[SPARK-53819][3.5] Upgrade commons-lang3 to 3.19.0

[eschcam]

What changes were proposed in this pull request?

Upgrade commons-lang3 to 3.19.0

Why are the changes needed?

Commons-lang3 3.12.0 contains CVE-2025-48924

Does this PR introduce any user-facing change?

No

How was this patch tested?

Passed CI tests

Was this patch authored or co-authored using generative AI tooling?

No

[dongjoon-hyun]

To @eschcam , when it comes to backport, you need to verify that CVE is really meaningful for the users.

I don't think the Apache Spark is affected because we don't use org.apache.commons.lang3.ClassUtils.getClass method's CVE bug.

Commons-lang3 3.12.0 contains GHSA-j288-q9x7-2f5v

Please provide more reasons for justification.

[eschcam]

My only justification is removing the vulnerable dependency

[dongjoon-hyun]

When it's not an Apache Spark vulnerability, we don't make a misleading backport because we don't want to be a boy who cried wolf. There are too many false alarms already.

My only justification is removing the vulnerable dependency

Let me close this PR to prevent accidental merging. We can continue to discuss on this topic on this closed PR.

[eschcam]

When it's not an Apache Spark vulnerability, we don't make a misleading backport because we don't want to be a boy who cried wolf. There are too many false alarms already.

So I'm guessing you only want to upgrade dependencies with reachable vulnerabilities and ignore others.