tl;dr: transition to Jackson & JSON without trying to support legacy data; create a module to help implementations make the transition
We discussed this a bit on today’s Platform Team call. The general sentiment was that we don’t want to bypass constraints that have been made for security purposes (i.e., adding the JVM option --add-opens is not a viable option). The best way forward seems to be to adopt a widely supported & active library (like Jackson) that can serialize to JSON with the goal of supporting 80% or more of serialization needs (i.e. most cases but not necessarily all the edge cases). Once we have a Jackson JSON-based solution, then we could create a script or module that can do the one-time task of helping an implementation translate Xstream-based XML entries in the database to Jackson-based JSON entries.