Ignore tests that set a SecurityManager on Java 21 and up:

Java 21 and up:
java.lang.UnsupportedOperationException: The Security Manager is
deprecated and will be removed in a future release

pom.xml

@@ -289,6 +289,7 @@ under the License.
                 <commons-logging-api>target/${project.build.finalName}-api.jar</commons-logging-api>
                 <commons-logging-adapters>target/${project.build.finalName}-adapters.jar</commons-logging-adapters>
                 <testclasses>target/${project.build.finalName}-tests.jar</testclasses>
+                <commons-lang3>${org.apache.commons:commons-lang3:jar}</commons-lang3>
               </systemPropertyVariables>
             </configuration>
           </execution>
@@ -597,6 +598,12 @@ under the License.
       <scope>provided</scope>
       <optional>true</optional>
     </dependency>
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-lang3</artifactId>
+      <version>3.16.0</version>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>org.apache.logging.log4j</groupId>
       <artifactId>log4j-core</artifactId>

src/test/java/org/apache/commons/logging/security/SecurityAllowedTestCase.java

@@ -27,6 +27,8 @@ import java.util.Hashtable;
 import junit.framework.Test;
 import junit.framework.TestCase;
 
+import org.apache.commons.lang3.JavaVersion;
+import org.apache.commons.lang3.SystemUtils;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.apache.commons.logging.PathableClassLoader;
@@ -35,11 +37,12 @@ import org.apache.commons.logging.PathableTestSuite;
 /**
  * Tests for logging with a security policy that allows JCL access to everything.
  * <p>
- * This class has only one unit test, as we are (in part) checking behavior in
+ * This test cannot run on Java 21 and up: {@code java.lang.UnsupportedOperationException: The Security Manager is deprecated and will be removed in a future release}.
- * the static block of the LogFactory class. As that class cannot be unloaded after
+ * </p>
- * being loaded into a class loader, the only workaround is to use the
+ * This class has only one unit test, as we are (in part) checking behavior in the static block of the LogFactory class. As that class cannot be unloaded after
- * PathableClassLoader approach to ensure each test is run in its own
+ * being loaded into a class loader, the only workaround is to use the PathableClassLoader approach to ensure each test is run in its own class loader, and use
- * class loader, and use a separate test class for each test.
+ * a separate test class for each test.
+ * </p>
  */
 public class SecurityAllowedTestCase extends TestCase {
 
@@ -62,9 +65,9 @@ public class SecurityAllowedTestCase extends TestCase {
         parent.useExplicitLoader("junit.", Test.class.getClassLoader());
         parent.addLogicalLib("commons-logging");
         parent.addLogicalLib("testclasses");
+        parent.addLogicalLib("commons-lang3");
 
-        final Class<?> testClass = parent.loadClass(
+        final Class<?> testClass = parent.loadClass("org.apache.commons.logging.security.SecurityAllowedTestCase");
-            "org.apache.commons.logging.security.SecurityAllowedTestCase");
         return new PathableTestSuite(testClass, parent);
     }
 
@@ -72,30 +75,38 @@ public class SecurityAllowedTestCase extends TestCase {
 
     @Override
     public void setUp() {
+        // Ignore on Java 21 and up
+        // TODO Port tests to JUnit 5
+        if (SystemUtils.isJavaVersionAtLeast(JavaVersion.JAVA_21)) {
+            return;
+        }
         // save security manager so it can be restored in tearDown
         oldSecMgr = System.getSecurityManager();
     }
 
     @Override
     public void tearDown() {
+        // Ignore on Java 21 and up
+        // TODO Port tests to JUnit 5
+        if (SystemUtils.isJavaVersionAtLeast(JavaVersion.JAVA_21)) {
+            return;
+        }
         // Restore, so other tests don't get stuffed up if a test
         // sets a custom security manager.
-        // Java 22: java.lang.UnsupportedOperationException: The Security Manager is deprecated and will be removed in a future release
+        // Java 21 and up: java.lang.UnsupportedOperationException: The Security Manager is deprecated and will be removed in a future release
         System.setSecurityManager(oldSecMgr);
     }
 
     /**
-     * Test what happens when JCL is run with all permissions enabled. Custom
+     * Test what happens when JCL is run with all permissions enabled. Custom overrides should take effect.
-     * overrides should take effect.
      */
     public void testAllAllowed() {
-        // Ignore on Java 21
+        // Ignore on Java 21 and up
-        if (System.getProperty("java.version").startsWith("21.")) {
+        // TODO Port tests to JUnit 5
+        if (SystemUtils.isJavaVersionAtLeast(JavaVersion.JAVA_21)) {
             return;
         }
-        System.setProperty(
+        System.setProperty(LogFactory.HASHTABLE_IMPLEMENTATION_PROPERTY, CustomHashtable.class.getName());
-                LogFactory.HASHTABLE_IMPLEMENTATION_PROPERTY,
-                CustomHashtable.class.getName());
         final MockSecurityManager mySecurityManager = new MockSecurityManager();
         mySecurityManager.addPermission(new AllPermission());
         // Java 22: java.lang.UnsupportedOperationException: The Security Manager is deprecated and will be removed in a future release
@@ -104,8 +115,7 @@ public class SecurityAllowedTestCase extends TestCase {
         try {
             // Use reflection so that we can control exactly when the static
             // initializer for the LogFactory class is executed.
-            final Class<?> c = this.getClass().getClassLoader().loadClass(
+            final Class<?> c = this.getClass().getClassLoader().loadClass("org.apache.commons.logging.LogFactory");
-                    "org.apache.commons.logging.LogFactory");
             final Method m = c.getMethod("getLog", Class.class);
             final Log log = (Log) m.invoke(null, this.getClass());
 

src/test/java/org/apache/commons/logging/security/SecurityForbiddenTestCase.java

@@ -28,6 +28,8 @@ import java.util.Hashtable;
 import junit.framework.Test;
 import junit.framework.TestCase;
 
+import org.apache.commons.lang3.JavaVersion;
+import org.apache.commons.lang3.SystemUtils;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.apache.commons.logging.PathableClassLoader;
@@ -36,6 +38,9 @@ import org.apache.commons.logging.PathableTestSuite;
 /**
  * Tests for logging with a security policy that forbids JCL access to anything.
  * <p>
+ * This test cannot run on Java 22: {@code java.lang.UnsupportedOperationException: The Security Manager is deprecated and will be removed in a future release}.
+ * </p>
+ * <p>
  * Performing tests with security permissions disabled is tricky, as building error
  * messages on failure requires certain security permissions. If the security manager
  * blocks these, then the test can fail without the error messages being output.
@@ -70,9 +75,9 @@ public class SecurityForbiddenTestCase extends TestCase {
         parent.useExplicitLoader("org.junit.", Test.class.getClassLoader());
         parent.addLogicalLib("commons-logging");
         parent.addLogicalLib("testclasses");
+        parent.addLogicalLib("commons-lang3");
 
-        final Class<?> testClass = parent.loadClass(
+        final Class<?> testClass = parent.loadClass("org.apache.commons.logging.security.SecurityForbiddenTestCase");
-            "org.apache.commons.logging.security.SecurityForbiddenTestCase");
         return new PathableTestSuite(testClass, parent);
     }
 
@@ -110,6 +115,11 @@ public class SecurityForbiddenTestCase extends TestCase {
 
     @Override
     public void tearDown() {
+        // Ignore on Java 21 and up
+        // TODO Port tests to JUnit 5
+        if (SystemUtils.isJavaVersionAtLeast(JavaVersion.JAVA_21)) {
+            return;
+        }
         // Restore, so other tests don't get stuffed up if a test
         // sets a custom security manager.
         // Java 22: java.lang.UnsupportedOperationException: The Security Manager is deprecated and will be removed in a future release
@@ -122,8 +132,9 @@ public class SecurityForbiddenTestCase extends TestCase {
      * should fall back to the built-in defaults.
      */
     public void testAllForbidden() {
-        // Ignore on Java 21
+        // Ignore on Java 21 and up
-        if (System.getProperty("java.version").startsWith("21.")) {
+        // TODO Port tests to JUnit 5
+        if (SystemUtils.isJavaVersionAtLeast(JavaVersion.JAVA_21)) {
             return;
         }
         System.setProperty(
@@ -177,8 +188,9 @@ public class SecurityForbiddenTestCase extends TestCase {
      * than the context class loader of the current thread tries to log something.
      */
     public void testContextClassLoader() {
-        // Ignore on Java 21
+        // Ignore on Java 21 and up
-        if (System.getProperty("java.version").startsWith("21.")) {
+        // TODO Port tests to JUnit 5
+        if (SystemUtils.isJavaVersionAtLeast(JavaVersion.JAVA_21)) {
             return;
         }
         System.setProperty(