chore: bump parent v50 -> v51 and migrate commons-lang -> commons-lang3 (#111)

* chore: bump parent v50 -> v51 and migrate commons-lang -> commons-lang3

uportal-portlet-parent:51 closes CVE-2025-48924 by replacing
commons-lang 2.6 (EOL, no upstream fix) with commons-lang3 3.20.0
+ commons-text 1.15.0. Parent v51 dropped legacy commons-lang from
dependencyManagement, so this repo's submodule poms and Java source
must move to commons-lang3 to keep compilation working.

Changes:
- pom.xml (root): <parent><version>50</version></> -> 51.
- courses-portlet-api/pom.xml, courses-portlet-webapp/pom.xml:
  swap commons-lang dep declarations for commons-lang3.
- src: rename imports across the 4 files using lang APIs:
  org.apache.commons.lang.* -> org.apache.commons.lang3.*
  (StringUtils, RandomStringUtils, builder.ToStringBuilder,
  builder.ToStringStyle). lang3 is API-compatible for these.

* chore: regenerate NOTICE for parent v51 + lang3

Problem: NOTICE was generated against the parent v50 dep tree (legacy
commons-lang). After the parent v50 -> v51 bump and the
commons-lang -> commons-lang3 swap, `mvn notice:check` flagged drift.

Goal: align NOTICE with the actual deployed dep tree so notice:check
passes during release:prepare.

Changes:
- regenerate NOTICE via `mvn notice:generate` against current deps;
  picks up Apache Commons Lang (lang3), Apache Commons Compress,
  Esbuild wrapper, Hibernate Core (was missing), Java Servlet API,
  Java Transaction API, AntLR, dom4j; drops Commons Logging shim
  that was removed transitively.

Author: bjagg

NOTICE

@@ -16,9 +16,12 @@ specific language governing permissions and limitations
 under the License.
 
 This project includes:
+  AntLR under BSD License
   AOP alliance under Public Domain
-  Apache Commons Codec under Apache License, Version 2.0
-  Apache Commons Collections under Apache License, Version 2.0
+  Apache Commons Codec under Apache-2.0
+  Apache Commons Compress under Apache-2.0
+  Apache Commons FileUpload under Apache License, Version 2.0
+  Apache Commons Lang under Apache-2.0
   Apache HttpClient under Apache License, Version 2.0
   Apache HttpCore under Apache License, Version 2.0
   Apache WSS4J under The Apache Software License, Version 2.0
@@ -28,20 +31,22 @@ This project includes:
   Bouncy Castle Provider under Bouncy Castle Licence
   Byte Buddy (without dependencies) under Apache License, Version 2.0
   Byte Buddy agent under Apache License, Version 2.0
-  Commons FileUpload under The Apache Software License, Version 2.0
   Commons IO under The Apache Software License, Version 2.0
   Commons Lang under The Apache Software License, Version 2.0
-  Commons Logging under The Apache Software License, Version 2.0
+  commons-collections under Apache License, Version 2.0
   CoursePortlet under Apache License Version 2.0
   CoursePortlet - API under Apache License Version 2.0
   CoursePortlet - Data Access Objects for SIS/LMS integration under Apache License Version 2.0
   CoursePortlet - Webapp under Apache License Version 2.0
   Cryptacular Library under Apache 2 or GNU Lesser General Public License
+  dom4j under BSD License
   ehcache under The Apache Software License, Version 2.0
   Ehcache Core under The Apache Software License, Version 2.0
   Ehcache Web Filters under The Apache Software License, Version 2.0
+  Esbuild wrapper for Java bundled with original binaries under MIT License
   Guava: Google Core Libraries for Java under The Apache Software License, Version 2.0
   Hamcrest Core under New BSD License
+  Hibernate Core under GNU Lesser General Public License
   Jackson module: Old JAXB Annotations (javax.xml.bind) under The Apache Software License, Version 2.0
   Jackson-annotations under The Apache Software License, Version 2.0
   Jackson-core under The Apache Software License, Version 2.0
@@ -51,21 +56,23 @@ This project includes:
   Jakarta XML Binding API under Eclipse Distribution License - v 1.0
   JASYPT: Java Simplified Encryption under The Apache Software License, Version 2.0
   Java Portlet Specification V2.0 under Commons Development and Distribution License, Version 1.0
+  Java Servlet API under CDDL + GPLv2 with classpath exception
+  Java Transaction API under Commons Development and Distribution License, Version 1.0
   java-support under The Apache Software License, Version 2.0
   JavaBeans Activation Framework API jar under CDDL/GPLv2+CE
   JavaMail 1.4 under The Apache Software License, Version 2.0
   javax.annotation API under CDDL + GPLv2 with classpath exception
   jaxb-api under CDDL 1.1 or GPL2 w/ CPE
   JAXB2 Basics - Runtime under BSD-Style License
-  JCL 1.2 implemented over SLF4J under Apache License, Version 2.0
-  Joda time under Apache 2
+  JCL 1.2 implemented over SLF4J under Apache-2.0
+  Joda-Time under Apache License, Version 2.0
   Joda-Time JSP tags support under Apache 2
   jstl under Commons Development and Distribution License, Version 1.0
-  JUL to SLF4J bridge under MIT License
+  JUL to SLF4J bridge under MIT
   JUnit under Eclipse Public License 1.0
-  Log4j Implemented Over SLF4J under Apache Software Licenses
-  Logback Classic Module under Eclipse Public License - v 1.0 or GNU Lesser General Public License
-  Logback Core Module under Eclipse Public License - v 1.0 or GNU Lesser General Public License
+  Log4j Implemented Over SLF4J under Apache-2.0
+  Logback Classic Module under Eclipse Public License - v 2.0 or GNU Lesser General Public License
+  Logback Core Module under Eclipse Public License - v 2.0 or GNU Lesser General Public License
   mockito-core under The MIT License
   Objenesis under Apache License, Version 2.0
   Old JAXB Runtime under Eclipse Distribution License - v 1.0
@@ -90,23 +97,22 @@ This project includes:
   Resource Server Content under Apache License Version 2.0
   Resource Server Core under Apache License Version 2.0
   Resource Server Utilities under Apache License Version 2.0
-  servlet-api under Commons Development and Distribution License, Version 1.0
-  SLF4J API Module under MIT License
+  SLF4J API Module under MIT
   Spring AOP under The Apache Software License, Version 2.0
   Spring Beans under The Apache Software License, Version 2.0
   Spring Context under The Apache Software License, Version 2.0
   Spring Context Support under The Apache Software License, Version 2.0
   Spring Core under The Apache Software License, Version 2.0
   Spring Expression Language (SpEL) under The Apache Software License, Version 2.0
   Spring JDBC under The Apache Software License, Version 2.0
-  Spring Portlet WebMVC Contributions under Apache License Version 2.0
+  Spring Object/XML Marshalling under The Apache Software License, Version 2.0
+  Spring Portlet WebMVC Contributions under Apache License, Version 2.0
   Spring TestContext Framework under The Apache Software License, Version 2.0
   Spring Transaction under The Apache Software License, Version 2.0
   Spring Web under The Apache Software License, Version 2.0
   Spring Web MVC under The Apache Software License, Version 2.0
   Spring Web Portlet under The Apache Software License, Version 2.0
   Spring WS Core under The Apache Software License, Version 2.0
-  spring-oxm under The Apache Software License, Version 2.0
   spring-security-core under The Apache Software License, Version 2.0
   spring-ws-security under Apache License, Version 2.0
   spring-xml under Apache License, Version 2.0
@@ -115,5 +121,6 @@ This project includes:
   Streaming API for XML under Sun Binary Code License
   Woodstox under The Apache Software License, Version 2.0
   WSDL4J under CPL
+  XML Commons External Components XML APIs under The Apache Software License, Version 2.0
   XMLTooling-J under Apache 2
 

courses-portlet-api/pom.xml

@@ -33,8 +33,8 @@
 
     <dependencies>
         <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
         </dependency>
         <dependency>
             <groupId>joda-time</groupId>

courses-portlet-api/src/main/java/org/jasig/portlet/degreeprogress/model/StudentCourseRegistration.java

@@ -18,8 +18,8 @@
  */
 package org.jasig.portlet.degreeprogress.model;
 
-import org.apache.commons.lang.builder.ToStringBuilder;
-import org.apache.commons.lang.builder.ToStringStyle;
+import org.apache.commons.lang3.builder.ToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
 import org.jasig.portlet.degreeprogress.model.xml.Course;
 import org.jasig.portlet.degreeprogress.model.xml.Grade;
 import org.jasig.portlet.degreeprogress.model.xml.Semester;

courses-portlet-dao/src/main/java/org/jasig/portlet/courses/dao/xml/SecureRequestCredentials.java

@@ -36,7 +36,7 @@
 import javax.crypto.spec.PBEKeySpec;
 import javax.crypto.spec.PBEParameterSpec;
 
-import org.apache.commons.lang.RandomStringUtils;
+import org.apache.commons.lang3.RandomStringUtils;
 
 /**
  * Holds a username and password in a secure manner. The intent is not to protect from in memory attacks as calling {@link #getPassword()}

courses-portlet-webapp/pom.xml

@@ -37,8 +37,8 @@
             <version>${project.version}</version>
         </dependency>
         <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
         </dependency>
         <dependency>
             <groupId>javax.servlet</groupId>

courses-portlet-webapp/src/main/java/org/jasig/portlet/courses/mvc/wrapper/CourseSectionMeetingWrapper.java

@@ -18,7 +18,7 @@
  */
 package org.jasig.portlet.courses.mvc.wrapper;
 
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.jasig.portlet.courses.model.xml.CourseMeeting;
 import org.jasig.portlet.courses.model.xml.CourseSection;
 import org.jasig.portlet.courses.service.IURLService;

courses-portlet-webapp/src/main/java/org/jasig/portlet/degreeprogress/mvc/portlet/DegreeProgressController.java

@@ -25,7 +25,7 @@
 import javax.portlet.PortletPreferences;
 import javax.portlet.PortletRequest;
 
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.jasig.portlet.courses.dao.ICoursesDao;
 import org.jasig.portlet.degreeprogress.dao.IDegreeProgramDao;
 import org.jasig.portlet.degreeprogress.dao.IDegreeProgressDao;

pom.xml

@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.jasig.portlet</groupId>
     <artifactId>uportal-portlet-parent</artifactId>
-    <version>50</version>
+    <version>51</version>
   </parent>
 
   <modelVersion>4.0.0</modelVersion>