The extra Event array contains arbitrary data passed by extensions when calling Event::create(). This data is later serialized by PHP function serialize() which is proven to cause some troubles:
- PHP cannot unserialize value when class doesn't exist any more (for example alias was removed)
- PHP cannot unserialize values when class was changed (some values are required/do not exist/etc)
- it allows code injections
- most likely methods serialize() and unserialize will be deprecated in PHP9
Instead of using serialize we can use the JSONCodec and JSONCodecable interface to allow Mediawiki to serialize/deserialize objects without using native PHP methods. This approach still allows extensions to keep arbitrary data they need. In case when the objects stored in the extra are not serializable (for example see T391948) extension developers can update their objects to allow serialization.