Testing commons-lang2 removal from jenkins-core by alecharp · Pull Request #6234 · jenkinsci/bom

alecharp · 2026-01-14T07:49:43Z

This is simply to validate / see what breaks with the removal of the library from Jenkins Core.
See jenkinsci/jenkins#26105.

see jenkinsci/jenkins#26105.

See jenkinsci/blueocean-plugin#5383

See jenkinsci/opentelemetry-plugin#1213

MarkEWaite

Can update to a more recent incremental of Jenkins core.

timja · 2026-02-03T22:43:22Z

I tried using openrewrite but neither the commons-lang3-api recipe or openrewrite cli seemed to do anything for me.

Gave up and just did:

rg -0 -lF 'org.apache.commons.lang.' . |
while IFS= read -r -d '' file; do
  sed -i '' 's/org.apache.commons.lang/org.apache.commons.lang3/' "$file"
done

Added the dep:

        <dependency>
            <groupId>io.jenkins.plugins</groupId>
            <artifactId>commons-lang3-api</artifactId>
        </dependency>

Banned commons-lang2:

<ban-commons-lang-2.skip>false</ban-commons-lang-2.skip>

Would be nice if there was a command that could be run to just do it.
Or migrate to Java platform API...

timja · 2026-02-05T07:56:32Z

@jonesbusy any idea what I was missing above? I would have thought there should be a simple method of migrating commons-lang to either java APIs or to commons-lang3

jonesbusy · 2026-02-08T09:25:38Z

@jonesbusy any idea what I was missing above? I would have thought there should be a simple method of migrating commons-lang to either java APIs or to commons-lang3

Any error in particular?

There is a recipe that change to commons-lang3 plugin-modernizer dry-run --plugins <plugin> --recipe MigrateCommonsLang2ToLang3AndCommonText that I was using of quiet a few plugins

For native Java API it's tracked by jenkins-infra/plugin-modernizer-tool#1542

It's probably just reusing what is provided by OpenRewrite

EDIT: Not sure if related by last with infra incident but some URL that we were using to get installation data return 404

        at io.jenkins.tools.pluginmodernizer.cli.Main.main(Main.java:50)
Caused by: io.jenkins.tools.pluginmodernizer.core.model.ModernizerException: Failed to get CSV data. Received response code: 404 from https://stats.jenkins.io/jenkins-stats/svg/202505-plugins.csv
        at io.jenkins.tools.pluginmodernizer.core.utils.CSVUtils.fromUrl(CSVUtils.java:40)

I will publish a release that ignore installation stats for now

@jamietanna

Plugin repository: * https://github.com/jenkinsci/job-dsl-plugin Pull request to enable automated releases (CD): * jenkinsci/job-dsl-plugin#2563 The new release will help with the removal of Apache Commons Lang 2 from Jenkins core. That is currently being tested in: * jenkinsci/jenkins#16404 * jenkinsci/bom#6234 Also updates permissions that were missed in previous changes. Completes the removal of @jamietanna and @daspilker as Job DSL maintainers, since they removed themselves with earlier pull requests. @jamietanna removed himself as a Job DSL maintainer in pull request: * jenkins-infra#4404 @daspilker removed himself as a Job DSL maintainer in pull request: * jenkins-infra#4385

…lang2-removal

timja · 2026-08-04T21:02:08Z

warnings-ng is failing because of https://github.com/jenkinsci/flexible-publish-plugin/blob/c66efc74337e0ad8af61def68433e4c093cd0f28/src/main/java/org/jenkins_ci/plugins/flexible_publish/builder/FailAtEndBuilder.java#L33

Which is not captured in the spreadsheet.
I'm doing a usage in plugins run to make sure everything is captured.

timja · 2026-08-04T21:40:13Z

No idea where that original spreadsheet came from =/ It was missing about 400 plugins.
It was accurate for most of the high install plugins, but quite a few in the 1000-10000 range missing

Added to the sheet now though

timja · 2026-08-04T22:15:26Z

I pointed my debug skill at this PR using the ci.jenkins.io MCP.

Updated 08/08

Commons Lang 2 removal — PCT triage for #6234, build #11

Build: Tools/bom/PR-6234 #11 → FAILURE, validating jenkinsci/jenkins#26105.

12 pct-*-plugin-weekly jobs failing / 115 failing tests, down from 22 jobs / ~225 tests in #10.

Every one of the 115 has age=7, failedSince=5 — all attributable to this change, with no unrelated flakes mixed in. Causes: 70 × StringUtils, 29 × cascade from ArrayUtils (see swarm), 9 × RandomStringUtils, 2 × StringEscapeUtils, 2 × cascade from StringUtils in a bundled library (see build-failure-analyzer), 1 × WordUtils, 1 × reflect.ConstructorUtils, 1 × silent no-op (see warnings-ng).

Every remaining failure now has either an open PR or a pending version bump — nothing is uncovered.

Open PRs — live status

Merged, awaiting a release

Released — needs a version bump only

Cleared since build #10

authorize-project · claim · multibranch-build-strategy-extension · gitea · gitea-checks · instant-messaging · s3 · google-storage · role-strategy · sbt

Which PR clears which job

PCT job	Tests	Culprit	Fix
swarm	38	swarm `PluginImpl.java:27` (`ArrayUtils`) — main code, plus 2 test classes	jenkinsci/swarm-plugin#904
htmlpublisher	33	htmlpublisher	jenkinsci/htmlpublisher-plugin#371 (in no release)
build-failure-analyzer	18	16 × build-failure-analyzer, 2 × bundled `gerrit-events` lib	jenkinsci/build-failure-analyzer-plugin#418 + sonyxperiadev/gerrit-events#131
view-job-filters	8	view-job-filters	jenkinsci/view-job-filters-plugin#116
mcp-server	4	2 × extended-choice-parameter, 2 × list-git-branches-parameter	jenkinsci/mcp-server-plugin#218 + jenkinsci/list-git-branches-parameter-plugin#80
declarative-pipeline-migration-assistant	4	htmlpublisher	jenkinsci/htmlpublisher-plugin#371
reverse-proxy-auth	2	reverse-proxy-auth	jenkinsci/reverse-proxy-auth-plugin#218
pipeline-model-definition	2	htmlpublisher + `reflect.ConstructorUtils` (pipeline-model-extensions, already released)	jenkinsci/htmlpublisher-plugin#371
kubernetes-credentials-provider	2	hashicorp-vault	jenkinsci/hashicorp-vault-plugin#376 (released, needs dep bump)
bitbucket-branch-source	2	bitbucket-branch-source	jenkinsci/bitbucket-branch-source-plugin#1237 (merged, unreleased)
warnings-ng	1	flexible-publish `FailAtEndBuilder`	jenkinsci/flexible-publish-plugin#27
build-monitor	1	build-monitor	jenkinsci/build-monitor-plugin#1324 (released, needs BOM bump)

6 of the 12 are collateral damage — the plugin under test is clean, a dependency is not.

swarm — 29 of the 38 are cascade, not separate failures

Only 9 failures name RandomStringUtils directly. The other 29 surface as InterruptedException: sleep interrupted in SwarmClientRule.waitOnline, which looks like a timeout but is not: the client's captured stderr shows

java.lang.ClassNotFoundException: org.apache.commons.lang.ArrayUtils
Caused: java.lang.NoClassDefFoundError: org/apache/commons/lang/ArrayUtils
Caused: jakarta.servlet.ServletException

thrown from a servlet request. PluginImpl.java:27 — swarm's main code, not just test code — imports org.apache.commons.lang.ArrayUtils, so agent registration 500s, the client never comes online, and waitOnline times out. jenkinsci/swarm-plugin#904 fixes PluginImpl and both test classes, so it clears all 38.

htmlpublisher — highest leverage, blocks 3 jobs / 37 tests

jenkinsci/htmlpublisher-plugin#371 merged 2025-10-03 and master is on lang3, but the newest release htmlpublisher-427.1 (2026-04-29, the version the BOM pins) still has import org.apache.commons.lang.StringUtils at line 21 of HtmlPublisherTarget.java.

compare/htmlpublisher-427.1...964f7305 reports diverged, ahead 4 / behind 2 — 427.1 was cut from a maintenance line that never contained the fix. This cannot be resolved by picking up a newer 427.x; it needs a release off master.

build-failure-analyzer — a third-party library, outside the plugin ecosystem

14 StringUtils + 1 StringEscapeUtils + 1 WordUtils failures are build-failure-analyzer's own code, covered by jenkinsci/build-failure-analyzer-plugin#418.

The remaining 2 (ScanOnDemandBaseActionTest, surfacing as HTTP 500) are not BFA's code and jenkinsci/build-failure-analyzer-plugin#418 will not fix them:

at com.sonymobile.tools.gerrit.gerritevents.GerritHandler.scheduleGerritWhitelistRead(GerritHandler.java:…)
Caused: java.lang.NoClassDefFoundError: org/apache/commons/lang/StringUtils

That is com.sonymobile.tools.gerrit:gerrit-events 2.22.0, a plain Java library from sonyxperiadev/gerrit-events reached via gerrit-trigger (BFA depends on gerrit-trigger 2.39.0, optional). Because it is not a Jenkins plugin, the ban-commons-lang-2 enforcer never flagged it. sonyxperiadev/gerrit-events#131 migrates all 5 affected files; it needs an upstream release and a gerrit-events bump in gerrit-trigger before this job goes green.

Worth noting for reviewers: that PR removes the source usage but leaves commons-lang:2.5 as a transitive dependency of net.sf.json-lib:json-lib:2.4, which cannot simply be excluded — json-lib 2.4 makes 59 bytecode references to Commons Lang 2. That does not affect this BOM run: in gerrit-trigger's resolved tree commons-lang is provided and never bundled (dependency:list -DincludeScope=runtime shows only lang3 reaching WEB-INF/lib), and net.sf.json-lib is substituted by org.kohsuke.stapler:json-lib, also provided. The failing call sites were gerrit-events' own, so removing them is sufficient here.

Separately, gerrit-trigger's own migration was incomplete: jenkinsci/gerrit-trigger-plugin#519 (merged, released) migrated PluginPatchsetCreatedEvent.java but missed the sibling PluginChangeMergedEvent.java:32. jenkinsci/gerrit-trigger-plugin#1030 fixes that and enables ban-commons-lang-2, which had never been set on that plugin — which is exactly why the miss went unnoticed.

Needs only version movement — no new code

Plugin	Currently resolved	Fixed in	Action
build-monitor	`1.14-985.v7b_f37b_3d0b_f5` (BOM pin)	`1113.v841eb_e2ccda_5` (2026-08-05)	bump in BOM
hashicorp-vault	`368.v48134f694db_f` (kubernetes-credentials-provider pom; not managed by bom-weekly)	`384.vda_86ec66c537` (2026-08-05)	bump in kubernetes-credentials-provider
bitbucket-branch-source	`937.3.6` (2026-07-10)	jenkinsci/bitbucket-branch-source-plugin#1237, merged 2026-07-23	needs a release

A full usage-in-plugins scan of all 2093 published plugins on 2026-08-08 confirms cloudbees-bitbucket-branch-source:937.3.6 still references Commons Lang 2, so that release genuinely predates the fix.

mcp-server — two culprits, split exactly 2 / 2

ParameterValueFactoryExtendedChoiceParameterTest (2 tests) → extended-choice-parameter, which is deprecated / end-of-life and will not be migrated. Remove deprecated extended-choice-parameter plugin integration mcp-server-plugin#218 removes the integration and the test-scoped dependency outright.
ParameterValueFactoryListGitBranchesParameterTest (2 tests) → list-git-branches-parameter 0.0.13, failing in ListGitBranchesParameterDefinition.setTagFilter:250. Migrate from Commons Lang 2 to Commons Lang 3 list-git-branches-parameter-plugin#80 is open and mergeable, but 0.0.13 dates from 2023-01-05 and the last merge to that repo was 2025-03-11 — so it needs a merge, a release, and a bump in mcp-server.

So jenkinsci/mcp-server-plugin#218 clears half this job; the other half is the longest remaining chain of the twelve.

warnings-ng — now has a stack trace

In build #10 this failure (FlexiblePublishITest, "Expected size: 2 but was: 0") had no stack trace and flexible-publish was inferred. Build #11 confirms it directly:

at org.jenkins_ci.plugins.flexible_publish.builder.FailAtEndBuilder$1.getDisplayName(FailAtEndBuilder.java:…)
Caused: java.lang.NoClassDefFoundError: org/apache/commons/lang/StringUtils

The publisher fails silently and produces zero results rather than erroring. jenkinsci/flexible-publish-plugin#27 covers FailAtEndBuilder.java.

Releases needed before this run can go green

htmlpublisher — a release off master (blocks 3 jobs).
bitbucket-branch-source — a release containing Move the one remaining lang2 usage to lang3 bitbucket-branch-source-plugin#1237.
gerrit-events — an upstream release, then a bump in gerrit-trigger.
list-git-branches-parameter — a release after Migrate from Commons Lang 2 to Commons Lang 3 list-git-branches-parameter-plugin#80, then a bump in mcp-server.

timja · 2026-08-08T07:02:07Z

@copilot resolve the merge conflicts in this pull request

timja · 2026-08-08T21:03:36Z

14 failing now, previously 23.

All should have PRs open or merged, some unreleased (e.g. jenkinsci/bitbucket-branch-source-plugin#1237)

Testing removal of Commons Lang 2 from core

4f96f61

see jenkinsci/jenkins#26105.

alecharp added do-not-merge weekly-test Test only the Weekly line in this PR labels Jan 14, 2026

Fixing incremental version

9b7a66a

alecharp mentioned this pull request Jan 14, 2026

Removes Commons Lang 2 usage jenkinsci/build-timestamp-plugin#109

Merged

Uses build-timeout incremental build

8ee3101

This was referenced Jan 14, 2026

Stops using undeclared commons-lang2 jenkinsci/blueocean-plugin#5383

Merged

Ban Commons Lang 2 jenkinsci/opentelemetry-plugin#1213

Merged

alecharp added 2 commits January 14, 2026 14:54

Using BlueOcean incremental build

ef47e9e

See jenkinsci/blueocean-plugin#5383

Using OpenTelemetry incremental build

742e2a3

See jenkinsci/opentelemetry-plugin#1213

alecharp mentioned this pull request Jan 14, 2026

Remove usages of Commons Lang 2 jenkinsci/simple-theme-plugin#268

Merged

6 tasks

alecharp added 3 commits January 15, 2026 09:12

Merge branch 'master' into testing/commons-lang2-removal

ad9c21d

Use new incremental for blueocean

e236100

Merge branch 'master' into testing/commons-lang2-removal

be3925d

MarkEWaite reviewed Jan 31, 2026

View reviewed changes

Comment thread sample-plugin/pom.xml Outdated

MarkEWaite reviewed Jan 31, 2026

View reviewed changes

MarkEWaite and others added 2 commits January 31, 2026 16:55

Merge branch 'master' into testing/commons-lang2-removal

405d9f3

Merge branch 'master' into testing/commons-lang2-removal

a39d9d6

This was referenced Feb 3, 2026

Replace commons.lang with plain java jenkinsci/parameterized-scheduler-plugin#297

Merged

Removes Commons Lang 2 usage jenkinsci/calendar-view-plugin#124

Merged

MarkEWaite mentioned this pull request Feb 11, 2026

Enable automated releases (CD) for Job DSL plugin jenkins-infra/repository-permissions-updater#4935

Merged

7 tasks

alecharp added 5 commits February 20, 2026 14:31

Update weekly version

b7fa9b5

Merge remote-tracking branch 'jenkinsci/master' into testing/commons-…

701a6d1

…lang2-removal

Merge branch 'master' into testing/commons-lang2-removal

d95b30c

Bump jenkins.version to 2.557-rc38133.5a_2f7f435791

71cdaee

Merge branch 'master' into testing/commons-lang2-removal

1bf6c4c

alecharp and others added 2 commits May 6, 2026 09:02

Merge branch 'master' into testing/commons-lang2-removal

60a4907

bump-incremental

4eb42b3

gbhat618 mentioned this pull request Jul 15, 2026

Testing commons-lang2 removal from core (recreated from #6234) #6993

Closed

Merge branch 'master' into testing/commons-lang2-removal

41217cb

Merge branch 'master' into testing/commons-lang2-removal

7a7c365

gbhat618 reviewed Jul 28, 2026

View reviewed changes

Comment thread sample-plugin/pom.xml Outdated

gbhat618 and others added 5 commits July 28, 2026 17:14

update to new incremental version of jenkins.

d9aa06b

Merge branch 'master' into testing/commons-lang2-removal

c721ade

bump job-dsl version not depending on lang2

81b9030

Merge branch 'master' into testing/commons-lang2-removal

580df9e

Merge branch 'master' into testing/commons-lang2-removal

7b76d5d

timja mentioned this pull request Aug 7, 2026

Remove deprecated extended-choice-parameter plugin integration jenkinsci/mcp-server-plugin#218

Open

6 tasks

Merge branch 'master' into testing/commons-lang2-removal

3d449bf

timja mentioned this pull request Aug 8, 2026

Move the one remaining lang2 usage to lang3 jenkinsci/bitbucket-branch-source-plugin#1237

Merged

This was referenced Aug 8, 2026

Migrate the last Commons Lang 2 usage to native Java jenkinsci/gerrit-trigger-plugin#1030

Open

Remove usages of Commons Lang 2 and Codec jenkinsci/htmlpublisher-plugin#371

Merged

Merge branch 'master' into testing/commons-lang2-removal

fa5d4c7

Navigation Menu

Uh oh!

Testing commons-lang2 removal from jenkins-core - #6234

Testing commons-lang2 removal from jenkins-core#6234
alecharp wants to merge 26 commits into
jenkinsci:masterfrom
alecharp:testing/commons-lang2-removal

alecharp commented Jan 14, 2026

Uh oh!

Uh oh!

MarkEWaite left a comment

Uh oh!

timja commented Feb 3, 2026 •

edited

Loading

Uh oh!

timja commented Feb 5, 2026

Uh oh!

jonesbusy commented Feb 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

timja commented Aug 4, 2026

Uh oh!

timja commented Aug 4, 2026 •

edited

Loading

Uh oh!

timja commented Aug 4, 2026 •

edited

Loading

Uh oh!

timja commented Aug 8, 2026

Uh oh!

timja commented Aug 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

alecharp commented Jan 14, 2026

Uh oh!

Uh oh!

MarkEWaite left a comment

Choose a reason for hiding this comment

Uh oh!

timja commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

timja commented Feb 5, 2026

Uh oh!

jonesbusy commented Feb 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

timja commented Aug 4, 2026

Uh oh!

timja commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

timja commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Commons Lang 2 removal — PCT triage for #6234, build #11

Open PRs — live status

Merged, awaiting a release

Released — needs a version bump only

Cleared since build #10

Which PR clears which job

swarm — 29 of the 38 are cascade, not separate failures

htmlpublisher — highest leverage, blocks 3 jobs / 37 tests

build-failure-analyzer — a third-party library, outside the plugin ecosystem

Needs only version movement — no new code

mcp-server — two culprits, split exactly 2 / 2

warnings-ng — now has a stack trace

Releases needed before this run can go green

Uh oh!

timja commented Aug 8, 2026

Uh oh!

timja commented Aug 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

timja commented Feb 3, 2026 •

edited

Loading

jonesbusy commented Feb 8, 2026 •

edited

Loading

timja commented Aug 4, 2026 •

edited

Loading

timja commented Aug 4, 2026 •

edited

Loading