StaxEventItemWriter.unclosedHeaderCallbackElements prevents new job execution

[Alex4i]

While upgrading to spring-batch 4.3.4, my job started to fail with the exception :
The class with javax.xml.namespace.QName and name of javax.xml.namespace.QName is not trusted.

After investigating, it turns out that StaxEventItemWriter (with saveState=true) writes unclosed elements from the header callback to the step context as QNames. On the next job execution, it will first try to read the last job execution and this is where the exception appears as the step execution from StaxEventItemWriter cannot be deserialized.

This was not a problem before 4.3.4 as SimpleJobExplorer#getLastJobExecution did not fetch step executions (see #3943) but now that it does, it means that StaxEventItemWriter is not usable with a header callback out-of-the-box. EIther we have to set saveState=false on the writer, or we must create a BatchConfigurer to add the mixIn for QName to the ObjectMapper.

I think that at the very least, documentation should reflect this.

Minimal example : https://github.com/Alex4i/staxwriter_qname
Run with gradlew bootRun

[fmbenhassine]

Thank you for opening this issue and for providing a minimal complete example! Indeed, the sample fails with the default configuration of the serializer. Using a custom serializer that trusts javax.xml.namespace.QName makes your sample work without any issue. According to Jackson's type validator, this class is safe to deserialize. Hence, I see no harm in adding it to the default list of trusted classes in Spring Batch (in order to avoid the effort of providing a custom serializer).