Downgrade commons-lang3 to 3.14.0 to avoid entropy issues

[famod]

Details: #41962 (comment)

Draft until it's clear whether or not this is the right way to go for now.
If not, then there should at least be a hint in the migration guide (I think).

[gsmet]

Hum. Awesome…

We are affected only starting 3.13?

Should we report the issue to Liquibase?

[famod]

We are affected only starting 3.13?

It seems so.

Should we report the issue to Liquibase?

There are two issues already (on which I left comments):

• Potential Future Issue With StringUtil randomIdentifier Method liquibase/liquibase#6156
• Liquibase hangs when trying to apply changesets on a newly created machine liquibase/liquibase#6178

and there's an open PR: liquibase/liquibase#6179

So there should be a "fixed" version of Liquibase sooner or later.

Question is: What else is (potentially) affected? E.g. https://github.com/search?q=repo%3Aquarkusio%2Fquarkus%20RandomStringUtils&type=code
Finding affected libs is much harder.

[gsmet]

I think it makes sense to merge this for now until the ecosystem has adapted.

Please mark it ready for review when if all is good on your side and I'll include it in the next 3.13 and 3.14.0.

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit 6ce7dee.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.

---

Flaky tests - Develocity

⚙️ JVM Tests - JDK 17

📦 extensions/smallrye-reactive-messaging/deployment

✖ io.quarkus.smallrye.reactivemessaging.hotreload.ConnectorChangeTest.testUpdatingConnector - History

• Expecting actual: ["-4","-5","-6","-7","-8","-9","-10","-11"] to start with: ["-3", "-4", "-5", "-6"] - java.lang.AssertionError

java.lang.AssertionError: 

Expecting actual:
  ["-4","-5","-6","-7","-8","-9","-10","-11"]
to start with:
  ["-3", "-4", "-5", "-6"]

	at io.quarkus.smallrye.reactivemessaging.hotreload.ConnectorChangeTest.testUpdatingConnector(ConnectorChangeTest.java:36)

---

⚙️ JVM Tests - JDK 21

📦 extensions/smallrye-reactive-messaging/deployment

✖ io.quarkus.smallrye.reactivemessaging.hotreload.ConnectorChangeTest.testUpdatingConnector - History

• Expecting actual: ["-4","-5","-6","-7","-8","-9","-10","-11"] to start with: ["-3", "-4", "-5", "-6"] - java.lang.AssertionError

java.lang.AssertionError: 

Expecting actual:
  ["-4","-5","-6","-7","-8","-9","-10","-11"]
to start with:
  ["-3", "-4", "-5", "-6"]

	at io.quarkus.smallrye.reactivemessaging.hotreload.ConnectorChangeTest.testUpdatingConnector(ConnectorChangeTest.java:36)

---

⚙️ JVM Tests - JDK 17 Windows

📦 extensions/micrometer/deployment

✖ io.quarkus.micrometer.deployment.binder.VertxTcpMetricsTest.testTcpMetrics - History

• event executor terminated - java.util.concurrent.RejectedExecutionException

java.util.concurrent.RejectedExecutionException: event executor terminated
	at io.netty.util.concurrent.SingleThreadEventExecutor.reject(SingleThreadEventExecutor.java:931)
	at io.netty.util.concurrent.SingleThreadEventExecutor.offerTask(SingleThreadEventExecutor.java:350)
	at io.netty.util.concurrent.SingleThreadEventExecutor.addTask(SingleThreadEventExecutor.java:343)
	at io.netty.util.concurrent.SingleThreadEventExecutor.execute(SingleThreadEventExecutor.java:833)
	at io.netty.util.concurrent.SingleThreadEventExecutor.execute0(SingleThreadEventExecutor.java:824)
	at io.netty.util.concurrent.SingleThreadEventExecutor.execute(SingleThreadEventExecutor.java:814)
	at io.vertx.core.impl.EventLoopExecutor.execute(EventLoopExecutor.java:35)

---

⚙️ Gradle Tests - JDK 17 Windows

📦 integration-tests/gradle

✖ io.quarkus.gradle.devmode.MavenExclusionInExtensionDependencyDevModeTest.main - History

• Condition with Lambda expression in io.quarkus.test.devmode.util.DevModeClient was not fulfilled within 1 minutes 30 seconds. - org.awaitility.core.ConditionTimeoutException

org.awaitility.core.ConditionTimeoutException: Condition with Lambda expression in io.quarkus.test.devmode.util.DevModeClient was not fulfilled within 1 minutes  30 seconds.
	at app//org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at app//org.awaitility.core.CallableCondition.await(CallableCondition.java:78)
	at app//org.awaitility.core.CallableCondition.await(CallableCondition.java:26)
	at app//org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1006)
	at app//org.awaitility.core.ConditionFactory.until(ConditionFactory.java:975)
	at app//io.quarkus.test.devmode.util.DevModeClient.getHttpResponse(DevModeClient.java:164)
	at app//io.quarkus.gradle.devmode.QuarkusDevGradleTestBase.getHttpResponse(QuarkusDevGradleTestBase.java:164)

---

⚙️ Native Tests - HTTP

📦 integration-tests/rest-client-reactive

✖ io.quarkus.it.rest.client.BasicTestIT.shouldCreateClientSpans - History

• expected: <1> but was: <2> - org.opentest4j.AssertionFailedError

org.opentest4j.AssertionFailedError: expected: <1> but was: <2>
	at io.quarkus.it.rest.client.BasicTest.shouldCreateClientSpans(BasicTest.java:216)
	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
	at io.quarkus.test.junit.QuarkusTestExtension.interceptTestMethod(QuarkusTestExtension.java:821)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)

[mikethecalamity]

I see this is tagged as a backport to 3.13, any idea when that patch will be released?

[gsmet]

If all goes well, it will be released today.