Tika 1.9.1 is using the legacy commons-lang 2.x series. This series is not going to receive updates anymore and is completely superseded by commons-lang 3.x .
Projects that use Tika are blocked from dropping commons-lang 2.x due to this dependency.
The link that I found was from tika-parsers to jackcess and then to commons-lang 2.6
[INFO] +- com.healthmarketscience.jackcess:jackcess:jar:2.1.12:compile [INFO] | \- commons-lang:commons-lang:jar:2.6:compile
If I understand correctly, this is the only commons-lang 2.x dependency from the Tika runtime and it would be great to remove it.
SLING-7953 Switch from legacy commons lang 2 to commons lang 3
TIKA-2674 Update some dependencies that are incompatible with Java 11