Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can be instantiated. The pipe connects devenv, the out-of-process Roslyn code-analysis process and the CodeLens process, and has the predictable name Metalama_{role}_{processId}_{hash(PackageVersion)}. Releases from the first public 2023.0 line through 2026.0.x use Newtonsoft.Json with TypeNameHandling.All; the later SerializationBinder only remaps assembly names, and BindToType resolves arbitrary wire-supplied types without an allow-list. Releases 2026.1.0 through 2026.1.18 use typeless MessagePack with TypelessObjectResolver and…