Question on breaking change or incompatibility between version 1.2 and 1.5.4

[pcouas]

Hi,

We need to upgrade from 1.2 to 1.5.4 to resolve CVE
Which incompatibility or breaking change exist ?

Regards

[pcouas]

There is an incompatibility between version 1.5.4 and xtream 1.4.20, the latter also fixes CVEs

com.thoughtworks.xstream.converters.collections.MapConverter
version : 1.4.20

Caused by: java.lang.InstantiationException: java.util.Map$Entry
at sun.misc.Unsafe.allocateInstance(Native Method)
at com.thoughtworks.xstream.converters.reflection.SunLimitedUnsafeReflectionProvider.newInstance(SunLimitedUnsafeReflectionProvider.java:85)

[kpentaris]

There are more incompatibilities. This is unfortunate since it's a minor version upgrade which should not break compatibility.
Unfortunately this software is mostly abandoned so there's no potential fixes incoming any time soon.