Section 6.6.4 declares that:

> If a producer method declares a passivating scope and:
> ..
> * has a parameter that does not resolve to a passivation capable
> dependency,
> then the container automatically detects the problem and
> treats it as a deployment problem.

Something like

@Produces @SessionScoped @AutoAuthenticated
public User getCurrentUser(MyConfig mc) {
return ...

(MyConfig is not Serializable and gets produced as @ApplicationScoped) would not be allowed.

The same restriction currently applies to parameters of @Inject methods and constructors:
>If a managed bean which declares a passivating scope:
> has a ... , bean constructor parameter or initializer method parameter
> that does not resolve to a passivation capable dependency, ...

This maybe comes from simple @Inject setters which set the given method parameters 1:1 into class members. But for all other cases this restriction is just way too rigid.