Skip to content

RANGER-5391: Migrate from Apache Commons Lang 2.6 to Commons Lang 3.19.0 #724

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 10 commits into from
Nov 10, 2025
Merged

RANGER-5391: Migrate from Apache Commons Lang 2.6 to Commons Lang 3.19.0 #724

merged 10 commits into from
Nov 10, 2025

Conversation

@vishnukribm
Copy link
Contributor

@vishnukribm vishnukribm commented Nov 3, 2025 •
edited
Loading

fix for https://issues.apache.org/jira/browse/RANGER-5391

This PR addresses CVE-2025-48924
by migrating Apache Ranger from Apache Commons Lang 2.6 to Commons Lang 3.19.0.

The old commons-lang:2.6 dependency is affected by CVE-2025-48924 and is no longer maintained.
commons-lang3 is a separate and actively maintained library under the package org.apache.commons.lang3.

Changes include:


Removed dependency on commons-lang:2.6

Added dependency on commons-lang3:3.19.0

Updated imports from org.apache.commons.lang.* → org.apache.commons.lang3.*

Adjusted minor API differences between Lang 2.x and 3.x

Verified build and runtime compatibility across all Ranger modules:

This change removes a known vulnerable dependency and aligns Ranger with modern, supported libraries.
image

@vishnukribm vishnukribm changed the title Migrate from Apache Commons Lang 2.6 to Commons Lang 3.19.0 to addres… Migrate from Apache Commons Lang 2.6 to Commons Lang 3.19.0 Nov 3, 2025
@vishnukribm vishnukribm changed the title Migrate from Apache Commons Lang 2.6 to Commons Lang 3.19.0 RANGER-5391:Migrate from Apache Commons Lang 2.6 to Commons Lang 3.19.0 Nov 3, 2025
@vishnukribm vishnukribm changed the title RANGER-5391:Migrate from Apache Commons Lang 2.6 to Commons Lang 3.19.0 RANGER-5391: Migrate from Apache Commons Lang 2.6 to Commons Lang 3.19.0 Nov 3, 2025
@vishnukribm
Copy link
Contributor Author

vishnukribm commented Nov 4, 2025

@mneethiraj can you help to review the pr

@mneethiraj mneethiraj requested review from Copilot and kumaab November 4, 2025 15:24
Copilot AI reviewed Nov 4, 2025
View reviewed changes
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR migrates Apache Ranger from the vulnerable Commons Lang 2.6 library to Commons Lang 3.19.0, addressing CVE-2025-48924. The migration involves updating all import statements from org.apache.commons.lang.* to org.apache.commons.lang3.* across the codebase and updating dependency declarations in POM files.

Key changes:

  • Updated Commons Lang 3 version from 3.3.2 to 3.19.0 in the root POM
  • Replaced all imports across 100+ Java files from org.apache.commons.lang to org.apache.commons.lang3
  • Removed commons-lang:2.6 dependency declarations and added commons-lang3:3.19.0 where needed

Reviewed Changes

Copilot reviewed 132 out of 132 changed files in this pull request and generated no comments.

Show a summary per file
File Description
pom.xml Updated commons-lang3 version from 3.3.2 to 3.19.0
agents-common/pom.xml Removed commons-lang 2.6 dependency declaration
agents-audit/core/pom.xml Replaced commons-lang 2.6 with commons-lang3 3.19.0 dependency
storm-agent/src/main/java/**/*.java Updated StringUtils imports to commons-lang3
ranger-examples/**/*.java Updated StringUtils imports to commons-lang3
agents-common/src/**/*.java Updated StringUtils, ArrayUtils, ObjectUtils, and Validate imports to commons-lang3
agents-audit/src/**/*.java Updated StringUtils and ArrayUtils imports to commons-lang3

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@mneethiraj
Copy link
Contributor

mneethiraj commented Nov 4, 2025

@vishnukribm - thank you for the patch to replace use of commons-lang library with commons-lang3. With this patch, commons-lang library is no more needed, hence can be removed from packaging as well - in files under distro/src/main/assembly. Can you please review and update?

@kumaab
Copy link
Contributor

kumaab commented Nov 4, 2025

@vishnukribm

Thank you for the patch, I see imports for org.apache.commons.lang package in other modules as well, some of them include: kms, ugsync, hdfs-agent. These modules are not currently part of the PR, please check for all references of imports and update. As @mneethiraj mentioned earlier, all assembly files in distro/src/main/assembly should be checked for lang references as well - thanks!

@vishnukribm
Copy link
Contributor Author

vishnukribm commented Nov 5, 2025

@mneethiraj @kumaab I’ve made the changes based on your comments. Please review them.

mneethiraj
mneethiraj approved these changes Nov 6, 2025
View reviewed changes
Copy link
Contributor

@mneethiraj mneethiraj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @vishnukribm for the patch.

@mneethiraj mneethiraj requested a review from Copilot November 6, 2025 19:28
Copilot AI reviewed Nov 6, 2025
View reviewed changes
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

kumaab
kumaab reviewed Nov 7, 2025
View reviewed changes
@vishnukribm vishnukribm requested a review from kumaab November 7, 2025 05:07
kumaab
kumaab reviewed Nov 7, 2025
View reviewed changes
@vishnukribm vishnukribm requested a review from kumaab November 8, 2025 07:19
@vishnukribm
Copy link
Contributor Author

vishnukribm commented Nov 10, 2025

@mneethiraj @kumaab who can help to merge this?

@kumaab kumaab merged commit 7008e02 into apache:master Nov 10, 2025
2 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@mneethiraj mneethiraj mneethiraj approved these changes

@kumaab kumaab kumaab approved these changes

@pradeepagrawal8184 pradeepagrawal8184 Awaiting requested review from pradeepagrawal8184

Assignees

@vishnukribm vishnukribm

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@vishnukribm @mneethiraj @kumaab