Hello,
It probably is related to this fix made in version 3.5.4 :
https://github.com/mybatis/mybatis-3/issues/1551Basically, there was a bug in one of the built-in type handlers that used 'column name' instead of 'column label' when getting the result.
In your case, this bug hid the misconfiguration in your result map when the app was developed.
And now that the bug is fixed, the hidden problem is exposed.
As an easy/temporary workaround, you can try disabling `useColumnLabel`, however, this could cause other problems for obvious reasons.
https://mybatis.org/mybatis-3/configuration.html#settingsYou seem to understand this, but the right solution would be to correct the `column` value of `<result />` or to modify the column alias in the SQL.
p.s.
If your security concern is about the JDK's deserialization vulnerability, you can (and should) use the JEP-290 serialization filter.
It is effective against any version of MyBatis (and most other libraries/frameworks), so you may be able to use MyBatis 3.5.3 which does not include the bug fix.
https://docs.oracle.com/pls/topic/lookup?ctx=javase15&id=GUID-8296D8E8-2B93-4B9A-856E-0A65AF9B8C66
Regards,
Iwao