Looks like we were having those by transitive dependencies.
diff --git a/pom.xml b/pom.xml
index 46121e6..079d40f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -209,6 +209,16 @@
       <artifactId>backport-util-concurrent</artifactId>
       <version>3.1</version>
     </dependency>
+    <dependency>
+      <groupId>commons-lang</groupId>
+      <artifactId>commons-lang</artifactId>
+      <version>2.6</version>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-collections4</artifactId>
+      <version>4.4</version>
+    </dependency>
 
     <dependency>
       <groupId>${openejb.groupId}</groupId>