1.4.18 breaks nexus-staging-maven-plugin 1.6.7

[zqfan]

I'm using nexus-staging-maven-plugin 1.6.7, it indirectly requires xstream 1.4.7, but xstream 1.4.7 has security issue, so I have to bump it to 1.4.17, and it works fine.
But recently github complains a new security alert which ask me to upgrade xstream to 1.4.18, but then nexus-staging-maven-plugin failed with message:

[ERROR] Failed to execute goal org.sonatype.plugins:nexus-staging-maven-plugin:1.6.8:deploy (injected-nexus-deploy) on project tencentcloud-sdk-java: Execution injected-nexus-deploy of goal org.sonatype.plugins:nexus-staging-maven-plugin:1.6.8:deploy failed: Nexus connection problem to URL [https://oss.sonatype.org/ ]: org.sonatype.nexus.rest.model.StatusResourceResponse -> [Help 1]

after revert it back to xstream 1.4.17, then it works again.

[joehni]

This is by design. If the nexus staging plugin does not initialize the Security Framework for its own needs, XStream will now only marshal the types on its own whitelist. It cannot know, what types the nexus staging plugin its using. The authors of the plugin had 9 years time to do this as recommended.

[kohlschuetter]

@zqfan FYI