HADOOP-19945. Update to commons-configuration2 2.15.0, commons-lang3 3.20.0 and commons-io 2.22.0 to fix CVE-2026-45205

[ankithpraveen]

Update commons-lang3 and commons-io along with commons-configuration2 because commons-configuration2 2.15.0 is built against newer related Commons library versions.

Description of PR

HADOOP-19945

Updates commons-configuration2 along with related Apache Commons dependencies commons-lang3 and commons-io. The related dependency bumps are included because updating only commons-configuration2 caused the shaded client CI check to fail in #8505. commons-configuration2 2.15.0 declares newer related Commons versions, so this keeps Hadoop's managed dependency set aligned. Also updates LICENSE-binary accordingly.

How was this patch tested?

CI build

For code changes:

• Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
• Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
• If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
• If applicable, have you updated the LICENSE, LICENSE-binary, NOTICE-binary files?

AI Tooling

If an AI tool was used:

• The PR includes the phrase "Contains content generated by "
  where is the name of the AI tool used.
• My use of AI contributions follows the ASF legal policy
  https://www.apache.org/legal/generative-tooling.html

[ayushtkn]

if the build comes green, changes LGTM

The description is misleading, this upgrades commons-io and commons-lang3 as well, can you update the PR title and Jira titl/description to reflect that

[hadoop-yetus]

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 29s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	detsecrets	0m 0s		detect-secrets was not available.
+0 🆗	xmllint	0m 0s		xmllint was not available.
+0 🆗	shelldocs	0m 0s		Shelldocs was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+0 🆗	mvndep	1m 33s		Maven dependency ordering for branch
+1 💚	mvninstall	29m 14s		trunk passed
+1 💚	compile	9m 5s		trunk passed with JDK Ubuntu-21.0.11+10-1-24.04.2-Ubuntu
+1 💚	compile	9m 31s		trunk passed with JDK Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
+1 💚	mvnsite	11m 0s		trunk passed
+1 💚	javadoc	5m 53s		trunk passed with JDK Ubuntu-21.0.11+10-1-24.04.2-Ubuntu
+1 💚	javadoc	5m 54s		trunk passed with JDK Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
+1 💚	shadedclient	29m 27s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 22s		Maven dependency ordering for patch
+1 💚	mvninstall	24m 34s		the patch passed
+1 💚	compile	9m 18s		the patch passed with JDK Ubuntu-21.0.11+10-1-24.04.2-Ubuntu
+1 💚	javac	9m 18s		the patch passed
+1 💚	compile	9m 46s		the patch passed with JDK Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
+1 💚	javac	9m 46s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	mvnsite	12m 49s		the patch passed
+1 💚	shellcheck	0m 0s		No new issues.
+1 💚	javadoc	6m 16s		the patch passed with JDK Ubuntu-21.0.11+10-1-24.04.2-Ubuntu
+1 💚	javadoc	6m 20s		the patch passed with JDK Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
+1 💚	shadedclient	32m 45s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
-1 ❌	unit	632m 53s	/patch-unit-root.txt	root in the patch failed.
+1 💚	asflicense	1m 9s		The patch does not generate ASF License warnings.
		816m 44s

Reason	Tests
Failed junit tests	hadoop.yarn.server.nodemanager.containermanager.logaggregation.TestLogAggregationService

Subsystem	Report/Notes
Docker	ClientAPI=1.55 ServerAPI=1.55 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8634/2/artifact/out/Dockerfile
GITHUB PR	#8634
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient codespell detsecrets xmllint shellcheck shelldocs
uname	Linux 5eabdf5efaf2 5.15.0-179-generic #189-Ubuntu SMP Tue May 5 18:20:56 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / f1ebdaf
Default Java	Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
Multi-JDK versions	/usr/lib/jvm/java-21-openjdk-amd64:Ubuntu-21.0.11+10-1-24.04.2-Ubuntu /usr/lib/jvm/java-17-openjdk-amd64:Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8634/2/testReport/
Max. process+thread count	5078 (vs. ulimit of 10000)
modules	C: hadoop-project . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8634/2/console
versions	git=2.43.0 maven=3.9.15 shellcheck=0.9.0
Powered by	Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

[ankithpraveen]

if the build comes green, changes LGTM

The description is misleading, this upgrades commons-io and commons-lang3 as well, can you update the PR title and Jira titl/description to reflect that

Thanks. I’ll update the PR title and Jira title to mention the commons-io and commons-lang3 upgrades as well.

The previous build had two failures:

1. TestLogAggregationService.testLocalFileDeletionAfterUpload failed while checking asynchronous log-directory cleanup.
2. The HDFS job reported 5,266 tests with no failures or errors, but Maven Surefire subsequently reported a timeout in the fork.
   Neither failure contains a Commons-related exception or linkage error, so they appear unrelated to this dependency update.

I’ll also amend the commit message for consistency. Pushing the amended commit will trigger a fresh build.

[ankithpraveen]

Jenkins Build 3 failed after approximately 24 hours with exit code 137. Its JUnit report recorded two timeout failures:

1. TestDFSClientRetries.testLeaseRenewAndDFSOutputStreamDeadLock
2. TestDFSClientRetries.testLeaseRenewSocketTimeout

The failure stacks are in HDFS DataStreamer, DFSOutputStream, LeaseRenewer, and test synchronization code. They do not contain any changed Commons API or linkage error. See the Build #3 test report and console. Further, they pass on local testing.

The same commit’s GitHub Actions HDFS run reported 5,266 tests with zero final failures, although the Surefire fork later timed out.
Build 2 also passed Maven install, JDK 17/21 compilation, and shaded-client testing, and I only updated the commit message to trigger Build 3.

These results do not show a deterministic Commons compatibility failure. Please let me know whether another Jenkins build retrigger is required.

@ayushtkn @slfan1989

[pan3793]

@ankithpraveen, the GitHub tests run in your forked repo, so you have permission to rerun the single failed job.

[ankithpraveen]

I reran all three affected tests locally:

Jenkins failures

./mvnw -pl :hadoop-hdfs -Dtest='TestDFSClientRetries#testLeaseRenewSocketTimeout' test
Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
./mvnw -pl :hadoop-hdfs -Dtest='TestDFSClientRetries#testLeaseRenewAndDFSOutputStreamDeadLock' test
Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS

GHA timeout (TestBackupNode took 1457s but Surefire fork timeout is 900s. This issue occurs in all recently opened PRs as well)

./mvnw -pl :hadoop-hdfs -Dtest='TestBackupNode' test
Tests run: 5, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS

These failures are all timeout issues and unrelated to the Commons upgrades.

[pan3793]

thanks, merged to trunk/branch-3.5

[ankithpraveen]

Thanks @pan3793. The dependabot PR #8505 can be closed as it is invalid.