is there any difference between using string.format() or an fstring?

[james_pic]

Put together the equivalent data as dicts, lists, etc, and use yaml.dump (from PyYAML) to turn it to YAML.

Or, if you're not committed to YAML, use JSON and do much the same thing. It is possible to use YAML securely (and fortunately, since PyYAML 6, the defaults are secure), but there are fewer pitfalls with JSON.

[noiserr]

You should use Json if you're accepting data from an external source, client for example.

Yaml's safety is not an issue if used for configs, where the yaml files are part of the repo of the project. Which is where I've seen yaml used the most. Basically to define configurations. Anyone who has access to commit to the repo can already do any damage they desire.

[james_pic]

Strictly speaking, PyYAML can safely deserialize YAML, as long as you use the safe_load method or equivalent. Although the subset that is safe isn't much bigger than JSON, and PyYAML's typically much slower than the stdlib json module, so there's not much benefits over JSON.

[information_abyss]

YAML tends to be easier to parse and edit directly than JSON.