Skip to content

🚫 Remove Deprecated commons-lang:2.6 Due to Blocker-Level Bugs and Migrate to commons-lang3 #1084

@relaxedboi

Description

@relaxedboi

📌 Summary
This project currently depends on commons-lang:2.6 (org.apache.commons.lang), a deprecated library that is no longer maintained. Modern scanners have flagged this version for blocker-level bugs, making its continued use a risk for stability and maintainability. This issue proposes the complete removal of commons-lang and migration to its successor, commons-lang3.

⚠ Identified Issues
The following known issues in commons-lang:2.6 have been reported as blockers by vulnerability/code quality scanners:
LANG-1049: SerializationUtils.clone() fails when cloning arrays of non-serializable objects — can cause unexpected runtime failures.
LANG-805: SerializationUtils.clone() should throw IllegalArgumentException when trying to clone a non-serializable object — current behavior is silent and misleading.
These bugs are not patched in 2.6, and the library is no longer receiving updates.

✅ Proposed Fix
• Remove the commons-lang dependency from the project build file (build.gradle or pom.xml).
• Replace all usages with equivalents from:
◦ org.apache.commons.lang3 (Commons Lang 3)
◦ org.apache.commons.text (for text escaping utilities previously in lang)
• Some class replacements:
◦ StringUtils → org.apache.commons.lang3.StringUtils
◦ NumberUtils → org.apache.commons.lang3.math.NumberUtils
◦ StringEscapeUtils → org.apache.commons.text.StringEscapeUtils

🔗 References
• 📄 Commons Lang 3 Migration Guide
• 📦 Commons Lang 3 on Maven Central
• 🧪 Commons Text on Maven Central
• 🐛 LANG-1049
• 🐛 LANG-805

✅ Impact
• Removes blocker-level bugs from the dependency graph
• Improves code quality and error handling
• Reduces technical debt by removing an unmaintained library
• Aligns the project with modern Java libraries and best practices

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions