xmpbox has a dependency on commons-io for only one class : IOUtils. This artefact weights 170 kb.
To make easier deployment and reduce dependencies foot print, this class could be copied in xmpbox artefact (changing package name).
This copy looks acceptable because, there is really few code (and robust).
This utility class could also be used in preflight.