Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:129130
Precedence: list
MIME-Version: 1.0
Date: Fri, 07 Nov 2025 11:57:22 +0100
To: Dmytro Kulyk <lnkvisitor.ts@gmail.com>
Cc: Ilija Tovilo <tovilo.ilija@gmail.com>, PHP internals
 <internals@lists.php.net>
Subject: Re: [PHP-DEV] [RFC][Discussion] Add #[NoSerialize] attribute for
 excluding properties or classes from serialization
In-Reply-To: <CAPqq82vbQzUidGG1h=hLhz7fxRrdZFav1RDjBw83aA0vqmpgUw@mail.gmail.com>
References: <CAPqq82sqFy1y77XLu8Kbncg18WNopeJdPrfB+JQ8FWNZ4XpTQg@mail.gmail.com>
 <CAPyj-LBG0nR75AUMXT0XCnpNnPP=T62NYvRQ34yeZpd+i=cTPw@mail.gmail.com>
 <CAPqq82sy1O9-J4yhvcPvsob3Rjdi1wFDW_t597850sBTbKc=sg@mail.gmail.com>
 <4b6abc36d8ab6cd306e95141869db3b0@bastelstu.be>
 <CAPqq82u7xhMDqmwuhEPOGqHdnrM3S2OM+HG=XpG-SyKPS3LofA@mail.gmail.com>
 <21ff8dee5016a1b7ecc412c44233abd1@bastelstu.be>
 <CAPqq82vPdraqE1DuJQ6w4pWpwr1koTHcj_o0pKV1dXxRoaguqg@mail.gmail.com>
 <3a20b5ef66fc23de6bad022685b41190@bastelstu.be>
 <CAPqq82vbQzUidGG1h=hLhz7fxRrdZFav1RDjBw83aA0vqmpgUw@mail.gmail.com>
Message-ID: <4e3061bfaa5218309041460d31be2856@bastelstu.be>
Content-Type: text/plain; charset=UTF-8;
 format=flowed
Content-Transfer-Encoding: 8bit
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=C3=BCsterhus?=)

Hi

Am 2025-11-07 01:13, schrieb Dmytro Kulyk:
> I’ve updated the RFC to include the new class-level behavior —
> applying #[NoSerialize] to a class now forbids its serialization by
> throwing, using the same internal mechanism as built-in
> non-serializable classes (e.g., CurlHandle, Random\Engine\Secure).
> 
> This update aligns the proposal with existing engine semantics and
> unifies both property-level skipping and class-level prohibition under
> a single attribute.
> The inheritance model has also been clarified: class-level
> #[NoSerialize] is inherited (“sticky”) and cannot be overridden in
> subclasses.
> 
> Updated RFC:
> https://wiki.php.net/rfc/no_serialize_attribute

Thank you. The updated RFC is looking good to me. I also appreciate that 
you kept a changelog within the RFC.

One thing you could mention and that should be done as part of the RFC 
is migrating all existing classes with `@not-serializable` to make use 
of the attribute instead. That's also what has been done when the 
`#[\Deprecated]` attribute was introduced. Other than that, I don't have 
any further comments.

Best regards
Tim Düsterhus