address sonar cloud bugs and smells
diff --git a/src/main/java/org/apache/sling/jcr/base/internal/AllowListFragment.java b/src/main/java/org/apache/sling/jcr/base/internal/AllowListFragment.java
index 5f52101..2c00dde 100644
--- a/src/main/java/org/apache/sling/jcr/base/internal/AllowListFragment.java
+++ b/src/main/java/org/apache/sling/jcr/base/internal/AllowListFragment.java
@@ -50,7 +50,7 @@
     )
     String[] allowlist_bundles();
 
-    @SuppressWarnings("unused")
+    @SuppressWarnings({"unused", "java:S100"})
     String webconsole_configurationFactory_nameHint() default "{allowlist.name}: [{allowlist.bundles}]";
 }
 
@@ -114,6 +114,6 @@
     }
 
     private Set<String> asSet(final String[] values) {
-        return Collections.unmodifiableSet(new HashSet<String>(asList(values)));
+        return Collections.unmodifiableSet(new HashSet<>(asList(values)));
     }
 }
diff --git a/src/main/java/org/apache/sling/jcr/base/internal/LegacyFragment.java b/src/main/java/org/apache/sling/jcr/base/internal/LegacyFragment.java
index 258f2a9..eae6249 100644
--- a/src/main/java/org/apache/sling/jcr/base/internal/LegacyFragment.java
+++ b/src/main/java/org/apache/sling/jcr/base/internal/LegacyFragment.java
@@ -35,9 +35,11 @@
     public static final String LEGACY_FACTORY_PID = "org.apache.sling.jcr.base.internal.LoginAdminWhitelist.fragment";
 
     public @interface Configuration {
-        String whitelist_name();
+        @SuppressWarnings("java:S100")
+        String whitelist_name() default "[unnamed]";
 
-        String[] whitelist_bundles() default {};
+        @SuppressWarnings("java:S100")
+        String[] whitelist_bundles();
     }
 
 
diff --git a/src/main/java/org/apache/sling/jcr/base/internal/LoginAdminAllowList.java b/src/main/java/org/apache/sling/jcr/base/internal/LoginAdminAllowList.java
index 888fde8..ef85849 100644
--- a/src/main/java/org/apache/sling/jcr/base/internal/LoginAdminAllowList.java
+++ b/src/main/java/org/apache/sling/jcr/base/internal/LoginAdminAllowList.java
@@ -64,12 +64,14 @@
 
     private static final String PROP_LEGACY_BUNDLES_ADDITIONAL = "whitelist.bundles.additional";
 
+    @SuppressWarnings("java:S3077")
+    // java:S3077 - the field is updated and read atomically, and the object is
+    // immutable, hence the use of "volatile" is adequate
     private volatile ConfigurationState config;
 
-    private final List<AllowListFragment> allowListFragments = new CopyOnWriteArrayList<AllowListFragment>();
+    private final List<AllowListFragment> allowListFragments = new CopyOnWriteArrayList<>();
 
-    private final Map<String, AllowListFragment> backwardsCompatibleFragments =
-            new ConcurrentHashMap<String, AllowListFragment>();
+    private final Map<String, AllowListFragment> backwardsCompatibleFragments = new ConcurrentHashMap<>();
 
     @Reference(
             cardinality = ReferenceCardinality.MULTIPLE,
@@ -94,11 +96,12 @@
     }
 
     public boolean allowLoginAdministrative(Bundle b) {
-        if (config == null) {
-            throw new IllegalStateException("LoginAdminAllowList has no configuration.");
-        }
         // create local copy of ConfigurationState to avoid reading mixed configurations during an configure
         final ConfigurationState localConfig = this.config;
+        if (localConfig == null) {
+            throw new IllegalStateException("LoginAdminAllowList has no configuration.");
+        }
+
         if(localConfig.bypassAllowList) {
             LOG.debug("Allow list is bypassed, all bundles allowed to use loginAdministrative");
             return true;