There is a vulnerability in com.thoughtworks.xstream.xstream 1.4.20, upgrade recommended

[intumchoi1]

Describe the bug
In the current version of OpenGrok (last release is 1.13.24), OpenGrok Suggester includes xstream 1.4.20 which has a vulnerability: CVE-2024-47072

Recommended version 1.4.21 fixes the above vulnerability.

Additional context

I tried updating 1.4.21 to see if it would be a trivial upgrade, but a couple unit test failures in ChronicleMapAdapterTest (testResize() and dataNotLostAfterResizeTest()) fail with the exception: com.thoughtworks.xstream.converters.ConversionException: unable to convert node named=org.apache.lucene.util.BytesRef.

Thank you!

[vladak]

Actually, not at all trivial, see PR #4684.

[intumchoi1]

thank you for the quick reply! will follow #4684