Remove the org.apache.commons:commons-lang3 exclusion from elytron-tool ----------------------------------------------------------------------- Key: WFCORE-4368 URL: https://issues.jboss.org/browse/WFCORE-4368 Project: WildFly Core Issue Type: Task Components: Security Reporter: Kabir Khan Priority: Major See https://issues.jboss.org/browse/WFCORE-4366 for details of why it is needed. Since the Elytron tool shades all its dependencies, can they have a scope which does not get exported again? Perhaps provided, although I don't know if those work with the shade plugin.