diff --git a/.bazelrc b/.bazelrc
index bf3aa6c..b9189c1 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -2,7 +2,7 @@
 build --repository_cache=~/.gerritcodereview/bazel-cache/repository
 build --action_env=PATH
 build --disk_cache=~/.gerritcodereview/bazel-cache/cas
-build --java_toolchain //tools:error_prone_warnings_toolchain
+build --java_toolchain=//tools:error_prone_warnings_toolchain_java11
 
 # Enable strict_action_env flag to. For more information on this feature see
 # https://groups.google.com/forum/#!topic/bazel-discuss/_VmRfMyyHBk.
@@ -13,5 +13,6 @@
 
 test --build_tests_only
 test --test_output=errors
+test --java_toolchain=//tools:error_prone_warnings_toolchain_java11
 
 import %workspace%/tools/remote-bazelrc
diff --git a/Documentation/dev-bazel.txt b/Documentation/dev-bazel.txt
index ee2f4a1..086e836 100644
--- a/Documentation/dev-bazel.txt
+++ b/Documentation/dev-bazel.txt
@@ -18,7 +18,7 @@
 To build Gerrit from source, you need:
 
 * A Linux or macOS system (Windows is not supported at this time)
-* A JDK for Java 8|9|10|11|...
+* A JDK for Java 8|11|...
 * Python 2 or 3
 * link:https://github.com/nodesource/distributions/blob/master/README.md[Node.js (including npm),role=external,window=_blank]
 * Bower (`npm install -g bower`)
@@ -54,6 +54,27 @@
 
 `java -version`
 
+[[java-8]]
+==== Java 8 support (deprecated)
+
+Java 8 is a legacy Java release and support for Java 8 will be discontinued
+in future gerrit releases. To build Gerrit with Java 8 language level, run:
+
+```
+  $ bazel build --java_toolchain //tools:error_prone_warnings_toolchain_java8
+        :release
+```
+
+[[java-11]]
+==== Java 11 support
+
+Java language level 11 is the default. To build Gerrit with Java 11 language
+level, run:
+
+```
+  $ bazel build :release
+```
+
 [[java-13]]
 ==== Java 13 support
 
@@ -101,22 +122,6 @@
 Now, invoking Bazel with just `bazel build :release` would include
 all those options.
 
-[[java-11]]
-==== Java 11 support
-
-Java 11 is supported through alternative java toolchain
-link:https://docs.bazel.build/versions/master/toolchains.html[Bazel option].
-To build Gerrit with Java 11, specify JDK 11 java toolchain:
-
-```
-  $ bazel build \
-      --host_javabase=@bazel_tools//tools/jdk:remote_jdk11 \
-      --javabase=@bazel_tools//tools/jdk:remote_jdk11 \
-      --host_java_toolchain=@bazel_tools//tools/jdk:toolchain_java11 \
-      --java_toolchain=@bazel_tools//tools/jdk:toolchain_java11 \
-      :release
-```
-
 === Node.js and npm packages
 See link:https://gerrit.googlesource.com/gerrit/+/master/polygerrit-ui/README.md#installing-node_js-and-npm-packages[Installing Node.js and npm packages,role=external,window=_blank].
 
diff --git a/java/com/google/gerrit/httpd/restapi/RestApiServlet.java b/java/com/google/gerrit/httpd/restapi/RestApiServlet.java
index f743578..665cc33 100644
--- a/java/com/google/gerrit/httpd/restapi/RestApiServlet.java
+++ b/java/com/google/gerrit/httpd/restapi/RestApiServlet.java
@@ -108,7 +108,6 @@
 import com.google.gerrit.server.RequestInfo;
 import com.google.gerrit.server.RequestListener;
 import com.google.gerrit.server.audit.ExtendedHttpAuditEvent;
-import com.google.gerrit.server.cache.PerThreadCache;
 import com.google.gerrit.server.change.ChangeFinder;
 import com.google.gerrit.server.config.GerritServerConfig;
 import com.google.gerrit.server.group.GroupAuditService;
@@ -328,7 +327,7 @@
     try (TraceContext traceContext = enableTracing(req, res)) {
       List<IdString> path = splitPath(req);
 
-      try (PerThreadCache ignored = PerThreadCache.create()) {
+      try {
         RequestInfo requestInfo = createRequestInfo(traceContext, requestUri(req), path);
         globals.requestListeners.runEach(l -> l.onRequest(requestInfo));
 
diff --git a/java/com/google/gerrit/server/AnonymousUser.java b/java/com/google/gerrit/server/AnonymousUser.java
index 91d2d05..c96d61a 100644
--- a/java/com/google/gerrit/server/AnonymousUser.java
+++ b/java/com/google/gerrit/server/AnonymousUser.java
@@ -27,12 +27,6 @@
   }
 
   @Override
-  public Object getCacheKey() {
-    // Treat all anonymous users as a single user
-    return "anonymous";
-  }
-
-  @Override
   public String toString() {
     return "ANONYMOUS";
   }
diff --git a/java/com/google/gerrit/server/CurrentUser.java b/java/com/google/gerrit/server/CurrentUser.java
index 75afc04..1955340 100644
--- a/java/com/google/gerrit/server/CurrentUser.java
+++ b/java/com/google/gerrit/server/CurrentUser.java
@@ -90,12 +90,6 @@
    */
   public abstract GroupMembership getEffectiveGroups();
 
-  /**
-   * Returns a unique identifier for this user that is intended to be used as a cache key. Returned
-   * object should to implement {@code equals()} and {@code hashCode()} for effective caching.
-   */
-  public abstract Object getCacheKey();
-
   /** Unique name of the user on this server, if one has been assigned. */
   public Optional<String> getUserName() {
     return Optional.empty();
diff --git a/java/com/google/gerrit/server/IdentifiedUser.java b/java/com/google/gerrit/server/IdentifiedUser.java
index 7cafdc0..14d74d0 100644
--- a/java/com/google/gerrit/server/IdentifiedUser.java
+++ b/java/com/google/gerrit/server/IdentifiedUser.java
@@ -390,11 +390,6 @@
     return effectiveGroups;
   }
 
-  @Override
-  public Object getCacheKey() {
-    return getAccountId();
-  }
-
   public PersonIdent newRefLogIdent() {
     return newRefLogIdent(new Date(), TimeZone.getDefault());
   }
diff --git a/java/com/google/gerrit/server/InternalUser.java b/java/com/google/gerrit/server/InternalUser.java
index 381819d..821a0c6 100644
--- a/java/com/google/gerrit/server/InternalUser.java
+++ b/java/com/google/gerrit/server/InternalUser.java
@@ -36,11 +36,6 @@
   }
 
   @Override
-  public String getCacheKey() {
-    return "internal";
-  }
-
-  @Override
   public boolean isInternalUser() {
     return true;
   }
diff --git a/java/com/google/gerrit/server/PeerDaemonUser.java b/java/com/google/gerrit/server/PeerDaemonUser.java
index b27e05c..8a8b67a 100644
--- a/java/com/google/gerrit/server/PeerDaemonUser.java
+++ b/java/com/google/gerrit/server/PeerDaemonUser.java
@@ -40,11 +40,6 @@
     return GroupMembership.EMPTY;
   }
 
-  @Override
-  public Object getCacheKey() {
-    return getRemoteAddress();
-  }
-
   public SocketAddress getRemoteAddress() {
     return peer;
   }
diff --git a/java/com/google/gerrit/server/cache/PerThreadCache.java b/java/com/google/gerrit/server/cache/PerThreadCache.java
deleted file mode 100644
index b4f79d1..0000000
--- a/java/com/google/gerrit/server/cache/PerThreadCache.java
+++ /dev/null
@@ -1,146 +0,0 @@
-// Copyright (C) 2018 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package com.google.gerrit.server.cache;
-
-import static com.google.common.base.Preconditions.checkState;
-
-import com.google.common.base.Objects;
-import com.google.common.collect.ImmutableList;
-import com.google.common.collect.Maps;
-import com.google.gerrit.common.Nullable;
-import java.util.Map;
-import java.util.function.Supplier;
-
-/**
- * Caches object instances for a request as {@link ThreadLocal} in the serving thread.
- *
- * <p>This class is intended to cache objects that have a high instantiation cost, are specific to
- * the current request and potentially need to be instantiated multiple times while serving a
- * request.
- *
- * <p>This is different from the key-value storage in {@code CurrentUser}: {@code CurrentUser}
- * offers a key-value storage by providing thread-safe {@code get} and {@code put} methods. Once the
- * value is retrieved through {@code get} there is not thread-safety anymore - apart from the
- * retrieved object guarantees. Depending on the implementation of {@code CurrentUser}, it might be
- * shared between the request serving thread as well as sub- or background treads.
- *
- * <p>In comparison to that, this class guarantees thread safety even on non-thread-safe objects as
- * its cache is tied to the serving thread only. While allowing to cache non-thread-safe objects, it
- * has the downside of not sharing any objects with background threads or executors.
- *
- * <p>Lastly, this class offers a cache, that requires callers to also provide a {@code Supplier} in
- * case the object is not present in the cache, while {@code CurrentUser} provides a storage where
- * just retrieving stored values is a valid operation.
- *
- * <p>To prevent OOM errors on requests that would cache a lot of objects, this class enforces an
- * internal limit after which no new elements are cached. All {@code get} calls are served by
- * invoking the {@code Supplier} after that.
- */
-public class PerThreadCache implements AutoCloseable {
-  private static final ThreadLocal<PerThreadCache> CACHE = new ThreadLocal<>();
-  /**
-   * Cache at maximum 25 values per thread. This value was chosen arbitrarily. Some endpoints (like
-   * ListProjects) break the assumption that the data cached in a request is limited. To prevent
-   * this class from accumulating an unbound number of objects, we enforce this limit.
-   */
-  private static final int PER_THREAD_CACHE_SIZE = 25;
-
-  /**
-   * Unique key for key-value mappings stored in PerThreadCache. The key is based on the value's
-   * class and a list of identifiers that in combination uniquely set the object apart form others
-   * of the same class.
-   */
-  public static final class Key<T> {
-    private final Class<T> clazz;
-    private final ImmutableList<Object> identifiers;
-
-    /**
-     * Returns a key based on the value's class and an identifier that uniquely identify the value.
-     * The identifier needs to implement {@code equals()} and {@hashCode()}.
-     */
-    public static <T> Key<T> create(Class<T> clazz, Object identifier) {
-      return new Key<>(clazz, ImmutableList.of(identifier));
-    }
-
-    /**
-     * Returns a key based on the value's class and a set of identifiers that uniquely identify the
-     * value. Identifiers need to implement {@code equals()} and {@hashCode()}.
-     */
-    public static <T> Key<T> create(Class<T> clazz, Object... identifiers) {
-      return new Key<>(clazz, ImmutableList.copyOf(identifiers));
-    }
-
-    private Key(Class<T> clazz, ImmutableList<Object> identifiers) {
-      this.clazz = clazz;
-      this.identifiers = identifiers;
-    }
-
-    @Override
-    public int hashCode() {
-      return Objects.hashCode(clazz, identifiers);
-    }
-
-    @Override
-    public boolean equals(Object o) {
-      if (!(o instanceof Key)) {
-        return false;
-      }
-      Key<?> other = (Key<?>) o;
-      return this.clazz == other.clazz && this.identifiers.equals(other.identifiers);
-    }
-  }
-
-  public static PerThreadCache create() {
-    checkState(CACHE.get() == null, "called create() twice on the same request");
-    PerThreadCache cache = new PerThreadCache();
-    CACHE.set(cache);
-    return cache;
-  }
-
-  @Nullable
-  public static PerThreadCache get() {
-    return CACHE.get();
-  }
-
-  public static <T> T getOrCompute(Key<T> key, Supplier<T> loader) {
-    PerThreadCache cache = get();
-    return cache != null ? cache.get(key, loader) : loader.get();
-  }
-
-  private final Map<Key<?>, Object> cache = Maps.newHashMapWithExpectedSize(PER_THREAD_CACHE_SIZE);
-
-  private PerThreadCache() {}
-
-  /**
-   * Returns an instance of {@code T} that was either loaded from the cache or obtained from the
-   * provided {@link Supplier}.
-   */
-  public <T> T get(Key<T> key, Supplier<T> loader) {
-    @SuppressWarnings("unchecked")
-    T value = (T) cache.get(key);
-    if (value == null) {
-      value = loader.get();
-      if (cache.size() < PER_THREAD_CACHE_SIZE) {
-        cache.put(key, value);
-      }
-    }
-    return value;
-  }
-
-  @Override
-  public void close() {
-    CACHE.remove();
-  }
-}
diff --git a/java/com/google/gerrit/server/permissions/DefaultPermissionBackend.java b/java/com/google/gerrit/server/permissions/DefaultPermissionBackend.java
index cf6a184..1b029b1 100644
--- a/java/com/google/gerrit/server/permissions/DefaultPermissionBackend.java
+++ b/java/com/google/gerrit/server/permissions/DefaultPermissionBackend.java
@@ -34,7 +34,6 @@
 import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.PeerDaemonUser;
 import com.google.gerrit.server.account.CapabilityCollection;
-import com.google.gerrit.server.cache.PerThreadCache;
 import com.google.gerrit.server.project.ProjectCache;
 import com.google.gerrit.server.project.ProjectState;
 import com.google.inject.Inject;
@@ -105,11 +104,7 @@
     public ForProject project(Project.NameKey project) {
       try {
         ProjectState state = projectCache.get(project).orElseThrow(illegalState(project));
-        ProjectControl control =
-            PerThreadCache.getOrCompute(
-                PerThreadCache.Key.create(ProjectControl.class, project, user.getCacheKey()),
-                () -> projectControlFactory.create(user, state));
-        return control.asForProject();
+        return projectControlFactory.create(user, state).asForProject();
       } catch (Exception e) {
         Throwable cause = e.getCause() != null ? e.getCause() : e;
         return FailedPermissionBackend.project(
diff --git a/java/com/google/gerrit/server/query/change/SingleGroupUser.java b/java/com/google/gerrit/server/query/change/SingleGroupUser.java
index c451d46..7947b6b 100644
--- a/java/com/google/gerrit/server/query/change/SingleGroupUser.java
+++ b/java/com/google/gerrit/server/query/change/SingleGroupUser.java
@@ -36,9 +36,4 @@
   public GroupMembership getEffectiveGroups() {
     return groups;
   }
-
-  @Override
-  public Object getCacheKey() {
-    return groups.getKnownGroups();
-  }
 }
diff --git a/javatests/com/google/gerrit/server/cache/PerThreadCacheTest.java b/javatests/com/google/gerrit/server/cache/PerThreadCacheTest.java
deleted file mode 100644
index 5d420d3..0000000
--- a/javatests/com/google/gerrit/server/cache/PerThreadCacheTest.java
+++ /dev/null
@@ -1,103 +0,0 @@
-// Copyright (C) 2018 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package com.google.gerrit.server.cache;
-
-import static com.google.common.truth.Truth.assertThat;
-import static com.google.gerrit.testing.GerritJUnit.assertThrows;
-
-import java.util.function.Supplier;
-import org.junit.Test;
-
-public class PerThreadCacheTest {
-
-  @SuppressWarnings("TruthIncompatibleType")
-  @Test
-  public void key_respectsClass() {
-    assertThat(PerThreadCache.Key.create(String.class))
-        .isEqualTo(PerThreadCache.Key.create(String.class));
-    assertThat(PerThreadCache.Key.create(String.class))
-        .isNotEqualTo(
-            /* expected: Key<String>, actual: Key<Integer> */ PerThreadCache.Key.create(
-                Integer.class));
-  }
-
-  @Test
-  public void key_respectsIdentifiers() {
-    assertThat(PerThreadCache.Key.create(String.class, "id1"))
-        .isEqualTo(PerThreadCache.Key.create(String.class, "id1"));
-    assertThat(PerThreadCache.Key.create(String.class, "id1"))
-        .isNotEqualTo(PerThreadCache.Key.create(String.class, "id2"));
-  }
-
-  @Test
-  public void endToEndCache() {
-    try (PerThreadCache ignored = PerThreadCache.create()) {
-      PerThreadCache cache = PerThreadCache.get();
-      PerThreadCache.Key<String> key1 = PerThreadCache.Key.create(String.class);
-
-      String value1 = cache.get(key1, () -> "value1");
-      assertThat(value1).isEqualTo("value1");
-
-      Supplier<String> neverCalled =
-          () -> {
-            throw new IllegalStateException("this method must not be called");
-          };
-      assertThat(cache.get(key1, neverCalled)).isEqualTo("value1");
-    }
-  }
-
-  @Test
-  public void cleanUp() {
-    PerThreadCache.Key<String> key = PerThreadCache.Key.create(String.class);
-    try (PerThreadCache ignored = PerThreadCache.create()) {
-      PerThreadCache cache = PerThreadCache.get();
-      String value1 = cache.get(key, () -> "value1");
-      assertThat(value1).isEqualTo("value1");
-    }
-
-    // Create a second cache and assert that it is not connected to the first one.
-    // This ensures that the cleanup is actually working.
-    try (PerThreadCache ignored = PerThreadCache.create()) {
-      PerThreadCache cache = PerThreadCache.get();
-      String value1 = cache.get(key, () -> "value2");
-      assertThat(value1).isEqualTo("value2");
-    }
-  }
-
-  @Test
-  public void doubleInstantiationFails() {
-    try (PerThreadCache ignored = PerThreadCache.create()) {
-      IllegalStateException thrown =
-          assertThrows(IllegalStateException.class, () -> PerThreadCache.create());
-      assertThat(thrown).hasMessageThat().contains("called create() twice on the same request");
-    }
-  }
-
-  @Test
-  public void enforceMaxSize() {
-    try (PerThreadCache cache = PerThreadCache.create()) {
-      // Fill the cache
-      for (int i = 0; i < 50; i++) {
-        PerThreadCache.Key<String> key = PerThreadCache.Key.create(String.class, i);
-        cache.get(key, () -> "cached value");
-      }
-      // Assert that the value was not persisted
-      PerThreadCache.Key<String> key = PerThreadCache.Key.create(String.class, 1000);
-      cache.get(key, () -> "new value");
-      String value = cache.get(key, () -> "directly served");
-      assertThat(value).isEqualTo("directly served");
-    }
-  }
-}
diff --git a/javatests/com/google/gerrit/server/extensions/webui/UiActionsTest.java b/javatests/com/google/gerrit/server/extensions/webui/UiActionsTest.java
index de23ef4..1cdca1b 100644
--- a/javatests/com/google/gerrit/server/extensions/webui/UiActionsTest.java
+++ b/javatests/com/google/gerrit/server/extensions/webui/UiActionsTest.java
@@ -101,11 +101,6 @@
         }
 
         @Override
-        public Object getCacheKey() {
-          return new Object();
-        }
-
-        @Override
         public boolean isIdentifiedUser() {
           return true;
         }
diff --git a/javatests/com/google/gerrit/server/permissions/RefControlTest.java b/javatests/com/google/gerrit/server/permissions/RefControlTest.java
index 81cb732..64f9392 100644
--- a/javatests/com/google/gerrit/server/permissions/RefControlTest.java
+++ b/javatests/com/google/gerrit/server/permissions/RefControlTest.java
@@ -1198,11 +1198,6 @@
     }
 
     @Override
-    public Object getCacheKey() {
-      return new Object();
-    }
-
-    @Override
     public Optional<String> getUserName() {
       return Optional.ofNullable(username);
     }
diff --git a/plugins/replication b/plugins/replication
index 293ee35..bc47d23 160000
--- a/plugins/replication
+++ b/plugins/replication
@@ -1 +1 @@
-Subproject commit 293ee3590d9fb57f6882e11126d8c97532cce968
+Subproject commit bc47d238733981d957a820f4c66f7128fca80663
diff --git a/polygerrit-ui/server.go b/polygerrit-ui/server.go
index 3844b5b..124b924 100644
--- a/polygerrit-ui/server.go
+++ b/polygerrit-ui/server.go
@@ -526,16 +526,23 @@
 	waitForNextChangeInterval = 1 * time.Second
 )
 
+// typescriptLogWriter implements Writer interface and receives output
+// (stdout and stderr) from the typescript compiler. It reads incoming
+// data line-by-line, analyzes each line and updates compilationDoneWaiter
+// according to the current compiler state. Additionally, the
+// typescriptLogWriter passes all incoming lines to the underlying logger.
 type typescriptLogWriter struct {
+	// unfinishedLine stores the portion of line which was partially received
+	// (i.e. all text received after the last EOL (\n) mark.
 	unfinishedLine string
-	logger         *log.Logger
+	// logger is used to pass-through all received strings
+	logger *log.Logger
 	// when WaitGroup counter is 0 the compilation is complete
 	compilationDoneWaiter *sync.WaitGroup
 }
 
 func newTypescriptLogWriter(compilationCompleteWaiter *sync.WaitGroup) *typescriptLogWriter {
 	return &typescriptLogWriter{
-		unfinishedLine:        "",
 		logger:                log.New(log.Writer(), "TSC - ", log.Flags()),
 		compilationDoneWaiter: compilationCompleteWaiter,
 	}
@@ -572,7 +579,7 @@
 			// again until it finishes.
 			go func() {
 				time.Sleep(waitForNextChangeInterval)
-				lw.compilationDoneWaiter.Add(-1)
+				lw.compilationDoneWaiter.Done()
 			}()
 		}
 		lw.logger.Print(text)
@@ -596,6 +603,20 @@
 
 	compilationCompleteWaiter := &sync.WaitGroup{}
 	logWriter := newTypescriptLogWriter(compilationCompleteWaiter)
+	// Note 1: (from https://golang.org/pkg/os/exec/#Cmd)
+	// If Stdout and Stderr are the same writer, and have a type that can
+	// be compared with ==, at most one goroutine at a time will call Write.
+	//
+	// Note 2: The typescript compiler reports all compilation errors to
+	// stdout by design (see https://github.com/microsoft/TypeScript/issues/615)
+	// It writes to stderr only when something unexpected happens (like internal
+	// exceptions). To print such errors in the same way as standard typescript
+	// error, the same logWriter is used both for Stdout and Stderr.
+	//
+	// If Stderr arrives in the middle of ordinary typescript output (i.e.
+	// something unexpected happens), the server.go can stop respond to http
+	// requests. However, this is not a problem for us: typescript compiler and
+	// server.go must be restarted anyway.
 	cmd.Stdout = logWriter
 	cmd.Stderr = logWriter
 
diff --git a/tools/BUILD b/tools/BUILD
index 5159177..be12735 100644
--- a/tools/BUILD
+++ b/tools/BUILD
@@ -17,6 +17,54 @@
     visibility = ["//visibility:public"],
 )
 
+JDK11_JVM_OPTS = select({
+    "@bazel_tools//src/conditions:openbsd": ["-Xbootclasspath/p:$(location @bazel_tools//tools/jdk:javac_jar)"],
+    "//conditions:default": [
+        "--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED",
+        "--add-exports=jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED",
+        "--add-exports=jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED",
+        "--add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED",
+        "--add-exports=jdk.compiler/com.sun.tools.javac.main=ALL-UNNAMED",
+        "--add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED",
+        "--add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED",
+        "--add-opens=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED",
+        "--patch-module=java.compiler=$(location @bazel_tools//tools/jdk:java_compiler_jar)",
+        "--patch-module=jdk.compiler=$(location @bazel_tools//tools/jdk:jdk_compiler_jar)",
+        "--add-opens=java.base/java.nio=ALL-UNNAMED",
+        "--add-opens=java.base/java.lang=ALL-UNNAMED",
+    ],
+})
+
+default_java_toolchain(
+    name = "error_prone_warnings_toolchain_java11",
+    bootclasspath = ["@bazel_tools//tools/jdk:platformclasspath.jar"],
+    forcibly_disable_header_compilation = False,
+    genclass = ["@bazel_tools//tools/jdk:genclass"],
+    header_compiler = ["@bazel_tools//tools/jdk:turbine"],
+    header_compiler_direct = ["@bazel_tools//tools/jdk:turbine_direct"],
+    ijar = ["@bazel_tools//tools/jdk:ijar"],
+    javabuilder = ["@bazel_tools//tools/jdk:javabuilder"],
+    javac = ["@bazel_tools//tools/jdk:javac_jar"],
+    javac_supports_workers = True,
+    jvm_opts = JDK11_JVM_OPTS,
+    misc = [
+        "-XDskipDuplicateBridges=true",
+        "-g",
+        "-parameters",
+    ],
+    package_configuration = [
+        ":error_prone",
+    ],
+    singlejar = ["@bazel_tools//tools/jdk:singlejar"],
+    source_version = "11",
+    target_version = "11",
+    tools = [
+        "@bazel_tools//tools/jdk:java_compiler_jar",
+        "@bazel_tools//tools/jdk:jdk_compiler_jar",
+    ],
+    visibility = ["//visibility:public"],
+)
+
 # Error Prone errors enabled by default; see ../.bazelrc for how this is
 # enabled. This warnings list is originally based on:
 # https://github.com/bazelbuild/BUILD_file_generator/blob/master/tools/bazel_defs/java.bzl