hostsAndPorts))
+            .build());
+  }
+
+  @Provides
+  @Singleton
+  public static Optional<SimplifiedJedisClient> provideJedisClient(Optional<UnifiedJedis> jedis) {
+    return jedis.map(SimplifiedJedisClient::new);
+  }
+
+  @Provides
+  @Singleton
+  public static DomainCache provideDomainCache(
+      Optional<SimplifiedJedisClient> domainJedisClient, Clock clock) {
+    if (domainJedisClient.isEmpty()) {
+      return domainName ->
+          ForeignKeyUtils.loadResourceByCache(Domain.class, domainName, clock.now());
+    }
+    return new MultilayerDomainCache(domainJedisClient.get(), clock);
+  }
+
+  @Provides
+  @Singleton
+  public static HostCache provideHostCache(Optional<SimplifiedJedisClient> hostJedisClient) {
+    if (hostJedisClient.isEmpty()) {
+      return repoId ->
+          Optional.ofNullable(EppResource.loadByCache(VKey.create(Host.class, repoId)));
+    }
+    return new MultilayerHostCache(hostJedisClient.get());
+  }
+
+  @Provides
+  @Singleton
+  @Config("valkeySslSocketFactory")
+  static SSLSocketFactory provideValkeySslSocketFactory(
+      @Config("valkeyCertificateAuthority") String valkeyCertificateAuthority) {
+    try {
+      ImmutableList<X509Certificate> trustedCerts =
+          CertificateFactory.getInstance("X.509")
+              .generateCertificates(
+                  new ByteArrayInputStream(
+                      valkeyCertificateAuthority.getBytes(StandardCharsets.UTF_8)))
+              .stream()
+              .map(X509Certificate.class::cast)
+              .collect(toImmutableList());
+
+      // This is a roundabout way to trust the Cloud Memorystore-issued certificate authority even
+      // though it's not a root cert (it's an intermediate cert).
+      TrustManager x509TrustManager =
+          new X509TrustManager() {
+            @Override
+            public X509Certificate[] getAcceptedIssuers() {
+              return trustedCerts.toArray(new X509Certificate[0]);
+            }
+
+            @Override
+            public void checkClientTrusted(X509Certificate[] certs, String authType) {}
+
+            @Override
+            public void checkServerTrusted(X509Certificate[] certs, String authType)
+                throws CertificateException {
+              Exception lastException = null;
+              for (X509Certificate cert : certs) {
+                for (X509Certificate trustedCert : trustedCerts) {
+                  try {
+                    cert.verify(trustedCert.getPublicKey());
+                    return;
+                  } catch (Exception e) {
+                    // Verification failed, try the next one
+                    lastException = e;
+                  }
+                }
+              }
+              throw new CertificateException(
+                  "None of the server certificates were signed by the provided CA", lastException);
+            }
+          };
+
+      SSLContext sslContext = SSLContext.getInstance("TLS");
+      sslContext.init(null, new TrustManager[] {x509TrustManager}, null);
+      return sslContext.getSocketFactory();
+    } catch (GeneralSecurityException e) {
+      throw new RuntimeException("Could not create X.509 certificate from provided PEM", e);
+    }
+  }
+}

core/src/main/java/google/registry/cache/DomainCache.java

@@ -0,0 +1,23 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import google.registry.model.domain.Domain;
+import java.util.Optional;
+
+/** Interface for some type of cache that loads {@link Domain}s by domain name. */
+public interface DomainCache {
+  Optional<Domain> loadByDomainName(String domainName);
+}

core/src/main/java/google/registry/cache/HostCache.java

@@ -0,0 +1,23 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import google.registry.model.host.Host;
+import java.util.Optional;
+
+/** Interface for some type of cache that loads {@link Host}s by repo ID. */
+public interface HostCache {
+  Optional<Host> loadByRepoId(String repoId);
+}

core/src/main/java/google/registry/cache/MultilayerDomainCache.java

@@ -0,0 +1,63 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import com.google.common.collect.ImmutableList;
+import google.registry.model.ForeignKeyUtils;
+import google.registry.model.domain.Domain;
+import google.registry.model.tld.Tld;
+import google.registry.util.Clock;
+import java.time.Instant;
+import java.util.Optional;
+
+/**
+ * A multi-layer cache for {@link Domain} objects.
+ *
+ * <p>It uses a local Caffeine cache, a remote Jedis cache, and finally the database.
+ */
+public class MultilayerDomainCache extends MultilayerEppResourceCache<Domain>
+    implements DomainCache {
+
+  private final Clock clock;
+
+  public MultilayerDomainCache(SimplifiedJedisClient jedisClient, Clock clock) {
+    super(jedisClient);
+    this.clock = clock;
+  }
+
+  @Override
+  public Optional<Domain> loadByDomainName(String domainName) {
+    return loadFromCaches(Domain.class, domainName);
+  }
+
+  @Override
+  protected Optional<Domain> loadFromDatabase(String domainName) {
+    // Don't use the cache (avoid caching the same domain twice). Do use the replica SQL instance.
+    Optional<Domain> possibleDomain =
+        Optional.ofNullable(
+            ForeignKeyUtils.loadMostRecentResourceObjects(
+                    Domain.class, ImmutableList.of(domainName), true)
+                .get(domainName));
+    Instant now = clock.now();
+    return possibleDomain
+        .filter(domain -> now.isBefore(domain.getDeletionTime()))
+        .map(domain -> domain.cloneProjectedAtTime(now));
+  }
+
+  @Override
+  protected boolean shouldPersistToRemoteCache(Domain domain) {
+    return Tld.get(domain.getTld()).getTldType().equals(Tld.TldType.REAL);
+  }
+}

core/src/main/java/google/registry/cache/MultilayerEppResourceCache.java

@@ -0,0 +1,76 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
+import google.registry.config.RegistryConfig;
+import google.registry.model.EppResource;
+import java.time.Duration;
+import java.util.Optional;
+
+/**
+ * A multi-layer cache for {@link EppResource}s.
+ *
+ * <p>It uses a local Caffeine cache, a remote Jedis cache, and finally the database.
+ */
+public abstract class MultilayerEppResourceCache<V extends EppResource> {
+
+  // Don't use a loading cache; it'd complicate the nesting
+  private final Cache<String, V> localCache =
+      Caffeine.newBuilder()
+          .expireAfterWrite(Duration.ofHours(1))
+          .maximumSize(RegistryConfig.getEppResourceMaxCachedEntries())
+          .build();
+
+  private final SimplifiedJedisClient jedisClient;
+
+  protected MultilayerEppResourceCache(SimplifiedJedisClient jedisClient) {
+    this.jedisClient = jedisClient;
+  }
+
+  protected abstract Optional<V> loadFromDatabase(String key);
+
+  protected boolean shouldPersistToRemoteCache(V value) {
+    return true;
+  }
+
+  protected Optional<V> loadFromCaches(Class<V> clazz, String key) {
+    // hopefully the resource is in the local cache
+    Optional<V> possibleValue = Optional.ofNullable(localCache.getIfPresent(key));
+    if (possibleValue.isPresent()) {
+      return possibleValue;
+    }
+
+    // if not, try the remote cache
+    possibleValue = jedisClient.get(clazz, key);
+    if (possibleValue.isPresent()) {
+      localCache.put(key, possibleValue.get());
+      return possibleValue;
+    }
+
+    // lastly, try the DB
+    return loadFromDatabase(key)
+        .map(
+            v -> {
+              // Optional has no direct "peek" functionality to fill the caches
+              if (shouldPersistToRemoteCache(v)) {
+                jedisClient.set(new SimplifiedJedisClient.JedisResource<>(key, v));
+              }
+              localCache.put(key, v);
+              return v;
+            });
+  }
+}

core/src/main/java/google/registry/cache/MultilayerHostCache.java

@@ -0,0 +1,44 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import static google.registry.persistence.transaction.TransactionManagerFactory.replicaTm;
+
+import google.registry.model.host.Host;
+import google.registry.persistence.VKey;
+import java.util.Optional;
+
+/**
+ * A multi-layer cache for {@link Host} objects.
+ *
+ * <p>It uses a local Caffeine cache, a remote Jedis cache, and finally the database.
+ */
+public class MultilayerHostCache extends MultilayerEppResourceCache<Host> implements HostCache {
+
+  public MultilayerHostCache(SimplifiedJedisClient jedisClient) {
+    super(jedisClient);
+  }
+
+  @Override
+  public Optional<Host> loadByRepoId(String repoId) {
+    return loadFromCaches(Host.class, repoId);
+  }
+
+  @Override
+  protected Optional<Host> loadFromDatabase(String repoId) {
+    return replicaTm()
+        .transact(() -> replicaTm().loadByKeyIfPresent(VKey.create(Host.class, repoId)));
+  }
+}

core/src/main/java/google/registry/cache/SimplifiedJedisClient.java

@@ -0,0 +1,154 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Preconditions.checkNotNull;
+
+import com.google.common.collect.ImmutableCollection;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.Iterables;
+import com.google.common.collect.Streams;
+import com.google.common.flogger.FluentLogger;
+import google.registry.model.EppResource;
+import google.registry.model.domain.Domain;
+import google.registry.model.host.Host;
+import io.protostuff.LinkedBuffer;
+import io.protostuff.ProtostuffIOUtil;
+import io.protostuff.Schema;
+import io.protostuff.runtime.RuntimeSchema;
+import java.nio.charset.StandardCharsets;
+import java.util.Optional;
+import redis.clients.jedis.AbstractPipeline;
+import redis.clients.jedis.UnifiedJedis;
+import redis.clients.jedis.params.SetParams;
+
+/**
+ * A {@link UnifiedJedis} client that handles serialization/deserialization.
+ *
+ * <p>We use protobufs for serialization to handle the immutable collections that our objects use.
+ *
+ * <p>{@link UnifiedJedis} pairs key-value types, so we need the key to be serialized to a byte
+ * array as well.
+ */
+public class SimplifiedJedisClient {
+
+  public record JedisResource<V extends EppResource>(String key, V value) {}
+
+  private static final ImmutableMap<Class<? extends EppResource>, String> TYPE_PREFIXES =
+      ImmutableMap.of(
+          Domain.class, "d_",
+          Host.class, "h_");
+
+  private static final ImmutableMap<Class<? extends EppResource>, Schema<? extends EppResource>>
+      VALUE_SCHEMAS =
+          ImmutableMap.of(
+              Domain.class, RuntimeSchema.getSchema(Domain.class),
+              Host.class, RuntimeSchema.getSchema(Host.class));
+
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  private static final int BATCH_SIZE = 500;
+
+  private final UnifiedJedis jedis;
+
+  SimplifiedJedisClient(UnifiedJedis jedis) {
+    this.jedis = jedis;
+  }
+
+  /** Gets the value from the remote cache. Returns null if it does not exist. */
+  public <V extends EppResource> Optional<V> get(Class<V> clazz, String key) {
+    checkNotNull(key, "Key cannot be null");
+    byte[] data = jedis.get(convertKey(clazz, key));
+    return Optional.ofNullable(data).map(d -> deserialize(clazz, d));
+  }
+
+  /** Sets the value in the remote cache. */
+  public <V extends EppResource> void set(JedisResource<V> resource) {
+    checkNotNull(resource.key, "Key cannot be null");
+    checkNotNull(resource.value, "Value cannot be null");
+    jedis.set(
+        convertKey(resource.value.getClass(), resource.key),
+        serialize(resource.value),
+        new SetParams().pxAt(resource.value.getDeletionTime().toEpochMilli()));
+  }
+
+  /** Sets multiple values in the remote cache using a Jedis {@link AbstractPipeline}. */
+  public <V extends EppResource> void setAll(ImmutableCollection<JedisResource<V>> resources) {
+    logger.atInfo().log("Processing %d resources", resources.size());
+    for (Iterable<JedisResource<V>> batch : Iterables.partition(resources, BATCH_SIZE)) {
+      try (AbstractPipeline pipeline = jedis.pipelined()) {
+        batch.forEach(
+            resource ->
+                pipeline.set(
+                    convertKey(resource.value.getClass(), resource.key),
+                    serialize(resource.value),
+                    new SetParams().pxAt(resource.value.getDeletionTime().toEpochMilli())));
+        pipeline.sync();
+      }
+    }
+  }
+
+  /**
+   * Deletes all values associated with the given keys in Valkey.
+   *
+   * <p>If any given key does not exist, it does nothing.
+   *
+   * <p>Note: we use {@code unlink} here instead of {@code del} so that the actual deletion can
+   * happen in the background whenever the server wants. The keys are removed from the namespace
+   * immediately, and we don't need the memory to be reclaimed this instant.
+   *
+   * <p>This could also be accomplished by using {@link #setAll(ImmutableCollection)} with
+   * expiration times that are in the past, but this is clearer.
+   */
+  public void deleteAll(Class<?> valueType, ImmutableCollection<String> keys) {
+    // we use a reasonably small batch size to avoid overwhelming the network
+    for (Iterable<String> batch : Iterables.partition(keys, BATCH_SIZE)) {
+      byte[][] keysToUnlink =
+          Streams.stream(batch).map(key -> convertKey(valueType, key)).toArray(byte[][]::new);
+      jedis.unlink(keysToUnlink);
+    }
+  }
+
+  private <V extends EppResource> byte[] serialize(V value) {
+    @SuppressWarnings("unchecked")
+    Schema<V> valueSchema = (Schema<V>) getValueSchema(value.getClass());
+    LinkedBuffer buffer = LinkedBuffer.allocate(LinkedBuffer.DEFAULT_BUFFER_SIZE);
+    try {
+      return ProtostuffIOUtil.toByteArray(value, valueSchema, buffer);
+    } finally {
+      buffer.clear();
+    }
+  }
+
+  private <V extends EppResource> V deserialize(Class<V> clazz, byte[] data) {
+    // We use protobufs because other deserializers don't play nicely with immutable collections
+    Schema<V> valueSchema = getValueSchema(clazz);
+    V value = valueSchema.newMessage();
+    ProtostuffIOUtil.mergeFrom(data, value, valueSchema);
+    return value;
+  }
+
+  private byte[] convertKey(Class<?> clazz, String key) {
+    checkArgument(TYPE_PREFIXES.containsKey(clazz), "Unknown class type %s", clazz);
+    return (TYPE_PREFIXES.get(clazz) + key).getBytes(StandardCharsets.UTF_8);
+  }
+
+  @SuppressWarnings("unchecked")
+  private <V extends EppResource> Schema<V> getValueSchema(Class<V> clazz) {
+    checkArgument(VALUE_SCHEMAS.containsKey(clazz), "Unknown class type %s", clazz);
+    return (Schema<V>) VALUE_SCHEMAS.get(clazz);
+  }
+}

core/src/main/java/google/registry/cache/ValkeyCredentialsProvider.java

@@ -0,0 +1,46 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import com.google.auth.oauth2.GoogleCredentials;
+import google.registry.util.GoogleCredentialsBundle;
+import java.io.IOException;
+import java.util.function.Supplier;
+import redis.clients.jedis.DefaultRedisCredentials;
+import redis.clients.jedis.RedisCredentials;
+
+public class ValkeyCredentialsProvider implements Supplier<RedisCredentials> {
+
+  private static final String MEMORYSTORE_AUTH_SCOPE =
+      "https://www.googleapis.com/auth/cloud-platform";
+
+  private final GoogleCredentials credentials;
+
+  public ValkeyCredentialsProvider(GoogleCredentialsBundle credentialsBundle) {
+    this.credentials =
+        credentialsBundle.getGoogleCredentials().createScoped(MEMORYSTORE_AUTH_SCOPE);
+  }
+
+  @Override
+  public RedisCredentials get() {
+    try {
+      credentials.refreshIfExpired();
+    } catch (IOException e) {
+      throw new RuntimeException("Unable to refresh IAM token for Memorystore", e);
+    }
+    String token = credentials.getAccessToken().getTokenValue();
+    return new DefaultRedisCredentials(null, token);
+  }
+}

core/src/main/java/google/registry/config/DelegatedCredentials.java

@@ -131,7 +131,7 @@ public class DelegatedCredentials extends GoogleCredentials {
       Clock clock,
       Duration tokenRefreshDelay) {
     checkArgument(
-        tokenRefreshDelay.getSeconds() <= MAX_TOKEN_REFRESH_DELAY.getSeconds(),
+        tokenRefreshDelay.toSeconds() <= MAX_TOKEN_REFRESH_DELAY.toSeconds(),
         "Max refresh delay must not exceed %s.",
         MAX_TOKEN_REFRESH_DELAY);
 
@@ -206,7 +206,7 @@ public class DelegatedCredentials extends GoogleCredentials {
     JsonWebToken.Payload payload = new JsonWebToken.Payload();
     payload.setIssuer(this.delegatedServiceAccountUser);
     payload.setIssuedAtTimeSeconds(currentTime / 1000);
-    payload.setExpirationTimeSeconds(currentTime / 1000 + tokenRefreshDelay.getSeconds());
+    payload.setExpirationTimeSeconds(currentTime / 1000 + tokenRefreshDelay.toSeconds());
     payload.setSubject(delegatingUserEmail);
     payload.put("scope", Joiner.on(' ').join(scopes));
     payload.setAudience(DEFAULT_TOKEN_URI);
@@ -241,10 +241,10 @@ public class DelegatedCredentials extends GoogleCredentials {
     if (value == null) {
       throw new IOException(String.format(VALUE_NOT_FOUND_MESSAGE, errorPrefix, key));
     }
-    if (!(value instanceof String)) {
+    if (!(value instanceof String string)) {
       throw new IOException(String.format(VALUE_WRONG_TYPE_MESSAGE, errorPrefix, "string", key));
     }
-    return (String) value;
+    return string;
   }
 
   /** Return the specified integer from JSON or throw a helpful error message. */
@@ -257,9 +257,9 @@ public class DelegatedCredentials extends GoogleCredentials {
     if (value instanceof BigDecimal bigDecimalValue) {
       return bigDecimalValue.intValueExact();
     }
-    if (!(value instanceof Integer)) {
+    if (!(value instanceof Integer i)) {
       throw new IOException(String.format(VALUE_WRONG_TYPE_MESSAGE, errorPrefix, "integer", key));
     }
-    return (Integer) value;
+    return i;
   }
 }

core/src/main/java/google/registry/config/RegistryConfig.java

@@ -225,7 +225,7 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("databaseRetention")
-    public static Duration provideDatabaseRetention() {
+    public static java.time.Duration provideDatabaseRetention() {
       return getDatabaseRetention();
     }
 
@@ -281,8 +281,8 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("brdaInterval")
-    public static Duration provideBrdaInterval() {
-      return Duration.standardDays(7);
+    public static java.time.Duration provideBrdaInterval() {
+      return java.time.Duration.ofDays(7);
     }
 
     /**
@@ -315,8 +315,8 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("publishDnsUpdatesLockDuration")
-    public static Duration providePublishDnsUpdatesLockDuration() {
-      return Duration.standardMinutes(3);
+    public static java.time.Duration providePublishDnsUpdatesLockDuration() {
+      return java.time.Duration.ofMinutes(3);
     }
 
     /**
@@ -343,8 +343,8 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("readDnsRefreshRequestsActionRuntime")
-    public static Duration provideReadDnsRefreshRequestsRuntime() {
-      return Duration.standardSeconds(45);
+    public static java.time.Duration provideReadDnsRefreshRequestsRuntime() {
+      return java.time.Duration.ofSeconds(45);
     }
 
     /**
@@ -354,8 +354,8 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("dnsDefaultATtl")
-    public static Duration provideDnsDefaultATtl() {
-      return Duration.standardHours(1);
+    public static java.time.Duration provideDnsDefaultATtl() {
+      return java.time.Duration.ofHours(1);
     }
 
     /**
@@ -365,8 +365,8 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("dnsDefaultNsTtl")
-    public static Duration provideDnsDefaultNsTtl() {
-      return Duration.standardHours(3);
+    public static java.time.Duration provideDnsDefaultNsTtl() {
+      return java.time.Duration.ofHours(3);
     }
 
     /**
@@ -376,8 +376,8 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("dnsDefaultDsTtl")
-    public static Duration provideDnsDefaultDsTtl() {
-      return Duration.standardHours(1);
+    public static java.time.Duration provideDnsDefaultDsTtl() {
+      return java.time.Duration.ofHours(1);
     }
 
     @Provides
@@ -757,8 +757,8 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("rdeInterval")
-    public static Duration provideRdeInterval() {
-      return Duration.standardDays(1);
+    public static java.time.Duration provideRdeInterval() {
+      return java.time.Duration.ofDays(1);
     }
 
     /**
@@ -768,8 +768,8 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("rdeReportLockTimeout")
-    public static Duration provideRdeReportLockTimeout() {
-      return Duration.standardMinutes(1);
+    public static java.time.Duration provideRdeReportLockTimeout() {
+      return java.time.Duration.ofMinutes(1);
     }
 
     /**
@@ -792,8 +792,8 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("rdeUploadLockTimeout")
-    public static Duration provideRdeUploadLockTimeout() {
-      return Duration.standardMinutes(30);
+    public static java.time.Duration provideRdeUploadLockTimeout() {
+      return java.time.Duration.ofMinutes(30);
     }
 
     /**
@@ -805,8 +805,8 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("rdeUploadSftpCooldown")
-    public static Duration provideRdeUploadSftpCooldown() {
-      return Duration.standardHours(2);
+    public static java.time.Duration provideRdeUploadSftpCooldown() {
+      return java.time.Duration.ofHours(2);
     }
 
     /**
@@ -841,8 +841,8 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("sheetLockTimeout")
-    public static Duration provideSheetLockTimeout() {
-      return Duration.standardHours(1);
+    public static java.time.Duration provideSheetLockTimeout() {
+      return java.time.Duration.ofHours(1);
     }
 
     /**
@@ -865,8 +865,8 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("emailThrottleDuration")
-    public static Duration provideEmailThrottleSeconds(RegistryConfigSettings config) {
-      return Duration.standardSeconds(config.misc.emailThrottleSeconds);
+    public static java.time.Duration provideEmailThrottleSeconds(RegistryConfigSettings config) {
+      return java.time.Duration.ofSeconds(config.misc.emailThrottleSeconds);
     }
 
     /**
@@ -946,8 +946,8 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("sshTimeout")
-    public static Duration provideSshTimeout() {
-      return Duration.standardSeconds(30);
+    public static java.time.Duration provideSshTimeout() {
+      return java.time.Duration.ofSeconds(30);
     }
 
     /**
@@ -957,8 +957,8 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("transactionCooldown")
-    public static Duration provideTransactionCooldown() {
-      return Duration.standardMinutes(5);
+    public static java.time.Duration provideTransactionCooldown() {
+      return java.time.Duration.ofMinutes(5);
     }
 
     /**
@@ -1327,15 +1327,15 @@ public final class RegistryConfig {
 
     @Provides
     @Config("bsaLockLeaseExpiry")
-    public static Duration provideBsaLockLeaseExpiry(RegistryConfigSettings config) {
-      return Duration.standardMinutes(config.bsa.bsaLockLeaseExpiryMinutes);
+    public static java.time.Duration provideBsaLockLeaseExpiry(RegistryConfigSettings config) {
+      return java.time.Duration.ofMinutes(config.bsa.bsaLockLeaseExpiryMinutes);
     }
 
     /** Returns the desired interval between successive BSA downloads. */
     @Provides
     @Config("bsaDownloadInterval")
-    public static Duration provideBsaDownloadInterval(RegistryConfigSettings config) {
-      return Duration.standardMinutes(config.bsa.bsaDownloadIntervalMinutes);
+    public static java.time.Duration provideBsaDownloadInterval(RegistryConfigSettings config) {
+      return java.time.Duration.ofMinutes(config.bsa.bsaDownloadIntervalMinutes);
     }
 
     /**
@@ -1344,8 +1344,8 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("bsaMaxNopInterval")
-    public static Duration provideBsaMaxNopInterval(RegistryConfigSettings config) {
-      return Duration.standardHours(config.bsa.bsaMaxNopIntervalHours);
+    public static java.time.Duration provideBsaMaxNopInterval(RegistryConfigSettings config) {
+      return java.time.Duration.ofHours(config.bsa.bsaMaxNopIntervalHours);
     }
 
     @Provides
@@ -1356,14 +1356,16 @@ public final class RegistryConfig {
 
     @Provides
     @Config("domainCreateTxnCommitTimeLag")
-    public static Duration provideDomainCreateTxnCommitTimeLag(RegistryConfigSettings config) {
-      return Duration.standardSeconds(config.bsa.domainCreateTxnCommitTimeLagSeconds);
+    public static java.time.Duration provideDomainCreateTxnCommitTimeLag(
+        RegistryConfigSettings config) {
+      return java.time.Duration.ofSeconds(config.bsa.domainCreateTxnCommitTimeLagSeconds);
     }
 
     @Provides
     @Config("bsaValidationMaxStaleness")
-    public static Duration provideBsaValidationMaxStaleness(RegistryConfigSettings config) {
-      return Duration.standardSeconds(config.bsa.bsaValidationMaxStalenessSeconds);
+    public static java.time.Duration provideBsaValidationMaxStaleness(
+        RegistryConfigSettings config) {
+      return java.time.Duration.ofSeconds(config.bsa.bsaValidationMaxStalenessSeconds);
     }
 
     @Provides
@@ -1374,8 +1376,8 @@ public final class RegistryConfig {
 
     @Provides
     @Config("bsaAuthTokenExpiry")
-    public static Duration provideBsaAuthTokenExpiry(RegistryConfigSettings config) {
-      return Duration.standardSeconds(config.bsa.authTokenExpirySeconds);
+    public static java.time.Duration provideBsaAuthTokenExpiry(RegistryConfigSettings config) {
+      return java.time.Duration.ofSeconds(config.bsa.authTokenExpirySeconds);
     }
 
     @Provides
@@ -1463,6 +1465,14 @@ public final class RegistryConfig {
       return config.mosapi.tldThreadCount;
     }
 
+    @Provides
+    @Config("valkeyHostsAndPorts")
+    public static Optional<ImmutableList<String>> provideValkeyHostsAndPorts(
+        RegistryConfigSettings config) {
+      return Optional.ofNullable(config.valkey)
+          .map(valkey -> ImmutableList.copyOf(valkey.hostsAndPorts));
+    }
+
     private static String formatComments(String text) {
       return Splitter.on('\n').omitEmptyStrings().trimResults().splitToList(text).stream()
           .map(s -> "# " + s)
@@ -1480,8 +1490,8 @@ public final class RegistryConfig {
    *
    * @see google.registry.tools.server.GenerateZoneFilesAction
    */
-  public static Duration getDatabaseRetention() {
-    return Duration.standardDays(30);
+  public static java.time.Duration getDatabaseRetention() {
+    return java.time.Duration.ofDays(30);
   }
 
   public static boolean areServersLocal() {

core/src/main/java/google/registry/config/RegistryConfigSettings.java

@@ -43,6 +43,7 @@ public class RegistryConfigSettings {
   public BulkPricingPackageMonitoring bulkPricingPackageMonitoring;
   public Bsa bsa;
   public MosApi mosapi;
+  public Valkey valkey;
 
   /** Configuration options that apply to the entire GCP project. */
   public static class GcpProject {
@@ -267,4 +268,9 @@ public class RegistryConfigSettings {
     public List<String> services;
     public int tldThreadCount;
   }
+
+  /** Configuration for Valkey caching. */
+  public static class Valkey {
+    public List<String> hostsAndPorts;
+  }
 }

core/src/main/java/google/registry/config/files/default-config.yaml

@@ -639,3 +639,7 @@ mosapi:
   # ICANN MoSAPI Specification, Section 12.3</a>
   tldThreadCount: 4
 
+valkey:
+  # Optional: hosts and ports for remote Valkey caching, e.g.
+  # - "127.0.0.1:6379"
+  hostsAndPorts: []

core/src/main/java/google/registry/dns/DnsMetrics.java

@@ -26,7 +26,7 @@ import com.google.monitoring.metrics.LabelDescriptor;
 import com.google.monitoring.metrics.MetricRegistryImpl;
 import google.registry.util.RegistryEnvironment;
 import jakarta.inject.Inject;
-import org.joda.time.Duration;
+import java.time.Duration;
 
 /** DNS instrumentation. */
 // TODO(b/67947699):Once load testing is done, revisit these to rename them and delete the ones that
@@ -239,15 +239,15 @@ public class DnsMetrics {
     int batchSize = numberOfDomains + numberOfHosts;
 
     processingTimePerCommitDist.record(
-        processingDuration.getMillis(), tld, status.name(), dnsWriter);
+        processingDuration.toMillis(), tld, status.name(), dnsWriter);
     processingTimePerItemDist.record(
-        processingDuration.getMillis(), batchSize, tld, status.name(), dnsWriter);
+        processingDuration.toMillis(), batchSize, tld, status.name(), dnsWriter);
 
     if (batchSize > 0) {
       normalizedProcessingTimePerCommitDist.record(
-          processingDuration.getMillis() / (double) batchSize, tld, status.name(), dnsWriter);
+          processingDuration.toMillis() / (double) batchSize, tld, status.name(), dnsWriter);
       normalizedProcessingTimePerItemDist.record(
-          processingDuration.getMillis() / (double) batchSize,
+          processingDuration.toMillis() / (double) batchSize,
           batchSize,
           tld,
           status.name(),
@@ -267,7 +267,7 @@ public class DnsMetrics {
       Duration timeSinceUpdateRequest,
       Duration timeSinceActionEnqueued) {
     updateRequestLatency.record(
-        timeSinceUpdateRequest.getMillis(), numberOfItems, tld, status.name(), dnsWriter);
-    publishQueueDelay.record(timeSinceActionEnqueued.getMillis(), tld, status.name(), dnsWriter);
+        timeSinceUpdateRequest.toMillis(), numberOfItems, tld, status.name(), dnsWriter);
+    publishQueueDelay.record(timeSinceActionEnqueued.toMillis(), tld, status.name(), dnsWriter);
   }
 }

core/src/main/java/google/registry/dns/DnsModule.java

@@ -32,9 +32,9 @@ import google.registry.dns.writer.DnsWriterZone;
 import google.registry.request.Parameter;
 import google.registry.request.RequestParameters;
 import jakarta.servlet.http.HttpServletRequest;
+import java.time.Instant;
 import java.util.Optional;
 import java.util.Set;
-import org.joda.time.DateTime;
 
 /** Dagger module for the dns package. */
 @Module
@@ -68,15 +68,15 @@ public abstract class DnsModule {
 
   @Provides
   @Parameter(PARAM_PUBLISH_TASK_ENQUEUED)
-  static DateTime provideCreateTime(HttpServletRequest req) {
-    return DateTime.parse(extractRequiredParameter(req, PARAM_PUBLISH_TASK_ENQUEUED));
+  static Instant provideCreateTime(HttpServletRequest req) {
+    return Instant.parse(extractRequiredParameter(req, PARAM_PUBLISH_TASK_ENQUEUED));
   }
 
   // TODO: Retire the old header after DNS pull queue migration.
   @Provides
   @Parameter(PARAM_REFRESH_REQUEST_TIME)
-  static DateTime provideItemsCreateTime(HttpServletRequest req) {
-    return DateTime.parse(
+  static Instant provideItemsCreateTime(HttpServletRequest req) {
+    return Instant.parse(
         extractOptionalParameter(req, "itemsCreated")
             .orElse(extractRequiredParameter(req, PARAM_REFRESH_REQUEST_TIME)));
   }

core/src/main/java/google/registry/dns/DnsUtils.java

@@ -17,6 +17,7 @@ package google.registry.dns;
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static google.registry.persistence.PersistenceModule.TransactionIsolationLevel.TRANSACTION_REPEATABLE_READ;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.util.DateTimeUtils.toJavaDuration;
 
 import com.google.common.collect.ImmutableCollection;
 import com.google.common.collect.ImmutableList;
@@ -24,10 +25,10 @@ import com.google.common.net.InternetDomainName;
 import google.registry.model.common.DnsRefreshRequest;
 import google.registry.model.tld.Tld;
 import google.registry.model.tld.Tlds;
+import java.time.Duration;
+import java.time.Instant;
 import java.util.Collection;
 import java.util.Optional;
-import org.joda.time.DateTime;
-import org.joda.time.Duration;
 
 /** Utility class to handle DNS refresh requests. */
 public final class DnsUtils {
@@ -42,13 +43,13 @@ public final class DnsUtils {
     // Throws an IllegalArgumentException if the name is not under a managed TLD -- we only update
     // DNS for names that are under our management.
     String tld = Tlds.findTldForNameOrThrow(InternetDomainName.from(name)).toString();
-    tm().insert(new DnsRefreshRequest(type, name, tld, tm().getTransactionTime().plus(delay)));
+    tm().insert(new DnsRefreshRequest(type, name, tld, tm().getTxTime().plus(delay)));
   }
 
   private static void requestDnsRefresh(
       ImmutableCollection<String> names, TargetType type, Duration delay) {
     tm().assertInTransaction();
-    DateTime requestTime = tm().getTransactionTime().plus(delay);
+    Instant requestTime = tm().getTxTime().plus(delay);
     tm().insertAll(
             names.stream()
                 .map(
@@ -103,7 +104,7 @@ public final class DnsUtils {
     return tm().transact(
             TRANSACTION_REPEATABLE_READ,
             () -> {
-              DateTime transactionTime = tm().getTransactionTime();
+              Instant transactionTime = tm().getTxTime();
               ImmutableList<DnsRefreshRequest> requests =
                   tm().query(
                           "FROM DnsRefreshRequest WHERE tld = :tld "
@@ -150,10 +151,10 @@ public final class DnsUtils {
     if (tldName.isPresent()) {
       Tld tld = Tld.get(tldName.get().toString());
       if (tld.getDnsAPlusAaaaTtl().isPresent()) {
-        dnsAPlusAaaaTtl = tld.getDnsAPlusAaaaTtl().get();
+        dnsAPlusAaaaTtl = toJavaDuration(tld.getDnsAPlusAaaaTtl().get());
       }
     }
-    return dnsAPlusAaaaTtl.getStandardSeconds();
+    return dnsAPlusAaaaTtl.toSeconds();
   }
 
   /** The possible values of the {@code DNS_TARGET_TYPE_PARAM} parameter. */

core/src/main/java/google/registry/dns/PublishDnsUpdatesAction.java

@@ -63,11 +63,11 @@ import google.registry.util.DomainNameUtils;
 import google.registry.util.EmailMessage;
 import jakarta.inject.Inject;
 import jakarta.mail.internet.InternetAddress;
+import java.time.Duration;
+import java.time.Instant;
 import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.Callable;
-import org.joda.time.DateTime;
-import org.joda.time.Duration;
 
 /** Task that sends domain and host updates to the DNS server. */
 @Action(
@@ -100,8 +100,8 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
    */
   private final String dnsWriter;
 
-  private final DateTime enqueuedTime;
-  private final DateTime itemsCreateTime;
+  private final Instant enqueuedTime;
+  private final Instant itemsCreateTime;
   private final int lockIndex;
   private final int numPublishLocks;
   private final Set<String> domains;
@@ -121,8 +121,8 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
   @Inject
   public PublishDnsUpdatesAction(
       @Parameter(PARAM_DNS_WRITER) String dnsWriter,
-      @Parameter(PARAM_PUBLISH_TASK_ENQUEUED) DateTime enqueuedTime,
-      @Parameter(PARAM_REFRESH_REQUEST_TIME) DateTime itemsCreateTime,
+      @Parameter(PARAM_PUBLISH_TASK_ENQUEUED) Instant enqueuedTime,
+      @Parameter(PARAM_REFRESH_REQUEST_TIME) Instant itemsCreateTime,
       @Parameter(PARAM_LOCK_INDEX) int lockIndex,
       @Parameter(PARAM_NUM_PUBLISH_LOCKS) int numPublishLocks,
       @Parameter(PARAM_DOMAINS) Set<String> domains,
@@ -167,15 +167,15 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
   }
 
   private void recordActionResult(ActionStatus status) {
-    DateTime now = clock.nowUtc();
+    Instant now = clock.now();
 
     dnsMetrics.recordActionResult(
         tld,
         dnsWriter,
         status,
         nullToEmpty(domains).size() + nullToEmpty(hosts).size(),
-        new Duration(itemsCreateTime, now),
-        new Duration(enqueuedTime, now));
+        Duration.between(itemsCreateTime, now),
+        Duration.between(enqueuedTime, now));
     logger.atInfo().log(
         "publishDnsWriter latency statistics: TLD: %s, dnsWriter: %s, actionStatus: %s, "
             + "numItems: %d, timeSinceCreation: %s, timeInQueue: %s.",
@@ -183,8 +183,8 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
         dnsWriter,
         status,
         nullToEmpty(domains).size() + nullToEmpty(hosts).size(),
-        new Duration(itemsCreateTime, now),
-        new Duration(enqueuedTime, now));
+        Duration.between(itemsCreateTime, now),
+        Duration.between(enqueuedTime, now));
   }
 
   /** Runs the task. */
@@ -237,7 +237,7 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
             .ifPresent(
                 dn -> {
                   Optional<Domain> domain =
-                      ForeignKeyUtils.loadResource(Domain.class, dn, clock.nowUtc());
+                      ForeignKeyUtils.loadResource(Domain.class, dn, clock.now());
                   if (domain.isPresent()) {
                     notifyWithEmailAboutDnsUpdateFailure(
                         domain.get().getCurrentSponsorRegistrarId(), dn, false);
@@ -250,8 +250,7 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
             .findFirst()
             .ifPresent(
                 hn -> {
-                  Optional<Host> host =
-                      ForeignKeyUtils.loadResource(Host.class, hn, clock.nowUtc());
+                  Optional<Host> host = ForeignKeyUtils.loadResource(Host.class, hn, clock.now());
                   if (host.isPresent()) {
                     notifyWithEmailAboutDnsUpdateFailure(
                         host.get().getPersistedCurrentSponsorRegistrarId(), hn, true);
@@ -336,7 +335,7 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
                 .put(PARAM_DNS_WRITER, dnsWriter)
                 .put(PARAM_LOCK_INDEX, Integer.toString(lockIndex))
                 .put(PARAM_NUM_PUBLISH_LOCKS, Integer.toString(numPublishLocks))
-                .put(PARAM_PUBLISH_TASK_ENQUEUED, clock.nowUtc().toString())
+                .put(PARAM_PUBLISH_TASK_ENQUEUED, clock.now().toString())
                 .put(PARAM_REFRESH_REQUEST_TIME, itemsCreateTime.toString())
                 .put(PARAM_DOMAINS, Joiner.on(",").join(domains))
                 .put(PARAM_HOSTS, Joiner.on(",").join(hosts))
@@ -374,7 +373,7 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
 
   /** Steps through the domain and host refreshes contained in the parameters and processes them. */
   private void processBatch() {
-    DateTime timeAtStart = clock.nowUtc();
+    Instant timeAtStart = clock.now();
 
     DnsWriter writer = dnsWriterProxy.getByClassNameForTld(dnsWriter, tld);
 
@@ -426,7 +425,7 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
       actionStatus = ActionStatus.SUCCESS;
     } finally {
       recordActionResult(actionStatus);
-      Duration duration = new Duration(timeAtStart, clock.nowUtc());
+      Duration duration = Duration.between(timeAtStart, clock.now());
       dnsMetrics.recordCommit(
           tld, dnsWriter, commitStatus, duration, domainsPublished, hostsPublished);
       logger.atInfo().log(

core/src/main/java/google/registry/dns/ReadDnsRefreshRequestsAction.java

@@ -28,7 +28,7 @@ import static google.registry.dns.DnsUtils.deleteRequests;
 import static google.registry.dns.DnsUtils.readAndUpdateRequestsWithLatestProcessTime;
 import static google.registry.request.Action.Method.POST;
 import static google.registry.request.RequestParameters.PARAM_TLD;
-import static google.registry.util.DateTimeUtils.END_OF_TIME;
+import static google.registry.util.DateTimeUtils.END_INSTANT;
 import static google.registry.util.DomainNameUtils.getSecondLevelDomain;
 import static java.nio.charset.StandardCharsets.UTF_8;
 
@@ -49,10 +49,10 @@ import google.registry.request.Parameter;
 import google.registry.request.auth.Auth;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Duration;
+import java.time.Instant;
 import java.util.Collection;
 import java.util.Optional;
-import org.joda.time.DateTime;
-import org.joda.time.Duration;
 
 /**
  * Action for fanning out DNS refresh tasks by TLD, using data taken from {@link DnsRefreshRequest}
@@ -104,11 +104,11 @@ public final class ReadDnsRefreshRequestsAction implements Runnable {
       logger.atInfo().log("The queue updated is paused for TLD: %s.", tld);
       return;
     }
-    DateTime requestedEndTime = clock.nowUtc().plus(requestedMaximumDuration);
+    Instant requestedEndTime = clock.now().plus(requestedMaximumDuration);
     // See getLockIndex(), requests are evenly distributed to [1, numDnsPublishLocks], so each
     // bucket would be roughly the size of tldUpdateBatchSize.
     int processBatchSize = tldUpdateBatchSize * Tld.get(tld).getNumDnsPublishLocks();
-    while (requestedEndTime.isAfter(clock.nowUtc())) {
+    while (requestedEndTime.isAfter(clock.now())) {
       ImmutableList<DnsRefreshRequest> requests =
           readAndUpdateRequestsWithLatestProcessTime(
               tld, requestedMaximumDuration, processBatchSize);
@@ -165,7 +165,7 @@ public final class ReadDnsRefreshRequestsAction implements Runnable {
   void enqueueUpdates(int lockIndex, int numPublishLocks, Collection<DnsRefreshRequest> requests) {
     ImmutableList.Builder<String> domainsBuilder = new ImmutableList.Builder<>();
     ImmutableList.Builder<String> hostsBuilder = new ImmutableList.Builder<>();
-    DateTime earliestRequestTime = END_OF_TIME;
+    Instant earliestRequestTime = END_INSTANT;
     for (DnsRefreshRequest request : requests) {
       if (request.getRequestTime().isBefore(earliestRequestTime)) {
         earliestRequestTime = request.getRequestTime();
@@ -189,7 +189,7 @@ public final class ReadDnsRefreshRequestsAction implements Runnable {
                   .put(PARAM_DNS_WRITER, dnsWriter)
                   .put(PARAM_LOCK_INDEX, Integer.toString(lockIndex))
                   .put(PARAM_NUM_PUBLISH_LOCKS, Integer.toString(numPublishLocks))
-                  .put(PARAM_PUBLISH_TASK_ENQUEUED, clock.nowUtc().toString())
+                  .put(PARAM_PUBLISH_TASK_ENQUEUED, clock.now().toString())
                   .put(PARAM_REFRESH_REQUEST_TIME, earliestRequestTime.toString())
                   .put(PARAM_DOMAINS, Joiner.on(',').join(domains))
                   .put(PARAM_HOSTS, Joiner.on(',').join(hosts))

core/src/main/java/google/registry/dns/RefreshDnsAction.java

@@ -78,7 +78,7 @@ public final class RefreshDnsAction implements Runnable {
 
   private <T extends EppResource & ForeignKeyedEppResource>
       T loadAndVerifyExistence(Class<T> clazz, String foreignKey) {
-    return ForeignKeyUtils.loadResource(clazz, foreignKey, clock.nowUtc())
+    return ForeignKeyUtils.loadResource(clazz, foreignKey, clock.now())
         .orElseThrow(
             () ->
                 new NotFoundException(

core/src/main/java/google/registry/dns/RefreshDnsOnHostRenameAction.java

@@ -30,7 +30,7 @@ import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import jakarta.inject.Inject;
-import org.joda.time.DateTime;
+import java.time.Instant;
 
 @Action(
     service = Action.Service.BACKEND,
@@ -56,7 +56,7 @@ public class RefreshDnsOnHostRenameAction implements Runnable {
   public void run() {
     tm().transact(
             () -> {
-              DateTime now = tm().getTransactionTime();
+              Instant now = tm().getTxTime();
               Host host = tm().loadByKeyIfPresent(hostKey).orElse(null);
               boolean hostValid = true;
               String failureMessage = null;

core/src/main/java/google/registry/dns/writer/clouddns/CloudDnsWriter.java

@@ -44,6 +44,7 @@ import google.registry.model.tld.Tld;
 import google.registry.model.tld.Tlds;
 import google.registry.util.Clock;
 import google.registry.util.Concurrent;
+import google.registry.util.DateTimeUtils;
 import google.registry.util.Retrier;
 import jakarta.inject.Inject;
 import jakarta.inject.Named;
@@ -51,6 +52,7 @@ import java.io.IOException;
 import java.net.Inet4Address;
 import java.net.Inet6Address;
 import java.net.InetAddress;
+import java.time.Duration;
 import java.util.AbstractMap.SimpleImmutableEntry;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -59,7 +61,6 @@ import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
 import java.util.stream.Stream;
-import org.joda.time.Duration;
 
 /**
  * {@link DnsWriter} implementation that talks to Google Cloud DNS.
@@ -123,8 +124,7 @@ public class CloudDnsWriter extends BaseDnsWriter {
     String absoluteDomainName = getAbsoluteHostName(domainName);
 
     // Load the target domain. Note that it can be absent if this domain was just deleted.
-    Optional<Domain> domain =
-        ForeignKeyUtils.loadResource(Domain.class, domainName, clock.nowUtc());
+    Optional<Domain> domain = ForeignKeyUtils.loadResource(Domain.class, domainName, clock.now());
 
     // Return early if no DNS records should be published.
     // desiredRecordsBuilder is populated with an empty set to indicate that all existing records
@@ -148,7 +148,12 @@ public class CloudDnsWriter extends BaseDnsWriter {
       domainRecords.add(
           new ResourceRecordSet()
               .setName(absoluteDomainName)
-              .setTtl((int) tld.getDnsDsTtl().orElse(defaultDsTtl).getStandardSeconds())
+              .setTtl(
+                  (int)
+                      tld.getDnsDsTtl()
+                          .map(DateTimeUtils::toJavaDuration)
+                          .orElse(defaultDsTtl)
+                          .toSeconds())
               .setType("DS")
               .setKind("dns#resourceRecordSet")
               .setRrdatas(ImmutableList.copyOf(dsRrData)));
@@ -171,7 +176,12 @@ public class CloudDnsWriter extends BaseDnsWriter {
       domainRecords.add(
           new ResourceRecordSet()
               .setName(absoluteDomainName)
-              .setTtl((int) tld.getDnsNsTtl().orElse(defaultNsTtl).getStandardSeconds())
+              .setTtl(
+                  (int)
+                      tld.getDnsNsTtl()
+                          .map(DateTimeUtils::toJavaDuration)
+                          .orElse(defaultNsTtl)
+                          .toSeconds())
               .setType("NS")
               .setKind("dns#resourceRecordSet")
               .setRrdatas(ImmutableList.copyOf(nsRrData)));
@@ -190,7 +200,7 @@ public class CloudDnsWriter extends BaseDnsWriter {
     // Load the target host. Note that it can be absent if this host was just deleted.
     // desiredRecords is populated with an empty set to indicate that all existing records
     // should be deleted.
-    Optional<Host> host = ForeignKeyUtils.loadResource(Host.class, hostName, clock.nowUtc());
+    Optional<Host> host = ForeignKeyUtils.loadResource(Host.class, hostName, clock.now());
 
     // Return early if the host is deleted.
     if (host.isEmpty()) {

core/src/main/java/google/registry/dns/writer/dnsupdate/DnsMessageTransport.java

@@ -28,8 +28,8 @@ import java.io.OutputStream;
 import java.net.InetAddress;
 import java.net.Socket;
 import java.nio.ByteBuffer;
+import java.time.Duration;
 import javax.net.SocketFactory;
-import org.joda.time.Duration;
 import org.xbill.DNS.Message;
 import org.xbill.DNS.Opcode;
 
@@ -76,7 +76,7 @@ public class DnsMessageTransport {
       @Config("dnsUpdateTimeout") Duration updateTimeout) {
     this.factory = factory;
     this.updateHost = updateHost;
-    this.updateTimeout = Ints.checkedCast(updateTimeout.getMillis());
+    this.updateTimeout = Ints.checkedCast(updateTimeout.toMillis());
   }
 
   /**

core/src/main/java/google/registry/dns/writer/dnsupdate/DnsUpdateConfigModule.java

@@ -17,7 +17,7 @@ package google.registry.dns.writer.dnsupdate;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.config.RegistryConfig.Config;
-import org.joda.time.Duration;
+import java.time.Duration;
 
 /** Dagger module that provides DNS configuration settings. */
 @Module
@@ -39,6 +39,6 @@ public class DnsUpdateConfigModule {
   @Provides
   @Config("dnsUpdateTimeout")
   public static Duration provideDnsUpdateTimeout() {
-    return Duration.standardSeconds(30);
+    return Duration.ofSeconds(30);
   }
 }

core/src/main/java/google/registry/dns/writer/dnsupdate/DnsUpdateWriter.java

@@ -34,13 +34,14 @@ import google.registry.model.host.Host;
 import google.registry.model.tld.Tld;
 import google.registry.model.tld.Tlds;
 import google.registry.util.Clock;
+import google.registry.util.DateTimeUtils;
 import jakarta.inject.Inject;
 import java.io.IOException;
 import java.net.Inet4Address;
 import java.net.Inet6Address;
 import java.net.InetAddress;
+import java.time.Duration;
 import java.util.Optional;
-import org.joda.time.Duration;
 import org.xbill.DNS.AAAARecord;
 import org.xbill.DNS.ARecord;
 import org.xbill.DNS.DClass;
@@ -130,7 +131,7 @@ public class DnsUpdateWriter extends BaseDnsWriter {
    */
   private void publishDomain(String domainName, String requestingHostName) {
     Optional<Domain> domainOptional =
-        ForeignKeyUtils.loadResource(Domain.class, domainName, clock.nowUtc());
+        ForeignKeyUtils.loadResource(Domain.class, domainName, clock.now());
     update.delete(toAbsoluteName(domainName), Type.ANY);
     // If the domain is now deleted, then don't update DNS for it.
     if (domainOptional.isPresent()) {
@@ -194,7 +195,10 @@ public class DnsUpdateWriter extends BaseDnsWriter {
           new DSRecord(
               toAbsoluteName(domain.getDomainName()),
               DClass.IN,
-              tld.getDnsDsTtl().orElse(dnsDefaultDsTtl).getStandardSeconds(),
+              tld.getDnsDsTtl()
+                  .map(DateTimeUtils::toJavaDuration)
+                  .orElse(dnsDefaultDsTtl)
+                  .toSeconds(),
               signerData.getKeyTag(),
               signerData.getAlgorithm(),
               signerData.getDigestType(),
@@ -219,7 +223,7 @@ public class DnsUpdateWriter extends BaseDnsWriter {
   private void addInBailiwickNameServerSet(Domain domain, Update update) {
     for (String hostName :
         intersection(domain.loadNameserverHostNames(), domain.getSubordinateHosts())) {
-      Optional<Host> host = ForeignKeyUtils.loadResource(Host.class, hostName, clock.nowUtc());
+      Optional<Host> host = ForeignKeyUtils.loadResource(Host.class, hostName, clock.now());
       checkState(host.isPresent(), "Host %s cannot be loaded", hostName);
       update.add(makeAddressSet(host.get()));
       update.add(makeV6AddressSet(host.get()));
@@ -234,7 +238,10 @@ public class DnsUpdateWriter extends BaseDnsWriter {
           new NSRecord(
               toAbsoluteName(domain.getDomainName()),
               DClass.IN,
-              tld.getDnsNsTtl().orElse(dnsDefaultNsTtl).getStandardSeconds(),
+              tld.getDnsNsTtl()
+                  .map(DateTimeUtils::toJavaDuration)
+                  .orElse(dnsDefaultNsTtl)
+                  .toSeconds(),
               toAbsoluteName(hostName));
       nameServerSet.addRR(record);
     }

core/src/main/java/google/registry/export/ExportDomainListsAction.java

@@ -47,8 +47,6 @@ import java.time.Instant;
 import java.util.List;
 import org.hibernate.query.NativeQuery;
 import org.hibernate.query.TupleTransformer;
-import org.joda.time.DateTime;
-import org.joda.time.DateTimeZone;
 
 /**
  * An action that exports the list of active domains on all real TLDs to Google Drive and GCS.
@@ -114,13 +112,13 @@ public class ExportDomainListsAction implements Runnable {
                               .unwrap(NativeQuery.class)
                               .setTupleTransformer(new DomainResultTransformer())
                               .setParameter("tld", tld)
-                              .setParameter("now", replicaTm().getTransactionTime().toString())
+                              .setParameter("now", replicaTm().getTxTime().toString())
                               .getResultList();
                         } else {
                           return replicaTm()
                               .query(SELECT_DOMAINS_STATEMENT, String.class)
                               .setParameter("tld", tld)
-                              .setParameter("now", replicaTm().getTransactionTime())
+                              .setParameter("now", replicaTm().getTxTime())
                               .getResultList();
                         }
                       });
@@ -175,8 +173,7 @@ public class ExportDomainListsAction implements Runnable {
     @Override
     public String transformTuple(Object[] domainResult, String[] strings) {
       String domainName = (String) domainResult[0];
-      Instant deletionInstant = (Instant) domainResult[1];
-      DateTime deletionTime = new DateTime(deletionInstant.toEpochMilli(), DateTimeZone.UTC);
+      Instant deletionTime = (Instant) domainResult[1];
       String[] domainStatuses = (String[]) domainResult[2];
       String gracePeriodType = (String) domainResult[3];
       boolean inPendingDelete =

core/src/main/java/google/registry/export/ExportPremiumTermsAction.java

@@ -144,7 +144,8 @@ public class ExportPremiumTermsAction implements Runnable {
     String premiumListName = tld.getPremiumListName().get();
     checkState(
         PremiumListDao.getLatestRevision(premiumListName).isPresent(),
-        "Could not load premium list for " + tldStr);
+        "Could not load premium list for %s",
+        tldStr);
     SortedSet<String> premiumTerms =
         PremiumListDao.loadAllPremiumEntries(premiumListName).stream()
             .map(PremiumEntry::toString)

core/src/main/java/google/registry/export/sheet/SyncRegistrarsSheet.java

@@ -25,7 +25,8 @@ import static google.registry.model.registrar.RegistrarPoc.Type.MARKETING;
 import static google.registry.model.registrar.RegistrarPoc.Type.TECH;
 import static google.registry.model.registrar.RegistrarPoc.Type.WHOIS;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.util.DateTimeUtils.START_OF_TIME;
+import static google.registry.util.DateTimeUtils.START_INSTANT;
+import static google.registry.util.DateTimeUtils.isAtOrAfter;
 
 import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableList;
@@ -37,13 +38,12 @@ import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarAddress;
 import google.registry.model.registrar.RegistrarPoc;
 import google.registry.util.Clock;
-import google.registry.util.DateTimeUtils;
 import jakarta.inject.Inject;
 import java.io.IOException;
+import java.time.Instant;
 import java.util.Optional;
 import java.util.function.Predicate;
 import javax.annotation.Nullable;
-import org.joda.time.DateTime;
 
 /**
  * Class for synchronizing all {@link Registrar} objects to a Google Spreadsheet.
@@ -63,9 +63,9 @@ class SyncRegistrarsSheet {
   boolean wereRegistrarsModified() {
     Optional<Cursor> cursor =
         tm().transact(() -> tm().loadByKeyIfPresent(Cursor.createGlobalVKey(SYNC_REGISTRAR_SHEET)));
-    DateTime lastUpdateTime = cursor.isEmpty() ? START_OF_TIME : cursor.get().getCursorTime();
+    Instant lastUpdateTime = cursor.isEmpty() ? START_INSTANT : cursor.get().getCursorTime();
     for (Registrar registrar : Registrar.loadAllCached()) {
-      if (DateTimeUtils.isAtOrAfter(registrar.getLastUpdateTime(), lastUpdateTime)) {
+      if (isAtOrAfter(registrar.getLastUpdateTime(), lastUpdateTime)) {
         return true;
       }
     }
@@ -74,7 +74,7 @@ class SyncRegistrarsSheet {
 
   /** Performs the synchronization operation. */
   void run(String spreadsheetId) throws IOException {
-    final DateTime executionTime = clock.nowUtc();
+    Instant executionTime = clock.now();
     sheetSynchronizer.synchronize(
         spreadsheetId,
         new Ordering<Registrar>() {

core/src/main/java/google/registry/export/sheet/SyncRegistrarsSheetAction.java

@@ -30,10 +30,10 @@ import google.registry.request.auth.Auth;
 import google.registry.request.lock.LockHandler;
 import jakarta.inject.Inject;
 import java.io.IOException;
+import java.time.Duration;
 import java.util.Optional;
 import java.util.concurrent.Callable;
 import javax.annotation.Nullable;
-import org.joda.time.Duration;
 
 /**
  * Action for synchronizing the registrars spreadsheet.
@@ -76,7 +76,7 @@ public class SyncRegistrarsSheetAction implements Runnable {
       }};
 
     private final int statusCode;
-    protected final String message;
+    final String message;
 
     Result(int statusCode, String message) {
       this.statusCode = statusCode;
@@ -84,7 +84,7 @@ public class SyncRegistrarsSheetAction implements Runnable {
     }
 
     /** Log an error message. Results that use log levels other than info should override this. */
-    protected void log(@Nullable Exception cause) {
+    void log(@Nullable Exception cause) {
       logger.atInfo().withCause(cause).log(message);
     }
 

core/src/main/java/google/registry/flows/CheckApiAction.java

@@ -60,9 +60,9 @@ import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import jakarta.inject.Inject;
 import jakarta.servlet.http.HttpServletRequest;
+import java.time.Instant;
 import java.util.Map;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * An action that returns availability and premium checks as JSON.
@@ -130,7 +130,7 @@ public class CheckApiAction implements Runnable {
       // Throws an EppException with a reasonable error message which will be sent back to caller.
       validateDomainNameWithIdnTables(domainName);
 
-      DateTime now = replicaTm().getTransactionTime();
+      Instant now = replicaTm().getTxTime();
       Tld tld = Tld.get(domainName.parent().toString());
       try {
         verifyNotInPredelegation(tld, now);
@@ -182,7 +182,7 @@ public class CheckApiAction implements Runnable {
     }
   }
 
-  private boolean checkExists(String domainString, DateTime now) {
+  private boolean checkExists(String domainString, Instant now) {
     return ForeignKeyUtils.loadKeyByCache(Domain.class, domainString, now).isPresent();
   }
 

core/src/main/java/google/registry/flows/EppException.java

@@ -217,12 +217,13 @@ public abstract class EppException extends Exception {
   public static class UnimplementedCommandException extends EppException {
 
     public UnimplementedCommandException(InnerCommand command) {
-      super(String.format(
-          "No flow found for %s with extension %s",
-          command.getClass().getSimpleName(),
-          command instanceof ResourceCommandWrapper
-              ? ((ResourceCommandWrapper) command).getResourceCommand().getClass().getSimpleName()
-              : null));
+      super(
+          String.format(
+              "No flow found for %s with extension %s",
+              command.getClass().getSimpleName(),
+              command instanceof ResourceCommandWrapper resourceCommandWrapper
+                  ? resourceCommandWrapper.getResourceCommand().getClass().getSimpleName()
+                  : null));
     }
 
     public UnimplementedCommandException(String message) {

core/src/main/java/google/registry/flows/EppXmlSanitizer.java

@@ -15,6 +15,7 @@
 package google.registry.flows;
 
 import static com.google.common.base.Preconditions.checkState;
+import static google.registry.xml.XmlTransformer.createXmlInputFactory;
 
 import com.google.common.base.CharMatcher;
 import com.google.common.collect.ImmutableSet;
@@ -22,6 +23,7 @@ import com.google.common.flogger.FluentLogger;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.UnsupportedEncodingException;
+import java.nio.charset.Charset;
 import java.nio.charset.StandardCharsets;
 import java.util.Base64;
 import java.util.Locale;
@@ -72,8 +74,8 @@ public class EppXmlSanitizer {
   private static final String DEFAULT_MASK = "*";
 
   private static final XMLInputFactory XML_INPUT_FACTORY = createXmlInputFactory();
-  private static final XMLOutputFactory XML_OUTPUT_FACTORY = XMLOutputFactory.newFactory();
-  private static final XMLEventFactory XML_EVENT_FACTORY = XMLEventFactory.newFactory();
+  private static final XMLOutputFactory XML_OUTPUT_FACTORY = XMLOutputFactory.newDefaultFactory();
+  private static final XMLEventFactory XML_EVENT_FACTORY = XMLEventFactory.newDefaultFactory();
 
   /**
    * Returns sanitized EPP XML message. For malformed XML messages, base64-encoded raw bytes will be
@@ -139,7 +141,7 @@ public class EppXmlSanitizer {
       }
     }
     xmlEventWriter.flush();
-    return outputXmlBytes.toString(inputEncoding);
+    return outputXmlBytes.toString(Charset.forName(inputEncoding));
   }
 
   private static String maskSensitiveData(String original) {
@@ -158,16 +160,4 @@ public class EppXmlSanitizer {
   private static boolean isMatchingEndEvent(XMLEvent xmlEvent, QName startEventName) {
     return xmlEvent.isEndElement() && xmlEvent.asEndElement().getName().equals(startEventName);
   }
-
-  private static XMLInputFactory createXmlInputFactory() {
-    XMLInputFactory xmlInputFactory = XMLInputFactory.newFactory();
-    // Coalesce adjacent data, so that all chars in a string will be grouped as one item.
-    xmlInputFactory.setProperty(XMLInputFactory.IS_COALESCING, true);
-    // Preserve Name Space information.
-    xmlInputFactory.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, true);
-    // Prevent XXE attacks.
-    xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
-    xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
-    return xmlInputFactory;
-  }
 }

core/src/main/java/google/registry/flows/FlowModule.java

@@ -251,7 +251,7 @@ public class FlowModule {
           String registrarId,
           EppInput eppInput) {
     builder
-        .setModificationTime(tm().getTransactionTime())
+        .setModificationTime(tm().getTxTime())
         .setTrid(trid)
         .setXmlBytes(inputXmlBytes)
         .setBySuperuser(isSuperuser)

core/src/main/java/google/registry/flows/ResourceFlowUtils.java

@@ -16,7 +16,6 @@ package google.registry.flows;
 
 import static com.google.common.collect.Sets.intersection;
 import static google.registry.model.EppResourceUtils.isLinked;
-import static google.registry.util.DateTimeUtils.toInstant;
 
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Sets;
@@ -50,7 +49,6 @@ import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
-import org.joda.time.DateTime;
 
 /** Static utility functions for resource flows. */
 public final class ResourceFlowUtils {
@@ -66,8 +64,7 @@ public final class ResourceFlowUtils {
   }
 
   /** Check if there are domains linked to the host to be deleted. Throws an exception if so. */
-  public static void checkLinkedDomains(final String targetId, final DateTime now)
-      throws EppException {
+  public static void checkLinkedDomains(final String targetId, Instant now) throws EppException {
     VKey<Host> key =
         ForeignKeyUtils.loadKey(Host.class, targetId, now)
             .orElseThrow(() -> new ResourceDoesNotExistException(Host.class, targetId));
@@ -89,11 +86,6 @@ public final class ResourceFlowUtils {
     }
   }
 
-  public static <R extends EppResource & ForeignKeyedEppResource> R loadAndVerifyExistence(
-      Class<R> clazz, String targetId, DateTime now) throws ResourceDoesNotExistException {
-    return loadAndVerifyExistence(clazz, targetId, toInstant(now));
-  }
-
   public static <R extends EppResource & ForeignKeyedEppResource> R loadAndVerifyExistence(
       Class<R> clazz, String targetId, Instant now) throws ResourceDoesNotExistException {
     return verifyExistence(clazz, targetId, ForeignKeyUtils.loadResource(clazz, targetId, now));
@@ -105,7 +97,7 @@ public final class ResourceFlowUtils {
   }
 
   public static <R extends EppResource> void verifyResourceDoesNotExist(
-      Class<R> clazz, String targetId, DateTime now, String registrarId) throws EppException {
+      Class<R> clazz, String targetId, Instant now, String registrarId) throws EppException {
     Optional<R> resource = ForeignKeyUtils.loadResource(clazz, targetId, now);
     if (resource.isPresent()) {
       // These are similar exceptions, but we can track them internally as log-based metrics.

core/src/main/java/google/registry/flows/certs/CertificateChecker.java

@@ -16,6 +16,7 @@ package google.registry.flows.certs;
 
 import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
+import static google.registry.util.DateTimeUtils.toDateTime;
 import static java.nio.charset.StandardCharsets.UTF_8;
 
 import com.google.common.collect.ImmutableSet;
@@ -94,8 +95,8 @@ public class CertificateChecker {
   }
 
   private static int getValidityLengthInDays(X509Certificate certificate) {
-    DateTime start = DateTime.parse(certificate.getNotBefore().toInstant().toString());
-    DateTime end = DateTime.parse(certificate.getNotAfter().toInstant().toString());
+    DateTime start = toDateTime(certificate.getNotBefore().toInstant());
+    DateTime end = toDateTime(certificate.getNotAfter().toInstant());
     return Days.daysBetween(start.withTimeAtStartOfDay(), end.withTimeAtStartOfDay()).getDays();
   }
 

core/src/main/java/google/registry/flows/custom/DomainCheckFlowCustomLogic.java

@@ -25,7 +25,7 @@ import google.registry.flows.domain.DomainCheckFlow;
 import google.registry.model.eppinput.EppInput;
 import google.registry.model.eppoutput.CheckData.DomainCheck;
 import google.registry.model.eppoutput.EppResponse.ResponseExtension;
-import org.joda.time.DateTime;
+import java.time.Instant;
 
 /**
  * A no-op base class for {@link DomainCheckFlow} custom logic.
@@ -75,7 +75,7 @@ public class DomainCheckFlowCustomLogic extends BaseFlowCustomLogic {
    *     but can be overridden in v>=0.12 of the fee extension.
    */
   public record AfterValidationParameters(
-      ImmutableMap<String, InternetDomainName> domainNames, DateTime asOfDate) {
+      ImmutableMap<String, InternetDomainName> domainNames, Instant asOfDate) {
 
     public static Builder newBuilder() {
       return new AutoBuilder_DomainCheckFlowCustomLogic_AfterValidationParameters_Builder();
@@ -87,7 +87,7 @@ public class DomainCheckFlowCustomLogic extends BaseFlowCustomLogic {
 
       Builder setDomainNames(ImmutableMap<String, InternetDomainName> domainNames);
 
-      Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(Instant asOfDate);
 
       AfterValidationParameters build();
     }
@@ -102,7 +102,7 @@ public class DomainCheckFlowCustomLogic extends BaseFlowCustomLogic {
   public record BeforeResponseParameters(
       ImmutableList<DomainCheck> domainChecks,
       ImmutableList<? extends ResponseExtension> responseExtensions,
-      DateTime asOfDate) {
+      Instant asOfDate) {
 
     public static Builder newBuilder() {
       return new AutoBuilder_DomainCheckFlowCustomLogic_BeforeResponseParameters_Builder();
@@ -116,7 +116,7 @@ public class DomainCheckFlowCustomLogic extends BaseFlowCustomLogic {
 
       Builder setResponseExtensions(ImmutableList<? extends ResponseExtension> responseExtensions);
 
-      Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(Instant asOfDate);
 
       BeforeResponseParameters build();
     }

core/src/main/java/google/registry/flows/custom/DomainPricingCustomLogic.java

@@ -23,8 +23,8 @@ import google.registry.flows.domain.DomainPricingLogic;
 import google.registry.flows.domain.FeesAndCredits;
 import google.registry.model.eppinput.EppInput;
 import google.registry.model.tld.Tld;
+import java.time.Instant;
 import javax.annotation.Nullable;
-import org.joda.time.DateTime;
 
 /**
  * A no-op base class to customize {@link DomainPricingLogic}.
@@ -79,7 +79,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
       FeesAndCredits feesAndCredits,
       Tld tld,
       InternetDomainName domainName,
-      DateTime asOfDate,
+      Instant asOfDate,
       int years) {
 
     public static Builder newBuilder() {
@@ -96,7 +96,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
       Builder setDomainName(InternetDomainName domainName);
 
-      Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(Instant asOfDate);
 
       Builder setYears(int years);
 
@@ -109,7 +109,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
       FeesAndCredits feesAndCredits,
       Tld tld,
       InternetDomainName domainName,
-      DateTime asOfDate,
+      Instant asOfDate,
       int years) {
 
     public static Builder newBuilder() {
@@ -126,7 +126,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
       Builder setDomainName(InternetDomainName domainName);
 
-      Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(Instant asOfDate);
 
       Builder setYears(int years);
 
@@ -136,7 +136,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
   /** A record to encapsulate parameters for a call to {@link #customizeRestorePrice} . */
   public record RestorePriceParameters(
-      FeesAndCredits feesAndCredits, Tld tld, InternetDomainName domainName, DateTime asOfDate) {
+      FeesAndCredits feesAndCredits, Tld tld, InternetDomainName domainName, Instant asOfDate) {
 
     public static Builder newBuilder() {
       return new AutoBuilder_DomainPricingCustomLogic_RestorePriceParameters_Builder();
@@ -152,7 +152,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
       Builder setDomainName(InternetDomainName domainName);
 
-      Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(Instant asOfDate);
 
       RestorePriceParameters build();
     }
@@ -160,7 +160,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
   /** A record to encapsulate parameters for a call to {@link #customizeTransferPrice} . */
   public record TransferPriceParameters(
-      FeesAndCredits feesAndCredits, Tld tld, InternetDomainName domainName, DateTime asOfDate) {
+      FeesAndCredits feesAndCredits, Tld tld, InternetDomainName domainName, Instant asOfDate) {
 
     public static Builder newBuilder() {
       return new AutoBuilder_DomainPricingCustomLogic_TransferPriceParameters_Builder();
@@ -176,7 +176,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
       Builder setDomainName(InternetDomainName domainName);
 
-      Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(Instant asOfDate);
 
       TransferPriceParameters build();
     }
@@ -184,7 +184,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
   /** A record to encapsulate parameters for a call to {@link #customizeUpdatePrice} . */
   public record UpdatePriceParameters(
-      FeesAndCredits feesAndCredits, Tld tld, InternetDomainName domainName, DateTime asOfDate) {
+      FeesAndCredits feesAndCredits, Tld tld, InternetDomainName domainName, Instant asOfDate) {
 
     public static Builder newBuilder() {
       return new AutoBuilder_DomainPricingCustomLogic_UpdatePriceParameters_Builder();
@@ -200,7 +200,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
       Builder setDomainName(InternetDomainName domainName);
 
-      Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(Instant asOfDate);
 
       UpdatePriceParameters build();
     }

core/src/main/java/google/registry/flows/custom/DomainRenewFlowCustomLogic.java

@@ -25,7 +25,7 @@ import google.registry.model.eppinput.EppInput;
 import google.registry.model.eppoutput.EppResponse.ResponseData;
 import google.registry.model.eppoutput.EppResponse.ResponseExtension;
 import google.registry.model.reporting.HistoryEntry;
-import org.joda.time.DateTime;
+import java.time.Instant;
 
 /**
  * A no-op base class for {@link DomainRenewFlow} custom logic.
@@ -80,7 +80,7 @@ public class DomainRenewFlowCustomLogic extends BaseFlowCustomLogic {
   }
 
   /** A class to encapsulate parameters for a call to {@link #afterValidation}. */
-  public record AfterValidationParameters(Domain existingDomain, int years, DateTime now) {
+  public record AfterValidationParameters(Domain existingDomain, int years, Instant now) {
 
     public static Builder newBuilder() {
       return new AutoBuilder_DomainRenewFlowCustomLogic_AfterValidationParameters_Builder();
@@ -94,7 +94,7 @@ public class DomainRenewFlowCustomLogic extends BaseFlowCustomLogic {
 
       Builder setYears(int years);
 
-      Builder setNow(DateTime now);
+      Builder setNow(Instant now);
 
       AfterValidationParameters build();
     }
@@ -113,7 +113,7 @@ public class DomainRenewFlowCustomLogic extends BaseFlowCustomLogic {
       HistoryEntry historyEntry,
       EntityChanges entityChanges,
       int years,
-      DateTime now) {
+      Instant now) {
 
     public static Builder newBuilder() {
       return new AutoBuilder_DomainRenewFlowCustomLogic_BeforeSaveParameters_Builder();
@@ -133,7 +133,7 @@ public class DomainRenewFlowCustomLogic extends BaseFlowCustomLogic {
 
       Builder setYears(int years);
 
-      Builder setNow(DateTime now);
+      Builder setNow(Instant now);
 
       BeforeSaveParameters build();
     }

core/src/main/java/google/registry/flows/domain/DomainCheckFlow.java

@@ -82,6 +82,7 @@ import google.registry.model.tld.label.ReservationType;
 import google.registry.persistence.VKey;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Collection;
 import java.util.HashSet;
 import java.util.Map;
@@ -89,7 +90,6 @@ import java.util.Optional;
 import java.util.Set;
 import java.util.stream.Collectors;
 import org.joda.money.CurrencyUnit;
-import org.joda.time.DateTime;
 
 /**
  * An EPP flow that checks whether a domain can be provisioned.
@@ -156,7 +156,7 @@ public final class DomainCheckFlow implements TransactionalFlow {
     extensionManager.validate();
     ImmutableList<String> domainNames = ((Check) resourceCommand).getTargetIds();
     verifyTargetIdCount(domainNames, maxChecks);
-    DateTime now = clock.nowUtc();
+    Instant now = clock.now();
     ImmutableMap.Builder<String, InternetDomainName> parsedDomainsBuilder =
         new ImmutableMap.Builder<>();
     // Only check that the registrar has access to a TLD the first time it is encountered
@@ -225,7 +225,7 @@ public final class DomainCheckFlow implements TransactionalFlow {
       ImmutableSet<InternetDomainName> bsaBlockedDomainNames,
       ImmutableMap<String, TldState> tldStates,
       ImmutableMap<String, InternetDomainName> parsedDomains,
-      DateTime now)
+      Instant now)
       throws EppException {
     InternetDomainName idn = parsedDomains.get(domainName);
     Optional<AllocationToken> token;
@@ -286,7 +286,7 @@ public final class DomainCheckFlow implements TransactionalFlow {
       ImmutableMap<String, InternetDomainName> domainNames,
       ImmutableMap<String, VKey<Domain>> existingDomains,
       ImmutableSet<String> availableDomains,
-      DateTime now)
+      Instant now)
       throws EppException {
     Optional<FeeCheckCommandExtension> feeCheckOpt =
         eppInput.getSingleExtension(FeeCheckCommandExtension.class);
@@ -480,7 +480,7 @@ public final class DomainCheckFlow implements TransactionalFlow {
   }
 
   static ImmutableSet<InternetDomainName> getBsaBlockedDomains(
-      ImmutableCollection<InternetDomainName> parsedDomains, DateTime now) {
+      ImmutableCollection<InternetDomainName> parsedDomains, Instant now) {
     Map<String, ImmutableList<InternetDomainName>> labelToDomainNames =
         parsedDomains.stream()
             .filter(

core/src/main/java/google/registry/flows/domain/DomainClaimsCheckFlow.java

@@ -49,10 +49,10 @@ import google.registry.model.tld.Tld;
 import google.registry.model.tmch.ClaimsListDao;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.HashSet;
 import java.util.Optional;
 import java.util.Set;
-import org.joda.time.DateTime;
 
 /**
  * An EPP flow that checks whether domain labels are trademarked.
@@ -103,7 +103,7 @@ public final class DomainClaimsCheckFlow implements TransactionalFlow {
           checkAllowedAccessToTld(registrarId, tldStr);
           checkHasBillingAccount(registrarId, tldStr);
           Tld tld = Tld.get(tldStr);
-          DateTime now = clock.nowUtc();
+          Instant now = clock.now();
           verifyNotInPredelegation(tld, now);
           verifyClaimsPeriodNotEnded(tld, now);
         }

core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java

@@ -51,8 +51,9 @@ import static google.registry.model.tld.Tld.TldState.QUIET_PERIOD;
 import static google.registry.model.tld.Tld.TldState.START_DATE_SUNRISE;
 import static google.registry.model.tld.label.ReservationType.NAME_COLLISION;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.util.DateTimeUtils.END_OF_TIME;
-import static google.registry.util.DateTimeUtils.leapSafeAddYears;
+import static google.registry.util.DateTimeUtils.END_INSTANT;
+import static google.registry.util.DateTimeUtils.plusYears;
+import static google.registry.util.DateTimeUtils.toInstant;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
@@ -120,6 +121,7 @@ import google.registry.model.tmch.ClaimsList;
 import google.registry.model.tmch.ClaimsListDao;
 import google.registry.tmch.LordnTaskUtils.LordnPhase;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Optional;
 import org.joda.time.DateTime;
 import org.joda.time.Duration;
@@ -235,7 +237,7 @@ public final class DomainCreateFlow implements MutatingFlow {
     verifyRegistrarIsActive(registrarId);
     extensionManager.validate();
     verifyDomainDoesNotExist();
-    DateTime now = tm().getTransactionTime();
+    Instant now = tm().getTxTime();
     DomainCommand.Create command = cloneAndLinkReferences((Create) resourceCommand, now);
     Period period = command.getPeriod();
     verifyUnitIsYears(period);
@@ -331,7 +333,7 @@ public final class DomainCreateFlow implements MutatingFlow {
     validateFeeChallenge(feeCreate, feesAndCredits, defaultTokenUsed);
     Optional<SecDnsCreateExtension> secDnsCreate =
         validateSecDnsExtension(eppInput.getSingleExtension(SecDnsCreateExtension.class));
-    DateTime registrationExpirationTime = leapSafeAddYears(now, years);
+    Instant registrationExpirationTime = plusYears(now, years);
     String repoId = createDomainRepoId(tm().allocateId(), tld.getTldStr());
     long historyRevisionId = tm().allocateId();
     HistoryEntryId domainHistoryId = new HistoryEntryId(repoId, historyRevisionId);
@@ -492,7 +494,7 @@ public final class DomainCreateFlow implements MutatingFlow {
   private void verifyIsGaOrSpecialCase(
       Tld tld,
       ClaimsList claimsList,
-      DateTime now,
+      Instant now,
       String domainLabel,
       Optional<AllocationToken> allocationToken,
       boolean isAnchorTenant,
@@ -556,14 +558,14 @@ public final class DomainCreateFlow implements MutatingFlow {
   }
 
   private DomainHistory buildDomainHistory(
-      Domain domain, Tld tld, DateTime now, Period period, Duration addGracePeriod) {
+      Domain domain, Tld tld, Instant now, Period period, Duration addGracePeriod) {
     // We ignore prober transactions
     if (tld.getTldType() == TldType.REAL) {
       historyBuilder.setDomainTransactionRecords(
           ImmutableSet.of(
               DomainTransactionRecord.create(
                   tld.getTldStr(),
-                  now.plus(addGracePeriod),
+                  now.plusMillis(addGracePeriod.getMillis()),
                   TransactionReportField.netAddsFieldFromYears(period.getValue()),
                   1)));
     }
@@ -579,7 +581,7 @@ public final class DomainCreateFlow implements MutatingFlow {
       FeesAndCredits feesAndCredits,
       HistoryEntryId domainHistoryId,
       Optional<AllocationToken> allocationToken,
-      DateTime now) {
+      Instant now) {
     ImmutableSet.Builder<Flag> flagsBuilder = new ImmutableSet.Builder<>();
     // Sunrise and anchor tenancy are orthogonal tags and thus both can be present together.
     if (isSunriseCreate) {
@@ -601,10 +603,11 @@ public final class DomainCreateFlow implements MutatingFlow {
         .setEventTime(now)
         .setAllocationToken(allocationToken.map(AllocationToken::createVKey).orElse(null))
         .setBillingTime(
-            now.plus(
-                isAnchorTenant
-                    ? tld.getAnchorTenantAddGracePeriodLength()
-                    : tld.getAddGracePeriodLength()))
+            now.plusMillis(
+                (isAnchorTenant
+                        ? tld.getAnchorTenantAddGracePeriodLength()
+                        : tld.getAddGracePeriodLength())
+                    .getMillis()))
         .setFlags(flagsBuilder.build())
         .setDomainHistoryId(domainHistoryId)
         .build();
@@ -612,7 +615,7 @@ public final class DomainCreateFlow implements MutatingFlow {
 
   private BillingRecurrence createAutorenewBillingEvent(
       HistoryEntryId domainHistoryId,
-      DateTime registrationExpirationTime,
+      Instant registrationExpirationTime,
       boolean isAnchorTenant,
       Optional<AllocationToken> allocationToken) {
     // Non-standard renewal behaviors can occur for anchor tenants (always NONPREMIUM pricing) or if
@@ -630,7 +633,7 @@ public final class DomainCreateFlow implements MutatingFlow {
         .setTargetId(targetId)
         .setRegistrarId(registrarId)
         .setEventTime(registrationExpirationTime)
-        .setRecurrenceEndTime(END_OF_TIME)
+        .setRecurrenceEndTime(END_INSTANT)
         .setDomainHistoryId(domainHistoryId)
         .setRenewalPriceBehavior(renewalPriceBehavior)
         .setRenewalPrice(allocationToken.flatMap(AllocationToken::getRenewalPrice).orElse(null))
@@ -638,7 +641,7 @@ public final class DomainCreateFlow implements MutatingFlow {
   }
 
   private Autorenew createAutorenewPollMessage(
-      HistoryEntryId domainHistoryId, DateTime registrationExpirationTime) {
+      HistoryEntryId domainHistoryId, Instant registrationExpirationTime) {
     return new PollMessage.Autorenew.Builder()
         .setTargetId(targetId)
         .setRegistrarId(registrarId)
@@ -652,7 +655,7 @@ public final class DomainCreateFlow implements MutatingFlow {
     Optional<DateTime> previousDeletionTime =
         domainDeletionTimeCache.getDeletionTimeForDomain(targetId);
     if (previousDeletionTime.isPresent()
-        && !tm().getTransactionTime().isAfter(previousDeletionTime.get())) {
+        && !tm().getTxTime().isAfter(toInstant(previousDeletionTime.get()))) {
       throw new ResourceCreateContentionException(targetId);
     }
   }
@@ -673,7 +676,7 @@ public final class DomainCreateFlow implements MutatingFlow {
   }
 
   private static PollMessage.OneTime createNameCollisionOneTimePollMessage(
-      String domainName, HistoryEntry historyEntry, String registrarId, DateTime now) {
+      String domainName, HistoryEntry historyEntry, String registrarId, Instant now) {
     return new PollMessage.OneTime.Builder()
         .setRegistrarId(registrarId)
         .setEventTime(now)

core/src/main/java/google/registry/flows/domain/DomainDeleteFlow.java

@@ -40,6 +40,9 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import static google.registry.pricing.PricingEngineProxy.getDomainRenewCost;
 import static google.registry.util.CollectionUtils.nullToEmpty;
 import static google.registry.util.CollectionUtils.union;
+import static google.registry.util.DateTimeUtils.toDateTime;
+import static google.registry.util.DateTimeUtils.toInstant;
+import static java.time.ZoneOffset.UTC;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
@@ -98,6 +101,7 @@ import google.registry.model.tld.Tld;
 import google.registry.model.tld.Tld.TldType;
 import google.registry.model.transfer.TransferStatus;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Collections;
 import java.util.Optional;
 import java.util.Set;
@@ -145,7 +149,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
     flowCustomLogic.beforeValidation();
     validateRegistrarIsLoggedIn(registrarId);
     extensionManager.validate();
-    DateTime now = tm().getTransactionTime();
+    Instant now = tm().getTxTime();
     // Loads the target resource if it exists
     Domain existingDomain = loadAndVerifyExistence(Domain.class, targetId, now);
     Tld tld = Tld.get(existingDomain.getTld());
@@ -184,11 +188,11 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
             : redemptionGracePeriodLength.plus(pendingDeleteLength);
     HistoryEntryId domainHistoryId = createHistoryEntryId(existingDomain);
     historyBuilder.setRevisionId(domainHistoryId.getRevisionId());
-    DateTime deletionTime = now.plus(durationUntilDelete);
+    Instant deletionTime = now.plusMillis(durationUntilDelete.getMillis());
     if (durationUntilDelete.equals(Duration.ZERO)) {
       builder.setDeletionTime(now).setStatusValues(null);
     } else {
-      DateTime redemptionTime = now.plus(redemptionGracePeriodLength);
+      Instant redemptionTime = now.plusMillis(redemptionGracePeriodLength.getMillis());
       asyncTaskEnqueuer.enqueueAsyncResave(
           existingDomain.createVKey(), now, ImmutableSortedSet.of(redemptionTime, deletionTime));
       builder
@@ -236,7 +240,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
     }
 
     // Cancel any grace periods that were still active, and set the expiration time accordingly.
-    DateTime newExpirationTime = existingDomain.getRegistrationExpirationDateTime();
+    Instant newExpirationTime = existingDomain.getRegistrationExpirationTime();
     for (GracePeriod gracePeriod : existingDomain.getGracePeriods()) {
       // No cancellation is written if the grace period was not for a billable event.
       if (gracePeriod.hasBillingEvent()) {
@@ -246,11 +250,12 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
           // Take the amount of registration time being refunded off the expiration time.
           // This can be either add grace periods or renew grace periods.
           BillingEvent billingEvent = tm().loadByKey(gracePeriod.getBillingEvent());
-          newExpirationTime = newExpirationTime.minusYears(billingEvent.getPeriodYears());
+          newExpirationTime =
+              newExpirationTime.atZone(UTC).minusYears(billingEvent.getPeriodYears()).toInstant();
         } else if (gracePeriod.getBillingRecurrence() != null) {
           // Take 1 year off the registration if in the autorenew grace period (no need to load the
           // recurrence billing event; all autorenews are for 1 year).
-          newExpirationTime = newExpirationTime.minusYears(1);
+          newExpirationTime = newExpirationTime.atZone(UTC).minusYears(1).toInstant();
         }
       }
     }
@@ -289,7 +294,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
         flowCustomLogic.beforeResponse(
             BeforeResponseParameters.newBuilder()
                 .setResultCode(
-                    newDomain.getDeletionDateTime().isAfter(now)
+                    newDomain.getDeletionTime().isAfter(now)
                         ? SUCCESS_WITH_ACTION_PENDING
                         : SUCCESS)
                 .setResponseExtensions(
@@ -302,7 +307,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
         .build();
   }
 
-  private void verifyDeleteAllowed(Domain existingDomain, Tld tld, DateTime now)
+  private void verifyDeleteAllowed(Domain existingDomain, Tld tld, Instant now)
       throws EppException {
     verifyOptionalAuthInfo(authInfo, existingDomain);
     verifyNoDisallowedStatuses(existingDomain, ImmutableSet.of(StatusValue.PENDING_DELETE));
@@ -318,11 +323,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
   }
 
   private DomainHistory buildDomainHistory(
-      Domain domain,
-      Tld tld,
-      DateTime now,
-      Duration durationUntilDelete,
-      boolean inAddGracePeriod) {
+      Domain domain, Tld tld, Instant now, Duration durationUntilDelete, boolean inAddGracePeriod) {
     // We ignore prober transactions
     if (tld.getTldType() == TldType.REAL) {
       Duration maxGracePeriod =
@@ -342,7 +343,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
               cancelledRecords,
               DomainTransactionRecord.create(
                   domain.getTld(),
-                  now.plus(durationUntilDelete),
+                  now.plusMillis(durationUntilDelete.getMillis()),
                   inAddGracePeriod
                       ? TransactionReportField.DELETED_DOMAINS_GRACE
                       : TransactionReportField.DELETED_DOMAINS_NOGRACE,
@@ -352,7 +353,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
   }
 
   private PollMessage.OneTime createDeletePollMessage(
-      Domain existingDomain, HistoryEntryId domainHistoryId, DateTime deletionTime) {
+      Domain existingDomain, HistoryEntryId domainHistoryId, Instant deletionTime) {
     Optional<MetadataExtension> metadataExtension =
         eppInput.getSingleExtension(MetadataExtension.class);
     boolean hasMetadataMessage =
@@ -376,7 +377,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
   }
 
   private PollMessage.OneTime createImmediateDeletePollMessage(
-      Domain existingDomain, HistoryEntryId domainHistoryId, DateTime now, DateTime deletionTime) {
+      Domain existingDomain, HistoryEntryId domainHistoryId, Instant now, Instant deletionTime) {
     return new PollMessage.OneTime.Builder()
         .setRegistrarId(existingDomain.getPersistedCurrentSponsorRegistrarId())
         .setEventTime(now)
@@ -394,7 +395,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
 
   @Nullable
   private ImmutableList<FeeTransformResponseExtension> getResponseExtensions(
-      BillingRecurrence billingRecurrence, Domain existingDomain, DateTime now) {
+      BillingRecurrence billingRecurrence, Domain existingDomain, Instant now) {
     FeeTransformResponseExtension.Builder feeResponseBuilder = getDeleteResponseBuilder();
     if (feeResponseBuilder == null) {
       return ImmutableList.of();
@@ -416,12 +417,12 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
   }
 
   private Money getGracePeriodCost(
-      BillingRecurrence billingRecurrence, GracePeriod gracePeriod, DateTime now) {
+      BillingRecurrence billingRecurrence, GracePeriod gracePeriod, Instant now) {
     if (gracePeriod.getType() == GracePeriodStatus.AUTO_RENEW) {
       // If we updated the autorenew billing event, reuse it.
       DateTime autoRenewTime =
-          billingRecurrence.getRecurrenceTimeOfYear().getLastInstanceBeforeOrAt(now);
-      return getDomainRenewCost(targetId, autoRenewTime, 1);
+          toDateTime(billingRecurrence.getRecurrenceTimeOfYear().getLastInstanceBeforeOrAt(now));
+      return getDomainRenewCost(targetId, toInstant(autoRenewTime), 1);
     }
     return tm().loadByKey(checkNotNull(gracePeriod.getBillingEvent())).getCost();
   }

core/src/main/java/google/registry/flows/domain/DomainDeletionTimeCache.java

@@ -104,7 +104,7 @@ public class DomainDeletionTimeCache {
             ForeignKeyUtils.loadMostRecentResources(
                     Domain.class, ImmutableSet.of(domainName), false)
                 .get(domainName);
-        return mostRecentResource == null ? null : mostRecentResource.deletionTime();
+        return mostRecentResource == null ? null : mostRecentResource.getDeletionTime();
       };
 
   // Unfortunately, maintenance tasks aren't necessarily already in a transaction