From 38e6371e9f04ee8141e9a86c85e34ff6b05a0d53 Mon Sep 17 00:00:00 2001
From: likeelli <likeelli@tencent.com>
Date: Thu, 20 Aug 2026 10:34:04 +0800
Subject: [PATCH 1/2] =?UTF-8?q?--story=3D137312876=20[=E5=AE=89=E5=85=A8]?=
 =?UTF-8?q?=20=E5=8D=87=E7=BA=A7=20commons-lang3=20=E8=87=B3=203.18.0=20?=
 =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20CVE-2025-48924?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pom.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pom.xml b/pom.xml
index e2e762b0d1..3805b4d903 100644
--- a/pom.xml
+++ b/pom.xml
@@ -34,6 +34,12 @@
       <artifactId>commons-configuration2</artifactId>
       <version>2.12.0</version>
     </dependency>
+    <!-- CVE-2025-48924: fix DoS vulnerability in commons-lang3, override transitive dependency -->
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-lang3</artifactId>
+      <version>3.18.0</version>
+    </dependency>
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>

From 4d22a5bbaaeedce57d84b9f10625b58e0c174345 Mon Sep 17 00:00:00 2001
From: likeelli <likeelli@tencent.com>
Date: Thu, 20 Aug 2026 15:12:24 +0800
Subject: [PATCH 2/2] =?UTF-8?q?--story=3D137312876=20[=E5=AE=89=E5=85=A8]?=
 =?UTF-8?q?=20=E5=8D=87=E7=BA=A7=20commons-lang3=20=E8=87=B3=203.18.0=20?=
 =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20CVE-2025-48924?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pom.xml | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/pom.xml b/pom.xml
index 3805b4d903..1b4d249c51 100644
--- a/pom.xml
+++ b/pom.xml
@@ -32,13 +32,7 @@
     <dependency>
       <groupId>org.apache.commons</groupId>
       <artifactId>commons-configuration2</artifactId>
-      <version>2.12.0</version>
-    </dependency>
-    <!-- CVE-2025-48924: fix DoS vulnerability in commons-lang3, override transitive dependency -->
-    <dependency>
-      <groupId>org.apache.commons</groupId>
-      <artifactId>commons-lang3</artifactId>
-      <version>3.18.0</version>
+      <version>2.15.1</version>
     </dependency>
     <dependency>
       <groupId>junit</groupId>