Skip to content

Add max_depth option to unserialize() callmap type#11702

Open
eyupcanakman wants to merge 1 commit intovimeo:6.xfrom
eyupcanakman:fix/unserialize-max-depth-11295
Open

Add max_depth option to unserialize() callmap type#11702
eyupcanakman wants to merge 1 commit intovimeo:6.xfrom
eyupcanakman:fix/unserialize-max-depth-11295

Conversation

@eyupcanakman
Copy link

@eyupcanakman eyupcanakman commented Mar 2, 2026

Fix #11295

PHP 7.4 added max_depth as an option to unserialize(), but Psalm's callmap only declared allowed_classes in the array shape -- causing a false-positive InvalidArgument error.

This PR adds max_depth?: int to the options type, version-gated to PHP 7.4+ via a new entry in CallMap_74_delta.php.

https://www.php.net/manual/en/function.unserialize.php

PHP 7.4 added max_depth as an option to unserialize(), but Psalm's
callmap only declared allowed_classes in the array shape, causing a
false-positive InvalidArgument error.

Add max_depth?: int to the options type, version-gated to PHP 7.4+
via CallMap_74_delta.php. Add regression tests for both valid usage
and invalid type detection.

Fix vimeo#11295
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

InvalidArgument error when using max_depth option with unserialize function

1 participant