RANGER-5391: Migrate from Apache Commons Lang 2.6 to Commons Lang 3.19.0

[vishnukribm]

fix for https://issues.apache.org/jira/browse/RANGER-5391

This PR addresses CVE-2025-48924
by migrating Apache Ranger from Apache Commons Lang 2.6 to Commons Lang 3.19.0.

The old commons-lang:2.6 dependency is affected by CVE-2025-48924 and is no longer maintained.
commons-lang3 is a separate and actively maintained library under the package org.apache.commons.lang3.

Changes include:

Removed dependency on commons-lang:2.6

Added dependency on commons-lang3:3.19.0

Updated imports from org.apache.commons.lang.* → org.apache.commons.lang3.*

Adjusted minor API differences between Lang 2.x and 3.x

Verified build and runtime compatibility across all Ranger modules:

This change removes a known vulnerable dependency and aligns Ranger with modern, supported libraries.

[vishnukribm]

@mneethiraj can you help to review the pr

[Copilot]

Pull Request Overview

This PR migrates Apache Ranger from the vulnerable Commons Lang 2.6 library to Commons Lang 3.19.0, addressing CVE-2025-48924. The migration involves updating all import statements from org.apache.commons.lang.* to org.apache.commons.lang3.* across the codebase and updating dependency declarations in POM files.

Key changes:

• Updated Commons Lang 3 version from 3.3.2 to 3.19.0 in the root POM
• Replaced all imports across 100+ Java files from org.apache.commons.lang to org.apache.commons.lang3
• Removed commons-lang:2.6 dependency declarations and added commons-lang3:3.19.0 where needed

Reviewed Changes

Copilot reviewed 132 out of 132 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pom.xml	Updated commons-lang3 version from 3.3.2 to 3.19.0
agents-common/pom.xml	Removed commons-lang 2.6 dependency declaration
agents-audit/core/pom.xml	Replaced commons-lang 2.6 with commons-lang3 3.19.0 dependency
storm-agent/src/main/java/**/*.java	Updated StringUtils imports to commons-lang3
ranger-examples/**/*.java	Updated StringUtils imports to commons-lang3
agents-common/src/**/*.java	Updated StringUtils, ArrayUtils, ObjectUtils, and Validate imports to commons-lang3
agents-audit/src/**/*.java	Updated StringUtils and ArrayUtils imports to commons-lang3

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mneethiraj]

@vishnukribm - thank you for the patch to replace use of commons-lang library with commons-lang3. With this patch, commons-lang library is no more needed, hence can be removed from packaging as well - in files under distro/src/main/assembly. Can you please review and update?

[kumaab]

@vishnukribm

Thank you for the patch, I see imports for org.apache.commons.lang package in other modules as well, some of them include: kms, ugsync, hdfs-agent. These modules are not currently part of the PR, please check for all references of imports and update. As @mneethiraj mentioned earlier, all assembly files in distro/src/main/assembly should be checked for lang references as well - thanks!

[vishnukribm]

@mneethiraj @kumaab I’ve made the changes based on your comments. Please review them.

[mneethiraj]

Can you review following checkstyle failures and address them please? Make sure to run "mvn clean verify" in your local environment to detect such issues.

[ERROR] src/main/java/org/apache/ranger/ldapconfigcheck/LdapConfigCheckMain.java:[20] (regexp) RegexpMultiline: Multiple consecutive blank lines
[ERROR] src/main/java/org/apache/ranger/ldapconfigcheck/LdapConfigCheckMain.java:[161] (indentation) Indentation: 'if' child has incorrect indentation level 16, expected level should be 12.
[ERROR] src/main/java/org/apache/ranger/ldapconfigcheck/LdapConfigCheckMain.java:[161,9] (whitespace) FileTabCharacter: File contains tab characters (this is the first instance).

[mneethiraj]

Can you review following checkstyle failures and address them please? Make sure to run "mvn clean verify" in your local environment to detect such issues.

[ERROR] src/main/java/org/apache/ranger/ldapconfigcheck/LdapConfig.java:[1] (misc) NewlineAtEndOfFile: File does not end with a newline.
[ERROR] src/main/java/org/apache/ranger/ldapconfigcheck/LdapConfig.java:[100] (indentation) Indentation: 'if' child has incorrect indentation level 17, expected level should be 12.
[ERROR] src/main/java/org/apache/ranger/ldapconfigcheck/LdapConfig.java:[100,9] (whitespace) FileTabCharacter: File contains tab characters (this is the first instance).

[mneethiraj]

Thank you @vishnukribm for the patch.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.