deps: EOL replace commons-lang 2.6 -> commons-lang3 3.20.0 (closes 1 CVE; paves way for Java 11+ migration)

[natechadwick-intsof]

Summary

Replace commons-lang:commons-lang:2.6 (EOL since 2010) with org.apache.commons:commons-lang3:3.20.0 project-wide. commons-lang3:3.20.0 is already declared in the root pom.xml dependencyManagement (line 596-599); nothing needs to be added to the dep tree, just the package rename and the removal of the 2.6 dep.

The commons-lang 2.x line is at <commons.lang.version>2.6</commons.lang.version> and has been EOL for ~15 years; it ships 1 CVE in the analysis (NO_JAVA8_UPGRADE category, since 2.7+ would require Java 6 which we have but the 2.x line is fully unmaintained). The 3.x line is the maintained replacement with the same API surface (most class names are identical; the package is just lang3. instead of lang.).

What changes

Bulk: package rename across the codebase

A mechanical s|org\.apache\.commons\.lang\.|org.apache.commons.lang3.|g over all .java files. Total: 1,396 files (per grep -rln of org.apache.commons.lang.).

Most files only change the import line(s); the API calls themselves don't change because the class names (StringUtils, ObjectUtils, ArrayUtils, Validate, WordUtils, etc.) are identical between the two lines.

6 special-case files (require code edits, not just import renames)

File	Issue	Fix
projects/sitemanage/src/test/java/com/percussion/share/test/PSRestClient.java	org.apache.commons.lang.CharEncoding is removed in lang3 (was just a constants holder for UTF_8 etc.)	replace CharEncoding.UTF_8 with java.nio.charset.StandardCharsets.UTF_8.name()
modules/ContentUI/src/main/java/com/percussion/content/ui/aa/actions/impl/PSAutoLinkGenerationProperties.java	org.apache.commons.lang.text.StrTokenizer is removed in lang3 (CSV tokenization is now in commons-csv)	inline the CSV tokenization with StringUtils.split(text, ",") (lang3's StringUtils has split) or text.split(","); the call site only iterates over tokens and trims each, which a one-liner covers
system/release/Install/src/com/percussion/installer/action/RxInstallServiceAction.java	org.apache.commons.lang.NotImplementedException is in lang3 but deprecated; OK to keep as the API name	rename to org.apache.commons.lang3.NotImplementedException; the call site is unchanged
system/release/Install/src/com/percussion/installer/rule/RxRhythmyxServiceInstallRule.java	same as above	same as above
system/services/src/com/percussion/services/integrations/siteimprove/PSSiteImproveProviderService.java	same as above	same as above
projects/sitemanage/src/main/java/com/percussion/apibridge/AssetAdaptor.java	org.apache.commons.lang.NullArgumentException is in lang3	rename to org.apache.commons.lang3.NullArgumentException; the call site is unchanged

Pom changes

• pom.xml lines 590-595: remove the <dependency>commons-lang:commons-lang:2.6</dependency> block (the 2.6 dep)
• <commons.lang.version>2.6</commons.lang.version>: delete the property (no other consumer — verified)
• <commons.lang3.version>3.20.0</commons.lang.version>: keep as-is

Risk

• Mechanical risk: the sed rename is mostly safe but may surface subtle API differences. The ./mvn-env.sh clean install -DskipTests build will catch any cannot find symbol errors at compile time.
• Behavioral risk: commons-lang3 ships some @Deprecated shims that behave the same as commons-lang 2.x for the methods this project uses (StringUtils.x, ObjectUtils.x, etc.). The StringUtils.isEmpty/isBlank/join/split API is unchanged.
• Test risk: the project has 1,396 files involved; 200+ are test files. Unit-test smoke run after the build is recommended (not run in this environment).

Verification

• ./mvn-env.sh clean install -DskipTests succeeds on Java 1.8
• ./mvn-env.sh spotless:check passes (the sed rename may need a spotless:apply pass)
• ./mvn-env.sh dependency:tree -Dincludes=commons-lang:commons-lang returns empty (the 2.6 dep is gone)
• ./mvn-env.sh dependency:tree -Dincludes=org.apache.commons:commons-lang3 returns the 3.20.0 entry
• No UnsupportedClassVersionError in the build log
• A grep for the old coordinate is empty: grep -rln 'org\.apache\.commons\.lang\.[A-Z]' --include='*.java' should return no files in the project source tree (allow target/ and .worktrees/)

Out of scope

• The commons-collections 3.2.2 -> commons-collections4 EOL replacement (similar shape; separate PR)
• The commons-beanutils 1.11.0 -> beanutils2 EOL replacement (more complex; Jakarta migration)
• The commons-httpclient 3.1 -> HttpClient 5 EOL replacement (the project already has HttpClient 5 from chore(deps): tier1 dependency upgrades for Java 1.8 (issue #72, 13 of 19 GAVs) #79)
• Moving the project to Java 11+ (parent epic [epic] Mitigations for 117 GAVs that cannot be upgraded on Java 1.8 (closes 504 CVEs) #73, separate workstream)
• The parent pom's org.apache.commons:commons-lang3:3.20.0 is already declared; no version bump is required for this issue

References

• Parent epic: [epic] Mitigations for 117 GAVs that cannot be upgraded on Java 1.8 (closes 504 CVEs) #73
• Tier 2 EOL plan: docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/02-epic-non-upgradeable.md#t26--apache-commons-hardening
• commons-lang 2.6 -> commons-lang3 migration guide: https://commons.apache.org/proper/commons-lang/article3_0_0.html
• commons-lang3 3.20.0 API (Javadoc): https://commons.apache.org/proper/commons-lang/javadocs/api-3.20.0/

Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.

[natechadwick-intsof]

Fixed by the PR linked below. Bulk package rename across 1,396 .java files (org.apache.commons.lang.* -> org.apache.commons.lang3.*), removed the 2.6 dep from root pom and 28 module poms, and addressed 6 lang3 API differences (CharEncoding, StrTokenizer, WordUtils move, NullArgumentException removed, getFullStackTrace rename, allElementsOfType removed, StringEscapeUtils moved to commons-text). Build passes on Java 1.8 in 2:18. Closing as fixed.