great answers above, but if you are upgrading to tomcat10 which naming change from javax to jakarta, commons-fileupload as of version 1.4 has not change the naming yet, but you can change to the custom class in tomcat10 instead! (LUCKY ME)
org.apache.commons.fileupload.ProgressListener to org.apache.tomcat.util.http.fileupload.ProgressListener
org.apache.commons.fileupload.servlet.ServletFileUpload to org.apache.tomcat.util.http.fileupload.servlet.ServletFileUpload
org.apache.commons.fileupload.disk.DiskFileItemFactory to org.apache.tomcat.util.http.fileupload.disk.DiskFileItemFactory
org.apache.commons.fileupload.FileItem to org.apache.tomcat.util.http.fileupload.FileItem