Warning about XStream after upgrading Axon version

Basic information

• Axon Framework version: 4.5.9
• JDK version: 17
• Kafka extension version: 4.5.3
• Spring boot version: 2.6.6

After upgrading the Axon version from 4.5.3 to 4.5.9, we are getting the console warning: An unsecured XStream instance allowing all types is used. It is strongly recommended to set the security context yourself instead., even we don’t use XStream, we use Jackson instead.

Steps to reproduce

In application.properties we set general serializer to jackson axon.serializer.general=jackson

Setting serializer using Spring boot configuration class didn’t help. Code used for this:

@Configuration
public class SerializerConfiguration {

   @Bean
   public Serializer defaultSerializer() {
      return JacksonSerializer.defaultSerializer();
   }
}

I have also tried to create XStream bean, but it also didn’t help

@Configuration
public class AxonConfig {
 
    @Bean
    public XStream xStream() {
        XStream xStream = new XStream();
      
        xStream.allowTypesByWildcard(new String[] {
                "our.package.**"
        });
        return xStream;
    }
}

Expected behaviour

Application up and running without any warnings.

Actual behaviour

Warning when starting application:

2022-04-12 15:39:18.300 WARN [dealer-command-server,,] 34196 --- [ main] o.a.serialization.xml.XStreamSerializer : An unsecured XStream instance allowing all types is used. It is strongly recommended to set the security context yourself instead!

[lfgcampos]

Hi @Corke123, I believe the fix we pushed to https://github.com/AxonFramework/extension-kafka/pull/280 should solve your problem.

By making the serializer lazy, we should not start XStream automatically but only if you don’t provide your own Serializer. By doing so, the initialization message/warn should not pop-up anymore.

Keep an eye for the next extension-kafka release and let us know if that indeed fixed the problem for you!

KR

[ivansenic]

Sorry completely forgot to share, works now, I am not sure if it’s the last released version or one before that I tested with, but anyway the issue does not exist anymore.