On: Oracle plans to dump risky Java serialization

[MBCook]

From the article it sounds like you’ll only be able to use the replacement on Java data classes, sort of like JSON structures or C structs.

Since there won’t be any code that gets executed, that particular vector is closed.

Of course if the code reading that object does something stupid…