From 92480cf66df00d3de269f76ddab90cc8f1ad8592 Mon Sep 17 00:00:00 2001
From: loong10k <20489781+loong10k@users.noreply.github.com>
Date: Fri, 14 Aug 2026 03:08:04 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20commons-lang=202.6=20=E2=86=92=20commons?=
 =?UTF-8?q?-lang3=203.18.0=EF=BC=8C=E4=BF=AE=E5=A4=8D=20CVE-2025-48924?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- commons-lang 2.x 已停止维护且无 2.x 修复版本，迁移到 commons-lang3
- 两个 pf4j 示例的 depMgmt 与 impl/test 模块依赖坐标同步更新
- StringUtils import org.apache.commons.lang → org.apache.commons.lang3
  （仅使用 upperCase，API 兼容）
---
 .../pf4j-plugin-sample/pf4j-plugin-impl1/pom.xml          | 4 ++--
 .../src/main/java/pf4j/plugin/impl/AuthcPluginImpl1.java  | 2 +-
 .../pf4j-plugin-sample/pf4j-plugin-impl2/pom.xml          | 4 ++--
 .../src/main/java/pf4j/plugin/impl/AuthcPluginImpl2.java  | 2 +-
 .../pf4j-plugin-sample/pf4j-plugin-test/pom.xml           | 4 ++--
 spring-boot-sample-pf4j/pf4j-plugin-sample/pom.xml        | 8 ++++----
 .../pf4j2-plugin-sample/pf4j2-plugin-impl1/pom.xml        | 4 ++--
 .../src/main/java/pf4j2/plugin/impl/AuthcPluginImpl1.java | 2 +-
 .../pf4j2-plugin-sample/pf4j2-plugin-impl2/pom.xml        | 4 ++--
 .../src/main/java/pf4j2/plugin/impl/AuthcPluginImpl2.java | 2 +-
 .../pf4j2-plugin-sample/pf4j2-plugin-test/pom.xml         | 4 ++--
 spring-boot-sample-pf4j2/pf4j2-plugin-sample/pom.xml      | 8 ++++----
 12 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-impl1/pom.xml b/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-impl1/pom.xml
index f731a31..0bacf9b 100644
--- a/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-impl1/pom.xml
+++ b/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-impl1/pom.xml
@@ -37,8 +37,8 @@
         <!-- Commons项目中用来处理Java基本对象方法的工具类包， 可以简化很多平时经常要用到的写法， 例如判断字符串是否为空等等 -->
         <!-- For Commons Lang -->
         <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
         </dependency>
         <!-- For Fastjson -->
         <dependency>
diff --git a/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-impl1/src/main/java/pf4j/plugin/impl/AuthcPluginImpl1.java b/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-impl1/src/main/java/pf4j/plugin/impl/AuthcPluginImpl1.java
index 298fb38..d202e30 100644
--- a/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-impl1/src/main/java/pf4j/plugin/impl/AuthcPluginImpl1.java
+++ b/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-impl1/src/main/java/pf4j/plugin/impl/AuthcPluginImpl1.java
@@ -16,7 +16,7 @@
 package pf4j.plugin.impl;
 
 
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 
 import pf4j.plugin.api.annotation.PluginMapping;
 import ro.fortsoft.pf4j.Plugin;
diff --git a/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-impl2/pom.xml b/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-impl2/pom.xml
index 0ee8852..5209884 100644
--- a/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-impl2/pom.xml
+++ b/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-impl2/pom.xml
@@ -38,8 +38,8 @@
         <!-- Commons项目中用来处理Java基本对象方法的工具类包， 可以简化很多平时经常要用到的写法， 例如判断字符串是否为空等等 -->
         <!-- For Commons Lang -->
         <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
         </dependency>
         <!-- For Fastjson -->
         <dependency>
diff --git a/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-impl2/src/main/java/pf4j/plugin/impl/AuthcPluginImpl2.java b/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-impl2/src/main/java/pf4j/plugin/impl/AuthcPluginImpl2.java
index 9fe45d4..0f46fef 100644
--- a/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-impl2/src/main/java/pf4j/plugin/impl/AuthcPluginImpl2.java
+++ b/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-impl2/src/main/java/pf4j/plugin/impl/AuthcPluginImpl2.java
@@ -16,7 +16,7 @@
 package pf4j.plugin.impl;
 
 
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 
 import pf4j.plugin.api.annotation.PluginMapping;
 import ro.fortsoft.pf4j.Plugin;
diff --git a/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-test/pom.xml b/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-test/pom.xml
index 5a7d6e8..5482c97 100644
--- a/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-test/pom.xml
+++ b/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-test/pom.xml
@@ -32,8 +32,8 @@
         <!-- Commons项目中用来处理Java基本对象方法的工具类包， 可以简化很多平时经常要用到的写法， 例如判断字符串是否为空等等 -->
         <!-- For Commons Lang -->
         <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
         </dependency>
 
         <!-- ###################### Spring 4.x 核心框架 ###################### -->
diff --git a/spring-boot-sample-pf4j/pf4j-plugin-sample/pom.xml b/spring-boot-sample-pf4j/pf4j-plugin-sample/pom.xml
index 1c5aade..23040ec 100644
--- a/spring-boot-sample-pf4j/pf4j-plugin-sample/pom.xml
+++ b/spring-boot-sample-pf4j/pf4j-plugin-sample/pom.xml
@@ -20,7 +20,7 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <junit.version>4.12</junit.version>
         <commons-io.version>2.5</commons-io.version>
-        <commons-lang.version>2.6</commons-lang.version>
+        <commons-lang3.version>3.18.0</commons-lang3.version>
         <fastjson.version>1.2.61</fastjson.version>
         <javax.servlet-api.version>3.1.0</javax.servlet-api.version>
         <ro.pf4j.version>1.3.0</ro.pf4j.version>
@@ -64,9 +64,9 @@
             <!-- Commons项目中用来处理Java基本对象方法的工具类包， 可以简化很多平时经常要用到的写法， 例如判断字符串是否为空等等 -->
             <!-- For Commons Lang -->
             <dependency>
-                <groupId>commons-lang</groupId>
-                <artifactId>commons-lang</artifactId>
-                <version>${commons-lang.version}</version>
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-lang3</artifactId>
+                <version>${commons-lang3.version}</version>
             </dependency>
 
             <!-- Java Servlet API -->
diff --git a/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-impl1/pom.xml b/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-impl1/pom.xml
index 3822e2a..a31b74b 100644
--- a/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-impl1/pom.xml
+++ b/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-impl1/pom.xml
@@ -37,8 +37,8 @@
         <!-- Commons项目中用来处理Java基本对象方法的工具类包， 可以简化很多平时经常要用到的写法， 例如判断字符串是否为空等等 -->
         <!-- For Commons Lang -->
         <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
         </dependency>
         <!-- For Fastjson -->
         <dependency>
diff --git a/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-impl1/src/main/java/pf4j2/plugin/impl/AuthcPluginImpl1.java b/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-impl1/src/main/java/pf4j2/plugin/impl/AuthcPluginImpl1.java
index eafd37a..a652aa0 100644
--- a/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-impl1/src/main/java/pf4j2/plugin/impl/AuthcPluginImpl1.java
+++ b/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-impl1/src/main/java/pf4j2/plugin/impl/AuthcPluginImpl1.java
@@ -16,7 +16,7 @@
 package pf4j2.plugin.impl;
 
 
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.pf4j.Plugin;
 import org.pf4j.PluginWrapper;
 import org.pf4j.RuntimeMode;
diff --git a/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-impl2/pom.xml b/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-impl2/pom.xml
index 53af87f..dbc5143 100644
--- a/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-impl2/pom.xml
+++ b/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-impl2/pom.xml
@@ -37,8 +37,8 @@
         <!-- Commons项目中用来处理Java基本对象方法的工具类包， 可以简化很多平时经常要用到的写法， 例如判断字符串是否为空等等 -->
         <!-- For Commons Lang -->
         <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
         </dependency>
         <!-- For Fastjson -->
         <dependency>
diff --git a/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-impl2/src/main/java/pf4j2/plugin/impl/AuthcPluginImpl2.java b/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-impl2/src/main/java/pf4j2/plugin/impl/AuthcPluginImpl2.java
index a0d51d5..38abf53 100644
--- a/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-impl2/src/main/java/pf4j2/plugin/impl/AuthcPluginImpl2.java
+++ b/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-impl2/src/main/java/pf4j2/plugin/impl/AuthcPluginImpl2.java
@@ -16,7 +16,7 @@
 package pf4j2.plugin.impl;
 
 
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.pf4j.Plugin;
 import org.pf4j.PluginWrapper;
 import org.pf4j.RuntimeMode;
diff --git a/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-test/pom.xml b/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-test/pom.xml
index 489c829..657626b 100644
--- a/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-test/pom.xml
+++ b/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-test/pom.xml
@@ -32,8 +32,8 @@
         <!-- Commons项目中用来处理Java基本对象方法的工具类包， 可以简化很多平时经常要用到的写法， 例如判断字符串是否为空等等 -->
         <!-- For Commons Lang -->
         <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
         </dependency>
 
         <!-- ###################### Spring 4.x 核心框架 ###################### -->
diff --git a/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pom.xml b/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pom.xml
index f2a88e1..1ea4f2e 100644
--- a/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pom.xml
+++ b/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pom.xml
@@ -20,7 +20,7 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <junit.version>4.12</junit.version>
         <commons-io.version>2.14.0</commons-io.version>
-        <commons-lang.version>2.6</commons-lang.version>
+        <commons-lang3.version>3.18.0</commons-lang3.version>
         <fastjson.version>1.2.61</fastjson.version>
         <javax.servlet-api.version>3.1.0</javax.servlet-api.version>
         <pf4j.version>3.14.1</pf4j.version>
@@ -64,9 +64,9 @@
             <!-- Commons项目中用来处理Java基本对象方法的工具类包， 可以简化很多平时经常要用到的写法， 例如判断字符串是否为空等等 -->
             <!-- For Commons Lang -->
             <dependency>
-                <groupId>commons-lang</groupId>
-                <artifactId>commons-lang</artifactId>
-                <version>${commons-lang.version}</version>
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-lang3</artifactId>
+                <version>${commons-lang3.version}</version>
             </dependency>
 
             <!-- Java Servlet API -->