Re: Release commons-lang:2.6.1 with a fix for CVE-2025-48924

2025年11月14日 05:14:57 -0800

>No we have very conservative JDK requirements. Commons Lang still runs
>on Java 8, while Spring Boot requires Java 17.
I don't question which Java do you require.
I claim that commons-lang3 breaks backward compatibility by raising Java
requirements in a minor release.
Emmanuel,
commons-lang3:3.0 was able to run with Java 1.5
commons-lang3:3.18.0 can't execute with Java 1.5, and it just fails in the
runtime.
commons-lang3:3.8 was able to run with Java 1.7
commons-lang3:3.18.0 can't execute with Java 1.7, and it just fails in the
runtime.
Effectively, you drop the possibility to use the library with Java 1.5,
then with Java 1.6, then with Java 1.7,
and all this happens within minor releases.
That is why I say commons-lang3 breaks backward over the course of the 3.x
major version.
Here's an example: Spring Boot 1.3.0 declares "support for Java 1.7".
They can't bump the minor version of commons-lang3 as it might unexpectedly
fail "Java 1.7 support".
Vladimir

Reply via email to