WS009 · Persistent event/listener registration

Default severity: MEDIUM · Framework: Any

Severity is contextual

This is the default severity, not a guarantee for every finding. The implementation and configured overrides determine the reported severity. Runtime targets describe a compatibility analysis, not a detected deployment.

What it checks

Event listeners, macros and handler callbacks are registered into structures that live for the whole worker process. Registering them while serving a request means the registry grows on every request and listeners from earlier requests keep firing.

What to review

• Register listeners, macros and handlers once, during boot: a service provider, or the worker bootstrap file.
• If the registration depends on request data, invoke the behaviour directly instead of registering a listener for it.
• Where a per-request listener is unavoidable, remove it again before the request ends.

Inspect this rule

vendor/bin/worker-safety rules WS009

Accepting a reviewed risk

Use a targeted suppression or a baseline only after reviewing the value’s origin and lifetime. Changing an assignment elsewhere may not invalidate an existing property-level suppression.