The fix for CVE-2020-11105 in version 1.3.1 requires that std::shared_ptr be used, but at least one cereal consumer, e-antic, uses boost::intrusive_ptr instead. It might be possible to subclass OutputArchive to deal with this, but the relevant member variables are all private, not protected. As a result, the e-antic package has been left in an unbuildable state in Fedora ever since we upgraded to cereal 1.3.1. Would you consider making itsSharedPointerMap protected so that consumers can deal with this situation? Or explicitly add support for boost::intrusive_ptr?