chore: replace commons-lang with commons-lang3 due to vulnerability

[simaysanli]

Purpose

Problem is related to CVE-2025-48924. The org.wso2.charon has latest version of commons-lang is v2.6 as seen in this maven repository. It causes a vulnerability. I saw that similar issue is also reported with this issue related tocommons-lang version.

[INFO] +- org.wso2.charon:org.wso2.charon3.core:jar:4.0.7:compile
[INFO] |  +- org.ops4j.pax.logging:pax-logging-api:jar:1.10.1:compile
[INFO] |  +- org.apache.ws.commons.axiom:axiom-api:jar:1.2.22:compile
[INFO] |  |  +- org.apache.geronimo.specs:geronimo-activation_1.1_spec:jar:1.1:compile
[INFO] |  |  +- commons-logging:commons-logging:jar:1.2:compile
[INFO] |  |  +- jaxen:jaxen:jar:2.0.1:compile
[INFO] |  |  +- org.apache.geronimo.specs:geronimo-stax-api_1.0_spec:jar:1.0.1:compile
[INFO] |  |  \- org.apache.james:apache-mime4j-core:jar:0.8.13:compile
[INFO] |  +- org.apache.ws.commons.axiom:axiom-impl:jar:1.2.22:compile
[INFO] |  |  \- org.codehaus.woodstox:woodstox-core-asl:jar:4.2.0:compile
[INFO] |  \- commons-lang:commons-lang:jar:2.6:compile

The issue is already reported in this link

Goals

The commons-lang is replaced with commons-lang3 v3.18.0 to fix security vulnerability

Approach

The usages of commons-lang are replaced with commons-lang3 in all files

User stories

Summary of user stories addressed by this change>

Developer Checklist (Mandatory)

• Complete the Developer Checklist in the related product-is issue to track any behavioral change or migration impact.

Release note

Brief description of the new feature or bug fix as it will appear in the release notes

Documentation

Link(s) to product documentation that addresses the changes of this PR. If no doc impact, enter “N/A” plus brief explanation of why there’s no doc impact

Training

Link to the PR for changes to the training content in https://github.com/wso2/WSO2-Training, if applicable

Certification

Type “Sent” when you have provided new/updated certification questions, plus four answers for each question (correct answer highlighted in bold), based on this change. Certification questions/answers should be sent to certification@wso2.com and NOT pasted in this PR. If there is no impact on certification exams, type “N/A” and explain why.

Marketing

Link to drafts of marketing content that will describe and promote this feature, including product page changes, technical articles, blog posts, videos, etc., if applicable

Automation tests

• Unit tests

  Code coverage information

• Integration tests

  Details about the test cases and coverage

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes/no
• Ran FindSecurityBugs plugin and verified report? yes/no
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes/no

Samples

Provide high-level details about the samples related to this feature

Related PRs

List any other related PRs

Migrations (if applicable)

Describe migration steps and platforms on which migration has been tested

Test environment

List all JDK versions, operating systems, databases, and browser/versions on which this feature/fix was tested

Learning

Describe the research phase and any blog posts, patterns, libraries, or add-ons you used to solve the problem.

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8c53aa84-6581-49a8-b0a3-31e6172ddb75

📥 Commits

Reviewing files that changed from the base of the PR and between 3090b94 and bc1dc1d.

📒 Files selected for processing (22)

• modules/charon-core/pom.xml
• modules/charon-core/src/main/java/org/wso2/charon3/core/attributes/DefaultAttributeFactory.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/config/ExtensionBuilder.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/config/SCIMSystemSchemaExtensionBuilder.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/config/SCIMUserSchemaExtensionBuilder.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/encoder/JSONDecoder.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/encoder/JSONEncoder.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/objects/Group.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/objects/User.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/protocol/BulkRequestProcessor.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/protocol/endpoints/GroupResourceManager.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/protocol/endpoints/MeResourceManager.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/protocol/endpoints/RoleResourceManager.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/protocol/endpoints/RoleResourceV2Manager.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/protocol/endpoints/SchemaResourceManager.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/protocol/endpoints/UserResourceManager.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/schema/AbstractValidator.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/utils/AttributeUtil.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/utils/ResourceManagerUtil.java
• modules/charon-core/src/main/java/org/wso2/charon3/core/utils/codeutils/FilterTreeManager.java
• modules/charon-utils/src/main/java/org/wso2/charon3/utils/usermanager/InMemoryUserManager.java
• pom.xml

---

📝 Walkthrough

Summary

This pull request updates the project to use Apache Commons Lang 3 (version 3.18.0) in place of the legacy Apache Commons Lang 2 library. The migration involves updating dependencies and imports throughout the codebase.

Changes

Dependency Updates:

• Updated root pom.xml dependency management to reference org.apache.commons:commons-lang3 (v3.18.0) instead of commons-lang
• Updated modules/charon-core/pom.xml with corresponding dependency and OSGi import package declarations

Import Updates:
Systematically updated imports across 21 Java files in the following modules:

• modules/charon-core/src/main/java/org/wso2/charon3/core/ (attributes, config, encoder, objects, protocol, schema, utils)
• modules/charon-utils/src/main/java/org/wso2/charon3/utils/

Specifically, the following utility class imports were updated:

• org.apache.commons.lang.StringUtils → org.apache.commons.lang3.StringUtils
• org.apache.commons.lang.ArrayUtils → org.apache.commons.lang3.ArrayUtils
• org.apache.commons.lang.NumberUtils → org.apache.commons.lang3.NumberUtils

All existing code logic and method usage remain unchanged, as the Commons Lang 3 library provides compatible implementations of these utility classes.

Impact

• Scope: 24 files modified (1 POM file, 23 Java source files)
• Behavioral Changes: None - the migration maintains functional equivalence with the previous implementation
• API Compatibility: The Commons Lang 3 utility APIs are compatible with existing usage patterns in the codebase

Walkthrough

The pull request migrates the charon project from Apache Commons Lang 2 (commons-lang) to Apache Commons Lang 3 (commons-lang3, version 3.18.0). The root pom.xml updates the managed dependency artifact, version property, and OSGi version range. The charon-core module's pom.xml correspondingly updates the local dependency and OSGi Import-Package directive to target org.apache.commons.lang3.*. Across 20 Java source files in charon-core and charon-utils, import statements for StringUtils, ArrayUtils, and NumberUtils are updated to the org.apache.commons.lang3 package. No logic, method signatures, or public API contracts are altered in any file.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description provides purpose, goals, and approach sections with security vulnerability context, but many required template sections are incomplete or contain only placeholder text.	Complete missing sections: Release note, Documentation, Training, Certification, Marketing, Automation tests details, Security checks confirmation, Samples, Related PRs, Migrations, Test environment, and Learning. Mark N/A sections explicitly if not applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: replacing commons-lang with commons-lang3 to address a security vulnerability.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[simaysanli]

Could you please help me to get review on this PR? Thanks. @Malith-19

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 31.93%. Comparing base (3090b94) to head (bc1dc1d).
⚠️ Report is 5 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff              @@
##             master     #460      +/-   ##
============================================
- Coverage     31.93%   31.93%   -0.01%     
  Complexity     1112     1112              
============================================
  Files           137      137              
  Lines         13523    13525       +2     
  Branches       2589     2590       +1     
============================================
  Hits           4319     4319              
- Misses         8666     8668       +2     
  Partials        538      538              

Flag	Coverage Δ
unit	31.05% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Malith-19]

Hi @simaysanli thank you for raising the PR. We will review your PR.

[jenkins-is-staging]

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/28147733157

[jenkins-is-staging]

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/28147733157
Status: success

[jenkins-is-staging]

Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/28147733157

[Malith-19]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.

Hi @simaysanli can you sign this License Cla here. PR is LGTM and once you sign it we can merge the PR.

[simaysanli]

@Malith-19 @sadilchamishka thanks for review and approval. I signed it. Could you please help me to merge it? As a next step, do I need to create PR in product-is as well?

[Malith-19]

@Malith-19 @sadilchamishka thanks for review and approval. I signed it. Could you please help me to merge it? As a next step, do I need to create PR in product-is as well?

Hi @simaysanli versions will be auto bumped in the product-is. If you meant to update the commans-lang dependency in product-is we have to first upgrade the commans-lang version in other product-is components first.

[simaysanli]

@Malith-19 I raised this PR to use the commons-lang3 instead of commons-lang. Do we need this change in scope of problem as seen in PR description?