SONAR-21452 move from commons-lang:commons-lang to org.apache.commons:commons-lang3

109 files changed, 290 insertions, 230 deletions

diff --git a/server/sonar-db-dao/build.gradle b/server/sonar-db-dao/build.gradle
index 1fe53397fbb..a75979c4356 100644
--- a/server/sonar-db-dao/build.gradle
+++ b/server/sonar-db-dao/build.gradle
@@ -10,7 +10,7 @@ dependencies {
   api 'com.google.guava:guava'
   api 'com.google.protobuf:protobuf-java'
   api 'commons-io:commons-io'
-  api 'commons-lang:commons-lang'
+  api 'org.apache.commons:commons-lang3'
   api 'org.lz4:lz4-java'
   api 'org.mybatis:mybatis'
   api 'org.sonarsource.api.plugin:sonar-plugin-api'
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/alm/pat/AlmPatDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/alm/pat/AlmPatDaoIT.java
index 9a53ae0c4f6..7fba2db8cce 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/alm/pat/AlmPatDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/alm/pat/AlmPatDaoIT.java
@@ -30,7 +30,7 @@ import org.sonar.db.alm.setting.AlmSettingDto;
 import org.sonar.db.audit.NoOpAuditPersister;
 import org.sonar.db.user.UserDto;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/audit/AuditDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/audit/AuditDaoIT.java
index 059240f24de..089898fa803 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/audit/AuditDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/audit/AuditDaoIT.java
@@ -30,7 +30,7 @@ import org.sonar.core.util.UuidFactoryImpl;
 import org.sonar.db.DbSession;
 import org.sonar.db.DbTester;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.sonar.db.audit.AuditDao.EXCEEDED_LENGTH;
 
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/ce/CeActivityDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/ce/CeActivityDaoIT.java
index 7313854807e..5159888bea3 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/ce/CeActivityDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/ce/CeActivityDaoIT.java
@@ -51,7 +51,7 @@ import org.sonar.db.project.ProjectDto;
 import static java.util.Collections.emptyList;
 import static java.util.Collections.singleton;
 import static java.util.Collections.singletonList;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.tuple;
 import static org.sonar.db.Pagination.forPage;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/component/AnalysisPropertiesDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/component/AnalysisPropertiesDaoIT.java
index fd8c3f4394b..60c5b58dc46 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/component/AnalysisPropertiesDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/component/AnalysisPropertiesDaoIT.java
@@ -31,7 +31,7 @@ import org.sonar.db.DbSession;
 import org.sonar.db.DbTester;
 import org.sonar.db.project.ProjectDto;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.assertj.core.api.AssertionsForClassTypes.tuple;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/component/BranchDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/component/BranchDaoIT.java
index 7c06c0b0f36..1b5a45eabb2 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/component/BranchDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/component/BranchDaoIT.java
@@ -45,7 +45,7 @@ import org.sonar.db.protobuf.DbProjectBranches;
 import static java.util.Arrays.asList;
 import static java.util.Collections.emptyList;
 import static java.util.Collections.singletonList;
-import static org.apache.commons.lang.StringUtils.repeat;
+import static org.apache.commons.lang3.StringUtils.repeat;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.entry;
 import static org.assertj.core.api.Assertions.tuple;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/component/ComponentDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/component/ComponentDaoIT.java
index 142377764a8..198ae57e5c1 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/component/ComponentDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/component/ComponentDaoIT.java
@@ -48,7 +48,6 @@ import org.sonar.db.audit.AuditPersister;
 import org.sonar.db.audit.NoOpAuditPersister;
 import org.sonar.db.audit.model.ComponentNewValue;
 import org.sonar.db.issue.IssueDto;
-import org.sonar.db.metric.MetricDto;
 import org.sonar.db.project.ProjectDto;
 import org.sonar.db.rule.RuleDto;
 import org.sonar.db.source.FileSourceDto;
@@ -61,7 +60,7 @@ import static java.util.Collections.emptySet;
 import static java.util.Collections.singleton;
 import static java.util.Collections.singletonList;
 import static java.util.stream.Collectors.toSet;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.assertj.core.api.Assertions.entry;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/component/ComponentKeyUpdaterDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/component/ComponentKeyUpdaterDaoIT.java
index 76291a2f157..c6964a51ba7 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/component/ComponentKeyUpdaterDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/component/ComponentKeyUpdaterDaoIT.java
@@ -32,7 +32,7 @@ import org.sonar.db.audit.AuditPersister;
 import org.sonar.db.audit.model.ComponentKeyNewValue;
 import org.sonar.db.project.ProjectDto;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.ArgumentMatchers.any;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/component/ScrollForFileMoveComponentDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/component/ScrollForFileMoveComponentDaoIT.java
index 0b349d77119..0f6edb1c5d9 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/component/ScrollForFileMoveComponentDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/component/ScrollForFileMoveComponentDaoIT.java
@@ -38,7 +38,7 @@ import org.sonar.db.DbTester;
 import org.sonar.db.audit.NoOpAuditPersister;
 import org.sonar.db.source.FileSourceDto;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.sonar.api.resources.Qualifiers.FILE;
 import static org.sonar.api.resources.Qualifiers.UNIT_TEST_FILE;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/component/SnapshotDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/component/SnapshotDaoIT.java
index 148c133b957..606ac14a93c 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/component/SnapshotDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/component/SnapshotDaoIT.java
@@ -19,6 +19,7 @@
  */
 package org.sonar.db.component;
 
+import java.security.SecureRandom;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.Comparator;
@@ -45,8 +46,7 @@ import static com.google.common.collect.Lists.newArrayList;
 import static java.util.Collections.emptyList;
 import static java.util.Collections.singletonList;
 import static java.util.stream.Collectors.toList;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
-import static org.apache.commons.lang.math.RandomUtils.nextLong;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.tuple;
 import static org.sonar.db.ce.CeActivityDto.Status.CANCELED;
@@ -61,6 +61,8 @@ import static org.sonar.db.component.SnapshotTesting.newAnalysis;
 
 class SnapshotDaoIT {
 
+  private final Random random = new SecureRandom();
+
   @RegisterExtension
   private final DbTester db = DbTester.create(System2.INSTANCE);
 
@@ -210,7 +212,6 @@ class SnapshotDaoIT {
 
   @Test
   void selectAnalysesByQuery_all() {
-    Random random = new Random();
     List<SnapshotDto> snapshots = IntStream.range(0, 1 + random.nextInt(5))
       .mapToObj(i -> {
         ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
@@ -227,7 +228,6 @@ class SnapshotDaoIT {
 
   @Test
   void selectAnalysesByQuery_by_component_uuid() {
-    Random random = new Random();
     ComponentDto project1 = db.components().insertPrivateProject().getMainBranchComponent();
     ComponentDto project2 = db.components().insertPrivateProject().getMainBranchComponent();
     List<SnapshotDto> snapshots1 = IntStream.range(0, 1 + random.nextInt(20))
@@ -249,7 +249,6 @@ class SnapshotDaoIT {
 
   @Test
   void selectAnalysesByQuery_sort_by_date() {
-    Random random = new Random();
     ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
     List<SnapshotDto> snapshots = IntStream.range(0, 1 + random.nextInt(20))
       .mapToObj(j -> SnapshotTesting.newAnalysis(project).setCreatedAt(1_000L + j))
@@ -573,11 +572,11 @@ class SnapshotDaoIT {
     queueDto.setTaskType(CeTaskTypes.REPORT);
     queueDto.setComponentUuid(projectUuid);
     queueDto.setUuid(randomAlphanumeric(40));
-    queueDto.setCreatedAt(nextLong());
+    queueDto.setCreatedAt(random.nextLong(Long.MAX_VALUE));
     CeActivityDto activityDto = new CeActivityDto(queueDto);
     activityDto.setStatus(status);
-    activityDto.setExecutionTimeMs(nextLong());
-    activityDto.setExecutedAt(nextLong());
+    activityDto.setExecutionTimeMs(random.nextLong(10000));
+    activityDto.setExecutedAt(random.nextLong(Long.MAX_VALUE));
     activityDto.setAnalysisUuid(analysis.getUuid());
     db.getDbClient().ceActivityDao().insert(db.getSession(), activityDto);
     db.commit();
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/event/EventComponentChangeDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/event/EventComponentChangeDaoIT.java
index d7c7ae1a727..bb7b889b155 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/event/EventComponentChangeDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/event/EventComponentChangeDaoIT.java
@@ -30,7 +30,7 @@ import org.sonar.db.DbSession;
 import org.sonar.db.DbTester;
 
 import static java.util.Collections.singletonList;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.tuple;
 import static org.mockito.Mockito.mock;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/issue/IssueDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/issue/IssueDaoIT.java
index 99416540c8a..015f87d4271 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/issue/IssueDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/issue/IssueDaoIT.java
@@ -19,6 +19,7 @@
  */
 package org.sonar.db.issue;
 
+import java.security.SecureRandom;
 import java.sql.SQLException;
 import java.util.Collection;
 import java.util.Collections;
@@ -26,6 +27,7 @@ import java.util.Date;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Optional;
+import java.util.Random;
 import java.util.Set;
 import java.util.stream.IntStream;
 import java.util.stream.Stream;
@@ -56,7 +58,6 @@ import org.sonar.db.user.UserDto;
 
 import static java.util.Arrays.asList;
 import static java.util.Collections.emptyList;
-import static org.apache.commons.lang.math.RandomUtils.nextInt;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.assertj.core.api.Assertions.fail;
@@ -96,6 +97,8 @@ class IssueDaoIT {
   private static final String TEST_CONTEXT_KEY = "test_context_key";
   private static final String USER_LOGIN = "user_login";
 
+  private static final Random RANDOM = new SecureRandom();
+
   private static final RuleType[] RULE_TYPES_EXCEPT_HOTSPOT = Stream.of(RuleType.values())
     .filter(r -> r != RuleType.SECURITY_HOTSPOT)
     .toArray(RuleType[]::new);
@@ -1041,7 +1044,7 @@ class IssueDaoIT {
   }
 
   private static RuleType randomRuleTypeExceptHotspot() {
-    return RULE_TYPES_EXCEPT_HOTSPOT[nextInt(RULE_TYPES_EXCEPT_HOTSPOT.length)];
+    return RULE_TYPES_EXCEPT_HOTSPOT[RANDOM.nextInt(RULE_TYPES_EXCEPT_HOTSPOT.length)];
   }
 
   private void insertBranchIssue(ComponentDto branch, ComponentDto file, RuleDto rule, String id, String status,
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/issue/IssueMapperIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/issue/IssueMapperIT.java
index 7708b9046ec..9646983c237 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/issue/IssueMapperIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/issue/IssueMapperIT.java
@@ -51,7 +51,7 @@ import org.sonar.db.component.ComponentTesting;
 import org.sonar.db.rule.RuleDto;
 import org.sonar.db.rule.RuleTesting;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.tuple;
 
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/measure/LiveMeasureDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/measure/LiveMeasureDaoIT.java
index b415146656d..99b137f1093 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/measure/LiveMeasureDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/measure/LiveMeasureDaoIT.java
@@ -27,7 +27,7 @@ import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 import java.util.stream.IntStream;
-import org.apache.commons.lang.RandomStringUtils;
+import org.apache.commons.lang3.RandomStringUtils;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/project/ProjectDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/project/ProjectDaoIT.java
index d6e13e8dbae..83b1fdfff64 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/project/ProjectDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/project/ProjectDaoIT.java
@@ -19,6 +19,7 @@
  */
 package org.sonar.db.project;
 
+import java.security.SecureRandom;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
@@ -27,6 +28,7 @@ import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
+import java.util.Random;
 import java.util.Set;
 import java.util.function.Consumer;
 import java.util.stream.Collectors;
@@ -53,7 +55,6 @@ import org.sonar.db.metric.MetricDto;
 import org.sonar.db.qualityprofile.QProfileDto;
 
 import static java.util.Collections.emptySet;
-import static org.apache.commons.lang.math.RandomUtils.nextInt;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.tuple;
 import static org.mockito.ArgumentMatchers.any;
@@ -66,6 +67,8 @@ import static org.sonar.api.measures.Metric.ValueType.STRING;
 
 class ProjectDaoIT {
 
+  private final Random random = new SecureRandom();
+
   private final System2 system2 = new AlwaysIncreasingSystem2(1000L);
 
   @RegisterExtension
@@ -312,7 +315,7 @@ class ProjectDaoIT {
   @Test
   void select_project_uuids_associated_to_default_quality_profile_for_specific_language() {
     String language = "xoo";
-    Set<ProjectData> projects = insertProjects(nextInt(10));
+    Set<ProjectData> projects = insertProjects(random.nextInt(10));
     insertDefaultQualityProfile(language);
     insertProjectsLiveMeasures(language, projects);
 
@@ -427,7 +430,7 @@ class ProjectDaoIT {
       .setMetricUuid(metric.getUuid())
       .setComponentUuid(componentDto.uuid())
       .setProjectUuid(project.getUuid())
-      .setData(language + "=" + nextInt(10));
+      .setData(language + "=" + random.nextInt(10));
   }
 
   private Consumer<ProjectData> insertLiveMeasure(String language, MetricDto metric) {
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/project/ProjectExportDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/project/ProjectExportDaoIT.java
index 64bd52e95c8..6d7dbfe0619 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/project/ProjectExportDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/project/ProjectExportDaoIT.java
@@ -25,7 +25,7 @@ import java.util.Set;
 import java.util.function.Consumer;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
-import org.apache.commons.lang.RandomStringUtils;
+import org.apache.commons.lang3.RandomStringUtils;
 import org.apache.ibatis.cursor.Cursor;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/property/InternalPropertiesDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/property/InternalPropertiesDaoIT.java
index 3ea737b4332..3bb89a1adeb 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/property/InternalPropertiesDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/property/InternalPropertiesDaoIT.java
@@ -48,7 +48,7 @@ import org.sonar.db.audit.model.PropertyNewValue;
 
 import static java.lang.Boolean.FALSE;
 import static java.lang.Boolean.TRUE;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.assertj.core.api.Assertions.entry;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/property/PropertiesDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/property/PropertiesDaoIT.java
index e3cc2950c32..754eb0ece6e 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/property/PropertiesDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/property/PropertiesDaoIT.java
@@ -50,7 +50,7 @@ import org.sonar.db.user.UserDto;
 import static com.google.common.collect.ImmutableSet.of;
 import static com.google.common.collect.Sets.newHashSet;
 import static java.util.Collections.singletonList;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.assertj.core.groups.Tuple.tuple;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/purge/PurgeCommandsIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/purge/PurgeCommandsIT.java
index 48a3e200b97..818fd758235 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/purge/PurgeCommandsIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/purge/PurgeCommandsIT.java
@@ -69,7 +69,7 @@ import static com.google.common.collect.Lists.newArrayList;
 import static java.util.Arrays.asList;
 import static java.util.Collections.singleton;
 import static java.util.Collections.singletonList;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatNoException;
 import static org.assertj.core.api.Assertions.tuple;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/purge/PurgeDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/purge/PurgeDaoIT.java
index 8bdb1ac2815..2bef9d30cc9 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/purge/PurgeDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/purge/PurgeDaoIT.java
@@ -22,6 +22,7 @@ package org.sonar.db.purge;
 import com.google.common.collect.ImmutableSet;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
+import java.security.SecureRandom;
 import java.time.LocalDateTime;
 import java.time.ZoneOffset;
 import java.util.ArrayList;
@@ -37,8 +38,7 @@ import java.util.stream.Collectors;
 import java.util.stream.IntStream;
 import java.util.stream.Stream;
 import org.apache.commons.io.IOUtils;
-import org.apache.commons.lang.math.RandomUtils;
-import org.apache.commons.lang.time.DateUtils;
+import org.apache.commons.lang3.time.DateUtils;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
 import org.slf4j.event.Level;
@@ -98,7 +98,7 @@ import static java.nio.charset.StandardCharsets.UTF_8;
 import static java.time.ZoneOffset.UTC;
 import static java.util.Arrays.asList;
 import static java.util.Collections.singletonList;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.groups.Tuple.tuple;
 import static org.mockito.Mockito.mock;
@@ -125,6 +125,8 @@ class PurgeDaoIT {
 
   private static final String PROJECT_UUID = "P1";
 
+  private final Random random = new SecureRandom();
+
   private final System2 system2 = mock(System2.class);
 
   @RegisterExtension
@@ -2045,7 +2047,7 @@ oldCreationDate));
   }
 
   private CeActivityDto insertCeActivity(ComponentDto component, String entityUuid) {
-    Status unusedStatus = Status.values()[RandomUtils.nextInt(Status.values().length)];
+    Status unusedStatus = Status.values()[random.nextInt(Status.values().length)];
     CeQueueDto queueDto = createCeQueue(component, entityUuid, unusedStatus);
 
     CeActivityDto dto = new CeActivityDto(queueDto);
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/qualitygate/QualityGateConditionDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/qualitygate/QualityGateConditionDaoIT.java
index 8d9746b1f27..9d484660ef0 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/qualitygate/QualityGateConditionDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/qualitygate/QualityGateConditionDaoIT.java
@@ -31,7 +31,7 @@ import org.sonar.db.DbSession;
 import org.sonar.db.DbTester;
 import org.sonar.db.metric.MetricDto;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.AssertionsForClassTypes.tuple;
 
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/qualitygate/QualityGateGroupPermissionsDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/qualitygate/QualityGateGroupPermissionsDaoIT.java
index 08309c7f4e6..ad21b9f43eb 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/qualitygate/QualityGateGroupPermissionsDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/qualitygate/QualityGateGroupPermissionsDaoIT.java
@@ -35,7 +35,7 @@ import org.sonar.db.user.GroupDto;
 import org.sonar.db.user.GroupTesting;
 import org.sonar.db.user.SearchGroupMembershipDto;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.tuple;
 import static org.mockito.ArgumentMatchers.eq;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/qualityprofile/QualityProfileDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/qualityprofile/QualityProfileDaoIT.java
index 8b42ec6a365..a99c13ffdad 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/qualityprofile/QualityProfileDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/qualityprofile/QualityProfileDaoIT.java
@@ -45,7 +45,7 @@ import static java.util.Arrays.asList;
 import static java.util.Collections.emptyList;
 import static java.util.Collections.singleton;
 import static java.util.Collections.singletonList;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.tuple;
 import static org.mockito.Mockito.mock;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/rule/RuleDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/rule/RuleDaoIT.java
index 94df40f66cf..fcf19a2ed78 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/rule/RuleDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/rule/RuleDaoIT.java
@@ -30,7 +30,7 @@ import java.util.Optional;
 import java.util.Set;
 import java.util.function.Consumer;
 import java.util.function.Function;
-import org.apache.commons.lang.RandomStringUtils;
+import org.apache.commons.lang3.RandomStringUtils;
 import org.apache.ibatis.exceptions.PersistenceException;
 import org.jetbrains.annotations.NotNull;
 import org.junit.jupiter.api.Test;
@@ -58,7 +58,7 @@ import static com.google.common.collect.Sets.newHashSet;
 import static java.util.Arrays.asList;
 import static java.util.Collections.emptyList;
 import static java.util.Collections.singletonList;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.assertj.core.api.Assertions.tuple;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/scim/ScimUserDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/scim/ScimUserDaoIT.java
index 6942062d867..bba0587f4e8 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/scim/ScimUserDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/scim/ScimUserDaoIT.java
@@ -39,7 +39,7 @@ import org.sonar.db.Pagination;
 import org.sonar.db.user.GroupDto;
 import org.sonar.db.user.UserDto;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatCode;
 import static org.assertj.core.api.Fail.fail;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/user/UserDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/user/UserDaoIT.java
index 180b179e82c..97c15d618ac 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/user/UserDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/user/UserDaoIT.java
@@ -49,7 +49,7 @@ import static java.util.Collections.emptySet;
 import static java.util.Collections.singletonList;
 import static java.util.stream.Collectors.toMap;
 import static java.util.stream.Collectors.toSet;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatNoException;
 import static org.assertj.core.groups.Tuple.tuple;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/user/UserDaoWithPersisterIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/user/UserDaoWithPersisterIT.java
index 81405ea50a7..3977de53ad3 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/user/UserDaoWithPersisterIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/user/UserDaoWithPersisterIT.java
@@ -30,7 +30,7 @@ import org.sonar.db.DbTester;
 import org.sonar.db.audit.AuditPersister;
 import org.sonar.db.audit.model.UserNewValue;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.mock;
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/user/UserTokenDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/user/UserTokenDaoIT.java
index 495b31e3723..9d3a5948b8f 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/user/UserTokenDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/user/UserTokenDaoIT.java
@@ -19,10 +19,12 @@
  */
 package org.sonar.db.user;
 
+import java.security.SecureRandom;
 import java.time.LocalDate;
 import java.time.ZoneOffset;
 import java.util.List;
 import java.util.Map;
+import java.util.Random;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
 import org.sonar.api.utils.System2;
@@ -31,12 +33,14 @@ import org.sonar.db.DbTester;
 import org.sonar.db.component.ComponentDto;
 
 import static java.util.Collections.singletonList;
-import static org.apache.commons.lang.math.RandomUtils.nextLong;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.sonar.db.user.UserTokenTesting.newProjectAnalysisToken;
 import static org.sonar.db.user.UserTokenTesting.newUserToken;
 
 class UserTokenDaoIT {
+
+  private final Random random = new SecureRandom();
+
   @RegisterExtension
   private final DbTester db = DbTester.create(System2.INSTANCE);
 
@@ -57,7 +61,7 @@ class UserTokenDaoIT {
 
   @Test
   void insert_user_token_with_expiration_date() {
-    UserTokenDto userToken = newUserToken().setExpirationDate(nextLong());
+    UserTokenDto userToken = newUserToken().setExpirationDate(10000L);
 
     underTest.insert(db.getSession(), userToken, "login");
 
diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/user/UserTokenDaoWithPersisterIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/user/UserTokenDaoWithPersisterIT.java
index b067c137e17..e186a61a167 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/user/UserTokenDaoWithPersisterIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/user/UserTokenDaoWithPersisterIT.java
@@ -19,6 +19,8 @@
  */
 package org.sonar.db.user;
 
+import java.security.SecureRandom;
+import java.util.Random;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
 import org.mockito.ArgumentCaptor;
@@ -30,7 +32,6 @@ import org.sonar.db.DbTester;
 import org.sonar.db.audit.AuditPersister;
 import org.sonar.db.audit.model.UserTokenNewValue;
 
-import static org.apache.commons.lang.math.RandomUtils.nextLong;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
@@ -40,6 +41,9 @@ import static org.mockito.Mockito.verifyNoMoreInteractions;
 import static org.sonar.db.user.UserTokenTesting.newUserToken;
 
 class UserTokenDaoWithPersisterIT {
+
+  private final Random random = new SecureRandom();
+
   private final AuditPersister auditPersister = mock(AuditPersister.class);
   private final ArgumentCaptor<UserTokenNewValue> newValueCaptor = ArgumentCaptor.forClass(UserTokenNewValue.class);
 
@@ -53,8 +57,8 @@ class UserTokenDaoWithPersisterIT {
   @Test
   void insert_token_is_persisted() {
     UserTokenDto userToken = newUserToken()
-      .setExpirationDate(nextLong())
-      .setLastConnectionDate(nextLong());
+      .setExpirationDate(random.nextLong(Long.MAX_VALUE))
+      .setLastConnectionDate(random.nextLong(Long.MAX_VALUE));
     underTest.insert(db.getSession(), userToken, "login");
 
     verify(auditPersister).addUserToken(eq(db.getSession()), newValueCaptor.capture());
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/audit/model/ComponentNewValue.java b/server/sonar-db-dao/src/main/java/org/sonar/db/audit/model/ComponentNewValue.java
index 80584ca1e4f..146ae5d33b3 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/audit/model/ComponentNewValue.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/audit/model/ComponentNewValue.java
@@ -21,7 +21,7 @@ package org.sonar.db.audit.model;
 
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.ObjectUtils;
+import org.apache.commons.lang3.ObjectUtils;
 import org.sonar.db.component.ComponentDto;
 import org.sonar.db.project.ProjectDto;
 
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/audit/model/DevOpsPlatformSettingNewValue.java b/server/sonar-db-dao/src/main/java/org/sonar/db/audit/model/DevOpsPlatformSettingNewValue.java
index a478f9a34cf..39040b313ca 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/audit/model/DevOpsPlatformSettingNewValue.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/audit/model/DevOpsPlatformSettingNewValue.java
@@ -21,7 +21,7 @@ package org.sonar.db.audit.model;
 
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.ObjectUtils;
+import org.apache.commons.lang3.ObjectUtils;
 import org.sonar.db.alm.setting.AlmSettingDto;
 import org.sonar.db.alm.setting.ProjectAlmSettingDto;
 import org.sonar.db.project.ProjectDto;
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/audit/model/PermissionTemplateNewValue.java b/server/sonar-db-dao/src/main/java/org/sonar/db/audit/model/PermissionTemplateNewValue.java
index 9d68bba3a5a..d7f135f1dd6 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/audit/model/PermissionTemplateNewValue.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/audit/model/PermissionTemplateNewValue.java
@@ -21,7 +21,7 @@ package org.sonar.db.audit.model;
 
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.ObjectUtils;
+import org.apache.commons.lang3.ObjectUtils;
 import org.sonar.db.permission.template.PermissionTemplateDto;
 
 public class PermissionTemplateNewValue extends NewValue {
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/audit/model/UserNewValue.java b/server/sonar-db-dao/src/main/java/org/sonar/db/audit/model/UserNewValue.java
index 835c1dc29fc..70a4d389a5c 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/audit/model/UserNewValue.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/audit/model/UserNewValue.java
@@ -23,7 +23,7 @@ import java.util.ArrayList;
 import java.util.List;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.ObjectUtils;
+import org.apache.commons.lang3.ObjectUtils;
 import org.sonar.api.utils.DateUtils;
 import org.sonar.db.user.UserDto;
 
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/ce/CeTaskMessageDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/ce/CeTaskMessageDto.java
index 4bb344311fa..5d17d6d6411 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/ce/CeTaskMessageDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/ce/CeTaskMessageDto.java
@@ -23,7 +23,7 @@ import com.google.common.annotations.VisibleForTesting;
 import org.sonar.db.dismissmessage.MessageType;
 
 import static com.google.common.base.Preconditions.checkArgument;
-import static org.apache.commons.lang.StringUtils.abbreviate;
+import static org.apache.commons.lang3.StringUtils.abbreviate;
 
 public class CeTaskMessageDto {
   @VisibleForTesting
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/component/ComponentDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/component/ComponentDto.java
index 2079cff6e55..ef0ce834b1c 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/component/ComponentDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/component/ComponentDto.java
@@ -26,13 +26,13 @@ import java.util.List;
 import java.util.Objects;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.builder.ToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringBuilder;
 import org.sonar.api.resources.Scopes;
 import org.sonar.db.WildcardPosition;
 
 import static com.google.common.base.Preconditions.checkArgument;
 import static java.lang.String.format;
-import static org.apache.commons.lang.StringUtils.substringBeforeLast;
+import static org.apache.commons.lang3.StringUtils.substringBeforeLast;
 import static org.sonar.db.DaoUtils.buildLikeValue;
 import static org.sonar.db.component.ComponentValidator.checkComponentKey;
 import static org.sonar.db.component.ComponentValidator.checkComponentLongName;
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/component/ComponentKeyUpdaterDao.java b/server/sonar-db-dao/src/main/java/org/sonar/db/component/ComponentKeyUpdaterDao.java
index 7861973f3d1..cd424269410 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/component/ComponentKeyUpdaterDao.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/component/ComponentKeyUpdaterDao.java
@@ -25,7 +25,7 @@ import java.util.LinkedList;
 import java.util.List;
 import java.util.function.BiConsumer;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.sonar.api.resources.Qualifiers;
 import org.sonar.api.resources.Scopes;
 import org.sonar.db.Dao;
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/component/SnapshotDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/component/SnapshotDto.java
index b33e0c296b3..872001ba497 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/component/SnapshotDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/component/SnapshotDto.java
@@ -24,7 +24,7 @@ import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
 
 import static com.google.common.base.Preconditions.checkArgument;
-import static org.apache.commons.lang.StringUtils.trimToNull;
+import static org.apache.commons.lang3.StringUtils.trimToNull;
 
 public final class SnapshotDto {
 
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/issue/IssueChangeDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/issue/IssueChangeDto.java
index 3880fced6c4..f85afd35243 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/issue/IssueChangeDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/issue/IssueChangeDto.java
@@ -23,8 +23,8 @@ import java.io.Serializable;
 import java.util.Date;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.builder.ToStringBuilder;
-import org.apache.commons.lang.builder.ToStringStyle;
+import org.apache.commons.lang3.builder.ToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
 import org.sonar.api.utils.System2;
 import org.sonar.core.issue.DefaultIssueComment;
 import org.sonar.core.issue.FieldDiffs;
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/issue/IssueDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/issue/IssueDto.java
index 8e3cdb99a69..dfa4c7e74e6 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/issue/IssueDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/issue/IssueDto.java
@@ -34,8 +34,8 @@ import java.util.Set;
 import java.util.stream.Collectors;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.builder.ToStringBuilder;
-import org.apache.commons.lang.builder.ToStringStyle;
+import org.apache.commons.lang3.builder.ToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
 import org.jetbrains.annotations.NotNull;
 import org.sonar.api.issue.IssueStatus;
 import org.sonar.api.issue.impact.Severity;
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/issue/IssueTesting.java b/server/sonar-db-dao/src/main/java/org/sonar/db/issue/IssueTesting.java
index fe5563c9ecc..c527cebd03e 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/issue/IssueTesting.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/issue/IssueTesting.java
@@ -19,11 +19,12 @@
  */
 package org.sonar.db.issue;
 
+import java.security.SecureRandom;
 import java.util.Date;
 import java.util.List;
+import java.util.Random;
 import java.util.function.Function;
 import java.util.stream.Stream;
-import org.apache.commons.lang.math.RandomUtils;
 import org.sonar.api.issue.Issue;
 import org.sonar.api.issue.impact.SoftwareQuality;
 import org.sonar.api.resources.Qualifiers;
@@ -36,13 +37,13 @@ import org.sonar.db.rule.RuleDto;
 
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.collect.Sets.newHashSet;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
-import static org.apache.commons.lang.math.RandomUtils.nextInt;
-import static org.apache.commons.lang.math.RandomUtils.nextLong;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 
 public class IssueTesting {
 
+  private static final Random RANDOM = new SecureRandom();
+
   private IssueTesting() {
     // only statics
   }
@@ -68,14 +69,14 @@ public class IssueTesting {
       .setComponent(file)
       .setStatus(Issue.STATUS_OPEN)
       .setResolution(null)
-      .setSeverity(Severity.ALL.get(nextInt(Severity.ALL.size())))
+      .setSeverity(Severity.ALL.get(RANDOM.nextInt(Severity.ALL.size())))
       //TODO map to correct impact. Will be fixed with persistence of impacts on issues
       .addImpact(new ImpactDto().setSoftwareQuality(SoftwareQuality.MAINTAINABILITY).setSeverity(org.sonar.api.issue.impact.Severity.HIGH))
-      .setEffort((long) RandomUtils.nextInt(10))
+      .setEffort((long) RANDOM.nextInt(10))
       .setAssigneeUuid("assignee-uuid_" + randomAlphabetic(26))
       .setAuthorLogin("author_" + randomAlphabetic(5))
-      // Adding one to the generated random value in order to never get 0 (as it's a forbidden value)
-      .setLine(nextInt(1_000) + 1)
+      // Starting from 1 in order to never get 0 (as it's a forbidden value)
+      .setLine(RANDOM.nextInt(1, 1_001))
       .setMessage("message_" + randomAlphabetic(5))
       .setChecksum("checksum_" + randomAlphabetic(5))
       .setTags(newHashSet("tag_" + randomAlphanumeric(5), "tag_" + randomAlphanumeric(5)))
@@ -95,9 +96,9 @@ public class IssueTesting {
       .setChangeType(IssueChangeDto.TYPE_FIELD_CHANGE)
       .setUserUuid("userUuid_" + randomAlphanumeric(40))
       .setProjectUuid(issue.getProjectUuid())
-      .setIssueChangeCreationDate(nextLong())
-      .setCreatedAt(nextLong())
-      .setUpdatedAt(nextLong());
+      .setIssueChangeCreationDate(RANDOM.nextLong(Long.MAX_VALUE))
+      .setCreatedAt(RANDOM.nextLong(Long.MAX_VALUE))
+      .setUpdatedAt(RANDOM.nextLong(Long.MAX_VALUE));
   }
 
   public static NewCodeReferenceIssueDto newCodeReferenceIssue(IssueDto issue) {
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/issue/PrIssueDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/issue/PrIssueDto.java
index c1e21d4ccb8..a149573f358 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/issue/PrIssueDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/issue/PrIssueDto.java
@@ -22,8 +22,8 @@ package org.sonar.db.issue;
 import java.io.Serializable;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.builder.ToStringBuilder;
-import org.apache.commons.lang.builder.ToStringStyle;
+import org.apache.commons.lang3.builder.ToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
 import org.sonar.api.rule.RuleKey;
 import org.sonar.db.component.BranchType;
 
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/measure/ProjectMeasuresIndexerIterator.java b/server/sonar-db-dao/src/main/java/org/sonar/db/measure/ProjectMeasuresIndexerIterator.java
index d37fd18fec0..95c0eb350dc 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/measure/ProjectMeasuresIndexerIterator.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/measure/ProjectMeasuresIndexerIterator.java
@@ -37,7 +37,7 @@ import java.util.function.Consumer;
 import java.util.stream.Collectors;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.sonar.api.measures.CoreMetrics;
 import org.sonar.api.resources.Qualifiers;
 import org.sonar.core.util.CloseableIterator;
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/notification/NotificationQueueDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/notification/NotificationQueueDto.java
index 873c766b429..1ef337a8f57 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/notification/NotificationQueueDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/notification/NotificationQueueDto.java
@@ -24,8 +24,8 @@ import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.ObjectInputStream;
 import java.io.ObjectOutputStream;
-import org.apache.commons.lang.builder.ToStringBuilder;
-import org.apache.commons.lang.builder.ToStringStyle;
+import org.apache.commons.lang3.builder.ToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
 import org.sonar.api.notifications.Notification;
 
 /**
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/permission/PermissionQuery.java b/server/sonar-db-dao/src/main/java/org/sonar/db/permission/PermissionQuery.java
index 79c21b395a5..d2b08773a45 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/permission/PermissionQuery.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/permission/PermissionQuery.java
@@ -29,7 +29,7 @@ import org.sonar.db.entity.EntityDto;
 
 import static com.google.common.base.MoreObjects.firstNonNull;
 import static com.google.common.base.Preconditions.checkArgument;
-import static org.apache.commons.lang.StringUtils.defaultIfBlank;
+import static org.apache.commons.lang3.StringUtils.defaultIfBlank;
 import static org.sonar.api.utils.Paging.offset;
 import static org.sonar.db.DaoUtils.buildLikeValue;
 
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/plugin/PluginDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/plugin/PluginDto.java
index f1006fac266..e1e848701f5 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/plugin/PluginDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/plugin/PluginDto.java
@@ -21,7 +21,7 @@ package org.sonar.db.plugin;
 
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.builder.ToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringBuilder;
 
 public class PluginDto {
   /** Technical unique identifier, can't be null */
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/project/ProjectDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/project/ProjectDto.java
index aaef5e5ad70..b01511fed23 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/project/ProjectDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/project/ProjectDto.java
@@ -25,7 +25,7 @@ import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
 import org.sonar.db.entity.EntityDto;
 
-import static org.apache.commons.lang.StringUtils.trimToNull;
+import static org.apache.commons.lang3.StringUtils.trimToNull;
 import static org.sonar.db.component.DbTagsReader.readDbTags;
 
 public class ProjectDto extends EntityDto {
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/property/PropertiesDao.java b/server/sonar-db-dao/src/main/java/org/sonar/db/property/PropertiesDao.java
index 7b024c72b48..e921e12bab3 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/property/PropertiesDao.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/property/PropertiesDao.java
@@ -42,7 +42,7 @@ import org.sonar.db.audit.model.PropertyNewValue;
 
 import static com.google.common.base.Preconditions.checkArgument;
 import static java.util.Collections.singletonList;
-import static org.apache.commons.lang.StringUtils.repeat;
+import static org.apache.commons.lang3.StringUtils.repeat;
 import static org.sonar.db.DatabaseUtils.executeLargeInputs;
 import static org.sonar.db.DatabaseUtils.executeLargeInputsIntoSet;
 
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/purge/PurgeableAnalysisDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/purge/PurgeableAnalysisDto.java
index 283fbda0b0f..c9c5cee6a73 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/purge/PurgeableAnalysisDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/purge/PurgeableAnalysisDto.java
@@ -22,8 +22,8 @@ package org.sonar.db.purge;
 import java.util.Date;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.builder.ReflectionToStringBuilder;
-import org.apache.commons.lang.builder.ToStringStyle;
+import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
 
 /**
  * Represents an analysis, aka. root snapshot, aka. snapshot of a project or portfolio
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/purge/period/Filters.java b/server/sonar-db-dao/src/main/java/org/sonar/db/purge/period/Filters.java
index 4ce8ad38e6b..0c093b316db 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/purge/period/Filters.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/purge/period/Filters.java
@@ -23,7 +23,7 @@ import java.util.ArrayList;
 import java.util.Calendar;
 import java.util.Date;
 import java.util.List;
-import org.apache.commons.lang.time.DateUtils;
+import org.apache.commons.lang3.time.DateUtils;
 import org.sonar.api.config.Configuration;
 import org.sonar.core.config.PurgeConstants;
 
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/purge/period/Interval.java b/server/sonar-db-dao/src/main/java/org/sonar/db/purge/period/Interval.java
index 1c1412644f0..f20ed83ed58 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/purge/period/Interval.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/purge/period/Interval.java
@@ -24,7 +24,7 @@ import java.util.Calendar;
 import java.util.Date;
 import java.util.GregorianCalendar;
 import java.util.List;
-import org.apache.commons.lang.time.DateUtils;
+import org.apache.commons.lang3.time.DateUtils;
 import org.sonar.db.purge.PurgeableAnalysisDto;
 
 final class Interval {
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/qualitygate/ProjectQgateAssociationQuery.java b/server/sonar-db-dao/src/main/java/org/sonar/db/qualitygate/ProjectQgateAssociationQuery.java
index f6d052563dc..3ee99176d82 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/qualitygate/ProjectQgateAssociationQuery.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/qualitygate/ProjectQgateAssociationQuery.java
@@ -25,7 +25,7 @@ import java.util.Locale;
 import java.util.Set;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.sonar.db.DaoUtils;
 import org.sonar.db.WildcardPosition;
 
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/qualityprofile/ActiveRuleDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/qualityprofile/ActiveRuleDto.java
index 1fde477e67e..005dff79be5 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/qualityprofile/ActiveRuleDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/qualityprofile/ActiveRuleDto.java
@@ -21,9 +21,9 @@ package org.sonar.db.qualityprofile;
 
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.StringUtils;
-import org.apache.commons.lang.builder.ReflectionToStringBuilder;
-import org.apache.commons.lang.builder.ToStringStyle;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
 import org.sonar.api.rule.RuleKey;
 import org.sonar.api.rules.ActiveRule;
 import org.sonar.db.rule.RuleDto;
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/qualityprofile/ActiveRuleParamDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/qualityprofile/ActiveRuleParamDto.java
index 6dc64845609..1c5ce4d25fa 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/qualityprofile/ActiveRuleParamDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/qualityprofile/ActiveRuleParamDto.java
@@ -23,8 +23,8 @@ import com.google.common.base.Preconditions;
 import java.util.Collection;
 import java.util.HashMap;
 import java.util.Map;
-import org.apache.commons.lang.builder.ReflectionToStringBuilder;
-import org.apache.commons.lang.builder.ToStringStyle;
+import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
 import org.sonar.db.rule.RuleParamDto;
 
 public class ActiveRuleParamDto {
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/qualityprofile/QProfileChangeDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/qualityprofile/QProfileChangeDto.java
index caefb931ffa..3abf3f1f868 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/qualityprofile/QProfileChangeDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/qualityprofile/QProfileChangeDto.java
@@ -23,8 +23,8 @@ import java.util.Collections;
 import java.util.Map;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.builder.ReflectionToStringBuilder;
-import org.apache.commons.lang.builder.ToStringStyle;
+import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
 import org.sonar.api.utils.KeyValueFormat;
 import org.sonar.db.rule.RuleChangeDto;
 
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/qualityprofile/QProfileChangeQuery.java b/server/sonar-db-dao/src/main/java/org/sonar/db/qualityprofile/QProfileChangeQuery.java
index a14c6654de7..8403c994347 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/qualityprofile/QProfileChangeQuery.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/qualityprofile/QProfileChangeQuery.java
@@ -21,8 +21,8 @@ package org.sonar.db.qualityprofile;
 
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.builder.ReflectionToStringBuilder;
-import org.apache.commons.lang.builder.ToStringStyle;
+import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
 
 import static java.util.Objects.requireNonNull;
 
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleDao.java b/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleDao.java
index d3e7bf7d570..cfa2f96711c 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleDao.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleDao.java
@@ -42,7 +42,7 @@ import org.sonar.db.issue.ImpactDto;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static java.util.Collections.emptyList;
 import static java.util.stream.Collectors.toMap;
-import static org.apache.commons.lang.StringUtils.isBlank;
+import static org.apache.commons.lang3.StringUtils.isBlank;
 import static org.sonar.db.DatabaseUtils.executeLargeInputs;
 import static org.sonar.db.DatabaseUtils.executeLargeInputsWithoutOutput;
 import static org.sonar.db.DatabaseUtils.executeLargeUpdates;
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleDescriptionSectionContextDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleDescriptionSectionContextDto.java
index a7644f810b4..18967410211 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleDescriptionSectionContextDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleDescriptionSectionContextDto.java
@@ -21,7 +21,7 @@ package org.sonar.db.rule;
 
 import java.util.Objects;
 
-import static org.apache.commons.lang.StringUtils.isNotEmpty;
+import static org.apache.commons.lang3.StringUtils.isNotEmpty;
 import static org.sonar.api.utils.Preconditions.checkArgument;
 
 public class RuleDescriptionSectionContextDto {
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleDto.java
index e71a33ebf05..ea65b61c907 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleDto.java
@@ -29,7 +29,7 @@ import java.util.Set;
 import java.util.stream.Collectors;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.builder.HashCodeBuilder;
+import org.apache.commons.lang3.builder.HashCodeBuilder;
 import org.sonar.api.issue.impact.SoftwareQuality;
 import org.sonar.api.rule.RuleKey;
 import org.sonar.api.rule.RuleStatus;
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleParamDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleParamDto.java
index 517dbdba5b8..352570bca65 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleParamDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleParamDto.java
@@ -21,8 +21,8 @@ package org.sonar.db.rule;
 
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.builder.ReflectionToStringBuilder;
-import org.apache.commons.lang.builder.ToStringStyle;
+import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
 
 import static com.google.common.base.Preconditions.checkArgument;
 
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleRepositoryDao.java b/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleRepositoryDao.java
index 917c89b03de..2ec3875f338 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleRepositoryDao.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/rule/RuleRepositoryDao.java
@@ -30,7 +30,7 @@ import org.sonar.db.DatabaseUtils;
 import org.sonar.db.DbSession;
 
 import static com.google.common.base.Preconditions.checkArgument;
-import static org.apache.commons.lang.StringUtils.isBlank;
+import static org.apache.commons.lang3.StringUtils.isBlank;
 
 public class RuleRepositoryDao implements Dao {
 
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/scim/ScimGroupQuery.java b/server/sonar-db-dao/src/main/java/org/sonar/db/scim/ScimGroupQuery.java
index e12e45a8972..065af654034 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/scim/ScimGroupQuery.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/scim/ScimGroupQuery.java
@@ -26,7 +26,7 @@ import java.util.regex.Pattern;
 import javax.annotation.Nullable;
 
 import static java.util.regex.Pattern.CASE_INSENSITIVE;
-import static org.apache.commons.lang.StringUtils.isBlank;
+import static org.apache.commons.lang3.StringUtils.isBlank;
 
 public class ScimGroupQuery {
   private static final Pattern DISPLAY_NAME_FILTER_PATTERN = Pattern.compile("^displayName\\s+eq\\s+\"([^\"]*?)\"$", CASE_INSENSITIVE);
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/scim/ScimUserQuery.java b/server/sonar-db-dao/src/main/java/org/sonar/db/scim/ScimUserQuery.java
index 89f39cae32b..234b78d17db 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/scim/ScimUserQuery.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/scim/ScimUserQuery.java
@@ -27,7 +27,7 @@ import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
 
 import static java.util.regex.Pattern.CASE_INSENSITIVE;
-import static org.apache.commons.lang.StringUtils.isBlank;
+import static org.apache.commons.lang3.StringUtils.isBlank;
 
 public class ScimUserQuery {
   private static final Pattern USERNAME_FILTER_PATTERN = Pattern.compile("^userName\\s+eq\\s+\"([^\"]*?)\"$", CASE_INSENSITIVE);
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/user/GroupMembershipQuery.java b/server/sonar-db-dao/src/main/java/org/sonar/db/user/GroupMembershipQuery.java
index ee6d283bc22..42962f69bd6 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/user/GroupMembershipQuery.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/user/GroupMembershipQuery.java
@@ -23,7 +23,7 @@ import com.google.common.collect.ImmutableSet;
 import java.util.Set;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 
 import static com.google.common.base.MoreObjects.firstNonNull;
 import static com.google.common.base.Preconditions.checkArgument;
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/user/GroupQuery.java b/server/sonar-db-dao/src/main/java/org/sonar/db/user/GroupQuery.java
index ca81edb50c5..c981b2aa4fb 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/user/GroupQuery.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/user/GroupQuery.java
@@ -22,7 +22,7 @@ package org.sonar.db.user;
 import java.util.Locale;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.sonar.db.DaoUtils;
 import org.sonar.db.WildcardPosition;
 
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/user/SearchPermissionQuery.java b/server/sonar-db-dao/src/main/java/org/sonar/db/user/SearchPermissionQuery.java
index 03782036be5..e2387790464 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/user/SearchPermissionQuery.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/user/SearchPermissionQuery.java
@@ -22,7 +22,7 @@ package org.sonar.db.user;
 import java.util.Set;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 
 import static com.google.common.base.MoreObjects.firstNonNull;
 import static com.google.common.base.Preconditions.checkArgument;
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/user/UserDao.java b/server/sonar-db-dao/src/main/java/org/sonar/db/user/UserDao.java
index 814a5bd32f4..39d4954a4ef 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/user/UserDao.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/user/UserDao.java
@@ -28,7 +28,7 @@ import java.util.function.Consumer;
 import java.util.function.Function;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nonnull;
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.sonar.api.utils.System2;
 import org.sonar.core.util.UuidFactory;
 import org.sonar.db.Dao;
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/user/UserMembershipQuery.java b/server/sonar-db-dao/src/main/java/org/sonar/db/user/UserMembershipQuery.java
index a1838fac23e..cb1df6aa5bb 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/user/UserMembershipQuery.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/user/UserMembershipQuery.java
@@ -24,7 +24,7 @@ import java.util.Locale;
 import java.util.Set;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 
 import static com.google.common.base.MoreObjects.firstNonNull;
 import static com.google.common.base.Preconditions.checkArgument;
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/user/UserQuery.java b/server/sonar-db-dao/src/main/java/org/sonar/db/user/UserQuery.java
index ce908f4da07..66d4c7f519b 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/user/UserQuery.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/user/UserQuery.java
@@ -26,7 +26,7 @@ import java.util.HashSet;
 import java.util.Set;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 
 public class UserQuery {
   private final String searchText;
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/webhook/WebhookDeliveryDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/webhook/WebhookDeliveryDto.java
index 3b4c698bb92..7598168322e 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/webhook/WebhookDeliveryDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/webhook/WebhookDeliveryDto.java
@@ -21,7 +21,7 @@ package org.sonar.db.webhook;
 
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.builder.ToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringBuilder;
 
 public class WebhookDeliveryDto extends WebhookDeliveryLiteDto<WebhookDeliveryDto> {
   /** Error message if HTTP request cannot be sent, else null */
diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/webhook/WebhookDeliveryLiteDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/webhook/WebhookDeliveryLiteDto.java
index 3c8aa5ac36c..6ee6868bfee 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/webhook/WebhookDeliveryLiteDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/webhook/WebhookDeliveryLiteDto.java
@@ -21,7 +21,7 @@ package org.sonar.db.webhook;
 
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.builder.ToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringBuilder;
 
 public class WebhookDeliveryLiteDto<T extends WebhookDeliveryLiteDto> {
   /** Technical unique identifier, can't be null */
diff --git a/server/sonar-db-dao/src/test/java/org/sonar/db/DBSessionsImplTest.java b/server/sonar-db-dao/src/test/java/org/sonar/db/DBSessionsImplTest.java
index 49b4699c66a..28a7df9aa5b 100644
--- a/server/sonar-db-dao/src/test/java/org/sonar/db/DBSessionsImplTest.java
+++ b/server/sonar-db-dao/src/test/java/org/sonar/db/DBSessionsImplTest.java
@@ -41,7 +41,7 @@ import org.slf4j.event.Level;
 import org.sonar.api.testfixtures.log.LogTesterJUnit5;
 
 import static java.lang.Math.abs;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.anyBoolean;
 import static org.mockito.Mockito.mock;
diff --git a/server/sonar-db-dao/src/test/java/org/sonar/db/DbSessionImplTest.java b/server/sonar-db-dao/src/test/java/org/sonar/db/DbSessionImplTest.java
index 1d57449ff4b..63080cc63c6 100644
--- a/server/sonar-db-dao/src/test/java/org/sonar/db/DbSessionImplTest.java
+++ b/server/sonar-db-dao/src/test/java/org/sonar/db/DbSessionImplTest.java
@@ -34,7 +34,7 @@ import org.apache.ibatis.session.RowBounds;
 import org.apache.ibatis.session.SqlSession;
 import org.junit.jupiter.api.Test;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.reset;
diff --git a/server/sonar-db-dao/src/test/java/org/sonar/db/ce/CeActivityDtoTest.java b/server/sonar-db-dao/src/test/java/org/sonar/db/ce/CeActivityDtoTest.java
index 5cf25f7670d..bb6ee8a1bc7 100644
--- a/server/sonar-db-dao/src/test/java/org/sonar/db/ce/CeActivityDtoTest.java
+++ b/server/sonar-db-dao/src/test/java/org/sonar/db/ce/CeActivityDtoTest.java
@@ -24,8 +24,8 @@ import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.MethodSource;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatNoException;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
diff --git a/server/sonar-db-dao/src/test/java/org/sonar/db/ce/CeTaskMessageDtoTest.java b/server/sonar-db-dao/src/test/java/org/sonar/db/ce/CeTaskMessageDtoTest.java
index 17f83d4cffa..bddef84d28d 100644
--- a/server/sonar-db-dao/src/test/java/org/sonar/db/ce/CeTaskMessageDtoTest.java
+++ b/server/sonar-db-dao/src/test/java/org/sonar/db/ce/CeTaskMessageDtoTest.java
@@ -21,7 +21,7 @@ package org.sonar.db.ce;
 
 import org.junit.jupiter.api.Test;
 
-import static org.apache.commons.lang.StringUtils.repeat;
+import static org.apache.commons.lang3.StringUtils.repeat;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.sonar.db.ce.CeTaskMessageDto.MAX_MESSAGE_SIZE;
diff --git a/server/sonar-db-dao/src/test/java/org/sonar/db/ce/UpdateIfTest.java b/server/sonar-db-dao/src/test/java/org/sonar/db/ce/UpdateIfTest.java
index 7e8367e062f..26eeec51bca 100644
--- a/server/sonar-db-dao/src/test/java/org/sonar/db/ce/UpdateIfTest.java
+++ b/server/sonar-db-dao/src/test/java/org/sonar/db/ce/UpdateIfTest.java
@@ -20,7 +20,7 @@
 package org.sonar.db.ce;
 
 import java.util.Random;
-import org.apache.commons.lang.RandomStringUtils;
+import org.apache.commons.lang3.RandomStringUtils;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.MethodSource;
diff --git a/server/sonar-db-dao/src/test/java/org/sonar/db/component/AnalysisPropertyDtoTest.java b/server/sonar-db-dao/src/test/java/org/sonar/db/component/AnalysisPropertyDtoTest.java
index 5c5056ea672..2b6c722ddd9 100644
--- a/server/sonar-db-dao/src/test/java/org/sonar/db/component/AnalysisPropertyDtoTest.java
+++ b/server/sonar-db-dao/src/test/java/org/sonar/db/component/AnalysisPropertyDtoTest.java
@@ -21,7 +21,7 @@ package org.sonar.db.component;
 
 import org.junit.jupiter.api.Test;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
diff --git a/server/sonar-db-dao/src/test/java/org/sonar/db/component/ScrapAnalysisPropertyDtoTest.java b/server/sonar-db-dao/src/test/java/org/sonar/db/component/ScrapAnalysisPropertyDtoTest.java
index 8ef91e030be..c868dca9097 100644
--- a/server/sonar-db-dao/src/test/java/org/sonar/db/component/ScrapAnalysisPropertyDtoTest.java
+++ b/server/sonar-db-dao/src/test/java/org/sonar/db/component/ScrapAnalysisPropertyDtoTest.java
@@ -23,7 +23,7 @@ import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.ValueSource;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.assertj.core.api.Assertions.assertThat;
 
 class ScrapAnalysisPropertyDtoTest {
diff --git a/server/sonar-db-dao/src/test/java/org/sonar/db/component/SnapshotDtoTest.java b/server/sonar-db-dao/src/test/java/org/sonar/db/component/SnapshotDtoTest.java
index 801d4ab7454..6a1e6faa601 100644
--- a/server/sonar-db-dao/src/test/java/org/sonar/db/component/SnapshotDtoTest.java
+++ b/server/sonar-db-dao/src/test/java/org/sonar/db/component/SnapshotDtoTest.java
@@ -22,7 +22,7 @@ package org.sonar.db.component;
 
 import org.junit.jupiter.api.Test;
 
-import static org.apache.commons.lang.StringUtils.repeat;
+import static org.apache.commons.lang3.StringUtils.repeat;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.sonar.api.utils.DateUtils.parseDate;
diff --git a/server/sonar-db-dao/src/test/java/org/sonar/db/issue/IssueDtoTest.java b/server/sonar-db-dao/src/test/java/org/sonar/db/issue/IssueDtoTest.java
index aeea53fb97b..84508faee34 100644
--- a/server/sonar-db-dao/src/test/java/org/sonar/db/issue/IssueDtoTest.java
+++ b/server/sonar-db-dao/src/test/java/org/sonar/db/issue/IssueDtoTest.java
@@ -26,7 +26,7 @@ import java.util.Calendar;
 import java.util.Date;
 import java.util.List;
 import java.util.Set;
-import org.apache.commons.lang.time.DateUtils;
+import org.apache.commons.lang3.time.DateUtils;
 import org.junit.jupiter.api.Test;
 import org.sonar.api.issue.Issue;
 import org.sonar.api.issue.IssueStatus;
diff --git a/server/sonar-db-dao/src/test/java/org/sonar/db/property/InternalComponentPropertyDtoTest.java b/server/sonar-db-dao/src/test/java/org/sonar/db/property/InternalComponentPropertyDtoTest.java
index 6a730e2098a..9c521edd3ce 100644
--- a/server/sonar-db-dao/src/test/java/org/sonar/db/property/InternalComponentPropertyDtoTest.java
+++ b/server/sonar-db-dao/src/test/java/org/sonar/db/property/InternalComponentPropertyDtoTest.java
@@ -19,7 +19,7 @@
  */
 package org.sonar.db.property;
 
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.NullAndEmptySource;
diff --git a/server/sonar-db-dao/src/test/java/org/sonar/db/rule/RuleDtoTest.java b/server/sonar-db-dao/src/test/java/org/sonar/db/rule/RuleDtoTest.java
index 30fa9f0689b..5d5fdf89a43 100644
--- a/server/sonar-db-dao/src/test/java/org/sonar/db/rule/RuleDtoTest.java
+++ b/server/sonar-db-dao/src/test/java/org/sonar/db/rule/RuleDtoTest.java
@@ -31,8 +31,8 @@ import org.sonar.api.rules.RuleType;
 import org.sonar.core.util.Uuids;
 import org.sonar.db.issue.ImpactDto;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
-import static org.apache.commons.lang.StringUtils.repeat;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.StringUtils.repeat;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.assertj.core.api.Assertions.tuple;
diff --git a/server/sonar-db-dao/src/test/java/org/sonar/db/scim/ScimGroupDaoTest.java b/server/sonar-db-dao/src/test/java/org/sonar/db/scim/ScimGroupDaoTest.java
index f80118de9bb..3fd4797c6a4 100644
--- a/server/sonar-db-dao/src/test/java/org/sonar/db/scim/ScimGroupDaoTest.java
+++ b/server/sonar-db-dao/src/test/java/org/sonar/db/scim/ScimGroupDaoTest.java
@@ -23,7 +23,7 @@ import java.util.Collection;
 import java.util.List;
 import java.util.Map;
 import java.util.stream.IntStream;
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
 import org.junit.jupiter.params.ParameterizedTest;
@@ -33,7 +33,7 @@ import org.sonar.db.OffsetBasedPagination;
 import org.sonar.db.Pagination;
 import org.sonar.db.user.GroupDto;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatCode;
 import static org.assertj.core.api.Fail.fail;
diff --git a/server/sonar-db-dao/src/test/java/org/sonar/db/user/UserTokenDtoTest.java b/server/sonar-db-dao/src/test/java/org/sonar/db/user/UserTokenDtoTest.java
index 44c22aaf334..5a7482f59a0 100644
--- a/server/sonar-db-dao/src/test/java/org/sonar/db/user/UserTokenDtoTest.java
+++ b/server/sonar-db-dao/src/test/java/org/sonar/db/user/UserTokenDtoTest.java
@@ -23,7 +23,7 @@ import java.time.ZoneId;
 import java.time.ZonedDateTime;
 import org.junit.jupiter.api.Test;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/TestDbImpl.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/TestDbImpl.java
index 927497792c0..5e2cd46a63e 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/TestDbImpl.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/TestDbImpl.java
@@ -29,7 +29,7 @@ import java.util.function.Function;
 import java.util.stream.Collectors;
 import javax.annotation.Nullable;
 import org.apache.commons.codec.digest.DigestUtils;
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.junit.AssumptionViolatedException;
 import org.sonar.api.config.internal.Settings;
 import org.sonar.db.dialect.H2;
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/alm/integration/pat/AlmPatsTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/alm/integration/pat/AlmPatsTesting.java
index 8b926163eea..ed2433ccb86 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/alm/integration/pat/AlmPatsTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/alm/integration/pat/AlmPatsTesting.java
@@ -21,7 +21,7 @@ package org.sonar.db.alm.integration.pat;
 
 import org.sonar.db.alm.pat.AlmPatDto;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 
 public class AlmPatsTesting {
 
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/almsettings/AlmSettingsTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/almsettings/AlmSettingsTesting.java
index d5d1b10a92e..d54d1a01425 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/almsettings/AlmSettingsTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/almsettings/AlmSettingsTesting.java
@@ -24,8 +24,8 @@ import org.sonar.db.alm.setting.AlmSettingDto;
 import org.sonar.db.alm.setting.ProjectAlmSettingDto;
 import org.sonar.db.project.ProjectDto;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
-import static org.apache.commons.lang.RandomStringUtils.randomNumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomNumeric;
 
 public class AlmSettingsTesting {
 
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/anticipatedtransition/AnticipatedTransitionDbTester.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/anticipatedtransition/AnticipatedTransitionDbTester.java
index 64f6e742fb0..09a41b7d914 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/anticipatedtransition/AnticipatedTransitionDbTester.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/anticipatedtransition/AnticipatedTransitionDbTester.java
@@ -27,7 +27,7 @@ import org.sonar.db.DbTester;
 import org.sonar.db.issue.AnticipatedTransitionDto;
 import org.sonar.db.issue.AnticipatedTransitionMapper;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
 
 public class AnticipatedTransitionDbTester {
 
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/audit/AuditTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/audit/AuditTesting.java
index 0d3ee6960f9..a1890290811 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/audit/AuditTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/audit/AuditTesting.java
@@ -19,24 +19,25 @@
  */
 package org.sonar.db.audit;
 
+import java.security.SecureRandom;
 import java.util.Random;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 
 public class AuditTesting {
 
-  private static final Random random = new Random();
+  private static final Random RANDOM = new SecureRandom();
 
   private AuditTesting() {
     throw new IllegalStateException("Utility class");
   }
 
   public static AuditDto newAuditDto() {
-    return newAuditDto(random.nextLong(), "operation");
+    return newAuditDto(RANDOM.nextLong(Long.MAX_VALUE), "operation");
   }
 
   public static AuditDto newAuditDto(String operation) {
-    return newAuditDto(random.nextLong(), operation);
+    return newAuditDto(RANDOM.nextLong(Long.MAX_VALUE), operation);
   }
 
   public static AuditDto newAuditDto(long createdAt) {
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/ce/CeQueueTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/ce/CeQueueTesting.java
index 39d0ba4cab4..9db889fbe1f 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/ce/CeQueueTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/ce/CeQueueTesting.java
@@ -19,17 +19,21 @@
  */
 package org.sonar.db.ce;
 
+import java.security.SecureRandom;
+import java.util.Random;
 import java.util.stream.Stream;
 import org.sonar.db.DbSession;
 
 import static com.google.common.base.Preconditions.checkArgument;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
-import static org.apache.commons.lang.math.RandomUtils.nextLong;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.sonar.db.ce.CeQueueDto.Status.IN_PROGRESS;
 import static org.sonar.db.ce.CeQueueDto.Status.PENDING;
 
 public class CeQueueTesting {
+
+  private static final Random RANDOM = new SecureRandom();
+
   private CeQueueTesting() {
     // static methods only
   }
@@ -42,8 +46,8 @@ public class CeQueueTesting {
       .setStatus(CeQueueDto.Status.PENDING)
       .setTaskType(CeTaskTypes.REPORT)
       .setSubmitterUuid(randomAlphanumeric(255))
-      .setCreatedAt(nextLong())
-      .setUpdatedAt(nextLong());
+      .setCreatedAt(RANDOM.nextLong(Long.MAX_VALUE))
+      .setUpdatedAt(RANDOM.nextLong(Long.MAX_VALUE));
   }
 
   public static void makeInProgress(DbSession dbSession, String workerUuid, long now, CeQueueDto... ceQueueDtos) {
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/component/ComponentTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/component/ComponentTesting.java
index 49beb7377ea..a0178d92e98 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/component/ComponentTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/component/ComponentTesting.java
@@ -29,7 +29,7 @@ import org.sonar.db.project.CreationMethod;
 import org.sonar.db.project.ProjectDto;
 
 import static com.google.common.base.Preconditions.checkArgument;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.sonar.db.component.BranchDto.DEFAULT_MAIN_BRANCH_NAME;
 import static org.sonar.db.component.ComponentDto.UUID_PATH_OF_ROOT;
 import static org.sonar.db.component.ComponentDto.formatUuidPathFromParent;
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/component/ProjectLinkTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/component/ProjectLinkTesting.java
index 4ac0aad7072..3bae295722d 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/component/ProjectLinkTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/component/ProjectLinkTesting.java
@@ -19,18 +19,21 @@
  */
 package org.sonar.db.component;
 
-import org.apache.commons.lang.math.RandomUtils;
+import java.security.SecureRandom;
+import java.util.Random;
 import org.sonar.core.util.Uuids;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 
 public class ProjectLinkTesting {
 
+  private static final Random RANDOM = new SecureRandom();
+
   public static ProjectLinkDto newProvidedLinkDto() {
     return newCommonLinkDto()
       .setName(null)
-      .setType(ProjectLinkDto.PROVIDED_TYPES.get(RandomUtils.nextInt(ProjectLinkDto.PROVIDED_TYPES.size() - 1)));
+      .setType(ProjectLinkDto.PROVIDED_TYPES.get(RANDOM.nextInt(ProjectLinkDto.PROVIDED_TYPES.size() - 1)));
   }
 
   public static ProjectLinkDto newCustomLinkDto() {
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/component/SnapshotTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/component/SnapshotTesting.java
index 0aaaf713c4f..39ad4a518cc 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/component/SnapshotTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/component/SnapshotTesting.java
@@ -21,8 +21,8 @@ package org.sonar.db.component;
 
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
-import static org.apache.commons.lang.RandomStringUtils.randomAscii;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAscii;
 
 public class SnapshotTesting {
 
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/event/EventTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/event/EventTesting.java
index 1a6ca8d5002..d95dc7b6b65 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/event/EventTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/event/EventTesting.java
@@ -22,7 +22,7 @@ package org.sonar.db.event;
 import org.sonar.db.component.SnapshotDto;
 
 import static java.util.Objects.requireNonNull;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 
 public class EventTesting {
 
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/measure/MeasureTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/measure/MeasureTesting.java
index a9928b8a05e..1beb000887c 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/measure/MeasureTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/measure/MeasureTesting.java
@@ -19,7 +19,8 @@
  */
 package org.sonar.db.measure;
 
-import org.apache.commons.lang.math.RandomUtils;
+import java.security.SecureRandom;
+import java.util.Random;
 import org.sonar.db.component.BranchDto;
 import org.sonar.db.component.ComponentDto;
 import org.sonar.db.component.SnapshotDto;
@@ -29,7 +30,9 @@ import static com.google.common.base.Preconditions.checkNotNull;
 
 public class MeasureTesting {
 
-  private static int cursor = RandomUtils.nextInt(100);
+  private static final Random RANDOM = new SecureRandom();
+
+  private static int cursor = RANDOM.nextInt(100);
 
   private MeasureTesting() {
     // static methods only
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/metric/MetricTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/metric/MetricTesting.java
index 62d202552d7..84cdc5a7571 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/metric/MetricTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/metric/MetricTesting.java
@@ -19,11 +19,15 @@
  */
 package org.sonar.db.metric;
 
-import org.apache.commons.lang.RandomStringUtils;
-import org.apache.commons.lang.math.RandomUtils;
+import java.security.SecureRandom;
+import java.util.Random;
+import org.apache.commons.lang3.RandomStringUtils;
 import org.sonar.api.measures.Metric;
 
 public class MetricTesting {
+
+  private static final Random RANDOM = new SecureRandom();
+
   private MetricTesting() {
     // static stuff only
   }
@@ -34,16 +38,16 @@ public class MetricTesting {
       .setUuid(RandomStringUtils.randomAlphanumeric(40))
       .setKey(RandomStringUtils.randomAlphanumeric(64))
       .setShortName(RandomStringUtils.randomAlphanumeric(64))
-      .setValueType(metricTypes[RandomUtils.nextInt(metricTypes.length - 1)].name())
+      .setValueType(metricTypes[RANDOM.nextInt(metricTypes.length - 1)].name())
       .setDomain(RandomStringUtils.randomAlphanumeric(64))
       .setDescription(RandomStringUtils.randomAlphanumeric(250))
-      .setBestValue(RandomUtils.nextDouble())
-      .setDeleteHistoricalData(RandomUtils.nextBoolean())
-      .setDirection(RandomUtils.nextInt())
-      .setHidden(RandomUtils.nextBoolean())
+      .setBestValue(RANDOM.nextDouble())
+      .setDeleteHistoricalData(RANDOM.nextBoolean())
+      .setDirection(RANDOM.nextInt(Integer.MAX_VALUE))
+      .setHidden(RANDOM.nextBoolean())
       .setEnabled(true)
-      .setOptimizedBestValue(RandomUtils.nextBoolean())
-      .setQualitative(RandomUtils.nextBoolean())
-      .setWorstValue(RandomUtils.nextDouble());
+      .setOptimizedBestValue(RANDOM.nextBoolean())
+      .setQualitative(RANDOM.nextBoolean())
+      .setWorstValue(RANDOM.nextDouble());
   }
 }
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/permission/template/PermissionTemplateTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/permission/template/PermissionTemplateTesting.java
index 8c52c8bbc71..8cb96a4afe8 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/permission/template/PermissionTemplateTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/permission/template/PermissionTemplateTesting.java
@@ -19,17 +19,21 @@
  */
 package org.sonar.db.permission.template;
 
+import java.security.SecureRandom;
 import java.util.Date;
+import java.util.Random;
 import java.util.function.Consumer;
-import org.apache.commons.lang.math.RandomUtils;
 import org.sonar.core.util.Uuids;
 import org.sonar.db.permission.PermissionsTestHelper;
 
 import static java.util.Arrays.stream;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
-import static org.apache.commons.lang.RandomStringUtils.randomAscii;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAscii;
 
 public class PermissionTemplateTesting {
+
+  private static final Random RANDOM = new SecureRandom();
+
   @SafeVarargs
   public static PermissionTemplateDto newPermissionTemplateDto(Consumer<PermissionTemplateDto>... populators) {
     PermissionTemplateDto dto = new PermissionTemplateDto()
@@ -44,7 +48,7 @@ public class PermissionTemplateTesting {
 
   public static PermissionTemplateUserDto newPermissionTemplateUserDto() {
     return new PermissionTemplateUserDto()
-      .setPermission(PermissionsTestHelper.ALL_PERMISSIONS.toArray(new String[0])[RandomUtils.nextInt(PermissionsTestHelper.ALL_PERMISSIONS.size())])
+      .setPermission(PermissionsTestHelper.ALL_PERMISSIONS.toArray(new String[0])[RANDOM.nextInt(PermissionsTestHelper.ALL_PERMISSIONS.size())])
       .setCreatedAt(new Date())
       .setUpdatedAt(new Date());
   }
@@ -52,7 +56,7 @@ public class PermissionTemplateTesting {
   public static PermissionTemplateGroupDto newPermissionTemplateGroupDto() {
     return new PermissionTemplateGroupDto()
       .setUuid(Uuids.createFast())
-      .setPermission(PermissionsTestHelper.ALL_PERMISSIONS.toArray(new String[0])[RandomUtils.nextInt(PermissionsTestHelper.ALL_PERMISSIONS.size())])
+      .setPermission(PermissionsTestHelper.ALL_PERMISSIONS.toArray(new String[0])[RANDOM.nextInt(PermissionsTestHelper.ALL_PERMISSIONS.size())])
       .setCreatedAt(new Date())
       .setUpdatedAt(new Date());
   }
@@ -60,8 +64,8 @@ public class PermissionTemplateTesting {
   public static PermissionTemplateCharacteristicDto newPermissionTemplateCharacteristicDto() {
     return new PermissionTemplateCharacteristicDto()
       .setUuid(Uuids.createFast())
-      .setPermission(PermissionsTestHelper.ALL_PERMISSIONS.toArray(new String[0])[RandomUtils.nextInt(PermissionsTestHelper.ALL_PERMISSIONS.size())])
-      .setWithProjectCreator(RandomUtils.nextBoolean())
+      .setPermission(PermissionsTestHelper.ALL_PERMISSIONS.toArray(new String[0])[RANDOM.nextInt(PermissionsTestHelper.ALL_PERMISSIONS.size())])
+      .setWithProjectCreator(RANDOM.nextBoolean())
       .setCreatedAt(System.currentTimeMillis())
       .setUpdatedAt(System.currentTimeMillis());
   }
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/plugin/PluginTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/plugin/PluginTesting.java
index 6ca04bf047d..517a31ba5f8 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/plugin/PluginTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/plugin/PluginTesting.java
@@ -19,13 +19,16 @@
  */
 package org.sonar.db.plugin;
 
+import java.security.SecureRandom;
+import java.util.Random;
 import org.sonar.core.util.Uuids;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
-import static org.apache.commons.lang.math.RandomUtils.nextLong;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 
 public class PluginTesting {
 
+  private static final Random RANDOM = new SecureRandom();
+
   private PluginTesting() {
     // prevent instantiation
   }
@@ -39,8 +42,8 @@ public class PluginTesting {
       .setUuid(uuid)
       .setKee(uuid)
       .setFileHash(randomAlphanumeric(32))
-      .setCreatedAt(nextLong())
-      .setUpdatedAt(nextLong());
+      .setCreatedAt(RANDOM.nextLong(Long.MAX_VALUE))
+      .setUpdatedAt(RANDOM.nextLong(Long.MAX_VALUE));
   }
 
 }
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/property/PropertyTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/property/PropertyTesting.java
index 7ae874f0fb9..2112e423d9d 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/property/PropertyTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/property/PropertyTesting.java
@@ -19,8 +19,9 @@
  */
 package org.sonar.db.property;
 
+import java.security.SecureRandom;
+import java.util.Random;
 import javax.annotation.Nullable;
-import org.apache.commons.lang.math.RandomUtils;
 import org.sonar.db.entity.EntityDto;
 import org.sonar.db.user.UserDto;
 
@@ -28,7 +29,8 @@ import static com.google.common.base.Preconditions.checkNotNull;
 
 public class PropertyTesting {
 
-  private static int cursor = RandomUtils.nextInt(100);
+  private static final Random RANDOM = new SecureRandom();
+  private static int cursor = RANDOM.nextInt(100);
 
   private PropertyTesting() {
     // static methods only
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/qualitygate/QualityGateDbTester.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/qualitygate/QualityGateDbTester.java
index 05efceac405..2da309dde91 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/qualitygate/QualityGateDbTester.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/qualitygate/QualityGateDbTester.java
@@ -33,8 +33,8 @@ import org.sonar.db.property.PropertyDto;
 import org.sonar.db.user.GroupDto;
 import org.sonar.db.user.UserDto;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
-import static org.apache.commons.lang.RandomStringUtils.randomNumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomNumeric;
 
 public class QualityGateDbTester {
   private static final String DEFAULT_QUALITY_GATE_PROPERTY_NAME = "qualitygate.default";
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/qualityprofile/QualityProfileDbTester.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/qualityprofile/QualityProfileDbTester.java
index 8f2bf0a2632..1b964f67e81 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/qualityprofile/QualityProfileDbTester.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/qualityprofile/QualityProfileDbTester.java
@@ -19,8 +19,10 @@
  */
 package org.sonar.db.qualityprofile;
 
+import java.security.SecureRandom;
 import java.util.Arrays;
 import java.util.Optional;
+import java.util.Random;
 import java.util.function.Consumer;
 import org.sonar.api.rule.Severity;
 import org.sonar.core.util.Uuids;
@@ -33,11 +35,10 @@ import org.sonar.db.user.GroupDto;
 import org.sonar.db.user.UserDto;
 
 import static com.google.common.base.Preconditions.checkArgument;
-import static org.apache.commons.lang.math.RandomUtils.nextInt;
-import static org.apache.commons.lang.math.RandomUtils.nextLong;
 import static org.sonar.db.qualityprofile.ActiveRuleDto.createFor;
 
 public class QualityProfileDbTester {
+  private final Random random = new SecureRandom();
   private final DbClient dbClient;
   private final DbSession dbSession;
 
@@ -94,9 +95,9 @@ public class QualityProfileDbTester {
 
   public ActiveRuleDto activateRule(QProfileDto profile, RuleDto rule, Consumer<ActiveRuleDto> consumer) {
     ActiveRuleDto activeRule = createFor(profile, rule)
-      .setSeverity(Severity.ALL.get(nextInt(Severity.ALL.size())))
-      .setCreatedAt(nextLong())
-      .setUpdatedAt(nextLong());
+      .setSeverity(Severity.ALL.get(random.nextInt(Severity.ALL.size())))
+      .setCreatedAt(random.nextLong(Long.MAX_VALUE))
+      .setUpdatedAt(random.nextLong(Long.MAX_VALUE));
     consumer.accept(activeRule);
     dbClient.activeRuleDao().insert(dbSession, activeRule);
     dbSession.commit();
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/qualityprofile/QualityProfileTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/qualityprofile/QualityProfileTesting.java
index f29a32dbc04..32034fd6162 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/qualityprofile/QualityProfileTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/qualityprofile/QualityProfileTesting.java
@@ -19,16 +19,19 @@
  */
 package org.sonar.db.qualityprofile;
 
+import java.security.SecureRandom;
+import java.util.Random;
 import java.util.function.Consumer;
 import org.sonar.core.util.Uuids;
 
 import static java.util.Arrays.stream;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
-import static org.apache.commons.lang.math.RandomUtils.nextLong;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 
 public class QualityProfileTesting {
 
+  private static final Random RANDOM = new SecureRandom();
+
   private QualityProfileTesting() {
     // prevent instantiation
   }
@@ -43,7 +46,7 @@ public class QualityProfileTesting {
       .setRulesProfileUuid(Uuids.createFast())
       .setName(uuid)
       .setLanguage(randomAlphanumeric(20))
-      .setLastUsed(nextLong());
+      .setLastUsed(RANDOM.nextLong(Long.MAX_VALUE));
   }
 
   /**
@@ -54,7 +57,7 @@ public class QualityProfileTesting {
     return new QProfileChangeDto()
       .setUuid(randomAlphanumeric(40))
       .setRulesProfileUuid(randomAlphanumeric(40))
-      .setCreatedAt(nextLong())
+      .setCreatedAt(RANDOM.nextLong(Long.MAX_VALUE))
       .setChangeType("ACTIVATED")
       .setUserUuid("userUuid_" + randomAlphanumeric(10));
   }
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/rule/RuleTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/rule/RuleTesting.java
index b2fae217b51..b81a436edc2 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/rule/RuleTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/rule/RuleTesting.java
@@ -19,7 +19,9 @@
  */
 package org.sonar.db.rule;
 
+import java.security.SecureRandom;
 import java.util.Collection;
+import java.util.Random;
 import java.util.Set;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.Consumer;
@@ -40,9 +42,8 @@ import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.collect.ImmutableSet.copyOf;
 import static com.google.common.collect.Sets.newHashSet;
 import static java.util.Arrays.stream;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphabetic;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
-import static org.apache.commons.lang.math.RandomUtils.nextInt;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.sonar.api.rule.RuleKey.EXTERNAL_RULE_REPO_PREFIX;
 import static org.sonar.api.rules.RuleType.CODE_SMELL;
 import static org.sonar.db.rule.RuleDescriptionSectionDto.createDefaultRuleDescriptionSection;
@@ -59,6 +60,8 @@ public class RuleTesting {
 
   private static final AtomicLong nextRuleId = new AtomicLong(0);
 
+  private static final Random RANDOM = new SecureRandom();
+
   private static final UuidFactory uuidFactory = UuidFactoryFast.getInstance();
 
   private RuleTesting() {
@@ -102,19 +105,19 @@ public class RuleTesting {
         .setSeverity(org.sonar.api.issue.impact.Severity.HIGH))
       .setStatus(RuleStatus.READY)
       .setConfigKey("configKey_" + ruleKey.rule())
-      .setSeverity(Severity.ALL.get(nextInt(Severity.ALL.size())))
+      .setSeverity(Severity.ALL.get(RANDOM.nextInt(Severity.ALL.size())))
       .setIsTemplate(false)
       .setIsExternal(false)
       .setIsAdHoc(false)
       .setSystemTags(newHashSet("tag_" + randomAlphanumeric(5), "tag_" + randomAlphanumeric(5)))
       .setLanguage("lang_" + randomAlphanumeric(3))
       .setGapDescription("gapDescription_" + randomAlphanumeric(5))
-      .setDefRemediationBaseEffort(nextInt(10) + "h")
+      .setDefRemediationBaseEffort(RANDOM.nextInt(10) + "h")
       // voluntarily offset the remediation to be able to detect issues
-      .setDefRemediationGapMultiplier((nextInt(10) + 10) + "h")
+      .setDefRemediationGapMultiplier((RANDOM.nextInt(10) + 10) + "h")
       .setDefRemediationFunction("LINEAR_OFFSET")
-      .setRemediationBaseEffort(nextInt(10) + "h")
-      .setRemediationGapMultiplier(nextInt(10) + "h")
+      .setRemediationBaseEffort(RANDOM.nextInt(10) + "h")
+      .setRemediationGapMultiplier(RANDOM.nextInt(10) + "h")
       .setRemediationFunction("LINEAR_OFFSET")
       .setTags(newHashSet("tag_" + randomAlphanumeric(5), "tag_" + randomAlphanumeric(5)))
       .setNoteData("noteData_" + randomAlphanumeric(5))
@@ -123,8 +126,8 @@ public class RuleTesting {
       .setNoteUpdatedAt(System.currentTimeMillis() - 150)
       .setAdHocName("adHocName_" + randomAlphanumeric(5))
       .setAdHocDescription("adHocDescription_" + randomAlphanumeric(5))
-      .setAdHocSeverity(Severity.ALL.get(nextInt(Severity.ALL.size())))
-      .setAdHocType(RuleType.values()[nextInt(RuleType.values().length - 1)])
+      .setAdHocSeverity(Severity.ALL.get(RANDOM.nextInt(Severity.ALL.size())))
+      .setAdHocType(RuleType.values()[RANDOM.nextInt(RuleType.values().length - 1)])
       .setCreatedAt(currentTimeMillis)
       .setUpdatedAt(currentTimeMillis + 5)
       .setScope(Scope.MAIN)
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/source/FileSourceTester.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/source/FileSourceTester.java
index 7cd31ecf38d..3926b3452ea 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/source/FileSourceTester.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/source/FileSourceTester.java
@@ -19,21 +19,23 @@
  */
 package org.sonar.db.source;
 
+import java.security.SecureRandom;
 import java.util.Arrays;
 import java.util.Date;
 import java.util.Random;
 import java.util.function.Consumer;
 import java.util.stream.IntStream;
-import org.apache.commons.lang.math.RandomUtils;
 import org.sonar.core.util.Uuids;
 import org.sonar.db.DbTester;
 import org.sonar.db.component.ComponentDto;
 import org.sonar.db.protobuf.DbFileSources;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 
 public class FileSourceTester {
 
+  private static final Random RANDOM = new SecureRandom();
+
   private final DbTester db;
 
   public FileSourceTester(DbTester db) {
@@ -48,7 +50,7 @@ public class FileSourceTester {
       .setFileUuid(file.uuid())
       .setSrcHash(randomAlphanumeric(50))
       .setDataHash(randomAlphanumeric(50))
-      .setLineHashes(IntStream.range(0, new Random().nextInt(21)).mapToObj(String::valueOf).toList())
+      .setLineHashes(IntStream.range(0, RANDOM.nextInt(21)).mapToObj(String::valueOf).toList())
       .setRevision(randomAlphanumeric(100))
       .setSourceData(newRandomData(3).build())
       .setCreatedAt(new Date().getTime())
@@ -86,14 +88,14 @@ public class FileSourceTester {
         .setLine(i)
         .setScmRevision(randomAlphanumeric(15))
         .setScmAuthor(randomAlphanumeric(10))
-        .setScmDate(RandomUtils.nextLong())
+        .setScmDate(RANDOM.nextLong(Long.MAX_VALUE))
         .setSource(randomAlphanumeric(20))
-        .setLineHits(RandomUtils.nextInt(4))
-        .setConditions(RandomUtils.nextInt(4))
-        .setCoveredConditions(RandomUtils.nextInt(4))
+        .setLineHits(RANDOM.nextInt(4))
+        .setConditions(RANDOM.nextInt(4))
+        .setCoveredConditions(RANDOM.nextInt(4))
         .setHighlighting(randomAlphanumeric(40))
         .setSymbols(randomAlphanumeric(30))
-        .addAllDuplication(Arrays.asList(RandomUtils.nextInt(200), RandomUtils.nextInt(200)))
+        .addAllDuplication(Arrays.asList(RANDOM.nextInt(200), RANDOM.nextInt(200)))
         .build();
     }
     return dataBuilder;
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/user/GroupTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/user/GroupTesting.java
index fe7bae60142..08d7f04db06 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/user/GroupTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/user/GroupTesting.java
@@ -19,13 +19,16 @@
  */
 package org.sonar.db.user;
 
+import java.security.SecureRandom;
 import java.util.Date;
+import java.util.Random;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
-import static org.apache.commons.lang.math.RandomUtils.nextLong;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 
 public class GroupTesting {
 
+  private static final Random RANDOM = new SecureRandom();
+
   private GroupTesting() {
     // only statics
   }
@@ -35,7 +38,7 @@ public class GroupTesting {
       .setUuid(randomAlphanumeric(40))
       .setName(randomAlphanumeric(255))
       .setDescription(randomAlphanumeric(200))
-      .setCreatedAt(new Date(nextLong()))
-      .setUpdatedAt(new Date(nextLong()));
+      .setCreatedAt(new Date(RANDOM.nextLong(Long.MAX_VALUE)))
+      .setUpdatedAt(new Date(RANDOM.nextLong(Long.MAX_VALUE)));
   }
 }
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/user/UserDbTester.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/user/UserDbTester.java
index 5d84d1c7ff0..004b5fd2caa 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/user/UserDbTester.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/user/UserDbTester.java
@@ -19,9 +19,11 @@
  */
 package org.sonar.db.user;
 
+import java.security.SecureRandom;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Optional;
+import java.util.Random;
 import java.util.Set;
 import java.util.function.Consumer;
 import javax.annotation.CheckForNull;
@@ -32,9 +34,9 @@ import org.sonar.api.web.UserRole;
 import org.sonar.core.util.Uuids;
 import org.sonar.db.DbClient;
 import org.sonar.db.DbTester;
-import org.sonar.db.dismissmessage.MessageType;
 import org.sonar.db.component.BranchDto;
 import org.sonar.db.component.ComponentDto;
+import org.sonar.db.dismissmessage.MessageType;
 import org.sonar.db.entity.EntityDto;
 import org.sonar.db.permission.GlobalPermission;
 import org.sonar.db.permission.GroupPermissionDto;
@@ -47,8 +49,7 @@ import org.sonar.db.scim.ScimUserDto;
 import static com.google.common.base.Preconditions.checkArgument;
 import static java.util.Arrays.stream;
 import static java.util.stream.Collectors.toSet;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
-import static org.apache.commons.lang.math.RandomUtils.nextLong;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 import static org.sonar.db.permission.GlobalPermission.ADMINISTER;
 import static org.sonar.db.user.GroupTesting.newGroupDto;
 
@@ -56,6 +57,8 @@ public class UserDbTester {
   private static final Set<String> PUBLIC_PERMISSIONS = Set.of(UserRole.USER, UserRole.CODEVIEWER);
   public static final String PERMISSIONS_CANT_BE_GRANTED_ON_BRANCHES = "Permissions can't be granted on branches";
 
+  private final Random random = new SecureRandom();
+
   private final DbTester db;
   private final DbClient dbClient;
 
@@ -482,7 +485,7 @@ public class UserDbTester {
   public final SessionTokenDto insertSessionToken(UserDto user, Consumer<SessionTokenDto>... populators) {
     SessionTokenDto dto = new SessionTokenDto()
       .setUserUuid(user.getUuid())
-      .setExpirationDate(nextLong());
+      .setExpirationDate(random.nextLong(Long.MAX_VALUE));
     stream(populators).forEach(p -> p.accept(dto));
     db.getDbClient().sessionTokensDao().insert(db.getSession(), dto);
     db.commit();
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/user/UserTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/user/UserTesting.java
index 0a66a03c509..ae148ef54d8 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/user/UserTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/user/UserTesting.java
@@ -19,22 +19,24 @@
  */
 package org.sonar.db.user;
 
+import java.security.SecureRandom;
 import java.util.Locale;
+import java.util.Random;
 import javax.annotation.Nullable;
 
 import static java.util.Collections.emptyList;
 import static java.util.Collections.singletonList;
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
-import static org.apache.commons.lang.math.RandomUtils.nextBoolean;
-import static org.apache.commons.lang.math.RandomUtils.nextLong;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 
 public class UserTesting {
 
+  private static final Random RANDOM = new SecureRandom();
+
   public static UserDto newUserDto() {
     return new UserDto()
       .setUuid(randomAlphanumeric(40))
       .setActive(true)
-      .setLocal(nextBoolean())
+      .setLocal(RANDOM.nextBoolean())
       .setLogin(randomAlphanumeric(30))
       .setName(randomAlphanumeric(30))
       .setEmail(randomAlphanumeric(30))
@@ -44,8 +46,8 @@ public class UserTesting {
       .setExternalIdentityProvider(randomAlphanumeric(40))
       .setSalt(randomAlphanumeric(40))
       .setCryptedPassword(randomAlphanumeric(40))
-      .setCreatedAt(nextLong())
-      .setUpdatedAt(nextLong());
+      .setCreatedAt(RANDOM.nextLong(Long.MAX_VALUE))
+      .setUpdatedAt(RANDOM.nextLong(Long.MAX_VALUE));
   }
 
   public static UserDto newUserDto(String login, String name, @Nullable String email) {
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/user/UserTokenTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/user/UserTokenTesting.java
index 33465a5fea7..d7c3d90fbe1 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/user/UserTokenTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/user/UserTokenTesting.java
@@ -19,11 +19,14 @@
  */
 package org.sonar.db.user;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
-import static org.apache.commons.lang.math.RandomUtils.nextLong;
+import org.sonar.api.utils.System2;
+
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 
 public class UserTokenTesting {
 
+  private static final long NOW = System2.INSTANCE.now();
+
   private UserTokenTesting() {
     throw new UnsupportedOperationException("This is a utility class and cannot be instantiated");
   }
@@ -33,7 +36,7 @@ public class UserTokenTesting {
       .setUserUuid("userUuid_" + randomAlphanumeric(40))
       .setName("name_" + randomAlphanumeric(20))
       .setTokenHash("hash_" + randomAlphanumeric(30))
-      .setCreatedAt(nextLong())
+      .setCreatedAt(NOW)
       .setType("USER_TOKEN");
   }
 
@@ -45,7 +48,7 @@ public class UserTokenTesting {
       .setProjectUuid("projectUuid_" + randomAlphanumeric(20))
       .setProjectKey("projectKey_" + randomAlphanumeric(40))
       .setProjectName("Project " + randomAlphanumeric(40))
-      .setCreatedAt(nextLong())
+      .setCreatedAt(NOW)
       .setType("PROJECT_ANALYSIS_TOKEN");
   }
 
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/webhook/WebhookDeliveryTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/webhook/WebhookDeliveryTesting.java
index 30c9d9c7f6b..c458c909d42 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/webhook/WebhookDeliveryTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/webhook/WebhookDeliveryTesting.java
@@ -19,18 +19,19 @@
  */
 package org.sonar.db.webhook;
 
+import java.security.SecureRandom;
 import java.util.List;
+import java.util.Random;
 import org.sonar.core.util.Uuids;
 import org.sonar.db.DbSession;
 import org.sonar.db.DbTester;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
-import static org.apache.commons.lang.math.RandomUtils.nextBoolean;
-import static org.apache.commons.lang.math.RandomUtils.nextInt;
-import static org.apache.commons.lang.math.RandomUtils.nextLong;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 
 public class WebhookDeliveryTesting {
 
+  private static final Random RANDOM = new SecureRandom();
+
   private WebhookDeliveryTesting() {
     // only statics
   }
@@ -56,11 +57,11 @@ public class WebhookDeliveryTesting {
       .setAnalysisUuid(randomAlphanumeric(40))
       .setName(randomAlphanumeric(10))
       .setUrl(randomAlphanumeric(10))
-      .setDurationMs(nextInt())
-      .setHttpStatus(nextInt())
-      .setSuccess(nextBoolean())
+      .setDurationMs(RANDOM.nextInt(Integer.MAX_VALUE))
+      .setHttpStatus(RANDOM.nextInt(Integer.MAX_VALUE))
+      .setSuccess(RANDOM.nextBoolean())
       .setPayload(randomAlphanumeric(10))
-      .setCreatedAt(nextLong());
+      .setCreatedAt(RANDOM.nextLong(Long.MAX_VALUE));
   }
 
   public static List<String> selectAllDeliveryUuids(DbTester dbTester, DbSession dbSession) {
diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/webhook/WebhookTesting.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/webhook/WebhookTesting.java
index c6da5ce9eb5..686fa1fd934 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/webhook/WebhookTesting.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/webhook/WebhookTesting.java
@@ -24,7 +24,7 @@ import java.util.Calendar;
 import java.util.function.Consumer;
 import org.sonar.db.project.ProjectDto;
 
-import static org.apache.commons.lang.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
 
 public class WebhookTesting {