diff --git a/0002-Commons-configuration2.patch b/0002-Commons-configuration2.patch
new file mode 100644
index 0000000..630b365
--- /dev/null
+++ b/0002-Commons-configuration2.patch
@@ -0,0 +1,72 @@
+--- doxia-1.12.0/doxia-modules/doxia-module-fo/pom.xml.orig	2023-01-09 21:09:18.000000000 -0700
++++ doxia-1.12.0/doxia-modules/doxia-module-fo/pom.xml	2023-06-12 15:58:35.171254714 -0600
+@@ -71,9 +71,9 @@ under the License.
+ 
+     <!-- misc -->
+     <dependency>
+-      <groupId>commons-configuration</groupId>
+-      <artifactId>commons-configuration</artifactId>
+-      <version>1.10</version>
++      <groupId>org.apache.commons</groupId>
++      <artifactId>commons-configuration2</artifactId>
++      <version>2.9.0</version>
+     </dependency>
+     <dependency>
+       <groupId>commons-collections</groupId>
+--- doxia-1.12.0/doxia-modules/doxia-module-fo/src/main/java/org/apache/maven/doxia/module/fo/FoConfiguration.java.orig	2023-01-09 21:09:18.000000000 -0700
++++ doxia-1.12.0/doxia-modules/doxia-module-fo/src/main/java/org/apache/maven/doxia/module/fo/FoConfiguration.java	2023-06-12 17:00:19.630450286 -0600
+@@ -20,14 +20,16 @@ package org.apache.maven.doxia.module.fo
+  */
+ 
+ import java.io.File;
++import java.io.FileReader;
+ import java.io.IOException;
+ import java.util.List;
+ 
+ import javax.swing.text.MutableAttributeSet;
+ import javax.swing.text.SimpleAttributeSet;
+ 
+-import org.apache.commons.configuration.ConfigurationException;
+-import org.apache.commons.configuration.XMLConfiguration;
++import org.apache.commons.configuration2.XMLConfiguration;
++import org.apache.commons.configuration2.ex.ConfigurationException;
++import org.apache.commons.configuration2.io.FileLocatorUtils;
+ import org.apache.maven.doxia.sink.impl.SinkUtils;
+ import org.codehaus.plexus.util.ReaderFactory;
+ 
+@@ -55,9 +57,6 @@ public class FoConfiguration
+     {
+         this.config = new XMLConfiguration();
+ 
+-        // necessary because some attributes contain commas:
+-        config.setDelimiterParsingDisabled( true );
+-
+         loadDefaultConfig();
+     }
+ 
+@@ -75,10 +74,11 @@ public class FoConfiguration
+             throws IOException
+     {
+         config.clear();
++        config.initFileLocator( FileLocatorUtils.fileLocator().basePath( configFile.getParent() ).fileName( configFile.getName() ).create() );
+ 
+         try
+         {
+-            config.load( configFile );
++            config.read( new FileReader(configFile) );
+         }
+         catch ( ConfigurationException cex )
+         {
+@@ -182,9 +182,11 @@ public class FoConfiguration
+     /** Load the default fo configuration file. */
+     private void loadDefaultConfig()
+     {
++        config.initFileLocator( FileLocatorUtils.fileLocator().sourceURL( getClass().getResource( "/fo-styles.xslt" ) ).create() );
++
+         try
+         {
+-            config.load( ReaderFactory.newXmlReader( getClass().getResourceAsStream( "/fo-styles.xslt" ) ) );
++            config.read( ReaderFactory.newXmlReader( getClass().getResourceAsStream( "/fo-styles.xslt" ) ) );
+         }
+         catch ( ConfigurationException | IOException cex )
+         {
diff --git a/maven-doxia.changes b/maven-doxia.changes
index 5f25c17..98d4745 100644
--- a/maven-doxia.changes
+++ b/maven-doxia.changes
@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Tue Sep 26 21:09:43 UTC 2023 - Fridrich Strba <fstrba@suse.com>
+
+- Added patch:
+  * 0002-Commons-configuration2.patch
+    + port to commons-configuration2 in order to remove dependency
+      on old commons-lang
+
 -------------------------------------------------------------------
 Sat Sep 23 17:46:16 UTC 2023 - Fridrich Strba <fstrba@suse.com>
 
diff --git a/maven-doxia.spec b/maven-doxia.spec
index 9008a8f..6c8b01a 100644
--- a/maven-doxia.spec
+++ b/maven-doxia.spec
@@ -25,11 +25,11 @@ Group:          Development/Libraries/Java
 URL:            https://maven.apache.org/doxia/
 Source0:        https://repo1.maven.org/maven2/org/apache/maven/doxia/doxia/%{version}/doxia-%{version}-source-release.zip
 Source1:        %{name}-build.tar.xz
+Patch0:         0002-Commons-configuration2.patch
 BuildRequires:  ant
 BuildRequires:  apache-commons-cli
 BuildRequires:  apache-commons-collections
-BuildRequires:  apache-commons-configuration
-BuildRequires:  apache-commons-lang
+BuildRequires:  apache-commons-configuration2
 BuildRequires:  apache-commons-lang3
 BuildRequires:  apache-commons-text
 BuildRequires:  atinject
@@ -185,6 +185,7 @@ API documentation for %{name}.
 
 %prep
 %setup -q -n doxia-%{version} -a1
+%patch0 -p1
 
 # we don't have clirr-maven-plugin
 %pom_remove_plugin org.codehaus.mojo:clirr-maven-plugin pom.xml
@@ -206,11 +207,10 @@ rm doxia-core/src/test/java/org/apache/maven/doxia/util/XmlValidatorTest.java
 mkdir -p lib
 build-jar-repository -s lib \
     atinject \
-    apache-commons-lang3 \
     apache-commons-text \
     commons-cli \
-    commons-configuration \
-    commons-lang \
+    commons-configuration2 \
+    commons-lang3 \
     guava/guava \
     guice/google-guice \
     httpcomponents/httpclient \