spatie/laravel-data 4.23.1

on PHP Packagist

A new allowedClasses option for UnserializeCast, and a round of PHPStan fixes.

Add allowedClasses option to UnserializeCast (#1220)

UnserializeCast called unserialize() without any restrictions, so every class in your application could be created from the serialized value. You can now limit which classes are allowed with the new allowedClasses option, which is passed to unserialize() as allowed_classes:

class SongData extends Data
{
    public function __construct(
        public string $title,
        #[WithCast(UnserializeCast::class, allowedClasses: [SongMetadata::class])]
        public SongMetadata $metadata,
    ) {
    }
}

Classes outside the list become a __PHP_Incomplete_Class object, and passing false only allows scalar values and arrays. The default stays true, so existing casts keep working as before. The cast is now also documented, including a note not to use it on user input.

Thanks @rubenvanassche.

Fix PHPStan errors after PHPStan 2.3 update (#1221)

PHPStan 2.3 stopped reporting a few errors that were in the baseline, which made the PHPStan workflow fail. The baseline is regenerated, a redundant check in DataMethod is removed, and the type assertion for cursor paginators is updated. There are no behaviour changes.

Thanks @rubenvanassche.

What's Changed

• Add allowedClasses option to UnserializeCast by @rubenvanassche in #1220
• Fix PHPStan errors after PHPStan 2.3 update by @rubenvanassche in #1221

Full Changelog: 4.23.0...4.23.1