PHP v8.2: Deprecation notices when unserializing array-like objects

[jyoung-uf]

Bug Report

• Yes, I reviewed the contribution guidelines.
• Yes, more specifically, I reviewed the guidelines on how to write clear bug reports.

Describe the current, buggy behavior

Running the wp search-replace command with PHP v8.2 on a database with serialized instances of CaseInsensitiveDictionary may result in deprecation notices. Our multisite makes extensive use of RSS feeds that store SimplePie responses as transients. The headers for these appear to be the source of the notices:

PHP Deprecated:  Creation of dynamic property WpOrg\Requests\Utility\CaseInsensitiveDictionary::$date is deprecated in /var/www/test.site.ufl.edu/vendor/wp-cli/search-replace-command/src/WP_CLI/SearchReplacer.php on line 130
PHP Deprecated:  Creation of dynamic property WpOrg\Requests\Utility\CaseInsensitiveDictionary::$server is deprecated in /var/www/test.site.ufl.edu/vendor/wp-cli/search-replace-command/src/WP_CLI/SearchReplacer.php on line 130
PHP Deprecated:  Creation of dynamic property WpOrg\Requests\Utility\CaseInsensitiveDictionary::$vary is deprecated in /var/www/test.site.ufl.edu/vendor/wp-cli/search-replace-command/src/WP_CLI/SearchReplacer.php on line 130
...

Describe how other contributors can replicate this bug

• Use PHP 8.2 or later.
• Pass serialized data containing WpOrg\Requests\Utility\CaseInsensitiveDictionary objects to the SearchReplacer::run() method. See example below.
• Ensure the serialized object contains properties that are not explicitly declared in the class definition.
• Observe the deprecation notices in the logs.

Example serialized string that triggers the issue (feed items have been omitted for concision and clarity):

'a:5:{s:4:"type";i:512;s:7:"headers";O:48:"WpOrg\Requests\Utility\CaseInsensitiveDictionary":1:{s:7:" * data";a:10:{s:4:"date";s:29:"Wed, 28 May 2025 23:53:30 GMT";s:6:"server";s:13:"Apache/2.4.37";s:12:"x-powered-by";s:10:"PHP/8.2.25";s:16:"content-encoding";s:4:"gzip";s:4:"vary";s:22:"Accept-Encoding,Cookie";s:13:"last-modified";s:29:"Wed, 28 May 2025 16:00:52 GMT";s:14:"content-length";s:5:"21831";s:13:"cache-control";s:12:"max-age=3600";s:7:"expires";s:29:"Thu, 29 May 2025 00:53:30 GMT";s:12:"content-type";s:35:"application/atom+xml; charset=UTF-8";}}s:5:"build";i:1746031969;s:21:"cache_expiration_time";i:1748519610;s:23:"__cache_expiration_time";i:1748519610;}'

Describe what you would expect as the correct outcome

No deprecation notices.

Environment

OS:	Linux 5.14
Shell:	/bin/bash
PHP version:	8.2.25
php.ini used:	/etc/php.ini
MySQL version:	mariadb  Ver 15.1 Distrib 10.11.10-MariaDB
SQL modes:	
WP-CLI root dir:	/var/www/test.site.ufl.edu/vendor/wp-cli/wp-cli
WP-CLI vendor dir:	/var/www/test.site.edu/vendor
WP_CLI phar path:	
WP-CLI packages dir:	
WP-CLI global config:	
WP-CLI project config:	
WP-CLI version:	2.12.0

Provide a possible solution

Since CaseInsensitiveDictionary implements an array-like interface, perhaps augmenting the check for these here would prevent falling through to the object case where dynamic property assignment occurs.

search-replace-command/src/WP_CLI/SearchReplacer.php

Line 112 in b7b186a

} elseif ( is_array( $data ) ) {

Maybe something like this to account for both arrays and iterable objects:

//...
} elseif ( is_array( $data ) || $data instanceof \Traversable ) { // PHP 5.6, 7, 8 compat
//...

For now, we've determined that we can silence our logs by passing the --no-recurse-objects flag, as most of these are non-essential for our testing environment, but we did want to make you all aware of the potential issue as PHP versions are bumped.