xstream/src/java/com/thoughtworks/xstream/mapper/LambdaMapper.java | 10 9 + 1 - 0 !
1 file changed, 9 insertions(+), 1 deletion(-)

 replaces the call to method.isdefault() by a reflexive call to compile with java 7

xstream/src/java/com/thoughtworks/xstream/io/xml/BEAStaxDriver.java | 14 0 + 14 - 0 !
1 file changed, 14 deletions(-)

 removes the dependency on the com.bea.xml.stream package (not needed, allows us to drop the stax dependency)

xstream/src/java/com/thoughtworks/xstream/XStream.java | 180 84 + 96 - 0 !
1 file changed, 84 insertions(+), 96 deletions(-)

 enable-security-whitelist-by-default

xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java | 217 61 + 156 - 0 !
1 file changed, 61 insertions(+), 156 deletions(-)

 securityvulnerabilitytest

xstream/src/java/com/thoughtworks/xstream/XStream.java | 4 4 + 0 - 0 !
1 file changed, 4 insertions(+)

 debian-specific-whitelist-extension

xstream/src/java/com/thoughtworks/xstream/XStream.java | 8 6 + 2 - 0 !
xstream/src/java/com/thoughtworks/xstream/security/AbstractSecurityException.java | 29 29 + 0 - 0 !
xstream/src/java/com/thoughtworks/xstream/security/InputManipulationException.java | 27 27 + 0 - 0 !
xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java | 35 34 + 1 - 0 !
4 files changed, 96 insertions(+), 3 deletions(-)

 cve-2022-41966

Bug-Debian: https://bugs.debian.org/1027754