From 504a43fc479d884085df9895900608dc5b0aca6f Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Fri, 31 Jul 2026 07:52:35 +0000
Subject: [PATCH] Fix CodeQL warning-severity alerts: dead checks, boxed locals and three null dereferences (#793)

---
 opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/RootContainer.java                   |    4 
 opendj-server-legacy/src/main/java/org/opends/server/tasks/ImportTask.java                                   |   10 +
 opendj-server-legacy/src/main/java/org/opends/server/util/StaticUtils.java                                   |   11 
 opendj-core/src/main/java/org/forgerock/opendj/ldif/TemplateTag.java                                         |    3 
 opendj-server/src/main/java/org/forgerock/opendj/server/core/ProductInformation.java                         |    3 
 opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java                                  |    2 
 opendj-config/src/test/java/org/forgerock/opendj/config/dsconfig/BuildVersionTest.java                       |   46 ++++++
 opendj-core/src/main/java/com/forgerock/opendj/util/StringPrepProfile.java                                   |    3 
 opendj-server-legacy/src/main/java/org/opends/server/replication/service/ReplicationBroker.java              |    2 
 opendj-server-legacy/src/main/java/org/opends/server/core/MemoryQuota.java                                   |    3 
 opendj-server-legacy/replace.rb                                                                              |    4 
 opendj-server-legacy/src/main/java/org/opends/server/tools/dsreplication/ReplicationCliMain.java             |    4 
 opendj-server-legacy/src/main/java/org/opends/server/backends/LDIFBackend.java                               |    8 
 opendj-server-legacy/src/main/java/org/opends/server/core/ModifyDNOperationBasis.java                        |   32 +++
 opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA512PasswordStorageScheme.java       |    9 +
 opendj-maven-plugin/src/main/java/org/forgerock/opendj/maven/GenerateConfigMojo.java                         |    4 
 opendj-server-legacy/src/main/java/org/opends/server/loggers/JDKLogging.java                                 |    9 
 opendj-server-legacy/src/main/java/org/opends/quicksetup/installer/Installer.java                            |    4 
 opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/UTCTimeSyntaxImpl.java                            |   13 -
 opendj-doc-maven-plugin/src/main/java/org/forgerock/opendj/maven/doc/GenerateConfigurationReferenceMojo.java |    3 
 opendj-rest2ldap/src/main/java/org/forgerock/opendj/rest2ldap/schema/JsonQueryEqualityMatchingRuleImpl.java  |    3 
 opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/SchemaUtils.java                                  |   21 --
 opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/BindRule.java                  |    8 
 opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/NameForm.java                                     |    3 
 opendj-core/src/main/java/org/forgerock/opendj/ldap/InetAddressValidator.java                                |    3 
 opendj-rest2ldap/src/main/java/org/forgerock/opendj/rest2ldap/Rest2LdapHttpApplication.java                  |    5 
 opendj-server-legacy/src/main/java/org/opends/server/crypto/CryptoManagerImpl.java                           |    5 
 opendj-core/src/main/java/com/forgerock/opendj/util/ASCIICharProp.java                                       |    5 
 opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/util/Utilities.java                      |    4 
 opendj-server-legacy/src/main/java/org/opends/server/loggers/CommonAuditAccessLogPublisher.java              |    3 
 opendj-config/src/main/java/org/forgerock/opendj/config/dsconfig/BuildVersion.java                           |    8 
 opendj-core/src/main/java/org/forgerock/opendj/ldap/controls/PasswordPolicyResponseControl.java              |    3 
 opendj-server-legacy/src/main/java/org/opends/server/schema/GeneralizedTimeSyntax.java                       |    3 
 opendj-server-legacy/src/main/java/org/opends/server/tools/status/StatusCli.java                             |   20 ++
 opendj-server-legacy/src/snmp/src/org/opends/server/snmp/DsMIBImpl.java                                      |    6 
 opendj-server-legacy/src/main/java/org/opends/server/extensions/EntryCacheCommon.java                        |    7 
 opendj-core/src/main/java/org/forgerock/opendj/ldap/AVA.java                                                 |    3 
 opendj-server-legacy/src/main/java/org/opends/server/loggers/CommonAudit.java                                |    2 
 opendj-server-legacy/src/main/java/org/opends/server/types/Entry.java                                        |    4 
 opendj-server-legacy/src/main/java/org/opends/server/util/CronExecutorService.java                           |   13 +
 opendj-core/src/main/java/org/forgerock/opendj/ldap/AttributeFilter.java                                     |   15 +
 opendj-core/src/test/java/org/forgerock/opendj/ldap/AttributeFilterTestCase.java                             |   63 +++++++++
 opendj-core/src/main/java/org/forgerock/opendj/ldap/GeneralizedTime.java                                     |    6 
 opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java         |    9 +
 opendj-server-legacy/src/main/java/org/opends/server/replication/server/ServerHandler.java                   |    2 
 opendj-server-legacy/src/main/java/org/opends/server/tasks/PurgeConflictsHistoricalTask.java                 |   11 +
 opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/ui/GenericDialog.java                    |    5 
 47 files changed, 294 insertions(+), 123 deletions(-)

diff --git a/opendj-config/src/main/java/org/forgerock/opendj/config/dsconfig/BuildVersion.java b/opendj-config/src/main/java/org/forgerock/opendj/config/dsconfig/BuildVersion.java
index 7f33935..8dcd3e4 100644
--- a/opendj-config/src/main/java/org/forgerock/opendj/config/dsconfig/BuildVersion.java
+++ b/opendj-config/src/main/java/org/forgerock/opendj/config/dsconfig/BuildVersion.java
@@ -13,6 +13,7 @@
  *
  * Copyright 2008 Sun Microsystems, Inc.
  * Portions Copyright 2013-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.forgerock.opendj.config.dsconfig;
 
@@ -191,11 +192,8 @@
         if (major == version.major) {
             if (minor == version.minor) {
                 if (point == version.point) {
-                    if (rev == version.rev) {
-                        return 0;
-                    } else if (rev.compareTo(version.rev) < 0) {
-                        return -1;
-                    }
+                    // Compares the revisions as strings: they are VCS revisions, not numbers.
+                    return Integer.signum(rev.compareTo(version.rev));
                 } else if (point < version.point) {
                     return -1;
                 }
diff --git a/opendj-config/src/test/java/org/forgerock/opendj/config/dsconfig/BuildVersionTest.java b/opendj-config/src/test/java/org/forgerock/opendj/config/dsconfig/BuildVersionTest.java
new file mode 100644
index 0000000..305fd68
--- /dev/null
+++ b/opendj-config/src/test/java/org/forgerock/opendj/config/dsconfig/BuildVersionTest.java
@@ -0,0 +1,46 @@
+/*
+ * The contents of this file are subject to the terms of the Common Development and
+ * Distribution License (the License). You may not use this file except in compliance with the
+ * License.
+ *
+ * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+ * specific language governing permission and limitations under the License.
+ *
+ * When distributing Covered Software, include this CDDL Header Notice in each file and include
+ * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+ * Header, with the fields enclosed by brackets [] replaced by your own identifying
+ * information: "Portions copyright [year] [name of copyright owner]".
+ *
+ * Copyright 2026 3A Systems, LLC.
+ */
+package org.forgerock.opendj.config.dsconfig;
+
+import org.forgerock.testng.ForgeRockTestCase;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+@Test(groups = { "precommit", "config" })
+public class BuildVersionTest extends ForgeRockTestCase {
+
+    @Test
+    public void testEqualRevisionsCompareEqual() {
+        // Two distinct String instances holding the same revision: the revisions must be compared
+        // by value, not by reference.
+        final String rev = "abcdef";
+        final String sameRev = new StringBuilder(rev).toString();
+        Assert.assertEquals(new BuildVersion(4, 0, 0, rev).compareTo(new BuildVersion(4, 0, 0, sameRev)), 0);
+    }
+
+    @Test
+    public void testRevisionsOrderVersionsWhichAreOtherwiseEqual() {
+        Assert.assertEquals(new BuildVersion(4, 0, 0, "aaa").compareTo(new BuildVersion(4, 0, 0, "bbb")), -1);
+        Assert.assertEquals(new BuildVersion(4, 0, 0, "bbb").compareTo(new BuildVersion(4, 0, 0, "aaa")), 1);
+    }
+
+    @Test
+    public void testVersionNumbersTakePrecedenceOverRevisions() {
+        Assert.assertEquals(new BuildVersion(3, 9, 9, "zzz").compareTo(new BuildVersion(4, 0, 0, "aaa")), -1);
+        Assert.assertEquals(new BuildVersion(4, 1, 0, "aaa").compareTo(new BuildVersion(4, 0, 9, "zzz")), 1);
+        Assert.assertEquals(new BuildVersion(4, 0, 1, "aaa").compareTo(new BuildVersion(4, 0, 0, "zzz")), 1);
+    }
+}
diff --git a/opendj-core/src/main/java/com/forgerock/opendj/util/ASCIICharProp.java b/opendj-core/src/main/java/com/forgerock/opendj/util/ASCIICharProp.java
index fc8816b..86ee0ab 100644
--- a/opendj-core/src/main/java/com/forgerock/opendj/util/ASCIICharProp.java
+++ b/opendj-core/src/main/java/com/forgerock/opendj/util/ASCIICharProp.java
@@ -13,6 +13,7 @@
  *
  * Copyright 2009 Sun Microsystems, Inc.
  * Portions copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 
 package com.forgerock.opendj.util;
@@ -110,7 +111,7 @@
             this.isKeyChar = true;
             this.isCompatKeyChar = true;
             this.decimalValue = -1;
-            if (c >= 'a' && c <= 'f') {
+            if (c <= 'f') {
                 this.isHexChar = true;
                 this.hexValue = c - 87;
             } else {
@@ -127,7 +128,7 @@
             this.isKeyChar = true;
             this.isCompatKeyChar = true;
             this.decimalValue = -1;
-            if (c >= 'A' && c <= 'F') {
+            if (c <= 'F') {
                 this.isHexChar = true;
                 this.hexValue = c - 55;
             } else {
diff --git a/opendj-core/src/main/java/com/forgerock/opendj/util/StringPrepProfile.java b/opendj-core/src/main/java/com/forgerock/opendj/util/StringPrepProfile.java
index 7d2c291..2ba8f1c 100644
--- a/opendj-core/src/main/java/com/forgerock/opendj/util/StringPrepProfile.java
+++ b/opendj-core/src/main/java/com/forgerock/opendj/util/StringPrepProfile.java
@@ -13,6 +13,7 @@
  *
  * Copyright 2010 Sun Microsystems, Inc.
  * Portions Copyright 2015 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package com.forgerock.opendj.util;
 
@@ -462,7 +463,7 @@
                     if (canMapToSpace(buffer, trim)) {
                         buffer.append(SPACE_CHAR);
                     }
-                } else if ((b >= '\u0000' && b <= '\u0008') || (b >= '\u000E' && b <= '\u001F')
+                } else if (b <= '\u0008' || (b >= '\u000E' && b <= '\u001F')
                         || b == '\u007F') {
                     // These characters are mapped to nothing and hence not
                     // copied over..
diff --git a/opendj-core/src/main/java/org/forgerock/opendj/ldap/AVA.java b/opendj-core/src/main/java/org/forgerock/opendj/ldap/AVA.java
index 14ddecb..7d8774c 100644
--- a/opendj-core/src/main/java/org/forgerock/opendj/ldap/AVA.java
+++ b/opendj-core/src/main/java/org/forgerock/opendj/ldap/AVA.java
@@ -166,9 +166,10 @@
                         builder.append(StaticUtils.byteToLowerHex(b));
                     }
                 } else {
+                    // NUL needs no test here: it is already handled by the c < ' ' branch above.
                     if ((c == ' ' && si == length - 1)
                             || (c == '"' || c == '+' || c == ',' || c == ';' || c == '<'
-                            || c == '>' || c == '\\' || c == '\u0000' || c == '=')) {
+                            || c == '>' || c == '\\' || c == '=')) {
                         builder.append('\\');
                     }
                     builder.append(c);
diff --git a/opendj-core/src/main/java/org/forgerock/opendj/ldap/AttributeFilter.java b/opendj-core/src/main/java/org/forgerock/opendj/ldap/AttributeFilter.java
index c207ed8..345e912 100644
--- a/opendj-core/src/main/java/org/forgerock/opendj/ldap/AttributeFilter.java
+++ b/opendj-core/src/main/java/org/forgerock/opendj/ldap/AttributeFilter.java
@@ -12,6 +12,7 @@
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
  * Copyright 2013-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 
 package org.forgerock.opendj.ldap;
@@ -163,13 +164,19 @@
                  * requested by the user.
                  */
                 return new Iterable<Attribute>() {
-                    private boolean hasNextMustIterate = true;
-                    private final Iterator<Attribute> iterator = entry.getAllAttributes().iterator();
-                    private Attribute next = null;
-
                     @Override
                     public Iterator<Attribute> iterator() {
+                        /*
+                         * The iteration state belongs to the iterator, not to this Iterable:
+                         * keeping it here is what allows the Iterable to be iterated more than
+                         * once, including by the toString() below.
+                         */
                         return new Iterator<Attribute>() {
+                            private boolean hasNextMustIterate = true;
+                            private final Iterator<Attribute> iterator =
+                                    entry.getAllAttributes().iterator();
+                            private Attribute next;
+
                             @Override
                             public boolean hasNext() {
                                 if (hasNextMustIterate) {
diff --git a/opendj-core/src/main/java/org/forgerock/opendj/ldap/GeneralizedTime.java b/opendj-core/src/main/java/org/forgerock/opendj/ldap/GeneralizedTime.java
index d58dbcf..ac11537 100644
--- a/opendj-core/src/main/java/org/forgerock/opendj/ldap/GeneralizedTime.java
+++ b/opendj-core/src/main/java/org/forgerock/opendj/ldap/GeneralizedTime.java
@@ -836,9 +836,9 @@
 
     @Override
     public int compareTo(final GeneralizedTime o) {
-        final Long timeMS1 = getTimeInMillis();
-        final Long timeMS2 = o.getTimeInMillis();
-        return timeMS1.compareTo(timeMS2);
+        final long timeMS1 = getTimeInMillis();
+        final long timeMS2 = o.getTimeInMillis();
+        return Long.compare(timeMS1, timeMS2);
     }
 
     @Override
diff --git a/opendj-core/src/main/java/org/forgerock/opendj/ldap/InetAddressValidator.java b/opendj-core/src/main/java/org/forgerock/opendj/ldap/InetAddressValidator.java
index ab2c845..ef2cd7e 100644
--- a/opendj-core/src/main/java/org/forgerock/opendj/ldap/InetAddressValidator.java
+++ b/opendj-core/src/main/java/org/forgerock/opendj/ldap/InetAddressValidator.java
@@ -12,6 +12,7 @@
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
  * Portions copyright 2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 /*
  * Licensed to the Apache Software Foundation (ASF) under one or more
@@ -184,7 +185,7 @@
                     if (!inet6Address.endsWith(octet)) {
                         return false;
                     }
-                    if (index > octets.length - 1 || index > 6) {  // CHECKSTYLE IGNORE MagicNumber
+                    if (index > 6) {  // CHECKSTYLE IGNORE MagicNumber
                         // IPV4 occupies last two octets
                         return false;
                     }
diff --git a/opendj-core/src/main/java/org/forgerock/opendj/ldap/controls/PasswordPolicyResponseControl.java b/opendj-core/src/main/java/org/forgerock/opendj/ldap/controls/PasswordPolicyResponseControl.java
index 13e3d2f..be39394 100644
--- a/opendj-core/src/main/java/org/forgerock/opendj/ldap/controls/PasswordPolicyResponseControl.java
+++ b/opendj-core/src/main/java/org/forgerock/opendj/ldap/controls/PasswordPolicyResponseControl.java
@@ -138,8 +138,7 @@
                             // nested element.
                             reader.readStartSequence();
                             final int warningChoiceValue = (0x7F & reader.peekType());
-                            if (warningChoiceValue < 0
-                                    || warningChoiceValue >= PasswordPolicyWarningType.values().length) {
+                            if (warningChoiceValue >= PasswordPolicyWarningType.values().length) {
                                 final LocalizableMessage message =
                                         ERR_PWPOLICYRES_INVALID_WARNING_TYPE.get(byteToHex(reader
                                                 .peekType()));
diff --git a/opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/NameForm.java b/opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/NameForm.java
index 214bb0c..2e651a4 100644
--- a/opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/NameForm.java
+++ b/opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/NameForm.java
@@ -12,6 +12,7 @@
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
  * Copyright 2009 Sun Microsystems, Inc.
+ * Portions Copyright 2026 3A Systems, LLC.
  * Portions copyright 2011-2016 ForgeRock AS.
  */
 package org.forgerock.opendj.ldap.schema;
@@ -334,7 +335,7 @@
         if (builder.structuralObjectClassOID == null || builder.structuralObjectClassOID.isEmpty()) {
             throw new IllegalArgumentException("A structural class OID must be specified.");
         }
-        if (builder.requiredAttributes == null || builder.requiredAttributes.isEmpty()) {
+        if (builder.requiredAttributes.isEmpty()) {
             throw new IllegalArgumentException("Required attribute must be specified.");
         }
 
diff --git a/opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/SchemaUtils.java b/opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/SchemaUtils.java
index 5195e65..cb6bb24 100644
--- a/opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/SchemaUtils.java
+++ b/opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/SchemaUtils.java
@@ -13,7 +13,7 @@
  *
  * Copyright 2009 Sun Microsystems, Inc.
  * Portions copyright 2011-2016 ForgeRock AS.
- * Portions Copyright 2024 3A Systems, LLC.
+ * Portions Copyright 2024-2026 3A Systems, LLC.
  */
 package org.forgerock.opendj.ldap.schema;
 
@@ -229,11 +229,8 @@
                         && (c = reader.read()) != ' '
                         && c != ')'
                         && (c != '\'' || !enclosingQuote)) {
-                    if (length == 0 && !isAlpha(c)) {
-                        throw DecodeException.error(
-                                ERR_ATTR_SYNTAX_ILLEGAL_CHAR_IN_STRING_OID1.get(c, reader.pos() - 1));
-                    }
-
+                    // The first character was already required to be alphabetic by the enclosing
+                    // test, so only the key-character check is needed here.
                     if (!isKeyChar(c, allowCompatChars)) {
                         throw DecodeException.error(
                                 ERR_ATTR_SYNTAX_ILLEGAL_CHAR_IN_STRING_OID1.get(c, reader.pos() - 1));
@@ -326,11 +323,6 @@
                     }
                     length++;
                 }
-
-                if (length == 0) {
-                    throw DecodeException.error(
-                            ERR_ATTR_SYNTAX_OID_NO_VALUE1.get(reader.pos() - 1));
-                }
             } else if (isAlpha(c)) {
                 // This must be an attribute description. In this case, we will
                 // only accept alphabetic characters, numeric digits, and the hyphen.
@@ -338,11 +330,8 @@
                         && c != ')'
                         && c != '{'
                         && (c != '\'' || !enclosingQuote)) {
-                    if (length == 0 && !isAlpha(c)) {
-                        throw DecodeException.error(
-                                ERR_ATTR_SYNTAX_ILLEGAL_CHAR_IN_STRING_OID1.get(c, reader.pos() - 1));
-                    }
-
+                    // The first character was already required to be alphabetic by the enclosing
+                    // test, so only the key-character check is needed here.
                     if (!isKeyChar(c, allowCompatChars)) {
                         throw DecodeException.error(
                                 ERR_ATTR_SYNTAX_ILLEGAL_CHAR_IN_STRING_OID1.get(c, reader.pos() - 1));
diff --git a/opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/UTCTimeSyntaxImpl.java b/opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/UTCTimeSyntaxImpl.java
index 321e4cb..a199446 100644
--- a/opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/UTCTimeSyntaxImpl.java
+++ b/opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/UTCTimeSyntaxImpl.java
@@ -12,6 +12,7 @@
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
  * Copyright 2009 Sun Microsystems, Inc.
+ * Portions Copyright 2026 3A Systems, LLC.
  * Portions copyright 2012-2016 ForgeRock AS.
  */
 package org.forgerock.opendj.ldap.schema;
@@ -399,16 +400,8 @@
         case '3':
         case '4':
         case '5':
-            // There must be at least two more characters, and the next one
-            // must be a digit between 0 and 9.
-            if (length < 11) {
-                final LocalizableMessage message =
-                        ERR_ATTR_SYNTAX_UTC_TIME_INVALID_CHAR.get(valueString, String.valueOf(m1),
-                                8);
-                invalidReason.append(message);
-                return false;
-            }
-
+            // A length below 11 was already rejected at the top of this method, so the next
+            // character is present and must be a digit between 0 and 9.
             switch (valueString.charAt(9)) {
             case '0':
             case '1':
diff --git a/opendj-core/src/main/java/org/forgerock/opendj/ldif/TemplateTag.java b/opendj-core/src/main/java/org/forgerock/opendj/ldif/TemplateTag.java
index dfcabc9..3df49c2 100644
--- a/opendj-core/src/main/java/org/forgerock/opendj/ldif/TemplateTag.java
+++ b/opendj-core/src/main/java/org/forgerock/opendj/ldif/TemplateTag.java
@@ -13,6 +13,7 @@
  *
  * Copyright 2006-2009 Sun Microsystems, Inc.
  * Portions Copyright 2013-2015 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.forgerock.opendj.ldif;
 
@@ -1322,7 +1323,7 @@
         }
 
         private void initialize(String[] arguments, int lineNumber) throws DecodeException {
-            if (arguments.length < 0 || arguments.length > 2) {
+            if (arguments.length > 2) {
                 throw DecodeException.fatalError(ERR_ENTRY_GENERATOR_TAG_INVALID_ARGUMENT_RANGE_COUNT.get(
                         getName(), lineNumber, 0, 2, arguments.length));
             }
diff --git a/opendj-core/src/test/java/org/forgerock/opendj/ldap/AttributeFilterTestCase.java b/opendj-core/src/test/java/org/forgerock/opendj/ldap/AttributeFilterTestCase.java
new file mode 100644
index 0000000..13f05b4
--- /dev/null
+++ b/opendj-core/src/test/java/org/forgerock/opendj/ldap/AttributeFilterTestCase.java
@@ -0,0 +1,63 @@
+/*
+ * The contents of this file are subject to the terms of the Common Development and
+ * Distribution License (the License). You may not use this file except in compliance with the
+ * License.
+ *
+ * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+ * specific language governing permission and limitations under the License.
+ *
+ * When distributing Covered Software, include this CDDL Header Notice in each file and include
+ * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+ * Header, with the fields enclosed by brackets [] replaced by your own identifying
+ * information: "Portions copyright [year] [name of copyright owner]".
+ *
+ * Copyright 2026 3A Systems, LLC.
+ */
+package org.forgerock.opendj.ldap;
+
+import static org.fest.assertions.Assertions.assertThat;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.testng.annotations.Test;
+
+/**
+ * Test {@code AttributeFilter}.
+ */
+@SuppressWarnings("javadoc")
+public final class AttributeFilterTestCase extends SdkTestCase {
+
+    @Test
+    public void testFilteredViewCanBeIteratedMoreThanOnce() {
+        final Iterable<Attribute> attributes = filteredView().getAllAttributes();
+
+        final List<String> firstPass = namesOf(attributes);
+        assertThat(firstPass).isNotEmpty();
+        assertThat(namesOf(attributes)).isEqualTo(firstPass);
+    }
+
+    @Test
+    public void testFilteredViewCanBeIteratedAfterToString() {
+        final Iterable<Attribute> attributes = filteredView().getAllAttributes();
+
+        final List<String> expected = namesOf(attributes);
+        attributes.toString();
+        assertThat(namesOf(attributes)).isEqualTo(expected);
+    }
+
+    private Entry filteredView() {
+        final Entry entry =
+                new LinkedHashMapEntry("dn: cn=test", "objectClass: top", "objectClass: person",
+                        "cn: test", "sn: user");
+        return new AttributeFilter().filteredViewOf(entry);
+    }
+
+    private List<String> namesOf(final Iterable<Attribute> attributes) {
+        final List<String> names = new ArrayList<>();
+        for (final Attribute attribute : attributes) {
+            names.add(attribute.getAttributeDescriptionAsString());
+        }
+        return names;
+    }
+}
diff --git a/opendj-doc-maven-plugin/src/main/java/org/forgerock/opendj/maven/doc/GenerateConfigurationReferenceMojo.java b/opendj-doc-maven-plugin/src/main/java/org/forgerock/opendj/maven/doc/GenerateConfigurationReferenceMojo.java
index 5618a9f..94311a9 100644
--- a/opendj-doc-maven-plugin/src/main/java/org/forgerock/opendj/maven/doc/GenerateConfigurationReferenceMojo.java
+++ b/opendj-doc-maven-plugin/src/main/java/org/forgerock/opendj/maven/doc/GenerateConfigurationReferenceMojo.java
@@ -12,6 +12,7 @@
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
  * Copyright 2015-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.forgerock.opendj.maven.doc;
 
@@ -151,7 +152,7 @@
      */
     private void copyResources() throws IOException {
         for (String file : resourceFiles) {
-            InputStream original = this.getClass().getResourceAsStream("/config-ref/" + file);
+            InputStream original = GenerateConfigurationReferenceMojo.class.getResourceAsStream("/config-ref/" + file);
             File copy = new File(outputDirectory, file);
             copyInputStreamToFile(original, copy);
         }
diff --git a/opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java b/opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java
index 3b2d725..46630f4 100644
--- a/opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java
+++ b/opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java
@@ -234,7 +234,7 @@
       // assign the DSMLv2 schema for validation
       if(schema==null)
       {
-        URL url = getClass().getResource("/resources/DSMLv2.xsd");
+        URL url = DSMLServlet.class.getResource("/resources/DSMLv2.xsd");
         if ( url != null ) {
           SchemaFactory sf = SchemaFactory.newInstance(W3C_XML_SCHEMA_NS_URI);
           schema = sf.newSchema(url);
diff --git a/opendj-maven-plugin/src/main/java/org/forgerock/opendj/maven/GenerateConfigMojo.java b/opendj-maven-plugin/src/main/java/org/forgerock/opendj/maven/GenerateConfigMojo.java
index 6ab98dc..94f87ec 100644
--- a/opendj-maven-plugin/src/main/java/org/forgerock/opendj/maven/GenerateConfigMojo.java
+++ b/opendj-maven-plugin/src/main/java/org/forgerock/opendj/maven/GenerateConfigMojo.java
@@ -184,7 +184,7 @@
         } else if (!isXMLPackageDirectoryValid()) {
             throw new MojoExecutionException("The XML definition directory \""
                     + getXMLPackageDirectory() + "\" does not exist.");
-        } else if (getClass().getResource(getStylesheetDirectory()) == null) {
+        } else if (GenerateConfigMojo.class.getResource(getStylesheetDirectory()) == null) {
             throw new MojoExecutionException("The XSLT stylesheet directory \""
                     + getStylesheetDirectory() + "\" does not exist.");
         }
@@ -439,7 +439,7 @@
     private Templates loadStylesheet(final String stylesheet)
             throws TransformerConfigurationException {
         final Source xslt =
-                new StreamSource(getClass().getResourceAsStream(
+                new StreamSource(GenerateConfigMojo.class.getResourceAsStream(
                         getStylesheetDirectory() + "/" + stylesheet));
         return stylesheetFactory.newTemplates(xslt);
     }
diff --git a/opendj-rest2ldap/src/main/java/org/forgerock/opendj/rest2ldap/Rest2LdapHttpApplication.java b/opendj-rest2ldap/src/main/java/org/forgerock/opendj/rest2ldap/Rest2LdapHttpApplication.java
index c70ec32..1cacf95 100644
--- a/opendj-rest2ldap/src/main/java/org/forgerock/opendj/rest2ldap/Rest2LdapHttpApplication.java
+++ b/opendj-rest2ldap/src/main/java/org/forgerock/opendj/rest2ldap/Rest2LdapHttpApplication.java
@@ -13,6 +13,7 @@
  *
  * Copyright 2015-2016 ForgeRock AS.
  * Portions Copyright 2017 Rosie Applications, Inc.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.forgerock.opendj.rest2ldap;
 
@@ -176,10 +177,10 @@
     public Rest2LdapHttpApplication() {
         try {
             // The null check is required for unit test mocks because the resource does not exist.
-            final URL configUrl = getClass().getResource("/config.json");
+            final URL configUrl = Rest2LdapHttpApplication.class.getResource("/config.json");
             this.configDirectory = configUrl != null ? new File(configUrl.toURI()).getParentFile() : null;
         } catch (final URISyntaxException e) {
-            throw new IllegalStateException(""+getClass().getResource("/config.json"),e);
+            throw new IllegalStateException("" + Rest2LdapHttpApplication.class.getResource("/config.json"), e);
         }
         this.schema = Schema.getDefaultSchema();
     }
diff --git a/opendj-rest2ldap/src/main/java/org/forgerock/opendj/rest2ldap/schema/JsonQueryEqualityMatchingRuleImpl.java b/opendj-rest2ldap/src/main/java/org/forgerock/opendj/rest2ldap/schema/JsonQueryEqualityMatchingRuleImpl.java
index 8e64239..ee3600c 100644
--- a/opendj-rest2ldap/src/main/java/org/forgerock/opendj/rest2ldap/schema/JsonQueryEqualityMatchingRuleImpl.java
+++ b/opendj-rest2ldap/src/main/java/org/forgerock/opendj/rest2ldap/schema/JsonQueryEqualityMatchingRuleImpl.java
@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.forgerock.opendj.rest2ldap.schema;
 
@@ -430,7 +431,7 @@
         if (value == null) {
             return createNullIndexKey(builder);
         } else if (value instanceof Number) {
-            final Double doubleValue = ((Number) value).doubleValue();
+            final double doubleValue = ((Number) value).doubleValue();
             return createNumberIndexKey(builder, BigDecimal.valueOf(doubleValue));
         } else if (value instanceof Boolean) {
             final Boolean booleanValue = (Boolean) value;
diff --git a/opendj-server-legacy/replace.rb b/opendj-server-legacy/replace.rb
index a4b73e3..8697a14 100755
--- a/opendj-server-legacy/replace.rb
+++ b/opendj-server-legacy/replace.rb
@@ -1,4 +1,7 @@
 #!/usr/bin/env ruby
+#
+# Portions Copyright 2026 3A Systems, LLC.
+#
 
 require 'fileutils'
 
@@ -471,7 +474,6 @@
       (0..replacements.size-1).step(2).each { |index|
         pattern, replace = replacements[index], replacements[index+1]
         replace = replace.gsub('{CLASSNAME}', classname(file))
-        is_replaced = true
         #while is_replaced
           #puts "pattern: " + pattern.to_s
           is_replaced = contents.gsub!(pattern, replace)
diff --git a/opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/ui/GenericDialog.java b/opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/ui/GenericDialog.java
index e81c995..f0dec5f 100644
--- a/opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/ui/GenericDialog.java
+++ b/opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/ui/GenericDialog.java
@@ -13,6 +13,7 @@
  *
  * Copyright 2008-2009 Sun Microsystems, Inc.
  * Portions Copyright 2014-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.guitools.controlpanel.ui;
 
@@ -200,10 +201,6 @@
     }
     if (visible && lastComponentWithFocus != null && lastComponentWithFocus.isVisible())
     {
-      if (lastComponentWithFocus == null)
-      {
-        lastComponentWithFocus = panel.getPreferredFocusComponent();
-      }
       lastComponentWithFocus.requestFocusInWindow();
     }
     updateDefaultButton(panel);
diff --git a/opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/util/Utilities.java b/opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/util/Utilities.java
index 86dc38a..e450e1b 100644
--- a/opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/util/Utilities.java
+++ b/opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/util/Utilities.java
@@ -2412,7 +2412,7 @@
       {
         return NO_VALUE_SET.toString();
       }
-      Long l = Long.parseLong(monitoringValue);
+      long l = Long.parseLong(monitoringValue);
       Date date = new Date(l);
       return ConfigFromConnection.newDateFormatter().format(date);
     }
@@ -2438,7 +2438,7 @@
     }
     else if (attr.isValueInBytes())
     {
-      Long l = Long.parseLong(monitoringValue);
+      long l = Long.parseLong(monitoringValue);
       long mb = l / (1024 * 1024);
       long kbs = (l - mb * 1024 * 1024) / 1024;
       return INFO_CTRL_PANEL_MEMORY_VALUE.get(mb, kbs).toString();
diff --git a/opendj-server-legacy/src/main/java/org/opends/quicksetup/installer/Installer.java b/opendj-server-legacy/src/main/java/org/opends/quicksetup/installer/Installer.java
index 2c787e8..4ca49eb 100644
--- a/opendj-server-legacy/src/main/java/org/opends/quicksetup/installer/Installer.java
+++ b/opendj-server-legacy/src/main/java/org/opends/quicksetup/installer/Installer.java
@@ -595,7 +595,7 @@
     int cumulatedTime = 0;
     for (InstallProgressStep s : steps)
     {
-      Integer statusTime = s.getRelativeDuration();
+      int statusTime = s.getRelativeDuration();
       hmRatio.put(s, (100 * cumulatedTime) / totalTime);
       cumulatedTime += statusTime;
     }
@@ -2683,7 +2683,7 @@
             {
               throw new ApplicationException(ReturnCode.APPLICATION_ERROR, pnfe.getMessageObject(), null);
             }
-            StaticUtils.sleep((5 - nTries) * 3000);
+            StaticUtils.sleep((5 - nTries) * 3000L);
           }
           nTries--;
         }
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/BindRule.java b/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/BindRule.java
index 8eacf35..5148610 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/BindRule.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/BindRule.java
@@ -529,11 +529,9 @@
      *          should be appended.
      */
     public final void toString(StringBuilder buffer) {
-        if (this.keywordRuleMap != null) {
-            for (KeywordBindRule rule : this.keywordRuleMap.values()) {
-                rule.toString(buffer);
-                buffer.append(";");
-            }
+        for (KeywordBindRule rule : this.keywordRuleMap.values()) {
+            rule.toString(buffer);
+            buffer.append(";");
         }
     }
 }
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/backends/LDIFBackend.java b/opendj-server-legacy/src/main/java/org/opends/server/backends/LDIFBackend.java
index 2d7ad26..bbcded9 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/backends/LDIFBackend.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/backends/LDIFBackend.java
@@ -13,6 +13,7 @@
  *
  * Copyright 2007-2008 Sun Microsystems, Inc.
  * Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.server.backends;
 
@@ -366,12 +367,7 @@
 
     try
     {
-      if (entryMap != null)
-      {
-        return entryMap.size();
-      }
-
-      return -1;
+      return entryMap.size();
     }
     finally
     {
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/RootContainer.java b/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/RootContainer.java
index e2fe9af..1adc22a 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/RootContainer.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/RootContainer.java
@@ -13,6 +13,7 @@
  *
  * Copyright 2006-2010 Sun Microsystems, Inc.
  * Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.server.backends.pluggable;
 
@@ -229,7 +230,8 @@
       }
     }
 
-    nextEntryID = new AtomicLong(highestID.longValue() + 1);
+    // highestID is null when there was no base DN to open, in which case numbering starts at 1.
+    nextEntryID = new AtomicLong(highestID != null ? highestID.longValue() + 1 : 1);
   }
 
   /**
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/core/MemoryQuota.java b/opendj-server-legacy/src/main/java/org/opends/server/core/MemoryQuota.java
index 32af3eb..9503ef8 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/core/MemoryQuota.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/core/MemoryQuota.java
@@ -12,6 +12,7 @@
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
  * Copyright 2015 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.server.core;
 
@@ -132,7 +133,7 @@
    */
   public long memPercentToBytes(int percent)
   {
-    return (reservableMemory * percent / 100) * ONE_MEGABYTE;
+    return ((long) reservableMemory * percent / 100) * ONE_MEGABYTE;
   }
 
   /**
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/core/ModifyDNOperationBasis.java b/opendj-server-legacy/src/main/java/org/opends/server/core/ModifyDNOperationBasis.java
index baaa1f3..ac907e6 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/core/ModifyDNOperationBasis.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/core/ModifyDNOperationBasis.java
@@ -13,6 +13,7 @@
  *
  * Copyright 2006-2010 Sun Microsystems, Inc.
  * Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.server.core;
 
@@ -92,6 +93,12 @@
   private DN newDN;
 
   /**
+   * Indicates whether the new entry DN has already been computed. The computation does not always
+   * yield a DN, and its failure is recorded on the operation, so it must not be repeated.
+   */
+  private boolean newDNComputed;
+
+  /**
    * Creates a new modify DN operation with the provided information.
    *
    * @param  clientConnection  The client connection with which this operation
@@ -188,6 +195,9 @@
     this.rawEntryDN = rawEntryDN;
 
     entryDN = null;
+    // The new DN is derived from the entry DN, so a failed computation must be allowed to run
+    // again. Any DN already computed is left in place, as it was before this flag existed.
+    newDNComputed = false;
   }
 
   @Override
@@ -228,6 +238,7 @@
 
     newRDN = null;
     newDN = null;
+    newDNComputed = false;
   }
 
   @Override
@@ -275,6 +286,7 @@
 
     newSuperior = null;
     newDN = null;
+    newDNComputed = false;
   }
 
   @Override
@@ -510,17 +522,22 @@
   @Override
   public DN getNewDN()
   {
-    if (newDN == null)
+    if (newDN == null && !newDNComputed)
     {
+      newDNComputed = true;
+
       // Construct the new DN to use for the entry.
-      DN parentDN = null;
+      DN parentDN;
       if (getNewSuperior() == null)
       {
-        if (getEntryDN() != null)
+        if (getEntryDN() == null)
         {
-          parentDN = DirectoryServer.getInstance().getServerContext().getBackendConfigManager()
-              .getParentDNInSuffix(entryDN);
+          // The raw DN could not be parsed and INVALID_DN_SYNTAX has already been recorded for it,
+          // so leave that diagnosis in place rather than replacing it with a less precise one.
+          return null;
         }
+        parentDN = DirectoryServer.getInstance().getServerContext().getBackendConfigManager()
+            .getParentDNInSuffix(entryDN);
       }
       else
       {
@@ -531,6 +548,11 @@
       {
         setResultCode(ResultCode.UNWILLING_TO_PERFORM);
         appendErrorMessage(ERR_MODDN_NO_PARENT.get(entryDN));
+        if (parentDN == null)
+        {
+          // Without a parent there is no new DN to build; the error set above is the outcome.
+          return null;
+        }
       }
       newDN = parentDN.child(getNewRDN());
     }
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/crypto/CryptoManagerImpl.java b/opendj-server-legacy/src/main/java/org/opends/server/crypto/CryptoManagerImpl.java
index 04f3347..c2f0cb3 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/crypto/CryptoManagerImpl.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/crypto/CryptoManagerImpl.java
@@ -14,6 +14,7 @@
  * Copyright 2006-2010 Sun Microsystems, Inc.
  * Portions Copyright 2009 Parametric Technology Corporation (PTC)
  * Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.server.crypto;
 
@@ -312,7 +313,7 @@
 
     // Requested encryption cipher validation.
     String requestedCipherTransformation = cfg.getCipherTransformation();
-    Integer requestedCipherTransformationKeyLengthBits = cfg.getCipherKeyLength();
+    int requestedCipherTransformationKeyLengthBits = cfg.getCipherKeyLength();
     if (! requestedCipherTransformation.equals(
             this.preferredCipherTransformation) ||
         requestedCipherTransformationKeyLengthBits !=
@@ -341,7 +342,7 @@
 
     // Requested MAC algorithm validation.
     String requestedMACAlgorithm = cfg.getMacAlgorithm();
-    Integer requestedMACAlgorithmKeyLengthBits = cfg.getMacKeyLength();
+    int requestedMACAlgorithmKeyLengthBits = cfg.getMacKeyLength();
     if (!requestedMACAlgorithm.equals(this.preferredMACAlgorithm) ||
          requestedMACAlgorithmKeyLengthBits !=
               this.preferredMACAlgorithmKeyLengthBits)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/extensions/EntryCacheCommon.java b/opendj-server-legacy/src/main/java/org/opends/server/extensions/EntryCacheCommon.java
index bb06b58..b353c6b 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/extensions/EntryCacheCommon.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/extensions/EntryCacheCommon.java
@@ -13,6 +13,7 @@
  *
  * Copyright 2006-2008 Sun Microsystems, Inc.
  * Portions Copyright 2014-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.server.extensions;
 
@@ -362,11 +363,11 @@
       // Cache misses is required to get cache tries and hit ratio.
       if (cacheMisses != null)
       {
-        Long cacheTries = cacheHits + cacheMisses;
+        long cacheTries = cacheHits + cacheMisses;
         attrs.add("entryCacheTries", cacheTries);
 
-        Double hitRatioRaw = cacheTries > 0 ? cacheHits.doubleValue()
-            / cacheTries.doubleValue() : cacheHits.doubleValue() / 1;
+        double hitRatioRaw = cacheTries > 0 ? cacheHits.doubleValue()
+            / cacheTries : cacheHits.doubleValue();
         Double hitRatio = hitRatioRaw * 100D;
         attrs.add("entryCacheHitRatio", hitRatio);
       }
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java b/opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java
index afb064c..e417e1c 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java
@@ -60,6 +60,13 @@
   /** The number of bytes of random data to use as the salt when generating the hashes. */
   private static final int NUM_SALT_BYTES = 8;
 
+  /**
+   * Source of randomness for the offline encoding, which has no access to the server's
+   * crypto manager. A single instance is shared because {@code SecureRandom} is thread-safe
+   * and reseeding it for every password would weaken it.
+   */
+  private static final SecureRandom OFFLINE_RANDOM = new SecureRandom();
+
   /** The number of bytes SHA algorithm produces. */
   private static final int SHA1_LENGTH = 20;
 
@@ -423,7 +430,7 @@
          throws DirectoryException
   {
     byte[] saltBytes = new byte[NUM_SALT_BYTES];
-    new SecureRandom().nextBytes(saltBytes);
+    OFFLINE_RANDOM.nextBytes(saltBytes);
 
     byte[] passwordPlusSalt = new byte[passwordBytes.length + NUM_SALT_BYTES];
     System.arraycopy(passwordBytes, 0, passwordPlusSalt, 0,
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA512PasswordStorageScheme.java b/opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA512PasswordStorageScheme.java
index 1fa32d9..23d969b 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA512PasswordStorageScheme.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/extensions/SaltedSHA512PasswordStorageScheme.java
@@ -60,6 +60,13 @@
   /** The number of bytes of random data to use as the salt when generating the hashes. */
   private static final int NUM_SALT_BYTES = 8;
 
+  /**
+   * Source of randomness for the offline encoding, which has no access to the server's
+   * crypto manager. A single instance is shared because {@code SecureRandom} is thread-safe
+   * and reseeding it for every password would weaken it.
+   */
+  private static final SecureRandom OFFLINE_RANDOM = new SecureRandom();
+
   /** The size of the digest in bytes. */
   private static final int SHA512_LENGTH = 512 / 8;
 
@@ -427,7 +434,7 @@
          throws DirectoryException
   {
     byte[] saltBytes = new byte[NUM_SALT_BYTES];
-    new SecureRandom().nextBytes(saltBytes);
+    OFFLINE_RANDOM.nextBytes(saltBytes);
 
     byte[] passwordPlusSalt = new byte[passwordBytes.length + NUM_SALT_BYTES];
     System.arraycopy(passwordBytes, 0, passwordPlusSalt, 0,
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/loggers/CommonAudit.java b/opendj-server-legacy/src/main/java/org/opends/server/loggers/CommonAudit.java
index c64a4bb..3a5c95c 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/loggers/CommonAudit.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/loggers/CommonAudit.java
@@ -358,7 +358,7 @@
       throws IOException, AuditException, ConfigException
   {
     final JsonValue jsonConfig;
-    try (InputStream input = getClass().getResourceAsStream(AUDIT_SERVICE_JSON_CONFIGURATION_FILE))
+    try (InputStream input = CommonAudit.class.getResourceAsStream(AUDIT_SERVICE_JSON_CONFIGURATION_FILE))
     {
       jsonConfig = AuditJsonConfig.getJson(input);
     }
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/loggers/CommonAuditAccessLogPublisher.java b/opendj-server-legacy/src/main/java/org/opends/server/loggers/CommonAuditAccessLogPublisher.java
index c0129b1..d281050 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/loggers/CommonAuditAccessLogPublisher.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/loggers/CommonAuditAccessLogPublisher.java
@@ -12,6 +12,7 @@
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
  * Copyright 2015-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.server.loggers;
 
@@ -501,7 +502,7 @@
 
   private Pair<Long,TimeUnit> getExecutionTime(final Operation operation)
   {
-    Long etime = operation.getProcessingNanoTime();
+    long etime = operation.getProcessingNanoTime();
     // if not configured for nanos, use millis
     return etime <= -1 ?
         Pair.of(operation.getProcessingTime(), TimeUnit.MILLISECONDS) :
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/loggers/JDKLogging.java b/opendj-server-legacy/src/main/java/org/opends/server/loggers/JDKLogging.java
index 5fbb17a..51f0986 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/loggers/JDKLogging.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/loggers/JDKLogging.java
@@ -12,6 +12,7 @@
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
  * Copyright 2014-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.server.loggers;
 
@@ -112,14 +113,16 @@
     @Override
     public void publish(LogRecord record)
     {
-      if (getFormatter() == null)
+      // These calls resolve to Handler's own formatter, not to the enclosing
+      // JDKLogging.getFormatter(); qualify them so that is unambiguous.
+      if (super.getFormatter() == null)
       {
-        setFormatter(new SimpleFormatter());
+        super.setFormatter(new SimpleFormatter());
       }
 
       try
       {
-        String message = getFormatter().format(record);
+        String message = super.getFormatter().format(record);
         if (record.getLevel().intValue() >= Level.WARNING.intValue())
         {
           err.write(message.getBytes());
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/replication/server/ServerHandler.java b/opendj-server-legacy/src/main/java/org/opends/server/replication/server/ServerHandler.java
index ccb3ebd..8037b16 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/replication/server/ServerHandler.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/replication/server/ServerHandler.java
@@ -791,7 +791,7 @@
     final Random random = new Random();
     final int randomTime = random.nextInt(6); // Random from 0 to 5
     // Wait at least 3 seconds + (0 to 5 seconds)
-    final long timeout = 3000 + randomTime * 1000;
+    final long timeout = 3000 + randomTime * 1000L;
     final boolean lockAcquired = replicationServerDomain.tryLock(timeout);
     if (!lockAcquired)
     {
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/replication/service/ReplicationBroker.java b/opendj-server-legacy/src/main/java/org/opends/server/replication/service/ReplicationBroker.java
index 9e59eb1..adf6c7e 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/replication/service/ReplicationBroker.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/replication/service/ReplicationBroker.java
@@ -1341,7 +1341,7 @@
     {
       if (foundBestRS())
       {
-        final Integer bestRSServerId = getBestRS().getServerId();
+        final int bestRSServerId = getBestRS().getServerId();
         if (rsEvals.get(bestRSServerId) == null)
         {
           final LocalizableMessage eval = NOTE_BEST_RS.get(bestRSServerId, localServerId);
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/schema/GeneralizedTimeSyntax.java b/opendj-server-legacy/src/main/java/org/opends/server/schema/GeneralizedTimeSyntax.java
index 4fc037c..075f539 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/schema/GeneralizedTimeSyntax.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/schema/GeneralizedTimeSyntax.java
@@ -14,6 +14,7 @@
  * Copyright 2006-2009 Sun Microsystems, Inc.
  * Portions Copyright 2009 D. J. Hagberg, Millibits Consulting, Inc.
  * Portions Copyright 2012-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.server.schema;
 
@@ -1199,7 +1200,7 @@
               ResultCode.INVALID_ATTRIBUTE_SYNTAX, message);
     }
 
-    Double fractionValue = Double.parseDouble(fractionBuffer.toString());
+    double fractionValue = Double.parseDouble(fractionBuffer.toString());
     long additionalMilliseconds = Math.round(fractionValue * multiplier);
 
     try
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/tasks/ImportTask.java b/opendj-server-legacy/src/main/java/org/opends/server/tasks/ImportTask.java
index 648c97b..f2f12a2 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/tasks/ImportTask.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/tasks/ImportTask.java
@@ -13,6 +13,7 @@
  *
  * Copyright 2006-2009 Sun Microsystems, Inc.
  * Portions Copyright 2013-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.server.tasks;
 
@@ -475,6 +476,15 @@
       }
     }
 
+    if (backend == null)
+    {
+      // Unlike initializeTask(), this method does not reject an include branch which resolves to no
+      // backend, so none of them having resolved leaves nothing to import into. The message of the
+      // backend ID case is reused here rather than adding a new one for a malformed task.
+      logger.error(ERR_LDIFIMPORT_NO_BACKENDS_FOR_ID);
+      return TaskState.STOPPED_BY_ERROR;
+    }
+
     // Find backends with subordinate base DNs that should be excluded from the import.
     defaultIncludeBranches = new HashSet<>(backend.getBaseDNs());
     for (Backend<?> subBackend : getServerContext().getBackendConfigManager().getSubordinateBackends(backend))
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/tasks/PurgeConflictsHistoricalTask.java b/opendj-server-legacy/src/main/java/org/opends/server/tasks/PurgeConflictsHistoricalTask.java
index 82affe6..e27421d 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/tasks/PurgeConflictsHistoricalTask.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/tasks/PurgeConflictsHistoricalTask.java
@@ -13,6 +13,7 @@
  *
  * Copyright 2006-2010 Sun Microsystems, Inc.
  * Portions Copyright 2013-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.server.tasks;
 
@@ -123,18 +124,20 @@
   @Override
   protected TaskState runTask()
   {
-    Boolean purgeCompletedInTime = false;
+    boolean purgeCompletedInTime = false;
     logger.trace("PurgeConflictsHistoricalTask is starting on domain: %s max duration (sec): %d",
         domain.getBaseDN(), purgeTaskMaxDurationInSec);
     try
     {
-      replaceAttributeValue(ATTR_TASK_CONFLICTS_HIST_PURGE_COMPLETED_IN_TIME, purgeCompletedInTime.toString());
+      replaceAttributeValue(ATTR_TASK_CONFLICTS_HIST_PURGE_COMPLETED_IN_TIME,
+          String.valueOf(purgeCompletedInTime));
 
       // launch the task
-      domain.purgeConflictsHistorical(this, TimeThread.getTime() + purgeTaskMaxDurationInSec*1000);
+      domain.purgeConflictsHistorical(this, TimeThread.getTime() + purgeTaskMaxDurationInSec * 1000L);
 
       purgeCompletedInTime = true;
-      replaceAttributeValue(ATTR_TASK_CONFLICTS_HIST_PURGE_COMPLETED_IN_TIME, purgeCompletedInTime.toString());
+      replaceAttributeValue(ATTR_TASK_CONFLICTS_HIST_PURGE_COMPLETED_IN_TIME,
+          String.valueOf(purgeCompletedInTime));
 
       initState =  TaskState.COMPLETED_SUCCESSFULLY;
     }
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/tools/dsreplication/ReplicationCliMain.java b/opendj-server-legacy/src/main/java/org/opends/server/tools/dsreplication/ReplicationCliMain.java
index 07227ff..716009f 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/tools/dsreplication/ReplicationCliMain.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/tools/dsreplication/ReplicationCliMain.java
@@ -6595,7 +6595,7 @@
               ERR_REPLICATION_INITIALIZING_TRIES_COMPLETED.get(
                   pnfe.getMessageObject()), INITIALIZING_TRIES_COMPLETED, pnfe);
         }
-        sleepCatchInterrupt((5 - nTries) * 3000);
+        sleepCatchInterrupt((5 - nTries) * 3000L);
       }
       catch (ApplicationException ae)
       {
@@ -6648,7 +6648,7 @@
               ERR_REPLICATION_INITIALIZING_TRIES_COMPLETED.get(
                   pnfe.getMessageObject()), INITIALIZING_TRIES_COMPLETED, pnfe);
         }
-        sleepCatchInterrupt((5 - nTries) * 3000);
+        sleepCatchInterrupt((5 - nTries) * 3000L);
       }
       catch (ClientException ae)
       {
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/tools/status/StatusCli.java b/opendj-server-legacy/src/main/java/org/opends/server/tools/status/StatusCli.java
index 86a47b9..ac59a12 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/tools/status/StatusCli.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/tools/status/StatusCli.java
@@ -79,7 +79,6 @@
 import org.opends.server.types.InitializationException;
 import org.opends.server.types.NullOutputStream;
 import org.opends.server.util.BuildVersion;
-import org.opends.server.util.StaticUtils;
 import org.opends.server.util.cli.LDAPConnectionConsoleInteraction;
 
 import com.forgerock.opendj.cli.ArgumentException;
@@ -355,9 +354,10 @@
     writeStatus(controlInfo.getServerDescriptor());
     int period = argParser.getRefreshPeriod();
     boolean first = true;
-    while (period > 0)
+    // A positive refresh period means refreshing until the command is interrupted.
+    while (period > 0 && !Thread.currentThread().isInterrupted())
     {
-      long timeToSleep = period * 1000;
+      long timeToSleep = period * 1000L;
       if (!first)
       {
         long t1 = System.currentTimeMillis();
@@ -369,7 +369,17 @@
 
       if (timeToSleep > 0)
       {
-        StaticUtils.sleep(timeToSleep);
+        try
+        {
+          // Not StaticUtils.sleep(): it discards the interruption, which would leave this loop
+          // running with no way for the caller to stop it.
+          Thread.sleep(timeToSleep);
+        }
+        catch (InterruptedException e)
+        {
+          Thread.currentThread().interrupt();
+          break;
+        }
       }
       println();
       println(LocalizableMessage.raw("          ---------------------"));
@@ -1125,7 +1135,7 @@
     // Interact with the user though the console to get
     // LDAP connection information
     final String hostName = getHostNameForLdapUrl(ci.getHostName());
-    final Integer portNumber = ci.getPortNumber();
+    final int portNumber = ci.getPortNumber();
     final DN bindDN = ci.getBindDN();
     final String bindPassword = ci.getBindPassword();
     TrustManager trustManager = ci.getTrustManager();
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/types/Entry.java b/opendj-server-legacy/src/main/java/org/opends/server/types/Entry.java
index c8087de..9bab17e 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/types/Entry.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/types/Entry.java
@@ -13,7 +13,7 @@
  *
  * Copyright 2006-2010 Sun Microsystems, Inc.
  * Portions Copyright 2011-2016 ForgeRock AS.
- * Portions Copyright 2023-2024 3A Systems, LLC.
+ * Portions Copyright 2023-2026 3A Systems, LLC.
  */
 package org.opends.server.types;
 
@@ -3357,7 +3357,7 @@
     {
       // The first byte must be the entry version.  If it's not one
       // we recognize, then that's an error.
-      Byte version = entryBuffer.readByte();
+      byte version = entryBuffer.readByte();
       if (version != 0x03 && version != 0x02 && version != 0x01)
       {
         LocalizableMessage message = ERR_ENTRY_DECODE_UNRECOGNIZED_VERSION.get(
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/util/CronExecutorService.java b/opendj-server-legacy/src/main/java/org/opends/server/util/CronExecutorService.java
index 6b74dc8..22486ec 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/util/CronExecutorService.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/util/CronExecutorService.java
@@ -12,6 +12,7 @@
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
  * Copyright 2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.server.util;
 
@@ -90,8 +91,11 @@
     @Override
     public boolean cancel(boolean mayInterruptIfRunning)
     {
-      return schedulerFuture.cancel(mayInterruptIfRunning)
-          | (executorFuture != null && executorFuture.cancel(mayInterruptIfRunning));
+      // Both futures must be cancelled, so neither call may be short circuited.
+      final boolean schedulerCancelled = schedulerFuture.cancel(mayInterruptIfRunning);
+      final boolean executorCancelled =
+          executorFuture != null && executorFuture.cancel(mayInterruptIfRunning);
+      return schedulerCancelled || executorCancelled;
     }
 
     @Override
@@ -351,7 +355,10 @@
   @Override
   public boolean awaitTermination(final long timeout, final TimeUnit unit) throws InterruptedException
   {
-    return cronScheduler.awaitTermination(timeout, unit) & cronExecutorService.awaitTermination(timeout, unit);
+    // Both services must be awaited, so neither call may be short circuited.
+    final boolean schedulerTerminated = cronScheduler.awaitTermination(timeout, unit);
+    final boolean executorTerminated = cronExecutorService.awaitTermination(timeout, unit);
+    return schedulerTerminated && executorTerminated;
   }
 
   @Override
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/util/StaticUtils.java b/opendj-server-legacy/src/main/java/org/opends/server/util/StaticUtils.java
index 5e344e8..e4d8c8e 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/util/StaticUtils.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/util/StaticUtils.java
@@ -511,11 +511,7 @@
       int firstByte = 0xFF & a[i];
       int secondByte = 0xFF & a2[i];
       if (firstByte != secondByte) {
-        if (firstByte < secondByte) {
-          return -1;
-        } else if (firstByte > secondByte) {
-          return 1;
-        }
+        return firstByte < secondByte ? -1 : 1;
       }
     }
 
@@ -1795,7 +1791,10 @@
         }
       }
 
-      return successful & file.delete();
+      // The delete must be attempted even when a child could not be removed, so it is
+      // evaluated into a local before being combined with the running result.
+      final boolean deleted = file.delete();
+      return successful && deleted;
     }
     return false;
   }
diff --git a/opendj-server-legacy/src/snmp/src/org/opends/server/snmp/DsMIBImpl.java b/opendj-server-legacy/src/snmp/src/org/opends/server/snmp/DsMIBImpl.java
index 204aaac..d616140 100644
--- a/opendj-server-legacy/src/snmp/src/org/opends/server/snmp/DsMIBImpl.java
+++ b/opendj-server-legacy/src/snmp/src/org/opends/server/snmp/DsMIBImpl.java
@@ -238,8 +238,7 @@
               this.mib, this.server, this.applIndex);
 
       // if the entry already exists nothing to do
-      if ((this.dsTableEntries.containsKey(entry.getObjectName())) ||
-              (entry == null)) {
+      if (this.dsTableEntries.containsKey(entry.getObjectName())) {
         return true;
       }
 
@@ -279,8 +278,7 @@
               this.applIndex, this.applIfOpsIndex);
 
       // If the entry already exists then nothing to do
-      if ((this.dsApplIfOpsTableEntries.containsKey(entry.getObjectName())) ||
-              (entry == null)) {
+      if (this.dsApplIfOpsTableEntries.containsKey(entry.getObjectName())) {
         return true;
       }
       // Add the entry in the Table
diff --git a/opendj-server/src/main/java/org/forgerock/opendj/server/core/ProductInformation.java b/opendj-server/src/main/java/org/forgerock/opendj/server/core/ProductInformation.java
index 11b7d0a..0c81ec7 100644
--- a/opendj-server/src/main/java/org/forgerock/opendj/server/core/ProductInformation.java
+++ b/opendj-server/src/main/java/org/forgerock/opendj/server/core/ProductInformation.java
@@ -12,6 +12,7 @@
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
  * Copyright 2014-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.forgerock.opendj.server.core;
 
@@ -43,7 +44,7 @@
 
     private ProductInformation(final String productName) {
         final String resourceName = "/META-INF/product/" + productName + ".properties";
-        final InputStream stream = getClass().getResourceAsStream(resourceName);
+        final InputStream stream = ProductInformation.class.getResourceAsStream(resourceName);
 
         if (stream == null) {
             throw new MissingResourceException("Can't find product information " + resourceName,

--
Gitblit v1.10.0