Store the route cache as a serialized payload

Replace the var_export()ed PHP array in the route cache file with a serialized payload that is rehydrated via unserialize(). The cache file remains a require()-able PHP file, so previously generated caches and any tooling that loads it directly keep working.

The route service provider now loads serialized payloads natively through Router::setCompiledRoutes() and falls back to require() for legacy PHP cache files, keeping full backward compatibility for applications that upgrade without re-running route:cache.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: jbidad

src/Illuminate/Foundation/Console/RouteCacheCommand.php

@@ -103,8 +103,9 @@ protected function getFreshApplication()
      */
     protected function buildRouteCacheFile(RouteCollection $routes)
     {
-        $stub = $this->files->get(__DIR__.'/stubs/routes.stub');
-
-        return str_replace('{{routes}}', var_export($routes->compile(), true), $stub);
+        return sprintf(
+            "<?php\n\napp('router')->setCompiledRoutes(\n    unserialize(%s)\n);\n",
+            var_export(serialize($routes->compile()), true)
+        );
     }
 }

src/Illuminate/Foundation/Console/stubs/routes.stub

@@ -147,7 +147,20 @@ protected function loadCachedRoutes()
         }
 
         $this->app->booted(function () {
-            require $this->app->getCachedRoutesPath();
+            $path = $this->app->getCachedRoutesPath();
+
+            $routes = @unserialize(file_get_contents($path));
+
+            if (is_array($routes)) {
+                $this->app['router']->setCompiledRoutes($routes);
+
+                return;
+            }
+
+            // Backward compatibility: route cache files generated by previous
+            // versions of the framework are PHP files that register the
+            // compiled routes themselves, so we require them as before.
+            require $path;
         });
     }
 

src/Illuminate/Foundation/Support/Providers/RouteServiceProvider.php

@@ -0,0 +1,118 @@
+<?php
+
+namespace Illuminate\Tests\Integration\Routing;
+
+use Illuminate\Container\Container;
+use Illuminate\Events\Dispatcher;
+use Illuminate\Foundation\Support\Providers\RouteServiceProvider;
+use Illuminate\Routing\Router;
+use Orchestra\Testbench\TestCase;
+
+class RouteCacheLoadingTest extends TestCase
+{
+    /**
+     * The path to the temporary route cache file used by the current test.
+     */
+    protected ?string $cachePath = null;
+
+    /** {@inheritDoc} */
+    #[\Override]
+    protected function getPackageProviders($app)
+    {
+        return [RouteServiceProvider::class];
+    }
+
+    /** {@inheritDoc} */
+    #[\Override]
+    protected function tearDown(): void
+    {
+        if ($this->cachePath !== null && is_file($this->cachePath)) {
+            @unlink($this->cachePath);
+        }
+
+        unset($_ENV['APP_ROUTES_CACHE'], $_SERVER['APP_ROUTES_CACHE']);
+
+        parent::tearDown();
+    }
+
+    public function testItLoadsRoutesFromASerializedPayloadCacheFile()
+    {
+        // This is the format produced by the "route:cache" command: a require()-able
+        // PHP file whose route data is stored as a serialized string.
+        $this->bootWithCachedRoutes(sprintf(
+            "<?php\n\napp('router')->setCompiledRoutes(\n    unserialize(%s)\n);\n",
+            var_export(serialize($this->compiledRoutes()), true)
+        ));
+
+        $this->assertTrue($this->app->routesAreCached());
+
+        $this->get('cached-route')->assertOk()->assertSee('cached response');
+    }
+
+    public function testItLoadsRoutesFromAPlainSerializedCacheFile()
+    {
+        // A cache file that contains only serialized route data (no PHP wrapper) is
+        // read with file_get_contents()/unserialize() and handed to the router via
+        // setCompiledRoutes().
+        $this->bootWithCachedRoutes(serialize($this->compiledRoutes()));
+
+        $this->assertTrue($this->app->routesAreCached());
+
+        $this->get('cached-route')->assertOk()->assertSee('cached response');
+    }
+
+    public function testItStillLoadsLegacyVarExportCacheFiles()
+    {
+        // Route cache files generated by previous versions of the framework dumped
+        // the compiled routes as a var_export()ed PHP array. They must keep working
+        // for applications that upgrade without re-running "route:cache".
+        $this->bootWithCachedRoutes(sprintf(
+            "<?php\n\napp('router')->setCompiledRoutes(\n    %s\n);\n",
+            var_export($this->compiledRoutes(), true)
+        ));
+
+        $this->assertTrue($this->app->routesAreCached());
+
+        $this->get('cached-route')->assertOk()->assertSee('cached response');
+    }
+
+    /**
+     * Write the given contents to a temporary route cache file and reboot the
+     * application so the route service provider loads it.
+     */
+    protected function bootWithCachedRoutes(string $contents): void
+    {
+        $this->cachePath = tempnam(sys_get_temp_dir(), 'route-cache-test-');
+
+        file_put_contents($this->cachePath, $contents);
+
+        $_ENV['APP_ROUTES_CACHE'] = $_SERVER['APP_ROUTES_CACHE'] = $this->cachePath;
+
+        $this->reloadApplication();
+    }
+
+    /**
+     * Build a compiled route cache array containing a single named route.
+     *
+     * @return array{compiled: array, attributes: array}
+     */
+    protected function compiledRoutes(): array
+    {
+        $router = new Router(new Dispatcher, new Container);
+
+        $router->get('cached-route', ['uses' => RouteCacheLoadingController::class.'@index'])->name('cached-route');
+
+        $router->getRoutes()->refreshNameLookups();
+        $router->getRoutes()->refreshActionLookups();
+
+        return $router->getRoutes()->compile();
+    }
+}
+
+class RouteCacheLoadingController
+{
+    public function index()
+    {
+        return 'cached response';
+    }
+}

tests/Integration/Routing/RouteCacheLoadingTest.php

@@ -23,6 +23,26 @@ public function testRedirectRoutes()
         $this->get('/foo/1')->assertRedirect('/foo/1/bar');
     }
 
+    public function testCachedRouteFileStoresASerializedPayload()
+    {
+        $this->routes(__DIR__.'/Fixtures/wildcard_catch_all_routes.php');
+
+        $contents = file_get_contents($this->app->getCachedRoutesPath());
+
+        // The route cache file remains a require()-able PHP file so that it stays
+        // compatible with previously generated caches and any tooling that loads
+        // it directly...
+        $this->assertStringContainsString("app('router')->setCompiledRoutes(", $contents);
+
+        // ...but the compiled route data is now stored as a serialized string that
+        // is rehydrated with unserialize() instead of being dumped into the file as
+        // a large var_export()ed PHP array.
+        $this->assertStringContainsString('unserialize(', $contents);
+
+        // The cached routes still resolve correctly once the file is loaded.
+        $this->get('/foo')->assertSee('Regular route');
+    }
+
     protected function routes(string $file)
     {
         $this->defineCacheRoutes(file_get_contents($file));