Apache Commons Collections End of Life - Dates and Lifecycle

Apache Commons Collections is a Java library that extends the core Java Collections Framework with additional data structures, decorators, and utility methods, functionality like bags, bidirectional maps, and functional-style transformations that aren't part of the standard library. It's used directly by many Java applications and pulled in transitively by other widely used libraries, including Apache Commons BeanUtils, which is how it often ends up in a dependency tree without a team realizing it.

Apache Commons Collections Lifecycle Explained

Commons Collections exists as two separate, differently versioned lines that both trace back to the same codebase. The original line, packaged as org.apache.commons.collections, topped out at version 3.2.2 in November 2015 and has had no release since, it's fully end of life. The current line, packaged as org.apache.commons.collections4 starting at version 4.0 in 2013, remains the actively maintained one, though its own release cadence is slow, nearly six years passed between 4.4 (2019) and 4.5.0 (2025).

The reason both lines converged on a release in the same two-week window in November 2015 is a major security event. Several functor classes in the library, most notably InvokerTransformer, could be exploited through Java's object deserialization mechanism to achieve remote code execution in applications that deserialized untrusted data, even if the application never directly called the vulnerable classes itself. This became one of the most consequential Java library vulnerabilities of that era, affecting numerous products across the ecosystem that used Commons Collections somewhere in their dependency tree. Commons Collections 3.2.2 and 4.1 both shipped fixes for it, removing or restricting the dangerous serialization behavior.

The practical risk that follows from this history isn't really about the actively maintained 4.x line, it's about 3.x lingering as an invisible transitive dependency. Apache Commons BeanUtils, for example, has historically pulled in Commons Collections 3.x by default, meaning a project that never directly chose to depend on the old, end-of-life 3.x line can still end up shipping it, and by extension carrying its unpatched risk, simply by using BeanUtils. Development discussions around projects like JasperReports have explicitly flagged this exact situation as a reason to migrate away from BeanUtils versions that still require Collections 3.x.