Looks like we were having those by transitive dependencies.
diff --git a/pom.xml b/pom.xml
index 46121e6..079d40f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -209,6 +209,16 @@
<artifactId>backport-util-concurrent</artifactId>
<version>3.1</version>
</dependency>
+ <dependency>
+ <groupId>commons-lang</groupId>
+ <artifactId>commons-lang</artifactId>
+ <version>2.6</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-collections4</artifactId>
+ <version>4.4</version>
+ </dependency>
<dependency>
<groupId>${openejb.groupId}</groupId>