Repository navigation
Remove Pickle usage entirely #19744
Description
Related issues, PRs or discussions
What is the current state of the codebase?
NVDA uses pickle for some data persistance tasks.
Why are changes required?
Pickle is an inherently unsafe data persistance format, which allows arbitrary code execution.
What technical changes are required?
- Use a safe serialization format for add-on state #19559
- Remove pickle to JSON migration for add-ons state #19743
- Use a safe serialization format for update check state #19560
- Deprecate usage of pickle #19745
Are the proposed technical changes API breaking?
No. The format of NDA's configuration on-disk is considered to be an implementation detail and is not part of the API.
Are there potential risks or issues with the proposed implementation?
Unlikely. We do not need the power offered by the pickle format for any of our data persistance tasks.
Activity