Remarshal

Latest version: v0.20.0

Safety actively analyzes 693883 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 2 of 5

0.17.1

* Fixed a [billion laughs](https://en.wikipedia.org/wiki/Billion_laughs_attack) DoS vulnerability when converting from YAML. More information: [JVN86156389](https://jvn.jp/en/jp/JVN86156389/). [CVE-2023-47163](https://www.cve.org/CVERecord?id=CVE-2023-47163).

0.17.0

Not secure
* BREAKING CHANGE: Remarshal no longer turns boolean and null keys into strings by default when converting to JSON. The default is to exit with an error. The previous default could cause silent data corruption, for example, when converting a GitHub Actions workflow file with an unquoted `on` key from YAML to JSON. While this is a breaking change, it should not affect most users.
* The new flag `-k`/`--stringify` restores the old JSON conversion behavior of turning boolean and null keys into strings. Additionally, it turns date-time keys into strings and works for both JSON and TOML. it also converts null _values_ to strings for TOML, since TOML does not have null.

0.16.1

Not secure
* This version fixes the default JSON indentation setting. Line breaks are once again absent when you don't use `--json-indent`.
* Types have been filled in for mypy strict mode.

0.16.0

Not secure
* This version adds new command-line options: `--json-indent n`, `-s`/`--sort-keys`, `--yaml-indent n`, `--yaml-width n`. `--json-indent n` is a synonym for `--indent-json n` consistent with the YAML options. Prefer it to the older option.
* Preserving key order in JSON, TOML, and YAML types is now the default. Remarshal accepts the flag `-p`/`--preserve-key-order` for compatibility, but it does nothing. Pass `-s`/`--sort-keys` to enable the previous default behavior.
* The code has type annotations.
* The readme has been improved. It suggests better ways to run and install Remarshal. The mistaken claim that you can use a blank string as the filename for standard input/output (not true since the Python rewrite in 2016) is gone.

0.15.1

Not secure
This release updates metadata and infrastructure. There are no user-visible changes.

0.15.0

Not secure
This version
* Fixes conversion of YAML with boolean and null keys to JSON;
* Updates the CBOR, TOML, and YAML library, upgrading support for TOML to 1.0.0 (no longer `-rc`);
* Requires Python 3.8;
* Removes some inert code that supported earlier versions of Python.

Page 2 of 5

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.