Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
Related to https://www.drupal.org/sa-core-2026-005.
There are no core usages of serialized_field_property_names however it requires to support serialized PHP.
I can only find one contrib usage via https://search.tresbien.tech/search?q=serialized_field_property_names&nu...
Let's deprecate support, and also provide a killswitch so that modules can skip the logic if they're confident they don't need it.
Originally was going to open this purely as a performance issue, but then when the security report came in, it makes sense to do it for that reason too - actual code change should be the same.
Steps to reproduce
Proposed resolution
Remaining tasks
User interface changes
Introduced terminology
API changes
Data model changes
Release notes snippet
Issue fork drupal-3603923
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #2
catchComment #4
catchOne unit test was using fake serialized properties purely to avoid a static ::schema() call on a mocked object (which is illegal). Addressed that by using a real object with mocked dependencies instead of the mock, which can then do the static schema() call because it's the actual class. The test itself has nothing to do with this feature.
Also kernel tests for this actual functionality now need to become deprecation tests.
Comment #5
heddnSeems like a reasonable thing to do. I've never heard of the feature, so it must not be well documented. We still mention it in https://git.drupalcode.org/project/drupal/-/blob/main/core/lib/Drupal/Co... though.