Pin patched version of commons-lang3 to address CVE-2025-48924 in build.gradle files

Author: IshikaDawda

instrumentation-security-test/build.gradle

@@ -15,6 +15,8 @@ dependencies {
     implementation("com.newrelic.agent.java:newrelic-api:${nrAPIVersion}")
     implementation("com.newrelic.agent.java:newrelic-agent:${nrAgentVersion}")
     implementation ('org.apache.commons:commons-text:1.10.0')
+    // commons-text pulls in a vulnerable commons-lang3 transitively (CVE-2026-54512); pin the patched version
+    implementation ('org.apache.commons:commons-lang3:3.18.0')
     implementation("com.newrelic.agent.java:agent-bridge:${nrAPIVersion}")
     implementation("com.newrelic.agent.java:agent-bridge-datastore:${nrAPIVersion}")
     implementation("commons-net:commons-net:3.9.0")

newrelic-security-agent/build.gradle

@@ -68,6 +68,8 @@ dependencies {
     shadowIntoJar 'org.apache.commons:commons-text:1.10.0'
     shadowIntoJar 'commons-net:commons-net:3.9.0'
     shadowIntoJar 'org.apache.commons:commons-compress:1.26.0'
+    // commons-text/commons-compress pull in a vulnerable commons-lang3 transitively (CVE-2026-54512); pin the patched version
+    shadowIntoJar 'org.apache.commons:commons-lang3:3.18.0'
     shadowIntoJar 'org.apache.commons:commons-collections4:4.4'
     shadowIntoJar 'org.unbescape:unbescape:1.1.6.RELEASE'
     shadowIntoJar 'commons-codec:commons-codec:1.15'