Highlights
Insecure Deserialization: 1 prior fix. Scrutinize any change in this area.
src/Parser/Serialize.php: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Insecure Deserialization: The parser historically permitted automatic unserialization of untrusted PHP objects and arrays. If left unrestricted, this behavior allows remote attackers to trigger PHP object injection and potentially execute arbitrary code on the hosting server.