build(deps): update test commons-lang3 to 3.18.0

[jbeckwith-oai]

Summary

• constrain WireMock's transitive commons-lang3 dependency to 3.18.0 in the core and OkHttp test graphs
• use the first patched release for Dependabot alert 46 while leaving WireMock at 2.35.2
• keep the change test-only so published artifacts and consumer dependency graphs are unaffected

Compatibility analysis

• 3.18.0 is the minimum release that fixes GHSA-j288-q9x7-2f5v / CVE-2025-48924, minimizing behavior drift versus moving to the latest Commons Lang release
• Commons Lang 3.18.0 still requires Java 8, and its artifact bytecode targets Java 8
• WireMock 2.35.2 and Handlebars Helpers linkage to Commons Lang resolves against 3.18.0
• Commons Lang is absent from the core and OkHttp production runtime classpaths and from their generated POM and Gradle module metadata
• the supported Jackson 2.14 compatibility floor and published Jackson 2.18.9 runtime are unchanged

Validation

• ./scripts/test
• all 15 WireMock-backed core test classes with the published Jackson 2.18.9 runtime
• OkHttp WireMock tests with the Jackson 2.14.0 compatibility floor
• ./scripts/lint
• ./scripts/build
• ./scripts/detect-breaking-changes origin/main
• dependency insight for both affected test runtime classpaths
• generated Maven POM and Gradle module metadata inspection
• Java 8 bytecode and WireMock/Handlebars linkage inspection

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 16.326s for Java SDK PR #789.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	277ms
tests/chat-completions-create.test.ts	✅ Passed	857ms
tests/chat-completions-stream.test.ts	✅ Passed	343ms
tests/files-content-binary.test.ts	✅ Passed	265ms
tests/files-create-multipart.test.ts	✅ Passed	295ms
tests/files-list-pagination.test.ts	✅ Passed	289ms
tests/initialize-config.test.ts	✅ Passed	156ms
tests/instance-isolation.test.ts	✅ Passed	199ms
tests/models-list.test.ts	✅ Passed	176ms
tests/responses-background-lifecycle.test.ts	✅ Passed	333ms
tests/responses-body-method-errors.test.ts	✅ Passed	475ms
tests/responses-cancel-timeout.test.ts	✅ Passed	233ms
tests/responses-cancel.test.ts	✅ Passed	344ms
tests/responses-compact-retries.test.ts	✅ Passed	382ms
tests/responses-compact.test.ts	✅ Passed	304ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	455ms
tests/responses-create-advanced.test.ts	✅ Passed	1.366s
tests/responses-create-disconnect.test.ts	✅ Passed	1.148s
tests/responses-create-errors.test.ts	✅ Passed	383ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	282ms
tests/responses-create-retries.test.ts	✅ Passed	258ms
tests/responses-create-stream-failures.test.ts	✅ Passed	226ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	238ms
tests/responses-create-stream-wire.test.ts	✅ Passed	6.02s
tests/responses-create-stream.test.ts	✅ Passed	421ms
tests/responses-create-terminal-states.test.ts	✅ Passed	334ms
tests/responses-create-timeout.test.ts	✅ Passed	240ms
tests/responses-create.test.ts	✅ Passed	249ms
tests/responses-delete.test.ts	✅ Passed	275ms
tests/responses-input-items-errors.test.ts	✅ Passed	294ms
tests/responses-input-items-list.test.ts	✅ Passed	358ms
tests/responses-input-items-options.test.ts	✅ Passed	291ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	188ms
tests/responses-input-tokens-count.test.ts	✅ Passed	411ms
tests/responses-malformed-inputs.test.ts	✅ Passed	4.951s
tests/responses-not-found-errors.test.ts	✅ Passed	427ms
tests/responses-parse.test.ts	✅ Passed	704ms
tests/responses-retrieve-retries.test.ts	✅ Passed	1.055s
tests/responses-retrieve.test.ts	✅ Passed	302ms
tests/responses-stored-method-errors.test.ts	✅ Passed	990ms
tests/retry-behavior.test.ts	✅ Passed	3.496s
tests/sdk-error-shape.test.ts	✅ Passed	455ms

View OkTest run #29601828287

_{SDK merge (73be7c134684) · head (09b8e87df6fc) · base (b2cf0ff66e42) · OkTest (fd7a761c81c1)}

[HAYDEN-OAI]

looks good, thanks!

[HAYDEN-OAI]

looks good, thanks! verified the current head stays test-only and leaves published dependencies, api surface, and java 8 compatibility unchanged.

[HAYDEN-OAI]

looks good, thanks! rechecked the current head and it stays test-only with green checks.

[jbeckwith-oai]

@HAYDEN-OAI apologies for Java being a silly language 😅. I rebased #789 onto the latest main, preserved the already-merged dependency constraints, and the new head is conflict-free with all CI green. Could you please give it another review when you have a chance?

[HAYDEN-OAI]

looks good, thanks! rechecked the rebased head, and the change remains test-only with green checks.