HIVE-29387:upgrade commons-lang3 to 3.20.x to fix CVE-2025-48924

[ramitg254]

What changes were proposed in this pull request?

commons-lang3 upgraded to 3.20.0

Why are the changes needed?

It fixes CVE-2025-48924

Does this PR introduce any user-facing change?

No

How was this patch tested?

build locally and ci tests

[ramitg254]

dependency-tree.txt

[ayushtkn]

@ramitg254 can you check if there are other versions getting packaged as well

+- commons-lang:commons-lang:jar:2.6:compile

I think hadoop & tez are pulling in other versions

[ramitg254]

@ramitg254 can you check if there are other versions getting packaged as well

+- commons-lang:commons-lang:jar:2.6:compile

I think hadoop & tez are pulling in other versions

this pr only addresses the dependency org.apache.comcommons-lang3:jar as currently we are having the two different versions of it 3.14.0 in the pom and other one 3.17.0 which comes from hadoop which I am enforcing it to 3.20.0 in this pr

but since you mentioned the commons-lang:commons-lang:jar it can't be addressed from hive side as these are v2 versions of commons-lang having classpath of pattern org/apache/commons/lang/* which are used by underlying tez and hadoop classes and commons-lang3 have pattern like org/apache/commons/lang3/* and these v2 jars needed be brought transitively
and to change it to commons-lang3 it needed to addressed from tez and hadoop classes.
so I am only addressing the upgrade which is possible from hive side as per my understanding.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud