https://codeql.github.com/codeql-query-help/java/java-unsafe-deserialization/

This query currently documents that SnakeYaml is currently insecure by default. As of 2.0, this is no longer the case. It's now secure by default. This should be updated in the documentation, and the query, if relevant, should also be updated.