Make CssImportFilter hashable so the asset cache can key it

[LukeTowers]

The bug

Any asset filtered by a configured CssImportFilter fatals as soon as it passes through AssetCache:

Serialization of 'Closure' is not allowed

AssetCache::getCacheKey() builds its key from the asset's filters, hashing those that implement HashableInterface and falling back to serialize() for the rest (AssetCache.php#L151-L157). Since #51, CssImportFilter can hold an import validator — normally a closure — and serializing a closure throws.

This reached consumers: Winter CMS wires an import validator into its asset combiner, so every combined bundle containing a plain .css file 500s with that message in place of the stylesheet. .less/.scss/.js bundles are unaffected, since CssImportFilter is only registered for css.

The fix

Implement HashableInterface so the filter is hashed rather than serialized. The hash covers the inner import filter and the validator, preferring serialization of each since that captures their configuration.

A closure can't be serialized, so it is identified by its declaration site plus the variables bound into it (ReflectionFunction::getStaticVariables()). That second half matters: the bound variables are where a validator's configuration lives — the set of paths it authorises — so two validators sharing a declaration but confining imports differently hash differently and cannot be served each other's cached output. Returning a constant for every closure would have let a permissive-validator build populate the cache and a restrictive-validator build reuse that output, undermining the confinement the validator exists to provide.

Object identity is deliberately never used as a fallback: spl_object_hash() and friends aren't stable between requests and would hand the cache a fresh key every time.

Tests

Five cases added to CssImportFilterTest, each verified to fail before the change:

• the filter is hashable, and hashes with a validator set
• AssetCache dumps an asset filtered by a validator-configured filter — the regression itself, which errors at AssetCache.php:155 without the fix
• the hash is stable between equivalent instances, and differs with/without a validator
• validators bound to different roots hash differently, while an equivalent configuration still hashes alike
• validators declared in different places hash differently

Full suite passes: 417 tests, 0 failures.

Note for maintainers

Cache keys for assets filtered by CssImportFilter change with this fix, so those assets rebuild once on upgrade.

The second commit backfills the changelog, which stopped at 3.1.1 — 3.1.2 through 3.2.1 all shipped without entries. Reconstructed from the commits between each tag and dated from each published release. Happy to drop that commit if you'd rather it landed separately. The 3.2.2 heading is dated on the assumption of an imminent release; adjust as needed.

🤖 Generated with Claude Code