There are quite a few instances of public static fields which appear to be intended to be constant, but which are not final.
The code would be safer if all the constant fields were made final.
Patch to follow for some of the problem fields.
The following also ought to be fixed:
org.apache.derby.iapi.services.property.PropertyUtil.servicePropertyList (e.g. use an accessor to lookup the values)