Skip to content

Remove usages of Commons Lang 2 - #27

Open
timja-bot wants to merge 1 commit into
jenkinsci:masterfrom
timja-bot:commons-lang3
Open

timja-bot wants to merge 1 commit into
jenkinsci:masterfrom
timja-bot:commons-lang3

Conversation

@timja-bot

Copy link
Copy Markdown

No need to depend on a third-party library here when the Java Platform provides this
functionality natively.

Part of the effort to remove Commons Lang 2 from Jenkins core — jenkinsci/jenkins#16404,
jenkinsci/jenkins#26105. Commons Lang 2 is EOL and carries an unfixed advisory
(GHSA-j288-q9x7-2f5v).

What's changed

  • DateParameterDefinition and DateParameterValue: the StringUtils.isEmpty checks (one a static
    import) become null checks plus String.isEmpty(). In createBuildWrapper the value is read into
    a local first, which also settles a SpotBugs NP_NULL_ON_SOME_PATH warning about calling
    getValue() twice.
  • No dependency was added — this plugin did not declare Commons Lang, it came in transitively from
    core.

Testing done

mvn -B -ntp clean verify passes locally on Java 21 / macOS.

The ban-commons-lang-2 enforcer rule was left disabled: it needs parent POM 6.2116.v7501b_67dc517 or newer, and parent 6.x requires Jenkins 2.475+
(Jakarta EE 9) while this plugin targets 2.361.4.

Note: mvn clean verify needs JDK 17 here — on JDK 21 the license-maven-plugin 1.15 fails with
Unsupported class file major version 65, unrelated to this change.

Submitter checklist

  • Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
  • Ensure that the pull request title represents the desired changelog entry
  • Please describe what you did
  • Link to relevant issues in GitHub or Jira
  • Link to relevant pull requests, esp. upstream and downstream changes
  • Ensure you have provided tests that demonstrate the feature works or the issue is fixed

🤖 This pull request was generated with AI assistance (Claude Code) as part of a bulk migration
across Jenkins plugins. If anything here looks wrong, please comment on this PR or contact @timja.

@timja-bot

Copy link
Copy Markdown
Author

The failing security-scan / scan check is pre-existing and unrelated to this change: CodeQL's
autobuild runs mvn clean package on JDK 21 and dies with

BUG! exception in phase 'semantic analysis' in source unit 'inlineScript'
Unsupported class file major version 65

which is an old Groovy-based Maven plugin (license-maven-plugin 1.15) that cannot run on JDK 21.
The same failure reproduces locally on an unmodified checkout; building with JDK 17 works, and
mvn clean verify is green there with this change applied.

Fixing that is a separate build-modernisation change, so I have left it alone here.

🤖 Posted with AI assistance (Claude Code); contact @timja.

@timja
timja requested a review from a team August 4, 2026 21:01
@MarkEWaite

Copy link
Copy Markdown

Jenkins 2.579 released August 25, 2026 with the removal of Apache Commons Lang 2. Users of this plugin will need to delay their upgrade to Jenkins 2.579 until this pull request is included in a released version of the plugin.

@Sucre911 Sucre911 mentioned this pull request Oct 22, 2026
6 tasks done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants