PHP 8.4 Deprecated features - unserialize() with `allowed_classes => true`

[ImperialCrise]

What type of issue is this?

Incorrect/unexpected/unexplainable behavior

Operating system + version

Linux

PHP version

8.4.5

Connector/Database version (if applicable)

No response

Phpfastcache version

9.2.0 ✅

Describe the issue you're facing

Hello,

In the file phpfastcache/lib/Phpfastcache/Core/Pool/DriverBaseTrait.php, the unserialize() function is currently used with the option ['allowed_classes' => true]:

protected function unserialize(?string $value): mixed
{
    return $value ? \unserialize($value, ['allowed_classes' => true]) : null;
}

However, starting with PHP 8.4, passing true to allowed_classes is deprecated and will result in a fatal error. According to the [PHP 8.4 changelog](https://www.php.net/manual/en/migration84.deprecated.php), this argument must now be either:

• An array of class names,
• false (to disallow all classes), or
• true was previously allowed but is now disallowed entirely.

Now throws TypeErrors and ValueErrors if the allowed_classes element of options is not an array of class names.

Suggested fix:
If the intent is to allow all classes, the recommendation would be to omit the allowed_classes option entirely or update it to the default behavior, depending on the security model of the library.

Best regards,
iCrise

Expected behavior

No response

Code sample (optional)

No response

Suggestion to fix the issue (optional)

No response

References (optional)

No response

Do you have anything more you want to share? (optional)

No response

Have you searched in our Wiki before posting ?

• I have searched over the Wiki

[github-actions]

Hello curious contributor !
Since it seems to be your first contribution, make sure that you've been:

• Reading and searching out our WIKI
• Reading and agreed with our Code Of Conduct
• Reading and understood our Coding Guideline
• Reading our README
  If everything looks unclear to you, tell us what 😄
  The Phpfastcache Team

[Geolim4]

Hello,

Can you test something for me ?

    return $value ? \unserialize($value, ['allowed_classes' => true]) : null;

by

    return $value ? \unserialize($value, ['allowed_classes' => ['*']]) : null;

then tell me if it's working ?

Can you replace

[Geolim4]

@ImperialCrise bump !

[ImperialCrise]

Hi,
As discussed in the PHP repository regarding this change for this specific PHP version, the issue has been closed with no further action required because there’s no fatal error like that.

[Geolim4]

Can you please be more explicit about this PHP version ? I might need to apply a php-specific patch ? I'm curious !