Motivation

commons-lang is an unused depenency (already replaced with commons-lang3 in the codebase) that is still getting included as a dependency for BK.

There is a CVE open in common-lang 2.6:

│ commons-lang:commons-lang                                   │ CVE-2025-48924 │ MEDIUM   │          │ 2.6               │                            │ commons-lang/commons-lang: org.apache.commons/commons-lang3: │
│ (commons-lang-commons-lang-2.6.jar)                         │                │          │          │                   │                            │ Uncontrolled Recursion vulnerability in Apache Commons Lang  │
│                                                             │                │          │          │                   │                            │ https://avd.aquasec.com/nvd/cve-2025-48924                   │

Changes

(Describe: what changes you have made)

---

In order to uphold a high standard for quality for code contributions, Apache BookKeeper runs various precommit
checks for pull requests. A pull request can only be merged when it passes precommit checks.

---

Be sure to do all the following to help us incorporate your contribution
quickly and easily:

If this PR is a BookKeeper Proposal (BP):

• Make sure the PR title is formatted like:
  <BP-#>: Description of bookkeeper proposal
e.g. BP-1: 64 bits ledger is support
• Attach the master issue link in the description of this PR.
• Attach the google doc link if the BP is written in Google Doc.

Otherwise:

• Make sure the PR title is formatted like:
  <Issue #>: Description of pull request
e.g. Issue 123: Description ...
• Make sure tests pass via mvn clean apache-rat:check install spotbugs:check.
• Replace <Issue #> in the title with the actual Issue number.

---