A PHP internals RFC discussion proposes making closures used in attribute arguments and parameter defaults (introduced in PHP 8.5) serializable. Currently these static closures that capture nothing silently break serialize()-based metadata caches. The RFC suggests serializing them as references to their declaration site. A respondent raises concerns about the fragility of the proposed serialization format, suggests splitting the RFC into two (one for closures, one for first-class callables), and argues the security model may be overly cautious since unserialized closures are 'inert' until called.
65 Impressions