development cve-fix-war xstream-fix