Tika 1.9.1 is using the legacy commons-lang 2.x series. This series is not going to receive updates anymore and is completely superseded by commons-lang 3.x .
Projects that use Tika are blocked from dropping commons-lang 2.x due to this dependency.
The link that I found was from tika-parsers to jackcess and then to commons-lang 2.6
If I understand correctly, this is the only commons-lang 2.x dependency from the Tika runtime and it would be great to remove it.