Skip to content

fix(deps): EOL replace commons-lang 2.6 with commons-lang3 3.20.0 (issue #84) - #85

Merged
natechadwick merged 1 commit into
mainfrom
security/72-commons-lang-eol
Aug 28, 2026
Merged

fix(deps): EOL replace commons-lang 2.6 with commons-lang3 3.20.0 (issue #84)#85
natechadwick merged 1 commit into
mainfrom
security/72-commons-lang-eol

Conversation

@natechadwick-intsof

@natechadwick-intsof natechadwick-intsof commented Aug 28, 2026

Copy link
Copy Markdown
Collaborator

Summary

EOL replace commons-lang:commons-lang:2.6 (EOL since 2010) with org.apache.commons:commons-lang3:3.20.0 project-wide. commons-lang3:3.20.0 was already in the root pom's dependencyManagement — only the 2.6 line was in active use, so no new dep is added.

This is a mechanical package rename plus removal of the 2.6 dep. Total: 1 431 files changed, +2 474 / −2 682.

What changes (7 categories)

1. Bulk package rename (1 396 .java files)

Every import org.apache.commons.lang.X.Y; becomes import org.apache.commons.lang3.X.Y;. Most class names are identical between the two lines (StringUtils, ObjectUtils, ArrayUtils, Validate, WordUtils, RandomStringUtils, SerializationUtils, NotImplementedException, etc.) so this is mostly an import-line change with no API impact.

2. Pom: drop commons-lang 2.6 (1 file + 28 module poms)

  • Root pom.xml: removed the <dependency>commons-lang:commons-lang:2.6</dependency> block and the <commons.lang.version>2.6</commons.lang.version> property
  • 28 module poms: removed the 4-line <dependency> block (and 5 exclusion blocks where commons-lang was being excluded from a transitive dep) that referenced the 2.6 line

3. Special-case API moves in lang3 (6 files)

File What was moved / removed in lang3 Fix
projects/sitemanage/.../PSRestClient.java org.apache.commons.lang.CharEncoding was removed in lang3 (it was a 2.x-only constants holder) use java.nio.charset.StandardCharsets.UTF_8.name()
modules/ContentUI/.../PSAutoLinkGenerationProperties.java org.apache.commons.lang.text.StrTokenizer was removed in lang3 3.12+ inline a StringUtils.split(text, ',') loop (only one call site)
modules/utils/.../PSStringUtils.java, deployer/.../PSDescriptorSummaryReport.java, projects/sitemanage/.../PSWidgetPackageSpec.java org.apache.commons.lang.WordUtils moved to org.apache.commons.lang3.text.WordUtils (subpackage change, top-level WordUtils was deleted) fix the 3 import paths
projects/sitemanage/.../AssetAdaptor.java org.apache.commons.lang.NullArgumentException was removed in lang3 use java.lang.NullPointerException with the same custom message
system/business/.../PSMetadataExtractorService.java (line 489 only) StringEscapeUtils.unescapeHtml(...) was removed from lang3 (and from commons-text too) use StringEscapeUtils.UNESCAPE_HTML4.translate("&" + entityName + ";")
2 more files: PSLegacyLinkGenerator.java, PSMetadataExtractorService.java org.apache.commons.lang3.StringEscapeUtils was moved out of lang3 entirely use org.apache.commons.text.StringEscapeUtils (commons-text 1.15.0 is already a transitive dep)

4. ExceptionUtils.getFullStackTrace(t) → getStackTrace(t) (49 call sites across 24 files)

Renamed in lang3 3.0. Many call sites are broken across multiple lines (e.g. ExceptionUtils\n .getFullStackTrace(...)); fixed with a word-bounded sed pass.

5. Validate.allElementsOfType(coll, type) removed (1 call site)

The single call site in projects/sitemanage/.../PSResourceInstanceHelper.java now inlines an instanceof loop with an IllegalArgumentException on mismatch (same throw behaviour as before).

6. StringEscapeUtils.unescapeHtml / escapeHtml / escapeHtml4 (25 call sites)

All call sites use the long-form escapeHtml4 / unescapeHtml4 which exist in commons-text 1.15.0 unchanged. Only the one unescapeHtml shortcut (in PSMetadataExtractorService.java) needed to switch to UNESCAPE_HTML4.translate(...).

7. Spotless pass during build

The build's validate phase runs spotless:apply automatically, which reformatted some of the import blocks after the sed pass. No semantic changes; the only spotless violation during my run was a multi-line import comment I had to inline (Google Java Format doesn't allow comments between import lines).

Verification

  • ./mvn-env.sh clean install -DskipTests → BUILD SUCCESS in 2:18 (61 modules, Java 1.8.0_504)
  • No UnsupportedClassVersionError in the build log
  • ./mvn-env.sh spotless:check (run by the validate phase; no manual violations)
  • commons-lang:2.6 no longer in the project's own dependency graph
    • mvn dependency:tree -Dincludes=commons-lang:commons-lang is now empty
    • commons-lang:2.5 is still pulled in transitively by axe:axe-saaj:1.4.1, caja, and com.isomorphic.smartgwt.lgpl:smartgwt (all system-scoped legacy jars in perc-system); that is independent of this PR
  • commons-lang3:3.20.0 resolves correctly: mvn dependency:tree -Dincludes=org.apache.commons:commons-lang3 shows the dep at 3.20.0

Out of scope (separate issues under #73)

  • commons-collections 3.2.2 → commons-collections4 (next EOL in queue)
  • commons-beanutils 1.11.0 → beanutils2 (Jakarta migration; large blast radius)
  • commons-httpclient 3.1 → HttpClient 5 (the project already has HttpClient 5 from chore(deps): tier1 dependency upgrades for Java 1.8 (issue #72, 13 of 19 GAVs) #79; remove the 3.1 dep)
  • commons-configuration 1.10 → commons-configuration2 (API changes; not just a package rename)

References

Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.

@natechadwick-intsof
fix(deps): EOL replace commons-lang 2.6 with commons-lang3 3.20.0
f8ef493 
Closes #84. Mechanical migration of every `org.apache.commons.lang.*`
import to `org.apache.commons.lang3.*` across the codebase, plus
removal of the 2.6 dep from the root pom and 28 module poms.

commons-lang 2.6 has been EOL since 2010. The 2.7+ line is also
unmaintained, and the project's other analysis (T2.6 hardening, #83)
flags the same set of CVEs. The 3.x line is the maintained successor;
`commons-lang3:3.20.0` was already in the root pom's dependencyManagement
(only the 2.6 line was in active use), so no new dep is added.

Scope:
  - 1,396 .java files: `org.apache.commons.lang.` -> `org.apache.commons.lang3.`
  - 29 .xml files (root pom + 28 module poms): drop the `commons-lang:commons-lang:2.6`
    dependency and the `<commons.lang.version>2.6</commons.lang.version>` property
  - 6 special-case files (see API notes below)

API differences between commons-lang 2.x and 3.20.0 that this PR
addresses (all behavioural, no semantic change for the call sites
involved):

  1. CharEncoding was removed (it was a 2.x-only constants holder).
     Fixed in projects/sitemanage/src/test/java/.../PSRestClient.java
     by switching to java.nio.charset.StandardCharsets.UTF_8.name().

  2. StrTokenizer (text.* subpackage) was removed in lang3 3.12+.
     Fixed in modules/ContentUI/.../PSAutoLinkGenerationProperties.java
     by inlining a StringUtils.split(text, ',') loop (only one call site).

  3. WordUtils was moved from top-level `org.apache.commons.lang3.WordUtils`
     to `org.apache.commons.lang3.text.WordUtils`. 3 call sites fixed
     via a per-file import path correction (modules/utils, deployer,
     projects/sitemanage).

  4. NullArgumentException was removed entirely. The only call site
     (projects/sitemanage/.../AssetAdaptor.java) now throws
     java.lang.NullPointerException with the same custom message.

  5. ExceptionUtils.getFullStackTrace(t) was renamed to getStackTrace(t)
     in lang3 3.0. 49 call sites updated across 24 files (some broken
     across multiple lines; fixed with a word-bounded sed).

  6. Validate.allElementsOfType(coll, type) was removed. The single call
     site (projects/sitemanage/.../PSResourceInstanceHelper.java) now
     inlines an instanceof loop with an IllegalArgumentException on
     mismatch.

  7. StringEscapeUtils (text.* subpackage) was moved out of lang3
     entirely; the maintained replacement is
     `org.apache.commons.text.StringEscapeUtils` in commons-text
     (already a transitive dep at 1.15.0). The 2 call sites in
     system/business/.../PSMetadataExtractorService.java and
     projects/sitemanage/.../PSLegacyLinkGenerator.java now import
     from commons-text. The legacy shortcut
     `StringEscapeUtils.unescapeHtml("&entity;")` is replaced with
     `StringEscapeUtils.UNESCAPE_HTML4.translate("&entity;")` in
     PSMetadataExtractorService (long form `escapeHtml4`/`unescapeHtml4`
     used elsewhere; both still exist in commons-text 1.15.0).

Verification:
  - ./mvn-env.sh clean install -DskipTests: BUILD SUCCESS in 2:18
    (61 modules, Java 1.8.0_504)
  - ./mvn-env.sh spotless:check: clean (the only spotless violation
    during the run was a multi-line import comment I had to inline;
    the project spotless config ran auto-style during the build and
    fixed everything else)
  - No UnsupportedClassVersionError in the build log
  - commons-lang 2.x no longer in the project's own dependency graph
    (commons-lang 2.5 is still pulled in transitively by axe/caja/
    smartgwt-jar, but the project's own declared dep is gone)

Out of scope (separate issues under #73):
  - commons-collections 3.2.2 -> commons-collections4 (next EOL in queue)
  - commons-beanutils 1.11.0 -> beanutils2 (Jakarta migration)
  - commons-httpclient 3.1 -> HttpClient 5 (the project already has
    HttpClient 5 from PR #79)
  - commons-configuration 1.10 -> commons-configuration2

Refs #84, #73, #72
@natechadwick
natechadwick merged commit c697c89 into main Aug 28, 2026
3 checks passed
@natechadwick
natechadwick deleted the security/72-commons-lang-eol branch August 28, 2026 20:48
@natechadwick-intsof natechadwick-intsof mentioned this pull request Aug 28, 2026
Closed
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@natechadwick natechadwick natechadwick approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

deps: EOL replace commons-lang 2.6 -> commons-lang3 3.20.0 (closes 1 CVE; paves way for Java 11+ migration)

2 participants

@natechadwick-intsof @natechadwick