[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.apache.commons:commons-lang3 (source)	3.21.0 → 3.22.0

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SCANJLIB-349

[gitar-bot]

Renovate safety review: commons-lang3 3.21.0 → 3.22.0 — Low risk (CI pending)

• Usage: StringUtils, Strings and SystemUtils are used in lib (HttpConfig, HttpException, VersionUtils, ScannerEndpointResolver, ArchResolver, CompressionUtils and others). The dependency is shaded in lib-shaded.
• Changelog 3.22.0: The Java 8 baseline is compatible with the project's release 11. The only StringUtils change is padding no longer splitting surrogate pairs, plus Javadoc fixes. The behavior changes are in LocaleUtils, NumberUtils, DateUtils, ToStringStyle, TypeUtils and similar classes, none of which this repo imports. ExceptionUtils.removeCommonFrames is deprecated and not used here. commons-parent moves from 105 to 107.
• Intermediate 3.21.0: The StringUtils changes are abbreviate/truncate fixes and performance work. No relevant API removals.
• License: Apache-2.0, unchanged.
• CI: Build is still pending. verify-sca, the StepSecurity checks and renovate/stability-days pass.
• Uncertainties: The changelog fetch was partially truncated for 3.21.0, so a few of its entries were not seen. Low risk depends on the pending Build passing.

Evidence: https://commons.apache.org/proper/commons-lang/changes.html

[gitar-bot]

Code Review ✅ Approved 🟡 Medium risk

Upgrading commons-lang3 from 3.21.0 to 3.22.0 may change library behavior used by the project, with compatibility effects unclear from this diff.

Bumps the org.apache.commons:commons-lang3 dependency from 3.21.0 to 3.22.0. No issues found.

Verification Rules 2/2 met Repos 3 inspected

Functional validation No results

Rules 2 passed 1 action taken 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance
🎸 Review major and minor Renovate updates - Posted an advisory summary rating the commons-lang3 3.21.0→3.22.0 update low risk, with the Build check still pending.

Broader impact Repos 3 inspected

Cross-repo 3 repositories inspected 0 open impacts

SonarSource/sonar-scanner-cli Inspected
SonarSource/sonar-scanner-maven Inspected
SonarSource/sonar-scanner-gradle Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube