lgtm,codescanning
* The "Deserialization of user-controlled data" (`java/unsafe-deserialization`) query
  now recognizes `JYaml`, `JsonIO`, `YAMLBeans`, `Castor`, `Hessian` and `Burlap` deserialization.