{"record":{"id":"443d460fb1fd9e2c","repo":"briannesbitt/Carbon","slug":"invalid-serialized-value-value","errorCode":null,"errorMessage":"Invalid serialized value: $value","messagePattern":"Invalid serialized value: \\$value","errorType":"exception","errorClass":"InvalidFormatException","httpStatus":null,"severity":"error","filePath":"src/Carbon/Traits/Serialization.php","lineNumber":96,"sourceCode":"     *\n     * @example\n     * ```php\n     * $object = Carbon::fromSerialized($value, ['allowed_classes' => [Carbon::class, CarbonImmutable::class]]);\n     * ```\n     *\n     * @param \\Stringable|string $value\n     * @param array              $options example: ['allowed_classes' => [CarbonImmutable::class]]\n     *\n     * @throws InvalidFormatException\n     *\n     * @return static\n     */\n    public static function fromSerialized($value, array $options = []): static\n    {\n        $instance = @unserialize((string) $value, $options);\n\n        if (!$instance instanceof static) {\n            throw new InvalidFormatException(\"Invalid serialized value: $value\");\n        }\n\n        return $instance;\n    }\n\n    /**\n     * The __set_state handler.\n     *\n     * @param string|array $dump\n     *\n     * @return static\n     */\n    #[ReturnTypeWillChange]\n    public static function __set_state($dump): static\n    {\n        if (\\is_string($dump)) {\n            return static::parse($dump);\n        }","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/briannesbitt/Carbon/blob/b13f05955dcfd7da71d60af745fd148cbdb73505/src/Carbon/Traits/Serialization.php#L78-L114","documentation":"fromSerialized() runs PHP unserialize() (error-suppressed) on the payload and requires the result to be an instance of the class it was called on. If unserialize() returns false, triggers a fatal, is blocked by the allowed_classes option, or yields a different class (e.g. a Carbon stored but fromSerialized called on CarbonImmutable), Carbon throws InvalidFormatException. It exists as the single decoding gate for data produced by serialize($date).","triggerScenarios":"Unserialize a Carbon payload written by an older Carbon major version (class layout/renames make the payload invalid); calling Carbon::fromSerialized(json_encode($date)) with JSON instead of PHP serialize format; passing a truncated/corrupted blob from cache or DB; options ['allowed_classes' => [...]] that omit the target class; storing a Carbon instance but reading it back via a subclass that does not extend it.","commonSituations":"Serialized Carbon objects in Redis/session/queue payloads that break after a Carbon 2-to-3 upgrade or a project namespace move; cache entries not invalidated after deploy; mixing serialization formats (JSON on write, fromSerialized on read); security-hardened unserialize settings that disable class loading.","solutions":["Stop storing PHP-serialized objects: write ->toISOString() (or format('Y-m-d H:i:s.u e O')) and read back with Carbon::parse() - ISO strings survive upgrades and cross-language use","Flush/regenerate the stale serialized cache entries after upgrading Carbon or renaming classes","Verify you are calling fromSerialized on the exact class (or a parent) that was serialized, and that allowed_classes includes it","Catch InvalidFormatException and rebuild the date from a canonical fallback (e.g. created_at column or 'now') while logging the bad payload"],"exampleFix":"// before\n$cache->put('since', serialize($startDate));\n$since = Carbon::fromSerialized($cache->get('since'));\n\n// after\n$cache->put('since', $startDate->toISOString());\n$since = Carbon::parse($cache->get('since'));","handlingStrategy":"try-catch","validationCode":"// Cheap sanity check before unserialize: serialized Carbon starts with 'O:' or 'C:'\nif (!is_string($payload) || !preg_match('/^[OC]:\\d+:/', $payload)) {\n    throw new InvalidArgumentException('Not a PHP-serialized object payload');\n}","typeGuard":"function looksSerializedObject(mixed $value): bool\n{\n    return is_string($value) && preg_match('/^[OC]:\\d+:[\"\\\\]/', $value) === 1;\n}","tryCatchPattern":"use Carbon\\Exceptions\\InvalidFormatException;\n\ntry {\n    $since = Carbon::fromSerialized($cached);\n} catch (InvalidFormatException $e) {\n    $since = Carbon::parse($row['created_at']); // canonical fallback\n    $cache->put('since', $since->toISOString());  // heal the entry\n}","preventionTips":["Store ISO-8601 strings, not serialize() output, for anything crossing a deploy boundary","Version your cache keys so Carbon/PHP upgrades cannot serve old serialized payloads","After any class rename or Carbon major upgrade, plan a cache/session flush or a migration that re-encodes dates"],"tags":["php","carbon","serialization","cache-invalidation","upgrade"],"backgroundTag":"unserialize-failure","analyzedSha":"b13f05955dcfd7da71d60af745fd148cbdb73505","analyzedAt":"2026-08-17T04:40:56.953Z","schemaVersion":2},"datasetVersion":"2026-08-17T09:17:11.063Z"}