upgrade commons-lang to 3.  Keep 2 for other 3rd party modules that depend on it at runtime (there is no collision with 2 and 3)
Update EscapeUtil wrapper to use version 3.