---
title: "Breaking: #108285 - Core uses __serialize() and __unserialize() methods"
manual: "TYPO3 Core Changelog"
version: "main"
permalink: "https://docs.typo3.org/permalink/changelog:breaking-108285-1792310400"
source: "Changelog/15.0/Breaking-108285-SerializeAndUnserializeMagicMethods.rst"
typo3-version: "15.0"
typo3-major: 15
type: "breaking"
issue: 108285
forge: "https://forge.typo3.org/issues/108285"
tags: ["PHP-API", "NotScanned"]
rendered: "2026-10-27T20:58:30+00:00"
---

# Breaking: #108285 - Core uses \_\_serialize() and \_\_unserialize() methods {#breaking-108285-1792310400}

See [forge#108285](https://forge.typo3.org/issues/108285)

## Description {#description}

PHP 8.5 deprecates the magic methods `__sleep()` and `__wakeup()`
in favor of `__serialize()` and `__unserialize()`. All TYPO3 Core
classes have been migrated to the new methods:

-   `\TYPO3\CMS\Core\Log\Logger`
-   `\TYPO3\CMS\Core\Resource\FileReference`
-   `\TYPO3\CMS\Core\Security\BlockSerializationTrait`
-   `\TYPO3\CMS\Extbase\Persistence\Generic\Query`
-   `\TYPO3\CMS\Extbase\Persistence\Generic\QueryResult`
-   `\TYPO3\CMS\Extbase\Persistence\Generic\Typo3QuerySettings`
-   `\TYPO3\CMS\Extbase\Reflection\ReflectionService`
-   `\TYPO3\CMS\Form\Domain\Finishers\FinisherVariableProvider`

`\TYPO3\CMS\Extbase\DomainObject\AbstractDomainObject`, the base
class of all Extbase entities and value objects, implements
`__serialize()` and `__unserialize()` as well.

The internal deserializer used by `\TYPO3\CMS\Core\Registry` and
by upgrade wizards now also rejects classes with a user-defined
`__unserialize()` method, unless that method is provided by
`\TYPO3\CMS\Core\Security\BlockSerializationTrait` or the class is
listed in
`$GLOBALS['TYPO3_CONF_VARS']['SYS']['deserialization']['allowedClassNames']`.

## Impact {#impact}

When a class or one of its parents implements `__serialize()` or
`__unserialize()`, PHP no longer calls `__sleep()` or
`__wakeup()`. Such methods in classes extending one of the classes above,
including any Extbase domain model, are silently ignored.

Serialized data written before the update, for example in caches, sessions or
the state of a form, may no longer be restored correctly.

## Affected installations {#affected-installations}

Installations with extensions that implement `__sleep()` or
`__wakeup()` in a class extending one of the classes mentioned above,
especially in Extbase domain models extending
`\TYPO3\CMS\Extbase\DomainObject\AbstractEntity` or
`\TYPO3\CMS\Extbase\DomainObject\AbstractValueObject`, or that
call `parent::__sleep()` or `parent::__wakeup()` of these classes.

## Migration {#migration}

Replace `__sleep()` with `__serialize()`, which returns an array of
the data to be serialized, and `__wakeup()` with `__unserialize()`,
which receives that array and restores the object state. Call the parent
methods where the parent class implements them:

**Before**

```php
public function __sleep(): array
{
    return ['title'];
}

public function __wakeup(): void
{
    $this->initializeRuntimeState();
}
```

**After**

```php
public function __serialize(): array
{
    return ['title' => $this->title];
}

public function __unserialize(array $data): void
{
    $this->title = $data['title'];
    $this->initializeRuntimeState();
}
```

Flush all caches after the update. Pending form submissions and session data
containing serialized objects of the affected classes have to be re-created.