We did an upgrade from 1.8 to 5_x and there is a trouble with the resourcepolicy table.
When an item is withdrawn
AuthorizeManager.removeAllPoliciesByDSOAndTypeNotEqualsTo(ourContext, this, ResourcePolicy.TYPE_CUSTOM);
gets called, meaning the following sql gets executed
DatabaseManager.updateQuery(c, "DELETE FROM resourcepolicy WHERE "
+ "resource_type_id= ? AND resource_id= ? AND rptype <> ? ",
o.getType(), o.getID(), type);
But since there was no rptype in 1.8, and the upgrade process does not add any, the column is null and nothing is deleted, because <> doesnt compare against null values.
This actually means if there was an anonymous read on an item, the item is still visible after being withdrawn...