Skip to content

Drop commons-lang3 dependency and replace its usages with core Java #2735

@vlsi

Description

@vlsi

Currently S3Mock uses only a few classes from commons-lang3, and it would probably be worth dropping the dependency for the following reasons:

  1. Better security. commons-* follows "all features in a single jar" pattern, so a CVE in one of the classes would impact S3Mock
  2. Fewer bytes to ship with binary distribution for the end-users: commons-lang3 is ~690K

I have raised a suggestion to make commons-lang3 modular and extract modules like commons-stringutils, commons-arrayutils, however, Commons team does not seem to like the idea.
Commons PMC members often suggest that users should clone the code or shade commons-lang, see

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions