[6.x] Fix serializable_classes issues#14443
Merged
jasonvarga merged 5 commits into6.xfrom Apr 7, 2026
Merged
Conversation
The registerSerializableClasses() method was eagerly converting an unconfigured (null) cache.serializable_classes into a restrictive allowlist on every boot, causing Response objects stored by the API and GraphQL cachers to deserialize as __PHP_Incomplete_Class. Make registerSerializableClasses() opt-in (only merge when the config is already an array), and store response data as primitives instead of full Response objects in both cachers. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fixes getData() not existing on base Response, which broke tests that depend on JsonResponse behavior from cached responses. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Laravel's JsonResponse has an extra $options parameter before $json, so passing true as the 4th arg set encoding options instead of enabling raw JSON mode, causing double-encoding of cached responses. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When serializable_classes is false (Laravel 13 default), the guard treated it the same as null/true and skipped registration. But false means "restrict to no classes", so unserialize() blocked all Stache objects. Now only null and true (both unrestricted) are skipped. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
|
I think this is related? statamic/eloquent-driver#564 |
Member
Author
|
Yeah |
Users with passkeys would get incomplete class errors when their cached User object was unserialized, since the Passkey classes weren't in the allowlist. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
jasonvarga
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
registerSerializableClasses()opt-in in bothAppServiceProviderandAddonServiceProvider. Previously it eagerly converted an unconfigured (null)cache.serializable_classesinto a restrictive allowlist on every boot, which caused cached Response objects to deserialize as__PHP_Incomplete_Class.API\Cachers\DefaultCacherandGraphQL\ResponseCache\DefaultCache. Instead of caching full Response objects (which require class allowlisting), storecontent,status, andheadersas an array and reconstruct on cache hit. Old cached Response objects are treated as cache misses and re-cached in the new format.serializable_classeshandling when config isfalse(the Laravel 13 default). The guard was treatingfalsethe same asnull/trueand skipping registration, butfalsemeans "restrict to no classes", breaking all Stache deserialization. Now onlynullandtrue(both unrestricted) are skipped.JsonResponseconstructor to use a namedjson:argument, since Laravel'sJsonResponsehas an extra$optionsparameter before$jsoncompared to Symfony's.serializable_classesallowlist. Users with passkeys would get incomplete class errors when their cached User object was unserialized, sinceStatamic\Auth\File\PasskeyandStatamic\Auth\Eloquent\Passkeyweren't in the allowlist.Fixes the 500 error on GraphQL POST requests after upgrading to 6.10.0:
Test plan
RequestCacheTestandCacherTestsuites passserializable_classesconfigured🤖 Generated with Claude Code