9.2.0-beta6 (2026-09-17)

Overview of merged pull requests

FEATURE: Runtime Constructor Injection

This changes constructor injection to happen at runtime by the ObjectManager. That means the constructor no longer needs to be proxied and loose it’s signature (Any other proxying happening, eg. AOP or other injection types will retain the signature now). It therefore also reduces the amount of proxies necessary in a project. Additionally to proof how this works some of the core classes now use exclusively constructor injection. The change also includes refactorings for type safety around the object configuration and proxy building.

NOTE This obviously breaks instantiating classes with constructor injection via new MyClass() omitting any arguments. IMHO that is very bad practice anyhow. As can be seen in this change (and I didn’t see anything in Neos either), it was only used in tests as of now. I think therefore we can relatively safely change this in a minor release?

  • Packages: .github Flow

FEATURE: Enable Xdebug Path Mapping in Development context per default

Enables the Xdebug Path Mapping per default in Development context.

See: https://github.com/neos/flow-development-collection/pull/3535

  • Packages: Flow

BUGFIX: Make Queries, QueryResults and Repositories generic and fix argument annotations

  • Make Query, QueryResult and Repository generic

  • Fix annotation of getArguments to reflect the fact that an exception is thrown if the argument is missing

  • Correct annotation of viewFormatToObjectNameMap

  • Packages: Flow

BUGFIX: Reduce breakiness by assuming controllers are initializes and have a request

Marking the $request in the abstract controller as a nullable property caused many downstream issues. Since the $request can only accept a Request it makes sense not to allow null as a value and assume initializeController is always called.

Upgrade instructions

  • Packages: Flow

BUGFIX: Support circular singleton dependencies

Since #3510, the Object Manager resolves the constructor arguments of an object itself, before the instance exists, and marks the class as being instantiated. At the same time, the generated proxy constructors lost the setInstance() call which registered a half-constructed singleton as their very first statement. That early registration was what allowed singletons to depend on each other: a re-entrant get() for an object which is currently being built returned that very instance. Without it, such object graphs – which are common in Flow applications and worked up to Flow 9.1 – fail with a “Circular dependency detected” exception while their dependencies are resolved.

The Object Manager now creates the instance of a singleton (or session scoped object) without calling its constructor, registers it, and only then resolves the constructor arguments and calls the constructor. If that fails, the registration is rolled back. This restores the 9.1 behavior at the place where dependencies are resolved today.

Prototypes cannot be registered up front, because each request must result in a new instance. Two prototypes depending on each other lead to an infinite recursion in 9.1 already, so the circular dependency guard keeps rejecting them – now with a meaningful exception instead of a stack overflow.

  • Fixes: #3618

  • Packages: Flow

BUGFIX: Unpack variadic parameters in proxies

A generated proxy method passes the parameters of the original method on to the parent method one by one. For a variadic parameter this means that the collected arguments are handed over as a single array, which results in a TypeError as soon as a proxied or advised method declares a variadic parameter.

The generated parent call now unpacks variadic parameters again. The same applies to the invocation of a join point at the end of an advice chain: a join point stores the arguments of a variadic parameter as one array, mapped to the name of that parameter, so that array needs to be unpacked before the method is called with the arguments taken from the join point.

  • Fixes: #3589

  • Packages: Flow

BUGFIX: Comment out final keyword of static methods

The regular expression which comments out the final keyword of methods that are overridden in a proxy class did not match methods declared as final public static function or similar combinations including the static keyword. As a consequence, a final static method annotated with Flow\\CompileStatic resulted in a “Cannot override final method” fatal error – but only in Production context, where CompileStatic methods are compiled into the proxy class.

The new expression covers all combinations of public, protected, static and final, methods returning by reference and method names consisting of a single character.

  • Fixes: #3592

  • Packages: Flow

BUGFIX: Preserve by-reference returns in proxies

Methods which are declared to return by reference (function &foo()) lost their reference semantics when the generated proxy method contained code before and after the parent call: the parent call was assigned to a local variable by value, therefore “return $result” returned a copy.

The proxy method generator now assigns the parent call by reference if the method itself returns by reference.

For advised methods this cannot be repaired: the return value passes through the join point and the advice chain by value, so the reference is lost by design. Instead of silently changing the semantics of such a method, the AdvisedMethodInterceptorBuilder now refuses to build the interceptor code and throws an exception while the proxy classes are compiled. The exception names the affected class and method and explains the possible ways out. Methods returning by reference which are introduced by an interface are covered as well.

Note that this is a change in behavior which should be mentioned in the release notes: a project with a pointcut which happens to match a method returning by reference will not compile anymore until the pointcut is adjusted. None of the Flow and Neos packages declare such methods.

  • Fixes: #3590

  • Packages: Flow

BUGFIX: Drop `setlocale() calls from Functions::pathinfo() <https://github.com/neos/flow-development-collection/pull/3607>`_

This avoids a (PHP) bug where following regex calls can change their behaviour.

See #3606

  • Packages: Flow Utility.Unicode

BUGFIX: Handle false model and pluralRulesSet in generateRulesets

This avoids Call to a member function getRawArray() on false.

  • Packages: Flow

BUGFIX: Call original method in void proxy methods

When proxy building adds only pre parent call code to a method – without any post code – and the method declares a void or never return type, the generated proxy method contains the pre code but no call to the original method: the original implementation is silently skipped.

This change renders the parent call (without a return statement, which is not allowed for these return types) like the branch for pre and post parent call code already does.

Note for the upmerge to 9.2: the unit test noParentCallIsRenderedForVoidAndNeverReturnTypesIfOnlyPreParentCallCodeExists introduced with #3596 <https://github.com/neos/flow-development-collection/issues/3596>``_documents the old behavior and needs to be inverted – the ``ProxyMethodGeneratorTest introduced with this change covers the corrected behavior and will conflict with the file of the same name from #3596.

  • Fixes: #3597

  • Packages: Flow

BUGFIX: Prevent reflecting non Flow classes in `couldHaveEntityRelations() <https://github.com/neos/flow-development-collection/pull/3587>`_

We should check if classes in properties of proxied classes are reflected, otherwise they might be non Flow classes or otherwise excluded. In either case making them definitely not (Flow) controlled entities.

Upgrade instructions

  • Packages: Flow

BUGFIX: Handle objects without name in argument configuration parsing

Instead of throwing an exception when an argument configuration contains no name, create a synthetic virtual object name derived from a configuration hash. This handles edge cases encountered with global Objects.yaml configurations.

  • Packages: Flow

BUGFIX: Reuse singleton instance when requested by interface

Regression from #3510

When a singleton was first requested by its implementation class name, subsequent requests by its interface name would create a new instance instead of reusing the existing one.

The ObjectManager now detects this case and returns the already-existing instance, preserving singleton semantics for both class name and interface name lookups.

Also removes the restriction that prevented building proxy classes for classes implementing interfaces with a constructor declaration, and guards ProxyClassBuilder’s parent-advice lookup against base classes without a parent.

  • Packages: Flow

BUGFIX: Always serialize the RelatedEntitesContainer in proxies

fixes regression from #3510

  • Packages: Flow

BUGFIX: fix exception message in ObjectSerializationTrait

  • Packages: Flow

TASK: Prepare for PHPUnit 12

See previous upgrade to PHPUnit 11 https://github.com/neos/flow-development-collection/pull/3563

Prepare the code for PHPUnit 12 by getting rid of deprecated methods in test code.

  • Packages: Flow FluidAdaptor

TASK: Raise PhpStan to Level 8 - Part 3

Raise PhpStan to level 8 for:

  • Neos.Flow/Classes/Annotation

  • Neos.Flow/Classes/Aop

  • Neos.Flow/Classes/Cli

  • Neos.Flow/Classes/Command

  • Neos.Flow/Classes/Core

  • Neos.Flow/Classes/Http

  • Neos.Flow/Classes/I18n

  • Neos.Flow/Classes/Log

  • Neos.Flow/Classes/Monitor

  • Neos.Flow/Classes/Mvc

  • Neos.Flow/Classes/ObjectManagement

  • Neos.Flow/Classes/Persistence

  • Neos.Flow/Classes/Property

And finalize the transition to PhpStan Level 8

This is a follow up for: https://github.com/neos/flow-development-collection/pull/3518 and is based on prior work of @nezaniel al @mhsdesign

Upgrade instructions

Review instructions

I am aware that this introduces a bunch of throw new \\Exception. Those shall be adjusted in a later commit. !!! This is intended for Flow 9.3 as 9.2 already is in feature freeze, the target branch has to be adjusted once 9.3 exists !!!

  • Packages: Flow FluidAdaptor

TASK: Update language feature reference after bug fixes

Updates the PHP language feature reference to reflect the state of the upcoming 9.2.0 release: variadic parameters (#3589) and final static methods with CompileStatic (#3592) are supported since the fixes were merged into 9.0, methods returning by reference are repaired for plain delegation and refused with an exception when advised (#3590), and the edge case for void and never methods (#3597) is fixed.

Note: this change assumes that the fixes merged into 9.0 have been merged upwards into 9.2, so it should be merged after the next upmerge.

Upgrade instructions

  • Packages: Flow

TASK: Use `Test attribute in kickstarter test template <https://github.com/neos/flow-development-collection/pull/3605>`_

Replaces the @test annotation with the PHPUnit #[Test] attribute in the generated entity test case, matching the style used since PHPUnit 11.

  • Packages: Flow Kickstarter

TASK: Fix tests after upmerge and PHPUnit migration

This fixes the two unit test failures which currently break the test run on the 9.2 branch:

The test noParentCallIsRenderedForVoidAndNeverReturnTypesIfOnlyPreParentCallCodeExists documented the behavior which was fixed with #3598: for void and never methods which only received pre parent call code, the call to the original method was skipped. After the upmerge of that fix into 9.2, the test failed. Since the merge already brought the corrected test coverage from `#3598 <https://github.com/neos/flow-development-collection/issues/3598>`_into the same test class, the outdated test can simply be removed.

Additionally, the code style clean-up in 2feb05da8 removed the import of ActionResponse from AbstractWidgetControllerTest although the class is used in one of the tests, which made that test fail with a class not found error. The import is restored.

  • Related to: #3597

  • Packages: .github FluidAdaptor

TASK: Extend test coverage for proxy class building

This adds functional and unit tests which verify that PHP language constructs work as expected in proxied classes: generator methods, first-class callable syntax, pure intersection and DNF types, typed class constants, constants declared in traits, the Override attribute, readonly properties and classes, new without parentheses and dynamic class constant fetch — covering both dependency injection and AOP advices.

It also adds unit tests for ProxyMethodGenerator, ProxyConstructorGenerator, RelatedEntitiesContainer and ObjectSerializationTrait, which previously had no test coverage at all. The unit tests document the current behavior of the code generators, including a few oddities which should be addressed separately.

TASK: Drop support for legacy code caches

Drop support for xcache and wincache from our OpcodeCacheHelper.

  • Packages: Utility.OpcodeCache

TASK: Update to PHPUnit 11

Upgrade instructions

The only thing you might need to adjust (besides catering to all the changes in PhpUnit 11), is the signature of getAccessibleMock() in our base testcase class. The arguments

  • $callAutoload

  • $callOriginalMethods

  • $proxyTarget

have been removed, as the underlying PHPUnit methods are deprecated.

Review instructions

All tests should still pass – have fun verifying they still do test the correct stuff.

  • Packages: Flow Cache

TASK: Add PHP language feature reference

This adds a new reference to the appendix of the Definitive Guide which documents the support status of PHP language constructs in proxied classes, separated by subsystem (Dependency Injection, AOP and object serialization) and including the Flow version which introduced support.

The reference also documents known limitations with links to the corresponding issues, so that users can look up whether a specific language feature can be used in classes managed by the object framework.

  • Packages: Flow

TASK: Fix typos in documentation and some strings

Hello!

First of all, thank you for your work! Just like in https://github.com/neos/neos-development-collection/pull/5846 I fixed typos in this repository too.

Upgrade instructions

n/a

Review instructions

I split my fixes into separate commits so changes in code (comments) and documentation are easily discernible. Note that c6d0157 changes actual strings in the code.

  • Packages: Flow FluidAdaptor

TASK: PSR12 & PHP-CS-Fixer

The codestyle is adjusted from psr2 to psr12 and the linters are adjusted accordingly.

PHP-CS-Fixer shall replace the StyleCi that caused lots of unexpected test failures. The fixer is included in the composer lint command and thus can be executed locally before pushing. The composer fix command allows to adjust the coding style to the requirements quickly.

also: - changes the codestyle from psr2 to psr12 - cs fixer in check mode to the composer lint command - a general composer fix command is added that for now only runs the cs fixed - style ci configuration is removed

Upgrade instructions

Review instructions

!!! Style CI will fail as we remove the configuration and change the settings. This is intended and will be fixed by removeing style ci after the merge !!!

TASK: Sort out use of cleanClassName vs cleanTypeName

  • Packages: Flow

TASK: Raise PhpStan to level 8 - Part 2

Raise PhpStan to level 8 for: - Neos.Flow/Classes/Reflection - Neos.Flow/Classes/ResourceManagement - Neos.Flow/Classes/Security - Neos.Flow/Classes/Session - Neos.Flow/Classes/SignalSlot - Neos.Flow/Classes/Utility - Neos.Flow/Validation

This is a follow up for: #3515

Upgrade instructions

Review instructions

Follow ups will adjust the other Flow Subcontexts. This is limited to be in a manageble size. Also the target branch should offcourse be adjusted to 9.2 once that exists.

  • Packages: Flow

TASK: Update PHP version requirement to 8.4

As discussed here https://neos-project.slack.com/archives/C050KKBEB/p1780140193359499

Upgrade instructions

  • Packages: Flow .github Cache Eel Error.Messages Flow.Log FluidAdaptor Http.Factories Kickstarter Utility.Arrays Utility.Files Utility.MediaTypes Utility.ObjectHandling Utility.OpcodeCache Utility.Pdo Utility.Schema Utility.Unicode

Detailed log