Accepted · Targets PHP 9

Replace the Serializable interface

PHP 8.1 deprecated Serializable implementations without the new magic methods. PHP 9 removes the interface. Move to __serialize() and __unserialize(), remove implements Serializable, and plan compatibility for stored serialized data.

Published October 14, 2026 · Last verified October 14, 2026

Read the RFC · Vote closed 2021-04-28 ↗

Before

class Note implements Serializable { /* ... */ }

After

class Note {
    public function __serialize(): array { return []; }
    public function __unserialize(array $data): void { /* restore */ }
}

Why change it?

The interface's nested serialization behavior creates correctness and security problems. The magic methods separate data collection from encoding.

Find it today.

Use this search or static-analysis diagnostic as a first pass. Review each result: text searches find candidates and miss cases that require type or control-flow analysis.

rg -n 'Serializable|FETCH_SERIALIZE' app --glob '*.php'

Make the fix earn its place.

Add a test for the path that relied on the old behavior. Check your dependencies as well as your own code, then run with all warnings and deprecations enabled. These examples show the syntax change; adapt them to your application's data and behavior.

Follow the upgrade checklist ↗