Add expiration/deletion to Valkey cache (#3024)

This will be necessary for the batch job that runs however often to
"catch up" to the existing state.

We also only store "real" domains in Valkey.

GEMINI.md

@@ -1,21 +1,33 @@
 # Engineering Standards for Gemini CLI
 
-This document outlines foundational mandates, architectural patterns, and project-specific conventions to ensure high-quality, idiomatic, and consistent code from the first iteration.
+This document outlines foundational mandates, architectural patterns, and project-specific conventions to ensure high-quality, idiomatic, and consistent code from the first iteration. When modifying this file, always review the full document to prevent the introduction of duplicate instructions and ensure the content remains coherent and logically organized.
 
 ## Core Mandates
 
 ### 1. Rigorous Import Management
 - **Addition:** When adding new symbols, ensure the corresponding import is added.
 - **Removal:** When removing the last usage of a class or symbol from a file (e.g., removing a `@Inject Clock clock;` field), **immediately remove the associated import**. Do not wait for a build failure to identify unused imports.
+- **No Redundant Qualifications:** NEVER use fully qualified class names (e.g., `java.time.temporal.ChronoUnit.DAYS`) in code when an import can be used instead. Always prefer adding an import and using the simple name.
+- **Static Imports for Utilities:** Always statically import methods from utility classes like `DateTimeUtils` or `CacheUtils`. (e.g., use `toInstant(...)` instead of `DateTimeUtils.toInstant(...)`).
 - **Checkstyle:** Proactively fix common checkstyle errors (line length > 100, formatting, unused imports) during the initial code write. Do not wait for CI/build failures to address these, as iterative fixes are inefficient.
-- **Verification:** Before finalizing any change, scan the imports section for redundancy.
+- **Verification**: Before finalizing any change, scan the imports section for redundancy.
+- **License Headers**: When creating new files, ensure the license header uses the current year (e.g., 2026). Existing files should retain their original year.
 
-### 2. Time and Precision Handling (java.time Migration)
+## 2. Time and Precision Handling (java.time Migration)
+
+- **Idiomatic java.time Usage:** Avoid redundant conversions between `Instant` and `DateTime`. If a field or parameter is an `Instant`, use it directly. Do not convert to `DateTime` just to call a deprecated method if an `Instant` alternative exists or can be easily created. Furthermore, you should not call `toInstant()` or `toDateTime()` conversion methods when not strictly necessary; always prefer to use an alternative method that returns the correct type if one exists (e.g. use `tm().getTxTime()` which returns an `Instant` instead of calling `tm().getTransactionTime().toInstant()`).
+- **CRITICAL MISTAKES TO AVOID:**
+    - NEVER use `toInstant(clock.nowUtc())` or `toInstant(fakeClock.nowUtc())`. Both `Clock` and `FakeClock` have a `now()` method that natively returns a `java.time.Instant`. You MUST use `clock.now()` or `fakeClock.now()` directly.
+    - NEVER double-wrap conversions like `toInstant(toDateTime(...))` or `toDateTime(toInstant(...))`.
+    - NEVER mark `Instant` parameters or local variables as `final` unnecessarily, as it clutters the codebase.
+    - When using test helpers like `assertThatCommand().atTime(...)` or `ForeignKeyUtils.loadResource(...)`, ALWAYS use the `Instant` overloads. DO NOT wrap `Instant` instances in `toDateTime(...)` just to pass them to deprecated overloads.
+- **UTC Timezones:** Do not use `ZoneId.of("UTC")`. Use a statically imported `UTC` from `ZoneOffset` instead (`import static java.time.ZoneOffset.UTC;`).
 - **Millisecond Precision:** Always truncate `Instant.now()` to milliseconds (using `.truncatedTo(ChronoUnit.MILLIS)`) to maintain consistency with Joda `DateTime` and the PostgreSQL schema (which enforces millisecond precision via JPA converters).
 - **Clock Injection:**
     - Avoid direct calls to `Instant.now()`, `DateTime.now()`, `ZonedDateTime.now()`, or `System.currentTimeMillis()`.
     - Inject `google.registry.util.Clock` (production) or `google.registry.testing.FakeClock` (tests).
     - Use `clock.nowDate()` to get a `ZonedDateTime` in UTC.
+    - When defining timestamps for tests, prefer using a fixed, static constant (e.g., `Instant.parse("2024-03-27T10:15:30.105Z")`) over capturing `clock.now()` to prevent flaky tests caused by the passage of real time. Avoid using the Unix epoch (`START_INSTANT`) unless specifically testing epoch-related logic; instead, use realistic dates and vary them across different test suites to ensure logic isn't dependent on a specific "standard" date.
 - **Beam Pipelines:**
     - Ensure `Clock` is serializable (it is by default in this project) when used in Beam `DoFn`s.
     - Pass the `Clock` through the constructor or via Dagger provider methods in the pipeline module.
@@ -47,6 +59,117 @@ This document outlines foundational mandates, architectural patterns, and projec
 ### 6. Project Dependencies
 - **Common Module:** When using `Clock` or other core utilities in a new or separate module (like `load-testing`), ensure `implementation project(':common')` is added to the module's `build.gradle`.
 
+### 7. Search and Discovery
+- **No CodeSearch:** This project is hosted on GitHub, not Google3. Do NOT use `mcp_Coding_search_for_files_codesearch` or other internal Google3 search tools.
+- **Local Grep:** Use local shell commands like `git grep` or `grep` via `run_shell_command` to search the codebase.
+
 ## Performance and Efficiency
 - **Turn Minimization:** Aim for "perfect" code in the first iteration. Iterative fixes for checkstyle or compilation errors consume significant context and time.
 - **Context Management:** Use sub-agents for batch refactoring or high-volume output tasks to keep the main session history lean and efficient.
+- **Code Formatting:** Do not write custom Python scripts or manual regex replacements to fix code formatting issues (e.g., unused imports, import ordering, line length). Instead, use the project's built-in formatting tools: run `./gradlew spotlessApply` to fix unused/unordered imports and `./gradlew javaIncrementalFormatApply` (or `google-java-format --replace <files>`) to automatically fix Java formatting and indentation errors.
+
+## General Code Review Lessons & Avoidable Mistakes
+Based on historical PR reviews, avoid the following common mistakes:
+- **No Unnecessary Casts:** Do not unnecessarily cast objects if the method signature accepts the type directly (e.g., avoid `(Instant) fakeClock.now()` or `(ImmutableSet<String>) bsaQuery(...)` if it compiles without it).
+- **Visibility Modifiers:** Do not use `/* package */` comments to denote package-private visibility. Just leave the modifier blank; it is an established idiom in this codebase.
+
+### Advanced Java & Guava Idioms
+- **Immutable Types:** Declare variables, fields, and return types explicitly as Guava immutable types (e.g., `ImmutableList<T>`, `ImmutableMap<K, V>`) instead of their generic interfaces (`List<T>`, `Map<K, V>`) to clearly communicate immutability contracts to callers. Use `toImmutableList()` and `toImmutableMap()` collectors in streams rather than manually accumulating into an `ArrayList` or `HashMap`.
+- **Constructors:** Do not perform heavy logic, I/O, or external API calls inside constructors. Initialization logic should be deferred or handled in a factory method or a dedicated startup routine.
+- **Exception Handling:** Do not catch generic `Exception` or `Throwable` if a more specific exception is expected. Never "log and re-throw" the same exception; either handle it entirely (and log), or throw it up the chain. For batch processes, catch exceptions at the individual item/chunk level so one failure doesn't abort the entire batch.
+- **Fail Fast:** Validate inputs and fail fast (using `Preconditions.checkArgument` or similar) at the highest level possible rather than passing invalid state (like `null`s) deeper into business logic.
+- **Magic Numbers:** Always document magic numbers or hardcoded limits (like `50.0` or `30`) with inline comments explaining the rationale.
+- **Null Safety and Optional:** Prefer using `Optional` for any variable that is expected to potentially be null. For any other variable that can be null but cannot use an `Optional` (e.g., function parameters or return types where `Optional` is not idiomatic), it MUST be annotated with `@Nullable`. Always use the `javax.annotation.Nullable` annotation.
+
+---
+
+# Gemini Engineering Guide: Nomulus Codebase
+
+This document captures high-level architectural patterns, lessons learned from large-scale refactorings (like the Joda-Time to `java.time` migration), and specific instructions to avoid common pitfalls in this environment.
+
+## 🏛 Architecture Overview
+
+- **Transaction Management:** The codebase uses a custom wrapper around JPA. Always use `tm()` (from `TransactionManagerFactory`) to interact with the database.
+- **Dependency Injection:** Dagger 2 is used extensively. If you see "cannot find symbol" errors for classes starting with `Dagger...`, the project is in a state where annotation processing failed. Fix compilation in core models first to restore generated code.
+- **Value Types:** AutoValue and "ImmutableObject" patterns are dominant. Most models follow a `Buildable` pattern with a nested `Builder`.
+- **Temporal Logic:** The project is migrating from Joda-Time to `java.time`.
+  - Core boundaries: `DateTimeUtils.START_OF_TIME_INSTANT` (Unix Epoch) and `END_OF_TIME_INSTANT` (Long.MAX_VALUE / 1000).
+  - Year Arithmetic: Use `DateTimeUtils.plusYears()` and `DateTimeUtils.minusYears()` to handle February 29th logic correctly.
+
+## Source Control
+- **Committing:** Always create a new commit on the branch if one hasn't been created yet for the branch's specific work. Only perform amending (`git commit --amend --no-edit`) for subsequent changes once the initial commit has been successfully created.
+- **One Commit Per PR:** All changes for a single PR must be squashed into a single commit before merging.
+- **Default to Amend:** Once an initial commit is created for a PR, all subsequent functional changes should be amended into that same commit by default (`git commit --amend --no-edit`). This ensures the PR remains a single, clean unit of work throughout the development lifecycle.
+- **Commit Message Style:** Follow standard Git commit best practices. The subject line (first line) MUST be a maximum of 50 characters, concise, capitalized, and **must not end with punctuation** (e.g., a period). The body MUST explicitly encapsulate and summarize all changes made across the entire diff, detailing the "what" and "why" comprehensively.
+- **Strict Completion Verification:** You MUST NEVER declare a task, commit, or amendment as complete until you have explicitly verified that the workspace is clean. You MUST follow this exact sequence of actions across multiple conversational turns if necessary:
+  1. Execute the `git commit` or `git commit --amend` command.
+  2. Wait for the tool to return successfully.
+  3. Execute `git status`.
+  4. Wait for the tool to return and explicitly verify the output contains `nothing to commit, working tree clean` (or similar indication that no unstaged changes remain). If changes remain, stage them and amend the commit, then repeat this verification loop.
+  5. **Only after** step 4 has successfully returned a clean working directory may you generate a text response to the user declaring that the task is complete.
+- **Diff Review:** Before finalizing a task, review the full diff (e.g., `git diff HEAD^`) to ensure all changes are functional and relevant. Identify and revert any formatting-only changes in files that do not contain functional updates to keep the commit focused.
+
+## Self-Review Guidelines
+Before finalizing any PR or declaring a task complete, you MUST perform a thorough, rigorous self-review of your entire diff. Run `git diff HEAD^` (or review the staged changes) and actively verify the following against every modified line:
+
+1. **Imports & FQNs:** Did I leave any fully-qualified class names or static variables inline? Did I add the necessary imports for them? *Crucial Exception:* If the file already imports a class with the identical name (e.g., it uses both `java.time.Duration` and `org.joda.time.Duration`), one MUST remain fully qualified to avoid a compilation conflict.
+2. **Redundant Conversions:** Did I use `toDateTime(clock.now())` where `clock.nowUtc()` would suffice? Did I use `toDateTime(END_INSTANT)` instead of `END_OF_TIME`? Did I use `.toInstant()` or `.toDateTime()` on something that could be avoided by using a different method overload (e.g., `tm().getTxTime()`)?
+3. **Verbose Math:** Did I write any verbose time conversions inline? Are there `DateTimeUtils` methods I should be using instead? If not, should I abstract this math into `DateTimeUtils`?
+4. **Assertion Cleanliness:** Am I polluting test assertions with `toDateTime(...)` wraps? If so, I need to add overloaded assertions to the Truth Subjects instead.
+5. **Diff Scope:** Are there any formatting-only changes in files that I did not functionally modify? If so, revert them. Does the total line count of the diff align with the approved scope (e.g., ~1,000 lines for migrations)?
+6. **Commit Message:** Does the commit message title fit within 50 characters? Does the body encapsulate the entirety of the changes across the diff cleanly and professionally?
+7. **Missing Tests & Coverage:** *Perform a structured check for any new methods or modified behavior.* Did I add a new utility method (like `plusMonths(Instant, int)`) or change core logic? If so, I MUST open the corresponding test file and write tests to cover the new functionality (including edge cases, negative values, and leap years) before considering the task complete. A code review is not thorough if it only checks for compilation. I must actively ensure every new branch of logic has a test.
+
+Only after actively confirming these checks against your diff are you permitted to finalize the task.
+
+## Refactoring & Migration Guardrails
+
+
+### 1. Compiler Warnings are Errors (`-Werror`)
+This project treats Error Prone warnings as errors.
+- **`@InlineMeSuggester`**: When creating deprecated Joda-Time bridge methods (e.g., `getTimestamp() -> return toDateTime(getTimestampInstant())`), you **MUST** immediately add `@SuppressWarnings("InlineMeSuggester")`. If you don't, the build will fail.
+- **Repeatable Annotations**: `@SuppressWarnings` is **NOT** repeatable in this environment. If a method or class already has a suppression (e.g., `@SuppressWarnings("unchecked")`), you must merge them:
+  - ❌ `@SuppressWarnings("unchecked") @SuppressWarnings("InlineMeSuggester")`
+  - ✅ `@SuppressWarnings({"unchecked", "InlineMeSuggester"})`
+
+### 2. Resolving Ambiguity
+- **Null Overloads**: Adding an `Instant` overload to a method that previously took `DateTime` will break all `create(null)` calls. You must cast them: `create((Instant) null)`.
+- **Type Erasure**: Methods taking `Optional<DateTime>` and `Optional<Instant>` will clash due to erasure. Use distinct names, e.g., `setAutorenewEndTimeInstant(Optional<Instant> time)`.
+
+### 3. Build Strategy
+- **Surgical Changes**: In large-scale migrations, focus on "leaf" nodes first (Utilities -> Models -> Flows -> Actions).
+- **PR Size**: Minimize PR size by retaining Joda-Time bridge methods for high-level "Action" and "Flow" classes unless a full migration is requested. Reverting changes to DNS and Reporting logic while updating the underlying models is a valid strategy to keep PRs reviewable.
+- **Validation**: Always run `./gradlew build -x test` before attempting to run unit tests. Unit tests will not run if there are compilation errors in any part of the `core` module. Before finalizing a PR or declaring a task done, you MUST verify your changes. **Prefer scoped builds** (e.g., `./gradlew :core:build`) if you are only modifying backend Java code. Running the global `./gradlew build` triggers the frontend `console-webapp` build, which unnecessarily runs `npmInstallDeps` and modifies `package-lock.json`. If you must run a global build, you must revert `console-webapp/package-lock.json` afterwards. Do not declare success if formatting checks (e.g., `spotlessCheck` or `javaIncrementalFormatCheck`) or tests fail. If formatting fails, run `./gradlew spotlessApply` and then re-run your build command to verify everything passes.
+
+## 🚫 Common Pitfalls to Avoid
+
+- **Mixing Joda and Java Durations:** Methods like `Tld.get().getRenewGracePeriodLength()` return a **Joda** `Duration`, which cannot be passed directly to `Instant.plus(...)` because it doesn't implement `TemporalAmount`. You MUST use `.plusMillis(duration.getMillis())` instead.
+- **Serialization Precision (`.000Z`):** When asserting against or generating XML/YAML files, remember that millisecond precision (`.000Z`) is required. Always use `DateTimeUtils.formatInstant(...)` to format `Instant` objects (it preserves the `.000Z` suffix) instead of `Instant.toString()` (which drops it for exact seconds). We have added custom Jackson `InstantKeySerializer`s for this purpose, but you must keep this precision in mind when manually updating `.xml` or `.yaml` test data.
+- **Static Imports:** Methods like `toDateTime`, `toInstant`, `plusYears`, `plusMonths`, and `minusDays` from `DateTimeUtils` MUST be statically imported. Do NOT use them fully qualified (e.g., `DateTimeUtils.plusMonths(...)`).
+
+- **Redundant Parses:** Never write `toDateTime(Instant.parse(...))` or `toInstant(DateTime.parse(...))`. If you need a `DateTime`, use `DateTime.parse(...)` directly. If you need an `Instant`, use `Instant.parse(...)` directly.
+- **cloneProjectedAtTime vs cloneProjectedAtInstant:** When converting tests and logic that use `clock.now()` to project resource state into the future or past, do not wrap the Java `Instant` in `toDateTime()` just to call `cloneProjectedAtTime()`. Instead, switch the method call to use the native `cloneProjectedAtInstant()` method which is available on all `EppResource` models.
+- **Do not go in circles with the build:** If you see an `InlineMeSuggester` error, apply the suppression to **ALL** similar methods in that file and related files in one turn. Do not fix them one by one. Furthermore, do not run a global `./gradlew build` when a scoped `./gradlew :core:build` or `./gradlew :core:test` is faster and more appropriate. Run global builds only when doing final verification.
+- **Exception Conversion in Tests:** When migrating time types (e.g., from Joda `DateTime` to Java `Instant`), be extremely careful with tests that verify parsing failures (e.g., `assertThrows(IllegalArgumentException.class, ...)`). Joda's `DateTime.parse()` throws an `IllegalArgumentException` on failure, but `Instant.parse()` throws a `java.time.format.DateTimeParseException`. You must update the expected exception type in these tests to ensure they actually test the correct behavior, and verify the tests are not failing prematurely on the first line if it contains invalid data meant to be ignored.
+- Dagger/AutoValue corruption: If you modify a builder or a component incorrectly, Dagger will fail to generate code, leading to hundreds of "cannot find symbol" errors. If this happens, `git checkout` the last working state of the specific file and re-apply changes more surgically.
+- **`replace` tool context**: When using `replace` on large files (like `Tld.java` or `DomainBase.java`), provide significant surrounding context. These files have many similar method signatures (getters/setters) that can lead to incorrect replacements.
+
+---
+
+# GitHub and Pull Request Protocol
+
+This protocol defines the standard for interacting with GitHub repositories and processing Pull Request (PR) feedback.
+
+## 1. Interaction via `gh` CLI
+- **Primary Tool:** ALWAYS use the `gh` CLI for all GitHub-related operations (listing PRs, viewing PR content, checking status, adding comments).
+- **Credential Safety:** Never expose tokens or credentials in shell commands.
+
+## 2. Processing PR Feedback
+- **Systematic Review:** When asked to address PR comments, first fetch all comments using `gh pr view <number> --json reviews,comments`.
+- **Minimal Scope Expansion:** Address comments surgically. If a fix requires changes beyond a few lines or expands the PR's original scope significantly, DO NOT implement it without explicit user approval. Instead, report the issue to the user.
+- **Verification:** After addressing feedback, run the full build (`./gradlew build`) and relevant tests to ensure no regressions were introduced.
+
+## 3. PR Lifecycle Management
+- **One Commit Per PR:** Ensure all changes are squashed into a single, clean commit. Use `git commit --amend --no-edit` for follow-up fixes.
+- **Clean Workspace:** Always run `git status` and verify the repository state before declaring a task complete.
+- **Package Lock:** The Gradle build automatically modifies `console-webapp/package-lock.json` via the `npmInstallDeps` task. ALWAYS revert this file (`git checkout console-webapp/package-lock.json`) before staging changes or finalizing a commit unless you explicitly modified NPM dependencies.

common/src/main/java/google/registry/util/DateTimeUtils.java

@@ -22,6 +22,12 @@ import com.google.common.collect.Ordering;
 import java.sql.Date;
 import java.time.Instant;
 import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
+import java.time.format.DateTimeFormatterBuilder;
+import java.time.format.DateTimeParseException;
+import java.time.format.SignStyle;
+import java.time.temporal.ChronoField;
+import java.time.temporal.ChronoUnit;
 import javax.annotation.Nullable;
 import org.joda.time.DateTime;
 import org.joda.time.DateTimeZone;
@@ -55,6 +61,43 @@ public abstract class DateTimeUtils {
    */
   public static final Instant END_INSTANT = Instant.ofEpochMilli(Long.MAX_VALUE / 1000);
 
+  /**
+   * Standard ISO 8601 formatter with millisecond precision in UTC.
+   *
+   * <p>Example: {@code 2024-03-27T10:15:30.105Z}
+   *
+   * <p>Handles large/negative years by using a sign prefix if necessary, compatible with {@link
+   * Instant#parse}.
+   */
+  private static final DateTimeFormatter ISO_8601_FORMATTER =
+      new DateTimeFormatterBuilder()
+          .appendValue(ChronoField.YEAR, 4, 10, SignStyle.NORMAL)
+          .appendPattern("-MM-dd'T'HH:mm:ss.SSS'Z'")
+          .toFormatter()
+          .withZone(ZoneOffset.UTC);
+
+  /** Formats an {@link Instant} to an ISO-8601 string. */
+  public static String formatInstant(Instant instant) {
+    return ISO_8601_FORMATTER.format(instant);
+  }
+
+  /**
+   * Parses an ISO-8601 string to an {@link Instant}.
+   *
+   * <p>This method is lenient and supports both strings with and without millisecond precision
+   * (e.g. {@code 2024-03-27T10:15:30Z} and {@code 2024-03-27T10:15:30.105Z}). It also supports
+   * large years (e.g. {@code 294247-01-10T04:00:54.775Z}).
+   */
+  public static Instant parseInstant(String timestamp) {
+    try {
+      // Try the standard millisecond precision format first.
+      return Instant.from(ISO_8601_FORMATTER.parse(timestamp));
+    } catch (DateTimeParseException e) {
+      // Fall back to the standard ISO instant parser which handles varied precision.
+      return Instant.parse(timestamp);
+    }
+  }
+
   /** Returns the earliest of a number of given {@link DateTime} instances. */
   public static DateTime earliestOf(DateTime first, DateTime... rest) {
     return earliestDateTimeOf(Lists.asList(first, rest));
@@ -79,15 +122,26 @@ public abstract class DateTimeUtils {
 
   /** Returns the latest of a number of given {@link DateTime} instances. */
   public static DateTime latestOf(DateTime first, DateTime... rest) {
+    return latestDateTimeOf(Lists.asList(first, rest));
+  }
+
+  /** Returns the latest of a number of given {@link Instant} instances. */
+  public static Instant latestOf(Instant first, Instant... rest) {
     return latestOf(Lists.asList(first, rest));
   }
 
   /** Returns the latest element in a {@link DateTime} iterable. */
-  public static DateTime latestOf(Iterable<DateTime> dates) {
+  public static DateTime latestDateTimeOf(Iterable<DateTime> dates) {
     checkArgument(!Iterables.isEmpty(dates));
     return Ordering.<DateTime>natural().max(dates);
   }
 
+  /** Returns the latest element in a {@link Instant} iterable. */
+  public static Instant latestOf(Iterable<Instant> instants) {
+    checkArgument(!Iterables.isEmpty(instants));
+    return Ordering.<Instant>natural().max(instants);
+  }
+
   /** Returns whether the first {@link DateTime} is equal to or earlier than the second. */
   public static boolean isBeforeOrAt(DateTime timeToCheck, DateTime timeToCompareTo) {
     return !timeToCheck.isAfter(timeToCompareTo);
@@ -112,8 +166,7 @@ public abstract class DateTimeUtils {
    * Adds years to a date, in the {@code Duration} sense of semantic years. Use this instead of
    * {@link DateTime#plusYears} to ensure that we never end up on February 29.
    */
-  @Deprecated
-  public static DateTime leapSafeAddYears(DateTime now, int years) {
+  public static DateTime plusYears(DateTime now, int years) {
     checkArgument(years >= 0);
     return years == 0 ? now : now.plusYears(1).plusYears(years - 1);
   }
@@ -122,19 +175,30 @@ public abstract class DateTimeUtils {
    * Adds years to a date, in the {@code Duration} sense of semantic years. Use this instead of
    * {@link java.time.ZonedDateTime#plusYears} to ensure that we never end up on February 29.
    */
-  public static Instant leapSafeAddYears(Instant now, long years) {
+  public static Instant plusYears(Instant now, int years) {
     checkArgument(years >= 0);
     return (years == 0)
         ? now
         : now.atZone(ZoneOffset.UTC).plusYears(1).plusYears(years - 1).toInstant();
   }
 
+  /** Adds months to a date. */
+  public static Instant plusMonths(Instant now, int months) {
+    checkArgument(months >= 0);
+    return now.atZone(ZoneOffset.UTC).plusMonths(months).toInstant();
+  }
+
+  /** Subtracts months from a date. */
+  public static Instant minusMonths(Instant now, int months) {
+    checkArgument(months >= 0);
+    return now.atZone(ZoneOffset.UTC).minusMonths(months).toInstant();
+  }
+
   /**
    * Subtracts years from a date, in the {@code Duration} sense of semantic years. Use this instead
    * of {@link DateTime#minusYears} to ensure that we never end up on February 29.
    */
-  @Deprecated
-  public static DateTime leapSafeSubtractYears(DateTime now, int years) {
+  public static DateTime minusYears(DateTime now, int years) {
     checkArgument(years >= 0);
     return years == 0 ? now : now.minusYears(1).minusYears(years - 1);
   }
@@ -143,13 +207,31 @@ public abstract class DateTimeUtils {
    * Subtracts years from a date, in the {@code Duration} sense of semantic years. Use this instead
    * of {@link java.time.ZonedDateTime#minusYears} to ensure that we never end up on February 29.
    */
-  public static Instant leapSafeSubtractYears(Instant now, int years) {
+  public static Instant minusYears(Instant now, long years) {
     checkArgument(years >= 0);
     return (years == 0)
         ? now
         : now.atZone(ZoneOffset.UTC).minusYears(1).minusYears(years - 1).toInstant();
   }
 
+  /**
+   * @deprecated Use {@link #plusYears(DateTime, int)}
+   */
+  @Deprecated
+  @SuppressWarnings("InlineMeSuggester")
+  public static DateTime leapSafeAddYears(DateTime now, int years) {
+    return plusYears(now, years);
+  }
+
+  /**
+   * @deprecated Use {@link #minusYears(DateTime, int)}
+   */
+  @Deprecated
+  @SuppressWarnings("InlineMeSuggester")
+  public static DateTime leapSafeSubtractYears(DateTime now, int years) {
+    return minusYears(now, years);
+  }
+
   public static Date toSqlDate(LocalDate localDate) {
     return new Date(localDate.toDateTimeAtStartOfDay().getMillis());
   }
@@ -176,8 +258,20 @@ public abstract class DateTimeUtils {
     return (instant == null) ? null : org.joda.time.Instant.ofEpochMilli(instant.toEpochMilli());
   }
 
-  public static Instant plusYears(Instant instant, int years) {
-    return instant.atZone(ZoneOffset.UTC).plusYears(years).toInstant();
+  public static Instant plusHours(Instant instant, long hours) {
+    return instant.plus(hours, ChronoUnit.HOURS);
+  }
+
+  public static Instant minusHours(Instant instant, long hours) {
+    return instant.minus(hours, ChronoUnit.HOURS);
+  }
+
+  public static Instant plusMinutes(Instant instant, long minutes) {
+    return instant.plus(minutes, ChronoUnit.MINUTES);
+  }
+
+  public static Instant minusMinutes(Instant instant, long minutes) {
+    return instant.minus(minutes, ChronoUnit.MINUTES);
   }
 
   public static Instant plusDays(Instant instant, int days) {

common/src/main/java/google/registry/util/SystemClock.java

@@ -18,6 +18,7 @@ import static org.joda.time.DateTimeZone.UTC;
 
 import jakarta.inject.Inject;
 import java.time.Instant;
+import java.time.temporal.ChronoUnit;
 import javax.annotation.concurrent.ThreadSafe;
 import org.joda.time.DateTime;
 
@@ -42,6 +43,6 @@ public class SystemClock implements Clock {
     // (which uses millisecond precision via DateTimeConverter). This prevents subtle comparison
     // bugs where a high-precision Instant would be considered "after" a truncated database
     // timestamp.
-    return Instant.now().truncatedTo(java.time.temporal.ChronoUnit.MILLIS);
+    return Instant.now().truncatedTo(ChronoUnit.MILLIS);
   }
 }

common/src/main/java/google/registry/util/SystemSleeper.java

@@ -19,6 +19,7 @@ import static com.google.common.base.Preconditions.checkArgument;
 import com.google.common.util.concurrent.Uninterruptibles;
 import jakarta.inject.Inject;
 import java.io.Serializable;
+import java.time.Duration;
 import javax.annotation.concurrent.ThreadSafe;
 import org.joda.time.ReadableDuration;
 
@@ -40,6 +41,6 @@ public final class SystemSleeper implements Sleeper, Serializable {
   @Override
   public void sleepUninterruptibly(ReadableDuration duration) {
     checkArgument(duration.getMillis() >= 0);
-    Uninterruptibles.sleepUninterruptibly(java.time.Duration.ofMillis(duration.getMillis()));
+    Uninterruptibles.sleepUninterruptibly(Duration.ofMillis(duration.getMillis()));
   }
 }

common/src/testing/java/google/registry/testing/FakeClock.java

@@ -49,6 +49,11 @@ public final class FakeClock implements Clock {
     setTo(startTime);
   }
 
+  /** Creates a FakeClock initialized to a specific time. */
+  public FakeClock(Instant startTime) {
+    setTo(startTime);
+  }
+
   /** Returns the current time. */
   @Override
   public DateTime nowUtc() {
@@ -89,6 +94,11 @@ public final class FakeClock implements Clock {
     currentTimeMillis.set(time.getMillis());
   }
 
+  /** Sets the time to the specified instant. */
+  public void setTo(Instant time) {
+    currentTimeMillis.set(time.toEpochMilli());
+  }
+
   /** Invokes {@link #setAutoIncrementStep} with one millisecond-step. */
   public FakeClock setAutoIncrementByOneMilli() {
     return setAutoIncrementStep(Duration.millis(1));

common/src/testing/java/google/registry/testing/truth/TextDiffSubject.java

@@ -33,6 +33,8 @@ import com.google.common.truth.Fact;
 import com.google.common.truth.FailureMetadata;
 import com.google.common.truth.SimpleSubjectBuilder;
 import com.google.common.truth.Subject;
+import com.google.errorprone.annotations.FormatMethod;
+import com.google.errorprone.annotations.FormatString;
 import java.io.IOException;
 import java.net.URL;
 import java.util.Collection;
@@ -125,8 +127,9 @@ public class TextDiffSubject extends Subject {
     return assertThat(Resources.asCharSource(resourceUrl, UTF_8).readLines());
   }
 
+  @FormatMethod
   public static SimpleSubjectBuilder<TextDiffSubject, URL> assertWithMessageAboutUrlSource(
-      String format, Object... params) {
+      @FormatString String format, Object... params) {
     return assertWithMessage(format, params).about(urlFactory());
   }
 
@@ -192,7 +195,7 @@ public class TextDiffSubject extends Subject {
 
   private record SideBySideRowFormatter(int maxExpectedLineLength, int maxActualLineLength) {
 
-    public String formatRow(String expected, String actual, char padChar) {
+    String formatRow(String expected, String actual, char padChar) {
       return String.format(
           "|%s|%s|",
           Strings.padEnd(expected, maxExpectedLineLength, padChar),

config/presubmits.py

@@ -104,7 +104,7 @@ PRESUBMITS = {
 
     # System.(out|err).println should only appear in tools/ or load-testing/
     PresubmitCheck(
-        r".*\bSystem\.(out|err)\.print", "java", {
+        r".*\bSystem\s*\.\s*(?:out|err)\s*\.\s*print.*", "java", {
             "/tools/", "/example/", "/load-testing/",
             "RegistryTestServerMain.java", "TestServerExtension.java"
         }):
@@ -139,7 +139,7 @@ PRESUBMITS = {
     ):
         "All soy templates must use strict autoescaping",
     PresubmitCheck(
-        r".*\nimport (static )?.*\.shaded\..*",
+        r".*\nimport\s+(?:static\s+)?.*\.shaded\..*",
         "java",
         {"/node_modules/"},
     ):
@@ -153,7 +153,7 @@ PRESUBMITS = {
     PresubmitCheck(
         r".*java\.util\.Date.*",
         "java",
-        {"/node_modules/", "JpaTransactionManagerImpl.java"},
+        {"/node_modules/", "JpaTransactionManagerImpl.java", "DateTimeUtils.java"},
     ):
         "Do not use java.util.Date. Use classes in java.time package instead.",
     PresubmitCheck(
@@ -163,7 +163,7 @@ PRESUBMITS = {
     ):
         "Use status code from jakarta.servlet.http.HttpServletResponse.",
     PresubmitCheck(
-        r".*mock\(Response\.class\).*",
+        r".*mock\(\s*Response\.class\s*\).*",
         "java",
         {"/node_modules/"},
     ):
@@ -181,13 +181,122 @@ PRESUBMITS = {
     ):
         "Do not use javax.inject.* Use jakarta.inject.* instead.",
     PresubmitCheck(
-        r".*import jakarta.persistence.(Pre|Post)(Persist|Load|Remove|Update);",
+        r".*import\s+jakarta\.persistence\.(?:Pre|Post)(?:Persist|Load|Remove|Update)\s*;",
         "java",
         {"EntityCallbacksListener.java"},
     ):
         "Hibernate lifecycle events aren't called for embedded entities, so it's "
         "usually best to avoid them. Instead, use the annotations defined in "
-        "EntityCallbacksListener.java"
+        "EntityCallbacksListener.java",
+    PresubmitCheck(
+        r".*\.isEqualTo\(\s*Optional\.of\(.*",
+        "java",
+        {},
+    ):
+        "Do not use .isEqualTo(Optional.of(...)). Use Truth's .hasValue(...) instead.",
+    # TODO: Remove the java.time migration presubmit checks below once the entire codebase has been migrated to java.time.
+    PresubmitCheck(
+        r".*toDateTime\(\s*toInstant\(.*",
+        "java",
+        {"DateTimeUtilsTest.java"},
+    ):
+        "Do not double-wrap toDateTime(toInstant(...)).",
+    PresubmitCheck(
+        r".*toInstant\(\s*toDateTime\(.*",
+        "java",
+        {"DateTimeUtilsTest.java"},
+    ):
+        "Do not double-wrap toInstant(toDateTime(...)).",
+    PresubmitCheck(
+        r".*toInstant\([^;]*[cC]lock\.nowUtc\(\).*",
+        "java",
+        {},
+    ):
+        "Do not use toInstant(clock.nowUtc()). Use clock.now() instead.",
+    PresubmitCheck(
+        r".*toDateTime\([^;]*[cC]lock\.now\(\).*",
+        "java",
+        {},
+    ):
+        "Do not use toDateTime(clock.now()). Use clock.nowUtc() instead.",
+    PresubmitCheck(
+        r".*toInstant\([^;]*tm\(\)\.getTransactionTime\(\).*",
+        "java",
+        {},
+    ):
+        "Do not use toInstant(tm().getTransactionTime()). Use tm().getTxTime() instead.",
+    PresubmitCheck(
+        r".*toDateTime\([^;]*tm\(\)\.getTxTime\(\).*",
+        "java",
+        {},
+    ):
+        "Do not use toDateTime(tm().getTxTime()). Use tm().getTransactionTime() instead.",
+    PresubmitCheck(
+        r".*\(\s*Instant\s*\)\s*(?:this\.)?(?:fakeClock|clock)\.now\(\s*\).*",
+        "java",
+        {},
+    ):
+        "Do not unnecessarily cast clock.now() to Instant.",
+    PresubmitCheck(
+        r".*toDateTime\(\s*Instant\.now\(.*",
+        "java",
+        {},
+    ):
+        "Do not wrap Instant.now() in toDateTime. Use DateTime.now(UTC) directly.",
+    PresubmitCheck(
+        r".*toInstant\(\s*DateTime\.now\(.*",
+        "java",
+        {},
+    ):
+        "Do not wrap DateTime.now() in toInstant. Use Instant.now().truncatedTo(ChronoUnit.MILLIS) directly.",
+    PresubmitCheck(
+        r".*toDateTime\(\s*Instant\.parse\(.*",
+        "java",
+        {"DateTimeUtilsTest.java"},
+    ):
+        "Do not wrap Instant.parse in toDateTime. Use DateTime.parse directly.",
+    PresubmitCheck(
+        r".*toInstant\(\s*DateTime\.parse\(.*",
+        "java",
+        {"DateTimeUtilsTest.java"},
+    ):
+        "Do not wrap DateTime.parse in toInstant. Use Instant.parse directly.",
+    PresubmitCheck(
+        r".*cloneProjectedAtTime\(\s*toDateTime\(.*",
+        "java",
+        {},
+    ):
+        "Do not use cloneProjectedAtTime(toDateTime(...)). Use cloneProjectedAtInstant(...) instead.",
+    PresubmitCheck(
+        r".*ZoneId\.of\(\s*\"UTC\"\s*\).*",
+        "java",
+        {},
+    ):
+        "Do not use ZoneId.of(\"UTC\"). Use java.time.ZoneOffset.UTC.",
+    PresubmitCheck(
+        r".*toDateTime\(\s*END_INSTANT\s*\).*",
+        "java",
+        {"DateTimeUtilsTest.java"},
+    ):
+        "Do not wrap END_INSTANT in toDateTime. Use END_OF_TIME.",
+    PresubmitCheck(
+        r".*toInstant\(\s*END_OF_TIME\s*\).*",
+        "java",
+        {"DateTimeUtilsTest.java"},
+    ):
+        "Do not wrap END_OF_TIME in toInstant. Use END_INSTANT.",
+    PresubmitCheck(
+        r".*toDateTime\(\s*START_INSTANT\s*\).*",
+        "java",
+        {"DateTimeUtilsTest.java"},
+    ):
+        "Do not wrap START_INSTANT in toDateTime. Use START_OF_TIME.",
+    PresubmitCheck(
+        r".*toInstant\(\s*START_OF_TIME\s*\).*",
+        "java",
+        {"DateTimeUtilsTest.java"},
+    ):
+        "Do not wrap START_OF_TIME in toInstant. Use START_INSTANT."
 }
 
 # Note that this regex only works for one kind of Flyway file.  If we want to

console-webapp/package-lock.json

@@ -628,18 +628,6 @@
         }
       }
     },
-    "node_modules/@angular/build/node_modules/@types/node": {
-      "version": "25.5.0",
-      "resolved": "https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/@types/node/-/node-25.5.0.tgz",
-      "integrity": "sha512-jp2P3tQMSxWugkCUKLRPVUpGaL5MVFwF8RDuSRztfwgN1wmqJeMSbKlnEtQqU8UrhTmzEmZdu2I6v2dpp7XIxw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "undici-types": "~7.18.0"
-      }
-    },
     "node_modules/@angular/build/node_modules/@vitejs/plugin-basic-ssl": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/@vitejs/plugin-basic-ssl/-/plugin-basic-ssl-2.1.0.tgz",
@@ -653,24 +641,6 @@
         "vite": "^6.0.0 || ^7.0.0"
       }
     },
-    "node_modules/@angular/build/node_modules/chokidar": {
-      "version": "5.0.0",
-      "resolved": "https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/chokidar/-/chokidar-5.0.0.tgz",
-      "integrity": "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "readdirp": "^5.0.0"
-      },
-      "engines": {
-        "node": ">= 20.19.0"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
-      }
-    },
     "node_modules/@angular/build/node_modules/magic-string": {
       "version": "0.30.21",
       "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
@@ -694,22 +664,6 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
-    "node_modules/@angular/build/node_modules/readdirp": {
-      "version": "5.0.0",
-      "resolved": "https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/readdirp/-/readdirp-5.0.0.tgz",
-      "integrity": "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "engines": {
-        "node": ">= 20.19.0"
-      },
-      "funding": {
-        "type": "individual",
-        "url": "https://paulmillr.com/funding/"
-      }
-    },
     "node_modules/@angular/build/node_modules/rxjs": {
       "version": "7.8.2",
       "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.2.tgz",
@@ -743,15 +697,6 @@
         "node": ">= 12"
       }
     },
-    "node_modules/@angular/build/node_modules/undici-types": {
-      "version": "7.18.2",
-      "resolved": "https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/undici-types/-/undici-types-7.18.2.tgz",
-      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true
-    },
     "node_modules/@angular/build/node_modules/vite": {
       "version": "7.3.0",
       "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.0.tgz",
@@ -971,24 +916,6 @@
         "url": "https://github.com/chalk/chalk?sponsor=1"
       }
     },
-    "node_modules/@angular/cli/node_modules/chokidar": {
-      "version": "5.0.0",
-      "resolved": "https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/chokidar/-/chokidar-5.0.0.tgz",
-      "integrity": "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "readdirp": "^5.0.0"
-      },
-      "engines": {
-        "node": ">= 20.19.0"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
-      }
-    },
     "node_modules/@angular/cli/node_modules/cli-spinners": {
       "version": "3.4.0",
       "resolved": "https://registry.npmjs.org/cli-spinners/-/cli-spinners-3.4.0.tgz",
@@ -1092,22 +1019,6 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
-    "node_modules/@angular/cli/node_modules/readdirp": {
-      "version": "5.0.0",
-      "resolved": "https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/readdirp/-/readdirp-5.0.0.tgz",
-      "integrity": "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "engines": {
-        "node": ">= 20.19.0"
-      },
-      "funding": {
-        "type": "individual",
-        "url": "https://paulmillr.com/funding/"
-      }
-    },
     "node_modules/@angular/cli/node_modules/rxjs": {
       "version": "7.8.2",
       "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.2.tgz",
@@ -4695,24 +4606,6 @@
         "url": "https://github.com/chalk/chalk?sponsor=1"
       }
     },
-    "node_modules/@schematics/angular/node_modules/chokidar": {
-      "version": "5.0.0",
-      "resolved": "https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/chokidar/-/chokidar-5.0.0.tgz",
-      "integrity": "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "readdirp": "^5.0.0"
-      },
-      "engines": {
-        "node": ">= 20.19.0"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
-      }
-    },
     "node_modules/@schematics/angular/node_modules/cli-spinners": {
       "version": "3.4.0",
       "resolved": "https://registry.npmjs.org/cli-spinners/-/cli-spinners-3.4.0.tgz",
@@ -4816,22 +4709,6 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
-    "node_modules/@schematics/angular/node_modules/readdirp": {
-      "version": "5.0.0",
-      "resolved": "https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/readdirp/-/readdirp-5.0.0.tgz",
-      "integrity": "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "engines": {
-        "node": ">= 20.19.0"
-      },
-      "funding": {
-        "type": "individual",
-        "url": "https://paulmillr.com/funding/"
-      }
-    },
     "node_modules/@schematics/angular/node_modules/rxjs": {
       "version": "7.8.2",
       "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.2.tgz",

core/build.gradle

@@ -190,6 +190,9 @@ dependencies {
   testRuntimeOnly deps['guru.nidi:graphviz-java-all-j2v8']
   testImplementation deps['io.github.classgraph:classgraph']
   testRuntimeOnly deps['io.github.java-diff-utils:java-diff-utils']
+  testImplementation deps['io.github.ss-bhatt:testcontainers-valkey']
+  implementation deps['io.protostuff:protostuff-core']
+  implementation deps['io.protostuff:protostuff-runtime']
   implementation deps['jakarta.inject:jakarta.inject-api']
   implementation deps['jakarta.mail:jakarta.mail-api']
   implementation deps['jakarta.persistence:jakarta.persistence-api']
@@ -243,6 +246,7 @@ dependencies {
   implementation deps['org.testcontainers:postgresql']
   testImplementation deps['org.testcontainers:selenium']
   testImplementation deps['org.testcontainers:testcontainers']
+  implementation deps['redis.clients:jedis']
   implementation deps['us.fatehi:schemacrawler']
   implementation deps['us.fatehi:schemacrawler-api']
   implementation deps['us.fatehi:schemacrawler-diagram']

core/gradle.lockfile

@@ -19,13 +19,13 @@ com.github.ben-manes.caffeine:caffeine:3.2.3=compileClasspath,deploy_jar,nonprod
 com.github.docker-java:docker-java-api:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.docker-java:docker-java-transport-zerodep:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.docker-java:docker-java-transport:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jffi:1.3.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jffi:1.3.15=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-a64asm:1.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-constants:0.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-enxio:0.32.19=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-ffi:2.2.18=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-posix:3.1.21=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-unixsocket:0.38.24=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-enxio:0.32.20=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-ffi:2.2.19=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-posix:3.1.22=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-unixsocket:0.38.25=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-x86asm:1.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.android:annotations:4.1.1.4=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
@@ -37,81 +37,58 @@ com.google.api-client:google-api-client-servlet:2.9.0=compileClasspath,nonprodCo
 com.google.api-client:google-api-client:2.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:gapic-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.api.grpc:gapic-google-cloud-storage-v2:2.67.0=testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.181.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.181.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.181.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.181.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.44.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.114.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.115.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.14.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.14.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.193.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.193.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.73.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.130.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-v1:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-control-v2:2.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.api.grpc:grpc-google-cloud-storage-v2:2.67.0=testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-common-protos:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:grpc-google-common-protos:2.45.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.9.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha:3.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha:3.9.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.181.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.181.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.181.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.181.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.44.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-v2:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-v2:2.44.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-common-protos:2.65.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha:3.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.193.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.193.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta:3.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.73.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigtable-v2:2.73.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-compute-v1:1.82.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.112.2=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.113.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-firestore-v1:3.25.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-firestore-v1:3.26.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-monitoring-v3:3.52.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.114.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.115.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.14.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.14.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.125.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-firestore-v1:3.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-monitoring-v3:3.85.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.130.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-secretmanager-v1beta2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-executor-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-spanner-v1:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-spanner-v1:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-v1:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-control-v2:2.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-storage-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.api.grpc:proto-google-cloud-storage-v2:2.67.0=testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.141.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.141.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-common-protos:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-iam-v1:1.50.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.60.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.api.grpc:proto-google-iam-v1:1.65.0=testCompileClasspath,testRuntimeClasspath
 com.google.api:api-common:2.57.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.api:api-common:2.62.0=testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-grpc:2.64.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api:gax-grpc:2.74.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.api:gax-grpc:2.79.0=testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-httpjson:2.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api:gax-httpjson:2.74.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.api:gax-httpjson:2.79.0=testCompileClasspath,testRuntimeClasspath
 com.google.api:gax:2.74.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-admin-directory:directory_v1-rev20260227-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-bigquery:v2-rev20240815-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-cloudresourcemanager:v1-rev20240310-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-bigquery:v2-rev20251012-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20250606-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-dataflow:v1b3-rev20260405-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-dns:v1-rev20260402-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-drive:v3-rev20260405-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-gmail:v1-rev20260112-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-gmail:v1-rev20260413-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20220614-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240130-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-iam:v2-rev20250502-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -119,61 +96,50 @@ com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileC
 com.google.apis:google-api-services-monitoring:v3-rev20260129-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sheets:v4-rev20260213-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sqladmin:v1beta4-rev20251201-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20250312-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20260317-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20251118-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20260204-2.0.0=testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-credentials:1.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.auth:google-auth-library-credentials:1.46.0=testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-oauth2-http:1.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.auth:google-auth-library-oauth2-http:1.46.0=testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-credentials:1.46.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-oauth2-http:1.46.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service-annotations:1.0.1=nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.auto.service:auto-service-annotations:1.1.1=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service:1.1.1=annotationProcessor
 com.google.auto.value:auto-value-annotations:1.11.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.value:auto-value-annotations:1.9=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.auto.value:auto-value:1.11.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auto.value:auto-value:1.11.1=annotationProcessor,testAnnotationProcessor
+com.google.auto.value:auto-value:1.11.1=annotationProcessor,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
 com.google.auto:auto-common:1.2.2=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.cloud.bigdataoss:gcsio:2.2.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.bigdataoss:util:2.2.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.bigdataoss:gcsio:2.2.26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.bigdataoss:util:2.2.26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.bigtable:bigtable-client-core-config:1.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.datastore:datastore-v1-proto-client:2.21.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.opentelemetry:detector-resources-support:0.31.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud.opentelemetry:detector-resources-support:0.33.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud.datastore:datastore-v1-proto-client:2.34.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.opentelemetry:detector-resources-support:0.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.opentelemetry:exporter-metrics:0.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.opentelemetry:shared-resourcemapping:0.33.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud.sql:jdbc-socket-factory-core:1.28.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.28.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-bigquerystorage:3.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-bigquerystorage:3.9.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-bigtable:2.43.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-bigtable:2.44.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud.sql:jdbc-socket-factory-core:1.28.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.28.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-bigquerystorage:3.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-bigtable:2.73.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-compute:1.82.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.54.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.64.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.cloud:google-cloud-core-grpc:2.69.0=testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-http:2.54.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.cloud:google-cloud-core-http:2.69.0=testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-firestore:3.25.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-firestore:3.26.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-monitoring:3.52.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-firestore:3.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-monitoring:3.85.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-nio:0.131.0=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-pubsub:1.132.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-pubsub:1.133.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-pubsublite:1.14.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-pubsublite:1.14.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-pubsub:1.148.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-secretmanager:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-spanner:6.74.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-spanner:6.77.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-spanner:6.111.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage-control:2.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-storage:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-tasks:2.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:grpc-gcp:1.6.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:grpc-gcp:1.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:libraries-bom:26.48.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.25.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.26.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.code.gson:gson:2.10.1=soy
-com.google.code.gson:gson:2.12.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.code.gson:gson:2.13.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.common.html.types:types:1.0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.google.dagger:dagger-compiler:2.59.2=annotationProcessor,testAnnotationProcessor
 com.google.dagger:dagger-spi:2.59.2=annotationProcessor,testAnnotationProcessor
@@ -182,17 +148,15 @@ com.google.devtools.ksp:symbol-processing-api:2.2.20-2.0.3=annotationProcessor,t
 com.google.errorprone:error_prone_annotation:2.48.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.20.0=soy
 com.google.errorprone:error_prone_annotations:2.36.0=checkstyle
-com.google.errorprone:error_prone_annotations:2.48.0=annotationProcessor,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.48.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
+com.google.errorprone:error_prone_annotations:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_check_api:2.48.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.48.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.escapevelocity:escapevelocity:1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-com.google.flatbuffers:flatbuffers-java:23.5.26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.flogger:flogger-system-backend:0.7.4=soy
-com.google.flogger:flogger-system-backend:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.flogger:flogger:0.7.4=soy
-com.google.flogger:flogger:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.flogger:google-extensions:0.7.4=soy
-com.google.flogger:google-extensions:0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.flatbuffers:flatbuffers-java:24.3.25=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.flogger:flogger-system-backend:0.7.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
+com.google.flogger:flogger:0.7.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
+com.google.flogger:google-extensions:0.7.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.google.googlejavaformat:google-java-format:1.34.1=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.guava:failureaccess:1.0.1=soy
 com.google.guava:failureaccess:1.0.3=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
@@ -201,8 +165,8 @@ com.google.guava:guava-testlib:33.3.0-jre=testRuntimeClasspath
 com.google.guava:guava-testlib:33.6.0-jre=testCompileClasspath
 com.google.guava:guava:32.1.1-jre=soy
 com.google.guava:guava:33.4.8-jre=checkstyle
-com.google.guava:guava:33.5.0-jre=annotationProcessor,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
-com.google.guava:guava:33.6.0-jre=testCompileClasspath
+com.google.guava:guava:33.5.0-jre=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
+com.google.guava:guava:33.6.0-jre=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-apache-v2:2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
@@ -212,8 +176,7 @@ com.google.http-client:google-http-client-appengine:2.1.0=testCompileClasspath,t
 com.google.http-client:google-http-client-gson:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-jackson2:1.46.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.http-client:google-http-client-jackson2:2.1.0=testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-protobuf:1.44.2=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.http-client:google-http-client-protobuf:1.45.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-protobuf:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject:guice:7.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.google.j2objc:j2objc-annotations:3.0.0=checkstyle
@@ -231,12 +194,11 @@ com.google.oauth-client:google-oauth-client-servlet:1.36.0=deploy_jar,nonprodRun
 com.google.oauth-client:google-oauth-client-servlet:1.39.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.oauth-client:google-oauth-client:1.39.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java-util:4.33.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.protobuf:protobuf-java-util:4.34.1=testCompileClasspath,testRuntimeClasspath
+com.google.protobuf:protobuf-java-util:4.35.0-RC1=testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java:3.21.7=soy
 com.google.protobuf:protobuf-java:4.33.2=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.protobuf:protobuf-java:4.34.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.re2j:re2j:1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-com.google.re2j:re2j:1.8=testRuntimeClasspath
+com.google.protobuf:protobuf-java:4.35.0-RC1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.re2j:re2j:1.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.template:soy:2024-02-26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.google.truth:truth:1.4.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.googlecode.json-simple:json-simple:1.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -290,70 +252,56 @@ io.github.classgraph:classgraph:4.8.162=compileClasspath,deploy_jar,nonprodCompi
 io.github.eisop:dataflow-errorprone:3.41.0-eisop1=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 io.github.java-diff-utils:java-diff-utils:4.16=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-alts:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.github.ss-bhatt:testcontainers-valkey:1.0.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-alts:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.grpc:grpc-alts:1.80.0=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.70.0=compileClasspath,nonprodCompileClasspath
-io.grpc:grpc-api:1.71.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-api:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.grpc:grpc-api:1.80.0=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-auth:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-auth:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.grpc:grpc-auth:1.80.0=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-census:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-census:1.68.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.71.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-census:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.grpc:grpc-context:1.80.0=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-core:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-core:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.grpc:grpc-core:1.80.0=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-googleapis:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-googleapis:1.76.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
 io.grpc:grpc-googleapis:1.80.0=testRuntimeClasspath
-io.grpc:grpc-grpclb:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-grpclb:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.grpc:grpc-grpclb:1.80.0=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-inprocess:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-inprocess:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.grpc:grpc-inprocess:1.80.0=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-netty-shaded:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-netty-shaded:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.grpc:grpc-netty-shaded:1.80.0=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-netty:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-netty:1.68.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-opentelemetry:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-netty:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-opentelemetry:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.grpc:grpc-opentelemetry:1.80.0=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf-lite:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-protobuf-lite:1.76.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
 io.grpc:grpc-protobuf-lite:1.80.0=testRuntimeClasspath
-io.grpc:grpc-protobuf:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-protobuf:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.grpc:grpc-protobuf:1.80.0=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-rls:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-rls:1.76.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
 io.grpc:grpc-rls:1.80.0=testRuntimeClasspath
-io.grpc:grpc-services:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-services:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-services:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
 io.grpc:grpc-services:1.80.0=testRuntimeClasspath
-io.grpc:grpc-stub:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-stub:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.grpc:grpc-stub:1.80.0=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-util:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-util:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-util:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
 io.grpc:grpc-util:1.80.0=testRuntimeClasspath
-io.grpc:grpc-xds:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-xds:1.70.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-xds:1.76.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
 io.grpc:grpc-xds:1.80.0=testRuntimeClasspath
-io.netty:netty-buffer:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-buffer:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-codec-http2:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-codec-http2:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-codec-http:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-codec-http:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-codec-socks:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-codec:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-codec:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-common:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-common:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-handler-proxy:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-handler:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-handler:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-resolver:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-resolver:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.netty:netty-buffer:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-http2:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-http:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-socks:4.1.124.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.netty:netty-codec:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-common:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-handler-proxy:4.1.124.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.netty:netty-handler:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-resolver:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-tcnative-boringssl-static:2.0.52.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-tcnative-classes:2.0.52.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-transport-native-unix-common:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-transport-native-unix-common:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-transport:4.1.100.Final=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.netty:netty-transport:4.1.110.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.netty:netty-transport-native-unix-common:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-transport:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-api:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-contrib-exemplar-util:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-contrib-grpc-metrics:0.31.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
@@ -371,31 +319,33 @@ io.opentelemetry.instrumentation:opentelemetry-grpc-1.6:2.1.0-alpha=compileClass
 io.opentelemetry.instrumentation:opentelemetry-instrumentation-api-incubator:2.1.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.instrumentation:opentelemetry-instrumentation-api:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.semconv:opentelemetry-semconv:1.29.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-api-incubator:1.42.1-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-api:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-api:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.opentelemetry:opentelemetry-api:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-bom:1.42.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-common:1.60.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-context:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-context:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.opentelemetry:opentelemetry-context:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-exporter-logging:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-extension-incubator:1.35.0-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-common:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-common:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.opentelemetry:opentelemetry-sdk-common:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.60.1=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:1.60.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-logs:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-logs:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.opentelemetry:opentelemetry-sdk-logs:1.60.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-metrics:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-metrics:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.opentelemetry:opentelemetry-sdk-metrics:1.60.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-trace:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-trace:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.opentelemetry:opentelemetry-sdk-trace:1.60.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 io.opentelemetry:opentelemetry-sdk:1.60.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-semconv:1.26.0-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.outfoxx:swiftpoet:1.3.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.perfmark:perfmark-api:0.27.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.protostuff:protostuff-api:1.8.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.protostuff:protostuff-collectionschema:1.8.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.protostuff:protostuff-core:1.8.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.protostuff:protostuff-runtime:1.8.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 jakarta-regexp:jakarta-regexp:1.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 jakarta.activation:jakarta.activation-api:2.1.4=jaxb
 jakarta.activation:jakarta.activation-api:2.2.0-M1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -411,11 +361,11 @@ javax.annotation:jsr250-api:1.0=compileClasspath,deploy_jar,nonprodCompileClassp
 javax.inject:javax.inject:1=annotationProcessor,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 javax.jdo:jdo2-api:2.3-20090302111651=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 javax.validation:validation-api:1.0.0.GA=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-joda-time:joda-time:2.12.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+joda-time:joda-time:2.14.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 junit:junit:4.13.2=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.arnx:nashorn-promise:0.1.1=testRuntimeClasspath
 net.bytebuddy:byte-buddy-agent:1.17.7=testCompileClasspath,testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.14.12=compileClasspath,nonprodCompileClasspath
+net.bytebuddy:byte-buddy:1.17.7=compileClasspath,nonprodCompileClasspath
 net.bytebuddy:byte-buddy:1.17.8=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
 net.bytebuddy:byte-buddy:1.18.8-jdk5=testCompileClasspath,testRuntimeClasspath
 net.java.dev.jna:jna:5.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -426,36 +376,38 @@ org.antlr:ST4:4.3.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodR
 org.antlr:antlr-runtime:3.5.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.antlr:antlr4-runtime:4.13.2=checkstyle,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.antlr:antlr4:4.13.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.arrow:arrow-format:15.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.arrow:arrow-memory-core:15.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.arrow:arrow-vector:15.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.avro:avro:1.12.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-fn-execution:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-job-management:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-pipeline:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.arrow:arrow-format:17.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.arrow:arrow-memory-core:17.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.arrow:arrow-vector:17.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.avro:avro:1.11.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-fn-execution:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-job-management:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-pipeline:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-runners-core-construction-java:2.54.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-core-java:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-direct-java:2.60.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-java-fn-execution:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-core:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-expansion-service:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-arrow:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-avro:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-core-java:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-direct-java:2.72.0=testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-java-fn-execution:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-core:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-expansion-service:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-arrow:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-avro:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-sdks-java-fn-execution:2.54.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-harness:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-transform-service-launcher:2.60.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-vendor-grpc-1_60_1:0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-harness:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-transform-service-launcher:2.72.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-vendor-grpc-1_60_1:0.1=testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-vendor-grpc-1_69_0:0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-vendor-guava-32_1_2-jre:0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-compress:1.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-compress:1.26.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-csv:1.14.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-exec:1.3=testRuntimeClasspath
 org.apache.commons:commons-lang3:3.18.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 org.apache.commons:commons-lang3:3.20.0=testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-lang3:3.8.1=checkstyle
+org.apache.commons:commons-pool2:2.12.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-text:1.15.0=testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-text:1.3=checkstyle
 org.apache.ftpserver:ftplet-api:1.2.1=testCompileClasspath,testRuntimeClasspath
@@ -501,8 +453,6 @@ org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,deploy_jar,nonprodCo
 org.eclipse.angus:angus-activation:2.0.3=jaxb
 org.eclipse.angus:angus-activation:2.1.0-M1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.eclipse.angus:jakarta.mail:2.1.0-M1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.eclipse.collections:eclipse-collections-api:11.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.eclipse.collections:eclipse-collections:11.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty.ee10:jetty-ee10-servlet:12.1.8=testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty.ee10:jetty-ee10-webapp:12.1.8=testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty.ee:jetty-ee-webapp:12.1.8=testCompileClasspath,testRuntimeClasspath
@@ -513,8 +463,8 @@ org.eclipse.jetty:jetty-server:12.1.8=testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-session:12.1.8=testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-util:12.1.8=testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-xml:12.1.8=testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-core:12.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-database-postgresql:12.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-core:12.5.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-database-postgresql:12.5.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:codemodel:4.0.7=jaxb
 org.glassfish.jaxb:jaxb-core:4.0.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-core:4.0.7=jaxb
@@ -563,21 +513,21 @@ org.jetbrains:annotations:17.0.0=compileClasspath,deploy_jar,nonprodCompileClass
 org.jline:jline:3.30.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.joda:joda-money:2.0.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.json:json:20230618=soy
-org.json:json:20240303=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jsoup:jsoup:1.22.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.json:json:20251224=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jsoup:jsoup:1.22.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jspecify:jspecify:1.0.0=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 org.junit-pioneer:junit-pioneer:2.3.0=testCompileClasspath,testRuntimeClasspath
 org.junit.jupiter:junit-jupiter-api:5.13.4=testCompileClasspath,testRuntimeClasspath
 org.junit.jupiter:junit-jupiter-engine:5.13.4=testCompileClasspath,testRuntimeClasspath
 org.junit.jupiter:junit-jupiter-migrationsupport:5.13.4=testCompileClasspath,testRuntimeClasspath
 org.junit.jupiter:junit-jupiter-params:5.13.4=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.14.3=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-engine:1.14.3=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-launcher:1.14.3=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.14.4=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-engine:1.14.4=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-launcher:1.14.4=testCompileClasspath,testRuntimeClasspath
 org.junit.platform:junit-platform-runner:1.13.3=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-suite-api:1.14.3=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-suite-commons:1.14.3=testRuntimeClasspath
-org.junit:junit-bom:5.14.3=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-suite-api:1.14.4=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-suite-commons:1.14.4=testRuntimeClasspath
+org.junit:junit-bom:5.14.4=testCompileClasspath,testRuntimeClasspath
 org.mockito:mockito-core:5.23.0=testCompileClasspath,testRuntimeClasspath
 org.mockito:mockito-junit-jupiter:5.23.0=testCompileClasspath,testRuntimeClasspath
 org.objenesis:objenesis:3.3=testRuntimeClasspath
@@ -635,16 +585,18 @@ org.webjars.npm:viz.js-graphviz-java:2.1.3=testRuntimeClasspath
 org.xerial.snappy:snappy-java:1.1.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.xmlresolver:xmlresolver:5.2.2=checkstyle
 org.yaml:snakeyaml:2.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+redis.clients.authentication:redis-authx-core:0.1.1-beta2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+redis.clients:jedis:7.4.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 tools.jackson.core:jackson-core:3.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 tools.jackson.core:jackson-databind:3.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 tools.jackson:jackson-bom:3.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-api:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-diagram:17.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-operations:17.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-postgresql:17.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-text:17.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-diagram:17.10.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-operations:17.10.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-postgresql:17.10.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-text:17.10.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-tools:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-utility:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler:17.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler:17.10.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 xerces:xmlParserAPIs:2.6.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 empty=devtool,shadow

core/src/main/java/google/registry/batch/BatchModule.java

@@ -21,7 +21,7 @@ import static google.registry.request.RequestParameters.extractBooleanParameter;
 import static google.registry.request.RequestParameters.extractIntParameter;
 import static google.registry.request.RequestParameters.extractLongParameter;
 import static google.registry.request.RequestParameters.extractOptionalBooleanParameter;
-import static google.registry.request.RequestParameters.extractOptionalDatetimeParameter;
+import static google.registry.request.RequestParameters.extractOptionalInstantParameter;
 import static google.registry.request.RequestParameters.extractOptionalIntParameter;
 import static google.registry.request.RequestParameters.extractOptionalParameter;
 import static google.registry.request.RequestParameters.extractRequiredDatetimeParameter;
@@ -41,6 +41,7 @@ import google.registry.request.OptionalJsonPayload;
 import google.registry.request.Parameter;
 import jakarta.inject.Named;
 import jakarta.servlet.http.HttpServletRequest;
+import java.time.Instant;
 import java.util.List;
 import java.util.Optional;
 import org.joda.time.DateTime;
@@ -121,14 +122,14 @@ public class BatchModule {
 
   @Provides
   @Parameter(ExpandBillingRecurrencesAction.PARAM_START_TIME)
-  static Optional<DateTime> provideStartTime(HttpServletRequest req) {
-    return extractOptionalDatetimeParameter(req, ExpandBillingRecurrencesAction.PARAM_START_TIME);
+  static Optional<Instant> provideStartTime(HttpServletRequest req) {
+    return extractOptionalInstantParameter(req, ExpandBillingRecurrencesAction.PARAM_START_TIME);
   }
 
   @Provides
   @Parameter(ExpandBillingRecurrencesAction.PARAM_END_TIME)
-  static Optional<DateTime> provideEndTime(HttpServletRequest req) {
-    return extractOptionalDatetimeParameter(req, ExpandBillingRecurrencesAction.PARAM_END_TIME);
+  static Optional<Instant> provideEndTime(HttpServletRequest req) {
+    return extractOptionalInstantParameter(req, ExpandBillingRecurrencesAction.PARAM_END_TIME);
   }
 
   @Provides

core/src/main/java/google/registry/batch/CheckBulkComplianceAction.java

@@ -15,7 +15,8 @@ package google.registry.batch;
 
 import static google.registry.persistence.PersistenceModule.TransactionIsolationLevel.TRANSACTION_REPEATABLE_READ;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.util.DateTimeUtils.END_OF_TIME;
+import static google.registry.util.DateTimeUtils.END_INSTANT;
+import static google.registry.util.DateTimeUtils.minusYears;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
@@ -31,8 +32,8 @@ import google.registry.request.auth.Auth;
 import google.registry.ui.server.SendEmailUtils;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Duration;
 import java.util.Optional;
-import org.joda.time.Days;
 
 /**
  * An action that checks all {@link BulkPricingPackage} objects for compliance with their max create
@@ -110,7 +111,7 @@ public class CheckBulkComplianceAction implements Runnable {
                       + " 'DOMAIN_CREATE'",
                   Long.class)
               .setParameter("token", bulkPricingPackage.getToken())
-              .setParameter("lastBilling", bulkPricingPackage.getNextBillingDate().minusYears(1))
+              .setParameter("lastBilling", minusYears(bulkPricingPackage.getNextBillingDate(), 1))
               .getSingleResult();
       if (creates > bulkPricingPackage.getMaxCreates()) {
         long overage = creates - bulkPricingPackage.getMaxCreates();
@@ -127,7 +128,7 @@ public class CheckBulkComplianceAction implements Runnable {
                       + " AND deletionTime = :endOfTime",
                   Long.class)
               .setParameter("token", bulkPricingPackage.getToken())
-              .setParameter("endOfTime", END_OF_TIME)
+              .setParameter("endOfTime", END_INSTANT)
               .getSingleResult();
       if (activeDomains > bulkPricingPackage.getMaxDomains()) {
         int overage = Ints.saturatedCast(activeDomains) - bulkPricingPackage.getMaxDomains();
@@ -184,7 +185,7 @@ public class CheckBulkComplianceAction implements Runnable {
       int daysSinceLastNotification =
           bulkPricingPackage
               .getLastNotificationSent()
-              .map(sentDate -> Days.daysBetween(sentDate, clock.nowUtc()).getDays())
+              .map(sentDate -> (int) Duration.between(sentDate, clock.now()).toDays())
               .orElse(Integer.MAX_VALUE);
       // Send a warning email if 30-39 days since last notification and an upgrade email if 40+ days
       if (daysSinceLastNotification >= THIRTY_DAYS) {
@@ -220,7 +221,7 @@ public class CheckBulkComplianceAction implements Runnable {
               bulkPricingPackage.getMaxDomains(),
               activeDomains);
       sendNotification(bulkToken, emailSubject, body, registrar.get());
-      tm().put(bulkPricingPackage.asBuilder().setLastNotificationSent(clock.nowUtc()).build());
+      tm().put(bulkPricingPackage.asBuilder().setLastNotificationSent(clock.now()).build());
     } else {
       throw new IllegalStateException(
           String.format("Could not find registrar for bulk token %s", bulkToken));

core/src/main/java/google/registry/batch/DeleteExpiredDomainsAction.java

@@ -19,7 +19,6 @@ import static com.google.common.net.MediaType.PLAIN_TEXT_UTF_8;
 import static google.registry.flows.FlowUtils.marshalWithLenientRetry;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.END_INSTANT;
-import static google.registry.util.DateTimeUtils.END_OF_TIME;
 import static google.registry.util.ResourceUtils.readResourceUtf8;
 import static jakarta.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
 import static jakarta.servlet.http.HttpServletResponse.SC_NO_CONTENT;
@@ -43,10 +42,10 @@ import google.registry.request.auth.Auth;
 import google.registry.request.lock.LockHandler;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Optional;
 import java.util.concurrent.Callable;
 import java.util.logging.Level;
-import org.joda.time.DateTime;
 import org.joda.time.Duration;
 
 /**
@@ -125,7 +124,7 @@ public class DeleteExpiredDomainsAction implements Runnable {
   }
 
   private void runLocked() {
-    DateTime runTime = clock.nowUtc();
+    Instant runTime = clock.now();
     logger.atInfo().log(
         "Deleting non-renewing domains with autorenew end times up through %s.", runTime);
 
@@ -134,7 +133,7 @@ public class DeleteExpiredDomainsAction implements Runnable {
                 () ->
                     tm().createQueryComposer(Domain.class)
                         .where("autorenewEndTime", Comparator.LTE, runTime)
-                        .where("deletionTime", Comparator.EQ, END_OF_TIME)
+                        .where("deletionTime", Comparator.EQ, END_INSTANT)
                         .list());
     if (domainsToDelete.isEmpty()) {
       logger.atInfo().log("Found 0 domains to delete.");
@@ -173,7 +172,7 @@ public class DeleteExpiredDomainsAction implements Runnable {
                 () -> {
                   Domain transDomain = tm().loadByKey(domain.createVKey());
                   if (domain.getAutorenewEndTime().isEmpty()
-                      || domain.getAutorenewEndTime().get().isAfter(tm().getTransactionTime())) {
+                      || domain.getAutorenewEndTime().get().isAfter(tm().getTxTime())) {
                     logger.atSevere().log(
                         "Failed to delete domain %s because of its autorenew end time: %s.",
                         transDomain.getDomainName(), transDomain.getAutorenewEndTime());

core/src/main/java/google/registry/batch/DeleteLoadTestDataAction.java

@@ -20,7 +20,7 @@ import static google.registry.persistence.PersistenceModule.TransactionIsolation
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.request.Action.Method.POST;
 import static google.registry.request.RequestParameters.PARAM_DRY_RUN;
-import static google.registry.util.DateTimeUtils.END_OF_TIME;
+import static google.registry.util.DateTimeUtils.END_INSTANT;
 import static google.registry.util.RegistryEnvironment.PRODUCTION;
 
 import com.google.common.collect.ImmutableList;
@@ -99,7 +99,7 @@ public class DeleteLoadTestDataAction implements Runnable {
 
   private void deletePollMessages(String registrarId) {
     ImmutableList<PollMessage> pollMessages =
-        PollFlowUtils.createPollMessageQuery(registrarId, END_OF_TIME).list();
+        PollFlowUtils.createPollMessageQuery(registrarId, END_INSTANT).list();
     if (isDryRun) {
       logger.atInfo().log(
           "Would delete %d poll messages for registrar %s.", pollMessages.size(), registrarId);

core/src/main/java/google/registry/batch/DeleteProberDataAction.java

@@ -27,6 +27,7 @@ import static google.registry.request.Action.Method.POST;
 import static google.registry.request.RequestParameters.PARAM_BATCH_SIZE;
 import static google.registry.request.RequestParameters.PARAM_DRY_RUN;
 import static google.registry.request.RequestParameters.PARAM_TLDS;
+import static google.registry.util.DateTimeUtils.toInstant;
 import static google.registry.util.RegistryEnvironment.PRODUCTION;
 
 import com.google.common.base.Strings;
@@ -187,9 +188,10 @@ public class DeleteProberDataAction implements Runnable {
         tm().query(DOMAIN_QUERY_STRING, Domain.class)
             .setParameter("tlds", deletableTlds)
             .setParameter(
-                "creationTimeCutoff", CreateAutoTimestamp.create(now.minus(DOMAIN_USED_DURATION)))
-            .setParameter("nowMinusSoftDeleteDelay", now.minus(SOFT_DELETE_DELAY))
-            .setParameter("now", now);
+                "creationTimeCutoff",
+                CreateAutoTimestamp.create(toInstant(now.minus(DOMAIN_USED_DURATION))))
+            .setParameter("nowMinusSoftDeleteDelay", toInstant(now.minus(SOFT_DELETE_DELAY)))
+            .setParameter("now", toInstant(now));
     ImmutableList<Domain> domainList =
         query.setMaxResults(batchSize).getResultStream().collect(toImmutableList());
       ImmutableList.Builder<String> domainRepoIdsToHardDelete = new ImmutableList.Builder<>();
@@ -303,12 +305,12 @@ public class DeleteProberDataAction implements Runnable {
   // Take a DNS queue + admin registrar id as input so that it can be called from the mapper as well
   private void softDeleteDomain(Domain domain) {
     Domain deletedDomain =
-        domain.asBuilder().setDeletionTime(tm().getTransactionTime()).setStatusValues(null).build();
+        domain.asBuilder().setDeletionTime(tm().getTxTime()).setStatusValues(null).build();
     DomainHistory historyEntry =
         new DomainHistory.Builder()
             .setDomain(domain)
             .setType(DOMAIN_DELETE)
-            .setModificationTime(tm().getTransactionTime())
+            .setModificationTime(tm().getTxTime())
             .setBySuperuser(true)
             .setReason("Deletion of prober data")
             .setRegistrarId(registryAdminRegistrarId)

core/src/main/java/google/registry/batch/ExpandBillingRecurrencesAction.java

@@ -19,7 +19,7 @@ import static google.registry.beam.BeamUtils.createJobName;
 import static google.registry.model.common.Cursor.CursorType.RECURRING_BILLING;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.request.RequestParameters.PARAM_DRY_RUN;
-import static google.registry.util.DateTimeUtils.START_OF_TIME;
+import static google.registry.util.DateTimeUtils.START_INSTANT;
 import static jakarta.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
 import static jakarta.servlet.http.HttpServletResponse.SC_OK;
 
@@ -42,8 +42,9 @@ import google.registry.util.Clock;
 import google.registry.util.RegistryEnvironment;
 import jakarta.inject.Inject;
 import java.io.IOException;
+import java.time.Instant;
+import java.util.Locale;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * An action that kicks off a {@link ExpandBillingRecurrencesPipeline} dataflow job to expand {@link
@@ -74,11 +75,11 @@ public class ExpandBillingRecurrencesAction implements Runnable {
 
   @Inject
   @Parameter(PARAM_START_TIME)
-  Optional<DateTime> startTimeParam;
+  Optional<Instant> startTimeParam;
 
   @Inject
   @Parameter(PARAM_END_TIME)
-  Optional<DateTime> endTimeParam;
+  Optional<Instant> endTimeParam;
 
   @Inject
   @Config("projectId")
@@ -102,33 +103,36 @@ public class ExpandBillingRecurrencesAction implements Runnable {
   @Override
   public void run() {
     checkArgument(!(isDryRun && advanceCursor), "Cannot advance the cursor in a dry run.");
-    DateTime endTime = endTimeParam.orElse(clock.nowUtc());
-    checkArgument(
-        !endTime.isAfter(clock.nowUtc()), "End time (%s) must be at or before now", endTime);
-    DateTime startTime =
+    Instant endTime = endTimeParam.orElse(clock.now());
+    checkArgument(!endTime.isAfter(clock.now()), "End time (%s) must be at or before now", endTime);
+    Instant startTime =
         startTimeParam.orElse(
             tm().transact(
                     () ->
                         tm().loadByKeyIfPresent(Cursor.createGlobalVKey(RECURRING_BILLING))
-                            .orElse(Cursor.createGlobal(RECURRING_BILLING, START_OF_TIME))
-                            .getCursorTime()));
+                            .orElse(Cursor.createGlobal(RECURRING_BILLING, START_INSTANT))
+                            .getCursorTimeInstant()));
     checkArgument(
         startTime.isBefore(endTime),
-        String.format("Start time (%s) must be before end time (%s)", startTime, endTime));
+        "Start time (%s) must be before end time (%s)",
+        startTime,
+        endTime);
     LaunchFlexTemplateParameter launchParameter =
         new LaunchFlexTemplateParameter()
             .setJobName(
                 createJobName(
                     String.format(
-                        "expand-billing-%s", startTime.toString("yyyy-MM-dd't'HH-mm-ss'z'")),
+                            "expand-billing-%s",
+                            startTime.toString().replace(':', '-').replace('.', '-'))
+                        .toLowerCase(Locale.ROOT),
                     clock))
             .setContainerSpecGcsPath(
                 String.format("%s/%s_metadata.json", stagingBucketUrl, PIPELINE_NAME))
             .setParameters(
                 new ImmutableMap.Builder<String, String>()
                     .put("registryEnvironment", RegistryEnvironment.get().name())
-                    .put("startTime", startTime.toString("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"))
-                    .put("endTime", endTime.toString("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"))
+                    .put("startTime", startTime.toString())
+                    .put("endTime", endTime.toString())
                     .put("isDryRun", Boolean.toString(isDryRun))
                     .put("advanceCursor", Boolean.toString(advanceCursor))
                     .build());

core/src/main/java/google/registry/batch/RelockDomainAction.java

@@ -134,7 +134,7 @@ public class RelockDomainAction implements Runnable {
                           String.format("Unknown revision ID %d", oldUnlockRevisionId)));
       domain =
           tm().loadByKey(VKey.create(Domain.class, oldLock.getRepoId()))
-              .cloneProjectedAtTime(tm().getTransactionTime());
+              .cloneProjectedAtTime(tm().getTxTime());
     } catch (Throwable t) {
       handleTransientFailure(Optional.ofNullable(oldLock), t);
       return;

core/src/main/java/google/registry/batch/ResaveEntityAction.java

@@ -83,7 +83,7 @@ public class ResaveEntityAction implements Runnable {
                     resourceKey);
                 return;
               }
-              tm().put(entity.get().cloneProjectedAtTime(tm().getTransactionTime()));
+              tm().put(entity.get().cloneProjectedAtTime(tm().getTxTime()));
               if (!resaveTimes.isEmpty()) {
                 asyncTaskEnqueuer.enqueueAsyncResave(
                     VKey.createEppVKeyFromString(resourceKey), requestedTime, resaveTimes);

core/src/main/java/google/registry/batch/SendExpiringCertificateNotificationEmailAction.java

@@ -16,6 +16,8 @@ package google.registry.batch;
 
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.util.DateTimeUtils.toDateTime;
+import static google.registry.util.DateTimeUtils.toInstant;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 import static org.apache.http.HttpStatus.SC_INTERNAL_SERVER_ERROR;
 import static org.apache.http.HttpStatus.SC_OK;
@@ -128,11 +130,11 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
                     registrar,
                     registrar.getClientCertificate().isPresent()
                         && certificateChecker.shouldReceiveExpiringNotification(
-                            registrar.getLastExpiringCertNotificationSentDate(),
+                            toDateTime(registrar.getLastExpiringCertNotificationSentDate()),
                             registrar.getClientCertificate().get()),
                     registrar.getFailoverClientCertificate().isPresent()
                         && certificateChecker.shouldReceiveExpiringNotification(
-                            registrar.getLastExpiringFailoverCertNotificationSentDate(),
+                            toDateTime(registrar.getLastExpiringFailoverCertNotificationSentDate()),
                             registrar.getFailoverClientCertificate().get())))
         .filter(
             registrarInfo ->
@@ -210,7 +212,7 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
                 Registrar.Builder newRegistrar = tm().loadByEntity(registrar).asBuilder();
                 switch (certificateType) {
                   case PRIMARY -> {
-                    newRegistrar.setLastExpiringCertNotificationSentDate(now);
+                    newRegistrar.setLastExpiringCertNotificationSentDate(toInstant(now));
                     tm().put(newRegistrar.build());
                     logger.atInfo().log(
                         "Updated last notification email sent date to %s for %s certificate of "
@@ -220,7 +222,7 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
                         registrar.getRegistrarName());
                   }
                   case FAILOVER -> {
-                    newRegistrar.setLastExpiringFailoverCertNotificationSentDate(now);
+                    newRegistrar.setLastExpiringFailoverCertNotificationSentDate(toInstant(now));
                     tm().put(newRegistrar.build());
                     logger.atInfo().log(
                         "Updated last notification email sent date to %s for %s certificate of "
@@ -255,7 +257,7 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
       if (registrarInfo.isCertExpiring()
           && sendNotificationEmail(
               registrar,
-              registrar.getLastExpiringCertNotificationSentDate(),
+              toDateTime(registrar.getLastExpiringCertNotificationSentDate()),
               CertificateType.PRIMARY,
               registrar.getClientCertificate())) {
         numEmailsSent++;
@@ -263,7 +265,7 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
       if (registrarInfo.isFailOverCertExpiring()
           && sendNotificationEmail(
               registrar,
-              registrar.getLastExpiringFailoverCertNotificationSentDate(),
+              toDateTime(registrar.getLastExpiringFailoverCertNotificationSentDate()),
               CertificateType.FAILOVER,
               registrar.getFailoverClientCertificate())) {
         numEmailsSent++;

core/src/main/java/google/registry/beam/billing/BillingEvent.java

@@ -14,12 +14,17 @@
 
 package google.registry.beam.billing;
 
+
 import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableList;
 import google.registry.reporting.billing.BillingModule;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.time.ZonedDateTime;
+import java.time.format.DateTimeFormatter;
 import java.util.regex.Pattern;
 import org.apache.beam.sdk.coders.AtomicCoder;
 import org.apache.beam.sdk.coders.Coder;
@@ -29,9 +34,6 @@ import org.apache.beam.sdk.coders.StringUtf8Coder;
 import org.apache.beam.sdk.coders.VarIntCoder;
 import org.apache.beam.sdk.coders.VarLongCoder;
 import org.jetbrains.annotations.NotNull;
-import org.joda.time.DateTime;
-import org.joda.time.format.DateTimeFormat;
-import org.joda.time.format.DateTimeFormatter;
 
 /**
  * A record representing a single billable event, parsed from a {@code SchemaAndRecord}.
@@ -53,8 +55,8 @@ import org.joda.time.format.DateTimeFormatter;
  */
 public record BillingEvent(
     long id,
-    DateTime billingTime,
-    DateTime eventTime,
+    Instant billingTime,
+    Instant eventTime,
     String registrarId,
     String billingId,
     String poNumber,
@@ -68,7 +70,7 @@ public record BillingEvent(
     String flags) {
 
   private static final DateTimeFormatter DATE_TIME_FORMATTER =
-      DateTimeFormat.forPattern("yyyy-MM-dd HH:mm:ss zzz");
+      DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss 'UTC'").withZone(ZoneOffset.UTC);
 
   private static final Pattern SYNTHETIC_REGEX = Pattern.compile("SYNTHETIC", Pattern.LITERAL);
 
@@ -92,8 +94,8 @@ public record BillingEvent(
   /** Creates a concrete {@link BillingEvent}. */
   static BillingEvent create(
       long id,
-      DateTime billingTime,
-      DateTime eventTime,
+      Instant billingTime,
+      Instant eventTime,
       String registrarId,
       String billingId,
       String poNumber,
@@ -143,8 +145,8 @@ public record BillingEvent(
         .join(
             ImmutableList.of(
                 id(),
-                DATE_TIME_FORMATTER.print(billingTime()),
-                DATE_TIME_FORMATTER.print(eventTime()),
+                DATE_TIME_FORMATTER.format(billingTime()),
+                DATE_TIME_FORMATTER.format(eventTime()),
                 registrarId(),
                 billingId(),
                 poNumber(),
@@ -162,10 +164,13 @@ public record BillingEvent(
   /** Returns the grouping key for this {@code BillingEvent}, to generate the overall invoice. */
   InvoiceGroupingKey getInvoiceGroupingKey() {
     return new InvoiceGroupingKey(
-        billingTime().toLocalDate().withDayOfMonth(1).toString(),
+        ZonedDateTime.ofInstant(billingTime(), ZoneOffset.UTC)
+            .toLocalDate()
+            .withDayOfMonth(1)
+            .toString(),
         years() == 0
             ? ""
-            : billingTime()
+            : ZonedDateTime.ofInstant(billingTime(), ZoneOffset.UTC)
                 .toLocalDate()
                 .withDayOfMonth(1)
                 .plusYears(years())
@@ -308,8 +313,8 @@ public record BillingEvent(
     @Override
     public void encode(BillingEvent value, OutputStream outStream) throws IOException {
       longCoder.encode(value.id(), outStream);
-      stringCoder.encode(DATE_TIME_FORMATTER.print(value.billingTime()), outStream);
-      stringCoder.encode(DATE_TIME_FORMATTER.print(value.eventTime()), outStream);
+      stringCoder.encode(DATE_TIME_FORMATTER.format(value.billingTime()), outStream);
+      stringCoder.encode(DATE_TIME_FORMATTER.format(value.eventTime()), outStream);
       stringCoder.encode(value.registrarId(), outStream);
       stringCoder.encode(value.billingId(), outStream);
       stringCoder.encode(value.poNumber(), outStream);
@@ -327,8 +332,8 @@ public record BillingEvent(
     public BillingEvent decode(InputStream inStream) throws IOException {
       return new BillingEvent(
           longCoder.decode(inStream),
-          DATE_TIME_FORMATTER.parseDateTime(stringCoder.decode(inStream)),
-          DATE_TIME_FORMATTER.parseDateTime(stringCoder.decode(inStream)),
+          Instant.from(DATE_TIME_FORMATTER.parse(stringCoder.decode(inStream))),
+          Instant.from(DATE_TIME_FORMATTER.parse(stringCoder.decode(inStream))),
           stringCoder.decode(inStream),
           stringCoder.decode(inStream),
           stringCoder.decode(inStream),

core/src/main/java/google/registry/beam/billing/ExpandBillingRecurrencesPipeline.java

@@ -21,10 +21,11 @@ import static google.registry.model.domain.Period.Unit.YEARS;
 import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_AUTORENEW;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.CollectionUtils.union;
-import static google.registry.util.DateTimeUtils.START_OF_TIME;
+import static google.registry.util.DateTimeUtils.START_INSTANT;
 import static google.registry.util.DateTimeUtils.earliestOf;
 import static google.registry.util.DateTimeUtils.latestOf;
-import static google.registry.util.DateTimeUtils.toInstant;
+import static google.registry.util.DateTimeUtils.minusYears;
+import static google.registry.util.DateTimeUtils.plusYears;
 import static org.apache.beam.sdk.values.TypeDescriptors.voids;
 
 import com.google.common.collect.ImmutableMap;
@@ -54,6 +55,7 @@ import google.registry.util.Clock;
 import google.registry.util.SystemClock;
 import jakarta.inject.Singleton;
 import java.io.Serializable;
+import java.time.Instant;
 import java.util.Optional;
 import java.util.Set;
 import org.apache.beam.sdk.Pipeline;
@@ -73,7 +75,6 @@ import org.apache.beam.sdk.transforms.Wait;
 import org.apache.beam.sdk.values.KV;
 import org.apache.beam.sdk.values.PCollection;
 import org.apache.beam.sdk.values.PDone;
-import org.joda.time.DateTime;
 
 /**
  * Definition of a Dataflow Flex pipeline template, which expands {@link BillingRecurrence} to
@@ -134,9 +135,9 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
   }
 
   // Inclusive lower bound of the expansion window.
-  private final DateTime startTime;
+  private final Instant startTime;
   // Exclusive lower bound of the expansion window.
-  private final DateTime endTime;
+  private final Instant endTime;
   private final boolean isDryRun;
   private final boolean advanceCursor;
   private final Counter recurrencesInScopeCounter =
@@ -151,14 +152,14 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
       Metrics.counter("ExpandBilling", "OneTimes that would be expanded");
 
   ExpandBillingRecurrencesPipeline(ExpandBillingRecurrencesPipelineOptions options, Clock clock) {
-    startTime = DateTime.parse(options.getStartTime());
-    endTime = DateTime.parse(options.getEndTime());
-    checkArgument(
-        !endTime.isAfter(clock.nowUtc()),
-        String.format("End time %s must be at or before now.", endTime));
+    startTime = Instant.parse(options.getStartTime());
+    endTime = Instant.parse(options.getEndTime());
+    checkArgument(!endTime.isAfter(clock.now()), "End time %s must be at or before now.", endTime);
     checkArgument(
         startTime.isBefore(endTime),
-        String.format("[%s, %s) is not a valid window of operation.", startTime, endTime));
+        "[%s, %s) is not a valid window of operation.",
+        startTime,
+        endTime);
     isDryRun = options.getIsDryRun();
     advanceCursor = options.getAdvanceCursor();
   }
@@ -199,7 +200,7 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
                     "startTime",
                     startTime,
                     "oneYearAgo",
-                    endTime.minusYears(1)),
+                    minusYears(endTime, 1)),
                 true,
                 (Long id) -> {
                   recurrencesInScopeCounter.inc();
@@ -268,7 +269,7 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
     // The best way to handle any unexpected behavior is to simply drop the recurrence from
     // expansion, if its new state still calls for an expansion, it would be picked up the next time
     // the pipeline runs.
-    ImmutableSet<DateTime> eventTimes;
+    ImmutableSet<Instant> eventTimes;
     try {
       eventTimes =
           ImmutableSet.copyOf(
@@ -277,7 +278,7 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
                   .getInstancesInRange(
                       Range.closedOpen(
                           latestOf(
-                              billingRecurrence.getRecurrenceLastExpansion().plusYears(1),
+                              plusYears(billingRecurrence.getRecurrenceLastExpansion(), 1),
                               startTime),
                           earliestOf(billingRecurrence.getRecurrenceEndTime(), endTime))));
     } catch (IllegalArgumentException e) {
@@ -289,28 +290,28 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
     // Find the times for which the OneTime billing event are already created, making this expansion
     // idempotent. There is no need to match to the domain repo ID as the cancellation matching
     // billing event itself can only be for a single domain.
-    ImmutableSet<DateTime> existingEventTimes =
+    ImmutableSet<Instant> existingEventTimes =
         ImmutableSet.copyOf(
             tm().query(
                     "SELECT eventTime FROM BillingEvent WHERE cancellationMatchingBillingEvent ="
                         + " :key",
-                    DateTime.class)
+                    Instant.class)
                 .setParameter("key", billingRecurrence.createVKey())
                 .getResultList());
 
-    Set<DateTime> eventTimesToExpand = difference(eventTimes, existingEventTimes);
+    Set<Instant> eventTimesToExpand = difference(eventTimes, existingEventTimes);
 
     if (eventTimesToExpand.isEmpty()) {
       return;
     }
 
-    DateTime recurrenceLastExpansionTime = billingRecurrence.getRecurrenceLastExpansion();
+    Instant recurrenceLastExpansionTime = billingRecurrence.getRecurrenceLastExpansion();
 
     // Create new OneTime and DomainHistory for EventTimes that needs to be expanded.
-    for (DateTime eventTime : eventTimesToExpand) {
+    for (Instant eventTime : eventTimesToExpand) {
       recurrenceLastExpansionTime = latestOf(recurrenceLastExpansionTime, eventTime);
       oneTimesToExpandCounter.inc();
-      DateTime billingTime = eventTime.plus(tld.getAutoRenewGracePeriodLength());
+      Instant billingTime = eventTime.plusMillis(tld.getAutoRenewGracePeriodLength().getMillis());
       // Note that the DomainHistory is created as of transaction time, as opposed to event time.
       // This might be counterintuitive because other DomainHistories are created at the time
       // mutation events occur, such as in DomainDeleteFlow or DomainRenewFlow. Therefore, it is
@@ -337,7 +338,7 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
           new DomainHistory.Builder()
               .setBySuperuser(false)
               .setRegistrarId(billingRecurrence.getRegistrarId())
-              .setModificationTime(tm().getTransactionTime())
+              .setModificationTime(tm().getTxTime())
               .setDomain(domain)
               .setPeriod(Period.create(1, YEARS))
               .setReason("Domain autorenewal by ExpandRecurringBillingEventsPipeline")
@@ -373,7 +374,7 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
                   // during ARGP).
                   //
                   // See: DomainFlowUtils#createCancellingRecords
-                  domain.getDeletionTime().isBefore(toInstant(billingTime))
+                  domain.getDeletionTime().isBefore(billingTime)
                       ? ImmutableSet.of()
                       : ImmutableSet.of(
                           DomainTransactionRecord.create(
@@ -439,12 +440,12 @@ public class ExpandBillingRecurrencesPipeline implements Serializable {
                       public void processElement() {
                         tm().transact(
                                 () -> {
-                                  DateTime currentCursorTime =
+                                  Instant currentCursorTime =
                                       tm().loadByKeyIfPresent(
                                               Cursor.createGlobalVKey(RECURRING_BILLING))
                                           .orElse(
-                                              Cursor.createGlobal(RECURRING_BILLING, START_OF_TIME))
-                                          .getCursorTime();
+                                              Cursor.createGlobal(RECURRING_BILLING, START_INSTANT))
+                                          .getCursorTimeInstant();
                                   if (!currentCursorTime.equals(startTime)) {
                                     throw new IllegalStateException(
                                         String.format(

core/src/main/java/google/registry/beam/rde/RdeIO.java

@@ -133,7 +133,7 @@ public class RdeIO {
     private final byte[] stagingKeyBytes;
     private final RdeMarshaller marshaller;
 
-    protected RdeWriter(
+    RdeWriter(
         GcsUtils gcsUtils,
         String rdeBucket,
         byte[] stagingKeyBytes,
@@ -144,7 +144,7 @@ public class RdeIO {
       this.marshaller = new RdeMarshaller(validationMode);
     }
 
-    @SuppressWarnings("unused")
+    @SuppressWarnings({"EffectivelyPrivate", "unused"})
     @Setup
     public void setup() {
       Security.addProvider(new BouncyCastleProvider());

core/src/main/java/google/registry/beam/rde/RdePipeline.java

@@ -27,6 +27,7 @@ import static google.registry.beam.rde.RdePipeline.TupleTags.REVISION_ID;
 import static google.registry.beam.rde.RdePipeline.TupleTags.SUPERORDINATE_DOMAINS;
 import static google.registry.model.reporting.HistoryEntryDao.RESOURCE_TYPES_TO_HISTORY_TYPES;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.util.DateTimeUtils.toInstant;
 import static google.registry.util.SafeSerializationUtils.safeDeserializeCollection;
 import static google.registry.util.SafeSerializationUtils.serializeCollection;
 import static google.registry.util.SerializeUtils.decodeBase64;
@@ -314,17 +315,16 @@ public class RdePipeline implements Serializable {
         String.format("Load most recent %s", historyClass.getSimpleName()),
         RegistryJpaIO.read(
                 ("SELECT repoId, revisionId FROM %entity% WHERE (repoId, modificationTime) IN"
-                     + " (SELECT repoId, MAX(modificationTime) FROM %entity% WHERE"
-                     + " modificationTime <= :watermark GROUP BY repoId) AND resource.deletionTime"
-                     + " > :watermark AND COALESCE(resource.creationRegistrarId, '') NOT LIKE"
-                     + " 'prober-%' AND COALESCE(resource.currentSponsorRegistrarId, '') NOT LIKE"
-                     + " 'prober-%' AND COALESCE(resource.lastEppUpdateRegistrarId, '') NOT LIKE"
-                     + " 'prober-%' "
+                     + " (SELECT repoId, MAX(modificationTime) FROM %entity% WHERE modificationTime"
+                     + " <= :watermark GROUP BY repoId) AND resource.deletionTime > :watermark AND"
+                     + " COALESCE(resource.creationRegistrarId, '') NOT LIKE 'prober-%' AND"
+                     + " COALESCE(resource.currentSponsorRegistrarId, '') NOT LIKE 'prober-%' AND"
+                     + " COALESCE(resource.lastEppUpdateRegistrarId, '') NOT LIKE 'prober-%' "
                         + (historyClass == DomainHistory.class
                             ? "AND resource.tld IN " + "(SELECT id FROM Tld WHERE tldType = 'REAL')"
                             : ""))
                     .replace("%entity%", historyClass.getSimpleName()),
-                ImmutableMap.of("watermark", watermark),
+                ImmutableMap.of("watermark", toInstant(watermark)),
                 Object[].class,
                 row -> KV.of((String) row[0], (long) row[1]))
             .withCoder(KvCoder.of(StringUtf8Coder.of(), VarLongCoder.of())));
@@ -365,7 +365,7 @@ public class RdePipeline implements Serializable {
                 tm().loadByKey(
                         VKey.create(historyEntryClazz, new HistoryEntryId(repoId, revisionId))))
         .getResourceAtPointInTime()
-        .map(resource -> resource.cloneProjectedAtTime(watermark))
+        .map(resource -> resource.cloneProjectedAtTime(toInstant(watermark)))
         .get();
   }
 

core/src/main/java/google/registry/beam/resave/ResaveAllEppResourcesPipeline.java

@@ -16,6 +16,8 @@ package google.registry.beam.resave;
 
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.util.DateTimeUtils.END_INSTANT;
+import static google.registry.util.DateTimeUtils.toInstant;
 import static org.apache.beam.sdk.values.TypeDescriptors.integers;
 
 import com.google.common.collect.ImmutableList;
@@ -30,7 +32,6 @@ import google.registry.model.domain.DomainBase;
 import google.registry.model.host.Host;
 import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.persistence.VKey;
-import google.registry.util.DateTimeUtils;
 import java.io.Serializable;
 import org.apache.beam.sdk.Pipeline;
 import org.apache.beam.sdk.PipelineResult;
@@ -74,7 +75,7 @@ public class ResaveAllEppResourcesPipeline implements Serializable {
       "SELECT repoId FROM Domain d WHERE (d.transferData.transferStatus = 'PENDING' AND"
           + " d.transferData.pendingTransferExpirationTime < current_timestamp()) OR"
           + " (d.registrationExpirationTime < current_timestamp() AND d.deletionTime ="
-          + " (:END_OF_TIME)) OR (EXISTS (SELECT 1 FROM GracePeriod gp WHERE gp.domainRepoId ="
+          + " (:END_INSTANT)) OR (EXISTS (SELECT 1 FROM GracePeriod gp WHERE gp.domainRepoId ="
           + " d.repoId AND gp.expirationTime < current_timestamp()))";
 
   private final ResaveAllEppResourcesPipelineOptions options;
@@ -108,7 +109,7 @@ public class ResaveAllEppResourcesPipeline implements Serializable {
     Read<String, String> repoIdRead =
         RegistryJpaIO.read(
                 DOMAINS_TO_PROJECT_QUERY,
-                ImmutableMap.of("END_OF_TIME", DateTimeUtils.END_OF_TIME),
+                ImmutableMap.of("END_INSTANT", END_INSTANT),
                 String.class,
                 r -> r)
             .withCoder(StringUtf8Coder.of());
@@ -154,9 +155,7 @@ public class ResaveAllEppResourcesPipeline implements Serializable {
     }
 
     @ProcessElement
-    public void processElement(
-        @Element KV<ShardedKey<Integer>, Iterable<String>> element,
-        OutputReceiver<Void> outputReceiver) {
+    public void processElement(@Element KV<ShardedKey<Integer>, Iterable<String>> element) {
       tm().transact(
               () -> {
                 DateTime now = tm().getTransactionTime();
@@ -166,7 +165,7 @@ public class ResaveAllEppResourcesPipeline implements Serializable {
                         .collect(toImmutableList());
                 ImmutableList<EppResource> mappedResources =
                     tm().loadByKeys(keys).values().stream()
-                        .map(r -> r.cloneProjectedAtTime(now))
+                        .map(r -> r.cloneProjectedAtTime(toInstant(now)))
                         .collect(toImmutableList());
                 tm().putAll(mappedResources);
               });

core/src/main/java/google/registry/beam/spec11/Spec11Pipeline.java

@@ -210,8 +210,8 @@ public class Spec11Pipeline implements Serializable {
                       String registrarId = kv.getKey();
                       checkArgument(
                           kv.getValue().iterator().hasNext(),
-                          String.format(
-                              "Registrar with ID %s had no corresponding threats", registrarId));
+                          "Registrar with ID %s had no corresponding threats",
+                          registrarId);
                       String email = kv.getValue().iterator().next().email();
                       JSONObject output = new JSONObject();
                       try {

core/src/main/java/google/registry/bigquery/BigqueryJobFailureException.java

@@ -29,8 +29,8 @@ public final class BigqueryJobFailureException extends RuntimeException {
 
   /** Delegate {@link IOException} errors, checking for {@link GoogleJsonResponseException} */
   public static BigqueryJobFailureException create(IOException cause) {
-    if (cause instanceof GoogleJsonResponseException) {
-        return create((GoogleJsonResponseException) cause);
+    if (cause instanceof GoogleJsonResponseException googleJsonResponseException) {
+      return create(googleJsonResponseException);
     } else {
       return new BigqueryJobFailureException(cause.getMessage(), cause, null, null);
     }

core/src/main/java/google/registry/bsa/BlockListFetcher.java

@@ -62,7 +62,7 @@ public class BlockListFetcher {
     // TODO: use more informative exceptions to describe retriable errors
     return retrier.callWithRetry(
         () -> tryFetch(blockListType),
-        e -> e instanceof BsaException && ((BsaException) e).isRetriable());
+        e -> e instanceof BsaException bsaException && bsaException.isRetriable());
   }
 
   LazyBlockList tryFetch(BlockListType blockListType) {

core/src/main/java/google/registry/bsa/BsaRefreshAction.java

@@ -36,9 +36,9 @@ import google.registry.request.auth.Auth;
 import google.registry.util.BatchedStreams;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Duration;
 import java.util.Optional;
 import java.util.stream.Stream;
-import org.joda.time.Duration;
 
 @Action(
     service = Action.Service.BACKEND,
@@ -67,7 +67,7 @@ public class BsaRefreshAction implements Runnable {
       GcsClient gcsClient,
       BsaReportSender bsaReportSender,
       @Config("bsaTxnBatchSize") int transactionBatchSize,
-      @Config("domainCreateTxnCommitTimeLag") Duration domainCreateTxnCommitTimeLag,
+      @Config("domainCreateTxnCommitTimeLag") org.joda.time.Duration domainCreateTxnCommitTimeLag,
       BsaEmailSender emailSender,
       BsaLock bsaLock,
       Clock clock,
@@ -76,7 +76,7 @@ public class BsaRefreshAction implements Runnable {
     this.gcsClient = gcsClient;
     this.bsaReportSender = bsaReportSender;
     this.transactionBatchSize = transactionBatchSize;
-    this.domainCreateTxnCommitTimeLag = domainCreateTxnCommitTimeLag;
+    this.domainCreateTxnCommitTimeLag = Duration.ofMillis(domainCreateTxnCommitTimeLag.getMillis());
     this.emailSender = emailSender;
     this.bsaLock = bsaLock;
     this.clock = clock;
@@ -103,7 +103,7 @@ public class BsaRefreshAction implements Runnable {
   /** Executes the refresh action while holding the BSA lock. */
   Void runWithinLock() {
     // Cannot enroll new TLDs after download starts. This may change if b/309175410 is fixed.
-    if (!Tlds.hasActiveBsaEnrollment(clock.nowUtc())) {
+    if (!Tlds.hasActiveBsaEnrollment(clock.now())) {
       logger.atInfo().log("No TLDs enrolled with BSA. Quitting.");
       return null;
     }
@@ -116,7 +116,7 @@ public class BsaRefreshAction implements Runnable {
     DomainsRefresher refresher =
         new DomainsRefresher(
             schedule.prevRefreshTime(),
-            clock.nowUtc(),
+            clock.now(),
             domainCreateTxnCommitTimeLag,
             transactionBatchSize);
     switch (schedule.stage()) {

core/src/main/java/google/registry/bsa/BsaValidateAction.java

@@ -57,11 +57,11 @@ import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Duration;
+import java.time.Instant;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.stream.Stream;
-import org.joda.time.DateTime;
-import org.joda.time.Duration;
 
 /** Validates the BSA data in the database against the most recent block lists. */
 @Action(
@@ -88,14 +88,14 @@ public class BsaValidateAction implements Runnable {
       IdnChecker idnChecker,
       BsaEmailSender emailSender,
       @Config("bsaTxnBatchSize") int transactionBatchSize,
-      @Config("bsaValidationMaxStaleness") Duration maxStaleness,
+      @Config("bsaValidationMaxStaleness") org.joda.time.Duration maxStaleness,
       Clock clock,
       Response response) {
     this.gcsClient = gcsClient;
     this.idnChecker = idnChecker;
     this.emailSender = emailSender;
     this.transactionBatchSize = transactionBatchSize;
-    this.maxStaleness = maxStaleness;
+    this.maxStaleness = Duration.ofMillis(maxStaleness.getMillis());
     this.clock = clock;
     this.response = response;
   }
@@ -186,7 +186,7 @@ public class BsaValidateAction implements Runnable {
           ForeignKeyUtils.loadResources(
               Domain.class,
               batch.stream().map(UnblockableDomain::domainName).collect(toImmutableList()),
-              clock.nowUtc());
+              clock.now());
       for (var unblockable : batch) {
         verifyDomainStillUnblockableWithReason(unblockable, activeDomains).ifPresent(errors::add);
       }
@@ -199,7 +199,7 @@ public class BsaValidateAction implements Runnable {
 
   Optional<String> verifyDomainStillUnblockableWithReason(
       UnblockableDomain domain, ImmutableMap<String, Domain> activeDomains) {
-    DateTime now = clock.nowUtc();
+    Instant now = clock.now();
     boolean isRegistered = activeDomains.containsKey(domain.domainName());
     boolean isReserved = isReservedDomain(domain.domainName(), now);
     InternetDomainName domainName = InternetDomainName.from(domain.domainName());
@@ -228,7 +228,7 @@ public class BsaValidateAction implements Runnable {
   }
 
   boolean isStalenessAllowed(Domain domain) {
-    return domain.getCreationTime().plus(maxStaleness).isAfter(clock.nowUtc());
+    return domain.getCreationTime().plus(maxStaleness).isAfter(clock.now());
   }
 
   /** Returns unique labels across all block lists in the download specified by {@code jobName}. */
@@ -262,20 +262,20 @@ public class BsaValidateAction implements Runnable {
   }
 
   ImmutableList<String> checkMissingUnblockableDomains() {
-    DateTime now = clock.nowUtc();
+    Instant now = clock.now();
     ImmutableList.Builder<String> errors = new ImmutableList.Builder<>();
     errors.addAll(checkForMissingReservedUnblockables(now));
     errors.addAll(checkForMissingRegisteredUnblockables(now));
     return errors.build();
   }
 
-  ImmutableList<String> checkForMissingRegisteredUnblockables(DateTime now) {
+  ImmutableList<String> checkForMissingRegisteredUnblockables(Instant now) {
     ImmutableList.Builder<String> errors = new ImmutableList.Builder<>();
     ImmutableList<Tld> bsaEnabledTlds =
         getTldEntitiesOfType(TldType.REAL).stream()
             .filter(tld -> isEnrolledWithBsa(tld, now))
             .collect(toImmutableList());
-    DateTime stalenessThreshold = now.minus(maxStaleness);
+    Instant stalenessThreshold = now.minus(maxStaleness);
     bsaEnabledTlds.stream()
         .map(Tld::getTldStr)
         .map(tld -> bsaQuery(() -> queryMissedRegisteredUnblockables(tld, now)))
@@ -290,7 +290,7 @@ public class BsaValidateAction implements Runnable {
     return errors.build();
   }
 
-  ImmutableList<String> checkForMissingReservedUnblockables(DateTime now) {
+  ImmutableList<String> checkForMissingReservedUnblockables(Instant now) {
     ImmutableList.Builder<String> errors = new ImmutableList.Builder<>();
     try (Stream<ImmutableList<String>> reservedNames =
         toBatches(

core/src/main/java/google/registry/bsa/ReservedDomainsUtils.java

@@ -20,6 +20,7 @@ import static google.registry.bsa.BsaStringUtils.DOMAIN_JOINER;
 import static google.registry.flows.domain.DomainFlowUtils.isReserved;
 import static google.registry.model.tld.Tlds.findTldForName;
 import static google.registry.model.tld.label.ReservedList.loadReservedLists;
+import static google.registry.util.DateTimeUtils.toInstant;
 
 import com.google.common.collect.ImmutableSet;
 import com.google.common.net.InternetDomainName;
@@ -28,6 +29,7 @@ import google.registry.model.tld.Tld.TldState;
 import google.registry.model.tld.Tld.TldType;
 import google.registry.model.tld.Tlds;
 import google.registry.model.tld.label.ReservedList;
+import java.time.Instant;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
@@ -45,7 +47,16 @@ public final class ReservedDomainsUtils {
 
   private ReservedDomainsUtils() {}
 
+  /**
+   * @deprecated Use {@link #getAllReservedNames(Instant)}
+   */
+  @Deprecated
+  @SuppressWarnings("InlineMeSuggester")
   public static Stream<String> getAllReservedNames(DateTime now) {
+    return getAllReservedNames(toInstant(now));
+  }
+
+  public static Stream<String> getAllReservedNames(Instant now) {
     return Tlds.getTldEntitiesOfType(TldType.REAL).stream()
         .filter(tld -> Tld.isEnrolledWithBsa(tld, now))
         .map(tld -> getAllReservedDomainsInTld(tld, now))
@@ -53,7 +64,7 @@ public final class ReservedDomainsUtils {
   }
 
   /** Returns all reserved domains in a given {@code tld} as of {@code now}. */
-  static ImmutableSet<String> getAllReservedDomainsInTld(Tld tld, DateTime now) {
+  static ImmutableSet<String> getAllReservedDomainsInTld(Tld tld, Instant now) {
     return loadReservedLists(tld.getReservedListNames()).stream()
         .map(ReservedList::getReservedListEntries)
         .map(Map::keySet)
@@ -63,11 +74,20 @@ public final class ReservedDomainsUtils {
         .collect(toImmutableSet());
   }
 
+  /**
+   * @deprecated Use {@link #getAllReservedDomainsInTld(Tld, Instant)}
+   */
+  @Deprecated
+  @SuppressWarnings("InlineMeSuggester")
+  static ImmutableSet<String> getAllReservedDomainsInTld(Tld tld, DateTime now) {
+    return getAllReservedDomainsInTld(tld, toInstant(now));
+  }
+
   /**
    * Returns true if {@code domain} is a reserved name that can be registered right now (e.g.,
    * during sunrise or with allocation token), therefore unblockable.
    */
-  public static boolean isReservedDomain(String domain, DateTime now) {
+  public static boolean isReservedDomain(String domain, Instant now) {
     Optional<InternetDomainName> tldStr = findTldForName(InternetDomainName.from(domain));
     verify(tldStr.isPresent(), "Tld for domain [%s] unexpectedly missing.", domain);
     Tld tld = Tld.get(tldStr.get().toString());
@@ -75,4 +95,13 @@ public final class ReservedDomainsUtils {
         InternetDomainName.from(domain),
         Objects.equals(tld.getTldState(now), TldState.START_DATE_SUNRISE));
   }
+
+  /**
+   * @deprecated Use {@link #isReservedDomain(String, Instant)}
+   */
+  @Deprecated
+  @SuppressWarnings("InlineMeSuggester")
+  public static boolean isReservedDomain(String domain, DateTime now) {
+    return isReservedDomain(domain, toInstant(now));
+  }
 }

core/src/main/java/google/registry/bsa/UploadBsaUnavailableDomainsAction.java

@@ -54,6 +54,7 @@ import java.io.OutputStreamWriter;
 import java.io.PipedInputStream;
 import java.io.PipedOutputStream;
 import java.io.Writer;
+import java.time.Instant;
 import java.util.Optional;
 import java.util.zip.GZIPOutputStream;
 import okhttp3.MediaType;
@@ -65,7 +66,6 @@ import okhttp3.Response;
 import okio.BufferedSink;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
-import org.joda.time.DateTime;
 
 /**
  * Daily action that uploads unavailable domain names on applicable TLDs to BSA.
@@ -122,7 +122,7 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
   public void run() {
     // TODO(mcilwain): Implement a date Cursor, have the cronjob run frequently, and short-circuit
     //                 the run if the daily upload is already completed.
-    DateTime runTime = clock.nowUtc();
+    Instant runTime = clock.now();
     ImmutableSortedSet<String> unavailableDomains = getUnavailableDomains(runTime);
     if (unavailableDomains.isEmpty()) {
       logger.atWarning().log("No unavailable domains found; terminating.");
@@ -141,7 +141,7 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
   }
 
   /** Uploads the unavailable domains list to GCS in the unavailable domains bucket. */
-  boolean uploadToGcs(ImmutableSortedSet<String> unavailableDomains, DateTime runTime) {
+  boolean uploadToGcs(ImmutableSortedSet<String> unavailableDomains, Instant runTime) {
     logger.atInfo().log("Uploading unavailable names file to GCS in bucket %s", gcsBucket);
     BlobId blobId = BlobId.of(gcsBucket, createFilename(runTime));
     // `gcsUtils.openOutputStream` returns a buffered stream
@@ -159,7 +159,7 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
     }
   }
 
-  boolean uploadToBsa(ImmutableSortedSet<String> unavailableDomains, DateTime runTime) {
+  boolean uploadToBsa(ImmutableSortedSet<String> unavailableDomains, Instant runTime) {
     try {
       Hasher sha512Hasher = Hashing.sha512().newHasher();
       unavailableDomains.stream()
@@ -211,11 +211,11 @@ public class UploadBsaUnavailableDomainsAction implements Runnable {
     }
   }
 
-  private static String createFilename(DateTime runTime) {
+  private static String createFilename(Instant runTime) {
     return String.format("unavailable_domains_%s.txt", runTime.toString());
   }
 
-  private ImmutableSortedSet<String> getUnavailableDomains(DateTime runTime) {
+  private ImmutableSortedSet<String> getUnavailableDomains(Instant runTime) {
     // Get list of TLDs to process.
     ImmutableSet<Tld> bsaEnabledTlds =
         getTldEntitiesOfType(TldType.REAL).stream()

core/src/main/java/google/registry/bsa/api/BsaReportSender.java

@@ -71,19 +71,19 @@ public class BsaReportSender {
   public void sendOrderStatusReport(String payload) {
     retrier.callWithRetry(
         () -> trySendData(this.orderStatusUrl, payload),
-        e -> e instanceof BsaException && ((BsaException) e).isRetriable());
+        e -> e instanceof BsaException bsaException && bsaException.isRetriable());
   }
 
   public void addUnblockableDomainsUpdates(String payload) {
     retrier.callWithRetry(
         () -> trySendData(this.addUnblockableDomainsUrl, payload),
-        e -> e instanceof BsaException && ((BsaException) e).isRetriable());
+        e -> e instanceof BsaException bsaException && bsaException.isRetriable());
   }
 
   public void removeUnblockableDomainsUpdates(String payload) {
     retrier.callWithRetry(
         () -> trySendData(this.removeUnblockableDomainsUrl, payload),
-        e -> e instanceof BsaException && ((BsaException) e).isRetriable());
+        e -> e instanceof BsaException bsaException && bsaException.isRetriable());
   }
 
   Void trySendData(String urlString, String payload) {

core/src/main/java/google/registry/bsa/persistence/BsaDomainRefresh.java

@@ -29,7 +29,7 @@ import jakarta.persistence.Enumerated;
 import jakarta.persistence.GeneratedValue;
 import jakarta.persistence.GenerationType;
 import jakarta.persistence.Id;
-import org.joda.time.DateTime;
+import java.time.Instant;
 
 /**
  * Records of completed and ongoing refresh actions, which recomputes the set of unblockable domains
@@ -46,10 +46,10 @@ class BsaDomainRefresh {
   Long jobId;
 
   @Column(nullable = false)
-  CreateAutoTimestamp creationTime = CreateAutoTimestamp.create(null);
+  CreateAutoTimestamp creationTime = CreateAutoTimestamp.create((Instant) null);
 
   @Column(nullable = false)
-  UpdateAutoTimestamp updateTime = UpdateAutoTimestamp.create(null);
+  UpdateAutoTimestamp updateTime = UpdateAutoTimestamp.create((Instant) null);
 
   @Column(nullable = false)
   @Enumerated(EnumType.STRING)
@@ -61,7 +61,7 @@ class BsaDomainRefresh {
     return jobId;
   }
 
-  DateTime getCreationTime() {
+  Instant getCreationTime() {
     return creationTime.getTimestamp();
   }
 

core/src/main/java/google/registry/bsa/persistence/BsaDownload.java

@@ -17,6 +17,7 @@ package google.registry.bsa.persistence;
 import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static google.registry.bsa.DownloadStage.DONE;
 import static google.registry.bsa.DownloadStage.DOWNLOAD_BLOCK_LISTS;
+import static google.registry.util.DateTimeUtils.formatInstant;
 
 import com.google.common.base.Joiner;
 import com.google.common.base.Objects;
@@ -37,8 +38,8 @@ import jakarta.persistence.GenerationType;
 import jakarta.persistence.Id;
 import jakarta.persistence.Index;
 import jakarta.persistence.Table;
+import java.time.Instant;
 import java.util.Locale;
-import org.joda.time.DateTime;
 
 /** Records of ongoing and completed download jobs. */
 @Entity
@@ -53,10 +54,10 @@ class BsaDownload {
   Long jobId;
 
   @Column(nullable = false)
-  CreateAutoTimestamp creationTime = CreateAutoTimestamp.create(null);
+  CreateAutoTimestamp creationTime = CreateAutoTimestamp.create((Instant) null);
 
   @Column(nullable = false)
-  UpdateAutoTimestamp updateTime = UpdateAutoTimestamp.create(null);
+  UpdateAutoTimestamp updateTime = UpdateAutoTimestamp.create((Instant) null);
 
   @Column(nullable = false)
   String blockListChecksums = "";
@@ -71,7 +72,7 @@ class BsaDownload {
     return jobId;
   }
 
-  DateTime getCreationTime() {
+  Instant getCreationTime() {
     return creationTime.getTimestamp();
   }
 
@@ -83,7 +84,7 @@ class BsaDownload {
    */
   String getJobName() {
     // Return a value based on job start time, which is unique.
-    return getCreationTime().toString().toLowerCase(Locale.ROOT).replace(":", "");
+    return formatInstant(getCreationTime()).toLowerCase(Locale.ROOT).replace(":", "");
   }
 
   boolean isDone() {

core/src/main/java/google/registry/bsa/persistence/BsaLabel.java

@@ -19,7 +19,7 @@ import google.registry.persistence.VKey;
 import jakarta.persistence.Column;
 import jakarta.persistence.Entity;
 import jakarta.persistence.Id;
-import org.joda.time.DateTime;
+import java.time.Instant;
 
 /**
  * Specifies a second-level TLD name that should be blocked from registration in all TLDs except by
@@ -41,12 +41,12 @@ final class BsaLabel {
    */
   @SuppressWarnings("unused")
   @Column(nullable = false)
-  DateTime creationTime;
+  Instant creationTime;
 
   // For Hibernate.
   private BsaLabel() {}
 
-  BsaLabel(String label, DateTime creationTime) {
+  BsaLabel(String label, Instant creationTime) {
     this.label = label;
     this.creationTime = creationTime;
   }

core/src/main/java/google/registry/bsa/persistence/BsaUnblockableDomain.java

@@ -31,6 +31,7 @@ import jakarta.persistence.Enumerated;
 import jakarta.persistence.Id;
 import jakarta.persistence.IdClass;
 import java.io.Serializable;
+import java.time.Instant;
 
 /** A domain matching a BSA label but is in use (registered or reserved), so cannot be blocked. */
 @Entity
@@ -52,7 +53,7 @@ class BsaUnblockableDomain {
    */
   @SuppressWarnings("unused")
   @Column(nullable = false)
-  CreateAutoTimestamp createTime = CreateAutoTimestamp.create(null);
+  CreateAutoTimestamp createTime = CreateAutoTimestamp.create((Instant) null);
 
   // For Hibernate
   BsaUnblockableDomain() {}

core/src/main/java/google/registry/bsa/persistence/DomainsRefresher.java

@@ -45,14 +45,14 @@ import google.registry.model.domain.Domain;
 import google.registry.model.tld.Tld;
 import google.registry.model.tld.Tld.TldType;
 import google.registry.util.BatchedStreams;
+import java.time.Duration;
+import java.time.Instant;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Optional;
 import java.util.stream.Stream;
-import org.joda.time.DateTime;
-import org.joda.time.Duration;
 
 /**
  * Rechecks {@link BsaUnblockableDomain the registered/reserved domain names} in the database for
@@ -89,13 +89,13 @@ import org.joda.time.Duration;
  */
 public final class DomainsRefresher {
 
-  private final DateTime prevRefreshStartTime;
+  private final Instant prevRefreshStartTime;
   private final int transactionBatchSize;
-  private final DateTime now;
+  private final Instant now;
 
   public DomainsRefresher(
-      DateTime prevRefreshStartTime,
-      DateTime now,
+      Instant prevRefreshStartTime,
+      Instant now,
       Duration domainTxnMaxDuration,
       int transactionBatchSize) {
     this.prevRefreshStartTime = prevRefreshStartTime.minus(domainTxnMaxDuration);
@@ -249,7 +249,7 @@ public final class DomainsRefresher {
   }
 
   static ImmutableSet<String> getNewlyCreatedUnblockables(
-      DateTime prevRefreshStartTime, DateTime now) {
+      Instant prevRefreshStartTime, Instant now) {
     ImmutableSet<String> bsaEnabledTlds =
         getTldEntitiesOfType(TldType.REAL).stream()
             .filter(tld -> isEnrolledWithBsa(tld, now))
@@ -260,7 +260,7 @@ public final class DomainsRefresher {
     return getBlockedDomainNames(liveDomains);
   }
 
-  static ImmutableSet<String> getAllReservedUnblockables(DateTime now, int batchSize) {
+  static ImmutableSet<String> getAllReservedUnblockables(Instant now, int batchSize) {
     Stream<String> allReserved = getAllReservedNames(now);
     return BatchedStreams.toBatches(allReserved, batchSize)
         .map(DomainsRefresher::getBlockedDomainNames)

core/src/main/java/google/registry/bsa/persistence/DownloadSchedule.java

@@ -24,8 +24,8 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import com.google.common.collect.ImmutableMap;
 import google.registry.bsa.BlockListType;
 import google.registry.bsa.DownloadStage;
+import java.time.Instant;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * Information needed when handling a download from BSA.
@@ -36,7 +36,7 @@ import org.joda.time.DateTime;
  */
 public record DownloadSchedule(
     long jobId,
-    DateTime jobCreationTime,
+    Instant jobCreationTime,
     String jobName,
     DownloadStage stage,
     Optional<CompletedJob> latestCompleted,

core/src/main/java/google/registry/bsa/persistence/DownloadScheduler.java

@@ -115,7 +115,11 @@ public final class DownloadScheduler {
   }
 
   private boolean isTimeAgain(BsaDownload mostRecent, Duration interval) {
-    return mostRecent.getCreationTime().plus(interval).minus(CRON_JITTER).isBefore(clock.nowUtc());
+    return mostRecent
+        .getCreationTime()
+        .plusMillis(interval.getMillis())
+        .minusMillis(CRON_JITTER.getMillis())
+        .isBefore(clock.now());
   }
 
   /**

core/src/main/java/google/registry/bsa/persistence/Queries.java

@@ -19,19 +19,16 @@ import static com.google.common.collect.ImmutableList.toImmutableList;
 import static google.registry.bsa.BsaStringUtils.DOMAIN_SPLITTER;
 import static google.registry.bsa.BsaTransactions.bsaQuery;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static org.joda.time.DateTimeZone.UTC;
 
 import com.google.common.collect.ImmutableCollection;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import google.registry.bsa.api.UnblockableDomain;
-import google.registry.model.CreateAutoTimestamp;
 import java.time.Instant;
 import java.util.List;
 import java.util.Optional;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
-import org.joda.time.DateTime;
 
 /** Helpers for querying BSA JPA entities. */
 public final class Queries {
@@ -135,15 +132,15 @@ public final class Queries {
   }
 
   static ImmutableSet<String> queryNewlyCreatedDomains(
-      ImmutableCollection<String> tlds, DateTime minCreationTime, DateTime now) {
+      ImmutableCollection<String> tlds, Instant minCreationTime, Instant now) {
     return ImmutableSet.copyOf(
         tm().getEntityManager()
             .createQuery(
-                "SELECT domainName FROM Domain WHERE creationTime >= :minCreationTime "
+                "SELECT domainName FROM Domain WHERE creationTime.creationTime >= :minCreationTime "
                     + "AND deletionTime > :now "
                     + "AND tld in (:tlds)",
                 String.class)
-            .setParameter("minCreationTime", CreateAutoTimestamp.create(minCreationTime))
+            .setParameter("minCreationTime", minCreationTime)
             .setParameter("now", now)
             .setParameter("tlds", tlds)
             .getResultList());
@@ -156,44 +153,36 @@ public final class Queries {
    * @return The missing unblockables and their creation and deletion time.
    */
   public static ImmutableList<DomainLifeSpan> queryMissedRegisteredUnblockables(
-      String tld, DateTime now) {
+      String tld, Instant now) {
     String sqlTemplate =
         """
-    SELECT l.domain_name, creation_time, deletion_time
-    FROM
-        (SELECT d.domain_name, d.creation_time, d.deletion_time
-         FROM
-             "Domain" d
-         JOIN
-             (SELECT concat(label, '.', :tld) AS domain_name from "BsaLabel") b
-         ON b.domain_name = d.domain_name
-         WHERE deletion_time > :now) l
-    LEFT OUTER JOIN
-        (SELECT concat(label, '.', tld) as domain_name
-         FROM "BsaUnblockableDomain"
-         WHERE tld = :tld and reason = 'REGISTERED') r
-    ON l.domain_name = r.domain_name
-    WHERE r.domain_name is null;
-    """;
+        SELECT l.domain_name, creation_time, deletion_time
+        FROM
+            (SELECT d.domain_name, d.creation_time, d.deletion_time
+             FROM
+                 "Domain" d
+             JOIN
+                 (SELECT concat(label, '.', :tld) AS domain_name from "BsaLabel") b
+             ON b.domain_name = d.domain_name
+             WHERE deletion_time > :now) l
+        LEFT OUTER JOIN
+            (SELECT concat(label, '.', tld) as domain_name
+             FROM "BsaUnblockableDomain"
+             WHERE tld = :tld and reason = 'REGISTERED') r
+        ON l.domain_name = r.domain_name
+        WHERE r.domain_name is null;
+        """;
 
     return ((Stream<?>)
             tm().getEntityManager()
                 .createNativeQuery(sqlTemplate)
                 .setParameter("tld", tld)
-                .setParameter("now", Instant.ofEpochMilli(now.getMillis()))
+                .setParameter("now", now)
                 .getResultStream())
         .map(Object[].class::cast)
-        .map(
-            row ->
-                new DomainLifeSpan(
-                    (String) row[0], toDateTime((Instant) row[1]), toDateTime((Instant) row[2])))
+        .map(row -> new DomainLifeSpan((String) row[0], (Instant) row[1], (Instant) row[2]))
         .collect(toImmutableList());
   }
 
-  // For testing convenience: 'assertEquals' fails between `new DateTime(timestamp)` and below.
-  static DateTime toDateTime(Instant timestamp) {
-    return new DateTime(timestamp.toEpochMilli(), UTC);
-  }
-
-  public record DomainLifeSpan(String domainName, DateTime creationTime, DateTime deletionTime) {}
+  public record DomainLifeSpan(String domainName, Instant creationTime, Instant deletionTime) {}
 }

core/src/main/java/google/registry/bsa/persistence/RefreshSchedule.java

@@ -19,7 +19,7 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 
 import com.google.errorprone.annotations.CanIgnoreReturnValue;
 import google.registry.bsa.RefreshStage;
-import org.joda.time.DateTime;
+import java.time.Instant;
 
 /**
  * Information needed when handling a domain refresh.
@@ -28,10 +28,10 @@ import org.joda.time.DateTime;
  */
 public record RefreshSchedule(
     long jobId,
-    DateTime jobCreationTime,
+    Instant jobCreationTime,
     String jobName,
     RefreshStage stage,
-    DateTime prevRefreshTime) {
+    Instant prevRefreshTime) {
 
   /** Updates the current job to the new stage. */
   @CanIgnoreReturnValue
@@ -50,7 +50,7 @@ public record RefreshSchedule(
             });
   }
 
-  static RefreshSchedule create(BsaDomainRefresh job, DateTime prevJobCreationTime) {
+  static RefreshSchedule create(BsaDomainRefresh job, Instant prevJobCreationTime) {
     return new RefreshSchedule(
         job.getJobId(),
         job.getCreationTime(),

core/src/main/java/google/registry/bsa/persistence/RefreshScheduler.java

@@ -20,8 +20,8 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableList;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /** Assigns work for each cron invocation of domain refresh job. */
 public class RefreshScheduler {
@@ -56,7 +56,7 @@ public class RefreshScheduler {
                 return Optional.empty();
               }
 
-              DateTime prevDownloadTime = mostRecentDownload.get().getCreationTime();
+              Instant prevDownloadTime = mostRecentDownload.get().getCreationTime();
               if (recentJobs.isEmpty()) {
                 return Optional.of(scheduleNewJob(prevDownloadTime));
               } else {
@@ -65,13 +65,13 @@ public class RefreshScheduler {
             });
   }
 
-  RefreshSchedule scheduleNewJob(DateTime prevRefreshTime) {
+  RefreshSchedule scheduleNewJob(Instant prevRefreshTime) {
     BsaDomainRefresh newJob = new BsaDomainRefresh();
     tm().insert(newJob);
     return RefreshSchedule.create(newJob, prevRefreshTime);
   }
 
-  RefreshSchedule rescheduleOngoingJob(BsaDomainRefresh ongoingJob, DateTime prevJobStartTime) {
+  RefreshSchedule rescheduleOngoingJob(BsaDomainRefresh ongoingJob, Instant prevJobStartTime) {
     return RefreshSchedule.create(ongoingJob, prevJobStartTime);
   }
 

core/src/main/java/google/registry/cache/CacheModule.java

@@ -0,0 +1,163 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import static com.google.common.collect.ImmutableList.toImmutableList;
+import static com.google.common.collect.ImmutableSet.toImmutableSet;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Iterables;
+import dagger.Module;
+import dagger.Provides;
+import google.registry.config.CredentialModule.ApplicationDefaultCredential;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.model.EppResource;
+import google.registry.model.ForeignKeyUtils;
+import google.registry.model.domain.Domain;
+import google.registry.model.host.Host;
+import google.registry.persistence.VKey;
+import google.registry.util.Clock;
+import google.registry.util.GoogleCredentialsBundle;
+import jakarta.inject.Singleton;
+import java.io.ByteArrayInputStream;
+import java.nio.charset.StandardCharsets;
+import java.security.GeneralSecurityException;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.util.Optional;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLSocketFactory;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509TrustManager;
+import redis.clients.jedis.DefaultJedisClientConfig;
+import redis.clients.jedis.HostAndPort;
+import redis.clients.jedis.Jedis;
+import redis.clients.jedis.JedisClientConfig;
+import redis.clients.jedis.RedisClient;
+import redis.clients.jedis.RedisClusterClient;
+import redis.clients.jedis.UnifiedJedis;
+
+/** Dagger module to provide the {@link Jedis}-based cache for Valkey. */
+@Module
+public final class CacheModule {
+
+  @Provides
+  @Singleton
+  public static Optional<UnifiedJedis> provideJedis(
+      @ApplicationDefaultCredential GoogleCredentialsBundle credentialsBundle,
+      @Config("valkeyHostsAndPorts") Optional<ImmutableList<String>> valkeyHostsAndPorts,
+      @Config("valkeySslSocketFactory") SSLSocketFactory valkeySslSocketFactory) {
+    if (valkeyHostsAndPorts.map(ImmutableList::isEmpty).orElse(true)) {
+      return Optional.empty();
+    }
+    ImmutableSet<HostAndPort> hostsAndPorts =
+        valkeyHostsAndPorts.get().stream().map(HostAndPort::from).collect(toImmutableSet());
+    JedisClientConfig clientConfig =
+        DefaultJedisClientConfig.builder()
+            .ssl(true)
+            .sslSocketFactory(valkeySslSocketFactory)
+            .credentialsProvider(new ValkeyCredentialsProvider(credentialsBundle))
+            .build();
+    if (hostsAndPorts.size() > 1) {
+      return Optional.of(
+          RedisClusterClient.builder().clientConfig(clientConfig).nodes(hostsAndPorts).build());
+    }
+    return Optional.of(
+        RedisClient.builder()
+            .clientConfig(clientConfig)
+            .hostAndPort(Iterables.getOnlyElement(hostsAndPorts))
+            .build());
+  }
+
+  @Provides
+  @Singleton
+  public static DomainCache provideDomainCache(Optional<UnifiedJedis> jedis, Clock clock) {
+    if (jedis.isEmpty()) {
+      return domainName ->
+          ForeignKeyUtils.loadResourceByCache(Domain.class, domainName, clock.now());
+    }
+    SimplifiedJedisClient<Domain> jedisClient =
+        SimplifiedJedisClient.create(Domain.class, jedis.get());
+    return new MultilayerDomainCache(jedisClient, clock);
+  }
+
+  @Provides
+  @Singleton
+  public static HostCache provideHostCache(Optional<UnifiedJedis> jedis) {
+    if (jedis.isEmpty()) {
+      return repoId ->
+          Optional.ofNullable(EppResource.loadByCache(VKey.create(Host.class, repoId)));
+    }
+    SimplifiedJedisClient<Host> jedisClient = SimplifiedJedisClient.create(Host.class, jedis.get());
+    return new MultilayerHostCache(jedisClient);
+  }
+
+  @Provides
+  @Singleton
+  @Config("valkeySslSocketFactory")
+  static SSLSocketFactory provideValkeySslSocketFactory(
+      @Config("valkeyCertificateAuthority") String valkeyCertificateAuthority) {
+    try {
+      ImmutableList<X509Certificate> trustedCerts =
+          CertificateFactory.getInstance("X.509")
+              .generateCertificates(
+                  new ByteArrayInputStream(
+                      valkeyCertificateAuthority.getBytes(StandardCharsets.UTF_8)))
+              .stream()
+              .map(X509Certificate.class::cast)
+              .collect(toImmutableList());
+
+      // This is a roundabout way to trust the Cloud Memorystore-issued certificate authority even
+      // though it's not a root cert (it's an intermediate cert).
+      TrustManager x509TrustManager =
+          new X509TrustManager() {
+            @Override
+            public X509Certificate[] getAcceptedIssuers() {
+              return trustedCerts.toArray(new X509Certificate[0]);
+            }
+
+            @Override
+            public void checkClientTrusted(X509Certificate[] certs, String authType) {}
+
+            @Override
+            public void checkServerTrusted(X509Certificate[] certs, String authType)
+                throws CertificateException {
+              Exception lastException = null;
+              for (X509Certificate cert : certs) {
+                for (X509Certificate trustedCert : trustedCerts) {
+                  try {
+                    cert.verify(trustedCert.getPublicKey());
+                    return;
+                  } catch (Exception e) {
+                    // Verification failed, try the next one
+                    lastException = e;
+                  }
+                }
+              }
+              throw new CertificateException(
+                  "None of the server certificates were signed by the provided CA", lastException);
+            }
+          };
+
+      SSLContext sslContext = SSLContext.getInstance("TLS");
+      sslContext.init(null, new TrustManager[] {x509TrustManager}, null);
+      return sslContext.getSocketFactory();
+    } catch (GeneralSecurityException e) {
+      throw new RuntimeException("Could not create X.509 certificate from provided PEM", e);
+    }
+  }
+}

core/src/main/java/google/registry/cache/DomainCache.java

@@ -0,0 +1,23 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import google.registry.model.domain.Domain;
+import java.util.Optional;
+
+/** Interface for some type of cache that loads {@link Domain}s by domain name. */
+public interface DomainCache {
+  Optional<Domain> loadByDomainName(String domainName);
+}

core/src/main/java/google/registry/cache/HostCache.java

@@ -0,0 +1,23 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import google.registry.model.host.Host;
+import java.util.Optional;
+
+/** Interface for some type of cache that loads {@link Host}s by repo ID. */
+public interface HostCache {
+  Optional<Host> loadByRepoId(String repoId);
+}

core/src/main/java/google/registry/cache/MultilayerDomainCache.java

@@ -0,0 +1,68 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import com.google.common.collect.ImmutableList;
+import google.registry.model.ForeignKeyUtils;
+import google.registry.model.domain.Domain;
+import google.registry.model.tld.Tld;
+import google.registry.util.Clock;
+import java.time.Instant;
+import java.util.Optional;
+
+/**
+ * A multi-layer cache for {@link Domain} objects.
+ *
+ * <p>It uses a local Caffeine cache, a remote Jedis cache, and finally the database.
+ */
+public class MultilayerDomainCache extends MultilayerEppResourceCache<Domain>
+    implements DomainCache {
+
+  private final Clock clock;
+
+  public MultilayerDomainCache(SimplifiedJedisClient<Domain> jedisClient, Clock clock) {
+    super(jedisClient);
+    this.clock = clock;
+  }
+
+  @Override
+  public Optional<Domain> loadByDomainName(String domainName) {
+    return loadFromCaches(domainName);
+  }
+
+  @Override
+  protected Optional<Domain> loadFromDatabase(String domainName) {
+    // Don't use the cache (avoid caching the same domain twice). Do use the replica SQL instance.
+    Optional<Domain> possibleDomain =
+        Optional.ofNullable(
+            ForeignKeyUtils.loadMostRecentResourceObjects(
+                    Domain.class, ImmutableList.of(domainName), true)
+                .get(domainName));
+    Instant now = clock.now();
+    return possibleDomain
+        .filter(domain -> now.isBefore(domain.getDeletionTime()))
+        .map(domain -> domain.cloneProjectedAtTime(now));
+  }
+
+  @Override
+  protected String getJedisPrefix() {
+    return "d_";
+  }
+
+  @Override
+  protected boolean shouldPersistToRemoteCache(Domain domain) {
+    return Tld.get(domain.getTld()).getTldType().equals(Tld.TldType.REAL);
+  }
+}

core/src/main/java/google/registry/cache/MultilayerEppResourceCache.java

@@ -0,0 +1,79 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
+import google.registry.config.RegistryConfig;
+import google.registry.model.EppResource;
+import java.time.Duration;
+import java.util.Optional;
+
+/**
+ * A multi-layer cache for {@link EppResource}s.
+ *
+ * <p>It uses a local Caffeine cache, a remote Jedis cache, and finally the database.
+ */
+public abstract class MultilayerEppResourceCache<V extends EppResource> {
+
+  // Don't use a loading cache; it'd complicate the nesting
+  private final Cache<String, V> localCache =
+      Caffeine.newBuilder()
+          .expireAfterWrite(Duration.ofHours(1))
+          .maximumSize(RegistryConfig.getEppResourceMaxCachedEntries())
+          .build();
+
+  private final SimplifiedJedisClient<V> jedisClient;
+
+  protected MultilayerEppResourceCache(SimplifiedJedisClient<V> jedisClient) {
+    this.jedisClient = jedisClient;
+  }
+
+  protected abstract Optional<V> loadFromDatabase(String key);
+
+  protected abstract String getJedisPrefix();
+
+  protected boolean shouldPersistToRemoteCache(V value) {
+    return true;
+  }
+
+  protected Optional<V> loadFromCaches(String key) {
+    // hopefully the resource is in the local cache
+    Optional<V> possibleValue = Optional.ofNullable(localCache.getIfPresent(key));
+    if (possibleValue.isPresent()) {
+      return possibleValue;
+    }
+
+    // if not, try the remote cache
+    String jedisKey = getJedisPrefix() + key;
+    possibleValue = jedisClient.get(jedisKey);
+    if (possibleValue.isPresent()) {
+      localCache.put(key, possibleValue.get());
+      return possibleValue;
+    }
+
+    // lastly, try the DB
+    return loadFromDatabase(key)
+        .map(
+            v -> {
+              // Optional has no direct "peek" functionality to fill the caches
+              if (shouldPersistToRemoteCache(v)) {
+                jedisClient.set(new SimplifiedJedisClient.JedisResource<>(jedisKey, v));
+              }
+              localCache.put(key, v);
+              return v;
+            });
+  }
+}

core/src/main/java/google/registry/cache/MultilayerHostCache.java

@@ -0,0 +1,49 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import static google.registry.persistence.transaction.TransactionManagerFactory.replicaTm;
+
+import google.registry.model.host.Host;
+import google.registry.persistence.VKey;
+import java.util.Optional;
+
+/**
+ * A multi-layer cache for {@link Host} objects.
+ *
+ * <p>It uses a local Caffeine cache, a remote Jedis cache, and finally the database.
+ */
+public class MultilayerHostCache extends MultilayerEppResourceCache<Host> implements HostCache {
+
+  public MultilayerHostCache(SimplifiedJedisClient<Host> jedisClient) {
+    super(jedisClient);
+  }
+
+  @Override
+  public Optional<Host> loadByRepoId(String repoId) {
+    return loadFromCaches(repoId);
+  }
+
+  @Override
+  protected Optional<Host> loadFromDatabase(String repoId) {
+    return replicaTm()
+        .transact(() -> replicaTm().loadByKeyIfPresent(VKey.create(Host.class, repoId)));
+  }
+
+  @Override
+  protected String getJedisPrefix() {
+    return "h_";
+  }
+}

core/src/main/java/google/registry/cache/SimplifiedJedisClient.java

@@ -0,0 +1,130 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import static com.google.common.base.Preconditions.checkNotNull;
+
+import com.google.common.collect.ImmutableCollection;
+import com.google.common.collect.Iterables;
+import com.google.common.collect.Streams;
+import google.registry.model.EppResource;
+import io.protostuff.LinkedBuffer;
+import io.protostuff.ProtostuffIOUtil;
+import io.protostuff.Schema;
+import io.protostuff.runtime.RuntimeSchema;
+import java.nio.charset.StandardCharsets;
+import java.util.Optional;
+import redis.clients.jedis.AbstractPipeline;
+import redis.clients.jedis.UnifiedJedis;
+import redis.clients.jedis.params.SetParams;
+
+/**
+ * A {@link UnifiedJedis} client that handles serialization/deserialization.
+ *
+ * <p>We use protobufs for serialization to handle the immutable collections that our objects use.
+ *
+ * <p>{@link UnifiedJedis} pairs key-value types, so we need the key to be serialized to a byte
+ * array as well.
+ */
+public class SimplifiedJedisClient<V extends EppResource> {
+
+  public record JedisResource<V extends EppResource>(String key, V value) {}
+
+  private static final int BATCH_SIZE = 500;
+
+  private final Schema<V> valueSchema;
+  private final UnifiedJedis jedis;
+
+  public static <V extends EppResource> SimplifiedJedisClient<V> create(
+      Class<V> valueClass, UnifiedJedis jedis) {
+    Schema<V> valueSchema = RuntimeSchema.getSchema(valueClass);
+    return new SimplifiedJedisClient<>(valueSchema, jedis);
+  }
+
+  private SimplifiedJedisClient(Schema<V> valueSchema, UnifiedJedis jedis) {
+    this.valueSchema = valueSchema;
+    this.jedis = jedis;
+  }
+
+  /** Gets the value from the remote cache. Returns null if it does not exist. */
+  public Optional<V> get(String key) {
+    checkNotNull(key, "Key cannot be null");
+    byte[] data = jedis.get(key.getBytes(StandardCharsets.UTF_8));
+    return Optional.ofNullable(data).map(this::deserialize);
+  }
+
+  /** Sets the value in the remote cache. */
+  public void set(JedisResource<V> resource) {
+    checkNotNull(resource.key, "Key cannot be null");
+    checkNotNull(resource.value, "Value cannot be null");
+    jedis.set(
+        resource.key.getBytes(StandardCharsets.UTF_8),
+        serialize(resource.value),
+        new SetParams().pxAt(resource.value.getDeletionTime().toEpochMilli()));
+  }
+
+  /** Sets multiple values in the remote cache using a Jedis {@link AbstractPipeline}. */
+  public void setAll(ImmutableCollection<JedisResource<V>> resources) {
+    for (Iterable<JedisResource<V>> batch : Iterables.partition(resources, BATCH_SIZE)) {
+      AbstractPipeline pipeline = jedis.pipelined();
+      batch.forEach(
+          resource ->
+              pipeline.set(
+                  resource.key.getBytes(StandardCharsets.UTF_8),
+                  serialize(resource.value),
+                  new SetParams().pxAt(resource.value.getDeletionTime().toEpochMilli())));
+      pipeline.sync();
+    }
+  }
+
+  /**
+   * Deletes all values associated with the given keys in Valkey.
+   *
+   * <p>If any given key does not exist, it does nothing.
+   *
+   * <p>Note: we use {@code unlink} here instead of {@code del} so that the actual deletion can
+   * happen in the background whenever the server wants. The keys are removed from the namespace
+   * immediately, and we don't need the memory to be reclaimed this instant.
+   *
+   * <p>This could also be accomplished by using {@link #setAll(ImmutableCollection)} with
+   * expiration times that are in the past, but this is clearer.
+   */
+  public void deleteAll(ImmutableCollection<String> keys) {
+    // we use a reasonably small batch size to avoid overwhelming the network
+    for (Iterable<String> batch : Iterables.partition(keys, BATCH_SIZE)) {
+      byte[][] keysToUnlink =
+          Streams.stream(batch)
+              .map(key -> key.getBytes(StandardCharsets.UTF_8))
+              .toArray(byte[][]::new);
+      jedis.unlink(keysToUnlink);
+    }
+  }
+
+  private byte[] serialize(V value) {
+    LinkedBuffer buffer = LinkedBuffer.allocate(LinkedBuffer.DEFAULT_BUFFER_SIZE);
+    try {
+      return ProtostuffIOUtil.toByteArray(value, valueSchema, buffer);
+    } finally {
+      buffer.clear();
+    }
+  }
+
+  private V deserialize(byte[] data) {
+    // We use protobufs because other deserializers don't play nicely with immutable collections
+    V value = valueSchema.newMessage();
+    ProtostuffIOUtil.mergeFrom(data, value, valueSchema);
+    return value;
+  }
+}

core/src/main/java/google/registry/cache/ValkeyCredentialsProvider.java

@@ -0,0 +1,46 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.cache;
+
+import com.google.auth.oauth2.GoogleCredentials;
+import google.registry.util.GoogleCredentialsBundle;
+import java.io.IOException;
+import java.util.function.Supplier;
+import redis.clients.jedis.DefaultRedisCredentials;
+import redis.clients.jedis.RedisCredentials;
+
+public class ValkeyCredentialsProvider implements Supplier<RedisCredentials> {
+
+  private static final String MEMORYSTORE_AUTH_SCOPE =
+      "https://www.googleapis.com/auth/cloud-platform";
+
+  private final GoogleCredentials credentials;
+
+  public ValkeyCredentialsProvider(GoogleCredentialsBundle credentialsBundle) {
+    this.credentials =
+        credentialsBundle.getGoogleCredentials().createScoped(MEMORYSTORE_AUTH_SCOPE);
+  }
+
+  @Override
+  public RedisCredentials get() {
+    try {
+      credentials.refreshIfExpired();
+    } catch (IOException e) {
+      throw new RuntimeException("Unable to refresh IAM token for Memorystore", e);
+    }
+    String token = credentials.getAccessToken().getTokenValue();
+    return new DefaultRedisCredentials(null, token);
+  }
+}

core/src/main/java/google/registry/config/DelegatedCredentials.java

@@ -131,7 +131,7 @@ public class DelegatedCredentials extends GoogleCredentials {
       Clock clock,
       Duration tokenRefreshDelay) {
     checkArgument(
-        tokenRefreshDelay.getSeconds() <= MAX_TOKEN_REFRESH_DELAY.getSeconds(),
+        tokenRefreshDelay.toSeconds() <= MAX_TOKEN_REFRESH_DELAY.toSeconds(),
         "Max refresh delay must not exceed %s.",
         MAX_TOKEN_REFRESH_DELAY);
 
@@ -206,7 +206,7 @@ public class DelegatedCredentials extends GoogleCredentials {
     JsonWebToken.Payload payload = new JsonWebToken.Payload();
     payload.setIssuer(this.delegatedServiceAccountUser);
     payload.setIssuedAtTimeSeconds(currentTime / 1000);
-    payload.setExpirationTimeSeconds(currentTime / 1000 + tokenRefreshDelay.getSeconds());
+    payload.setExpirationTimeSeconds(currentTime / 1000 + tokenRefreshDelay.toSeconds());
     payload.setSubject(delegatingUserEmail);
     payload.put("scope", Joiner.on(' ').join(scopes));
     payload.setAudience(DEFAULT_TOKEN_URI);
@@ -241,10 +241,10 @@ public class DelegatedCredentials extends GoogleCredentials {
     if (value == null) {
       throw new IOException(String.format(VALUE_NOT_FOUND_MESSAGE, errorPrefix, key));
     }
-    if (!(value instanceof String)) {
+    if (!(value instanceof String string)) {
       throw new IOException(String.format(VALUE_WRONG_TYPE_MESSAGE, errorPrefix, "string", key));
     }
-    return (String) value;
+    return string;
   }
 
   /** Return the specified integer from JSON or throw a helpful error message. */
@@ -257,9 +257,9 @@ public class DelegatedCredentials extends GoogleCredentials {
     if (value instanceof BigDecimal bigDecimalValue) {
       return bigDecimalValue.intValueExact();
     }
-    if (!(value instanceof Integer)) {
+    if (!(value instanceof Integer i)) {
       throw new IOException(String.format(VALUE_WRONG_TYPE_MESSAGE, errorPrefix, "integer", key));
     }
-    return (Integer) value;
+    return i;
   }
 }

core/src/main/java/google/registry/config/RegistryConfig.java

@@ -1463,6 +1463,14 @@ public final class RegistryConfig {
       return config.mosapi.tldThreadCount;
     }
 
+    @Provides
+    @Config("valkeyHostsAndPorts")
+    public static Optional<ImmutableList<String>> provideValkeyHostsAndPorts(
+        RegistryConfigSettings config) {
+      return Optional.ofNullable(config.valkey)
+          .map(valkey -> ImmutableList.copyOf(valkey.hostsAndPorts));
+    }
+
     private static String formatComments(String text) {
       return Splitter.on('\n').omitEmptyStrings().trimResults().splitToList(text).stream()
           .map(s -> "# " + s)

core/src/main/java/google/registry/config/RegistryConfigSettings.java

@@ -43,6 +43,7 @@ public class RegistryConfigSettings {
   public BulkPricingPackageMonitoring bulkPricingPackageMonitoring;
   public Bsa bsa;
   public MosApi mosapi;
+  public Valkey valkey;
 
   /** Configuration options that apply to the entire GCP project. */
   public static class GcpProject {
@@ -267,4 +268,9 @@ public class RegistryConfigSettings {
     public List<String> services;
     public int tldThreadCount;
   }
+
+  /** Configuration for Valkey caching. */
+  public static class Valkey {
+    public List<String> hostsAndPorts;
+  }
 }

core/src/main/java/google/registry/config/files/default-config.yaml

@@ -639,3 +639,7 @@ mosapi:
   # ICANN MoSAPI Specification, Section 12.3</a>
   tldThreadCount: 4
 
+valkey:
+  # Optional: hosts and ports for remote Valkey caching, e.g.
+  # - "127.0.0.1:6379"
+  hostsAndPorts: []

core/src/main/java/google/registry/export/ExportDomainListsAction.java

@@ -114,13 +114,13 @@ public class ExportDomainListsAction implements Runnable {
                               .unwrap(NativeQuery.class)
                               .setTupleTransformer(new DomainResultTransformer())
                               .setParameter("tld", tld)
-                              .setParameter("now", replicaTm().getTransactionTime().toString())
+                              .setParameter("now", replicaTm().getTxTime().toString())
                               .getResultList();
                         } else {
                           return replicaTm()
                               .query(SELECT_DOMAINS_STATEMENT, String.class)
                               .setParameter("tld", tld)
-                              .setParameter("now", replicaTm().getTransactionTime())
+                              .setParameter("now", replicaTm().getTxTime())
                               .getResultList();
                         }
                       });

core/src/main/java/google/registry/export/ExportPremiumTermsAction.java

@@ -144,7 +144,8 @@ public class ExportPremiumTermsAction implements Runnable {
     String premiumListName = tld.getPremiumListName().get();
     checkState(
         PremiumListDao.getLatestRevision(premiumListName).isPresent(),
-        "Could not load premium list for " + tldStr);
+        "Could not load premium list for %s",
+        tldStr);
     SortedSet<String> premiumTerms =
         PremiumListDao.loadAllPremiumEntries(premiumListName).stream()
             .map(PremiumEntry::toString)

core/src/main/java/google/registry/export/sheet/SyncRegistrarsSheet.java

@@ -25,7 +25,7 @@ import static google.registry.model.registrar.RegistrarPoc.Type.MARKETING;
 import static google.registry.model.registrar.RegistrarPoc.Type.TECH;
 import static google.registry.model.registrar.RegistrarPoc.Type.WHOIS;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.util.DateTimeUtils.START_OF_TIME;
+import static google.registry.util.DateTimeUtils.START_INSTANT;
 
 import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableList;
@@ -40,10 +40,10 @@ import google.registry.util.Clock;
 import google.registry.util.DateTimeUtils;
 import jakarta.inject.Inject;
 import java.io.IOException;
+import java.time.Instant;
 import java.util.Optional;
 import java.util.function.Predicate;
 import javax.annotation.Nullable;
-import org.joda.time.DateTime;
 
 /**
  * Class for synchronizing all {@link Registrar} objects to a Google Spreadsheet.
@@ -63,7 +63,7 @@ class SyncRegistrarsSheet {
   boolean wereRegistrarsModified() {
     Optional<Cursor> cursor =
         tm().transact(() -> tm().loadByKeyIfPresent(Cursor.createGlobalVKey(SYNC_REGISTRAR_SHEET)));
-    DateTime lastUpdateTime = cursor.isEmpty() ? START_OF_TIME : cursor.get().getCursorTime();
+    Instant lastUpdateTime = cursor.isEmpty() ? START_INSTANT : cursor.get().getCursorTimeInstant();
     for (Registrar registrar : Registrar.loadAllCached()) {
       if (DateTimeUtils.isAtOrAfter(registrar.getLastUpdateTime(), lastUpdateTime)) {
         return true;
@@ -74,7 +74,7 @@ class SyncRegistrarsSheet {
 
   /** Performs the synchronization operation. */
   void run(String spreadsheetId) throws IOException {
-    final DateTime executionTime = clock.nowUtc();
+    Instant executionTime = clock.now();
     sheetSynchronizer.synchronize(
         spreadsheetId,
         new Ordering<Registrar>() {

core/src/main/java/google/registry/export/sheet/SyncRegistrarsSheetAction.java

@@ -76,7 +76,7 @@ public class SyncRegistrarsSheetAction implements Runnable {
       }};
 
     private final int statusCode;
-    protected final String message;
+    final String message;
 
     Result(int statusCode, String message) {
       this.statusCode = statusCode;
@@ -84,7 +84,7 @@ public class SyncRegistrarsSheetAction implements Runnable {
     }
 
     /** Log an error message. Results that use log levels other than info should override this. */
-    protected void log(@Nullable Exception cause) {
+    void log(@Nullable Exception cause) {
       logger.atInfo().withCause(cause).log(message);
     }
 

core/src/main/java/google/registry/flows/CheckApiAction.java

@@ -60,9 +60,9 @@ import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import jakarta.inject.Inject;
 import jakarta.servlet.http.HttpServletRequest;
+import java.time.Instant;
 import java.util.Map;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * An action that returns availability and premium checks as JSON.
@@ -130,7 +130,7 @@ public class CheckApiAction implements Runnable {
       // Throws an EppException with a reasonable error message which will be sent back to caller.
       validateDomainNameWithIdnTables(domainName);
 
-      DateTime now = replicaTm().getTransactionTime();
+      Instant now = replicaTm().getTxTime();
       Tld tld = Tld.get(domainName.parent().toString());
       try {
         verifyNotInPredelegation(tld, now);
@@ -182,7 +182,7 @@ public class CheckApiAction implements Runnable {
     }
   }
 
-  private boolean checkExists(String domainString, DateTime now) {
+  private boolean checkExists(String domainString, Instant now) {
     return ForeignKeyUtils.loadKeyByCache(Domain.class, domainString, now).isPresent();
   }
 

core/src/main/java/google/registry/flows/EppException.java

@@ -217,12 +217,13 @@ public abstract class EppException extends Exception {
   public static class UnimplementedCommandException extends EppException {
 
     public UnimplementedCommandException(InnerCommand command) {
-      super(String.format(
-          "No flow found for %s with extension %s",
-          command.getClass().getSimpleName(),
-          command instanceof ResourceCommandWrapper
-              ? ((ResourceCommandWrapper) command).getResourceCommand().getClass().getSimpleName()
-              : null));
+      super(
+          String.format(
+              "No flow found for %s with extension %s",
+              command.getClass().getSimpleName(),
+              command instanceof ResourceCommandWrapper resourceCommandWrapper
+                  ? resourceCommandWrapper.getResourceCommand().getClass().getSimpleName()
+                  : null));
     }
 
     public UnimplementedCommandException(String message) {

core/src/main/java/google/registry/flows/EppXmlSanitizer.java

@@ -23,6 +23,7 @@ import com.google.common.flogger.FluentLogger;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.UnsupportedEncodingException;
+import java.nio.charset.Charset;
 import java.nio.charset.StandardCharsets;
 import java.util.Base64;
 import java.util.Locale;
@@ -140,7 +141,7 @@ public class EppXmlSanitizer {
       }
     }
     xmlEventWriter.flush();
-    return outputXmlBytes.toString(inputEncoding);
+    return outputXmlBytes.toString(Charset.forName(inputEncoding));
   }
 
   private static String maskSensitiveData(String original) {

core/src/main/java/google/registry/flows/FlowModule.java

@@ -251,7 +251,7 @@ public class FlowModule {
           String registrarId,
           EppInput eppInput) {
     builder
-        .setModificationTime(tm().getTransactionTime())
+        .setModificationTime(tm().getTxTime())
         .setTrid(trid)
         .setXmlBytes(inputXmlBytes)
         .setBySuperuser(isSuperuser)

core/src/main/java/google/registry/flows/ResourceFlowUtils.java

@@ -16,7 +16,6 @@ package google.registry.flows;
 
 import static com.google.common.collect.Sets.intersection;
 import static google.registry.model.EppResourceUtils.isLinked;
-import static google.registry.util.DateTimeUtils.toInstant;
 
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Sets;
@@ -50,7 +49,6 @@ import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
-import org.joda.time.DateTime;
 
 /** Static utility functions for resource flows. */
 public final class ResourceFlowUtils {
@@ -66,8 +64,7 @@ public final class ResourceFlowUtils {
   }
 
   /** Check if there are domains linked to the host to be deleted. Throws an exception if so. */
-  public static void checkLinkedDomains(final String targetId, final DateTime now)
-      throws EppException {
+  public static void checkLinkedDomains(final String targetId, Instant now) throws EppException {
     VKey<Host> key =
         ForeignKeyUtils.loadKey(Host.class, targetId, now)
             .orElseThrow(() -> new ResourceDoesNotExistException(Host.class, targetId));
@@ -89,11 +86,6 @@ public final class ResourceFlowUtils {
     }
   }
 
-  public static <R extends EppResource & ForeignKeyedEppResource> R loadAndVerifyExistence(
-      Class<R> clazz, String targetId, DateTime now) throws ResourceDoesNotExistException {
-    return loadAndVerifyExistence(clazz, targetId, toInstant(now));
-  }
-
   public static <R extends EppResource & ForeignKeyedEppResource> R loadAndVerifyExistence(
       Class<R> clazz, String targetId, Instant now) throws ResourceDoesNotExistException {
     return verifyExistence(clazz, targetId, ForeignKeyUtils.loadResource(clazz, targetId, now));
@@ -105,7 +97,7 @@ public final class ResourceFlowUtils {
   }
 
   public static <R extends EppResource> void verifyResourceDoesNotExist(
-      Class<R> clazz, String targetId, DateTime now, String registrarId) throws EppException {
+      Class<R> clazz, String targetId, Instant now, String registrarId) throws EppException {
     Optional<R> resource = ForeignKeyUtils.loadResource(clazz, targetId, now);
     if (resource.isPresent()) {
       // These are similar exceptions, but we can track them internally as log-based metrics.

core/src/main/java/google/registry/flows/certs/CertificateChecker.java

@@ -16,6 +16,7 @@ package google.registry.flows.certs;
 
 import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
+import static google.registry.util.DateTimeUtils.toDateTime;
 import static java.nio.charset.StandardCharsets.UTF_8;
 
 import com.google.common.collect.ImmutableSet;
@@ -94,8 +95,8 @@ public class CertificateChecker {
   }
 
   private static int getValidityLengthInDays(X509Certificate certificate) {
-    DateTime start = DateTime.parse(certificate.getNotBefore().toInstant().toString());
-    DateTime end = DateTime.parse(certificate.getNotAfter().toInstant().toString());
+    DateTime start = toDateTime(certificate.getNotBefore().toInstant());
+    DateTime end = toDateTime(certificate.getNotAfter().toInstant());
     return Days.daysBetween(start.withTimeAtStartOfDay(), end.withTimeAtStartOfDay()).getDays();
   }
 

core/src/main/java/google/registry/flows/custom/DomainCheckFlowCustomLogic.java

@@ -25,7 +25,7 @@ import google.registry.flows.domain.DomainCheckFlow;
 import google.registry.model.eppinput.EppInput;
 import google.registry.model.eppoutput.CheckData.DomainCheck;
 import google.registry.model.eppoutput.EppResponse.ResponseExtension;
-import org.joda.time.DateTime;
+import java.time.Instant;
 
 /**
  * A no-op base class for {@link DomainCheckFlow} custom logic.
@@ -75,7 +75,7 @@ public class DomainCheckFlowCustomLogic extends BaseFlowCustomLogic {
    *     but can be overridden in v>=0.12 of the fee extension.
    */
   public record AfterValidationParameters(
-      ImmutableMap<String, InternetDomainName> domainNames, DateTime asOfDate) {
+      ImmutableMap<String, InternetDomainName> domainNames, Instant asOfDate) {
 
     public static Builder newBuilder() {
       return new AutoBuilder_DomainCheckFlowCustomLogic_AfterValidationParameters_Builder();
@@ -87,7 +87,7 @@ public class DomainCheckFlowCustomLogic extends BaseFlowCustomLogic {
 
       Builder setDomainNames(ImmutableMap<String, InternetDomainName> domainNames);
 
-      Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(Instant asOfDate);
 
       AfterValidationParameters build();
     }
@@ -102,7 +102,7 @@ public class DomainCheckFlowCustomLogic extends BaseFlowCustomLogic {
   public record BeforeResponseParameters(
       ImmutableList<DomainCheck> domainChecks,
       ImmutableList<? extends ResponseExtension> responseExtensions,
-      DateTime asOfDate) {
+      Instant asOfDate) {
 
     public static Builder newBuilder() {
       return new AutoBuilder_DomainCheckFlowCustomLogic_BeforeResponseParameters_Builder();
@@ -116,7 +116,7 @@ public class DomainCheckFlowCustomLogic extends BaseFlowCustomLogic {
 
       Builder setResponseExtensions(ImmutableList<? extends ResponseExtension> responseExtensions);
 
-      Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(Instant asOfDate);
 
       BeforeResponseParameters build();
     }

core/src/main/java/google/registry/flows/custom/DomainPricingCustomLogic.java

@@ -23,8 +23,8 @@ import google.registry.flows.domain.DomainPricingLogic;
 import google.registry.flows.domain.FeesAndCredits;
 import google.registry.model.eppinput.EppInput;
 import google.registry.model.tld.Tld;
+import java.time.Instant;
 import javax.annotation.Nullable;
-import org.joda.time.DateTime;
 
 /**
  * A no-op base class to customize {@link DomainPricingLogic}.
@@ -79,7 +79,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
       FeesAndCredits feesAndCredits,
       Tld tld,
       InternetDomainName domainName,
-      DateTime asOfDate,
+      Instant asOfDate,
       int years) {
 
     public static Builder newBuilder() {
@@ -96,7 +96,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
       Builder setDomainName(InternetDomainName domainName);
 
-      Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(Instant asOfDate);
 
       Builder setYears(int years);
 
@@ -109,7 +109,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
       FeesAndCredits feesAndCredits,
       Tld tld,
       InternetDomainName domainName,
-      DateTime asOfDate,
+      Instant asOfDate,
       int years) {
 
     public static Builder newBuilder() {
@@ -126,7 +126,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
       Builder setDomainName(InternetDomainName domainName);
 
-      Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(Instant asOfDate);
 
       Builder setYears(int years);
 
@@ -136,7 +136,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
   /** A record to encapsulate parameters for a call to {@link #customizeRestorePrice} . */
   public record RestorePriceParameters(
-      FeesAndCredits feesAndCredits, Tld tld, InternetDomainName domainName, DateTime asOfDate) {
+      FeesAndCredits feesAndCredits, Tld tld, InternetDomainName domainName, Instant asOfDate) {
 
     public static Builder newBuilder() {
       return new AutoBuilder_DomainPricingCustomLogic_RestorePriceParameters_Builder();
@@ -152,7 +152,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
       Builder setDomainName(InternetDomainName domainName);
 
-      Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(Instant asOfDate);
 
       RestorePriceParameters build();
     }
@@ -160,7 +160,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
   /** A record to encapsulate parameters for a call to {@link #customizeTransferPrice} . */
   public record TransferPriceParameters(
-      FeesAndCredits feesAndCredits, Tld tld, InternetDomainName domainName, DateTime asOfDate) {
+      FeesAndCredits feesAndCredits, Tld tld, InternetDomainName domainName, Instant asOfDate) {
 
     public static Builder newBuilder() {
       return new AutoBuilder_DomainPricingCustomLogic_TransferPriceParameters_Builder();
@@ -176,7 +176,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
       Builder setDomainName(InternetDomainName domainName);
 
-      Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(Instant asOfDate);
 
       TransferPriceParameters build();
     }
@@ -184,7 +184,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
   /** A record to encapsulate parameters for a call to {@link #customizeUpdatePrice} . */
   public record UpdatePriceParameters(
-      FeesAndCredits feesAndCredits, Tld tld, InternetDomainName domainName, DateTime asOfDate) {
+      FeesAndCredits feesAndCredits, Tld tld, InternetDomainName domainName, Instant asOfDate) {
 
     public static Builder newBuilder() {
       return new AutoBuilder_DomainPricingCustomLogic_UpdatePriceParameters_Builder();
@@ -200,7 +200,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
       Builder setDomainName(InternetDomainName domainName);
 
-      Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(Instant asOfDate);
 
       UpdatePriceParameters build();
     }

core/src/main/java/google/registry/flows/custom/DomainRenewFlowCustomLogic.java

@@ -25,7 +25,7 @@ import google.registry.model.eppinput.EppInput;
 import google.registry.model.eppoutput.EppResponse.ResponseData;
 import google.registry.model.eppoutput.EppResponse.ResponseExtension;
 import google.registry.model.reporting.HistoryEntry;
-import org.joda.time.DateTime;
+import java.time.Instant;
 
 /**
  * A no-op base class for {@link DomainRenewFlow} custom logic.
@@ -80,7 +80,7 @@ public class DomainRenewFlowCustomLogic extends BaseFlowCustomLogic {
   }
 
   /** A class to encapsulate parameters for a call to {@link #afterValidation}. */
-  public record AfterValidationParameters(Domain existingDomain, int years, DateTime now) {
+  public record AfterValidationParameters(Domain existingDomain, int years, Instant now) {
 
     public static Builder newBuilder() {
       return new AutoBuilder_DomainRenewFlowCustomLogic_AfterValidationParameters_Builder();
@@ -94,7 +94,7 @@ public class DomainRenewFlowCustomLogic extends BaseFlowCustomLogic {
 
       Builder setYears(int years);
 
-      Builder setNow(DateTime now);
+      Builder setNow(Instant now);
 
       AfterValidationParameters build();
     }
@@ -113,7 +113,7 @@ public class DomainRenewFlowCustomLogic extends BaseFlowCustomLogic {
       HistoryEntry historyEntry,
       EntityChanges entityChanges,
       int years,
-      DateTime now) {
+      Instant now) {
 
     public static Builder newBuilder() {
       return new AutoBuilder_DomainRenewFlowCustomLogic_BeforeSaveParameters_Builder();
@@ -133,7 +133,7 @@ public class DomainRenewFlowCustomLogic extends BaseFlowCustomLogic {
 
       Builder setYears(int years);
 
-      Builder setNow(DateTime now);
+      Builder setNow(Instant now);
 
       BeforeSaveParameters build();
     }

core/src/main/java/google/registry/flows/domain/DomainCheckFlow.java

@@ -82,6 +82,7 @@ import google.registry.model.tld.label.ReservationType;
 import google.registry.persistence.VKey;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Collection;
 import java.util.HashSet;
 import java.util.Map;
@@ -89,7 +90,6 @@ import java.util.Optional;
 import java.util.Set;
 import java.util.stream.Collectors;
 import org.joda.money.CurrencyUnit;
-import org.joda.time.DateTime;
 
 /**
  * An EPP flow that checks whether a domain can be provisioned.
@@ -156,7 +156,7 @@ public final class DomainCheckFlow implements TransactionalFlow {
     extensionManager.validate();
     ImmutableList<String> domainNames = ((Check) resourceCommand).getTargetIds();
     verifyTargetIdCount(domainNames, maxChecks);
-    DateTime now = clock.nowUtc();
+    Instant now = clock.now();
     ImmutableMap.Builder<String, InternetDomainName> parsedDomainsBuilder =
         new ImmutableMap.Builder<>();
     // Only check that the registrar has access to a TLD the first time it is encountered
@@ -225,7 +225,7 @@ public final class DomainCheckFlow implements TransactionalFlow {
       ImmutableSet<InternetDomainName> bsaBlockedDomainNames,
       ImmutableMap<String, TldState> tldStates,
       ImmutableMap<String, InternetDomainName> parsedDomains,
-      DateTime now)
+      Instant now)
       throws EppException {
     InternetDomainName idn = parsedDomains.get(domainName);
     Optional<AllocationToken> token;
@@ -286,7 +286,7 @@ public final class DomainCheckFlow implements TransactionalFlow {
       ImmutableMap<String, InternetDomainName> domainNames,
       ImmutableMap<String, VKey<Domain>> existingDomains,
       ImmutableSet<String> availableDomains,
-      DateTime now)
+      Instant now)
       throws EppException {
     Optional<FeeCheckCommandExtension> feeCheckOpt =
         eppInput.getSingleExtension(FeeCheckCommandExtension.class);
@@ -480,7 +480,7 @@ public final class DomainCheckFlow implements TransactionalFlow {
   }
 
   static ImmutableSet<InternetDomainName> getBsaBlockedDomains(
-      ImmutableCollection<InternetDomainName> parsedDomains, DateTime now) {
+      ImmutableCollection<InternetDomainName> parsedDomains, Instant now) {
     Map<String, ImmutableList<InternetDomainName>> labelToDomainNames =
         parsedDomains.stream()
             .filter(

core/src/main/java/google/registry/flows/domain/DomainClaimsCheckFlow.java

@@ -49,10 +49,10 @@ import google.registry.model.tld.Tld;
 import google.registry.model.tmch.ClaimsListDao;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.HashSet;
 import java.util.Optional;
 import java.util.Set;
-import org.joda.time.DateTime;
 
 /**
  * An EPP flow that checks whether domain labels are trademarked.
@@ -103,7 +103,7 @@ public final class DomainClaimsCheckFlow implements TransactionalFlow {
           checkAllowedAccessToTld(registrarId, tldStr);
           checkHasBillingAccount(registrarId, tldStr);
           Tld tld = Tld.get(tldStr);
-          DateTime now = clock.nowUtc();
+          Instant now = clock.now();
           verifyNotInPredelegation(tld, now);
           verifyClaimsPeriodNotEnded(tld, now);
         }

core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java

@@ -51,8 +51,9 @@ import static google.registry.model.tld.Tld.TldState.QUIET_PERIOD;
 import static google.registry.model.tld.Tld.TldState.START_DATE_SUNRISE;
 import static google.registry.model.tld.label.ReservationType.NAME_COLLISION;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.util.DateTimeUtils.END_OF_TIME;
-import static google.registry.util.DateTimeUtils.leapSafeAddYears;
+import static google.registry.util.DateTimeUtils.END_INSTANT;
+import static google.registry.util.DateTimeUtils.plusYears;
+import static google.registry.util.DateTimeUtils.toInstant;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
@@ -120,6 +121,7 @@ import google.registry.model.tmch.ClaimsList;
 import google.registry.model.tmch.ClaimsListDao;
 import google.registry.tmch.LordnTaskUtils.LordnPhase;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Optional;
 import org.joda.time.DateTime;
 import org.joda.time.Duration;
@@ -235,7 +237,7 @@ public final class DomainCreateFlow implements MutatingFlow {
     verifyRegistrarIsActive(registrarId);
     extensionManager.validate();
     verifyDomainDoesNotExist();
-    DateTime now = tm().getTransactionTime();
+    Instant now = tm().getTxTime();
     DomainCommand.Create command = cloneAndLinkReferences((Create) resourceCommand, now);
     Period period = command.getPeriod();
     verifyUnitIsYears(period);
@@ -331,7 +333,7 @@ public final class DomainCreateFlow implements MutatingFlow {
     validateFeeChallenge(feeCreate, feesAndCredits, defaultTokenUsed);
     Optional<SecDnsCreateExtension> secDnsCreate =
         validateSecDnsExtension(eppInput.getSingleExtension(SecDnsCreateExtension.class));
-    DateTime registrationExpirationTime = leapSafeAddYears(now, years);
+    Instant registrationExpirationTime = plusYears(now, years);
     String repoId = createDomainRepoId(tm().allocateId(), tld.getTldStr());
     long historyRevisionId = tm().allocateId();
     HistoryEntryId domainHistoryId = new HistoryEntryId(repoId, historyRevisionId);
@@ -492,7 +494,7 @@ public final class DomainCreateFlow implements MutatingFlow {
   private void verifyIsGaOrSpecialCase(
       Tld tld,
       ClaimsList claimsList,
-      DateTime now,
+      Instant now,
       String domainLabel,
       Optional<AllocationToken> allocationToken,
       boolean isAnchorTenant,
@@ -556,14 +558,14 @@ public final class DomainCreateFlow implements MutatingFlow {
   }
 
   private DomainHistory buildDomainHistory(
-      Domain domain, Tld tld, DateTime now, Period period, Duration addGracePeriod) {
+      Domain domain, Tld tld, Instant now, Period period, Duration addGracePeriod) {
     // We ignore prober transactions
     if (tld.getTldType() == TldType.REAL) {
       historyBuilder.setDomainTransactionRecords(
           ImmutableSet.of(
               DomainTransactionRecord.create(
                   tld.getTldStr(),
-                  now.plus(addGracePeriod),
+                  now.plusMillis(addGracePeriod.getMillis()),
                   TransactionReportField.netAddsFieldFromYears(period.getValue()),
                   1)));
     }
@@ -579,7 +581,7 @@ public final class DomainCreateFlow implements MutatingFlow {
       FeesAndCredits feesAndCredits,
       HistoryEntryId domainHistoryId,
       Optional<AllocationToken> allocationToken,
-      DateTime now) {
+      Instant now) {
     ImmutableSet.Builder<Flag> flagsBuilder = new ImmutableSet.Builder<>();
     // Sunrise and anchor tenancy are orthogonal tags and thus both can be present together.
     if (isSunriseCreate) {
@@ -601,10 +603,11 @@ public final class DomainCreateFlow implements MutatingFlow {
         .setEventTime(now)
         .setAllocationToken(allocationToken.map(AllocationToken::createVKey).orElse(null))
         .setBillingTime(
-            now.plus(
-                isAnchorTenant
-                    ? tld.getAnchorTenantAddGracePeriodLength()
-                    : tld.getAddGracePeriodLength()))
+            now.plusMillis(
+                (isAnchorTenant
+                        ? tld.getAnchorTenantAddGracePeriodLength()
+                        : tld.getAddGracePeriodLength())
+                    .getMillis()))
         .setFlags(flagsBuilder.build())
         .setDomainHistoryId(domainHistoryId)
         .build();
@@ -612,7 +615,7 @@ public final class DomainCreateFlow implements MutatingFlow {
 
   private BillingRecurrence createAutorenewBillingEvent(
       HistoryEntryId domainHistoryId,
-      DateTime registrationExpirationTime,
+      Instant registrationExpirationTime,
       boolean isAnchorTenant,
       Optional<AllocationToken> allocationToken) {
     // Non-standard renewal behaviors can occur for anchor tenants (always NONPREMIUM pricing) or if
@@ -630,7 +633,7 @@ public final class DomainCreateFlow implements MutatingFlow {
         .setTargetId(targetId)
         .setRegistrarId(registrarId)
         .setEventTime(registrationExpirationTime)
-        .setRecurrenceEndTime(END_OF_TIME)
+        .setRecurrenceEndTime(END_INSTANT)
         .setDomainHistoryId(domainHistoryId)
         .setRenewalPriceBehavior(renewalPriceBehavior)
         .setRenewalPrice(allocationToken.flatMap(AllocationToken::getRenewalPrice).orElse(null))
@@ -638,7 +641,7 @@ public final class DomainCreateFlow implements MutatingFlow {
   }
 
   private Autorenew createAutorenewPollMessage(
-      HistoryEntryId domainHistoryId, DateTime registrationExpirationTime) {
+      HistoryEntryId domainHistoryId, Instant registrationExpirationTime) {
     return new PollMessage.Autorenew.Builder()
         .setTargetId(targetId)
         .setRegistrarId(registrarId)
@@ -652,7 +655,7 @@ public final class DomainCreateFlow implements MutatingFlow {
     Optional<DateTime> previousDeletionTime =
         domainDeletionTimeCache.getDeletionTimeForDomain(targetId);
     if (previousDeletionTime.isPresent()
-        && !tm().getTransactionTime().isAfter(previousDeletionTime.get())) {
+        && !tm().getTxTime().isAfter(toInstant(previousDeletionTime.get()))) {
       throw new ResourceCreateContentionException(targetId);
     }
   }
@@ -673,7 +676,7 @@ public final class DomainCreateFlow implements MutatingFlow {
   }
 
   private static PollMessage.OneTime createNameCollisionOneTimePollMessage(
-      String domainName, HistoryEntry historyEntry, String registrarId, DateTime now) {
+      String domainName, HistoryEntry historyEntry, String registrarId, Instant now) {
     return new PollMessage.OneTime.Builder()
         .setRegistrarId(registrarId)
         .setEventTime(now)

core/src/main/java/google/registry/flows/domain/DomainDeleteFlow.java

@@ -40,6 +40,8 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import static google.registry.pricing.PricingEngineProxy.getDomainRenewCost;
 import static google.registry.util.CollectionUtils.nullToEmpty;
 import static google.registry.util.CollectionUtils.union;
+import static google.registry.util.DateTimeUtils.toDateTime;
+import static google.registry.util.DateTimeUtils.toInstant;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
@@ -98,6 +100,8 @@ import google.registry.model.tld.Tld;
 import google.registry.model.tld.Tld.TldType;
 import google.registry.model.transfer.TransferStatus;
 import jakarta.inject.Inject;
+import java.time.Instant;
+import java.time.ZoneOffset;
 import java.util.Collections;
 import java.util.Optional;
 import java.util.Set;
@@ -145,7 +149,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
     flowCustomLogic.beforeValidation();
     validateRegistrarIsLoggedIn(registrarId);
     extensionManager.validate();
-    DateTime now = tm().getTransactionTime();
+    Instant now = tm().getTxTime();
     // Loads the target resource if it exists
     Domain existingDomain = loadAndVerifyExistence(Domain.class, targetId, now);
     Tld tld = Tld.get(existingDomain.getTld());
@@ -184,13 +188,15 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
             : redemptionGracePeriodLength.plus(pendingDeleteLength);
     HistoryEntryId domainHistoryId = createHistoryEntryId(existingDomain);
     historyBuilder.setRevisionId(domainHistoryId.getRevisionId());
-    DateTime deletionTime = now.plus(durationUntilDelete);
+    Instant deletionTime = now.plusMillis(durationUntilDelete.getMillis());
     if (durationUntilDelete.equals(Duration.ZERO)) {
       builder.setDeletionTime(now).setStatusValues(null);
     } else {
-      DateTime redemptionTime = now.plus(redemptionGracePeriodLength);
+      Instant redemptionTime = now.plusMillis(redemptionGracePeriodLength.getMillis());
       asyncTaskEnqueuer.enqueueAsyncResave(
-          existingDomain.createVKey(), now, ImmutableSortedSet.of(redemptionTime, deletionTime));
+          existingDomain.createVKey(),
+          toDateTime(now),
+          ImmutableSortedSet.of(toDateTime(redemptionTime), toDateTime(deletionTime)));
       builder
           .setDeletionTime(deletionTime)
           .setStatusValues(ImmutableSet.of(StatusValue.PENDING_DELETE))
@@ -236,7 +242,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
     }
 
     // Cancel any grace periods that were still active, and set the expiration time accordingly.
-    DateTime newExpirationTime = existingDomain.getRegistrationExpirationDateTime();
+    Instant newExpirationTime = existingDomain.getRegistrationExpirationTime();
     for (GracePeriod gracePeriod : existingDomain.getGracePeriods()) {
       // No cancellation is written if the grace period was not for a billable event.
       if (gracePeriod.hasBillingEvent()) {
@@ -246,11 +252,15 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
           // Take the amount of registration time being refunded off the expiration time.
           // This can be either add grace periods or renew grace periods.
           BillingEvent billingEvent = tm().loadByKey(gracePeriod.getBillingEvent());
-          newExpirationTime = newExpirationTime.minusYears(billingEvent.getPeriodYears());
+          newExpirationTime =
+              newExpirationTime
+                  .atZone(ZoneOffset.UTC)
+                  .minusYears(billingEvent.getPeriodYears())
+                  .toInstant();
         } else if (gracePeriod.getBillingRecurrence() != null) {
           // Take 1 year off the registration if in the autorenew grace period (no need to load the
           // recurrence billing event; all autorenews are for 1 year).
-          newExpirationTime = newExpirationTime.minusYears(1);
+          newExpirationTime = newExpirationTime.atZone(ZoneOffset.UTC).minusYears(1).toInstant();
         }
       }
     }
@@ -289,7 +299,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
         flowCustomLogic.beforeResponse(
             BeforeResponseParameters.newBuilder()
                 .setResultCode(
-                    newDomain.getDeletionDateTime().isAfter(now)
+                    newDomain.getDeletionTime().isAfter(now)
                         ? SUCCESS_WITH_ACTION_PENDING
                         : SUCCESS)
                 .setResponseExtensions(
@@ -302,7 +312,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
         .build();
   }
 
-  private void verifyDeleteAllowed(Domain existingDomain, Tld tld, DateTime now)
+  private void verifyDeleteAllowed(Domain existingDomain, Tld tld, Instant now)
       throws EppException {
     verifyOptionalAuthInfo(authInfo, existingDomain);
     verifyNoDisallowedStatuses(existingDomain, ImmutableSet.of(StatusValue.PENDING_DELETE));
@@ -318,11 +328,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
   }
 
   private DomainHistory buildDomainHistory(
-      Domain domain,
-      Tld tld,
-      DateTime now,
-      Duration durationUntilDelete,
-      boolean inAddGracePeriod) {
+      Domain domain, Tld tld, Instant now, Duration durationUntilDelete, boolean inAddGracePeriod) {
     // We ignore prober transactions
     if (tld.getTldType() == TldType.REAL) {
       Duration maxGracePeriod =
@@ -342,7 +348,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
               cancelledRecords,
               DomainTransactionRecord.create(
                   domain.getTld(),
-                  now.plus(durationUntilDelete),
+                  now.plusMillis(durationUntilDelete.getMillis()),
                   inAddGracePeriod
                       ? TransactionReportField.DELETED_DOMAINS_GRACE
                       : TransactionReportField.DELETED_DOMAINS_NOGRACE,
@@ -352,7 +358,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
   }
 
   private PollMessage.OneTime createDeletePollMessage(
-      Domain existingDomain, HistoryEntryId domainHistoryId, DateTime deletionTime) {
+      Domain existingDomain, HistoryEntryId domainHistoryId, Instant deletionTime) {
     Optional<MetadataExtension> metadataExtension =
         eppInput.getSingleExtension(MetadataExtension.class);
     boolean hasMetadataMessage =
@@ -376,7 +382,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
   }
 
   private PollMessage.OneTime createImmediateDeletePollMessage(
-      Domain existingDomain, HistoryEntryId domainHistoryId, DateTime now, DateTime deletionTime) {
+      Domain existingDomain, HistoryEntryId domainHistoryId, Instant now, Instant deletionTime) {
     return new PollMessage.OneTime.Builder()
         .setRegistrarId(existingDomain.getPersistedCurrentSponsorRegistrarId())
         .setEventTime(now)
@@ -394,7 +400,7 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
 
   @Nullable
   private ImmutableList<FeeTransformResponseExtension> getResponseExtensions(
-      BillingRecurrence billingRecurrence, Domain existingDomain, DateTime now) {
+      BillingRecurrence billingRecurrence, Domain existingDomain, Instant now) {
     FeeTransformResponseExtension.Builder feeResponseBuilder = getDeleteResponseBuilder();
     if (feeResponseBuilder == null) {
       return ImmutableList.of();
@@ -416,12 +422,12 @@ public final class DomainDeleteFlow implements MutatingFlow, SqlStatementLogging
   }
 
   private Money getGracePeriodCost(
-      BillingRecurrence billingRecurrence, GracePeriod gracePeriod, DateTime now) {
+      BillingRecurrence billingRecurrence, GracePeriod gracePeriod, Instant now) {
     if (gracePeriod.getType() == GracePeriodStatus.AUTO_RENEW) {
       // If we updated the autorenew billing event, reuse it.
       DateTime autoRenewTime =
-          billingRecurrence.getRecurrenceTimeOfYear().getLastInstanceBeforeOrAt(now);
-      return getDomainRenewCost(targetId, autoRenewTime, 1);
+          toDateTime(billingRecurrence.getRecurrenceTimeOfYear().getLastInstanceBeforeOrAt(now));
+      return getDomainRenewCost(targetId, toInstant(autoRenewTime), 1);
     }
     return tm().loadByKey(checkNotNull(gracePeriod.getBillingEvent())).getCost();
   }

core/src/main/java/google/registry/flows/domain/DomainDeletionTimeCache.java

@@ -104,7 +104,7 @@ public class DomainDeletionTimeCache {
             ForeignKeyUtils.loadMostRecentResources(
                     Domain.class, ImmutableSet.of(domainName), false)
                 .get(domainName);
-        return mostRecentResource == null ? null : mostRecentResource.deletionTime();
+        return mostRecentResource == null ? null : mostRecentResource.getDeletionTime();
       };
 
   // Unfortunately, maintenance tasks aren't necessarily already in a transaction

core/src/main/java/google/registry/flows/domain/DomainFlowTmchUtils.java

@@ -38,10 +38,10 @@ import java.security.SignatureException;
 import java.security.cert.CertificateExpiredException;
 import java.security.cert.CertificateNotYetValidException;
 import java.security.cert.CertificateRevokedException;
+import java.time.Instant;
 import javax.xml.crypto.MarshalException;
 import javax.xml.crypto.dsig.XMLSignatureException;
 import javax.xml.parsers.ParserConfigurationException;
-import org.joda.time.DateTime;
 import org.xml.sax.SAXException;
 
 /** TMCH utility functions for domain flows. */
@@ -55,15 +55,15 @@ public final class DomainFlowTmchUtils {
   }
 
   public SignedMark verifySignedMarks(
-      ImmutableList<AbstractSignedMark> signedMarks, String domainLabel, DateTime now)
+      ImmutableList<AbstractSignedMark> signedMarks, String domainLabel, Instant now)
       throws EppException {
     if (signedMarks.size() > 1) {
       throw new TooManySignedMarksException();
     }
-    if (!(signedMarks.get(0) instanceof EncodedSignedMark)) {
+    if (!(signedMarks.get(0) instanceof EncodedSignedMark encodedSignedMark)) {
       throw new SignedMarksMustBeEncodedException();
     }
-    SignedMark signedMark = verifyEncodedSignedMark((EncodedSignedMark) signedMarks.get(0), now);
+    SignedMark signedMark = verifyEncodedSignedMark(encodedSignedMark, now);
     return verifySignedMarkValidForDomainLabel(signedMark, domainLabel);
   }
 
@@ -75,7 +75,7 @@ public final class DomainFlowTmchUtils {
     return signedMark;
   }
 
-  public SignedMark verifyEncodedSignedMark(EncodedSignedMark encodedSignedMark, DateTime now)
+  public SignedMark verifyEncodedSignedMark(EncodedSignedMark encodedSignedMark, Instant now)
       throws EppException {
     if (!encodedSignedMark.getEncoding().equals("base64")) {
       throw new Base64RequiredForEncodedSignedMarksException();

core/src/main/java/google/registry/flows/domain/DomainFlowUtils.java

@@ -40,9 +40,9 @@ import static google.registry.model.tld.label.ReservationType.RESERVED_FOR_SPECI
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.pricing.PricingEngineProxy.isDomainPremium;
 import static google.registry.util.CollectionUtils.nullToEmpty;
-import static google.registry.util.DateTimeUtils.END_OF_TIME;
+import static google.registry.util.DateTimeUtils.END_INSTANT;
 import static google.registry.util.DateTimeUtils.isAtOrAfter;
-import static google.registry.util.DateTimeUtils.leapSafeAddYears;
+import static google.registry.util.DateTimeUtils.minusDays;
 import static google.registry.util.DomainNameUtils.ACE_PREFIX;
 import static java.util.stream.Collectors.joining;
 
@@ -123,6 +123,8 @@ import google.registry.tldconfig.idn.IdnLabelValidator;
 import google.registry.tools.DigestType;
 import google.registry.util.Idn;
 import java.math.BigDecimal;
+import java.time.Instant;
+import java.time.ZoneOffset;
 import java.util.Comparator;
 import java.util.List;
 import java.util.Map.Entry;
@@ -131,7 +133,6 @@ import java.util.Set;
 import javax.annotation.Nullable;
 import org.joda.money.CurrencyUnit;
 import org.joda.money.Money;
-import org.joda.time.DateTime;
 import org.joda.time.Duration;
 import org.xbill.DNS.DNSSEC.Algorithm;
 
@@ -251,7 +252,7 @@ public class DomainFlowUtils {
   public static void verifyNotBlockedByBsa(
       InternetDomainName domainName,
       Tld tld,
-      DateTime now,
+      Instant now,
       Optional<AllocationToken> allocationToken)
       throws DomainLabelBlockedByBsaException {
     if (!isRegisterBsaCreate(domainName, allocationToken)
@@ -260,7 +261,7 @@ public class DomainFlowUtils {
     }
   }
 
-  public static boolean isBlockedByBsa(String domainLabel, Tld tld, DateTime now) {
+  public static boolean isBlockedByBsa(String domainLabel, Tld tld, Instant now) {
     return isEnrolledWithBsa(tld, now) && isLabelBlocked(domainLabel);
   }
 
@@ -456,7 +457,7 @@ public class DomainFlowUtils {
 
   /** Verifies that a launch extension's specified phase matches the specified tld's phase. */
   static void verifyLaunchPhaseMatchesRegistryPhase(
-      Tld tld, LaunchExtension launchExtension, DateTime now) throws EppException {
+      Tld tld, LaunchExtension launchExtension, Instant now) throws EppException {
     if (!LAUNCH_PHASE_TO_TLD_STATES.containsKey(launchExtension.getPhase())
         || !LAUNCH_PHASE_TO_TLD_STATES
             .get(launchExtension.getPhase())
@@ -472,7 +473,7 @@ public class DomainFlowUtils {
    * this registrar.
    */
   static void verifyPremiumNameIsNotBlocked(
-      String domainName, DateTime priceTime, String registrarId) throws EppException {
+      String domainName, Instant priceTime, String registrarId) throws EppException {
     if (isDomainPremium(domainName, priceTime)) {
       if (Registrar.loadByRegistrarIdCached(registrarId).get().getBlockPremiumNames()) {
         throw new PremiumNameBlockedException();
@@ -484,7 +485,7 @@ public class DomainFlowUtils {
    * Helper to call {@link CreateOrUpdate#cloneAndLinkReferences} and convert exceptions to
    * EppExceptions, since this is needed in several places.
    */
-  static <T extends CreateOrUpdate<T>> T cloneAndLinkReferences(T command, DateTime now)
+  static <T extends CreateOrUpdate<T>> T cloneAndLinkReferences(T command, Instant now)
       throws EppException {
     try {
       return command.cloneAndLinkReferences(now);
@@ -503,7 +504,7 @@ public class DomainFlowUtils {
         .setFlags(ImmutableSet.of(Flag.AUTO_RENEW))
         .setTargetId(domain.getDomainName())
         .setRegistrarId(domain.getCurrentSponsorRegistrarId())
-        .setEventTime(domain.getRegistrationExpirationDateTime());
+        .setEventTime(domain.getRegistrationExpirationTime());
   }
 
   /**
@@ -514,7 +515,7 @@ public class DomainFlowUtils {
     return new Autorenew.Builder()
         .setTargetId(domain.getDomainName())
         .setRegistrarId(domain.getCurrentSponsorRegistrarId())
-        .setEventTime(domain.getRegistrationExpirationDateTime())
+        .setEventTime(domain.getRegistrationExpirationTime())
         .setMsg("Domain was auto-renewed.");
   }
 
@@ -530,7 +531,7 @@ public class DomainFlowUtils {
   public static BillingRecurrence updateAutorenewRecurrenceEndTime(
       Domain domain,
       BillingRecurrence existingBillingRecurrence,
-      DateTime newEndTime,
+      Instant newEndTime,
       @Nullable HistoryEntryId historyId) {
     Optional<Autorenew> autorenewPollMessage =
         tm().loadByKeyIfPresent(domain.getAutorenewPollMessage());
@@ -580,13 +581,13 @@ public class DomainFlowUtils {
       InternetDomainName domainName,
       Optional<Domain> domain,
       @Nullable CurrencyUnit topLevelCurrency,
-      DateTime currentDate,
+      Instant currentDate,
       DomainPricingLogic pricingLogic,
       Optional<AllocationToken> allocationToken,
       boolean isAvailable,
       @Nullable BillingRecurrence billingRecurrence)
       throws EppException {
-    DateTime now = currentDate;
+    Instant now = currentDate;
     // Use the custom effective date specified in the fee check request, if there is one.
     if (feeRequest.getEffectiveDate().isPresent()) {
       now = feeRequest.getEffectiveDate().get();
@@ -658,7 +659,7 @@ public class DomainFlowUtils {
         // process, don't count as expired for the purposes of requiring an added year of renewal on
         // restore because they can't be restored in the first place.
         boolean isExpired =
-            domain.isPresent() && domain.get().getRegistrationExpirationDateTime().isBefore(now);
+            domain.isPresent() && domain.get().getRegistrationExpirationTime().isBefore(now);
         fees = pricingLogic.getRestorePrice(tld, domainNameString, now, isExpired).getFees();
       }
       case TRANSFER -> {
@@ -699,16 +700,16 @@ public class DomainFlowUtils {
     // Set the fees, and based on the validDateRange of the fees, set the notAfterDate.
     if (!fees.isEmpty()) {
       builder.setFees(fees);
-      DateTime notAfterDate = null;
+      Instant notAfterDate = null;
       for (Fee fee : fees) {
         if (fee.hasValidDateRange()) {
-          DateTime endDate = fee.getValidDateRange().upperEndpoint();
+          Instant endDate = fee.getValidDateRange().upperEndpoint();
           if (notAfterDate == null || notAfterDate.isAfter(endDate)) {
             notAfterDate = endDate;
           }
         }
       }
-      if (notAfterDate != null && !notAfterDate.equals(END_OF_TIME)) {
+      if (notAfterDate != null && !notAfterDate.equals(END_INSTANT)) {
         builder.setNotAfterDateIfSupported(notAfterDate);
       }
     }
@@ -845,9 +846,12 @@ public class DomainFlowUtils {
    *
    * @throws ExceedsMaxRegistrationYearsException if the new registration period is too long
    */
-  public static void validateRegistrationPeriod(DateTime now, DateTime newExpirationTime)
+  public static void validateRegistrationPeriod(Instant now, Instant newExpirationTime)
       throws EppException {
-    if (leapSafeAddYears(now, MAX_REGISTRATION_YEARS).isBefore(newExpirationTime)) {
+    if (now.atZone(ZoneOffset.UTC)
+        .plusYears(MAX_REGISTRATION_YEARS)
+        .toInstant()
+        .isBefore(newExpirationTime)) {
       throw new ExceedsMaxRegistrationYearsException();
     }
   }
@@ -933,7 +937,7 @@ public class DomainFlowUtils {
   }
 
   /** Check that the registry phase is not predelegation, during which some flows are forbidden. */
-  public static void verifyNotInPredelegation(Tld registry, DateTime now)
+  public static void verifyNotInPredelegation(Tld registry, Instant now)
       throws BadCommandForRegistryPhaseException {
     if (registry.getTldState(now) == PREDELEGATION) {
       throw new BadCommandForRegistryPhaseException();
@@ -968,7 +972,7 @@ public class DomainFlowUtils {
 
   /** Validate the notice from a launch create extension, allowing null as a valid notice. */
   static void validateLaunchCreateNotice(
-      @Nullable LaunchNotice notice, String domainLabel, boolean isSuperuser, DateTime now)
+      @Nullable LaunchNotice notice, String domainLabel, boolean isSuperuser, Instant now)
       throws EppException {
     if (notice == null) {
       return;
@@ -982,7 +986,7 @@ public class DomainFlowUtils {
         throw new ExpiredClaimException();
       }
       // An acceptance within the past 48 hours is mandated by the TMCH Functional Spec.
-      if (notice.getAcceptedTime().isBefore(now.minusHours(48))) {
+      if (notice.getAcceptedTime().isBefore(minusDays(now, 2))) {
         throw new AcceptedTooLongAgoException();
       }
     }
@@ -996,8 +1000,8 @@ public class DomainFlowUtils {
   }
 
   /** Check that the claims period hasn't ended. */
-  static void verifyClaimsPeriodNotEnded(Tld tld, DateTime now) throws ClaimsPeriodEndedException {
-    if (isAtOrAfter(now, tld.getClaimsPeriodEnd())) {
+  static void verifyClaimsPeriodNotEnded(Tld tld, Instant now) throws ClaimsPeriodEndedException {
+    if (!now.isBefore(tld.getClaimsPeriodEnd())) {
       throw new ClaimsPeriodEndedException(tld.getTldStr());
     }
   }
@@ -1064,7 +1068,7 @@ public class DomainFlowUtils {
    */
   public static ImmutableSet<DomainTransactionRecord> createCancelingRecords(
       Domain domain,
-      final DateTime now,
+      Instant now,
       Duration maxSearchPeriod,
       final ImmutableSet<TransactionReportField> cancelableFields) {
 
@@ -1108,12 +1112,12 @@ public class DomainFlowUtils {
   }
 
   private static List<DomainHistory> findRecentHistoryEntries(
-      Domain domain, DateTime now, Duration maxSearchPeriod) {
+      Domain domain, Instant now, Duration maxSearchPeriod) {
     return tm().query(
             "FROM DomainHistory WHERE modificationTime >= :beginning AND repoId = "
                 + ":repoId ORDER BY modificationTime ASC",
             DomainHistory.class)
-        .setParameter("beginning", now.minus(maxSearchPeriod))
+        .setParameter("beginning", now.minusMillis(maxSearchPeriod.getMillis()))
         .setParameter("repoId", domain.getRepoId())
         .getResultList();
   }

core/src/main/java/google/registry/flows/domain/DomainInfoFlow.java

@@ -56,8 +56,8 @@ import google.registry.persistence.IsolationLevel;
 import google.registry.persistence.PersistenceModule;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * An EPP flow that returns information about a domain.
@@ -105,7 +105,7 @@ public final class DomainInfoFlow implements MutatingFlow {
     flowCustomLogic.beforeValidation();
     validateRegistrarIsLoggedIn(registrarId);
     extensionManager.validate();
-    DateTime now = clock.nowUtc();
+    Instant now = clock.now();
     Domain domain = loadAndVerifyExistence(Domain.class, targetId, now);
     verifyOptionalAuthInfo(authInfo, domain);
     flowCustomLogic.afterValidation(
@@ -122,8 +122,8 @@ public final class DomainInfoFlow implements MutatingFlow {
             .setNameservers(
                 hostsRequest.requestDelegated() ? domain.loadNameserverHostNames() : null)
             .setCreationTime(domain.getCreationTime())
-            .setLastEppUpdateTime(domain.getLastEppUpdateDateTime())
-            .setRegistrationExpirationTime(domain.getRegistrationExpirationDateTime())
+            .setLastEppUpdateTime(domain.getLastEppUpdateTime())
+            .setRegistrationExpirationTime(domain.getRegistrationExpirationTime())
             .setLastTransferTime(domain.getLastTransferTime());
 
     // If authInfo is non-null, then the caller is authorized to see the full information since we
@@ -149,7 +149,7 @@ public final class DomainInfoFlow implements MutatingFlow {
         .build();
   }
 
-  private ImmutableList<ResponseExtension> getDomainResponseExtensions(Domain domain, DateTime now)
+  private ImmutableList<ResponseExtension> getDomainResponseExtensions(Domain domain, Instant now)
       throws EppException {
     ImmutableList.Builder<ResponseExtension> extensions = new ImmutableList.Builder<>();
     addSecDnsExtensionIfPresent(extensions, domain.getDsData());

core/src/main/java/google/registry/flows/domain/DomainPricingLogic.java

@@ -41,11 +41,11 @@ import google.registry.model.pricing.PremiumPricingEngine.DomainPrices;
 import google.registry.model.tld.Tld;
 import jakarta.inject.Inject;
 import java.math.RoundingMode;
+import java.time.Instant;
 import java.util.Optional;
 import javax.annotation.Nullable;
 import org.joda.money.CurrencyUnit;
 import org.joda.money.Money;
-import org.joda.time.DateTime;
 
 /**
  * Provides pricing for create, renew, etc, operations, with call-outs that can be customized by
@@ -70,7 +70,7 @@ public final class DomainPricingLogic {
   public FeesAndCredits getCreatePrice(
       Tld tld,
       String domainName,
-      DateTime dateTime,
+      Instant dateTime,
       int years,
       boolean isAnchorTenant,
       boolean isSunriseCreate,
@@ -125,7 +125,7 @@ public final class DomainPricingLogic {
   public FeesAndCredits getRenewPrice(
       Tld tld,
       String domainName,
-      DateTime dateTime,
+      Instant dateTime,
       int years,
       @Nullable BillingRecurrence billingRecurrence,
       Optional<AllocationToken> allocationToken) {
@@ -194,7 +194,7 @@ public final class DomainPricingLogic {
 
   /** Returns a new restore price for the pricer. */
   public FeesAndCredits getRestorePrice(
-      Tld tld, String domainName, DateTime dateTime, boolean isExpired) throws EppException {
+      Tld tld, String domainName, Instant dateTime, boolean isExpired) throws EppException {
     DomainPrices domainPrices = getPricesForDomainName(domainName, dateTime);
     FeesAndCredits.Builder feesAndCredits =
         new FeesAndCredits.Builder()
@@ -217,7 +217,7 @@ public final class DomainPricingLogic {
 
   /** Returns a new transfer price for the pricer. */
   public FeesAndCredits getTransferPrice(
-      Tld tld, String domainName, DateTime dateTime, @Nullable BillingRecurrence billingRecurrence)
+      Tld tld, String domainName, Instant dateTime, @Nullable BillingRecurrence billingRecurrence)
       throws EppException {
     FeesAndCredits renewPrice =
         getRenewPrice(tld, domainName, dateTime, 1, billingRecurrence, Optional.empty());
@@ -239,7 +239,7 @@ public final class DomainPricingLogic {
   }
 
   /** Returns a new update price for the pricer. */
-  public FeesAndCredits getUpdatePrice(Tld tld, String domainName, DateTime dateTime)
+  public FeesAndCredits getUpdatePrice(Tld tld, String domainName, Instant dateTime)
       throws EppException {
     CurrencyUnit currency = tld.getCurrency();
     BaseFee feeOrCredit = Fee.create(zeroInCurrency(currency), FeeType.UPDATE, false);
@@ -272,7 +272,7 @@ public final class DomainPricingLogic {
   private Money getDomainRenewCostWithDiscount(
       Tld tld,
       DomainPrices domainPrices,
-      DateTime dateTime,
+      Instant dateTime,
       int years,
       Optional<AllocationToken> allocationToken) {
     // Short-circuit if the user sent an anchor-tenant or otherwise NONPREMIUM-renewal token
@@ -349,7 +349,7 @@ public final class DomainPricingLogic {
   }
 
   private DomainPrices applyTokenToDomainPrices(
-      DomainPrices domainPrices, Tld tld, DateTime dateTime, int years, AllocationToken token) {
+      DomainPrices domainPrices, Tld tld, Instant dateTime, int years, AllocationToken token) {
     // Convert to nonpremium iff no premium charges are included (either in create or any renewal)
     boolean convertToNonPremium =
         token.getRegistrationBehavior().equals(RegistrationBehavior.NONPREMIUM_CREATE)

core/src/main/java/google/registry/flows/domain/DomainRenewFlow.java

@@ -34,7 +34,7 @@ import static google.registry.flows.domain.token.AllocationTokenFlowUtils.maybeA
 import static google.registry.flows.domain.token.AllocationTokenFlowUtils.verifyBulkTokenAllowedOnDomain;
 import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_RENEW;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.util.DateTimeUtils.leapSafeAddYears;
+import static google.registry.util.DateTimeUtils.toDateTime;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
@@ -86,9 +86,10 @@ import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
 import google.registry.model.tld.Tld;
 import jakarta.inject.Inject;
+import java.time.Instant;
+import java.time.ZoneOffset;
 import java.util.Optional;
 import org.joda.money.Money;
-import org.joda.time.DateTime;
 import org.joda.time.Duration;
 
 /**
@@ -163,7 +164,7 @@ public final class DomainRenewFlow implements MutatingFlow {
     validateRegistrarIsLoggedIn(registrarId);
     verifyRegistrarIsActive(registrarId);
     extensionManager.validate();
-    DateTime now = tm().getTransactionTime();
+    Instant now = tm().getTxTime();
     Renew command = (Renew) resourceCommand;
     // Loads the target resource if it exists
     Domain existingDomain = loadAndVerifyExistence(Domain.class, targetId, now);
@@ -190,8 +191,12 @@ public final class DomainRenewFlow implements MutatingFlow {
     // If client passed an applicable static token this updates the domain
     existingDomain = maybeApplyBulkPricingRemovalToken(existingDomain, allocationToken);
 
-    DateTime newExpirationTime =
-        leapSafeAddYears(existingDomain.getRegistrationExpirationDateTime(), years); // Uncapped
+    Instant newExpirationTime =
+        existingDomain
+            .getRegistrationExpirationTime()
+            .atZone(ZoneOffset.UTC)
+            .plusYears(years)
+            .toInstant(); // Uncapped
     validateRegistrationPeriod(now, newExpirationTime);
     Optional<FeeRenewCommandExtension> feeRenew =
         eppInput.getSingleExtension(FeeRenewCommandExtension.class);
@@ -287,7 +292,7 @@ public final class DomainRenewFlow implements MutatingFlow {
   }
 
   private DomainHistory buildDomainHistory(
-      Domain newDomain, DateTime now, Period period, Duration renewGracePeriod) {
+      Domain newDomain, Instant now, Period period, Duration renewGracePeriod) {
     Optional<MetadataExtension> metadataExtensionOpt =
         eppInput.getSingleExtension(MetadataExtension.class);
     if (metadataExtensionOpt.isPresent()) {
@@ -305,7 +310,7 @@ public final class DomainRenewFlow implements MutatingFlow {
             ImmutableSet.of(
                 DomainTransactionRecord.create(
                     newDomain.getTld(),
-                    now.plus(renewGracePeriod),
+                    now.plusMillis(renewGracePeriod.getMillis()),
                     TransactionReportField.netRenewsFieldFromYears(period.getValue()),
                     1)))
         .build();
@@ -330,7 +335,7 @@ public final class DomainRenewFlow implements MutatingFlow {
     // If the date they specify doesn't match the expiration, fail. (This is an idempotence check).
     if (!command
         .getCurrentExpirationDate()
-        .equals(existingDomain.getRegistrationExpirationDateTime().toLocalDate())) {
+        .equals(toDateTime(existingDomain.getRegistrationExpirationTime()).toLocalDate())) {
       throw new IncorrectCurrentExpirationDateException();
     }
   }
@@ -341,7 +346,7 @@ public final class DomainRenewFlow implements MutatingFlow {
       int years,
       HistoryEntryId domainHistoryId,
       Optional<AllocationToken> allocationToken,
-      DateTime now) {
+      Instant now) {
     return new BillingEvent.Builder()
         .setReason(Reason.RENEW)
         .setTargetId(targetId)
@@ -354,7 +359,7 @@ public final class DomainRenewFlow implements MutatingFlow {
                 .filter(t -> AllocationToken.TokenBehavior.DEFAULT.equals(t.getTokenBehavior()))
                 .map(AllocationToken::createVKey)
                 .orElse(null))
-        .setBillingTime(now.plus(Tld.get(tld).getRenewGracePeriodLength()))
+        .setBillingTime(now.plusMillis(Tld.get(tld).getRenewGracePeriodLength().getMillis()))
         .setDomainHistoryId(domainHistoryId)
         .build();
   }

core/src/main/java/google/registry/flows/domain/DomainRestoreRequestFlow.java

@@ -30,7 +30,7 @@ import static google.registry.flows.domain.DomainFlowUtils.verifyPremiumNameIsNo
 import static google.registry.flows.domain.DomainFlowUtils.verifyRegistrarIsActive;
 import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_RESTORE;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.util.DateTimeUtils.END_OF_TIME;
+import static google.registry.util.DateTimeUtils.END_INSTANT;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
@@ -69,9 +69,10 @@ import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
 import google.registry.model.tld.Tld;
 import jakarta.inject.Inject;
+import java.time.Instant;
+import java.time.ZoneOffset;
 import java.util.Optional;
 import org.joda.money.Money;
-import org.joda.time.DateTime;
 
 /**
  * An EPP flow that requests that a domain in the redemption grace period be restored.
@@ -136,9 +137,9 @@ public final class DomainRestoreRequestFlow implements MutatingFlow {
     verifyRegistrarIsActive(registrarId);
     extensionManager.validate();
     Update command = (Update) resourceCommand;
-    DateTime now = tm().getTransactionTime();
+    Instant now = tm().getTxTime();
     Domain existingDomain = loadAndVerifyExistence(Domain.class, targetId, now);
-    boolean isExpired = existingDomain.getRegistrationExpirationDateTime().isBefore(now);
+    boolean isExpired = existingDomain.getRegistrationExpirationTime().isBefore(now);
     FeesAndCredits feesAndCredits =
         pricingLogic.getRestorePrice(Tld.get(existingDomain.getTld()), targetId, now, isExpired);
     Optional<FeeUpdateCommandExtension> feeUpdate =
@@ -148,8 +149,12 @@ public final class DomainRestoreRequestFlow implements MutatingFlow {
     historyBuilder.setRevisionId(domainHistoryId.getRevisionId());
     ImmutableSet.Builder<ImmutableObject> entitiesToInsert = new ImmutableSet.Builder<>();
 
-    DateTime newExpirationTime =
-        existingDomain.getRegistrationExpirationDateTime().plusYears(isExpired ? 1 : 0);
+    Instant newExpirationTime =
+        existingDomain
+            .getRegistrationExpirationTime()
+            .atZone(ZoneOffset.UTC)
+            .plusYears(isExpired ? 1 : 0)
+            .toInstant();
     // Restore the expiration time on the deleted domain, except if that's already passed, then add
     // a year and bill for it immediately, with no grace period.
     if (isExpired) {
@@ -163,14 +168,14 @@ public final class DomainRestoreRequestFlow implements MutatingFlow {
     BillingRecurrence autorenewEvent =
         newAutorenewBillingEvent(existingDomain)
             .setEventTime(newExpirationTime)
-            .setRecurrenceEndTime(END_OF_TIME)
+            .setRecurrenceEndTime(END_INSTANT)
             .setDomainHistoryId(domainHistoryId)
             .build();
     entitiesToInsert.add(autorenewEvent);
     PollMessage.Autorenew autorenewPollMessage =
         newAutorenewPollMessage(existingDomain)
             .setEventTime(newExpirationTime)
-            .setAutorenewEndTime(END_OF_TIME)
+            .setAutorenewEndTime(END_INSTANT)
             .setDomainHistoryId(domainHistoryId)
             .build();
     entitiesToInsert.add(autorenewPollMessage);
@@ -195,7 +200,7 @@ public final class DomainRestoreRequestFlow implements MutatingFlow {
         .build();
   }
 
-  private DomainHistory buildDomainHistory(Domain newDomain, DateTime now) {
+  private DomainHistory buildDomainHistory(Domain newDomain, Instant now) {
     return historyBuilder
         .setType(DOMAIN_RESTORE)
         .setDomain(newDomain)
@@ -211,7 +216,7 @@ public final class DomainRestoreRequestFlow implements MutatingFlow {
       Domain existingDomain,
       Optional<FeeUpdateCommandExtension> feeUpdate,
       FeesAndCredits feesAndCredits,
-      DateTime now)
+      Instant now)
       throws EppException {
     verifyOptionalAuthInfo(authInfo, existingDomain);
     if (!isSuperuser) {
@@ -234,15 +239,15 @@ public final class DomainRestoreRequestFlow implements MutatingFlow {
 
   private static Domain performRestore(
       Domain existingDomain,
-      DateTime newExpirationTime,
+      Instant newExpirationTime,
       BillingRecurrence autorenewEvent,
       PollMessage.Autorenew autorenewPollMessage,
-      DateTime now,
+      Instant now,
       String registrarId) {
     return existingDomain
         .asBuilder()
         .setRegistrationExpirationTime(newExpirationTime)
-        .setDeletionTime(END_OF_TIME)
+        .setDeletionTime(END_INSTANT)
         .setStatusValues(null)
         .setGracePeriods(null)
         .setDeletePollMessage(null)
@@ -257,17 +262,17 @@ public final class DomainRestoreRequestFlow implements MutatingFlow {
   }
 
   private BillingEvent createRenewBillingEvent(
-      HistoryEntryId domainHistoryId, Money renewCost, DateTime now) {
+      HistoryEntryId domainHistoryId, Money renewCost, Instant now) {
     return prepareBillingEvent(domainHistoryId, renewCost, now).setReason(Reason.RENEW).build();
   }
 
   private BillingEvent createRestoreBillingEvent(
-      HistoryEntryId domainHistoryId, Money restoreCost, DateTime now) {
+      HistoryEntryId domainHistoryId, Money restoreCost, Instant now) {
     return prepareBillingEvent(domainHistoryId, restoreCost, now).setReason(Reason.RESTORE).build();
   }
 
   private BillingEvent.Builder prepareBillingEvent(
-      HistoryEntryId domainHistoryId, Money cost, DateTime now) {
+      HistoryEntryId domainHistoryId, Money cost, Instant now) {
     return new BillingEvent.Builder()
         .setTargetId(targetId)
         .setRegistrarId(registrarId)

core/src/main/java/google/registry/flows/domain/DomainTransferApproveFlow.java

@@ -32,9 +32,7 @@ import static google.registry.model.reporting.DomainTransactionRecord.Transactio
 import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_TRANSFER_APPROVE;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.CollectionUtils.union;
-import static google.registry.util.DateTimeUtils.END_OF_TIME;
-import static google.registry.util.DateTimeUtils.toDateTime;
-import static google.registry.util.DateTimeUtils.toInstant;
+import static google.registry.util.DateTimeUtils.END_INSTANT;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
@@ -70,9 +68,9 @@ import google.registry.model.tld.Tld;
 import google.registry.model.transfer.DomainTransferData;
 import google.registry.model.transfer.TransferStatus;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Optional;
 import org.joda.money.Money;
-import org.joda.time.DateTime;
 
 /**
  * An EPP flow that approves a pending transfer on a domain.
@@ -127,7 +125,7 @@ public final class DomainTransferApproveFlow implements MutatingFlow {
     extensionManager.register(MetadataExtension.class, AllocationTokenExtension.class);
     validateRegistrarIsLoggedIn(registrarId);
     extensionManager.validate();
-    DateTime now = tm().getTransactionTime();
+    Instant now = tm().getTxTime();
     Domain existingDomain = loadAndVerifyExistence(Domain.class, targetId, now);
     AllocationTokenFlowUtils.loadAllocationTokenFromExtension(
         registrarId, targetId, now, eppInput.getSingleExtension(AllocationTokenExtension.class));
@@ -170,7 +168,8 @@ public final class DomainTransferApproveFlow implements MutatingFlow {
                                 hasBulkToken ? null : existingBillingRecurrence)
                             .getRenewCost())
                     .setEventTime(now)
-                    .setBillingTime(now.plus(Tld.get(tldStr).getTransferGracePeriodLength()))
+                    .setBillingTime(
+                        now.plusMillis(Tld.get(tldStr).getTransferGracePeriodLength().getMillis()))
                     .setDomainHistoryId(domainHistoryId)
                     .build());
 
@@ -194,10 +193,8 @@ public final class DomainTransferApproveFlow implements MutatingFlow {
     // up deleting the poll message.
     updateAutorenewRecurrenceEndTime(
         existingDomain, existingBillingRecurrence, now, domainHistoryId);
-    DateTime newExpirationTime =
-        toDateTime(
-            computeExDateForApprovalTime(
-                existingDomain, toInstant(now), transferData.getTransferPeriod()));
+    Instant newExpirationTime =
+        computeExDateForApprovalTime(existingDomain, now, transferData.getTransferPeriod());
     // Create a new autorenew event starting at the expiration time.
     BillingRecurrence autorenewEvent =
         new BillingRecurrence.Builder()
@@ -211,7 +208,7 @@ public final class DomainTransferApproveFlow implements MutatingFlow {
                     ? RenewalPriceBehavior.DEFAULT
                     : existingBillingRecurrence.getRenewalPriceBehavior())
             .setRenewalPrice(renewalPrice)
-            .setRecurrenceEndTime(END_OF_TIME)
+            .setRecurrenceEndTime(END_INSTANT)
             .setDomainHistoryId(domainHistoryId)
             .build();
     // Create a new autorenew poll message.
@@ -220,7 +217,7 @@ public final class DomainTransferApproveFlow implements MutatingFlow {
             .setTargetId(targetId)
             .setRegistrarId(gainingRegistrarId)
             .setEventTime(newExpirationTime)
-            .setAutorenewEndTime(END_OF_TIME)
+            .setAutorenewEndTime(END_INSTANT)
             .setMsg("Domain was auto-renewed.")
             .setDomainHistoryId(domainHistoryId)
             .build();
@@ -274,14 +271,12 @@ public final class DomainTransferApproveFlow implements MutatingFlow {
     return responseBuilder
         .setResData(
             createTransferResponse(
-                targetId,
-                newDomain.getTransferData(),
-                newDomain.getRegistrationExpirationDateTime()))
+                targetId, newDomain.getTransferData(), newDomain.getRegistrationExpirationTime()))
         .build();
   }
 
   private DomainHistory buildDomainHistory(
-      Domain newDomain, Tld tld, DateTime now, String gainingRegistrarId) {
+      Domain newDomain, Tld tld, Instant now, String gainingRegistrarId) {
     ImmutableSet<DomainTransactionRecord> cancelingRecords =
         createCancelingRecords(
             newDomain,
@@ -297,7 +292,7 @@ public final class DomainTransferApproveFlow implements MutatingFlow {
                 cancelingRecords,
                 DomainTransactionRecord.create(
                     newDomain.getTld(),
-                    now.plus(tld.getTransferGracePeriodLength()),
+                    now.plusMillis(tld.getTransferGracePeriodLength().getMillis()),
                     TRANSFER_SUCCESSFUL,
                     1)))
         .build();

core/src/main/java/google/registry/flows/domain/DomainTransferCancelFlow.java

@@ -29,7 +29,7 @@ import static google.registry.model.ResourceTransferUtils.denyPendingTransfer;
 import static google.registry.model.reporting.DomainTransactionRecord.TransactionReportField.TRANSFER_SUCCESSFUL;
 import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_TRANSFER_CANCEL;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.util.DateTimeUtils.END_OF_TIME;
+import static google.registry.util.DateTimeUtils.END_INSTANT;
 
 import com.google.common.collect.ImmutableSet;
 import google.registry.flows.EppException;
@@ -51,8 +51,8 @@ import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
 import google.registry.model.tld.Tld;
 import google.registry.model.transfer.TransferStatus;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * An EPP flow that cancels a pending transfer on a domain.
@@ -92,7 +92,7 @@ public final class DomainTransferCancelFlow implements MutatingFlow {
     extensionManager.register(MetadataExtension.class);
     validateRegistrarIsLoggedIn(registrarId);
     extensionManager.validate();
-    DateTime now = tm().getTransactionTime();
+    Instant now = tm().getTxTime();
     Domain existingDomain = loadAndVerifyExistence(Domain.class, targetId, now);
     verifyOptionalAuthInfo(authInfo, existingDomain);
     verifyHasPendingTransfer(existingDomain);
@@ -120,7 +120,7 @@ public final class DomainTransferCancelFlow implements MutatingFlow {
     BillingRecurrence existingBillingRecurrence =
         tm().loadByKey(existingDomain.getAutorenewBillingEvent());
     updateAutorenewRecurrenceEndTime(
-        existingDomain, existingBillingRecurrence, END_OF_TIME, domainHistory.getHistoryEntryId());
+        existingDomain, existingBillingRecurrence, END_INSTANT, domainHistory.getHistoryEntryId());
     // Delete the billing event and poll messages that were written in case the transfer would have
     // been implicitly server approved.
     tm().delete(existingDomain.getTransferData().getServerApproveEntities());
@@ -129,7 +129,7 @@ public final class DomainTransferCancelFlow implements MutatingFlow {
         .build();
   }
 
-  private DomainHistory buildDomainHistory(Domain newDomain, Tld tld, DateTime now) {
+  private DomainHistory buildDomainHistory(Domain newDomain, Tld tld, Instant now) {
     ImmutableSet<DomainTransactionRecord> cancelingRecords =
         createCancelingRecords(
             newDomain,

core/src/main/java/google/registry/flows/domain/DomainTransferQueryFlow.java

@@ -19,8 +19,6 @@ import static google.registry.flows.ResourceFlowUtils.computeExDateForApprovalTi
 import static google.registry.flows.ResourceFlowUtils.loadAndVerifyExistence;
 import static google.registry.flows.ResourceFlowUtils.verifyOptionalAuthInfo;
 import static google.registry.flows.domain.DomainTransferUtils.createTransferResponse;
-import static google.registry.util.DateTimeUtils.toDateTime;
-import static google.registry.util.DateTimeUtils.toInstant;
 
 import google.registry.flows.EppException;
 import google.registry.flows.ExtensionManager;
@@ -38,8 +36,8 @@ import google.registry.model.transfer.DomainTransferData;
 import google.registry.model.transfer.TransferStatus;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * An EPP flow that queries a pending transfer on a domain.
@@ -72,7 +70,7 @@ public final class DomainTransferQueryFlow implements TransactionalFlow {
   public EppResponse run() throws EppException {
     validateRegistrarIsLoggedIn(registrarId);
     extensionManager.validate(); // There are no legal extensions for this flow.
-    DateTime now = clock.nowUtc();
+    Instant now = clock.now();
     Domain domain = loadAndVerifyExistence(Domain.class, targetId, now);
     verifyOptionalAuthInfo(authInfo, domain);
     // Most of the fields on the transfer response are required, so there's no way to return valid
@@ -88,14 +86,12 @@ public final class DomainTransferQueryFlow implements TransactionalFlow {
         && !registrarId.equals(transferData.getLosingRegistrarId())) {
       throw new NotAuthorizedToViewTransferException();
     }
-    DateTime newExpirationTime = null;
+    Instant newExpirationTime = null;
     if (transferData.getTransferStatus().isApproved()) {
-      newExpirationTime = transferData.getTransferredRegistrationExpirationDateTime();
+      newExpirationTime = transferData.getTransferredRegistrationExpirationTime();
     } else if (transferData.getTransferStatus().equals(TransferStatus.PENDING)) {
       newExpirationTime =
-          toDateTime(
-              computeExDateForApprovalTime(
-                  domain, toInstant(now), domain.getTransferData().getTransferPeriod()));
+          computeExDateForApprovalTime(domain, now, domain.getTransferData().getTransferPeriod());
     }
     return responseBuilder
         .setResData(createTransferResponse(targetId, transferData, newExpirationTime))

core/src/main/java/google/registry/flows/domain/DomainTransferRejectFlow.java

@@ -31,7 +31,7 @@ import static google.registry.model.reporting.DomainTransactionRecord.Transactio
 import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_TRANSFER_REJECT;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.CollectionUtils.union;
-import static google.registry.util.DateTimeUtils.END_OF_TIME;
+import static google.registry.util.DateTimeUtils.END_INSTANT;
 import static google.registry.util.DateTimeUtils.toDateTime;
 
 import com.google.common.collect.ImmutableSet;
@@ -56,7 +56,6 @@ import google.registry.model.transfer.TransferStatus;
 import jakarta.inject.Inject;
 import java.time.Instant;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * An EPP flow that rejects a pending transfer on a domain.
@@ -111,18 +110,18 @@ public final class DomainTransferRejectFlow implements MutatingFlow {
     Domain newDomain =
         denyPendingTransfer(
             existingDomain, TransferStatus.CLIENT_REJECTED, toDateTime(now), registrarId);
-    DomainHistory domainHistory = buildDomainHistory(newDomain, tld, toDateTime(now));
+    DomainHistory domainHistory = buildDomainHistory(newDomain, tld, now);
     tm().update(newDomain);
     tm().insertAll(
             domainHistory,
             createGainingTransferPollMessage(
-                targetId, newDomain.getTransferData(), null, toDateTime(now), domainHistoryId));
+                targetId, newDomain.getTransferData(), null, now, domainHistoryId));
     // Reopen the autorenew event and poll message that we closed for the implicit transfer. This
     // may end up recreating the poll message if it was deleted upon the transfer request.
     BillingRecurrence existingBillingRecurrence =
         tm().loadByKey(existingDomain.getAutorenewBillingEvent());
     updateAutorenewRecurrenceEndTime(
-        existingDomain, existingBillingRecurrence, END_OF_TIME, domainHistory.getHistoryEntryId());
+        existingDomain, existingBillingRecurrence, END_INSTANT, domainHistory.getHistoryEntryId());
     // Delete the billing event and poll messages that were written in case the transfer would have
     // been implicitly server approved.
     tm().delete(existingDomain.getTransferData().getServerApproveEntities());
@@ -131,7 +130,7 @@ public final class DomainTransferRejectFlow implements MutatingFlow {
         .build();
   }
 
-  private DomainHistory buildDomainHistory(Domain newDomain, Tld tld, DateTime now) {
+  private DomainHistory buildDomainHistory(Domain newDomain, Tld tld, Instant now) {
     ImmutableSet<DomainTransactionRecord> cancelingRecords =
         createCancelingRecords(
             newDomain,

core/src/main/java/google/registry/flows/domain/DomainTransferRequestFlow.java

@@ -36,7 +36,6 @@ import static google.registry.model.eppoutput.Result.Code.SUCCESS_WITH_ACTION_PE
 import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_TRANSFER_REQUEST;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.toDateTime;
-import static google.registry.util.DateTimeUtils.toInstant;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
@@ -83,8 +82,8 @@ import google.registry.model.transfer.TransferResponse.DomainTransferResponse;
 import google.registry.model.transfer.TransferStatus;
 import jakarta.inject.Inject;
 import java.time.Instant;
+import java.time.temporal.ChronoUnit;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * An EPP flow that requests a transfer on a domain.
@@ -165,7 +164,7 @@ public final class DomainTransferRequestFlow implements MutatingFlow {
     validateRegistrarIsLoggedIn(gainingClientId);
     verifyRegistrarIsActive(gainingClientId);
     extensionManager.validate();
-    DateTime now = tm().getTransactionTime();
+    Instant now = tm().getTxTime();
     Domain existingDomain = loadAndVerifyExistence(Domain.class, targetId, now);
     AllocationTokenFlowUtils.loadAllocationTokenFromExtension(
         gainingClientId,
@@ -216,13 +215,14 @@ public final class DomainTransferRequestFlow implements MutatingFlow {
     historyBuilder
         .setRevisionId(domainHistoryId.getRevisionId())
         .setOtherRegistrarId(existingDomain.getCurrentSponsorRegistrarId());
-    DateTime automaticTransferTime =
+    Instant automaticTransferTime =
         superuserExtension
             .map(
                 domainTransferRequestSuperuserExtension ->
-                    now.plusDays(
-                        domainTransferRequestSuperuserExtension.getAutomaticTransferLength()))
-            .orElseGet(() -> now.plus(tld.getAutomaticTransferLength()));
+                    now.plus(
+                        domainTransferRequestSuperuserExtension.getAutomaticTransferLength(),
+                        ChronoUnit.DAYS))
+            .orElseGet(() -> now.plusMillis(tld.getAutomaticTransferLength().getMillis()));
     // If the domain will be in the auto-renew grace period at the moment of transfer, the transfer
     // will subsume the autorenew, so we don't add the normal extra year from the transfer.
     // The gaining registrar is still billed for the extra year; the losing registrar will get a
@@ -232,10 +232,8 @@ public final class DomainTransferRequestFlow implements MutatingFlow {
     // policy documentation for transfers subsuming autorenews within the autorenew grace period.
     Domain domainAtTransferTime = existingDomain.cloneProjectedAtTime(automaticTransferTime);
     // The new expiration time if there is a server approval.
-    DateTime serverApproveNewExpirationTime =
-        toDateTime(
-            computeExDateForApprovalTime(
-                domainAtTransferTime, toInstant(automaticTransferTime), period));
+    Instant serverApproveNewExpirationTime =
+        computeExDateForApprovalTime(domainAtTransferTime, automaticTransferTime, period);
     // Create speculative entities in anticipation of an automatic server approval.
     ImmutableSet<TransferServerApproveEntity> serverApproveEntities =
         createTransferServerApproveEntities(
@@ -286,13 +284,15 @@ public final class DomainTransferRequestFlow implements MutatingFlow {
     DomainHistory domainHistory = buildDomainHistory(newDomain, tld, now, period);
 
     asyncTaskEnqueuer.enqueueAsyncResave(
-        newDomain.createVKey(), now, ImmutableSortedSet.of(automaticTransferTime));
+        newDomain.createVKey(),
+        toDateTime(now),
+        ImmutableSortedSet.of(toDateTime(automaticTransferTime)));
     tm().put(newDomain);
     tm().putAll(serverApproveEntities);
     tm().insertAll(domainHistory, requestPollMessage);
     return responseBuilder
         .setResultFromCode(SUCCESS_WITH_ACTION_PENDING)
-        .setResData(createResponse(period, existingDomain, newDomain, toInstant(now)))
+        .setResData(createResponse(period, existingDomain, newDomain, now))
         .setExtensions(createResponseExtensions(feesAndCredits, feeTransfer))
         .build();
   }
@@ -300,7 +300,7 @@ public final class DomainTransferRequestFlow implements MutatingFlow {
   private void verifyTransferAllowed(
       Domain existingDomain,
       Period period,
-      DateTime now,
+      Instant now,
       Optional<DomainTransferRequestSuperuserExtension> superuserExtension)
       throws EppException {
     verifyNoDisallowedStatuses(existingDomain, ImmutableSet.of(StatusValue.PENDING_DELETE));
@@ -363,7 +363,7 @@ public final class DomainTransferRequestFlow implements MutatingFlow {
     }
   }
 
-  private DomainHistory buildDomainHistory(Domain newDomain, Tld tld, DateTime now, Period period) {
+  private DomainHistory buildDomainHistory(Domain newDomain, Tld tld, Instant now, Period period) {
     return historyBuilder
         .setType(DOMAIN_TRANSFER_REQUEST)
         .setPeriod(period)
@@ -372,8 +372,8 @@ public final class DomainTransferRequestFlow implements MutatingFlow {
             ImmutableSet.of(
                 DomainTransactionRecord.create(
                     tld.getTldStr(),
-                    now.plus(tld.getAutomaticTransferLength())
-                        .plus(tld.getTransferGracePeriodLength()),
+                    now.plusMillis(tld.getAutomaticTransferLength().getMillis())
+                        .plusMillis(tld.getTransferGracePeriodLength().getMillis()),
                     TransactionReportField.TRANSFER_SUCCESSFUL,
                     1)))
         .build();
@@ -387,7 +387,7 @@ public final class DomainTransferRequestFlow implements MutatingFlow {
     Instant approveNowExtendedRegistrationTime =
         computeExDateForApprovalTime(existingDomain, now, period);
     return createTransferResponse(
-        targetId, newDomain.getTransferData(), toDateTime(approveNowExtendedRegistrationTime));
+        targetId, newDomain.getTransferData(), approveNowExtendedRegistrationTime);
   }
 
   private static ImmutableList<FeeTransformResponseExtension> createResponseExtensions(

core/src/main/java/google/registry/flows/domain/DomainTransferUtils.java

@@ -16,7 +16,7 @@ package google.registry.flows.domain;
 
 import static com.google.common.collect.Iterables.getOnlyElement;
 import static com.google.common.collect.MoreCollectors.onlyElement;
-import static google.registry.util.DateTimeUtils.END_OF_TIME;
+import static google.registry.util.DateTimeUtils.END_INSTANT;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
@@ -40,10 +40,10 @@ import google.registry.model.transfer.DomainTransferData.TransferServerApproveEn
 import google.registry.model.transfer.TransferResponse.DomainTransferResponse;
 import google.registry.model.transfer.TransferStatus;
 import google.registry.persistence.VKey;
+import java.time.Instant;
 import java.util.Optional;
 import javax.annotation.Nullable;
 import org.joda.money.Money;
-import org.joda.time.DateTime;
 
 /**
  * Utility logic for facilitating domain transfers.
@@ -106,15 +106,15 @@ public final class DomainTransferUtils {
    * </ul>
    */
   public static ImmutableSet<TransferServerApproveEntity> createTransferServerApproveEntities(
-      DateTime automaticTransferTime,
-      DateTime serverApproveNewExpirationTime,
+      Instant automaticTransferTime,
+      Instant serverApproveNewExpirationTime,
       HistoryEntryId domainHistoryId,
       Domain existingDomain,
       BillingRecurrence existingBillingRecurrence,
       Trid trid,
       String gainingRegistrarId,
       Optional<Money> transferCost,
-      DateTime now) {
+      Instant now) {
     String targetId = existingDomain.getDomainName();
     // Create a TransferData for the server-approve case to use for the speculative poll messages.
     DomainTransferData serverApproveTransferData =
@@ -179,12 +179,12 @@ public final class DomainTransferUtils {
   public static PollMessage createGainingTransferPollMessage(
       String targetId,
       DomainTransferData transferData,
-      @Nullable DateTime extendedRegistrationExpirationTime,
-      DateTime now,
+      @Nullable Instant extendedRegistrationExpirationTime,
+      Instant now,
       HistoryEntryId domainHistoryId) {
     return new PollMessage.OneTime.Builder()
         .setRegistrarId(transferData.getGainingRegistrarId())
-        .setEventTime(transferData.getPendingTransferExpirationDateTime())
+        .setEventTime(transferData.getPendingTransferExpirationTime())
         .setMsg(transferData.getTransferStatus().getMessage())
         .setResponseData(
             ImmutableList.of(
@@ -202,11 +202,11 @@ public final class DomainTransferUtils {
   public static PollMessage createLosingTransferPollMessage(
       String targetId,
       DomainTransferData transferData,
-      @Nullable DateTime extendedRegistrationExpirationTime,
+      @Nullable Instant extendedRegistrationExpirationTime,
       HistoryEntryId domainHistoryId) {
     return new PollMessage.OneTime.Builder()
         .setRegistrarId(transferData.getLosingRegistrarId())
-        .setEventTime(transferData.getPendingTransferExpirationDateTime())
+        .setEventTime(transferData.getPendingTransferExpirationTime())
         .setMsg(transferData.getTransferStatus().getMessage())
         .setResponseData(
             ImmutableList.of(
@@ -219,12 +219,12 @@ public final class DomainTransferUtils {
   static DomainTransferResponse createTransferResponse(
       String targetId,
       DomainTransferData transferData,
-      @Nullable DateTime extendedRegistrationExpirationTime) {
+      @Nullable Instant extendedRegistrationExpirationTime) {
     return new DomainTransferResponse.Builder()
         .setDomainName(targetId)
         .setGainingRegistrarId(transferData.getGainingRegistrarId())
         .setLosingRegistrarId(transferData.getLosingRegistrarId())
-        .setPendingTransferExpirationTime(transferData.getPendingTransferExpirationDateTime())
+        .setPendingTransferExpirationTime(transferData.getPendingTransferExpirationTime())
         .setTransferRequestTime(transferData.getTransferRequestTime())
         .setTransferStatus(transferData.getTransferStatus())
         .setExtendedRegistrationExpirationTime(extendedRegistrationExpirationTime)
@@ -232,7 +232,7 @@ public final class DomainTransferUtils {
   }
 
   private static PollMessage.Autorenew createGainingClientAutorenewPollMessage(
-      DateTime serverApproveNewExpirationTime,
+      Instant serverApproveNewExpirationTime,
       HistoryEntryId domainHistoryId,
       String targetId,
       String gainingRegistrarId) {
@@ -240,7 +240,7 @@ public final class DomainTransferUtils {
         .setTargetId(targetId)
         .setRegistrarId(gainingRegistrarId)
         .setEventTime(serverApproveNewExpirationTime)
-        .setAutorenewEndTime(END_OF_TIME)
+        .setAutorenewEndTime(END_INSTANT)
         .setMsg("Domain was auto-renewed.")
         .setDomainHistoryId(domainHistoryId)
         .build();
@@ -248,7 +248,7 @@ public final class DomainTransferUtils {
 
   private static BillingRecurrence createGainingClientAutorenewEvent(
       BillingRecurrence existingBillingRecurrence,
-      DateTime serverApproveNewExpirationTime,
+      Instant serverApproveNewExpirationTime,
       HistoryEntryId domainHistoryId,
       String targetId,
       String gainingRegistrarId) {
@@ -258,7 +258,7 @@ public final class DomainTransferUtils {
         .setTargetId(targetId)
         .setRegistrarId(gainingRegistrarId)
         .setEventTime(serverApproveNewExpirationTime)
-        .setRecurrenceEndTime(END_OF_TIME)
+        .setRecurrenceEndTime(END_INSTANT)
         .setRenewalPriceBehavior(existingBillingRecurrence.getRenewalPriceBehavior())
         .setRenewalPrice(existingBillingRecurrence.getRenewalPrice().orElse(null))
         .setDomainHistoryId(domainHistoryId)
@@ -282,8 +282,8 @@ public final class DomainTransferUtils {
    * href="https://www.icann.org/news/advisory-2002-06-06-en">this ICANN advisory</a>.
    */
   private static Optional<BillingCancellation> createOptionalAutorenewCancellation(
-      DateTime automaticTransferTime,
-      DateTime now,
+      Instant automaticTransferTime,
+      Instant now,
       HistoryEntryId domainHistoryId,
       String targetId,
       Domain existingDomain,
@@ -303,7 +303,7 @@ public final class DomainTransferUtils {
   }
 
   private static BillingEvent createTransferBillingEvent(
-      DateTime automaticTransferTime,
+      Instant automaticTransferTime,
       HistoryEntryId domainHistoryId,
       String targetId,
       String gainingRegistrarId,
@@ -316,7 +316,8 @@ public final class DomainTransferUtils {
         .setCost(transferCost)
         .setPeriodYears(1)
         .setEventTime(automaticTransferTime)
-        .setBillingTime(automaticTransferTime.plus(registry.getTransferGracePeriodLength()))
+        .setBillingTime(
+            automaticTransferTime.plusMillis(registry.getTransferGracePeriodLength().getMillis()))
         .setDomainHistoryId(domainHistoryId)
         .build();
   }

core/src/main/java/google/registry/flows/domain/DomainUpdateFlow.java

@@ -84,9 +84,9 @@ import google.registry.model.poll.PollMessage;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
 import google.registry.model.tld.Tld;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Objects;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * An EPP flow that updates a domain.
@@ -164,7 +164,7 @@ public final class DomainUpdateFlow implements MutatingFlow {
     flowCustomLogic.beforeValidation();
     validateRegistrarIsLoggedIn(registrarId);
     extensionManager.validate();
-    DateTime now = tm().getTransactionTime();
+    Instant now = tm().getTxTime();
     Update command = cloneAndLinkReferences((Update) resourceCommand, now);
     Domain existingDomain = loadAndVerifyExistence(Domain.class, targetId, now);
     verifyUpdateAllowed(command, existingDomain, now);
@@ -211,7 +211,7 @@ public final class DomainUpdateFlow implements MutatingFlow {
   }
 
   /** Fail if the object doesn't exist or was deleted. */
-  private void verifyUpdateAllowed(Update command, Domain existingDomain, DateTime now)
+  private void verifyUpdateAllowed(Update command, Domain existingDomain, Instant now)
       throws EppException {
     verifyOptionalAuthInfo(authInfo, existingDomain);
     AddRemove add = command.getInnerAdd();
@@ -233,7 +233,7 @@ public final class DomainUpdateFlow implements MutatingFlow {
     validateNameserversAllowedOnTld(tldStr, add.getNameserverHostNames());
   }
 
-  private Domain performUpdate(Update command, Domain domain, DateTime now) throws EppException {
+  private Domain performUpdate(Update command, Domain domain, Instant now) throws EppException {
     AddRemove add = command.getInnerAdd();
     AddRemove remove = command.getInnerRemove();
     Optional<SecDnsUpdateExtension> secDnsUpdate =
@@ -281,7 +281,7 @@ public final class DomainUpdateFlow implements MutatingFlow {
       if (superuserExt.get().getAutorenews().isPresent()) {
         boolean autorenews = superuserExt.get().getAutorenews().get();
         domainBuilder.setAutorenewEndTime(
-            Optional.ofNullable(autorenews ? null : domain.getRegistrationExpirationDateTime()));
+            Optional.ofNullable(autorenews ? null : domain.getRegistrationExpirationTime()));
       }
     }
     return domainBuilder.build();
@@ -304,7 +304,7 @@ public final class DomainUpdateFlow implements MutatingFlow {
 
   /** Some status updates cost money. Bill only once no matter how many of them are changed. */
   private Optional<BillingEvent> createBillingEventForStatusUpdates(
-      Domain existingDomain, Domain newDomain, DomainHistory historyEntry, DateTime now) {
+      Domain existingDomain, Domain newDomain, DomainHistory historyEntry, Instant now) {
     Optional<MetadataExtension> metadataExtension =
         eppInput.getSingleExtension(MetadataExtension.class);
     if (metadataExtension.isPresent() && metadataExtension.get().getRequestedByRegistrar()) {
@@ -330,7 +330,7 @@ public final class DomainUpdateFlow implements MutatingFlow {
 
   /** Enqueues a poll message iff a superuser is adding/removing server statuses. */
   private Optional<PollMessage.OneTime> createPollMessageForServerStatusUpdates(
-      Domain existingDomain, Domain newDomain, DomainHistory historyEntry, DateTime now) {
+      Domain existingDomain, Domain newDomain, DomainHistory historyEntry, Instant now) {
     if (registrarId.equals(existingDomain.getPersistedCurrentSponsorRegistrarId())) {
       // Don't send a poll message when a superuser registrar is updating its own domain.
       return Optional.empty();

core/src/main/java/google/registry/flows/domain/FeesAndCredits.java

@@ -127,11 +127,11 @@ public class FeesAndCredits extends ImmutableObject implements Buildable {
     }
 
     public Builder addFeeOrCredit(BaseFee feeOrCredit) {
-      if (feeOrCredit instanceof Credit) {
+      if (feeOrCredit instanceof Credit credit) {
         getInstance().credits =
             new ImmutableList.Builder<Credit>()
                 .addAll(nullToEmptyImmutableCopy(getInstance().credits))
-                .add((Credit) feeOrCredit)
+                .add(credit)
                 .build();
       } else {
         getInstance().fees =
@@ -147,8 +147,8 @@ public class FeesAndCredits extends ImmutableObject implements Buildable {
       ImmutableList.Builder<Fee> feeBuilder = new ImmutableList.Builder<>();
       ImmutableList.Builder<Credit> creditBuilder = new ImmutableList.Builder<>();
       for (BaseFee feeOrCredit : feesAndCredits) {
-        if (feeOrCredit instanceof Credit) {
-          creditBuilder.add((Credit) feeOrCredit);
+        if (feeOrCredit instanceof Credit credit) {
+          creditBuilder.add(credit);
         } else {
           feeBuilder.add((Fee) feeOrCredit);
         }

core/src/main/java/google/registry/flows/domain/token/AllocationTokenFlowUtils.java

@@ -42,9 +42,9 @@ import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
 import google.registry.model.tld.Tld;
 import google.registry.persistence.VKey;
 import java.math.BigDecimal;
+import java.time.Instant;
 import java.util.Map;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /** Utility functions for dealing with {@link AllocationToken}s in domain flows. */
 public class AllocationTokenFlowUtils {
@@ -71,7 +71,7 @@ public class AllocationTokenFlowUtils {
   public static Optional<AllocationToken> loadAllocationTokenFromExtension(
       String registrarId,
       String domainName,
-      DateTime now,
+      Instant now,
       Optional<AllocationTokenExtension> extension)
       throws NonexistentAllocationTokenException, AllocationTokenInvalidException {
     if (extension.isEmpty()) {
@@ -90,7 +90,7 @@ public class AllocationTokenFlowUtils {
    */
   public static Optional<AllocationToken> loadTokenFromExtensionOrGetDefault(
       String registrarId,
-      DateTime now,
+      Instant now,
       Optional<AllocationTokenExtension> extension,
       Tld tld,
       String domainName,
@@ -165,7 +165,7 @@ public class AllocationTokenFlowUtils {
    */
   @VisibleForTesting
   static boolean tokenIsValidAgainstDomain(
-      InternetDomainName domainName, AllocationToken token, CommandName commandName, DateTime now) {
+      InternetDomainName domainName, AllocationToken token, CommandName commandName, Instant now) {
     if (discountTokenInvalidForPremiumName(token, isDomainPremium(domainName.toString(), now))) {
       return false;
     }
@@ -192,7 +192,7 @@ public class AllocationTokenFlowUtils {
       String domainName,
       CommandName commandName,
       String registrarId,
-      DateTime now,
+      Instant now,
       Optional<Integer> years,
       DomainPricingLogic pricingLogic)
       throws EppException {
@@ -232,7 +232,7 @@ public class AllocationTokenFlowUtils {
       String domainName,
       AllocationToken token,
       CommandName commandName,
-      DateTime now,
+      Instant now,
       Optional<Integer> years,
       DomainPricingLogic pricingLogic)
       throws EppException {
@@ -256,7 +256,7 @@ public class AllocationTokenFlowUtils {
 
   /** Loads a given token and validates it against the registrar, time, etc */
   private static AllocationToken loadAndValidateToken(
-      String token, String registrarId, String domainName, DateTime now)
+      String token, String registrarId, String domainName, Instant now)
       throws NonexistentAllocationTokenException, AllocationTokenInvalidException {
     if (Strings.isNullOrEmpty(token)) {
       // We load the token directly from the input XML. If it's null or empty we should throw
@@ -280,7 +280,7 @@ public class AllocationTokenFlowUtils {
   }
 
   private static void validateTokenEntity(
-      AllocationToken token, String registrarId, String domainName, DateTime now)
+      AllocationToken token, String registrarId, String domainName, Instant now)
       throws AllocationTokenInvalidException {
     if (token.isRedeemed()) {
       throw new AlreadyRedeemedAllocationTokenException();

core/src/main/java/google/registry/flows/host/HostCheckFlow.java

@@ -62,7 +62,7 @@ public final class HostCheckFlow implements TransactionalFlow {
     ImmutableList<String> hostnames = ((Check) resourceCommand).getTargetIds();
     verifyTargetIdCount(hostnames, maxChecks);
     ImmutableSet<String> existingIds =
-        ForeignKeyUtils.loadKeys(Host.class, hostnames, clock.nowUtc()).keySet();
+        ForeignKeyUtils.loadKeys(Host.class, hostnames, clock.now()).keySet();
     ImmutableList.Builder<HostCheck> checks = new ImmutableList.Builder<>();
     for (String hostname : hostnames) {
       HostFlowUtils.validateHostName(hostname);

core/src/main/java/google/registry/flows/host/HostCreateFlow.java

@@ -49,8 +49,8 @@ import google.registry.model.host.HostCommand.Create;
 import google.registry.model.host.HostHistory;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * An EPP flow that creates a new host.
@@ -99,7 +99,7 @@ public final class HostCreateFlow implements MutatingFlow {
     validateRegistrarIsLoggedIn(registrarId);
     extensionManager.validate();
     Create command = (Create) resourceCommand;
-    DateTime now = tm().getTransactionTime();
+    Instant now = tm().getTxTime();
     verifyResourceDoesNotExist(Host.class, targetId, now, registrarId);
     // The superordinate domain of the host object if creating an in-bailiwick host, or null if
     // creating an external host. This is looked up before we actually create the Host object, so

core/src/main/java/google/registry/flows/host/HostDeleteFlow.java

@@ -43,7 +43,7 @@ import google.registry.model.host.HostHistory;
 import google.registry.model.reporting.HistoryEntry.Type;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
 import jakarta.inject.Inject;
-import org.joda.time.DateTime;
+import java.time.Instant;
 
 /**
  * An EPP flow that deletes a host.
@@ -82,7 +82,7 @@ public final class HostDeleteFlow implements MutatingFlow {
     extensionManager.register(MetadataExtension.class);
     validateRegistrarIsLoggedIn(registrarId);
     extensionManager.validate();
-    DateTime now = tm().getTransactionTime();
+    Instant now = tm().getTxTime();
     validateHostName(targetId);
     checkLinkedDomains(targetId, now);
     Host existingHost = loadAndVerifyExistence(Host.class, targetId, now);

core/src/main/java/google/registry/flows/host/HostFlowUtils.java

@@ -36,8 +36,8 @@ import google.registry.model.ForeignKeyUtils;
 import google.registry.model.domain.Domain;
 import google.registry.model.eppcommon.StatusValue;
 import java.net.InetAddress;
+import java.time.Instant;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /** Static utility functions for host flows. */
 public class HostFlowUtils {
@@ -90,8 +90,8 @@ public class HostFlowUtils {
   }
 
   /** Return the {@link Domain} this host is subordinate to, or null for external hosts. */
-  public static Optional<Domain> lookupSuperordinateDomain(
-      InternetDomainName hostName, DateTime now) throws EppException {
+  public static Optional<Domain> lookupSuperordinateDomain(InternetDomainName hostName, Instant now)
+      throws EppException {
     Optional<InternetDomainName> tld = findTldForName(hostName);
     if (tld.isEmpty()) {
       // This is an host on a TLD we don't run, therefore obviously external, so we are done.

core/src/main/java/google/registry/flows/host/HostInfoFlow.java

@@ -35,7 +35,7 @@ import google.registry.model.host.HostInfoData;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
-import org.joda.time.DateTime;
+import java.time.Instant;
 
 /**
  * An EPP flow that returns information about a host.
@@ -64,7 +64,7 @@ public final class HostInfoFlow implements TransactionalFlow {
     validateRegistrarIsLoggedIn(registrarId);
     extensionManager.validate(); // There are no legal extensions for this flow.
     validateHostName(targetId);
-    DateTime now = clock.nowUtc();
+    Instant now = clock.now();
     Host host = loadAndVerifyExistence(Host.class, targetId, now);
     ImmutableSet.Builder<StatusValue> statusValues = new ImmutableSet.Builder<>();
     statusValues.addAll(host.getStatusValues());
@@ -99,7 +99,7 @@ public final class HostInfoFlow implements TransactionalFlow {
                 .setCreationRegistrarId(host.getCreationRegistrarId())
                 .setCreationTime(host.getCreationTime())
                 .setLastEppUpdateRegistrarId(host.getLastEppUpdateRegistrarId())
-                .setLastEppUpdateTime(host.getLastEppUpdateDateTime())
+                .setLastEppUpdateTime(host.getLastEppUpdateTime())
                 .build())
         .build();
   }

core/src/main/java/google/registry/flows/host/HostUpdateFlow.java

@@ -66,9 +66,9 @@ import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
 import google.registry.persistence.VKey;
 import google.registry.request.Action;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Objects;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * An EPP flow that updates a host.
@@ -137,7 +137,7 @@ public final class HostUpdateFlow implements MutatingFlow {
     Update command = (Update) resourceCommand;
     Change change = command.getInnerChange();
     String suppliedNewHostName = change.getHostName();
-    DateTime now = tm().getTransactionTime();
+    Instant now = tm().getTxTime();
     validateHostName(targetId);
     Host existingHost = loadAndVerifyExistence(Host.class, targetId, now);
     boolean isHostRename = suppliedNewHostName != null;
@@ -167,7 +167,7 @@ public final class HostUpdateFlow implements MutatingFlow {
     VKey<Domain> newSuperordinateDomainKey =
         newSuperordinateDomain.map(Domain::createVKey).orElse(null);
     // If the superordinateDomain field is changing, set the lastSuperordinateChange to now.
-    DateTime lastSuperordinateChange =
+    Instant lastSuperordinateChange =
         Objects.equals(newSuperordinateDomainKey, existingHost.getSuperordinateDomain())
             ? existingHost.getLastSuperordinateChange()
             : now;
@@ -175,7 +175,7 @@ public final class HostUpdateFlow implements MutatingFlow {
     // have just completed.  This is only critical for updates that rename a host away from its
     // current superordinate domain, where we must "freeze" the last transfer time, but it's easiest
     // to just update it unconditionally.
-    DateTime lastTransferTime = existingHost.computeLastTransferTime(oldSuperordinateDomain);
+    Instant lastTransferTime = existingHost.computeLastTransferTime(oldSuperordinateDomain);
     // Copy the clientId onto the host. This is only really needed when the host will be external,
     // since external hosts store their own clientId. For subordinate hosts the canonical clientId
     // comes from the superordinate domain, but we might as well update the persisted value. For

core/src/main/java/google/registry/flows/picker/FlowPicker.java

@@ -90,8 +90,12 @@ public class FlowPicker {
     /** Get the flow associated with this {@link EppInput} or return null to signal no match. */
     Class<? extends Flow> get(EppInput eppInput) {
       InnerCommand innerCommand = eppInput.getCommandWrapper().getCommand();
-      return get(eppInput, innerCommand, (innerCommand instanceof ResourceCommandWrapper)
-          ? ((ResourceCommandWrapper) innerCommand).getResourceCommand() : null);
+      return get(
+          eppInput,
+          innerCommand,
+          (innerCommand instanceof ResourceCommandWrapper resourceCommandWrapper)
+              ? resourceCommandWrapper.getResourceCommand()
+              : null);
     }
 
     /**
@@ -129,10 +133,10 @@ public class FlowPicker {
         @Override
         Class<? extends Flow> get(
             EppInput eppInput, InnerCommand innerCommand, ResourceCommand resourceCommand) {
-          if (!(innerCommand instanceof Poll)) {
+          if (!(innerCommand instanceof Poll poll)) {
             return null;
           }
-          return switch (((Poll) innerCommand).getPollOp()) {
+          return switch (poll.getPollOp()) {
             case ACK -> PollAckFlow.class;
             case REQUEST -> PollRequestFlow.class;
           };
@@ -222,28 +226,51 @@ public class FlowPicker {
     }};
 
   /** Transfer flows have an {@link InnerCommand} of type {@link Transfer}. */
-  private static final FlowProvider TRANSFER_FLOW_PROVIDER = new FlowProvider() {
-    private final Table<Class<?>, TransferOp, Class<? extends Flow>> transferFlows = ImmutableTable
-        .<Class<?>, TransferOp, Class<? extends Flow>>builder()
-        .put(ContactCommand.Transfer.class, TransferOp.APPROVE, ContactTransferApproveFlow.class)
-        .put(ContactCommand.Transfer.class, TransferOp.CANCEL, ContactTransferCancelFlow.class)
-        .put(ContactCommand.Transfer.class, TransferOp.QUERY, ContactTransferQueryFlow.class)
-        .put(ContactCommand.Transfer.class, TransferOp.REJECT, ContactTransferRejectFlow.class)
-        .put(ContactCommand.Transfer.class, TransferOp.REQUEST, ContactTransferRequestFlow.class)
-        .put(DomainCommand.Transfer.class, TransferOp.APPROVE, DomainTransferApproveFlow.class)
-        .put(DomainCommand.Transfer.class, TransferOp.CANCEL, DomainTransferCancelFlow.class)
-        .put(DomainCommand.Transfer.class, TransferOp.QUERY, DomainTransferQueryFlow.class)
-        .put(DomainCommand.Transfer.class, TransferOp.REJECT, DomainTransferRejectFlow.class)
-        .put(DomainCommand.Transfer.class, TransferOp.REQUEST, DomainTransferRequestFlow.class)
-        .build();
+  private static final FlowProvider TRANSFER_FLOW_PROVIDER =
+      new FlowProvider() {
+        private final Table<Class<?>, TransferOp, Class<? extends Flow>> transferFlows =
+            ImmutableTable.<Class<?>, TransferOp, Class<? extends Flow>>builder()
+                .put(
+                    ContactCommand.Transfer.class,
+                    TransferOp.APPROVE,
+                    ContactTransferApproveFlow.class)
+                .put(
+                    ContactCommand.Transfer.class,
+                    TransferOp.CANCEL,
+                    ContactTransferCancelFlow.class)
+                .put(
+                    ContactCommand.Transfer.class, TransferOp.QUERY, ContactTransferQueryFlow.class)
+                .put(
+                    ContactCommand.Transfer.class,
+                    TransferOp.REJECT,
+                    ContactTransferRejectFlow.class)
+                .put(
+                    ContactCommand.Transfer.class,
+                    TransferOp.REQUEST,
+                    ContactTransferRequestFlow.class)
+                .put(
+                    DomainCommand.Transfer.class,
+                    TransferOp.APPROVE,
+                    DomainTransferApproveFlow.class)
+                .put(
+                    DomainCommand.Transfer.class, TransferOp.CANCEL, DomainTransferCancelFlow.class)
+                .put(DomainCommand.Transfer.class, TransferOp.QUERY, DomainTransferQueryFlow.class)
+                .put(
+                    DomainCommand.Transfer.class, TransferOp.REJECT, DomainTransferRejectFlow.class)
+                .put(
+                    DomainCommand.Transfer.class,
+                    TransferOp.REQUEST,
+                    DomainTransferRequestFlow.class)
+                .build();
 
-    @Override
-    Class<? extends Flow> get(
-        EppInput eppInput, InnerCommand innerCommand, ResourceCommand resourceCommand) {
-      return resourceCommand != null && innerCommand instanceof Transfer
-          ? transferFlows.get(resourceCommand.getClass(), ((Transfer) innerCommand).getTransferOp())
-          : null;
-    }};
+        @Override
+        Class<? extends Flow> get(
+            EppInput eppInput, InnerCommand innerCommand, ResourceCommand resourceCommand) {
+          return resourceCommand != null && innerCommand instanceof Transfer transfer
+              ? transferFlows.get(resourceCommand.getClass(), transfer.getTransferOp())
+              : null;
+        }
+      };
 
   private static final ImmutableList<FlowProvider> FLOW_PROVIDERS =
       ImmutableList.of(

core/src/main/java/google/registry/flows/poll/PollAckFlow.java

@@ -41,8 +41,8 @@ import google.registry.persistence.IsolationLevel;
 import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.persistence.VKey;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * An EPP flow for acknowledging {@link PollMessage}s.
@@ -83,7 +83,7 @@ public final class PollAckFlow implements MutatingFlow {
       throw new InvalidMessageIdException(messageId);
     }
 
-    final DateTime now = tm().getTransactionTime();
+    final Instant now = tm().getTxTime();
 
     // Load the message to be acked. If a message is queued to be delivered in the future, we treat
     // it as if it doesn't exist yet. Same for if the message ID year isn't the same as the actual

core/src/main/java/google/registry/flows/poll/PollFlowUtils.java

@@ -19,22 +19,23 @@ import static google.registry.persistence.transaction.QueryComposer.Comparator.E
 import static google.registry.persistence.transaction.QueryComposer.Comparator.LTE;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.isBeforeOrAt;
+import static google.registry.util.DateTimeUtils.plusYears;
 
 import google.registry.model.poll.PollMessage;
 import google.registry.persistence.transaction.QueryComposer;
+import java.time.Instant;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /** Static utility functions for poll flows. */
 public final class PollFlowUtils {
 
   /** Returns the number of poll messages for the given registrar that are not in the future. */
-  public static int getPollMessageCount(String registrarId, DateTime now) {
+  public static int getPollMessageCount(String registrarId, Instant now) {
     return (int) createPollMessageQuery(registrarId, now).count();
   }
 
   /** Returns the first (by event time) poll message not in the future for this registrar. */
-  public static Optional<PollMessage> getFirstPollMessage(String registrarId, DateTime now) {
+  public static Optional<PollMessage> getFirstPollMessage(String registrarId, Instant now) {
     return createPollMessageQuery(registrarId, now).orderBy("eventTime").first();
   }
 
@@ -47,7 +48,7 @@ public final class PollFlowUtils {
    */
   public static void ackPollMessage(PollMessage pollMessage) {
     checkArgument(
-        isBeforeOrAt(pollMessage.getEventTime(), tm().getTransactionTime()),
+        isBeforeOrAt(pollMessage.getEventTime(), tm().getTxTime()),
         "Cannot ACK poll message with ID %s because its event time is in the future: %s",
         pollMessage.getId(),
         pollMessage.getEventTime());
@@ -57,7 +58,7 @@ public final class PollFlowUtils {
     } else if (pollMessage instanceof PollMessage.Autorenew autorenewPollMessage) {
 
       // Move the eventTime of this autorenew poll message forward by a year.
-      DateTime nextEventTime = autorenewPollMessage.getEventTime().plusYears(1);
+      Instant nextEventTime = plusYears(autorenewPollMessage.getEventTime(), 1);
 
       // If the next event falls within the bounds of the end time, then just update the eventTime
       // and re-save it for future autorenew poll messages to be delivered. Otherwise, this
@@ -76,8 +77,7 @@ public final class PollFlowUtils {
    * Returns the QueryComposer for poll messages from the given registrar that are not in the
    * future.
    */
-  public static QueryComposer<PollMessage> createPollMessageQuery(
-      String registrarId, DateTime now) {
+  public static QueryComposer<PollMessage> createPollMessageQuery(String registrarId, Instant now) {
     return tm().createQueryComposer(PollMessage.class)
         .where("clientId", EQ, registrarId)
         .where("eventTime", LTE, now);

core/src/main/java/google/registry/flows/poll/PollRequestFlow.java

@@ -35,8 +35,8 @@ import google.registry.model.poll.PollMessageExternalKeyConverter;
 import google.registry.persistence.IsolationLevel;
 import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import jakarta.inject.Inject;
+import java.time.Instant;
 import java.util.Optional;
-import org.joda.time.DateTime;
 
 /**
  * An EPP flow for requesting {@link PollMessage}s.
@@ -67,7 +67,7 @@ public final class PollRequestFlow implements TransactionalFlow {
     }
 
     // Return the oldest message from the queue.
-    DateTime now = tm().getTransactionTime();
+    Instant now = tm().getTxTime();
     Optional<PollMessage> maybePollMessage = getFirstPollMessage(registrarId, now);
     if (maybePollMessage.isEmpty()) {
       return responseBuilder.setResultFromCode(SUCCESS_WITH_NO_MESSAGES).build();

core/src/main/java/google/registry/flows/session/HelloFlow.java

@@ -37,6 +37,6 @@ public final class HelloFlow implements Flow {
   @Override
   public Greeting run() throws EppException {
     extensionManager.validate(); // There are no legal extensions for this flow.
-    return Greeting.create(clock.nowUtc(), greetingServerId);
+    return Greeting.create(clock.now(), greetingServerId);
   }
 }

core/src/main/java/google/registry/gcs/GcsUtils.java

@@ -182,7 +182,7 @@ public class GcsUtils implements Serializable {
   // These two methods are needed to check whether serialization is done correctly in tests.
   @Override
   public boolean equals(Object obj) {
-    return obj instanceof GcsUtils && ((GcsUtils) obj).storageOptions.equals(storageOptions);
+    return obj instanceof GcsUtils gcsUtils && gcsUtils.storageOptions.equals(storageOptions);
   }
 
   @Override

core/src/main/java/google/registry/groups/DirectoryGroupsConnection.java

@@ -68,7 +68,7 @@ public class DirectoryGroupsConnection implements GroupsConnection {
   @VisibleForTesting
   static Groups getDefaultGroupPermissions() {
     Groups permissions = new Groups();
-    permissions.setAllowExternalMembers(Boolean.TRUE.toString());
+    permissions.setAllowExternalMembers("true");
     permissions.setWhoCanPostMessage("ALL_MANAGERS_CAN_POST");
     permissions.setWhoCanViewGroup("ALL_MANAGERS_CAN_VIEW");
     permissions.setWhoCanViewMembership("ALL_MANAGERS_CAN_VIEW");