review of a dependency patch

[Steve Loughran]

Can I get a review of https://issues.apache.org/jira/browse/HADOOP-13994 ; it's 
explicitly declaring the version of commons-lang3, rather than picking it up 
from downstream versions of things.

thanks