[Backport 2.x] CVE-2025-48924: upgrade commons-lang3 to 3.18.0 (opensearch-project#3895)

Signed-off-by: Lantao Jin <ltjin@amazon.com>

Author: LantaoJin

common/build.gradle

@@ -36,7 +36,7 @@ dependencies {
     api "org.antlr:antlr4-runtime:4.7.1"
     api group: 'com.google.guava', name: 'guava', version: "${guava_version}"
     api group: 'org.apache.logging.log4j', name: 'log4j-core', version:"${versions.log4j}"
-    api group: 'org.apache.commons', name: 'commons-lang3', version: '3.12.0'
+    api group: 'org.apache.commons', name: 'commons-lang3', version: '3.18.0'
     api group: 'com.squareup.okhttp3', name: 'okhttp', version: '4.9.3'
     api group: 'org.apache.commons', name: 'commons-text', version: '1.10.0'
     implementation 'com.github.babbel:okhttp-aws-signer:1.0.2'

core/build.gradle

@@ -36,7 +36,7 @@ repositories {
 
 dependencies {
     api group: 'com.google.guava', name: 'guava', version: "${guava_version}"
-    api group: 'org.apache.commons', name: 'commons-lang3', version: '3.12.0'
+    api group: 'org.apache.commons', name: 'commons-lang3', version: '3.18.0'
     api group: 'org.apache.commons', name: 'commons-text', version: '1.10.0'
     api group: 'com.facebook.presto', name: 'presto-matching', version: '0.240'
     api group: 'org.apache.commons', name: 'commons-math3', version: '3.6.1'

legacy/build.gradle

@@ -91,7 +91,7 @@ dependencies {
     }
     implementation group: 'com.google.guava', name: 'guava', version: "${guava_version}"
     implementation group: 'org.json', name: 'json', version:'20231013'
-    implementation group: 'org.apache.commons', name: 'commons-lang3', version: '3.12.0'
+    implementation group: 'org.apache.commons', name: 'commons-lang3', version: '3.18.0'
     implementation group: 'org.apache.commons', name: 'commons-text', version: '1.10.0'
     implementation group: 'org.opensearch', name: 'opensearch', version: "${opensearch_version}"
     // add geo module as dependency. https://github.com/opensearch-project/OpenSearch/pull/4180/.