`xstream` is what we use in Jenkins nowadays. `xstream-fork` has been created by Nicolas de Loof at some point, but this repository has never been updated to incorporate Jenkins-specific patches. And I am not sure whether it has passed the full test cycle. There is a splitbrain between the repos, and their README files are misleading. Since 2016 there were pull requests submitted against both repos, and it made the situation worse.
Whomever wants to update XStream, we firstly need to resolve the splitbrain issue. Switching from a custom XStream fork to the official XStream releases is something we should do IMHO, but it needs to be tested a LOT before we do it. Any XStream change may cause Jenkins startup issues and, potentially, security issues if JEP-200 classfilter hooks stop working. BR, Oleg On Monday, December 10, 2018 at 10:46:34 PM UTC+1, Jesse Glick wrote: > > On Fri, Dec 7, 2018 at 7:38 AM Oliver Gondža <[email protected] > <javascript:>> wrote: > > How did we ever released from our fork? > > I am not personally even sure whether `xstream` or `xstream-fork` is > really the right source repo, much less exactly how we have > historically cut releases. > -- You received this message because you are subscribed to the Google Groups "Jenkins Developers" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-dev/ed0f0ad6-d521-4473-94dd-c27773031a3b%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
