I certainly hope no one takes my list as an endorsement… It’s just some formats seen in the wild. It should be noted (the article does not) that parsing and de

I certainly hope no one takes my list as an endorsement… It’s just some formats seen in the wild. It should be noted (the article does not) that parsing and deserialisation is generally a known weak area and a common source of CVEs, even when pickling is not used. Being more disciplined about it helps, of course.