Would this affect unserialize()? I ask because MediaWiki's main "text" database table is an immutable/append-only store where we store the text of each page revision since ~2004. It is stored as serialised blobs of a value class. There have been a number of different implementations over the past twenty years of Wikipedia's existence (plain text, gzip-compressed, diff-compressed, etc.).
When we adopted modern autoloading in MediaWiki, we quickly found that blobs originally serialized by PHP 4 actually encoded the class in lowercase, regardless of the casing in source code. >From https://3v4l.org/jl0et: > class ConcatenatedGzipHistoryBlob {…} > print serialize($blob); > # PHP 4.x: O:27:"concatenatedgziphistoryblob":… > # PHP 5/7/8: O:27:"ConcatenatedGzipHistoryBlob":… It is of course the application's responsibility to load these classes, but, it is arguably PHP's responsiblity to be able to construct what it serialized. I suppose anything is possible when announced as a breaking change for PHP 9.0. I wanted to share this as something to take into consideration as part of the impact. Potentially worthy of additional communicating, or perhaps worth supporting separately. -- Timo Tijhof, Principal Engineer, Wikimedia Foundation. https://timotijhof.net/
