Description

This PR migrates the server module to JDK 21 by replacing deprecated and removed APIs across 23 source files. It builds on top of the demo/java-21-foundation branch which already updated the root POM (JDK version, compiler/surefire/failsafe plugins, --add-opens flags) and CI workflow.

Three categories of changes:

1. Class.newInstance() → Class.getDeclaredConstructor().newInstance()
Class.newInstance() was deprecated in JDK 9 (for removal) because it bypasses checked-exception handling. Updated in:

• ApiAsyncJobDispatcher
• ApiResponseHelper — also broadened catch clause from InstantiationException | IllegalAccessException to ReflectiveOperationException to cover NoSuchMethodException and InvocationTargetException now thrown by the new reflection path.
• APIAuthenticationManagerImpl — same catch clause broadening as above.

2. new URL(String) → URI.create(String).toURL()
The URL constructors were deprecated in JDK 20. Updated in:

• TemplateManagerImpl
• VolumeApiServiceImpl
• ExternalIpAddressAllocator

⚠️ Reviewer note: URI.create() throws unchecked IllegalArgumentException on malformed input, whereas the old new URL() threw checked MalformedURLException. In ExternalIpAddressAllocator, existing catch (MalformedURLException) blocks will no longer catch malformed-URI errors at the URI.create() stage. The .toURL() call still throws MalformedURLException for unknown protocols. In practice the URLs here are constructed programmatically from configuration, so this is low risk, but worth verifying.

3. Deprecated wrapper constructors → valueOf() factory methods
new Long/Integer/Boolean/Double(...) constructors were deprecated in JDK 9 (marked for removal in JDK 16+). Replaced with Long.valueOf(...), Integer.valueOf(...), Boolean.valueOf(...), Double.valueOf(...) across 20 files. These are semantically equivalent and additionally benefit from the JVM's internal caching of common values.

Test source files (server/src/test/) were intentionally not modified in this PR to keep the scope focused.

Updates since initial revision

• Removed now-unused import java.net.URL from VolumeApiServiceImpl and TemplateManagerImpl (caught by checkstyle CI). The import remains in ExternalIpAddressAllocator where the URL type is still used as a local variable.
• Broadened catch clause in ApiResponseHelper.createVlanIpRangeResponse from InstantiationException | IllegalAccessException to ReflectiveOperationException to fix compilation failure — getDeclaredConstructor().newInstance() declares NoSuchMethodException and InvocationTargetException as checked exceptions.

Human review checklist

• Verify the URI.create() exception semantics change in ExternalIpAddressAllocator is acceptable (existing catch (MalformedURLException) won't catch IllegalArgumentException from malformed URIs)
• Confirm the ReflectiveOperationException broadening in APIAuthenticationManagerImpl and ApiResponseHelper doesn't silently swallow unexpected errors
• Spot-check a few Long.valueOf() / Integer.valueOf() replacements for correctness (especially around null handling — all replaced call sites pass primitives or non-null expressions)

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• Build/CI
• Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

How Has This Been Tested?

Changes are mechanical replacements of deprecated APIs with their recommended JDK 21 equivalents. No behavioral changes are intended (see reviewer note on URI.create() exception semantics above). Compilation and test verification is deferred to CI on JDK 21.

How did you try to break this feature and the system with this change?

• Verified zero remaining deprecated wrapper constructor usages in server/src/main/java via rg 'new (Long|Integer|Boolean|Double)\('
• Verified zero remaining Class.newInstance() usages in server/src/main/java
• Verified zero remaining new URL( usages in server/src/main/java
• Checkstyle passes for the server module (unused URL imports removed in follow-up commit)
• Pre-commit hooks passed (gitleaks, codespell, trailing whitespace, merge conflict checks)

Link to Devin session: https://app.devin.ai/sessions/2800e178a7d34c59b2c3d5d9b4083373
Requested by: @hitomimimi