Closed (fixed)
Project:
Token Filter
Version:
2.1.x-dev
Component:
Code
Priority:
Normal
Category:
Feature request
Assigned:
Unassigned
Reporter:
Created:
5 Jun 2026 at 14:54 UTC
Updated:
22 Jun 2026 at 02:25 UTC
Jump to comment: Most recent
Comments
Comment #3
darvanenSure we can start this now... this is the first time I'm approaching 12 - what do you reckon the upgrade status module means by "unsafe new static()"? That's how we used to do DI, I guess it must have changed?
Comment #4
lostcarpark commentedI believe the reason why
new static()is considered unsafe is because if another class inherits this one, and adds to the constructor, but doesn't also override thecreate()function, it will fail.One option is to mark the class "final", which will prevent it from being inherited.
A less drastic option is to replace
new static()withnew self(). This will mean thatcreate()will always create an instance of the class it's implemented in, which means an inherited class will always need to override it.In the longer term, autowiring will allow
create()functions to disappear altogether. Plugins support this from Drupal 11.3, so you could just deletecreate()functions and it will work anything above that. However, if you want to continue supporting D10, probably should keep them for now.Happy to change to use
new self()if you would like.Comment #5
darvanenThanks for the explanation 🙏
I do want to keep supporting D10 while it is still in support, so yes please go ahead with
new self()thank you 🙇♂️Comment #6
lostcarpark commentedI don't think
new self()will work for plugins, because it doesn't match the function prototype.So I think the options are mark the classes
final(and if we do that, we need to remove fromignoreErrorsin phpstan.neon, or we could just acknowledge the Upgrade Status findings and allow it to fail.I'm not sure if there's a way to tell Upgrade Status to ignore an error.
Comment #7
lostcarpark commentedGabor linked me to this issue: #3579468: Module reports phpstan "Unsafe usage of new static()" errors
It seems that Upgrade Status will no longer warn about
unsafe use of new static, so this warning will go away once Gitlab CI updates to the new version.I would be inclined to leave the
new static()calls alone in light of this.Comment #8
lostcarpark commentedReverted back to plain
new static().Everything currently passing except Upgrade Status, but hopefully when Gitlab CI updates to the latest version, that will also pass.
Note that "phpstan (previous major)" validates attributes, but D10 doesn't know about many of the D11+ attributes, so I use a
sedscript to remove them for that task only.Comment #9
darvanenYeah cool, thanks very much for looking into it! Good to know the outcome, very happy to merge with that evidence.
Comment #11
darvanen