WDDX has been designed as programming language independent data exchange format for the web1). However, it never has been formally standardized, and it appears that it has been mostly superseeded by other data exchange formats such as JSON.
A particular problem is that PHP 4.0.0 added the ability to (de)serialize class instances2) including calls to __sleep() and __wakeup(), respectively. Therefore, wddx_deserialize() must not be called on untrusted user input to avoid remote code execution, basically defeating the purpose of WDDX. A former RFC proposed to “Deprecate class instance deserialization in WDDX”, but it has been withdrawn since that would break BC, and there seemed to be generally more consensus on deprecating the extension altogether.
Therefore I suggest to unbundle ext/wddx. A secondary vote will be held about the detailed procedure:
Obviously, code using the wddx extension would issue deprecation warnings, and/or would have to use the wddx extension from PECL (or somewhere else), or be rewritten.
The primary vote is about whether to unbundle ext/wddx, which requires a 2/3 majority.
A secondary vote is held about the detailed procedure (see the proposal above). If the primary vote passes, the alternative with the most votes will be accepted.
Voting starts on 2019-01-17, and ends on 2019-01-31.
None, yet.
None.