Description
Bug report
| Question | Answer |
|---|---|
| Box version | master |
| PHP version | 8.1 |
| Platform with version | any |
| Github Repo | - |
As of PHP 8.1, the PHP native Serializable class is deprecated.
Per the RFC:
A class is “only Serializable” if it is non-abstract, implements
Serializable, and does not implement__serialize()and__unserialize(). > Then:
- In PHP 8.1, declaring an “only Serializable” class will throw a deprecation warning. Other implementations of
Serializablewill be accepted without a deprecation warning, because libraries supporting PHP < 7.4 will generally need to implement both the old and new mechanisms.- In PHP 9.0 the
Serializableinterface will be removed andunserialize()will reject payloads using the C serialization format. Code needing to support both PHP < 7.4 and PHP >= 9.0 may polyfill the Serializable interface, though it will have no effect on serialization.If a class implements both
Serializableand__serialize()/__unserialize(), the latter take precedence (on versions that support them), and theSerializableinterface is only used to decode existing serialization payload using the obsolete C format. To migrate to the new mechanism, it's possible to either replace Serializable entirely (if support for PHP 7.3 and below is not needed) or to implement both (if it is needed).
The above has an impact on the KevinGH\Box\PhpScoper\SerializablePhpScoper class which implements Serializable.
I suspect this class can only be made compatible once the Opis\Closure\SerializableClosure class being (un)serialized has been made compatible with PHP 8.1 and the implementation used in that class is known.
Unfortunately, an initial attempt to make the Opis\Closure\SerializableClosure class compatible has bounced: opis/closure#103 and it is unknown when a compatible version of the class will be available.