There is no hard dependency, you can just bundle jboss-commons.jar in your package.
We might change this, btw. But we've seen a lot of people having trouble with commons-logging in the past.