Fixed #29708 -- Deprecated PickleSerializer.

2 files changed, 8 insertions, 0 deletions

diff --git a/django/contrib/sessions/serializers.py b/django/contrib/sessions/serializers.py
index 5b6c343daa..6a9452bba0 100644
--- a/django/contrib/sessions/serializers.py
+++ b/django/contrib/sessions/serializers.py
@@ -1,3 +1,4 @@
+# RemovedInDjango50Warning.
 from django.core.serializers.base import (
     PickleSerializer as BasePickleSerializer,
 )
diff --git a/django/core/serializers/base.py b/django/core/serializers/base.py
index 3bd492ec09..45c43a77d6 100644
--- a/django/core/serializers/base.py
+++ b/django/core/serializers/base.py
@@ -2,10 +2,12 @@
 Module for abstract serializer/unserializer base classes.
 """
 import pickle
+import warnings
 from io import StringIO
 
 from django.core.exceptions import ObjectDoesNotExist
 from django.db import models
+from django.utils.deprecation import RemovedInDjango50Warning
 
 DEFER_FIELD = object()
 
@@ -16,6 +18,11 @@ class PickleSerializer:
     cache backends.
     """
     def __init__(self, protocol=None):
+        warnings.warn(
+            'PickleSerializer is deprecated due to its security risk. Use '
+            'JSONSerializer instead.',
+            RemovedInDjango50Warning,
+        )
         self.protocol = pickle.HIGHEST_PROTOCOL if protocol is None else protocol
 
     def dumps(self, obj):