WS005 · Laravel container singleton with mutable state

Default severity: HIGH · Framework: laravel

Severity is contextual

This is the default severity, not a guarantee for every finding. The implementation and configured overrides determine the reported severity. Runtime targets describe a compatibility analysis, not a detected deployment.

What it checks

A singleton() binding is resolved once and then reused. Octane keeps the container between requests, so the same instance — and everything written into it — is handed to every request the worker serves.

What to review

• Consider $this->app->scoped(): Octane discards scoped instances between requests. Check first what else resolves this class — anything that outlives a request and took it through the constructor keeps the instance it already has, so the binding changes while that consumer does not.
• Or make the service immutable and pass the per-request values in as method arguments. That removes the question of lifetime instead of answering it.
• If the binding must stay a singleton, reset its state in a RequestReceived listener.

Inspect this rule

vendor/bin/worker-safety rules WS005

Accepting a reviewed risk

Use a targeted suppression or a baseline only after reviewing the value’s origin and lifetime. Changing an assignment elsewhere may not invalidate an existing property-level suppression.