You can have both Lang2 and Lang3 in your classpath. Due to incompatibility of Lang2 and Lang3, the package is intentionally changed from org.apache.commons.lang to org.apache.commons.lang3 so that you can have both version in classpath without conflict
The base package of Apache Commons Lang 3 is not org.apache.commons.lang anymore.
Provided that the error occurs in your own code, you have to replace it with the org.apache.commons.lang3 package .
If it occurs in external libraries, either upgrade them to a version that uses Lang 3 (if it is possible), or you may have to also keep your older commons lang among the dependencies (as explained in the answer by Karol, the distinct packages will prevent possible conflicts anyway).
e.g :
org.apache.commons.lang.StringUtils in Lang 2.6
vs
org.apache.commons.lang3.StringUtils in Lang 3
commons-lang3 is using org.apache.commons.lang3 base package to avoid conflicts with previous versions of commons-lang. This allows both 2.X and 3.X to be used at the same time.
To update to 3.X uou have to change the import in your code e.g. use
import org.apache.commons.lang3.StringUtils;
Commons lang 2 has CVEs so we want off of it in my company. The problem is our product is old and bloated and we have both direct and transitive dependencies on commons lang 2. The direct ones were fairly easy to solve, I think anyone familiar with commons lang would agree the upgrade really isn't that painful. But to fix the transitive dependencies, we would have to upgrade a bunch of other more painful stuff.
Hence the question: is there any kind of shim library already out there that basically provides commons lang 2 APIs but uses commons lang 3 as the impl? That would give us a way to completely remove commons lang 2 without the other painful upgrades.
PS. Yes I know anything that uses commons lang 2 we should probably get off of, however we need to balance "what we should do" with the time constraints and demands on our team.