A PHP internals RFC discussion proposes making closures from constant expressions (introduced in PHP 8.5 for attribute arguments and parameter defaults) serializable. Currently these static, capture-nothing closures silently break serialize()-based metadata caches. The RFC proposes serializing them as references to their declaration site using a member@callable identifier format. Key discussion points include the security model (restricting deserialization to declared closures as defense-in-depth against call gadgets), serialization format stability across code changes, handling of private method access during unserialization, and whether to split the RFC or offer a reflection-only variant without the serialize() integration.
116 Impressions