From cb47f044dc074c2a5a91388b0c19104febd81b95 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 Apr 2026 03:17:11 +0000
Subject: [PATCH] Build(deps): Bump the apache-commons group across 1 directory
 with 6 updates

Bumps the apache-commons group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [commons-net:commons-net](https://github.com/apache/commons-net) | `3.9.0` | `3.13.0` |
| org.apache.commons:commons-configuration2 | `2.11.0` | `2.14.0` |
| org.apache.commons:commons-lang3 | `3.18.0` | `3.20.0` |
| [org.apache.commons:commons-text](https://github.com/apache/commons-text) | `1.10.0` | `1.15.0` |
| [commons-io:commons-io](https://github.com/apache/commons-io) | `2.15.0` | `2.21.0` |
| [org.apache.commons:commons-compress](https://github.com/apache/commons-compress) | `1.26.2` | `1.28.0` |



Updates `commons-net:commons-net` from 3.9.0 to 3.13.0
- [Changelog](https://github.com/apache/commons-net/blob/master/RELEASE-NOTES.txt)
- [Commits](https://github.com/apache/commons-net/compare/rel/commons-net-3.9.0...rel/commons-net-3.13.0)

Updates `org.apache.commons:commons-configuration2` from 2.11.0 to 2.14.0

Updates `org.apache.commons:commons-lang3` from 3.18.0 to 3.20.0

Updates `org.apache.commons:commons-text` from 1.10.0 to 1.15.0
- [Changelog](https://github.com/apache/commons-text/blob/master/RELEASE-NOTES.txt)
- [Commits](https://github.com/apache/commons-text/compare/rel/commons-text-1.10.0...rel/commons-text-1.15.0)

Updates `commons-io:commons-io` from 2.15.0 to 2.21.0
- [Changelog](https://github.com/apache/commons-io/blob/master/RELEASE-NOTES.txt)
- [Commits](https://github.com/apache/commons-io/compare/rel/commons-io-2.15.0...rel/commons-io-2.21.0)

Updates `org.apache.commons:commons-compress` from 1.26.2 to 1.28.0
- [Changelog](https://github.com/apache/commons-compress/blob/master/RELEASE-NOTES.txt)
- [Commits](https://github.com/apache/commons-compress/compare/rel/commons-compress-1.26.2...rel/commons-compress-1.28.0)

---
updated-dependencies:
- dependency-name: commons-net:commons-net
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: apache-commons
- dependency-name: org.apache.commons:commons-configuration2
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: apache-commons
- dependency-name: org.apache.commons:commons-lang3
  dependency-version: 3.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: apache-commons
- dependency-name: org.apache.commons:commons-text
  dependency-version: 1.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: apache-commons
- dependency-name: commons-io:commons-io
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: apache-commons
- dependency-name: org.apache.commons:commons-compress
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: apache-commons
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 analytics-core/pom.xml | 6 +++---
 batch-models/pom.xml   | 4 ++--
 pom.xml                | 8 ++++----
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/analytics-core/pom.xml b/analytics-core/pom.xml
index 0d08063..1ce60ad 100644
--- a/analytics-core/pom.xml
+++ b/analytics-core/pom.xml
@@ -379,7 +379,7 @@
 		<dependency>
 			<groupId>org.apache.commons</groupId>
 			<artifactId>commons-text</artifactId>
-			<version>1.10.0</version>
+			<version>1.15.0</version>
 			<exclusions>
 				<exclusion>
 					<groupId>org.apache.commons</groupId>
@@ -396,7 +396,7 @@
 		<dependency>
 			<groupId>commons-io</groupId>
 			<artifactId>commons-io</artifactId>
-			<version>2.15.0</version>
+			<version>2.21.0</version>
 		</dependency>
 		<!-- https://mvnrepository.com/artifact/io.github.embeddedkafka/embedded-kafka -->
 		<dependency>
@@ -415,7 +415,7 @@
 		<dependency>
 			<groupId>org.apache.commons</groupId>
 			<artifactId>commons-compress</artifactId>
-			<version>1.26.2</version>
+			<version>1.28.0</version>
 		</dependency>
 		<dependency>
 			<groupId>com.fasterxml.woodstox</groupId>
diff --git a/batch-models/pom.xml b/batch-models/pom.xml
index b640bac..9e5bc38 100644
--- a/batch-models/pom.xml
+++ b/batch-models/pom.xml
@@ -298,7 +298,7 @@
 		<dependency>
 			<groupId>org.apache.commons</groupId>
 			<artifactId>commons-compress</artifactId>
-			<version>1.26.2</version>
+			<version>1.28.0</version>
 		</dependency>
 		<dependency>
 			<groupId>com.fasterxml.woodstox</groupId>
@@ -308,7 +308,7 @@
 		<dependency>
 			<groupId>commons-io</groupId>
 			<artifactId>commons-io</artifactId>
-			<version>2.15.0</version>
+			<version>2.21.0</version>
 		</dependency>
 		<dependency>
 			<groupId>io.netty</groupId>
diff --git a/pom.xml b/pom.xml
index a106df4..de51098 100644
--- a/pom.xml
+++ b/pom.xml
@@ -123,25 +123,25 @@
 			<dependency>
 				<groupId>commons-net</groupId>
 				<artifactId>commons-net</artifactId>
-				<version>3.9.0</version>
+				<version>3.13.0</version>
 			</dependency>
 			<!-- CVE-2024-29131 (MED), CVE-2024-29133 (MED) -->
 			<dependency>
 				<groupId>org.apache.commons</groupId>
 				<artifactId>commons-configuration2</artifactId>
-				<version>2.11.0</version>
+				<version>2.14.0</version>
 			</dependency>
 			<!-- CVE-2025-48924 (MED) -->
 			<dependency>
 				<groupId>org.apache.commons</groupId>
 				<artifactId>commons-lang3</artifactId>
-				<version>3.18.0</version>
+				<version>3.20.0</version>
 			</dependency>
 			<!-- CVE-2022-42889 (CRIT): safe at 1.10.0 — centrally managed so all modules are covered -->
 			<dependency>
 				<groupId>org.apache.commons</groupId>
 				<artifactId>commons-text</artifactId>
-				<version>1.10.0</version>
+				<version>1.15.0</version>
 			</dependency>
 			<!-- CVE-2025-66566 (HIGH), CVE-2025-12183 (HIGH): org.lz4:lz4-java safe at 1.10.1.
 			     Kafka and other transitive paths pull this groupId; at.yawk.lz4:lz4-java is