-
Notifications
You must be signed in to change notification settings - Fork 9
/
changes.html
2009 lines (1666 loc) · 114 KB
/
changes.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<!--
Copyright (C) 2005, 2006 Joe Walnes.
Copyright (C) 2006, 2007, 2008, 2021 XStream committers.
All rights reserved.
The software in this package is published under the terms of the BSD
style license a copy of which has been included with this distribution in
the LICENSE.txt file.
Created on 29. January 2005 by Joe Walnes
-->
<head>
<title>XStream - Change History</title>
<link rel="stylesheet" type="text/css" href="style.css"/>
<!-- Google analytics -->
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
<script type="text/javascript">
_uacct = "UA-110973-2";
urchinTracker();
</script>
</head>
<body>
<div id="banner">
<a href="index.html"><img id="logo" src="logo.gif" alt="XStream"/></a>
</div>
<div id="center" class="Content2Column"> <!-- Content3Column for index -->
<div id="content">
<h1 class="FirstChild">Change History</h1>
<p>Changes are split into following categories:</p>
<ul>
<li><b>Major changes</b>: The major new features that all users should know about.</li>
<li><b>Minor changes</b>: Any smaller changes, including bugfixes.</li>
<li><b>Stream Compatibility</b>: Changes affecting the persisted data.</li>
<li><b>API changes</b>: Any changes to the API that could impact existing users.</li>
</ul>
<p>
Full details can be found in GitHub's <a href="https://github.com/x-stream/xstream/issues?q=is%3Aissue+is%3Aclosed">Issues</a>,
filter for the appropriate milestone.
</p>
<!--
<h1 id="upcoming-1.4.x">Upcoming 1.4.x maintenance release</h1>
<p>Not yet released.</p>
-->
<h1 id="1.4.20">1.4.20</h1>
<p>Released December 24, 2022.</p>
<p class="highlight">This maintenance release addresses the security vulnerabilities
<a href="CVE-2022-40151.html">CVE-2022-40151</a> and <a href="CVE-2022-41966.html">CVE-2022-41966</a>, causing a
Denial of Service by raising a stack overflow. It also provides new converters for Optional and Atomic types.</p>
<h2>Major changes</h2>
<ul>
<li><a href="https://github.com/x-stream/xstream/issues/308">#308</a>: Add converter for AtomicBoolean, AtomicInteger, AtomicLong, and AtomicReference of
package java.util.concurrent.atomic.</li>
<li><a href="https://github.com/x-stream/xstream/issues/293">#293</a>: Add converter for Optional, OptionalDouble, OptionalInt, and OptionalLong of package
java.util.</li>
</ul>
<h2>Minor changes</h2>
<ul>
<li><a href="https://github.com/x-stream/xstream/pull/287">#287</a>: Close stream opened from provided URL.</li>
<li><a href="https://github.com/x-stream/xstream/issues/284">#284</a>: Fix disabling check against hash code attack with XStream.setCollectionUpdateLimit(0).</li>
</ul>
<h2>Stream compatibility</h2>
<ul>
<li>The atomic types with new converters of package java.util.concurrent.atomic, that have been written with
previous versions of XStream, can still be deserialized.</li>
<li>The Optional types with new converters of package java.util, that have been written with previous versions
of XStream, can still be deserialized.</li>
<li>The WildcardTypePermission allows by default no longer anonymous class types.</li>
</ul>
<h2>API changes</h2>
<ul>
<li>Added c.t.x.converters.extended.AtomicBooleanConverter.</li>
<li>Added c.t.x.converters.extended.AtomicIntegerConverter.</li>
<li>Added c.t.x.converters.extended.AtomicLongConverter.</li>
<li>Added c.t.x.converters.extended.AtomicReferenceConverter.</li>
<li>Added c.t.x.converters.extended.OptionalConverter.</li>
<li>Added c.t.x.converters.extended.OptionalDoubleConverter.</li>
<li>Added c.t.x.converters.extended.OptionalIntConverter.</li>
<li>Added c.t.x.converters.extended.OptionalLongConverter.</li>
<li>Added c.t.x.security.WildcardTypePermission.WildcardTypePermission(boolean,String[]).</li>
</ul>
<h1 id="1.4.19">1.4.19</h1>
<p>Released January 29, 2022.</p>
<p class="highlight">This maintenance release addresses the security vulnerability
<a href="CVE-2021-43859.html">CVE-2021-43859</a>, when unmarshalling highly recursive collections or maps causing a
Denial of Service.</p>
<h2>API changes</h2>
<ul>
<li>Added c.t.x.XStream.COLLECTION_UPDATE_LIMIT and c.t.x.XStream.COLLECTION_UPDATE_SECONDS.</li>
<li>Added c.t.x.XStream.setCollectionUpdateLimit(int).</li>
<li>Added c.t.x.core.SecurityUtils.</li>
<li>Added c.t.x.security.AbstractSecurityException and c.t.x.security.InputManipulationException.</li>
<li>c.t.x.security.InputManipulationException derives now from c.t.x.security.AbstractSecurityException.</li>
</ul>
<h1 id="1.4.18">1.4.18</h1>
<p>Released August 22, 2021.</p>
<p class="highlight">This maintenance release addresses following security vulnerabilities, when unmarshalling with
an XStream instance using the default blacklist of an uninitialized security framework. XStream is therefore now
using a whitelist by default.</p>
<ul>
<li><a href="CVE-2021-39139.html">CVE-2021-39139</a></li>
<li><a href="CVE-2021-39140.html">CVE-2021-39140</a></li>
<li><a href="CVE-2021-39141.html">CVE-2021-39141</a></li>
<li><a href="CVE-2021-39144.html">CVE-2021-39144</a></li>
<li><a href="CVE-2021-39145.html">CVE-2021-39145</a></li>
<li><a href="CVE-2021-39146.html">CVE-2021-39146</a></li>
<li><a href="CVE-2021-39147.html">CVE-2021-39147</a></li>
<li><a href="CVE-2021-39148.html">CVE-2021-39148</a></li>
<li><a href="CVE-2021-39149.html">CVE-2021-39149</a></li>
<li><a href="CVE-2021-39150.html">CVE-2021-39150</a></li>
<li><a href="CVE-2021-39151.html">CVE-2021-39151</a></li>
<li><a href="CVE-2021-39152.html">CVE-2021-39152</a></li>
<li><a href="CVE-2021-39153.html">CVE-2021-39153</a></li>
<li><a href="CVE-2021-39154.html">CVE-2021-39154</a></li>
</ul>
<h2>Minor changes</h2>
<ul>
<li><a href="https://github.com/x-stream/xstream/issues/233">#233</a>: Support serializable types with non-serializable parent with PureJavaReflectionConverter.</li>
</ul>
<h2>Stream compatibility</h2>
<p class="highlight">Starting with version 1.14.12 nine years ago, XStream contains a
<a href="security.html#framework">Security Framework</a> to implement a black- or whitelist for the allowed types
at deserialization time. Until version 1.4.17, XStream kept a default blacklist in order to deny all types of the
Java runtime, which are used for all kinds of <a href="security.html#CVEs">security attacks</a>, in order to
guarantee optimal runtime compatibility for existing users. However, this approach has failed. The last months
have shown, that the Java runtime alone contains dozens of types that can be used for an attack, not even looking
at the 3rd party libraries on a classpath. The new version of XStream uses therefore now by default a whitelist,
which is recommended since nine years. It also has been complaining on the console for a long time about an
uninitialized security framework the first time it was run. Anyone who has followed the advice and initialized the
security framework for their own scenario can easily update to the new version without any problem. Everyone else
will have to do a proper initialization now, otherwise the new version will fail with certainty at deserialization
time.</p>
<h1 id="1.4.17">1.4.17</h1>
<p>Released May 13, 2021.</p>
<p class="highlight">This maintenance release addresses the security vulnerability
<a href="CVE-2021-29505.html">CVE-2021-29505</a>, when unmarshalling with XStream instance using an uninitialized
security framework.</p>
<h2>Stream compatibility</h2>
<ul>
<li>The following types are now blacklisted by default and the deserialization
of XML containing one of the two types will fail. You will have to enable these types by explicit
configuration, if you need them:<br>
<ul>
<li>any type in the java.rmi.* and sun.rmi.* package hierarchies</li>
<li>the individual type com.sun.jndi.toolkit.dir.LazySearchEnumerationImpl</li>
</ul>
</li>
</ul>
<h1 id="1.4.16">1.4.16</h1>
<p>Released March 13, 2021.</p>
<p class="highlight">This maintenance release switches XStream's default parser and addresses following security
vulnerabilities, when unmarshalling with an XStream instance using an uninitialized security framework.</p>
<ul>
<li><a href="CVE-2021-21341.html">CVE-2021-21341</a></li>
<li><a href="CVE-2021-21342.html">CVE-2021-21342</a></li>
<li><a href="CVE-2021-21343.html">CVE-2021-21343</a></li>
<li><a href="CVE-2021-21344.html">CVE-2021-21344</a></li>
<li><a href="CVE-2021-21345.html">CVE-2021-21345</a></li>
<li><a href="CVE-2021-21346.html">CVE-2021-21346</a></li>
<li><a href="CVE-2021-21347.html">CVE-2021-21347</a></li>
<li><a href="CVE-2021-21348.html">CVE-2021-21348</a></li>
<li><a href="CVE-2021-21349.html">CVE-2021-21349</a></li>
<li><a href="CVE-2021-21350.html">CVE-2021-21350</a></li>
<li><a href="CVE-2021-21351.html">CVE-2021-21351</a></li>
</ul>
<h2>Major changes</h2>
<ul>
<li>Switch from Xpp3 as default parser to MXParser, a fork of Xpp3.</li>
</ul>
<h2>Minor changes</h2>
<ul>
<li><a href="https://github.com/x-stream/xstream/issues/238">#238</a>: Fix possibility to process references on enum types at deserialization.</li>
<li><a href="https://github.com/x-stream/xstream/issues/237">#237</a>: Fix optimization in XmlFriendlyNameCoder.</li>
</ul>
<h2>Stream compatibility</h2>
<ul>
<li>The following types are now blacklisted by default and the deserialization
of XML containing one of the two types will fail. You will have to enable these types by explicit
configuration, if you need them:<br>
<ul>
<li>the type hierarchies for java.io.InputStream, java.nio.channels.Channel,
javax.activation.DataSource and javax.sql.rowsel.BaseRowSet</li>
<li>the individual types com.sun.corba.se.impl.activation.ServerTableEntry,
com.sun.tools.javac.processing.JavacProcessingEnvironment$NameProcessIterator,
sun.awt.datatransfer.DataTransferer$IndexOrderComparator, and sun.swing.SwingLazyValue</li>
<li>the individual types com.sun.corba.se.impl.activation.ServerTableEntry,
com.sun.tools.javac.processing.JavacProcessingEnvironment$NameProcessIterator,
sun.awt.datatransfer.DataTransferer$IndexOrderComparator, and sun.swing.SwingLazyValue</li>
<li>the internal type Accessor$GetterSetterReflection of JAXB, the internal types
MethodGetter$PrivilegedGetter and ServiceFinder$ServiceNameIterator of JAX-WS</li>
<li>all inner classes of javafx.collections.ObservableList</li>
<li>an internal ClassLoader used in a private copy of BCEL within the Java runtime</li>
</ul>
</li>
</ul>
<h2>Dependencies</h2>
<p>The default parser of XStream has changed from the Xpp3Parser in artifact xpp3:xpp3_min to MXParser, a fork of
Xpp3 in the artifact io.github.x-stream:mxparser. The Xpp3 is unmaintained for a long time, bugs have been fixed
reported more than a decade ago, improvements by other forks have been incorporated and some endless loops have
been fixed, that could have been utilized as DoS attack.</p>
<p>XStream has therefore new default dependencies. If you have used XStream with the default driver (i.e. Xpp3),
you can still exchange the XStream library for a drop-in replacement, but you will also have to remove the Xpp3 and
add the MXParser library instead.</p>
<p>For build time you will have to add the Xpp3 library to your dependencies, if you made explicitly use of the
Xpp3 driver. If you did explicitly use a different driver than Xpp3 and had therefore excluded the Xpp3
dependency, you might have to exclude now the new MXParser dependency instead to minimize your dependency list.</p>
<h1 id="1.4.15">1.4.15</h1>
<p>Released December 13, 2020.</p>
<p class="highlight">This maintenance release addresses the security vulnerabilities
<a href="CVE-2020-26258.html">CVE-2020-26258</a> and <a href="CVE-2020-26259.html">CVE-2020-26259</a>, when
unmarshalling with XStream instance using an uninitialized security framework.</p>
<h2>Minor changes</h2>
<ul>
<li><a href="https://github.com/x-stream/xstream/issues/226">#226</a>: XmlFriendlyNameCoder does not accept '9' as valid character in an XML name.</li>
<li><a href="https://github.com/x-stream/xstream/pull/228">#228</a>: DefaultMapper should handle IllegalArgumentException thrown by Class.forName().</li>
</ul>
<h2>Stream compatibility</h2>
<ul>
<li>The type jdk.nashorn.internal.objects.NativeString and the internal JAX-WS type ReadAllStream.FileStream
are now part of the default blacklist and the deserialization of XML containing one of the two types will fail.
You will have to enable these types by explicit configuration, if you need them.</li>
</ul>
<h2>Delivery</h2>
<p>Any XStream release can run with a minimal Java runtime environment of Java 1.4 as long as this environment will
process only requested classes of the jar file. Until version 1.4.14 XStream was delivered also as special Java 7
version for Android, because Dalvik scans all classes and fails at classes requiring a higher runtime version. However, this
special version will not work in a normal Java 8 environment or higher and was never meant do so.</p>
<p>Unfortunately, this version has to be build always after the standard version due to the build sequence. The
latest version in Maven Central however is always the one that has been deployed last independently from the time
of publishing. This creates an annoyance now in GitHub for any project using the Dependabot service which creates
automated pull requests with updates to the latest XStream version, because it injects now the special Java 7
version that probably breaks these projects.</p>
<p>Users who still require a special version for Java 7 will have to build this artifact now on their own. Users
for even older Java environments had always to do so anyway.</p>
<h1 id="1.4.14">1.4.14</h1>
<p>Released November 16, 2020.</p>
<p class="highlight">This maintenance release addresses the security vulnerability
<a href="CVE-2020-26217.html">CVE-2020-26217</a>, reported originally as CVE-2017-9805 for Struts' XStream Plugin,
an arbitrary execution of commands when unmarshalling with XStream instances using an uninitialized security
framework.</p>
<h2>Stream compatibility</h2>
<ul>
<li>The types java.lang.ProcessBuilder and javax.imageio.ImageIO$ContainsFilter are now part of the default
blacklist and the deserialization of XML containing one of the two types will fail. You will have to enable
these types by explicit configuration, if you need them.</li>
</ul>
<h1 id="1.4.13">1.4.13</h1>
<p>Released September 6, 2020.</p>
<h2>Major changes</h2>
<ul>
<li><a href="https://github.com/x-stream/xstream/pull/218">#218</a>: Defer reflective access to Java core modules.</li>
<li><a href="https://github.com/x-stream/xstream/issues/207">#207</a>: New predefined blacklist avoids vulnerability due to improper setup of the security framework.</li>
</ul>
<h1 id="1.4.12">1.4.12</h1>
<p>Released April 12, 2020.</p>
<h2>Minor changes</h2>
<ul>
<li>XmlFriendlyNameCoder supports now XML parsers implementing only 4th edition of XML 1.0 specification.</li>
<li>Fix support of CDATA events in StAX.</li>
<li><a href="https://github.com/x-stream/xstream/issues/171">#171</a>: XStream.createObjectInputStream does not pass the DataHolder.</li>
<li><a href="https://github.com/x-stream/xstream/issues/151">#151</a>: Use of SPDX license identifier in POM and Manifest.</li>
<li><a href="https://github.com/x-stream/xstream/issues/152">#152</a>: Declare OSGi import of internal runtime packages as optional.</li>
<li>Drop Require-Capability entry in manifest.</li>
</ul>
<h1 id="1.4.11.1">1.4.11.1</h1>
<p>Released October 27, 2018.</p>
<h2>Hot fix</h2>
<ul>
<li><a href="https://github.com/x-stream/xstream/issues/133">#133</a>: XStream 1.4.11 fails to run on a Java Runtime < 8.</li>
</ul>
<h1 id="1.4.11">1.4.11</h1>
<p>Released October 23, 2018.</p>
<p class="highlight">This maintenance release addresses again the security vulnerability <a href="CVE-2013-7285.html">
CVE-2013-7285</a>, an arbitrary execution of commands when unmarshalling with XStream instances using an
uninitialized security framework. Only 1.4.10 uninitialized security framework was affected.</p>
<h2>Minor changes</h2>
<ul>
<li><a href="https://github.com/x-stream/xstream/pull/91">#91</a>, <a href="https://github.com/x-stream/xstream/pull/106">#106</a>: Clean-up data stacks in UnmarshallingContext implementations in case of exception (by
Märt Bakhoff).</li>
<li><a href="https://github.com/x-stream/xstream/issues/2">#2</a>: Unneeded contention in DefaultConverterLookup.</li>
<li><a href="https://github.com/x-stream/xstream/issues/94">#94</a>: Fix PathConverter containing absolute Windows paths.</li>
<li><a href="https://github.com/x-stream/xstream/issues/105">#105</a>: XStream's ObjectInputStream returns wrong values for readUnsignedByte and readUnsignedShort.</li>
<li><a href="/jira/616">XSTR-616</a> and <a href="https://github.com/x-stream/xstream/pull/93">#93</a>: Introduce StringCodec interface to support arbitrary Base64 codec
implementations for EncodedByteArrayConverter. Prefer Base64 codec implementations of the Java runtime over
XStream's own one.</li>
<li><a href="https://github.com/x-stream/xstream/issues/97">#97</a>: Support to run out of the box in a Java 1.4 runtime is established again.</li>
<li>Provide methods in AbstractCollectionConverter that read and write in a balanced way from and to the
hierarchical stream.</li>
<li>New future-proof method JVM.isVersion to detect major version of Java runtime (incl. Java 10) as
replacement for individual JVM.isXY methods.</li>
<li><a href="https://github.com/x-stream/xstream/issues/115">#115</a>: Dom4JDriver ignores character set of Dom4J configuration creating a Writer.</li>
<li><a href="https://github.com/x-stream/xstream/issues/116">#116</a>: Make converters null safe.</li>
<li><a href="https://github.com/x-stream/xstream/issues/123">#123</a> and <a href="https://github.com/x-stream/xstream/pull/124">#124</a>: Declare XPP dependencies for OSGi as optional.</li>
<li>Add XppDriver.createDefaultParser for a simpler access to the default XmlPullParserFactory.</li>
<li>Old BEA reference implementation of StAX is outdated, unmaintained and has security issues, therefore
XStream's driver has been deprecated.</li>
<li>Support for JaCoCo: FieldDictionary ignores synthetic fields starting with <em>$jacoco</em> as name.</li>
<li>Add integration test for OSGi (by Wes Wannemacher).</li>
</ul>
<h2>Stream compatibility</h2>
<ul>
<li>The EncodedByteArrayConverter will now use an encoder by default that does no longer add line breaks as
normally required by the RFC 1521 after 76 characters, making it also easier to use the converter for
attributes. This will not affect XStream's Base64 decoder.</li>
</ul>
<h2>API changes</h2>
<ul>
<li>Added c.t.x.converters.collection.AbstractCollectionConverter.readBareItem(HierarchicalStreamReader, UnmarshallingContext, Object).</li>
<li>Added c.t.x.converters.collection.AbstractCollectionConverter.readCompleteItem(HierarchicalStreamReader, UnarshallingContext, Object).</li>
<li>Deprecated c.t.x.converters.collection.AbstractCollectionConverter.readItem(HierarchicalStreamReader, UnmarshallingContext, Object).</li>
<li>Added c.t.x.converters.collection.AbstractCollectionConverter.writeBareItem(Object, MarshallingContext, HierarchicalStreamWriter).</li>
<li>Added c.t.x.converters.collection.AbstractCollectionConverter.writeCompleteItem(Object, MarshallingContext, HierarchicalStreamWriter).</li>
<li>Deprecated c.t.x.converters.collection.AbstractCollectionConverter.writeItem(Object, MarshallingContext, HierarchicalStreamWriter).</li>
<li>Added c.t.x.converters.collection.AbstractCollectionConverter.writeNullItem(MarshallingContext, HierarchicalStreamWriter).</li>
<li>Added c.t.x.converters.extended.EncodedByteArrayConverter(StingCodec).</li>
<li>Added c.t.x.converters.extended.NamedCollectionConverter.readBareItem(HierarchicalStreamReader, UnmarshallingContext, Object).</li>
<li>Deprecated c.t.x.converters.extended.NamedCollectionConverter.readItem(HierarchicalStreamReader, UnmarshallingContext, Object).</li>
<li>Added c.t.x.converters.extended.NamedCollectionConverter.writeCompleteItem(Object, MarshallingContext, HierarchicalStreamWriter).</li>
<li>Deprecated c.t.x.converters.extended.NamedCollectionConverter.writeItem(Object, MarshallingContext, HierarchicalStreamWriter).</li>
<li>Added c.t.x.core.DefaultConverterLookup(Map).</li>
<li>Added c.t.x.core.util.JVM.getBase64Codec().</li>
<li>Added c.t.x.core.util.JVM.isVersion().</li>
<li>Deprecated c.t.x.core.util.JVM.is18().</li>
<li>Deprecated c.t.x.core.util.JVM.is9().</li>
<li>Deprecated c.t.x.io.ExtendedHierarchicalStreamReader.</li>
<li>Deprecated c.t.x.io.ExtendedHierarchicalStreamWriter.</li>
<li>Deprecated c.t.x.io.ExtendedHierarchicalStreamWriterHelper.</li>
<li>Deprecated c.t.x.io.xml.BEAStaxDriver.</li>
<li>Added c.t.x.io.xml.Dom4JReader.Dom4JReader(Branch).</li>
<li>Added c.t.x.io.xml.XppDriver.createDefaultParser().</li>
<li>Added c.t.x.core.util.StingCodec.</li>
</ul>
<h1 id="1.4.10">1.4.10</h1>
<p>Released May 23, 2017.</p>
<p class="highlight">This maintenance release addresses also the security vulnerability <a href="CVE-2017-7957.html">
CVE-2017-7957</a>, used for a Denial of Service attack by crashing the Java runtime.</p>
<h2>Major changes</h2>
<ul>
<li><a href="https://github.com/x-stream/xstream/issues/84">#84</a>: New XStream artifact with <em>-java7</em> appended as version suffix for a library explicitly
without the Java 8 stuff (lambda expression support, converters for java.time.* package).</li>
<li>Fix PrimitiveTypePermission to reject type <em>void</em> to prevent CVE-2017-7957 with an initialized
security framework.</li>
<li>Improve performance by minimizing call stack of mapper chain.</li>
<li><a href="https://github.com/x-stream/xstream/pull/82">#82</a>, <a href="/jira/774">XSTR-774</a>: Add converters for types of java.time, java.time.chrono, and java.time.temporal
packages (converters for LocalDate, LocalDateTime, LocalTime, OffsetDateTime, and ZonedDateTime by Matej Cimbora).</li>
<li><a href="https://github.com/x-stream/xstream/issues/29">#29</a>: JavaBeanConverter does not respect ignored unknown elements.</li>
<li>Add XStream.setupDefaultSecurity to initialize security framework with defaults of XStream 1.5.x.</li>
<li>Emit error warning if security framework has not been initialized and the XStream instance is vulnerable to
known exploits.</li>
</ul>
<h2>Stream Compatibility</h2>
<ul>
<li>The alias <em>duration</em> for type <em>javax.xml.datatype.Duration</em> has changed to <em>xml-duration</em>
due to the support of the classes in the java.time package. <em>duration</em> is now used for type <em>java.time.Duration</em>.
Simply register the alias <em>duration</em> again for type <em>javax.xml.datatype.Duration</em> if backward
compatibility is required for this type.
</li>
<li>All types of the java.time packages that have been written with previous versions of XStream can still be
deserialized.</li>
</ul>
<h2>Minor changes</h2>
<ul>
<li><a href="https://github.com/x-stream/xstream/issues/54">#54</a>: Fix BeanProvider.canInstantiate(Class), method may not throw exception.</li>
<li><a href="https://github.com/x-stream/xstream/issues/76">#76</a> and <a href="https://github.com/x-stream/xstream/pull/77">#77</a>: Missing support for cascaded writeReplace calls.</li>
<li><a href="https://github.com/x-stream/xstream/issues/61">#61</a>: Regression in 1.4.9: Performance drop in ImplicitCollectionMapper.</li>
<li><a href="https://github.com/x-stream/xstream/issues/52">#52</a>: PathConverter fails for file paths with spaces.</li>
<li>PathConverter uses always forward slashes as path separator.</li>
<li><a href="https://github.com/x-stream/xstream/issues/53">#53</a>: SqlTimestampConverter cannot parse values without fraction.</li>
<li><a href="https://github.com/x-stream/xstream/issues/45">#45</a>: Support different time zones for SqlTimestampConverter.</li>
<li><a href="https://github.com/x-stream/xstream/issues/67">#67</a> and <a href="https://github.com/x-stream/xstream/pull/68">#68</a>: Allow usage of DataHolder for createObjectInputStream and createObjectOutputStream.</li>
<li><a href="https://github.com/x-stream/xstream/issues/75">#75</a>: Use java.time.* package instead of Joda-Time.</li>
<li>Dom4JXmlWriter does not flush writer at endDocument().</li>
<li>Path is an immutable type.</li>
<li><a href="https://github.com/x-stream/xstream/pull/65">#65</a>: Protect converter lookup against runtime errors.</li>
<li>Current Java 9 implementation reports itself as version 9 now.</li>
</ul>
<h2>API changes</h2>
<ul>
<li>Added c.t.x.util.JVM.is9().</li>
<li>Added c.t.x.XStream.setupDefaultSecurity(XStream).</li>
<li>Added c.t.x.XStream.createObjectInputStream(HierarchicalStreamReader, DataHolder) and
c.t.x.XStream.createObjectOutputStream(HierarchicalStreamWriter, String, DataHolder).</li>
<li>Added c.t.x.converters.javabean.PropertyDictionary.propertyDescriptorOrNull(Class, String).</li>
<li>Added method c.t.x.mapper.Mapper.IsIgnoredElement(String)</li>
<li>Added c.t.x.mapper.ElementIgnoringMapper.</li>
<li>Deprecated method c.t.x.mapper.FieldAliasingMapper.addFieldsToIgnore(Pattern).</li>
<li>Deprecated method c.t.x.mapper.FieldAliasingMapper.omitField(Class, String).</li>
<li>Deprecated method c.t.x.core.util.JVM.is17().</li>
<li>Deprecated method c.t.x.core.util.JVM.is19().</li>
</ul>
<h1 id="1.4.9">1.4.9</h1>
<p>Released March 15, 2016.</p>
<p class="highlight">This maintenance release addresses also the security vulnerability <a href="CVE-2016-3674.html">
CVE-2016-3674</a>, known as XXE vulnerability that can be used to expose arbitrary data from the file system
when unmarshalling.</p>
<h2>Major changes</h2>
<ul>
<li><a href="https://github.com/x-stream/xstream/issues/25">#25</a>: Fix <a href="https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing">XXE
vulnerability (CVE-2016-3674)</a>: Fixed affected drivers were Dom4JDriver, DomDriver, JDomDriver, JDom2Driver,
SjsxpDriver, StandardStaxDriver and WstxDriver. Still vulnerable are BEAStaxDriver and XomDriver. Processing of
(external) entities has been disabled. See <a href="faq.html#Security_XXEVulnerability">FAQ</a> for more information.
</li>
<li>Benchmark module has been deprecated in favor of <a href="http://openjdk.java.net/projects/code-tools/jmh/">
JMH (Java Microbenchmarking Harness)</a>.
</li>
<li><a href="https://github.com/x-stream/xstream/issues/33">#33</a> and <a href="https://github.com/x-stream/xstream/pull/38">#38</a>: Add converter for java.nio.file.Path (by Aaron Jonson).</li>
</ul>
<h2>Minor changes</h2>
<ul>
<li><a href="https://github.com/x-stream/xstream/issues/35">#35</a>: AnnotationMapper dropped silently constructor arguments for converters if they were equal.</li>
<li>Fix: Possible concurrency problem with XomDriver.</li>
<li><a href="/jira/773">XSTR-773</a>, <a href="https://github.com/x-stream/xstream/pull/3">#3</a>: Minimize memory footprint by not keeping internal references to instances of
immutable types.</li>
<li>Drop automatic reference support at deserialization time for immutable types before version 1.4 (primitive
types and their boxed counterpart, java.lang.Class, java.lang.String, java.math.BigDecimal, java.math.BigInteger,
java.io.File, java.net.URL, and java.awt.font.TextAttribute).</li>
<li>Fix: Implicit collection declaration is erroneously inherited or propagated to hidden field of same name.</li>
<li>XStreamConverter annotation supports null values as arguments for converter instantiation.</li>
<li><a href="https://github.com/x-stream/xstream/issues/5">#5</a>: Support null values for JavaBean properties.</li>
<li><a href="https://github.com/x-stream/xstream/issues/36">#36</a>: Fix NamedMapConverter, does not use SingleValueConverter of value if value is text of entry element.</li>
<li><a href="https://github.com/x-stream/xstream/issues/13">#13</a>: Own converter for javax.activation.ActivationDataFlavor, because ExternalizableConverter cannot
handle a type that violates the Java specification.</li>
<li><a href="https://github.com/x-stream/xstream/pull/18">#18</a>: Minimize synchronized block in FieldDictionary.</li>
<li><a href="/jira/769">XSTR-769</a>: Synthetic fields with references to outer class use compiler dependent names.</li>
<li><a href="/jira/771">XSTR-771</a>: UUID is an immutable type by default.</li>
<li><a href="https://github.com/x-stream/xstream/pull/23">#23</a>: Constructor of AbstractXppDriver swallows causing exception.</li>
<li><a href="https://github.com/x-stream/xstream/issues/28">#28</a>: Fix functionality of ClassAliaslingMapper.itemTypeAsAttributes(Class).</li>
<li><a href="https://github.com/x-stream/xstream/issues/37">#37</a>: Historical Java 1.3 support suppresses causing exception of a thrown InvocationTargetException.</li>
<li><a href="https://github.com/x-stream/xstream/issues/41">#41</a>: Cannot instantiate ToAttributedValueConverter with null value for valueFieldName using
XStreamConverter annotation.</li>
<li>Fix example code in description of security framework.</li>
<li>Clean-up usage of exceptions.</li>
</ul>
<h2>API changes</h2>
<ul>
<li>Added c.t.x.XStream.addImmutableType(Class, boolean) and deprecated c.t.x.XStream.addImmutableType(Class).</li>
<li>Added c.t.x.mapper.Mapper.isReferenceable(Class).</li>
<li>Added c.t.x.mapper.ImmutableTypesMapper.addImmutableType(Class, boolean) and deprecated
c.t.x.mapper.ImmutableTypesMapper.addImmutableType(Class).</li>
<li>Added c.t.x.io.xml.Dom4JDriver.createReader().</li>
<li>Added c.t.x.io.xml.DomDriver.createDocumentBuilderFactory().</li>
<li>Added c.t.x.io.xml.JDomDriver.createBuilder().</li>
<li>Added c.t.x.io.xml.JDom2Driver.createBuilder().</li>
<li>Added c.t.x.io.xml.XomDriver.createBuilder().</li>
<li>Added constructor c.t.x.converter.extended.ToAttributedValueConverter.ToAttributedValueConverter(Class,
Mapper, ReflectionProvider, ConverterLookup).</li>
<li>Added abstract c.t.x.converter.ErrorWritingException as common base for c.t.x.converter.ConversionException
and c.t.x.converter.reflection.ObjectAccessException.</li>
<li>Deprecated c.t.x.io.xml.XomDriver(Builder), c.t.x.io.xml.XomDriver(Builder, NameCoder) and
c.t.x.io.xml.XomDriver.getBuilder().</li>
<li>Deprecated c.t.x.mapper.ClassAliaslingMapper.itemTypeAsAttributes(Class) and
c.t.x.mapper.ClassAliaslingMapper.aliasIsAttribute(String). Methods never called, left-over from old refactoring.</li>
</ul>
<h1 id="1.4.8">1.4.8</h1>
<p>Released February 18, 2015.</p>
<h2>Major changes</h2>
<ul>
<li>Support for serializable lambda expressions and handling of non-serializable ones.</li>
</ul>
<h2>Minor changes</h2>
<ul>
<li>Detect Java 9 runtime.</li>
<li><a href="/jira/767">XSTR-767</a>: Deserialization of referenced lambda expressions fail.</li>
<li><a href="/jira/762">XSTR-762</a>: Private method readResolve() called on base classes.</li>
<li><a href="/jira/761">XSTR-761</a>: Support ignored serialPersistentField at deserialization time.</li>
<li><a href="/jira/755">XSTR-755</a>: ExternalizableConverter does not respect writeReplace and readResolve.</li>
<li><a href="/jira/757">XSTR-757</a>: Deserialized TreeSet does not honor remove(Object) return value contract.</li>
<li><a href="/jira/759">XSTR-759</a>: Support deserialization of <a href="http://www.w3.org/TR/NOTE-datetime">W3C datetime
format</a> in DateConverter with Java 7 runtime.
</li>
<li>Fix: DateConverter ignores provided locale.</li>
<li><a href="/jira/768">XSTR-768</a>: ISO8601GregorianCalendarConverter may set invalid time zone for Joda-Time.</li>
<li>Fix: WeakCache.entrySet().iterator().next.setValue(value) returns the reference instead of the old value.</li>
<li>Fix: SqlTimestampConverter throws IllegalArgumentException instead of ConversionException on fromString().</li>
<li>Fix: CGLIBEnhancedConverter does not initialize transient members of parent after deserialization.</li>
<li><a href="/jira/763">XSTR-763</a>: Set scope of org.json:json to test instead declaring the dependency as optional.</li>
</ul>
<h2>API changes</h2>
<ul>
<li>Added c.t.x.util.JVM.is19().</li>
<li>Added c.t.x.converter.reflection.LambdaConverter and c.t.x.mapper.LambdaMapper.</li>
<li>Declare c.t.x.XStream.ignoreUnknownElements(Pattern) as public.</li>
<li>c.t.x.converters.reflection.AbstractReflectionConverter.readResolve() is protected now.</li>
<li>c.t.x.mapper.AbstractAttributeAliasingMapper.readResolve() is protected now.</li>
<li>Deprecated c.t.x.converters.extended.StackTraceElementFactory, it is an internal helper class.</li>
<li>Deprecated c.t.x.converters.reflection.SerializationMethodInvoker, it is an internal helper class.</li>
<li>Deprecated c.t.x.io.AttributeNameIterator, it is an internal helper class.</li>
<li>Deprecated c.t.x.XStream.useXStream11XmlFriendlyMapper(), corresponding
c.t.x.mapper.XStream11XmlFriendlyMapper has been deprecated long ago.</li>
<li>Deprecated c.t.x.converter.basic.BooleanConverter.shouldConvert(Class,Object), undetected remainder of
ancient XStream version.</li>
</ul>
<h1 id="1.4.7">1.4.7</h1>
<p>Released February 8, 2014.</p>
<p class="highlight">This maintenance release addresses mainly the security vulnerability <a href="CVE-2013-7285.html">
CVE-2013-7285</a>, an arbitrary execution of commands when unmarshalling.</p>
<h2>Major changes</h2>
<ul>
<li>Add <a href="security.html#framework">security framework</a> to limit handled types while unmarshalling.
</li>
<li>java.bean.EventHandler no longer handled automatically because of severe security vulnerability.</li>
<li><a href="/jira/751">XSTR-751</a>: New SunLimitedUnsafeReflectionProvider that uses undocumented features only to allocate new
instances as required on Dalvik.</li>
<li>Fix instantiation of AnnotationMapper that requires ConverterLookup and ConverterRegistry to be the same
instance.</li>
</ul>
<h2>Minor changes</h2>
<ul>
<li>XSTR-749: NPE if ReflectionConverter.canConvert(type) is called with null as argument.</li>
<li>XSTR-753: NPE if SerializationConverter.canConvert(type) is called with an interface type as argument that
extends Serializable.</li>
<li>Add constructor to ReflectionConverter taking an additional type to create an instance that is dedicated to a
specific type only.</li>
<li>The ConverterLookup used by default cannot be casted to a ConverterRegistry anymore.</li>
</ul>
<h2>API changes</h2>
<ul>
<li>Added package c.t.x.security with interface TypePermission, all its implementations and
ForbiddenClassException.</li>
<li>Added c.t.x.mapper.SecurityMapper handling the new type permissions.</li>
<li>Added methods addPermission, denyPermission, allowTypesXXX and denyTypesXXX to c.t.x.XStream to setup
security at unmarshalling time.</li>
<li>Added c.t.x.converters.reflection.SunLimitedUnsafeReflectionProvider.</li>
<li>Deprecated c.t.x.converters.reflection.Sun14ReflectionProvider in favor of new
c.t.x.converters.reflection.SunUnsafeReflectionProvider.</li>
<li>Added c.t.x.converters.reflection.ReflectionConverter(Mapper,ReflectionProvider,Class).</li>
</ul>
<h1 id="1.4.6">1.4.6</h1>
<p>Released December 12, 2013.</p>
<h2>Major changes</h2>
<ul>
<li><a href="/jira/566">XSTR-566</a> and <a href="/jira/200">XSTR-200</a>: Better compatibility with GAE and environments with active SecurityManager
(i.e. in an Applet). XStream converters try now to ensure already in the canConvert methods that they can handle the
requested type in practice and not only theoretically. Additionally the implementations even better take care, that
the initialization of a converter will not break the setup of XStream itself. Following modifications have been done
for these topics:
<ul>
<li>ReflectionConverter, SerializationConverter and LookAndFieldConverter will check if they can access the
fields by reflection for a requested type.</li>
<li>SerializationConverter and ExternalizableConverter will check if they can create an instance of a derived
OutputObjectStream first.</li>
<li>BeanProvider does no longer use reflection to locate default constructor.</li>
<li>AbstractAttributedCharacterIteratorAttributeConverter (and therefore TextAttributeConverter) will check
first if it can access the possible constants of the type by reflection.</li>
<li>NoClassDefFoundError raised in GAE accessing the fields of restricted types by reflection will be handled.</li>
<li>StackTraceElementConverter uses constructor for StackTraceElement instances in Java 5 and GEA.</li>
</ul>
</li>
<li><a href="/jira/739">XSTR-739</a> and <a href="/jira/746">XSTR-746</a>: OrderRetainingMap fails if HashMap.putAll(Map) of Java Runtime is not
implemented calling put for every element within the map.</li>
<li>New NamedArrayConverter to define names of inner elements.</li>
</ul>
<h2>Minor changes</h2>
<ul>
<li><a href="/jira/747">XSTR-747</a>: All constructors of StaxDriver derived classes take erroneously a XmlFriendlyNameCoder instead
of a plain NameCoder.</li>
</ul>
<h2>API changes</h2>
<ul>
<li>Added c.t.x.converters.extended.NamedArrayConverter for free element names in arrays.</li>
<li>Added constructors to c.t.x.io.xml.StandardStaxDriver taking NameCoder instead of XmlFriendlyNameCoder.</li>
<li>Deprecated constructors of c.t.x.io.xml.StandardStaxDriver taking a XmlFriendlyNameCoder.</li>
<li>Added constructors to c.t.x.io.xml.BEAStaxDriver taking NameCoder instead of XmlFriendlyNameCoder.</li>
<li>Deprecated constructors of c.t.x.io.xml.BEAStaxDriver taking a XmlFriendlyNameCoder.</li>
<li>Added constructors to c.t.x.io.xml.WstxDriver taking NameCoder instead of XmlFriendlyNameCoder.</li>
<li>Deprecated constructors of c.t.x.io.xml.WstxDriver taking a XmlFriendlyNameCoder.</li>
<li>Added method canAccess to c.t.x.converter.reflection.AbstractReflectionConverter.</li>
<li>Added static method canCreateDerivedObjectOutputStream to c.t.x.core.JVM.</li>
<li>Deprecated unused member c.t.x.converter.javabean.BeanProvider.NO_PARAMS.</li>
<li>Deprecated unused method c.t.x.converter.javabean.BeanProvider.getDefaultConstrutor(Class).</li>
</ul>
<h1 id="1.4.5">1.4.5</h1>
<p>Released September 18, 2013.</p>
<h2>Major changes</h2>
<ul>
<li><a href="/jira/732">XSTR-732</a>: Use a referencing implementation for the ClassLoader to support environments where no new
ClassLoader can be instantiated due to security restrictions.</li>
<li><a href="/jira/691">XSTR-691</a>: Allow unknown XML elements to be ignored using new method XStream.ignoreUnknownElements.</li>
<li><a href="/jira/728">XSTR-728</a>: XStream creates invalid JSON with JsonHierarchicalStreamDriver for custom converters since
XStream 1.4.</li>
<li><a href="/jira/300">XSTR-300</a>: New EnumToStringConverter to support custom string representations of Enum values.</li>
<li><a href="/jira/292">XSTR-292</a> and <a href="/jira/405">XSTR-405</a>: New NamedMapConverter and NamedCollectionConverter to define names of inner
elements.</li>
<li><a href="/jira/726">XSTR-726</a>: New annotation XStreamAliasType to support declarative definition of XStream.aliasType().</li>
<li><a href="/jira/735">XSTR-735</a>: Support for JDOM2 with JDom2Driver, JDom2Reader and JDom2Writer.</li>
<li>Optimized XML structure for java.awt.Font.</li>
<li>Fix: ToAttributedValueConverter silently appends fields without attribute support to the value producing
mixed-mode XML.</li>
<li><a href="/jira/566">XSTR-566</a> and <a href="/jira/249">XSTR-249</a>: Better compatibility with Google AppEngine and J2ME, setup no longer fails
for unavailable converters.</li>
</ul>
<h2>Minor changes</h2>
<ul>
<li>Fix missing manifest information.</li>
<li><a href="/jira/729">XSTR-729</a>: Add OSGi information to manifests.</li>
<li><a href="/jira/723">XSTR-723</a>: XStream will now detect a working enhanced mode dynamically instead using lists of known
vendors. This allows enhanced support for JamVM if it is bundled with OpenJDK. It will currently fail on a runtime
based on GNU Classpath (at least up to version 0.98).</li>
<li><a href="/jira/541">XSTR-541</a>: JavaScript compatibility problem with 64-bit integers in JSON.</li>
<li><a href="/jira/719">XSTR-719</a>: Support replacement of default converter in any case.</li>
<li><a href="/jira/725">XSTR-725</a>: processAnnotation performance improvement in concurrent situation.</li>
<li><a href="/jira/721">XSTR-721</a>: EnumConverter is more lenient while parsing constants.</li>
<li>New constructors for CollectionConverter and MapConverter to allow registration for an individual type.</li>
<li><a href="/jira/724">XSTR-724</a>: Cache class name lookup failures.</li>
<li>Current IBM JDK for Java 1.4.2 no longer has a reverse field ordering.</li>
<li>LongConverter supports now positive hex and octal numbers over Long.MAX_VALUE within 64 bit.</li>
<li>Fix: Sun14RefectionProvider ignores a provided FieldDictionary.</li>
<li><a href="/jira/457">XSTR-457</a>: Do not write 'defined-in' attribute if not needed.</li>
<li>JettisonMappedXmlDriver provides better support to overwrite its create methods.</li>
<li><a href="/jira/685">XSTR-685</a>: StAX based drivers (StaxDriver and JettisonMappedXmlDriver) are not closing internal input
stream reading from file or URL.</li>
<li><a href="/jira/736">XSTR-736</a>: XStream.unmarshal may throw NPE if version info of manifest is missing.</li>
<li><a href="/jira/733">XSTR-733</a>: Implicit elements that match multiple defined implicit collections will be assigned to the map
with the nearest matching element type.</li>
<li><a href="/jira/740">XSTR-740</a>: ISO8601GregorianCalendarConverter creates Calendar instance with wrong Locale in Java 7 if the
Locale for the LocaleCategory.FORMAT is different to the global default Locale.</li>
<li><a href="/jira/578">XSTR-578</a>: Implement support for aliasing in JavaClasConverter, JavaFieldConverter and
JavaMethodConverter. While it is not possible to enable this in general, new constructors have been added to these
converters and an example in the acceptance tests (AliasTest).</li>
<li><a href="/jira/742">XSTR-742</a>: Register CompositeClassLoader in Java 7 as parallel capable.</li>
<li><a href="/jira/743">XSTR-743</a>: Support proxy collections of Hibernate Envers.</li>
<li>Fix NPE in AttributeMapper.shouldLookForSingleValueConverter if parameters fieldName and definedIn are null.</li>
<li>Implicit type argument can be omitted when registering converters with @XStreamConverter annotation.</li>
</ul>
<h2>API changes</h2>
<ul>
<li>Added c.t.x.converters.extended.NamedCollectionConverter for free element names in collections.</li>
<li>Added c.t.x.converters.extended.NamedMapConverter for free element names in maps.</li>
<li>Added c.t.x.io.xml.StandardStaxDriver to use the StAX implementation delivered with the Java 6 runtime.</li>
<li>Deprecated c.t.x.io.xml.SjsxpStaxDriver to select the internal StAX implementation of Oracle.</li>
<li>Added static methods getStaxInputFactory and getStaxOutputFactory to c.t.x.core.JVM as returning the
implementations of javax.xml.stream.XMLInputFactory (resp. javax.xml.stream.XMLOutputFactory) delivered with the Java
Runtime since Java 6.</li>
<li>Added c.t.x.core.ClassLoaderReference.</li>
<li>Added constructors taking an additional Class argument for c.t.x.converters.collections.CollectionConverter
and c.t.x.converters.collections.MapConverter.</li>
<li>Added constructors taking a ClassLoaderReference instead of a ClassLoader and deprecated the ones taking the
ClassLoader:
<ul>
<li>c.t.x.XStream</li>
<li>c.t.x.converters.extended.DynamicProxyConverter</li>
<li>c.t.x.converters.extended.JavaClassConverter</li>
<li>c.t.x.converters.extended.JavaFieldConverter</li>
<li>c.t.x.converters.extended.JavaMethodConverter</li>
<li>c.t.x.converters.reflection.CGLIBEnhancedConverter</li>
<li>c.t.x.converters.reflection.ExternalizableConverter</li>
<li>c.t.x.converters.reflection.SerializableConverter</li>
<li>c.t.x.mapper.AnnotationMapper</li>
<li>c.t.x.mapper.DefaultMapper</li>
</ul>
</li>
<li>Added static methods newReflectionProvider, isAWTAvailable, isSQLAvailable and isSwingAvailable to
c.t.x.core.JVM as replacement for the deprecated non-static methods.</li>
<li>Deprecated c.t.x.core.JVM() and all non-static methods.</li>
<li>Added method useImplicitType to c.t.x.annotations.XStreamConverter.</li>
<li><a href="/jira/722">XSTR-722</a>: Added c.t.x.converters.reflection.ReflectionProvider.getFieldOrNull(Class, String).</li>
<li>Deprecated c.t.x.converters.reflection.ReflectionProvider.fieldDefinedInClass(Class, String) in favor of new
c.t.x.converters.reflection.ReflectionProvider.getFieldOrNull(Class, String).</li>
<li>Deprecated constructor c.t.x.converters.extended.RegexPatternConverter(Converter) in favor of
c.t.x.converters.extended.RegexPatternConverter().</li>
<li>Deprecated default constructor of c.t.x.converters.extended.FontConverter in favor of
c.t.x.converters.extended.FontConverter(Mapper).</li>
<li>Deprecated constructor c.t.x.converters.extended.ThrowableConverter(Converter) in favor of
c.t.x.converters.extended.ThrowableConverter(ConverterLookup).</li>
<li>Deprecated class c.t.x.converters.reflection.SelfStreamingInstanceChecker and moved original implementation
into c.t.x.core.util, since it is internal.</li>
<li>Deprecated interface c.t.x.mapper.AnnotationConfiguration.</li>
</ul>
<h1 id="1.4.4">1.4.4</h1>
<p>Released January 19, 2013.</p>
<h2>Minor changes</h2>
<ul>
<li><a href="/jira/709">XSTR-709</a>: Locks up on Mac with Apple JVM due to unwanted initialization of AWT.</li>
<li><a href="/jira/711">XSTR-711</a>: DateConverter cannot handle dates in different era.</li>
<li><a href="/jira/741">XSTR-741</a>: ToAttributedValueConverter fails to write enums as attributes.</li>
<li><a href="/jira/712">XSTR-712</a>: HibernateMapper throws NPE if a collection contains null.</li>
<li>DateConverter supports now localized formats.</li>
<li><a href="/jira/710">XSTR-710</a>: JsonWriter does not write BigInteger and BigDecimal as number values.</li>
<li><a href="/jira/708">XSTR-708</a>: SqlTimestampConverter does not ignore timezone.</li>
<li><a href="/jira/707">XSTR-707</a>: Creation of XmllPullParser with the XmlPullParserFactory may fail in OSGi environment.</li>
<li><a href="/jira/705">XSTR-705</a>: Unnecessary synchronization accessing the field cache decreases performance.</li>
<li><a href="/jira/714">XSTR-714</a>: Fields not found when XStream12FieldKeySorter used.</li>
</ul>
<h2>API changes</h2>
<ul>
<li>Deprecated method c.t.x.core.util.JVM.is14(), c.t.x.core.util.JVM.is15() and c.t.x.core.util.JVM.is16().</li>
</ul>
<h1 id="1.4.3">1.4.3</h1>
<p>Released July 17, 2012.</p>
<h2>Major changes</h2>
<ul>
<li>Support java.util.concurrent.ConcurrentHashMap with the MapConverter. This will also avoid a bug in JRockit
JDK reported in <a href="/jira/608">XSTR-608</a>.</li>
<li><a href="/jira/699">XSTR-699</a>: Support for Hibernate 4 with XStream's Hibernate module as default for Java 6 or higher.</li>
</ul>
<h2>Minor changes</h2>
<ul>
<li>JVM.loadClass will now also initialize the loaded class and ignore any occurring LinkageError.</li>
<li><a href="/jira/596">XSTR-596</a>: SubjectConverter will be no longer registered if initialization of javax.security.auth.Subject
fails.</li>
<li><a href="/jira/683">XSTR-683</a>: Inheritance of implicit collections, arrays or maps is dependent on declaration sequence.</li>
<li>Inherited implicit collections, arrays or maps can be overwritten with own definition in subtype.</li>
<li><a href="/jira/688">XSTR-688</a>: Cannot omit XML elements from derived fields.</li>
<li><a href="/jira/696">XSTR-696</a>: Ill-formed JSON generated, because JSON writer is fed with type of declaring field instead of
the real object's type.</li>
<li><a href="/jira/685">XSTR-685</a>: Deserialization from file or URL keeps stream open.</li>
<li><a href="/jira/684">XSTR-684</a>: XML 1.0 character validation fails for characters from 0x10 to 0x1f.</li>
<li>JavaBeanConverter supports now instantiation for a specific type and can therefore be used in
@XStreamConverter annotation.</li>
<li>SerializableConverter is broken if the serialized type is the default implementation.</li>
<li>Method marshalUnserializableParent of SerializableConverter is protected now to skip the default mechanism in
a derived converter that uses the default constructor to create the original type (as an alternative for
<a href="/jira/695">XSTR-695</a>).</li>
<li>FieldDictionary may call sort of FieldKeySorter implementation with wrong type as key.</li>
<li>Sometimes DependencyInjectionFactory tries to instantiate objects with mismatching constructor arguments.</li>
<li>HSQLDB has to be a test dependency only for XStream's Hibernate module.</li>
</ul>
<h1 id="1.4.2">1.4.2</h1>
<p>Released November 3, 2011.</p>
<h2>Major changes</h2>
<ul>
<li>XStream libraries can be used now directly in Android, therefore support of Java 1.4.2 has been stopped with
the delivery. Anyone who needs a version for Java 1.4.2 can build it easily from source, this build is still
supported and part of CI.</li>
<li><a href="/jira/675">XSTR-675</a>: New extended HierarchicalStreamReader interface with peekNextChild method. All XStream readers
implement the new interface (by Nikita Levyankov).</li>
<li><a href="/jira/673">XSTR-673</a>: Collections.EMPTY_LIST, Collections.EMPTY_SET and Collections.EMPTY_MAP supported with own
alias and defined as immutable.</li>
<li><a href="/jira/631">XSTR-631</a>: Collections.singletonList(), Collections.singletonSet() and Collections.singletonMap()
supported with own alias and own converters.</li>
<li><a href="/jira/406">XSTR-406</a> + <a href="/jira/663">XSTR-663</a>: Support additional parameters for XStreamConverter annotation (e.g. to declare
a ToAttributedValueConverter).</li>
</ul>
<h2>Minor changes</h2>
<ul>
<li>WstxDriver did not trigger Woodstox, but BEA StAX implementation.</li>
<li><a href="/jira/260">XSTR-260</a>: PrettyPrintWriter does not handle tab and new line characters in attributes.</li>
<li><a href="/jira/667">XSTR-667</a>: Cannot serialize empty list with JsonHierarchicalStreamDriver.</li>
<li><a href="/jira/661">XSTR-661</a>: TreeMarshaller.CircularReference is not a ConversionException.</li>
<li><a href="/jira/562">XSTR-562</a>: StAX: Namespace attribute is not written in non-repairing mode for second sibling.</li>
<li><a href="/jira/664">XSTR-664</a>: ClassCastException in HibernatePersistentSortedSetConverter and
HibernatePersistentSortedMapConverter.</li>
<li><a href="/jira/674">XSTR-674</a>: Recreate binary compatibility with 1.3.x series for method
CustomObjectInputStream.getInstance(...).</li>
<li><a href="/jira/671">XSTR-671</a>: CannotResolveClassException should accept cause.</li>
<li><a href="/jira/672">XSTR-672</a>: Collections.EMPTY_LIST, Collections.EMPTY_SET and Collections.EMPTY_MAP used for in implicit
collection should not throw ReferencedImplicitElementException.</li>
<li><a href="/jira/676">XSTR-676</a>: Introduce MissingFieldException thrown at deserialization time indicating a missing field or
property (by Nikita Levyankov).</li>
<li>Add length limit for cached strings in StringConverter, 38 characters by default.</li>
<li>The JsonHierarchicalStreamDriver and the JsonWriter did not support the inherited NameCoder instance.</li>
<li>Add BinaryStreamDriver.</li>
<li>NPE in XppDomComparator.</li>
<li>Dom4JXmlWriter fails to flush the underlying writer.</li>
<li>Known control characters are not encoded with JsonWriter as proposed at json.org.</li>
<li>Detect duplicate property processing in JavaBeanConverter and throw DuplicatePropertyException instead of
clobbering silently.</li>
<li>Allow access to Mapper and JavaBeanProvider in derived instances of JavaBeanConverter.</li>
<li>DependencyInjectionFactory failed to create instance when a matching constructor was found, but a default
constructor was also present.</li>
</ul>
<h2>API changes</h2>
<ul>
<li>Added interface c.t.x.io.ExtendedHierarchicalStreamReader extending c.t.x.io.HierarchicalStreamReader. All
implementations of c.t.x.io.HierarchicalStreamReader will implement also the extended interface.</li>
<li>Added c.t.x.converters.reflection.MissingFieldException derived from
c.t.x.converters.reflection.ObjectAccessException and used instead when the unmarshalling process should write a
field or property that is missing and does not exist.</li>
<li>Added methods c.t.x.io.path.PathTracker.peekElement(), c.t.x.io.path.PathTracker.peekElement(int), and
c.t.x.io.path.PathTracker.depth().</li>
<li>Deprecated method c.t.x.core.ReferencingMarshallingContext.currentPath(). Wrong approach.</li>
</ul>
<h1 id="1.4.1">1.4.1</h1>
<p>Released August 11, 2011.</p>
<h2>Major changes</h2>
<ul>
<li><a href="/jira/659">XSTR-659</a>: Use again Xpp3 as default parser, now with additional XmlPullParser API as regular dependency
for the XPP factory. Only standard kXML2 package contains the XPP factory, but not the minimal kXML2 version.</li>
</ul>
<h2>Minor changes</h2>
<ul>
<li>Add utility class c.t.x.io.xml.xppdom.XppFactory and a path tracking comparator for XppDom.</li>
</ul>
<h1 id="1.4">1.4</h1>
<p>Released August 6, 2011.</p>
<h2>Major changes</h2>
<ul>
<li>Java 7 is detected and supported.</li>
<li><a href="/jira/542">XSTR-542</a>: The XppDriver uses now the official XmlPullParser API to locate an available parser using the
XmlPullParserFactory. This allows the usage of XPP technology with XStream in Android.</li>
<li>Additional explicit XPP drivers for the Xpp3 and kXML2 implementations.</li>
<li>Additional explicit XPP DOM drivers for the Xpp3 and kXML2 implementations.</li>
<li>kXML2 is now the preferred parser implementation, Xpp3 is optional.</li>
<li>Additional explicit StAX drivers for Woodstox, BEA StAX and SJSXP of the JDK 6 implementations.</li>
<li>JDK 1.3 is no longer officially supported.</li>
<li><a href="/jira/377">XSTR-377</a>+<a href="/jira/226">XSTR-226</a>: New artifact xstream-hibernate with converters and mapper to process Hibernate
object graphs (by Costin Leau, Konstantin Pribluda and in special Jaime Metcher).</li>
<li>New NameCoder interface and implementations to support a generic name translation between names from the
object graph and a target format. The new XmlFriendlyNameCoder replaces the XmlFriendlyReplacer used for XML only.</li>
<li><a href="/jira/553">XSTR-553</a>: Support annotations in Android.</li>
<li><a href="/jira/556">XSTR-556</a>: DateConverter uses format with 3-letter time zones that are ambiguous. Therefore it will now
always use UTC to write dates. Unmarshalled dates are not affected as long as they contain a time zone.</li>
<li>The type java.lang.reflect.Field is now handled by an own converter, that can still read the old format.</li>
<li><a href="/jira/490">XSTR-490</a>: Provide path in Converter for contexts that track the path.</li>
<li><a href="/jira/592">XSTR-592</a>+<a href="/jira/579">XSTR-579</a>: OmitField respected at deserialization time even for existing fields.</li>
<li><a href="/jira/593">XSTR-593</a>: Direct support for java.net.URI instances (by Carlos Roman).</li>
<li><a href="/jira/615">XSTR-615</a>+<a href="/jira/580">XSTR-580</a>: Dynamic proxies cannot be referenced recursively.</li>
<li><a href="/jira/547">XSTR-547</a>: Wrong class loader used for Serializable types deserialized with an ObjectInputStream.</li>
<li><a href="/jira/341">XSTR-341</a>: Support of implicit arrays.</li>
<li><a href="/jira/306">XSTR-306</a>+<a href="/jira/406">XSTR-406</a>: Support of implicit maps.</li>
<li><a href="/jira/344">XSTR-344</a>: New ToAttributedValueConverter to allow conversion of an element with string body and
attributes.</li>
<li><a href="/jira/573">XSTR-573</a>: SortedSet added with TreeSet as the default implementation.</li>
<li><a href="/jira/576">XSTR-576</a>: TreeMap and TreeSet no longer add an element without comparator (by Jason Greanya), solves
also invalid format with JSON for such objects (<a href="/jira/640">XSTR-640</a>).</li>
</ul>
<h2>Minor changes</h2>
<ul>