-
Notifications
You must be signed in to change notification settings - Fork 554
Description
📌 Summary
This project currently depends on commons-lang:2.6 (org.apache.commons.lang), a deprecated library that is no longer maintained. Modern scanners have flagged this version for blocker-level bugs, making its continued use a risk for stability and maintainability. This issue proposes the complete removal of commons-lang and migration to its successor, commons-lang3.
⚠ Identified Issues
The following known issues in commons-lang:2.6 have been reported as blockers by vulnerability/code quality scanners:
• LANG-1049: SerializationUtils.clone() fails when cloning arrays of non-serializable objects — can cause unexpected runtime failures.
• LANG-805: SerializationUtils.clone() should throw IllegalArgumentException when trying to clone a non-serializable object — current behavior is silent and misleading.
These bugs are not patched in 2.6, and the library is no longer receiving updates.
✅ Proposed Fix
• Remove the commons-lang dependency from the project build file (build.gradle or pom.xml).
• Replace all usages with equivalents from:
◦ org.apache.commons.lang3 (Commons Lang 3)
◦ org.apache.commons.text (for text escaping utilities previously in lang)
• Some class replacements:
◦ StringUtils → org.apache.commons.lang3.StringUtils
◦ NumberUtils → org.apache.commons.lang3.math.NumberUtils
◦ StringEscapeUtils → org.apache.commons.text.StringEscapeUtils
🔗 References
• 📄 Commons Lang 3 Migration Guide
• 📦 Commons Lang 3 on Maven Central
• 🧪 Commons Text on Maven Central
• 🐛 LANG-1049
• 🐛 LANG-805
✅ Impact
• Removes blocker-level bugs from the dependency graph
• Improves code quality and error handling
• Reduces technical debt by removing an unmaintained library
• Aligns the project with modern Java libraries and best practices