Skip to content
Worker Safety

WS001 · Mutable static property

Default severity: HIGH · Framework: Any

What it checks

Section titled “What it checks”

Static properties are bound to the PHP process, not to the request. Under a persistent worker any value written during one request stays visible to every later request served by the same worker. Singleton instance holders are reported by WS004 instead.

What to review

Section titled “What to review”
  • Move the value into a request-scoped service and inject it where it is needed.
  • If the value really is shared, make it immutable: a constant, a readonly instance property or a value object.
  • Otherwise reset the property explicitly at the start or the end of every request.

Inspect this rule

Section titled “Inspect this rule”
Terminal window
vendor/bin/worker-safety rules WS001

Accepting a reviewed risk

Section titled “Accepting a reviewed risk”

Use a targeted suppression or a baseline only after reviewing the value’s origin and lifetime. Changing an assignment elsewhere may not invalidate an existing property-level suppression.