Skip to content
Worker Safety

WS008 · Static collection growth

Default severity: MEDIUM · Framework: Any

What it checks

Section titled “What it checks”

A static array that is appended to on every request never releases its entries. Under PHP-FPM the engine tears down the request context and the memory goes away; under a persistent worker the same context stays alive, so the array accumulates until the worker is recycled or the memory limit is hit.

What to review

Section titled “What to review”
  • Bound the collection: cap its size, or key it so that entries are reused instead of added.
  • Clear it at the end of every request. Under Laravel Octane that means a RequestTerminated listener that calls your reset: octane.flush only forgets container bindings, it does not empty static properties.
  • Move the cache into a real cache backend with a TTL, so eviction is somebody else’s problem.

Inspect this rule

Section titled “Inspect this rule”
Terminal window
vendor/bin/worker-safety rules WS008

Accepting a reviewed risk

Section titled “Accepting a reviewed risk”

Use a targeted suppression or a baseline only after reviewing the value’s origin and lifetime. Changing an assignment elsewhere may not invalidate an existing property-level suppression.