Unserialize Exception with Php 8.6

[oleibman]

Description

The following code:

<?php

require __DIR__ . '/PhpSpreadsheet' . '/vendor/autoload.php';

use PhpOffice\PhpSpreadsheet\Shared\XMLWriter;

class XmlWriterTest
{
    public function testUnserialize(): void
    {
        $className = XMLWriter::class;
        $classLen = strlen($className);
        $text = "O:$classLen:\"$className\":1:{";
        $text2 = "\x00$className\x00tempFileName";
        $text2Len = strlen($text2);
        $text .= "s:$text2Len:\"$text2\"";
        $text .= ';s:0:"";}';
        unserialize($text);
        echo "done\n";
    }
}

$obj = new XmlWriterTest();
$obj->testUnserialize();

Resulted in this output:

PHP Fatal error:  Uncaught Exception: Unserialization of 'PhpOffice\PhpSpreadsheet\Shared\XMLWriter' is not allowed in C:\git\XmlWriterTest.php:18
Stack trace:
#0 C:\git\XmlWriterTest.php(18): unserialize()
#1 C:\git\XmlWriterTest.php(24): XmlWriterTest->testUnserialize()
#2 {main}
  thrown in C:\git\XmlWriterTest.php on line 18

But I expected this output instead:

Fatal error: Uncaught PhpOffice\PhpSpreadsheet\Exception: Unserialize not permitted in C:\git\PhpSpreadsheet\src\PhpSpreadsheet\Shared\XMLWriter.php on line 72

This is not precisely a problem, but it is a change in behavior. The class which I am trying to unserialize has the following method:

    public function __unserialize(array $data): void
    {
        $this->tempFileName = '';

        throw new SpreadsheetException('Unserialize not permitted');
    }

So, throwing an exception is the desired result. But the change in behavior is not described in any of the "what's new with Php 8.6" sites that I've looked at. Can you point me to something which describes the change so that I can update my test, and my expected coverage, properly?
This difference has shown up only within the last few days.

PHP Version

PHP 8.6.0-dev (cli) (built: Aug  8 2026 23:41:53) (ZTS Visual C++ 2026 x64)
Copyright © The PHP Group and Contributors
Zend Engine v4.6.0-dev, Copyright © Zend by Perforce
    with Zend OPcache v8.6.0-dev, Copyright ©, by Zend by Perforce

Operating System

Windows 11. Also on Ubuntu latest on Github

[arshidkv12]

Please check 4782ec5

[oleibman]

Thank you. I have my answer, closing issue.