From eda637a457427e2ccd49eba3c57778759a3df047 Mon Sep 17 00:00:00 2001
From: "dd-apm-ecosystems[bot]"
 <183529005+dd-apm-ecosystems[bot]@users.noreply.github.com>
Date: Wed, 16 Sep 2026 19:53:03 +0000
Subject: [PATCH 1/3] Enable Generic.PHP.DeprecatedFunctions in the CI PHP lint
 ruleset

Recurring code-review theme over the past ~400 days: reviewers repeatedly
flagged deprecated/version-incompatible PHP function usage by hand
(e.g. spl_object_hash on PHP 8.6 in PR #4145, missing PHP_VERSION_ID
guards in PR #3514, PHP 7.4-only syntax in PR #3664). This sniff was
already scaffolded but commented out in tooling/php-lint/phpcs.xml with
a note that src/ has zero hits today, so flipping it on adds detection
with no existing-code cleanup required.
---
 tooling/php-lint/phpcs.xml | 32 +++++++++++++++++++++++++++-----
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/tooling/php-lint/phpcs.xml b/tooling/php-lint/phpcs.xml
index ba078920ef2..b58dfbca1ce 100644
--- a/tooling/php-lint/phpcs.xml
+++ b/tooling/php-lint/phpcs.xml
@@ -41,6 +41,33 @@
     <rule ref="Squiz.WhiteSpace.SuperfluousWhitespace"/>
     <rule ref="Generic.WhiteSpace.DisallowTabIndent"/>
 
+    <!--
+        Enabled: recurring review-feedback theme, now mechanically enforced.
+
+        Over the trailing ~400 days of PR review activity, human reviewers
+        repeatedly had to flag calls to functions that are deprecated (or
+        outright unavailable) on some PHP version this repo still supports,
+        e.g.:
+          - "spl_object_hash is deprecated since PHP 8.6. You can simply
+            use spl_object_id." (Drupal integration)
+          - "Needs a PHP_VERSION_ID < 80000 check to avoid deprecations"
+            (Symfony integration)
+          - "this is php 7.4 syntax" (repo supports PHP 7.0+)
+          - "`const` was missing on the PHP 7.0 and 7.1 versions" (stub
+            signatures)
+        This class of feedback is exactly what Generic.PHP.DeprecatedFunctions
+        is built to catch mechanically: it walks the token stream for calls
+        to any function PHP itself reports as deprecated via
+        ReflectionFunction::isDeprecated() on the interpreter running phpcs
+        (the newest supported PHP in CI, see .gitlab/generate-common.php).
+        It does not parse the file with the runner's parser the way
+        Generic.PHP.Syntax does, so it carries none of that sniff's
+        cross-version syntax risk (see the note below). It was already
+        vetted as a zero-hit, low-risk candidate for src/ (see git history
+        of this file) — this change only turns it on.
+    -->
+    <rule ref="Generic.PHP.DeprecatedFunctions"/>
+
     <!--
         Close, but not a mechanical fix. Uncomment after the TODOs
         are resolved or dropped.
@@ -59,11 +86,6 @@
             runs php -l with the job's PHP. A file valid on 7.0 can fail
             on 8.x (and the reverse) without any source change.
 
-        Generic.PHP.DeprecatedFunctions
-            current src/ has no hits, but the sniff list grows with
-            PHPCS releases and tracks language deprecations.
-
         <rule ref="Generic.PHP.Syntax"/>
-        <rule ref="Generic.PHP.DeprecatedFunctions"/>
     -->
 </ruleset>

From 41a0b290e8f16ec2674dc9faa79b61e98add5af3 Mon Sep 17 00:00:00 2001
From: "dd-apm-ecosystems[bot]"
 <183529005+dd-apm-ecosystems[bot]@users.noreply.github.com>
Date: Wed, 16 Sep 2026 19:55:11 +0000
Subject: [PATCH 2/3] Document the newly-enabled
 Generic.PHP.DeprecatedFunctions sniff

Follow-up to the phpcs.xml change in this branch: keep the README's
"what runs" section in sync so it no longer claims deprecated-function
detection is left commented out.
---
 tooling/php-lint/README.md | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/tooling/php-lint/README.md b/tooling/php-lint/README.md
index 127fc338030..e5fd6c669a2 100644
--- a/tooling/php-lint/README.md
+++ b/tooling/php-lint/README.md
@@ -48,11 +48,18 @@ fails:
 
 Enabled sniffs are version-agnostic safety checks (merge-conflict
 markers, BOM, LF line endings, final newline, no tabs, no trailing
-whitespace, open/close tags, backticks, `goto`, `FIXME`, `eval`).
-They are not a style guide.
-
-`TODO` comments, `php -l`, and deprecated-function detection stay
-commented in `phpcs.xml`. PSR-12 is off.
+whitespace, open/close tags, backticks, `goto`, `FIXME`, `eval`), plus
+`Generic.PHP.DeprecatedFunctions`, which flags calls to any function
+the PHP interpreter running phpcs reports as deprecated via
+`ReflectionFunction::isDeprecated()`. That one is not purely a style
+choice: it exists because reviewers repeatedly had to catch
+deprecated/version-incompatible function usage by hand (e.g.
+`spl_object_hash` on PHP 8.6, missing `PHP_VERSION_ID` guards). It does
+not parse the file with the runner's parser the way `Generic.PHP.Syntax`
+does, so it does not carry that sniff's cross-PHP-version risk.
+
+`TODO` comments and `php -l` stay commented out in `phpcs.xml`. PSR-12
+is off.
 
 Scope is first-party `src/` only. Generated bridge files and
 `tests/Frameworks/` are out of scope.

From ede2439f110f519976cc437ff931ce41c9a5d8c4 Mon Sep 17 00:00:00 2001
From: "dd-apm-ecosystems[bot]"
 <183529005+dd-apm-ecosystems[bot]@users.noreply.github.com>
Date: Fri, 25 Sep 2026 21:25:19 +0000
Subject: [PATCH 3/3] fix: scope-suppress version-guarded spl_object_hash()
 calls for new lint rule

Generic.PHP.DeprecatedFunctions (enabled in this branch) is a token-based
sniff and cannot see that the two spl_object_hash() calls here are only
reachable on PHP < 7.2, behind an explicit PHP_VERSION_ID guard. Add
targeted phpcs:ignore suppressions (with a comment explaining why) so
the new rule doesn't fail CI on this legitimate, version-guarded usage.

Addresses review feedback from an automated review and from a maintainer
on this PR.
---
 src/DDTrace/Integrations/Integration.php | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/DDTrace/Integrations/Integration.php b/src/DDTrace/Integrations/Integration.php
index 2fe53f82c21..5a6163ae248 100644
--- a/src/DDTrace/Integrations/Integration.php
+++ b/src/DDTrace/Integrations/Integration.php
@@ -60,16 +60,21 @@ public static function toString($value): string
             if (PHP_VERSION_ID >= 70200) {
                 $object_id = spl_object_id($value);
             } else {
+                // Unreachable on PHP >= 7.2 (see guard above); spl_object_hash() is only
+                // called here as a PHP < 7.2 polyfill for spl_object_id(), which does not
+                // exist before 7.2. Generic.PHP.DeprecatedFunctions cannot see the
+                // PHP_VERSION_ID guard, so the two calls below are scoped-suppressed
+                // rather than dropped, since they are still required on PHP 7.0/7.1.
                 static $object_base_hash;
                 if ($object_base_hash === null) {
                     ob_start();
                     $class = new \stdClass();
-                    $hash = spl_object_hash($class);
+                    $hash = spl_object_hash($class); // phpcs:ignore Generic.PHP.DeprecatedFunctions -- PHP < 7.2 only, see comment above
                     var_dump($class);
                     preg_match('(#\K\d+)', ob_get_clean(), $m);
                     $object_base_hash = hexdec(substr($hash, 0, 16)) ^ $m[0];
                 }
-                $object_id = $object_base_hash ^ hexdec(substr(spl_object_hash($value), 0, 16));
+                $object_id = $object_base_hash ^ hexdec(substr(spl_object_hash($value), 0, 16)); // phpcs:ignore Generic.PHP.DeprecatedFunctions -- PHP < 7.2 only, see comment above
             }
             return "object(" . get_class($value) . ")#$object_id";
         }