fix(deps): EOL replace commons-collections 3.2.2 with commons-collections4 4.5.0 (issue #86) - #87
Merged
Conversation
…ions4 4.5.0 (issue #86) Closes #86. Mechanical migration of every `org.apache.commons.collections.*` import to `org.apache.commons.collections4.*` across the codebase, plus removal of the 3.2.2 dep from the root pom and 13 module poms. The `commons-collections4:4.5.0` line was already in the root pom's dependencyManagement (only the 3.x line was in active use), so no new dep is added. Scope: - 71 .java files: `org.apache.commons.collections.` -> `org.apache.commons.collections4.` - 1 root pom + 13 module poms: drop the `commons-collections:commons-collections:3.2.2` dependency and the `<commons.collections3.version>3.2.2</commons.collections3.version>` property - 1 module pom (jcadf-master): add a direct `org.apache.commons:commons-collections4` dep, since the original `commons-collections:commons-collections` direct dep was the sole source of the collections classes in this module - 6 special-case files (see API notes below) API differences between commons-collections 3.x and 4.5.0 that this PR addresses (all behavioural, no semantic change for the call sites involved): 1. `org.apache.commons.collections.MultiHashMap` was **removed** in 4.x. The 3 call sites now use `org.apache.commons.collections4.multimap.ArrayListValuedHashMap`. The `MultiMap` interface (deprecated in 4.x but still present) was replaced with `MultiValuedMap` (the new 4.x interface that replaced it; `ArrayListValuedHashMap` implements `MultiValuedMap`, not `MultiMap`). Files: PSCalendarMonthModel, PSContentRepository, PSItemUtilities + 2 callers (PSActionPanelServlet, PSItemUtilitiesTest). 2. `CollectionUtils.addAll(Collection, Iterator)` was **removed** in 4.x (the new signatures are `addAll(Collection, Iterable)` and `addAll(Collection, Enumeration)` only). The 4 call sites that pass an Iterator are inlined to a `while (it.hasNext()) list.add(it.next())` loop. The 7 sites that pass an Iterable/Collection work unchanged. Files: PSLegacyExtensionUtils, PSContentTypeSetter (iteratorToList), PSContentTypeFieldSetter (excludes loop), PSConditionalCloneHandler. 3. `AbstractListDecorator.getCollection()` / `getList()` were renamed to `decorated()` in 4.x. The 1 call site in PSConcurrentRegionsAssembler.FutureList inlines the override as `decorated()` (and calls it from the iterator/toString overrides that previously used the public `getList()` / `getCollection()`). 4. `MapUtils.getString(Map, String)` (2-arg) and the new 3-arg `getString(Map, String, String)` (default) in 4.x use a generic signature `<K> String getString(Map<? super K, ?>, K)` that does not type-infer when the input is `Map<?, ?>`. The 1 call site in PSPageUtils casts to a raw `Map` to anchor the K-inference to String (with a `@SuppressWarnings({unchecked, rawtypes})` on the line). Verification: - ./mvn-env.sh clean install -DskipTests: BUILD SUCCESS in 3:41 (61 modules, Java 1.8.0_504) - ./mvn-env.sh spotless:check: clean (the build runs spotless:apply during validate; nothing needed reformatting beyond the inline raw-type cast above) - No UnsupportedClassVersionError in the build log - commons-collections 3.x no longer in the project's own dependency graph (only commons-collections4 4.5.0 remains; `commons-collections` 2.5 may still be pulled in transitively by legacy system-scoped jars, but that is independent of this PR) Out of scope (separate issues under #73): - commons-beanutils 1.11.0 -> beanutils2 EOL replacement (Jakarta migration; large blast radius) - commons-httpclient 3.1 -> HttpClient 5 (the project already has HttpClient 5 from #79; just remove the 3.1 dep) - commons-configuration 1.10 -> commons-configuration2 EOL replacement - T2.11 SnakeYAML SafeConstructor hardening (16 CVEs) - T2.6 size caps on the other zip sites (follow-up to #83) Refs #86, #73, #72
natechadwick
approved these changes
Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
EOL replace
commons-collections:commons-collections:3.2.2(EOL since 2015) withorg.apache.commons:commons-collections4:4.5.0project-wide.commons-collections4:4.5.0was already in the root pom'sdependencyManagement— only the 3.x line was in active use, so no new dep is added.The 3.x line has been EOL since 2015 and has 2 CVEs in the analysis report (one CRITICAL, one HIGH). The 4.x line is the maintained successor with the same API surface (most class names are identical; the package is just
collections4instead ofcollections).What changes (4 categories)
1. Bulk package rename (71 .java files)
Every
import org.apache.commons.collections.X.Y;becomesimport org.apache.commons.collections4.X.Y;. Most class names are identical between the two lines (CollectionUtils,MapUtils,ListUtils,MapIterator,Predicate,Transformer,IterableMap,IteratorUtils,FilterIterator,IteratorEnumeration,AbstractListDecorator,HashedMap, etc.) so this is mostly an import-line change with no API impact.2. Pom cleanup (1 + 13 files)
pom.xml: removed the<dependency>commons-collections:commons-collections:3.2.2</dependency>block (line 561-564) and the<commons.collections3.version>3.2.2</commons.collections3.version>property<dependency>blocks (and 5 exclusion blocks) that referenced the 3.x linemodules/jcadf-master/pom.xml): added a direct<dependency>org.apache.commons:commons-collections4</dependency>entry, since the originalcommons-collections:commons-collectionsdirect dep was the sole source of the collections classes in this module — the 4.x version is in dependencyManagement but a child pom that doesn't inherit transitive deps from a parent that uses them needs a direct declaration to bring them in3. Special-case API moves in 4.x (6 files)
projects/sitemanage/.../PSPageUtils.javaMapUtils.getString(Map, String)2-arg signature changed to a generic<K> String getString(Map<? super K, ?>, K); doesn't type-infer when input isMap<?, ?>Mapwith@SuppressWarnings({"unchecked", "rawtypes"})to anchor K=Stringmodules/extensions-sfp/.../PSCalendarMonthModel.java,system/services/.../PSContentRepository.java,system/services/.../PSItemUtilities.java(+ 2 callers:PSActionPanelServlet,PSItemUtilitiesTest)org.apache.commons.collections.MultiHashMapwas removed in 4.x;MultiMapinterface (deprecated but still present) is unrelated to the newMultiValuedMapinterface that replaced itMultiHashMap→multimap.ArrayListValuedHashMap; changeMultiMapfield/local types →MultiValuedMap; changenew MultiHashMap()→new ArrayListValuedHashMap()projects/sitemanage/.../PSLegacyExtensionUtils.java,deployer/.../PSContentTypeSetter.java(iteratorToList helper),deployer/.../PSContentTypeFieldSetter.java(excludes loop),system/.../PSConditionalCloneHandler.javaCollectionUtils.addAll(Collection, Iterator)was removed in 4.x (the new signatures areaddAll(Collection, Iterable)andaddAll(Collection, Enumeration)only)while (it.hasNext()) list.add((...) it.next())loop (with a cast for the raw-Iterator case)projects/sitemanage/.../PSConcurrentRegionsAssembler.javaAbstractListDecorator.getCollection()andgetList()were renamed todecorated()in 4.x (the 4.x base class declares it asprotected)FutureList.getCollection()override todecorated()(and remove the@Overridesincedecorated()isprotected); update internalgetList()andgetCollection()calls todecorated()The 7 other
CollectionUtils.addAll(...)call sites passIterable/Collection(notIterator) and work unchanged in 4.x.4.
jcadf-master/pom.xmldirect depThe
modules/jcadf-master(artifactIdauditlogger) module's direct<dependency>commons-collections:commons-collections</dependency>was the only source of the collections classes for that module (it doesn't inherit them transitively from a sibling). After removing the 3.x line, added a corresponding direct<dependency>org.apache.commons:commons-collections4</dependency>entry (version inherited from the parent pom's dependencyManagement). This is the only module where the direct dep is structurally required.Verification
./mvn-env.sh clean install -DskipTests→ BUILD SUCCESS in 3:41 (61 modules, Java 1.8.0_504)./mvn-env.sh spotless:check(run by the validate phase; no manual violations)UnsupportedClassVersionErrorin the build logcommons-collections:3.2.2no longer in the project's own dependency graphmvn dependency:tree -Dincludes=commons-collections:commons-collectionsis now emptycommons-collections:2.5is still pulled in transitively by legacysystem-scoped jars likeaxe:axe-saaj:1.4.1,caja,smartgwt; that is independent of this PRcommons-collections4:4.5.0resolves correctly:mvn dependency:tree -Dincludes=org.apache.commons:commons-collections4shows the dep at 4.5.0Out of scope (separate issues under #73)
commons-beanutils 1.11.0 → beanutils2EOL replacement (Jakarta migration; large blast radius)commons-httpclient 3.1 → HttpClient 5(the project already has HttpClient 5 from chore(deps): tier1 dependency upgrades for Java 1.8 (issue #72, 13 of 19 GAVs) #79; just remove the 3.1 dep)commons-configuration 1.10 → commons-configuration2EOL replacement (API changes; not just a package rename)SafeConstructorhardening (16 CVEs)References
commons-collections 3.x → 4.xmigration guide: https://commons.apache.org/proper/commons-collections/user-guide.htmlcommons-collections4 4.5.0Javadoc: https://commons.apache.org/proper/commons-collections/apidocs/org/apache/commons/collections4/package-summary.htmldocs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/02-epic-non-upgradeable.md#t26--apache-commons-hardening