Skip to content

Removes commons-lang:2.6 from core #26105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
alecharp wants to merge 12 commits into
base: master
Choose a base branch
from
Draft

Removes commons-lang:2.6 from core #26105

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
9491084
Removes commons-lang:2.6 from core
alecharp Jan 12, 2026
ac2bf8a
Resolves spotless issue
alecharp Jan 12, 2026
3bb1826
Merge branch 'master' into chore/remove-commons-lang-2.6
alecharp Jan 12, 2026
62b195f
Merge branch 'master' into chore/remove-commons-lang-2.6
alecharp Jan 13, 2026
67b8576
Merge branch 'master' into chore/remove-commons-lang-2.6
MarkEWaite Jan 17, 2026
21f30c1
Merge branch 'master' into chore/remove-commons-lang-2.6
alecharp Jan 20, 2026
50093ee
Merge branch 'master' into chore/remove-commons-lang-2.6
alecharp Jan 21, 2026
27a9c51
Merge branch 'master' into chore/remove-commons-lang-2.6
alecharp Jan 31, 2026
722ebfc
Merge branch 'master' into chore/remove-commons-lang-2.6
alecharp Feb 17, 2026
5e74248
Empty commit to trigger a build
alecharp Feb 18, 2026
4439998
Merge branch 'master' into chore/remove-commons-lang-2.6
alecharp Feb 20, 2026
fea13b1
Merge branch 'master' into chore/remove-commons-lang-2.6
alecharp Mar 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 0 additions & 5 deletions bom/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,11 +121,6 @@ THE SOFTWARE.
<artifactId>commons-io</artifactId>
<version>2.21.0</version>
</dependency>
<dependency>
<groupId>commons-lang</groupId>
<artifactId>commons-lang</artifactId>
Copy link
Member

@timja timja Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's the plan for rolling this out?

Example:

  1. As there's so many plugins making this a detached plugin?
  2. Fixing the majority of the plugins in the spreadsheet
  3. Something else?

Copy link
Member Author

@alecharp alecharp Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now, I want to see with the BOM if we have critical plugins broken with this removal. The security advisory of Commons Lang 2.6 has been out there for a longtime now and we need to stop from suffering from it.

Fixing all the plugins in the spreadsheet is not really feasible. Fixing the top 250 probably.

Copy link
Member Author

@alecharp alecharp Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

and with jenkinsci/plugin-pom#1338 (comment), it might go rather quickly

<version>2.6</version>
</dependency>
<dependency>
<groupId>jakarta.servlet</groupId>
<artifactId>jakarta.servlet-api</artifactId>
Expand Down
5 changes: 0 additions & 5 deletions core/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,11 +158,6 @@ THE SOFTWARE.
<groupId>commons-io</groupId>
<artifactId>commons-io</artifactId>
</dependency>
<dependency>
<!-- Jenkins doesn't use this directly, but some plugins wanted to use the latest -->
<groupId>commons-lang</groupId>
<artifactId>commons-lang</artifactId>
</dependency>
<dependency>
<groupId>io.jenkins.tools</groupId>
<artifactId>bridge-method-annotation</artifactId>
Expand Down
17 changes: 0 additions & 17 deletions core/src/main/java/hudson/Util.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,13 +94,11 @@
import java.util.EnumSet;
import java.util.HexFormat;
import java.util.List;
import java.util.Locale;
import java.util.Map;
import java.util.MissingResourceException;
import java.util.Properties;
import java.util.ResourceBundle;
import java.util.Set;
import java.util.SimpleTimeZone;
import java.util.StringTokenizer;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.atomic.AtomicBoolean;
Expand All @@ -117,7 +115,6 @@
import jenkins.util.SystemProperties;
import jenkins.util.io.PathRemover;
import org.apache.commons.io.IOUtils;
import org.apache.commons.lang.time.FastDateFormat;
import org.apache.tools.ant.BuildException;
import org.apache.tools.ant.Project;
import org.apache.tools.ant.taskdefs.Copy;
Expand Down Expand Up @@ -1878,23 +1875,9 @@ public static void printRedirect(String contextPath, String redirectUrl, String
"<!--%n", Functions.htmlAttributeEscape(redirectUrl), message);
}

/**
* @deprecated use {@link #XS_DATETIME_FORMATTER2}
*/
@Deprecated
public static final FastDateFormat XS_DATETIME_FORMATTER = FastDateFormat.getInstance("yyyy-MM-dd'T'HH:mm:ss'Z'", new SimpleTimeZone(0, "GMT"));

public static final DateTimeFormatter XS_DATETIME_FORMATTER2 =
DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ss'Z'").withZone(ZoneOffset.UTC);

// Note: RFC822 dates must not be localized!
/**
* @deprecated use {@link DateTimeFormatter#RFC_1123_DATE_TIME}
*/
@Deprecated
public static final FastDateFormat RFC822_DATETIME_FORMATTER
= FastDateFormat.getInstance("EEE, dd MMM yyyy HH:mm:ss Z", Locale.US);

private static final Logger LOGGER = Logger.getLogger(Util.class.getName());

/**
Expand Down
3 changes: 1 addition & 2 deletions core/src/main/java/jenkins/security/csp/impl/CspDecorator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,6 @@
import jenkins.security.csp.CspHeader;
import jenkins.security.csp.CspHeaderDecider;
import jenkins.security.csp.ReportingContext;
import org.apache.commons.lang.StringUtils;
import org.kohsuke.accmod.Restricted;
import org.kohsuke.accmod.restrictions.NoExternalUse;
import org.kohsuke.stapler.Ancestor;
Expand Down Expand Up @@ -74,7 +73,7 @@ public String getReportingEndpointsHeaderValue(HttpServletRequest req) {
@CheckForNull
/* package */ static String getReportingEndpoint(HttpServletRequest req) {
Class<?> modelObjectClass = null;
String restOfPath = StringUtils.removeStart(req.getRequestURI(), req.getContextPath());
String restOfPath = req.getRequestURI().replaceFirst("^" + req.getContextPath(), "");
final StaplerRequest2 staplerRequest2 = Stapler.getCurrentRequest2();
if (staplerRequest2 != null) {
final List<Ancestor> ancestors = staplerRequest2.getAncestors();
Expand Down
Loading