Update to Java 11

Remove Commons IO dependency (WIP)
diff --git a/parent/pom.xml b/parent/pom.xml
index 36bdd55..8aa05c7 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -63,7 +63,7 @@
         <bnd.version>6.4.0</bnd.version>
         <minimalMavenBuildVersion>3.6.1</minimalMavenBuildVersion><!-- due to https://issues.apache.org/jira/browse/MNG-6059 -->
         <minimalJavaBuildVersion>11</minimalJavaBuildVersion>
-        <maven.compiler.release>8</maven.compiler.release>
+        <maven.compiler.release>11</maven.compiler.release>
         <sling.url>http://localhost:4502</sling.url>
         <jacoco.command /><!-- is overwritten by https://www.eclemma.org/jacoco/trunk/doc/prepare-agent-mojo.html -->
         <project.build.outputTimestamp>2024-08-01T07:16:26Z</project.build.outputTimestamp>
diff --git a/vault-core/pom.xml b/vault-core/pom.xml
index 2d5731d..d2b6c53 100644
--- a/vault-core/pom.xml
+++ b/vault-core/pom.xml
@@ -178,6 +178,12 @@
             <groupId>org.apache.jackrabbit</groupId>
             <artifactId>jackrabbit-jcr2spi</artifactId>
             <scope>provided</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>commons-io</groupId>
+                    <artifactId>commons-io</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <!-- JCR Stuff -->
         <dependency>
@@ -215,11 +221,6 @@
             <scope>provided</scope>
         </dependency>
         <dependency>
-            <groupId>commons-io</groupId>
-            <artifactId>commons-io</artifactId>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
             <groupId>org.jetbrains</groupId>
             <artifactId>annotations</artifactId>
             <scope>provided</scope>
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/AbstractConfig.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/AbstractConfig.java
index 26bdc18..d4be02f 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/AbstractConfig.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/AbstractConfig.java
@@ -18,6 +18,8 @@
 package org.apache.jackrabbit.vault.fs.config;
 
 import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -28,7 +30,6 @@
 import javax.xml.stream.XMLStreamException;
 import javax.xml.stream.XMLStreamWriter;
 
-import org.apache.commons.io.FileUtils;
 import org.apache.jackrabbit.vault.util.RejectingEntityResolver;
 import org.apache.jackrabbit.vault.util.xml.serialize.FormattingXmlStreamWriter;
 import org.apache.jackrabbit.vault.util.xml.serialize.OutputFormat;
@@ -87,7 +88,7 @@
 
     public boolean load(File configFile) throws IOException, ConfigurationException {
         if (configFile.canRead()) {
-            try (InputStream input = FileUtils.openInputStream(configFile)) {
+            try (InputStream input = new FileInputStream(configFile)) {
                 return load(input);
             }
         }
@@ -120,7 +121,7 @@
     }
 
     public void save(File configFile) throws IOException {
-        try (OutputStream output = FileUtils.openOutputStream(configFile)) {
+        try (OutputStream output = new FileOutputStream(configFile)) {
             save(output);
         }
     }
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/AbstractVaultFsConfig.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/AbstractVaultFsConfig.java
index 885c252..1de7acd 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/AbstractVaultFsConfig.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/AbstractVaultFsConfig.java
@@ -33,7 +33,6 @@
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
-import org.apache.commons.io.IOUtils;
 import org.apache.jackrabbit.vault.fs.api.Aggregator;
 import org.apache.jackrabbit.vault.fs.api.ArtifactHandler;
 import org.apache.jackrabbit.vault.fs.api.VaultFsConfig;
@@ -85,7 +84,7 @@
      */
     public static VaultFsConfig load(InputStream in, String name)
             throws ConfigurationException, IOException {
-        byte[] source = IOUtils.toByteArray(in);
+        byte[] source = in.readAllBytes();
         Document document = parse(new ByteArrayInputStream(source));
 
         Element doc = document.getDocumentElement();
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultMetaInf.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultMetaInf.java
index 8cab1b7..e7e4f15 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultMetaInf.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultMetaInf.java
@@ -19,6 +19,7 @@
 
 import java.io.File;
 import java.io.FileInputStream;
+import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
@@ -33,7 +34,6 @@
 import javax.jcr.NamespaceException;
 
 import org.apache.commons.io.FileUtils;
-import org.apache.commons.io.IOUtils;
 import org.apache.commons.io.input.CloseShieldInputStream;
 import org.apache.jackrabbit.spi.commons.privilege.ParseException;
 import org.apache.jackrabbit.spi.commons.privilege.PrivilegeDefinitionReader;
@@ -346,8 +346,9 @@
             throws IOException {
         if (config != null) {
             File file = new File(metaDir, Constants.CONFIG_XML);
-            try (OutputStream output = FileUtils.openOutputStream(file)) {
-                IOUtils.copy(config.getSource(), output);
+            try (OutputStream output = new FileOutputStream(file);
+                InputStream in = config.getSource()) {
+                in.transferTo(output);
             }
         }
     }
@@ -373,8 +374,9 @@
             throws IOException {
         if (filter != null) {
             File file = new File(metaDir, Constants.FILTER_XML);
-            try (OutputStream output = FileUtils.openOutputStream(file)) {
-                IOUtils.copy(filter.getSource(), output);
+            try (OutputStream output = new FileOutputStream(file);
+                 InputStream in = filter.getSource()) {
+                in.transferTo(output);
             }
         }
     }
@@ -382,7 +384,7 @@
     protected void loadProperties(@NotNull File metaDir) throws IOException {
         File file = new File(metaDir, Constants.PROPERTIES_XML);
         if (file.isFile()) {
-            try (InputStream input = FileUtils.openInputStream(file)) {
+            try (InputStream input = new FileInputStream(file)) {
                 Properties properties = new Properties();
                 properties.loadFromXML(input);
                 this.properties = properties;
@@ -393,7 +395,7 @@
     protected void saveProperties(@NotNull File metaDir) throws IOException {
         if (properties != null) {
             File file = new File(metaDir, Constants.PROPERTIES_XML);
-            try (OutputStream output = FileUtils.openOutputStream(file)) {
+            try (OutputStream output = new FileOutputStream(file)) {
                 properties.storeToXML(output, "Custom Vault Properties", "utf-8");
             }
         }
@@ -402,7 +404,7 @@
     protected void loadPrivileges(@NotNull File metaDir) throws IOException {
         File file = new File(metaDir, Constants.PRIVILEGES_XML);
         if (file.isFile()) {
-            try (InputStream in = FileUtils.openInputStream(file)) {
+            try (InputStream in = new FileInputStream(file)) {
                 loadPrivileges(in, file.getPath());
             }
         }
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java
index f012214..4d73cbc 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java
@@ -41,7 +41,6 @@
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.stream.XMLStreamException;
 
-import org.apache.commons.io.IOUtils;
 import org.apache.jackrabbit.util.Text;
 import org.apache.jackrabbit.vault.fs.api.DumpContext;
 import org.apache.jackrabbit.vault.fs.api.Dumpable;
@@ -358,7 +357,7 @@
      * @throws IOException if an I/O error occurs
      */
     public void load(final InputStream in) throws IOException, ConfigurationException {
-        byte[] tmpSource = source = IOUtils.toByteArray(in);
+        byte[] tmpSource = source = in.readAllBytes();
         try (InputStream inCopy = getSource()) {
             DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
             factory.setNamespaceAware(true);
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/PropertyValueArtifact.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/PropertyValueArtifact.java
index bcafe13..3c042d9 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/PropertyValueArtifact.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/PropertyValueArtifact.java
@@ -30,7 +30,6 @@
 import javax.jcr.RepositoryException;
 import javax.jcr.Value;
 
-import org.apache.commons.io.IOUtils;
 import org.apache.jackrabbit.vault.fs.api.AccessType;
 import org.apache.jackrabbit.vault.fs.api.Artifact;
 import org.apache.jackrabbit.vault.fs.api.ArtifactType;
@@ -167,7 +166,7 @@
             tmpFile.deleteOnExit();
             try (FileOutputStream out = new FileOutputStream(tmpFile);
                  InputStream in = getValue().getBinary().getStream()) {
-                IOUtils.copy(in, out);
+                in.transferTo(out);
             }
         }
     }
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/CompressionUtil.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/CompressionUtil.java
index 422107c..eba098e 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/CompressionUtil.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/CompressionUtil.java
@@ -30,7 +30,6 @@
 
 import javax.jcr.RepositoryException;
 
-import org.apache.commons.io.IOUtils;
 import org.apache.jackrabbit.vault.fs.api.Artifact;
 import org.apache.jackrabbit.vault.fs.api.SerializationType;
 import org.jetbrains.annotations.NotNull;
@@ -156,7 +155,7 @@
 
     static int seemsCompressible(@NotNull Artifact artifact) {
         try (InputStream stream = artifact.getInputStream()) {
-            byte[] sample = IOUtils.toByteArray(stream, SAMPLE_LENGTH);
+            byte[] sample = stream.readNBytes(SAMPLE_LENGTH);
             return isCompressible(sample, SAMPLE_LENGTH) ? 1 : -1;
         } catch (RepositoryException | IOException e) {
             log.warn(e.getMessage(), e);
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/DocViewFormat.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/DocViewFormat.java
index 36fd943..c26c4fd 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/DocViewFormat.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/DocViewFormat.java
@@ -18,7 +18,6 @@
 package org.apache.jackrabbit.vault.fs.io;
 
 import java.io.BufferedInputStream;
-import java.io.BufferedOutputStream;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
@@ -53,7 +52,6 @@
 import javax.xml.transform.sax.SAXSource;
 import javax.xml.transform.stax.StAXResult;
 
-import org.apache.commons.io.IOUtils;
 import org.apache.jackrabbit.vault.util.xml.serialize.FormattingXmlStreamWriter;
 import org.apache.jackrabbit.vault.util.xml.serialize.NormalizingSaxFilter;
 import org.apache.jackrabbit.vault.util.xml.serialize.OutputFormat;
@@ -93,8 +91,9 @@
 
         final boolean changed = originalCrc32.getValue() != formattedCrc32.getValue();
         if (changed && !dryRun) {
-            try (OutputStream out = new BufferedOutputStream(new FileOutputStream(file))) {
-                IOUtils.copy(new ByteArrayInputStream(formatted), out);
+            try (OutputStream out = new FileOutputStream(file);
+                 InputStream in = new ByteArrayInputStream(formatted) ) {
+                in.transferTo(out);
             }
         }
         return changed;
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/FileArchive.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/FileArchive.java
index 0bf2979..bee100f 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/FileArchive.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/FileArchive.java
@@ -18,6 +18,7 @@
 package org.apache.jackrabbit.vault.fs.io;
 
 import java.io.File;
+import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.util.ArrayList;
@@ -25,8 +26,7 @@
 import java.util.Collections;
 import java.util.List;
 
-import org.apache.commons.io.FileUtils;
-import org.apache.jackrabbit.vault.fs.api.VaultInputSource;
+i.VaultInputSource;
 import org.apache.jackrabbit.vault.fs.config.ExportRoot;
 import org.apache.jackrabbit.vault.fs.config.MetaInf;
 import org.apache.jackrabbit.vault.util.Constants;
@@ -110,7 +110,7 @@
         if (file == null || !file.isFile() || !file.canRead()) {
             return null;
         }
-        return FileUtils.openInputStream(file);
+        return new FileInputStream(file);
     }
 
     /**
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/Importer.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/Importer.java
index 8547e1a..5630b74 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/Importer.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/Importer.java
@@ -18,6 +18,7 @@
 package org.apache.jackrabbit.vault.fs.io;
 
 import java.io.File;
+import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
@@ -35,7 +36,6 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
-import java.util.Properties;
 import java.util.Set;
 
 import javax.jcr.Node;
@@ -44,8 +44,6 @@
 import javax.jcr.security.AccessControlPolicy;
 import javax.jcr.version.Version;
 
-import org.apache.commons.io.FileUtils;
-import org.apache.commons.io.IOUtils;
 import org.apache.jackrabbit.api.security.authorization.PrincipalSetPolicy;
 import org.apache.jackrabbit.spi.commons.namespace.NamespaceMapping;
 import org.apache.jackrabbit.spi.commons.namespace.NamespaceResolver;
@@ -1269,8 +1267,8 @@
             } else {
                 log.debug("Copying patch {} to {}", name, target.getPath());
                 try (InputStream in = archive.getInputSource(e).getByteStream();
-                     OutputStream out = FileUtils.openOutputStream(target)) {
-                    IOUtils.copy(in, out);
+                     OutputStream out = new FileOutputStream(target)) {
+                    in.transferTo(out);
                 } catch (IOException e1) {
                     log.error("Error while copying patch.", e);
                 }
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/JarExporter.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/JarExporter.java
index 857d136..be0346d 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/JarExporter.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/JarExporter.java
@@ -190,7 +190,7 @@
 
             case STREAM:
                 try (InputStream in = a.getInputStream()) {
-                    IOUtils.copy(in, jOut);
+                    in.transferTo(jOut);
                 }
                 break;
         }
@@ -206,7 +206,7 @@
             ZipEntry e = new ZipEntry(relPath);
             exportInfo.update(ExportInfo.Type.ADD, e.getName());
             jOut.putNextEntry(e);
-            IOUtils.copy(in, jOut);
+            in.transferTo(jOut);
             jOut.closeEntry();
         } finally {
             in.close();
@@ -227,7 +227,7 @@
         if (!entry.isDirectory()) {
             // copy
             try (InputStream in = zip.getInputStream(entry)) {
-                IOUtils.copy(in, jOut);
+                in.transferTo(jOut);
             }
         }
         jOut.closeEntry();
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/MemoryArchive.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/MemoryArchive.java
index 7d21d7b..12aee15 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/MemoryArchive.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/MemoryArchive.java
@@ -27,7 +27,6 @@
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
 
-import org.apache.commons.io.IOUtils;
 import org.apache.jackrabbit.util.Text;
 import org.apache.jackrabbit.vault.fs.api.VaultInputSource;
 import org.apache.jackrabbit.vault.fs.config.DefaultMetaInf;
@@ -86,7 +85,7 @@
             }
             if (isMeta || !cacheMetaOnly) {
                 String[] names = Text.explode(name, '/');
-                byte[] data = entry.isDirectory() ? null : IOUtils.toByteArray(zin);
+                byte[] data = entry.isDirectory() ? null : zin.readAllBytes();
                 if (names.length > 0) {
                     VirtualEntry je = root;
                     for (int i=0; i<names.length; i++) {
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/PlatformExporter.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/PlatformExporter.java
index 2a9e45a..914fb76 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/PlatformExporter.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/PlatformExporter.java
@@ -171,7 +171,7 @@
             case STREAM:
                 try (InputStream in = a.getInputStream();
                     OutputStream out = new FileOutputStream(local)) {
-                    IOUtils.copy(in, out);
+                    in.transferTo(out);
                 }
                 break;
         }
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/impl/JcrPackageImpl.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/impl/JcrPackageImpl.java
index b41f0ca..05e0e84 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/impl/JcrPackageImpl.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/impl/JcrPackageImpl.java
@@ -17,6 +17,9 @@
 
 package org.apache.jackrabbit.vault.packaging.impl;
 
+import static org.apache.jackrabbit.vault.packaging.impl.JcrPackageManagerImpl.ARCHIVE_PACKAGE_ROOT_PATH;
+import static org.apache.jackrabbit.vault.packaging.registry.impl.AbstractPackageRegistry.DEFAULT_PACKAGE_ROOT_PATH;
+
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
@@ -39,10 +42,9 @@
 import javax.jcr.Session;
 import javax.jcr.nodetype.NodeTypeManager;
 
-import org.apache.commons.io.FileUtils;
-import org.apache.commons.io.IOUtils;
 import org.apache.jackrabbit.spi.Name;
 import org.apache.jackrabbit.spi.commons.conversion.DefaultNamePathResolver;
+import org.apache.jackrabbit.util.Text;
 import org.apache.jackrabbit.vault.fs.api.ImportMode;
 import org.apache.jackrabbit.vault.fs.api.PathFilterSet;
 import org.apache.jackrabbit.vault.fs.api.ProgressTrackerListener;
@@ -74,15 +76,11 @@
 import org.apache.jackrabbit.vault.packaging.registry.impl.JcrPackageRegistry;
 import org.apache.jackrabbit.vault.packaging.registry.impl.JcrRegisteredPackage;
 import org.apache.jackrabbit.vault.util.JcrConstants;
-import org.apache.jackrabbit.util.Text;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import static org.apache.jackrabbit.vault.packaging.impl.JcrPackageManagerImpl.ARCHIVE_PACKAGE_ROOT_PATH;
-import static org.apache.jackrabbit.vault.packaging.registry.impl.JcrPackageRegistry.DEFAULT_PACKAGE_ROOT_PATH;
-
 /**
  * Implements a JcrPackage
  */
@@ -323,9 +321,9 @@
             } else {
                 File tmpFile = File.createTempFile("vaultpack", ".zip");
                 Binary bin = getData().getBinary();
-                try (FileOutputStream out = FileUtils.openOutputStream(tmpFile); 
+                try (FileOutputStream out = new FileOutputStream(tmpFile); 
                     InputStream in = bin.getStream()) {
-                    IOUtils.copy(in, out);
+                    in.transferTo(out);
                 } finally {
                     bin.dispose();
                 }
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/impl/JcrPackageManagerImpl.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/impl/JcrPackageManagerImpl.java
index 61deeca..71a95c9 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/impl/JcrPackageManagerImpl.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/impl/JcrPackageManagerImpl.java
@@ -20,6 +20,7 @@
 import static org.apache.jackrabbit.vault.packaging.registry.impl.AbstractPackageRegistry.DEFAULT_PACKAGE_ROOT_PATH;
 
 import java.io.File;
+import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -37,7 +38,6 @@
 import javax.jcr.RepositoryException;
 import javax.jcr.Session;
 
-import org.apache.commons.io.FileUtils;
 import org.apache.jackrabbit.vault.fs.api.IdConflictPolicy;
 import org.apache.jackrabbit.vault.fs.api.ProgressTrackerListener;
 import org.apache.jackrabbit.vault.fs.api.WorkspaceFilter;
@@ -60,7 +60,6 @@
 import org.apache.jackrabbit.vault.packaging.events.PackageEvent;
 import org.apache.jackrabbit.vault.packaging.events.impl.PackageEventDispatcher;
 import org.apache.jackrabbit.vault.packaging.registry.PackageRegistry;
-
 import org.apache.jackrabbit.vault.packaging.registry.impl.AbstractPackageRegistry;
 import org.apache.jackrabbit.vault.packaging.registry.impl.JcrPackageRegistry;
 import org.apache.jackrabbit.vault.util.JcrConstants;
@@ -362,7 +361,7 @@
         // update this content
         Node contentNode = packNode.getNode(JcrConstants.JCR_CONTENT);
         
-        try (InputStream in = FileUtils.openInputStream(pack.getFile())){
+        try (InputStream in = new FileInputStream(pack.getFile())){
             // stay jcr 1.0 compatible
             //noinspection deprecation
             contentNode.setProperty(JcrConstants.JCR_DATA, in);
@@ -442,7 +441,7 @@
             // update this content
             Node packNode = pack.getNode();
             Node contentNode = packNode.getNode(JcrConstants.JCR_CONTENT);
-            try (InputStream in = FileUtils.openInputStream(dst.getFile())) {
+            try (InputStream in = new FileInputStream(dst.getFile())) {
                 // stay jcr 1.0 compatible
                 //noinspection deprecation
                 contentNode.setProperty(JcrConstants.JCR_DATA, in);
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/impl/PackageManagerImpl.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/impl/PackageManagerImpl.java
index 2507bd8..55ce54b 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/impl/PackageManagerImpl.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/impl/PackageManagerImpl.java
@@ -20,6 +20,7 @@
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
+import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -31,8 +32,6 @@
 import javax.jcr.RepositoryException;
 import javax.jcr.Session;
 
-import org.apache.commons.io.FileUtils;
-import org.apache.commons.io.IOUtils;
 import org.apache.jackrabbit.vault.fs.Mounter;
 import org.apache.jackrabbit.vault.fs.api.RepositoryAddress;
 import org.apache.jackrabbit.vault.fs.api.VaultFileSystem;
@@ -52,6 +51,7 @@
 import org.apache.jackrabbit.vault.packaging.events.PackageEvent;
 import org.apache.jackrabbit.vault.packaging.events.impl.PackageEventDispatcher;
 import org.apache.jackrabbit.vault.util.Constants;
+import org.h2.store.fs.FileUtils;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
 
@@ -104,21 +104,17 @@
     @Override
     public VaultPackage assemble(Session s, ExportOptions opts, File file)
             throws IOException, RepositoryException {
-        OutputStream out = null;
         boolean isTmp = false;
         boolean success = false;
-        try {
+        try (OutputStream out = new FileOutputStream(file)) {
             if (file == null) {
                 file = File.createTempFile("filevault", ".zip");
                 isTmp = true;
             }
-            out = FileUtils.openOutputStream(file);
             assemble(s, opts, out);
-            IOUtils.closeQuietly(out);
             success = true;
             return new ZipVaultPackage(file, isTmp);
         } finally {
-            IOUtils.closeQuietly(out);
             if (isTmp && !success) {
                 FileUtils.deleteQuietly(file);
             }
@@ -179,7 +175,7 @@
             file = File.createTempFile("filevault", ".zip");
             isTmp = true;
         }
-        try (OutputStream out = FileUtils.openOutputStream(file);){
+        try (OutputStream out = new FileOutputStream(file);){
             rewrap(opts, src, out);
             success = true;
             VaultPackage pack =  new ZipVaultPackage(file, isTmp);
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/util/FileInputSource.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/util/FileInputSource.java
index 2ed4d56..bf5fc58 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/util/FileInputSource.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/util/FileInputSource.java
@@ -22,7 +22,6 @@
 import java.io.IOException;
 import java.io.InputStream;
 
-import org.apache.commons.io.FileUtils;
 import org.apache.jackrabbit.vault.fs.api.VaultInputSource;
 
 /**
@@ -73,7 +72,7 @@
             if (lineSeparator != null) {
                 return new LineInputStream(new FileInputStream(file), lineSeparator);
             } else {
-                return FileUtils.openInputStream(file);
+                return new FileInputStream(file);
             }
         } catch (IOException e) {
             return null;
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/util/SHA1.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/util/SHA1.java
index 5314c6f..24faa77 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/util/SHA1.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/util/SHA1.java
@@ -18,13 +18,12 @@
 package org.apache.jackrabbit.vault.util;
 
 import java.io.File;
+import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 
-import org.apache.commons.io.FileUtils;
-
 /**
  * SHA1 abstraction
  * @deprecated Rather use {@link MessageDigest#getInstance(String)}
@@ -104,7 +103,7 @@
     }
 
     public static SHA1 digest(File file) throws IOException {
-        try (InputStream input = FileUtils.openInputStream(file)) {
+        try (InputStream input = new FileInputStream(file)) {
             return digest(input);
         }
     }
diff --git a/vault-validation/pom.xml b/vault-validation/pom.xml
index 34174eb..cf50434 100644
--- a/vault-validation/pom.xml
+++ b/vault-validation/pom.xml
@@ -140,13 +140,14 @@
             <groupId>org.apache.jackrabbit</groupId>
             <artifactId>jackrabbit-jcr2spi</artifactId>
             <scope>provided</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>commons-io</groupId>
+                    <artifactId>commons-io</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
-        <dependency>
-            <groupId>org.apache.commons</groupId>
-            <artifactId>commons-lang3</artifactId>
-            <scope>provided</scope>
-        </dependency>
 
         <dependency>
             <!-- see JCRVLT-680 -->
@@ -161,6 +162,12 @@
             <artifactId>maven-artifact</artifactId>
             <version>3.8.4</version>
             <scope>provided</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.commons</groupId>
+                    <artifactId>commons-lang3</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
diff --git a/vault-validation/src/main/java/org/apache/jackrabbit/vault/validation/impl/util/ResettableInputStream.java b/vault-validation/src/main/java/org/apache/jackrabbit/vault/validation/impl/util/ResettableInputStream.java
index a592fe5..167f7f9 100644
--- a/vault-validation/src/main/java/org/apache/jackrabbit/vault/validation/impl/util/ResettableInputStream.java
+++ b/vault-validation/src/main/java/org/apache/jackrabbit/vault/validation/impl/util/ResettableInputStream.java
@@ -34,6 +34,7 @@
  * It uses a temporary file for buffering the given input stream, except for the case where it is already a {@link FileInputStream}
  * in which case it uses the seeking methods of that.
  */
+// TODO: Replace by pushback inputstream?
 public class ResettableInputStream extends InputStream {
 
     private final Path tmpFile;