WS006 · Laravel scoped binding candidate

Default severity: MEDIUM · Framework: laravel

Severity is contextual

This is the default severity, not a guarantee for every finding. The implementation and configured overrides determine the reported severity. Runtime targets describe a compatibility analysis, not a detected deployment.

What it checks

Laravel offers a third lifetime between bind() (new instance every resolve) and singleton() (one instance forever): scoped(). A scoped instance is created once per request and discarded when the request ends, which is exactly what a request context object needs.

What to review

• Check how long the instance is meant to live and who resolves it, then decide. scoped() is the right lifetime for per-request state, but it is a lifetime change, not a drop-in.
• Look for consumers that outlive a request: a singleton (or any longer-lived object) that takes this class in its constructor captures the first instance and keeps it, so the binding changes while that consumer does not.
• Check what the instance carries across resolves today — a warmed cache, a connection, a lazily built index. Under scoped() that work happens once per request instead of once per worker.
• Once the lifetime is right, Octane flushes scoped instances between requests, so no manual reset listener is needed for them.

Inspect this rule

vendor/bin/worker-safety rules WS006

Accepting a reviewed risk

Use a targeted suppression or a baseline only after reviewing the value’s origin and lifetime. Changing an assignment elsewhere may not invalidate an existing property-level suppression.