Removing commons-lang &commons-collections dependency？

[marsggg]

These two dependencies have too many vulneeabilities. They should now be replaced with commons-lang3 and commons-collections4

[kwwall]

Show us that the vulnerabilities in those 2 libraries reachable from ESAPI and we will prioritize fixing them. I don't believe they are, although it's been a while since I checked, so one of the newer CVEs may be reachable. Our intent is to disable those rarely used ESAPI components by default in a future release. In the meantime, my wife and I have been battling health issues and that is a much higher priority for me than patching ESAPI.

…

-kevin -- Blog: https://off-the-wall-security.blogspot.com/ | GitHub: @kwwall <https://github.com/kwwall>| OWASP ESAPI Project <https://owasp.org/www-project-enterprise-security-api/>co-lead | OWASP and ACM lifetime member NSA: All your crypto bit are belong to us.

On Tue, Aug 4, 2026, 11:44 PM xiabaosen ***@***.***> wrote: These two dependencies have too many vulneeabilities. They should now be replaced with commons-lang3 and commons-collections4 — Reply to this email directly, view it on GitHub <#916?email_source=notifications&email_token=AAO6PG42JWNV36BIF2WPQ335IKURPA5CNFSNUABBM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63RPGEYDKNJUHE3TLJTSMVQXG33OVJZXKYTTMNZGSYTFMSSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAO6PG5AA5S5PKCDBTRIROT5IKURPAVCNFSNUABHKJSXA33TNF2G64TZHMZDGOBVG42DMMZ3IRUXGY3VONZWS33OHMYTANJVGQ4TONNBOYBA> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/AAO6PGYXXX4OEILXQW6KEOD5IKURPA5CNFSNUABBM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63RPGEYDKNJUHE3TLJTSMVQXG33OVJZXKYTTMNZGSYTFMSSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/AAO6PG4STKQM2M3CNUTP3ED5IKURPA5CNFSNUABBM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63RPGEYDKNJUHE3TLJTSMVQXG33OVJZXKYTTMNZGSYTFMSSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[marsggg]

wishing your wife a speedy recovery