Skip to content

Conversation

oleibman
Copy link
Collaborator

Php8.5 may deprecate the use of __wakeup (it is planned, but not yet implemented, and it is convtroversial). We use it only twice. In the first instance, it just throws an exception to prevent a security exploit. This can be trivially replaced with __unserialize.

The other instance is merely to initialize a Worksheet instance variable. Converting this use to __unserialize is not trivial (one of the reasons for the controversy). However, I see no useful purpose for that variable. Since it has no use, there is no real need for __wakeup, so we will just remove the routine altogether, and deprecate the variable's getter (there is no setter).

A similar instance variable in Spreadsheet also serves no useful purpose, so we will deprecate its getter as well (again no setter).

This is:

  • a bugfix
  • a new feature
  • refactoring
  • additional unit tests
  • Php compatibility

Checklist:

  • Changes are covered by unit tests
    • Changes are covered by existing unit tests
    • New unit tests have been added
  • Code style is respected
  • Commit message explains why the change is made (see https://github.com/erlang/otp/wiki/Writing-good-commit-messages)
  • CHANGELOG.md contains a short summary of the change and a link to the pull request if applicable
  • Documentation is updated as necessary

Why this change is needed?

Provide an explanation of why this change is needed, with links to any Issues (if appropriate).
If this is a bugfix or a new feature, and there are no existing Issues, then please also create an issue that will make it easier to track progress with this PR.

Php8.5 *may* deprecate the use of `__wakeup` (it is planned, but not yet implemented, and it is convtroversial). We use it only twice. In the first instance, it just throws an exception to prevent a security exploit. This can be trivially replaced with `__unserialize`.

The other instance is merely to initialize a Worksheet instance variable. Converting this use to `__unserialize` is *not* trivial (one of the reasons for the controversy). However, I see no useful purpose for that variable. Since it has no use, there is no real need for `__wakeup`, so we will just remove the routine altogether, and deprecate the variable's getter (there is no setter).

A similar instance variable in Spreadsheet also serves no useful purpose, so we will deprecate its getter as well (again no setter).
@oleibman oleibman added this pull request to the merge queue Sep 12, 2025
Merged via the queue into PHPOffice:master with commit 5179fff Sep 12, 2025
14 checks passed
@oleibman oleibman deleted the wakeup branch September 12, 2025 05:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

1 participant