unserialize() is insecure unless allowed classes are limited.

Problem/Motivation

 ERROR | unserialize() is insecure unless allowed classes are limited. Use a safe format like JSON or use the allowed_classes option.

Proposed resolution

$diff = unserialize($diff, ['allowed_classes' => FALSE]);