As shown in the below dependency tree. The latest version of devkit still uses the legacy version on lang3.
org.apache.commons:commons-lang3:3.2.1 -> 3.9
--- org.jvnet.jaxb2_commons:jaxb2-commons-lang:2.4
--- com.intuit.quickbooks-online:ipp-v3-java-data:6.1.2
--- com.intuit.quickbooks-online:ipp-v3-java-devkit:6.1.2
--- compile
It would be helpful if the jar is upgraded for compatibility amongst other dependencies.