Skip to content

[MNG-10928] Upgrade commons-lang3 to 3.18.0 (CVE-2025-48924) - #13082

Open
charangowdamd-cmd wants to merge 1 commit into
apache:maven-3.8.xfrom
charangowdamd-cmd:fix/mng-10928-commons-lang3-upgrade
Open

[MNG-10928] Upgrade commons-lang3 to 3.18.0 (CVE-2025-48924)#13082
charangowdamd-cmd wants to merge 1 commit into
apache:maven-3.8.xfrom
charangowdamd-cmd:fix/mng-10928-commons-lang3-upgrade

Conversation

@charangowdamd-cmd

Copy link
Copy Markdown

Following this checklist to help us incorporate your contribution quickly and easily:

  • Make sure there is a JIRA issue filed for the change: MNG-10928
  • Each commit in the pull request should have a meaningful subject line and body.
  • Format the pull request title like [MNG-XXX] SUMMARY.
  • Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
  • Run mvn clean verify to make sure basic checks pass.
  • I hereby declare this contribution to be licenced under the Apache License Version 2.0, January 2004

Description

This PR upgrades org.apache.commons:commons-lang3 from 3.8.1 to 3.18.0 in the maven-3.8.x branch to remediate CVE-2025-48924.

Key Changes

  1. Dependency Upgrade: Bumped <commonsLangVersion> from 3.8.1 to 3.18.0 in root pom.xml.
  2. Enforcer Rule Exemption: commons-lang3 >= 3.9 targets Java 8 (class file version 52.0), which triggers the enforce-bytecode-version enforcer check in maven-3.8.x (<maxJdkVersion>1.7</maxJdkVersion>). We added an <exclude>org.apache.commons:commons-lang3</exclude> under enforceBytecodeVersion to whitelist the security-patched artifact without weakening bytecode checks for all other dependencies.
  3. Compatibility Preserved: animal-sniffer-maven-plugin continues enforcing Java 1.7 API compatibility for all Maven source classes.

Verification

  • Executed mvn clean verify across all 15 reactor modules with success (0 errors, 0 test failures).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant