Bugfixes

You can expect the following changes in 4.5.8. See the changelog for every commit.

• Backport gettext compatible paths to the list of translation folders.
• Improved API docs for assertSameAsFile.
• Fixed deprecations on QueryInterface.

Contributors to 4.5.8

Thank you to all the contributors that helped make this release happen:

• Mark Scherer
• Mark Story
• Val Bancer

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 5.1.2. See the changelog for every commit.

• Fix usage of constants in EavStrategy.
• Clean up constructor logic.
• In console command listings app and cakephp commands are now displayed above plugin names.
• Added command descriptions to all framework commands.
• Fixed file descriptor leaks in StubConsoleOutput.
• Added support for using DI in commands executed by other commands.
• Restored ability to disable query logging at runtime.
• Improved performance of count updates in CounterCache.
• Fixed object naming in ObjectRegistry. Plugin class names are reflected more correctly now.
• Added IP and URL to active transaction warning.
• Cleanup usage of special view variables to configure the class in SerializedView.
• Swapped usage of E_USER_ERROR to E_USER_WARNING to improve compatibility with PHP 8.4.
• Fixed geospatial types not being defined in TypeFactory.
• Improved API documentation.
• Fixed disabling client side buffering with SqlServer when it is disabled in the SelectQuery.
• Fix XML serialization to not break with enums.
• Add cjs/mjs extensions.

Contributors to 5.1.2

Thank you to all the contributors that submitted a pull request:

• Adam Halfar
• ADmad
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• Nicolas Roggli
• othercorey

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 5.1.1. See the changelog for every commit.

• Improve FormHelper’s request method inference. The method option now takes precedence over the value of type option.
• Fixed regression in meta tag generation.
• Fix missing method errors in Console only applications.
• EventAwareApplicationInterface was added. This interface was is to solve the console compatibility issue.
• Event hooks are now called application first, plugins after. This aligns behavior with other hooks.
• I18n message translation now supports gettext compatible paths.
• PaginatorHelper will now reset the current page to 1 when changing the per page limit. This reduces the chances of end users getting 404 errors changing their per page limit.
• The new to*() type coercion functions are now available as a global functions for applications that prefer to use global functions.
• Removed inline javascript from disabled pagination buttons. This improves compatibility with strict CSP policies.
• Fixed a type error if Mailer::reset() was called without proper setup.
• Fixed a SQL generation regression for UNION queries in MySQL < 8.

Contributors to 5.1.1

Thank you to all the contributors that submitted a pull request:

• ADmad
• bancer
• Kevin Pfeifer
• Mark Story
• Robert Pustułka

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.5.7. See the changelog for every commit.

• Added annotations for mixin and template to Association classes.
• Fix BehaviorRegistry::unload() not detaching camelCase methods.

Contributors to 4.5.7

Thank you to all the contributors that helped make this release happen:

• Adam Halfar
• Mark Scherer
• Mark Story

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Upgrading to 5.1.0

You can use composer to upgrade to CakePHP 5.1.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:5.1.*"

Deprecation Warnings

5.1 introduces a few deprecations. All of these features will continue for the duration of 5.x but will be removed in 6.0. See the migration guide.

What’s new in 5.1.0?

The migration guide has a complete list of what’s new in 5.1.0. We recommend you give that page a read when upgrading. A few highlights from 5.1.0 are:

• RedisEngine now supports TLS connections.
• bin/cake plugin list has been added to list plugin metadata.
• Optional Command arguments can now have a default value.
• BannerHelper was added. This command helper can format text as a banner with a coloured background and padding.
• Components can now use the DI container to have dependencies resolved and provided as constructor parameters just like Controllers and Commands do.
• The toString, toInt, toBool, toDate, and toDateTime functions were added. They give you a typesafe way to cast request data or other input and return null when conversion fails.
• pathCombine() was added to help build paths without worrying about duplicate and trailing slashes.
• A new events hook was added to the BaseApplication as well as the BasePlugin class.
• Support for point, linestring, polygon and geometry types were added to the Database package.
• SelectQuery::intersect() and SelectQuery::intersectAll() were added.
• Client now emits HttpClient.beforeSend and HttpClient.afterSend events when requests are sent.
• Http\Server now emits Server.terminate event to run logic after the response has been sent in fastcgi environments. In other environments the Server.terminate event runs before the response has been sent.
• View cells now emit events around their actions Cell.beforeAction and Cell.afterAction.
• Validation::enum(), Validator::enum(), Validation::enumOnly(), and Validation::enumExcept() were added to further simplify validating backed enum values.
• HtmlHelper can now create a meta tag with the CSRF token in it.

Contributors to 5.1.0

Thank you to all the contributors that helped make 5.1 happen:

• Adam Halfar
• ADmad
• Alejandro Ibarra
• Fernando Herrero
• Frank de Graaf (Phally)
• Jamison Bryant
• J.Brabec
• Jozef Grencik
• Kevin Pfeifer
• KrzysiekNDS
• Mark Scherer
• Mark Story
• Maximilian Ruta
• ndm2
• Nicos Panayides
• othercorey
• Robert Pustułka

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests. 5.1.0 is a large release and would not have been possible without the community support and feedback.

What’s Next

With 5.1.0 shipped, future feature work will continue on 5.next and eventually form 5.2.0. Bugfixes for 5.1 will be done in the 5.x branch, and 5.0 will receive security fixes until the release of 5.3.

The roadmap for 5.x is still under development. We’re interested in making the upgrade from 5.0 to 5.1 a smooth one, and would appreciate any feedback you have on upgrade difficulties. Please open an issue and get the discussion started.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 5.0.10. See the changelog for every commit.

• Improve README contents and layout.
• Fixed errors found by new versions of phpstan.
• Optimize logic in FormHelper for working with Enum values.

Contributors to 5.0.11

Thank you to all the contributors that submitted a pull request:

• ADmad
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• othercorey

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

Download a packaged release on github.

What’s new in 5.1.0

The migration guide has a complete list of what’s new in 5.1.0. We recommend you give that page a read when upgrading as it notes the behavior changes present in 5.1.0.

How you Can Help

You can help deliver 5.1.0 by contributing in one of many ways:

1. Check the documentation for mistakes, outdated, unclear or broken examples. We’ve been trying to update the documentation as we go, but there are likely examples or sections we’ve missed.
2. Try it out! Give CakePHP 5.1.0 a test drive. Let us know how upgrading went and if there were any rough spots.
3. File issues for regressions in existing features, or suggest new features. Even if those features don’t make it into 5.1.0, we’re early in the process of planning 5.2 and value community feedback.

Contributors to 5.1.0-RC2

Thank you to all the contributors that have contributed to this release:

• Adam Halfar
• ADmad
• Jamison Bryant
• jun-taniai
• Mark Scherer
• Mark Story
• othercorey

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 5.0.10. See the changelog for every commit.

• IntegrationTestTrait::enableCsrfTokens() will no longer add CSRF tokens to GET requests performed after a POST request in the same test method.
• Improved API documentation
• Router now gets an updated request set after each middleware is applied. This gives exception handling access to request attributes added by middleware.
• FormHelper::unlockFields() no longer raises errors when called without Form tampering protection being active.

Contributors to 5.0.10

Thank you to all the contributors that submitted a pull request:

• ADmad
• jun-taniai
• Mark Story
• othercorey

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.5.6. See the changelog for every commit.

• Fixed how MemcacheEngine handles empty prefix values.
• Fixed HTML validation for checkboxes generated by FormHelper.
• Table::removeBehavior() now cleans up the method map and finder map.
• Improved API documentation for Inflector.

Contributors to 4.5.6

Thank you to all the contributors that helped make this release happen:

• Joris Vaesen
• Mark Story
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

What’s new in 5.1.0

The migration guide has a complete list of what’s new in 5.1.0. We recommend you give that page a read when upgrading as it notes the behavior changes present in 5.1.0.

How you Can Help

You can help deliver 5.1.0 by contributing in one of many ways:

1. Check the documentation for mistakes, outdated, unclear or broken examples. We’ve been trying to update the documentation as we go, but there are likely examples or sections we’ve missed.
2. Try it out! Give CakePHP 5.1.0 a test drive. Let us know how upgrading went and if there were any rough spots.
3. File issues for regressions in existing features, or suggest new features. Even if those features don’t make it into 5.1.0, we’re early in the process of planning 5.2 and value community feedback.

Contributors to 5.1.0-RC1

Thank you to all the contributors that have contributed to this release:

• Adam Halfar
• ADmad
• Fernando Herrero
• Frank de Graaf (Phally)
• J.Brabec
• Jozef Grencik
• Kevin Pfeifer
• KrzysiekNDS
• Mark Scherer
• Mark Story
• Maximilian Ruta
• ndm2
• othercorey
• Robert Pustułka

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 5.0.8. See the changelog for every commit.

• Added connection role to logged queries.
• Improved compatibility with 4.x finders. You can now call finder with named parameters but have the finder implemented with an $options array.
• Eagerloaders now propagate connection roles.
• Error logs from fallback failures in WebExceptionRenderer now include stack traces making debugging easier.
• Update documentation for SelectQuery.
• cake i18n extract now allows --path and --plugin to be provided at the same time.

Contributors to 5.0.8

Thank you to all the contributors that helped make this release happen:

• ADmad
• Alejandro Ibarra
• Corey Taylor
• Jonathan Guillot
• Mark Scherer
• Mark Story
• othercorey
• wowDAS Markus Ramšak

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.5.5. See the changelog for every commit.

• Fix problem formatting milliseconds using i18nFormat.

Contributors to 4.5.5

Thank you to all the contributors that helped make this release happen:

• freefri
• Mark Story

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 5.0.7. See the changelog for every commit.

• Add logging to error rendering failures. When error rendering fails, CakePHP will log error messages.
• Fix file handle leak in StubConsoleInput.
• Reverted recent changes in connection aliasing. The test runner will automatically alias all live connections to test_ prefixed ones.
• Improved enum support in FormHelper.
• IntegrationTestTrait no longer adds security tokens to GET requests with data.
• Improved response assertion method output. Failure messages will now include the response body.

Contributors to 5.0.7

Thank you to all the contributors that helped make this release happen:

• ADmad
• KrzysiekNDS
• Mark Scherer
• Mark Story
• othercorey
• RoboSchmied

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 5.0.6. See the changelog for every commit.

• Fix validation of ChronosTime instances to be considered valid by the time validation method.
• Allow Collection::groupBy() to work with Enum values.
• Improve display of console exceptions in production mode.
• Fix Hash::insert() with {s} placeholders and attribute conditions on uneven datasets.
• Fix potentially leaking file descriptor in StubConsoleInput.
• Fixed formatting error of datetimes with microseconds.
• Fixed parsing of datetimes of microseconds.

Contributors to 5.0.6

Thank you to all the contributors that helped make this release happen:

• ADmad
• freefri
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.5.4. See the changelog for every commit.

• Fix Hash::insert() and paths containing {s} and conditions, and data where all values after {s} are not arrays.

Contributors to 4.5.4

Thank you to all the contributors that helped make this release happen:

• Mark Story
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 5.0.5. See the changelog for every commit.

• Fixed dirty state tracking for entities that use TranslateBehavior and use ResultSet methods to mutate records.
• Improved marshalling nullable enum values from strings.
• Shifted the logic for getting view variables to serialize into SerializedView::serializeKeys() so it is easier to override.
• Improved session gc time when server side idle timeouts are disabled. PHP defaults are now used, and you can configure this with application configuration as well.
• CollectionTrait::combine() is now compatible with enum keys.
• Fixed an array to string warning in EventFiredWith constraints.
• Improve API documentation.
• Reduce potential for empty cloaking throrugh refactoring.
• Fixed a regression with converting Date objects passed into datetime columns via the ORM into query parameters.
• Fixed type error in IntegrationTestTrait when adding tokens to requests.

Contributors to 5.0.4

Thank you to all the contributors that helped make this release happen:

• Adam Halfar
• ADmad
• dependabot[bot]
• fabian-mcfly
• Ishan Vyas
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.5.3. See the changelog for every commit.

• Configuration based path keys are normalized to integer keys now.
• Update requirements to be compatible with paragonie/csp-builder:^3.
• Cookie assertion methods are now compatible with RedirectResponse.
• Fixed dev error page rendering in PHP8.3
• CI matrix now includes PHP8.3
• Improve assertion failure message of EventFiredWith constraint.

Contributors to 4.5.3

Thank you to all the contributors that helped make this release happen:

• Fabian Friedel
• fabian-mcfly
• Ishan Vyas
• Mark Scherer
• Mark Story
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 5.0.4. See the changelog for every commit.

• Improve support for template paths being defined as an associative array.
• Improved output of cache_clear commands.
• Updated Sqlite mapping for binaryuuid to use UUID_TEXT.
• The Exception.beforeRender event can now prevent default rendering from occurring by setting a result and stopping the event.
• Fixed regression in SQLite schema reflection for older versions of SQLite.
• Fixed off by one errors in code location for dd().
• Updated dependency on paragonie/csp-builder to accept 3.0
• The cookie assertions in IntegrationTestTrait now work with RedirectResponse values.
• Fixed dev error page rendering in PHP8.3
• Improved display of enum values in FormHelper.

Contributors to 5.0.4

Thank you to all the contributors that helped make this release happen:

• ADmad
• Chris Nizzardini
• fabian-mcfly
• Jens Mischer
• Jorge González
• Kevin Pfeifer
• Marc de Lima Lucio
• Marc Würth
• Mark Scherer
• Mark Story
• othercorey
• Robert Pustułka

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.5.2. See the changelog for every commit.

• Fix regression in plugin translation file loading order.
• Marshalling Date values no longer sets a timezone.
• Fix inconsistency between Error.beforeRender and Exception.beforeRender. You can now stop this event to prevent output being rendered, or set your own result to bypass the default renderer just like error handling.
• Added more deprecation annotations for easier upgrading to 5.x.
• Fix off by one errors in dd().

Contributors to 4.5.2

Thank you to all the contributors that helped make this release happen:

• ADmad
• Jens Mischer
• Kevin Pfeifer
• Marc de Lima Lucio
• Marc Würth
• Mark Scherer
• Mark Story
• othercorey
• Robert Pustułka

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 5.0.3. See the changelog for every commit.

• Update path to plugin_class_error.php.
• Expanded enum support to include providing a label. Implementing Cake\Database\Type\EnumLabelInterface in your enum class will allow you to provide a user facing label. Labels are used by FormHelper when generating controls.
• Improved validation support for enums.
• Widened type of $format in TimeHelper::format().
• Support for PHP 8.3
• Fixed significant performance regression in intl date and datetime formatting. Serializing dates and datetimes now cache intl formatters restoring performance to 4.x levels.
• Improved support for binaryuuid type across database platforms.
• Improved readability of missing route pages by collapsing the route list by default.
• Improve support for indexes on generated columns in SQLite.
• Improved internal tooling for maintaining consistency in split packages.

Contributors to 5.0.3

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Kevin Pfeifer
• kolorafa
• Marcelo Rocha
• Mark Scherer
• Mark Story
• Mauro Brandoni
• ndm2
• Oliver Nowak
• othercorey
• Umer Salman
• wowDAS Markus Ramšak

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.5.1. See the changelog for every commit.

• ControllerFactory no longer raises errors on union typed parameters.
• Collection::combine() raises an error when keys are null.
• Namespaced core functions are now wrapped in function_exists calls resolving errors if the file containing these functions are imported more than once.
• Added schema mapping type to sqlite for UUID_TEXT.
• Reverted deprecated annotation on LocatorAwareTrait::$defaultTable property.

Contributors to 4.5.1

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Jorge González
• Kevin Pfeifer
• Mark Scherer
• Mark Story

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 5.0.2. See the changelog for every commit.

• Fixed links between API docs and book.
• TranslateBehavior now allows using _translations.{locale}.field_name style naming for default locale.
• LoggedQuery::getContext() now includes the query that was emitted.
• Fixed recursion errors when entities have cyclic references and getErrors() or hasErrors() is called.
• ControllerFactory no longer raises errors when it encounters a type it cannot cast into (like unions). Instead the framework relies on PHP to validate the parameter types.
• Collection::combine() now raises an error should a path result in a null value for the key.
• Relaxed constraint on psr/simple-cache, psr/container and psr/http-message.
• Invalid enum values are no longer cast to null when an invalid string value is marshalled into the PHP value.
• Improved compatibility between enum values and FormHelper.
• Improved compatibility between DateTimeWidget and ChronosTime.
• Improved SQLite mapping of uuid abstract type. It now maps to UUID_TEXT.
• TimeType::getClassName() was added. This method was missed in 5.0.0

Contributors to 5.0.2

Thank you to all the contributors that helped make this release happen:

• ADmad
• Jèfferson Gonçalves
• Jorge González
• Kevin Pfeifer
• Lars Ebert
• Mark Scherer
• Mark Story
• Mark Watney
• Michael Hoffmann
• othercorey
• salehhashemi1992
• wowDAS Markus Ramšak

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Upgrading to 4.5.0

You can use composer to upgrade to CakePHP 4.5.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:4.5.*"

Deprecation Warnings

4.5 introduces a few deprecations. All of these features will continue for the duration of 4.x but will be removed in 5.0. See the migration guide.

What’s new in 4.5.0?

The migration guide has a complete list of what’s new in 4.5.0. We recommend you give that page a read when upgrading. A few highlights from 4.5.0 are:

• bin/cake cache clear_group <name> was added. This command gives a CLI interface to clearing a specific cache group.
• ComponentRegistry is now automatically added to your application’s DI container.
• Controller::addViewClasses() was added. This method lets you build a controller’s view classes programatically.
• Database and ORM connections now support read and write connection roles. Connection roles let you scale an application up by using read-replicas. When defining connections, roles can be configured with read and write keys in the connection config that override the shared config.
• New methods were added to queries to select the read or write connection role to be used.
• ModelAwareTrait::fetchModel() was added. This method works similar to loadModel() but does not set the model as an attribute.
• The development error page design has been improved. It now renders chained exceptions and makes navigating stack traces easier as each frame can be collapsed individually.
• Console exception messages now include stack traces for chained exceptions.
• EntityTrait::$_hasAllowsNull was added. This property allows you to incrementally opt-in to a breaking change present in 5.x for EntityTrait::has().
• View::addHelper() was added. This method compliments addBehavior() and addComponent().

Contributors to 4.5.0

Thank you to all the contributors that helped make 4.5 happen:

• ADmad
• Alejandro Ibarra
• Brian French
• Chris Nizzardini
• Jaro Varga
• Jose Daian
• Kevin Pfeifer
• Lars Ebert
• leon.schaub
• Marcelo Rocha
• Mark Scherer
• Mark Story
• Matthias Wirtz
• othercorey
• Roland Waldner
• wowDAS Ing. Markus Ramšak

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests. 4.5.0 is a large release and would not have been possible without the community support and feedback.

What’s Next

With both 5.0 and 4.5 shipped the core team’s focus will be primarily on CakePHP 5.x. Future 4.x releases will be primarily community driven. Feature and bugfix releases for 4.x will continue until September 2025. Security fixes will continue for 4.x until September 2026.

The roadmap for 5.x is still under development. We’re interested in making the upgrade from 4.5.0 to 5.0 a smooth one, and would appreciate any feedback you have on upgrade difficulties. Please open an issue and get the discussion started.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 5.0.1. See the changelog for every commit.

• Allow FormProtection component to have its session id source customized in subclasses.
• Fixed potential email address manipulation if unvalided address data was set into Cake\Mailer\Message. Thank you to Waldemar Bartikowski who reported the issue via our security mailing list.
• Fixed errors arising from plugin helpers being loaded within other plugin helpers, when the parent helper is loaded without a plugin scope.
• PaginatedResultSet is now JsonSerializable.
• Replaced usage of include_once when Application loads plugin configuration.
• Fixed broken links in API documentation links to MDN.
• View::getConfig() is now public.
• ORM\Marshaller::one() now uses newEmptyEntity() improving compatibility with subclass implementations.
• Adding methods with getMockForModel() is deprecated because of changes in PHPUnit.
• Fixed Cake\Http\Client cookie parsing with invalid values that lack both a value and = delimiter.
• Collection\SortIterator is now compatible with Chronos types.
• Fixed source line attribution in the dd() method.
• Fixed defaults being mutated in DashedRoute and InflectedRoute after match() is called.

Contributors to 5.0.1

Thank you to all the contributors that helped make this release happen:

• ADmad
• Jorge González
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• andrii-pukhalevych
• breno
• othercorey
• wowDAS Markus Ramšak

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.4.18. See the changelog for every commit.

• RedirectException now forwards headers to redirect responses.
• Allow ConsoleOutput to accept stream resources. This solves ‘too many streams open’ problems when application code creates many instances of ConsoleIo.
• Fixed potential email address manipulation if unvalided address data was set into Cake\Mailer\Message. Thank you to Waldemar Bartikowski who reported the issue via our security mailing list.
• Fixed Cake\Http\Client cookie parsing with invalid values that lack both a value and = delimiter.

Contributors to 4.4.18

Thank you to all the contributors that helped make this release happen:

• Brian French
• Mark Story
• andrii-pukhalevych
• othercorey
• Waldemar Bartikowski

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Key Features

• PHP 8.1 required.
• Improved typehints across the framework. CakePHP now leverages union types to formalize the types of many parameters across the framework.
• Upgraded to PHPUnit 10.x
• Support for read and write database connection roles.
• New enum type mapping support in the ORM enabling more expressive model layers with improved type checking.
• Table finders with named parameters, providing more expressive query building APIs.
• Added time-only Time` type and greatly improved Date and DateTime support via chronos 3.x.
• Support for PSR17 HTTP factories was added.

To find out more about what is new and changed in 5.0 refer to the migration guide.

Upgrading to 5.0

5.0 contains a number of breaking changes. If you have an existing application, we’ll be releasing 4.5.0 in the upcoming weeks. This release will contain many of the features present in 5.0, and will also contain deprecations for many of the breaking changes in 5.0 that do not already have deprecations. Once 4.5.0 is released we recommend that you upgrade to that release first. Then, once you have addressed all of the deprecations in 4.5.0 you will have a much easier time upgrading to 5.0.0.

To help with your upgrade from 4.x to 5.x the core team has prepared both a migration guide covering the deprecated, removed and new features.

Additionally, the core team has also prepared an upgrade guide which provides a step-by-step guide and CLI tooling to help you upgrade your application.

Contributors to 5.0.0

CakePHP 5.0 is the result of two years of work and contributions from the following community members:

• ADmad
• Alejandro Ibarra
• Andrii Pukhalevych
• Brian French
• chris cnizzardini
• Chris Nizzardini
• fabian-mcfly
• Jaro Varga
• J.Brabec
• Jose Daian
• Jozef Grencik
• Kevin Pfeifer
• leon.schaub
• Marcelo Rocha
• Marc Würth
• Mark Scherer
• Mark Story
• Matthias Wirtz
• ndm2
• Oliver Nowak
• othercorey
• Roland Waldner
• saeideng

Thank you for all you’ve done to make CakePHP 5.0.0 a reality.

Bugfixes

You can expect the following changes in 4.4.17. See the changelog for every commit.

• Fix deprecation notice because of Chronos 2.4.
• Fixed a typo in BasePlugin.

Contributors to 4.4.17

Thank you to all the contributors that helped make this release happen:

• Kevin Pfeifer
• kolorafa
• Mark Scherer
• Mark Story

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.4.16. See the changelog for every commit.

• Improve API documentation.
• Correct pagination URL generation for the current page from numbers() when using the modulus option.
• ProgressHelper now initializes options with default values solving errors when output() is called before init() is.
• Fixed failure to reflect schema for tables in MySQL 8+ that use functional indexes.

Contributors to 4.4.16

Thank you to all the contributors that helped make this release happen:

• Edoardo Cavazza
• Jozef Grencik
• Mark Scherer
• Mark Story
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.4.15. See the changelog for every commit.

• SMTP transport skips authentication header parsing if no credentials are passed.
• Fixed unsafe usage of unserialize in debug output of SecurityComponent failure messages. Thanks to Andreas Kellas for reporting this issue via our security disclosure policy.

Contributors to 4.4.15

Thank you to all the contributors that helped make this release happen:

• ADmad
• DeSerFix-bot
• Mark Story
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

New Features

The migration guide has a complete list of what’s new in 5.0.0. We recommend you give that page a read when upgrading as it notes the various breaking changes present in 5.0.

How you Can Help

You can help deliver 5.0 by contributing in one of many ways:

1. Check the documentation for mistakes, outdated, unclear or broken examples. We’ve been trying to update the documentation as we go, but there are likely examples or sections we’ve missed.
2. Try it out! Give CakePHP 5.0 a test drive in a non-production application. We’d love to hear how converting a small application went and what was harder than it should have been.
3. File issues for regressions in existing features, or suggest new features. Even if those features don’t make it into 5.0, we would appreciate community input on what should be part of 5.1 and 5.2

Contributors to 5.0.0-beta1

Thank you to all the contributors that have helped since the beta2 release:

• ADmad
• Kevin Pfeifer
• Marcelo Rocha
• Marc Würth
• Mark Scherer
• Mark Story
• mscherer
• ndm2
• othercorey
• Roland Waldner

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.4.14. See the changelog for every commit.

• Implemented SSL XOAUTH2 support in SmtpTransport. This improves compatibility with Microsoft based servers.
• Improve API documentation.
• Fixed support for postgres schemas other than public in Fixture schema generation.
• Validation::utf8() and by extension the Validator::utf8() method as well now fail on invalid UTF8 bytes even when the extended range is enabled.
• Fix usage of ROOT in deprecationWarning(). This was causing failures in standalone package usage.

Contributors to 4.4.14

Thank you to all the contributors that helped make this release happen:

• ADmad
• Marc Würth
• Mark Story
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.4.13. See the changelog for every commit.

• Fix DateTimeType::manyToPHP with int.
• Handle numeric keys in cookies being parsed from the server request.
• Catch all exceptions when generating sql for Query::__debugInfo().
• Fix loading of vendor namespaced plugins.

Contributors to 4.4.13

Thank you to all the contributors that helped make this release happen:

• ADmad
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

New Features

The migration guide has a complete list of what’s new in 5.0.0. We recommend you give that page a read when upgrading as it notes the various breaking changes present in 5.0.

How you Can Help

You can help deliver 5.0 by contributing in one of many ways:

1. Check the documentation for mistakes, outdated, unclear or broken examples. We’ve been trying to update the documentation as we go, but there are likely examples or sections we’ve missed.
2. Try it out! Give CakePHP 5.0 a test drive in a non-production application. We’d love to hear how converting a small application went and what was harder than it should have been.
3. File issues for regressions in existing features, or suggest new features. Even if those features don’t make it into 5.0, we would appreciate community input on what should be part of 5.1 and 5.2

Contributors to 5.0.0-beta1

Thank you to all the contributors that have helped since the beta1 release:

• ADmad
• Alejandro Ibarra
• Andrii Pukhalevych
• andrii-pukhalevych
• Brad McNaughton
• Brian French
• Chris Hallgren
• Edgaras Janušauskas
• Erwane Breton
• fabsn182
• Jamison Bryant
• Jaro Varga
• J.Brabec
• Jose Daian
• Kevin Pfeifer
• Marc Würth
• Mark Scherer
• Mark Story
• Matthias Wirtz
• Mikkel Bonde
• Nicos Panayides
• othercorey
• saeideng

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.4.12. See the changelog for every commit.

• Fix regression in missing_controller template where class was undefined.
• Add opt-in exception wrapping for PDOError that preserves the queryString attribute used in error templates. This is a workaround for dynamic properties being deprecated in PHP 8.2.
• Improve how validation rules work on array elements with numeric keys.
• Fix mutation side-effects in TestEmailTransport caused by Mailer instances being delivered within a loop. These mutations would result in test assertions having access to incorrect information.
• Fixed cookie expiration when the default server timezone was ahead of UTC.
• Added additional composer package metadata for PSR interface implementations.
• An exception will now be thrown if the session cannot be started due to headers being sent. Previously a hard to understand TypeError would be raised when attempting to write to a session that failed to start.
• cake plugin load now detects and prevents duplicates.

Contributors to 4.4.12

Thank you to all the contributors that helped make this release happen:

• ADmad
• Andrii Pukhalevych
• Brad McNaughton
• Brian French
• Chris Hallgren
• Erwane Breton
• Jamison Bryant
• Kevin Pfeifer
• Marc Würth
• Mark Scherer
• Mark Story
• mscherer
• Nicos Panayides

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.4.11. See the changelog for every commit.

• View can now iterates templates paths that were defined as an associative array.
• The i18n extract command now checks for directory existence before trying to enumerate the files within directories provided as inputs.
• Update SECURITY policy docs to include 3.x end-of-life status.
• Improve API documentation.
• Fix dynamic-property error in PHP8.2 when PDOError objects are logged.
• Switch to using phive to install static analysis tools.
• Set the request into the routing context before processing middleware. This ensures that links on error pages always have access to the current request.

Contributors to 4.4.11

Thank you to all the contributors that helped make this release happen:

• ADmad
• Edgaras Janušauskas
• fabsn182
• Kevin Pfeifer
• Marc Würth
• Mark Scherer
• Mark Story
• Mikkel Bonde
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.4.12. See the changelog for every commit.

• Fix regression in Query::offset() and Query::limit().

Download a packaged release on github.

Additional Bugfixes in 4.4.10

The 4.4.10 release contains the aforementioned security fix as well as the following fixes. See the changelog for every commit.

• Update association definitions in ORM tests.
• Update build images to Ubuntu 22.04.

Contributors to 4.4.10

Thank you to all the contributors that helped make this release happen:

• ADmad
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

CakePHP 3.10.5 released

The 3.10.5 release contains a single bugfix:

• Fix IntegrationTestTrait providing null as the request body.

Contributors to 3.10.5

• Marc Würth

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Bugfixes

You can expect the following changes in 4.4.9. See the changelog for every commit.

• Improve duplicate route detection in cake routes.
• Make ShadowTranslate strategy for TranslateBehavior handle missing association records with translations consistently with EavStrategy.

Contributors to 4.4.9

Thank you to all the contributors that helped make this release happen:

• ADmad
• Mark Story
• Matthias Wirtz
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

New Features

The migration guide has a complete list of what’s new in 5.0.0. We recommend you give that page a read when upgrading as it notes the various breaking changes present in 5.0.

How you Can Help

You can help deliver 5.0 by contributing in one of many ways:

1. Check the documentation for mistakes, outdated, unclear or broken examples. We’ve been trying to update everything but may have not caught everything.
2. Try it out! Give CakePHP 5.0 a test drive in a non-production application. We’d love to hear how converting a small application went and what was harder than it should have been.
3. File issues for regressions in existing features, or suggest new features. Even if those features don’t make it into 5.0, we would appreciate community input on what should be part of 5.1 and 5.2

Contributors to 5.0.0-beta1

Thank you to all the contributors that have helped since the alpha1 release:

• ADmad
• Chris Nizzardini
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• ndm2
• othercorey
• saeideng

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.4.8. See the changelog for every commit.

• Aligned ServerRequest::scheme() and Uri::getScheme() on how they handle proxy headers.
• Improve compatibility of old PaginatorInterface alias.
• Fixed infinite loop when a table class was created without a name or table, and getAlias() is called on it.
• Improve assertMailSentWith comparisons with array values.
• Fixed sortDefault and directionDefault not working with multiple pagination.
• Improved typehints and API docs.

Contributors to 4.4.8

Thank you to all the contributors that helped make this release happen:

• ADmad
• Marc Würth
• Mark Story
• Matthias Wirtz
• othercorey
• TerryKern

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.4.7. See the changelog for every commit.

• Fixed errors arising from exporting objects with invalid __debugInfo() methods.
• Improved API documentation.
• Fixed missing dependency to cakephp/database.
• Fixed regression in FormHelper::radio() and FormHelper::multiCheckbox().

Contributors to 4.4.7

Thank you to all the contributors that helped make this release happen:

• ADmad
• Felix Kempf
• Mark Scherer
• Mark Story
• ndm2
• Oliver Nowak
• othercorey
• Tyler Lendon

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.4.6. See the changelog for every commit.

• Chained or nested exceptions are now rendered correctly in integration test cases, console and HTML exception rendering.
• ConsoleInputArgument instances no longer consider each other equal based on their option values only.
• Improve typing and psalm error supression.
• FormData now accepts UploadedFileInterface as a file.
• Fixed MySQL schema reflection for tables that use conditional indexes. The expression part of the index is now ignored.
• Updated links to use https instead of http.
• Improved CI configuration security.

Contributors to 4.4.6

Thank you to all the contributors that helped make this release happen:

• ADmad
• Alex
• Arhell
• Corey Taylor
• Mark Story
• Nicos Panayides

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.4.5. See the changelog for every commit.

• Improved handling of authentication errors in Smtp email transport.
• Re-enabled displaying arguments in stack frames on development error pages.
• Improved API documentation.
• Fixed diffForHumans() not translating text based on the current locale.
• The ValidatableInterface is now deprecated.
• Fixed mocking services in tests with mockService() for services that are provided by reflection based container delegates.

Contributors to 4.4.5

• ADmad
• celsowm
• Chris Nizzardini
• Iacovos Constantinou
• Marcelo Rocha
• Mark Scherer
• Mark Story
• othercorey

Thank you to all the contributors that helped make this release happen:

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.4.4. See the changelog for every commit.

• Simplify tests for Database package. This helps with the development of 5.x.
• Fix build errors from new versions of intl, MySQL, and openssl.
• Improved README docs.
• Fix regression in route parameter coercion intoduced in 4.4.3 with the value 0 being cast to an int.

Contributors to 4.4.4

• ADmad
• blieb
• Edgaras Janušauskas
• Mark Scherer
• Mark Story
• othercorey

Thank you to all the contributors that helped make this release happen:

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.4.3. See the changelog for every commit.

• Fixed a potential method call on null in file assertion methods.
• Improved compatibility with PHP 8.2.
• TableLocator::get() no longer throws an error if a table is configured with options and then mocked.
• Updated CI configuration to use windows 2022 image.
• Fixed a regression in Folder::create() where umask was not correctly set.
• Cache keys used with FileEngine are now URL encoded. This aligns the characters valid in cache keys with other engines. It could cause cache misses for applications that were previously using characters outside of the alpha-numeric ranges.
• Removed redundant class type checks.
• Fixed ResultSet indexes being mutated by exceptions thrown within a loop while xdebug is enabled.
• TableLocator now handles getting tables by namespaced class name better.
• Unused properties in Database\Query were deprecated.

Contributors to 4.4.3

Thank you to all the contributors that helped make this release happen:

• ADmad
• Apisathan
• chris cnizzardini
• Edgaras Janušauskas
• Erwane Breton
• Kevin Pfeifer
• Mark Story
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.4.2. See the changelog for every commit.

• Updated constraints on laminas packages.
• Improved EntityTrait::_accessible type annotation.
• Added the encrypt and trustServerCertificate options to SqlServerDriver.
• When viewClasses() based extension driven content-negotiation fails a NotFoundException will now be raised.
• Fixed ServerRequest::is('xml') from returning true on the default Accept header sent by Firefox.
• Added deprecation for the Error.errorLogger configure option. This was missed during the development of the ErrorTrap sub-system.
• Improved API documentation.

Contributors to 4.4.2

Thank you to all the contributors that helped make this release happen:

• ADmad
• Cristian Haunsen
• Mark Story
• Michael Hoffmann
• Nicos Panayides
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.4.1. See the changelog for every commit.

• Fixed broken links in API documentation.
• Reverted a deprecation in implementedEvents() as DebugKit was relying on it and we missed identifying this usage earlier.
• Added scanCount to RedisEngine to give more control over how keys are cleared.
• Improved deprecation warning for ResultSetInterface proxying.
• Fixed updating belongsToMany association junction records that contain composite primary keys that involve a column that is mapped to a non-scalar value.
• Fixed P1D date interval expressions when used as cache TTL values.

Contributors to 4.4.1

Thank you to all the contributors that helped make this release happen:

• ADmad
• Alex Mayer
• Corey Taylor
• Erwane
• Mark Story
• Nicos Panayides
• ndm2
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Upgrading to 4.4.0

You can use composer to upgrade to CakePHP 4.4.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:4.4.*"

Deprecation Warnings

4.4 introduces a few deprecations. All of these features will continue for the duration of 4.x but will be removed in 5.0. See the migration guide.

What’s new in 4.4.0?

The migration guide has a complete list of what’s new in 4.4.0. We recommend you give that page a read when upgrading. A few highlights from 4.4.0 are:

• A new Error and Exception handling framework that is easier to extend and requires less application code to operate.
• The RedisEngine now supports fast deletes with deleteAsync().
• bin/cake routes now highlights collisions in route templates.
• Controller::viewClasses() was added. This method enables controllers to take control of what content-types they can respond as.
• View classes can define the static method contentType() to participate in content-type negotiation.
• Query::expr() was added as an alternative to Query::newExpr().
• The QueryExpression::case() builder now supports inferring the type from expressions passed to then() and else() that implement \Cake\Database\TypedResultInterface.
• BaseApplication::handle() now adds the $request into the service container all the time.
• HttpsEnforcerMiddleware now has an hsts option that allows you to configure the Strict-Transport-Security header.
• TreeBehavior now supports triggering ORM callbacks when deleting nodes.

Contributors to 4.4.0

Thank you to all the contributors that helped make 4.4 happen:

• ADmad
• Alejandro Ibarra
• Chetan Varshney
• Corey Taylor
• Gerhard Lechner
• itosho
• Jorge González
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• naveen
• saeideng

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests. 4.4.0 is a large release and would not have been possible without the community support and feedback.

What’s Next

With 4.4.0 shipped, the core team’s focus will be primarily on CakePHP 5.0. So far in the 5.x branch, the team has:

• Bumped the required version of PHP to 8.1.0
• Removed all the behavior that was deprecated in 4.x.
• Improved typehinting by using features in PHP 8.1.
• Updated interfaces with @method annotations.

The roadmap for 5.x is still under development, and if there is a feature you feel passionate about or a tedious behavior you’d like to see changed, please open an issue and get the discussion started.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.3.10. See the changelog for every commit.

• Fixed patchEntity() failing when a table contains a field that matches the name and casing of the table alias.
• Fixed Collection::__debugInfo() failing when a count could not be generated.

Contributors to 4.3.10

Thank you to all the contributors that helped make this release happen:

• Kevin Pfeifer
• Mark Story
• naveen
• othercorey
• Robert Gasch
• Sheldon Reiff

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Security Fixes

The 3.10.4 release fixes an encoding issue with the verified tokens feature of CsrfProtectionMiddleware released in 3.10.3. In 3.10.3 verfied tokens were generated using random bytes and would often fail to match as the bytes would be incorrectly encoded when rendered in HTML.

Bugfixes

You can expect the following changes in 3.10.4. See the changelog for every commit.

• Fixed incorrectly encoded CSRF tokens when using the verifyTokenSource option.

Contributors to 3.10.4

Thank you to all the contributors that helped make this release happen:

• Marc Würth
• Mark Story

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

New Features

The migration guide has a complete list of what’s new in 4.4.0. We recommend you give that page a read when upgrading as it outlines the deprecations present in 4.4.

Changes Since 4.4.0-RC1

• The current request is now automatically added to your application’s dependency injection container making it easier to have services that depend on the current request.
• Fixture schema reflection now clears the table registry to prevent errors with applications that initialize tables in initialize() hooks.
• PaginatorHelper::limitControl() now works with multiple pagination.
• Additional features on Debugger were deprecated in favour of using ErrorTrap instead.
• Pagination classes were moved under Cake\Datasources\Paging.
• Renamed DefaultPaginator to NumericPaginator.
• The experimental flag was removed from the dependency injection container. It is now considered a stable API.
• Improved the logging configuration in ErrorTrap and ExceptionTrap.
• Fixed missing use of bindingKey in BelongsToMany associations.
• Improved handling of invalid cookie names.
• Improved content-negotiation with file types that have multiple content-type options.
• The FormContext adapter for FormHelper now supports non-default validation rule sets.
• Added a ‘match all’ type to View so that fallback view classes can be implemented in the new content-negotiation feature.
• Added deleteAsync() and clearBlocking() methods to the redis cache engine.
• Added new methods to ErrorLoggerInterface with annotations. The new logError() and logException() methods will replace the logMessage() and log() methods respectively in 5.x. Before using the new error handling subsystem you should update any custom error loggers.
• Improved API documentation.
• Removed usage of string interpolation that is deprecated in PHP 8.2

How you Can Help

You can help by trying out the RC in your application. Please open issues for any new test failures or regressions the new version creates in your application.

Contributors to 4.4.0-RC2

Thank you to all the contributors that have helped with 4.4.0:

• ADmad
• Andrii Pukhalevych
• Corey Taylor
• Danial Khoshkhou
• dependabot[bot]
• Gerasimos
• itosho
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• OJMichael
• othercorey
• Remy Bos

We would also like to thank Guarang Maheta for notifying us of a security issue in bakery.cakephp.org and helping us resolve it.

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.3.9. See the changelog for every commit.

• Improved API documentation.
• Removed redundant function calls in session handling.
• Updated to phpstan 1.6

Contributors to 4.3.9

Thank you to all the contributors that helped make this release happen:

• Mark Scherer
• Mark Story
• othercorey
• Remy Bos

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Security Fixes

The 3.10.3 release contains an opt in security fix for CsrfProtectionMiddleware. Prior to this release, if an application has a cross-site-scripting vulnerability, or an attacker has access to a victim’s browser CSRF tokens could be manipulated allowing CSRF bypass. This weakness stems from CSRF middleware accepting any matching pair of tokens. With the fix applied, only tokens generated by the host application will be accepted. This fix requires opt-in because it breaks compatibility with existing CSRF tokens that may be in user’s browsers/sessions. To enable the new style tokens add the following:

// in src/Application.php
$middlewareQueue->add(new CsrfProtectionMiddleware([
    'verifyTokenSource' => true
]));

Bugfixes

You can expect the following changes in 3.10.3. See the changelog for every commit.

• Fixed a memory leak in TranslatorRegistry when loading translations from cache.

Contributors to 3.10.3

Thank you to all the contributors that helped make this release happen:

• Mark Story
• Val Bancer

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.3.8. See the changelog for every commit.

• Improved examples in documentation blocks.
• Fixed missing usage of bindingKey in associations generated by BelongsToMany.
• Fixed a TypeError coming from CsrfProtectionMiddleware when cookie data contained invalid base64 encoded data.
• Improved handling of numeric keys in cookie parsing.

Contributors to 4.3.8

Thank you to all the contributors that helped make this release happen:

• ADmad
• Andrii Pukhalevych
• Corey Taylor
• Danial Khoshkhou
• Gerasimos
• Kevin Pfeifer
• Mark Scherer
• Mark Story

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.3.7. See the changelog for every commit.

• Fixed additional errors where FileEngine could raise exceptions by calling unlink incorrectly.
• Fixed ‘table already configured’ errors in reflection based fixtures when a table loads and configures another table during its initialize() hook.
• Fixed contain() emitting errors when an association querybuilder uses both explicit fields and autoFields() at the same time.
• Fixed PaginatorHelper::limitControl() not working with multiple-pagination.

Contributors to 4.3.7

Thank you to all the contributors that helped make this release happen:

• ADmad
• Mark Story
• Markus Ramšak
• OJMichael
• Val Bancer
• ndm2
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

New Features

The migration guide has a complete list of what’s new in 4.4.0. We recommend you give that page a read when upgrading as it outlines the deprecations present in 4.4.

New Feature Highlights

• CakePHP 4.4.0 requires PHP 7.4+
• bin/cake routes now highlights route collisions.
• The SQLite driver now uses RETURNING * to update entities after saving with sqlite >=3.35+
• Query::expr() was added as a shorter alias for Query::newExpr().
• A new more extensible error handling subsystem has been added. The existing inheritance based system is now deprecated.
• HttpsEnforcerMiddleware now has an hsts option that allows you to configure the Strict-Transport-Security header.
• Controller::viewClasses() was added. This can be implemented by controllers that need to perform content-type negotiation. View classes will need to implement the static method contentType() to participate in content-type negotiation.

How you Can Help

You can help by trying out the RC in your application. Please open issues for any new test failures or regressions the new version creates in your application.

Contributors to 4.4.0-RC1

Thank you to all the contributors that have helped with 4.4.0:

• ADmad
• Alejandro Ibarra
• Corey Taylor
• Gerhard Lechner
• Jorge González
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• Markus Ramšak
• saeideng

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.3.6. See the changelog for every commit.

• Fixed typing errors when routes converted passed parameters into objects.
• Improved API documentation.
• Fixed a memory leak in TranslatorRegistry when many translations were loaded from cache.
• Improved handling of empty array typed controller action parameters.
• Fixed required options blocking --help output in console commands.
• CacheEngine::deleteMultiple() now attempts to delete all keys instead of stopping at the first failure.
• Fixed regression in belong to many associations that use a junction table and finder that applies contain() to the query.

Contributors to 4.3.6

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Mark Story
• Val Bancer
• ndm2

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.3.5. See the changelog for every commit.

• FormHelper now correctly detects of entity collections.
• Improved error messages for fixture insertion errors.
• Widened the accepted range for psr/log.
• FormHelper checkbox and radio control hiddenField options can now be set to ‘’.
• Http\Client auth adapters can now be set without App.namespace being set.
• Fixed errors detected by newer versions of static analyzers.

Contributors to 4.3.5

Thank you to all the contributors that helped make this release happen:

• ADmad
• Cees-Jan Kiewiet
• Corey Taylor
• Mark Story
• Michael Hoffmann
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.3.4. See the changelog for every commit.

• Improved exception logging. If rendering fails during the ‘safe’ fallback error page rendering, a log message is now recorded..
• Added a omitted method for getting a list of tables without views from a connection.
• Updated Schema\Collection::listTables() to omit views from the table listing. This will resolve problems with views and the new fixture system.
• Improved MySQL table list query.
• Improved route compiliation performance.

Team Changes

Since our last release post there have been a few changes in the CakePHP core team. First, we would like to welcome LordSimal who joins us from Leibnitz, Austria. LordSimal has been actively helping others in the community, improving the documentation and has contributed pull requests to both CakePHP core, and DebugKit. We would like to thank chinpei215 for his many years of involvement in CakePHP as he is leaving the team. During his tenure, chinpei215 identified and fixed several security issues and contributed greatly to i18n functionality in the framework.

Contributors to 4.3.4

Thank you to all the contributors that helped make this release happen:

• ADmad
• Mark Story
• othercorey
• rmarsh1ua

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.3.3. See the changelog for every commit.

• Improved error handling when OAuth signing encounters SSL errors.
• Fixed regression in Router::reverse() and how it handles passed arguments.
• Fixed inserting breadcrumbs at the end of the list with insertAfter().
• Improved API docs.
• Improved error mesages when PDO extensions are missing.

Contributors to 4.3.3

Thank you to all the contributors that helped make this release happen:

• ADmad
• Andrii Pukhalevych
• Corey Taylor
• Juan Pablo Ramirez
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• ndm2

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.10.2. See the changelog for every commit.

• Improved API docs.
• Fixed Router::reverse() not handling passed parameters defined with setPass() properly.
• Fixed BreadCrumbHelper::insertAt() at the last index.

Contributors to 3.10.2

Thank you to all the contributors that helped make this release happen:

• Kevin Pfeifer
• Mark Story
• othercorey
• R.Strittmatter

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.3.2. See the changelog for every commit.

• Added array type coercion to controller actions. Lists of , separated values can now be unpacked into arrays.
• Ensure that $defaultTable is set in controllers.
• Relaxed version contraints on psr/container.
• Updated cache keys generated by Table::get(). Previously keys were not compatible with file based caches. The side-effect of this fix is that cache keys will change.
• Added _urldecode option to route to allow more control on how request URLs are decoded.
• Fixed missing milliseconds in log messages.
• Fixed Router::reverse() not handling parameters created with Route::setPass() properly.
• Added support for 308 HTTP status code.
• Removed _defaultConfig from PaginatorComponent to fix default configuration defined in sub-classes from being ignored.
• Improved API documentation.

Contributors to 4.3.2

Thank you to all the contributors that helped make this release happen:

• ADmad
• Chris Hallgren
• Corey Taylor
• Ian den Hartog
• Kevin Pfeifer
• Marc Würth
• Mark Scherer
• Mark Story

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.3.1. See the changelog for every commit.

• Fixed incomplete cloning when Database\Query is cloned.
• Fixed Query::modifier() not handling expression objects correctly.
• Improved array typehints in API documentation blocks.
• Fixed custom type mappings defined in Table classes not being used when inserting fixture rows with the new fixture system.
• Improved deprecation messages for QueryExpression::case().
• Fixed base path handling in HttpsEnforcerMiddleware.

Contributors to 4.3.1

Thank you to all the contributors that helped make this release happen:

• ADmad
• Mark Scherer
• Mark Story
• mirko-pagliai
• ndm2
• othercorey
• Remi Collet

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.10.1. See the changelog for every commit.

• Fixed radio inputs generating duplicate id attribute values when values had trailing/leading -.
• Fixtures now only reset sequences in SQLServer if required.
• Fix DateType not clearing time for DateTimeImmutable.
• Fixed cascading deletes generating incorrect SQL when bindingKey values are null.

Contributors to 3.10.1

Thank you to all the contributors that helped make this release happen:

• Marc Würth
• Mark Scherer
• Mark Story
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Upgrading to 4.3.0

You can use composer to upgrade to CakePHP 4.3.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:4.3.*"

Deprecation Warnings

4.3 introduces a few deprecations. All of these features will continue for the duration of 4.x but will be removed in 5.0. See the migration guide.

What’s new in 4.3.0?

The migration guide has a complete list of what’s new in 4.3.0. We recommend you give that page a read when upgrading. A few highlights from 4.3.0 are:

• A new fixture system that allows you to use your existing migrations or SQL dump files to define schema was added. Support for cake’s migrations and SQL dump files is included.
• TestSuite\HttpMockTrait was added to make mocking HTTP client requests easier.
• LocatorAwareTrait::fetchTable() was added to make the getTableLocator()->get() pattern more ergonomic.
• Controller::middleware() was added. This method lets you define middleware specific to a controller, or the current controller action.
• deprecationWarning() no longer emits duplicate warnings.
• Logged SQL queries now use boolean literals making them easier to paste into a repl.
• The cake console command was extracted into a new cakephp/repl package.
• Form objects now support multiple validators and leverage a similar interface to the ORM to use those validators.
• CspMiddleware can now transparently add nonce- based policies.
• FormHelper will now set additional ARIA attributes automatically.
• The ORM can now marshall date times from the user’s timezone into the applications timezone transparently.
• CakePHP’s dependency on league/container was bumped to ^4.1.1.

Contributors to 4.3.0

Thank you to all the contributors that helped make 4.3 happen:

• ADmad
• andrii-pukhalevych
• Breton Erwane
• captain-redbeard
• Chris Nizzardini
• Erwane Breton
• fabsn182
• Jan Brabec
• Juan Pablo Ramirez
• Marc Würth
• Mark Scherer
• Mark Story
• ndm2
• othercorey
• Rafael Mardones
• Rob Rikken
• saeideng

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests. 4.3.0 is a large release and would not have been possible without the community support and feedback.

Download a packaged release on github.

Baking allowMultipleNulls in Application Rules

Bake 2.6 will automatically add the allowMultipleNulls option for any unique index that contains a nullable column. This will be set to true for all databases except SQL Server. This should be easier for users to understand the behavior and know where to change the option.

You should see unique rules generated something like this:

$rules->add($rules->isUnique(['field_1', 'field_2'], ['allowMultipleNulls' => true]), ['errorField' => 'field_1']);

There are always edge cases for rules like this. Some users might have nullable columns but maintain unique null values. Some users might have a solution for SQL Server to consider NULL unique. Our goal is to provide reasonable and reliable defaults.

CakePHP 5 Changes

We understand there is confusion caused by changing default behavior of options that are hidden, but we think this needs to be corrected the right way.

CakePHP 5 will default this behavior back to allowing multiple NULL values.

With the above changes to Bake, this should not be a signifcant change in behavior.

New Features

The migration guide has a complete list of what’s new in 4.3.0. We recommend you give that page a read when upgrading as it outlines the deprecations present in 4.3.

Changes from RC3

Since the release of 4.3.0-RC3 the following changes have been made:

• A new fluent builder for CASE expressions was added to QueryExpression.
• QueryExpression::addCase() is now deprecated.
• Associations that load records with the subquery strategy, no longer include a LIMIT clause if there is no ORDER BY on the query.
• CakePHP’s dependency on league/container was bumped to ^4.x this may cause type errors with ServiceProvider implementations.
• The new fixture system was further refined, both in API and performance. These changes may cause incompatibilities with applications using previous release candidates.
• Fixed the singular form of ‘lenses’ to ‘lens’.

How you Can Help

You can help by trying out the RC in your application. Please open issues for any new test failures or regressions the new version creates in your application.

Contributors to 4.3.0-RC4

Thank you to all the contributors that have helped with 4.3.0:

• ADmad
• Corey Taylor
• Mark Scherer
• Mark Story
• ndm2

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.2.10. See the changelog for every commit.

• Fix a TypeError in CsrfProtectionMiddleware when invalid data was provided.
• Fixed MailContains constraint from escaping patterns multiple times.
• Improved API documentation.
• Added workaround for breaking change in PHPUnit 9.5.10.
• Fixed incorrect SQL being generated when a HasMany association has a null value, and the association has cascadeCallbacks.
• Fix DateType not clearing time values for DateTimeImmutable. This scenario can arise when using the cakephp/orm package directly.
• Limit clauses are ignored if no order exists when using a subquery strategy for HasMany associations.

Contributors to 4.2.10

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Julian Pollmann
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• Rolf Kaiser

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

New Features

The migration guide has a complete list of what’s new in 4.3.0. We recommend you give that page a read when upgrading as it outlines the deprecations present in 4.3.

Changes from RC2

Since the release of 4.3.0-RC2 the following changes have been made:

• TestCase::deprecated() now raises an assertion error if the callback doesn’t trigger any deprecations.
• Improved API documentation and static analysis tool typing.
• Improved error messages from incorrect Command classes.
• Fixed behavior of cascading deletes when bindingKey values are null.
• Improved stack references for deprecation warnings.
• Deprecated ModelAwareTrait. Use the new LocatorAwareTrait features instead.
• Added LocatorAwareTrait::fetchTable() as a simpler API to get ORM Table instances.
• Added LocatorAwareTrait::$defaultTable. This property replaces $modelClass.
• Passed parameters from routes can now be typed as float, bool and int. If an invalid value is used in a route, a 404 error will be raised.
• Fixed BelongsToMany junction tables getting the incorrect entity class during association row replacement. Instead of getting entities from the association target table, you will receive entity records from the junction table.
• Duplicate deprecation warnings are only emit once now. You can enable duplicated output by setting Error.allowDuplicateDeprecations to true.
• cake plugin now adds to the bottom of the Application bootstrap instead of the top.

How you Can Help

You can help by trying out the RC in your application. Please open issues for any new test failures or regressions the new version creates in your application.

Contributors to 4.3.0-RC3

Thank you to all the contributors that have helped with 4.3.0:

• ADmad
• Corey Taylor
• Mark Scherer
• Mark Story
• ndm2
• othercorey
• Rolf Kaiser
• saeideng

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

CakePHP 3.x End of Life Extended

We would also like to remind users that End of Life date for CakePHP 3.x was extended to help support users who have made the transition out of 2.x.

• 3.10 will continue to receive bug fixes until December 15, 2021.
• 3.10 will continue to receive security fixes until December 15, 2022.

With CakePHP 4.3 just aroud the corner and work in CakePHP 5 started, we hope users are excited about the push for improvements and tastier Cake.

New Features

The migration guide has a complete list of what’s new in 4.3.0. We recommend you give that page a read when upgrading as it outlines the deprecations present in 4.3.

Changes from RC1

Since the release of 4.3.0-RC1 the following changes have been made:

• View::addHelpers() was added and the $merge flag of setHelpers() was deprecated.
• Association::setName() was deprecated.
• A type error in CsrfProtectionMiddleware was fixed. This error could be triggered if cookie data was invalid.
• MailContains only escapes patterns once noce.
• Fixture cleanup performance was improved for SQLServer.
• BaseLog::resolve() was renamed to BaseLog::interpolate().
• TestCase::loadFixtures() is now deprecated.
• The automatic nonce policy features of CspMiddleware now require opt-in configuration to enable. This improves backwards compatibility for applications with existing CSP policies.
• Improved API documentation.
• Improved extensibility of fixture strategies by always calling setup/teardown methods.

How you Can Help

You can help by trying out the RC in your application. Please open issues for any new test failures or regressions the new version creates in your application.

Contributors to 4.3.0-RC2

Thank you to all the contributors that have helped with 4.3.0:

• ADmad
• Corey Taylor
• Juan Pablo Ramirez
• Julian Pollmann
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• othercorey

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

New Features

The migration guide has a complete list of what’s new in 4.3.0. We recommend you give that page a read when upgrading as it outlines the deprecations present in 4.3.

New Feature Highlights

• Controller::middleware() was added which allows you to define middleware for a single controller only.
• Http\Client::addMockResponse() was added making integration tests easier to write without using complex to define mocks.
• A JSON based logger was added.
• FormHelper generates aria attributes improving out-of-the box accessibility.
• A new fixture subsystem leverages your migrations or SQL dumps to generate test database schema was added.

How you Can Help

You can help by trying out the RC in your application. Please open issues for any new test failures or regressions the new version creates in your application.

Contributors to 4.3.0-RC1

Thank you to all the contributors that have helped with 4.3.0:

• ADmad
• Breton Erwane
• Chris Nizzardini
• Erwane Breton
• J.Brabec
• Jan Brabec
• Juan Pablo Ramirez
• Mark Scherer
• Mark Story
• Rob Rikken
• andrii-pukhalevych
• captain-redbeard
• chris cnizzardini
• fabsn182
• jpramirez
• ndm2
• othercorey

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.2.9. See the changelog for every commit.

• Fixed radio inputs trimming off leading - which could result in duplicate id attributes.
• Improved API documentation.
• Fixed newline usage in MailTransport. In PHP8 mail() require headers to be separated with CRLF instead of PHP_EOL.
• Fixture truncation in SQLServer now only regenerates sequences that were used.

Contributors to 4.2.9

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Lars Willighagen
• Mark Story
• othercorey
• saeideng

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.2.8. See the changelog for every commit.

• Paginator scopes now generate URLs correctly when passed parameters are involved.
• The searched path list in a MissingTemplateException is now correct for elements in plugins.
• Improved documentation for Query::applyOptions().

Contributors to 4.2.8

Thank you to all the contributors that helped make this release happen:

• ADmad
• Joel Montesinos
• Mark Story
• ndm2

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Extending the 3.x Timeline

Previously 3.9 was the last planned feature release for 3.x and bug fix releases were planned to stop after June 15 2021. Because of continued interest and usage of 3.x we’ve decided to extend the 3.x maintenance timeline and release 3.10. The new timelines are:

• 3.10 will continue to receive bug fixes until December 15, 2021.
• 3.10 will continue to receive security fixes until December 15, 2022.

Updating to 3.10.0

You can use composer to upgrade to the beta version of CakePHP 3.10.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:^3.10.0"

What’s new in 3.10.0?

The shortlist of features included in 3.10 is as follows:

• Improved API documentation.
• Backported improvements to Validation::time() from 4.x.
• EmailTrait::assertMailSentFrom() now accepts an array with an address & alias.

Contributors to 3.10.0

Thank you to all the contributors that helped make this release happen:

• bancer
• David Yell
• gregs
• Jorge
• Mark Story
• ndm2
• othercorey
• tanden
• Tobse

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Bugfixes

You can expect the following changes in 4.2.7. See the changelog for every commit.

• Improved error messages for form protection failures.
• Fixed tuple comparisons dropping their parameter binding types which improves subquery generation and marshalling _ids with composite primary keys.
• Improved API documentation.
• I18n\Number no longer emits errors in PHP8 when invalid data is formatted.
• Fixed OAuth1 signature comparison failures when consumer keys contain base64 encoded data.
• Reduced output from debug() when objects implement __debugInfo(). Now only the data from __debugInfo() is exported instead of debug data and all properties which often led to duplicate output.
• Fixed failing console output assertion when output contained a %s placeholder.

Contributors to 4.2.7

Thank you to all the contributors that helped make this release happen:

• ADmad
• Hache_raw
• Mark Scherer
• Mark Story
• Michael Hoffmann
• Rytis Slatkevičius
• fugaco
• ndm2
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.9.10. See the changelog for every commit.

• Fixed ‘text file busy’ errors that occur with file caching and virtual machines.
• Fixed type information being lost when translating tuple comparisons. The surrogate queries did not inherit type map information.
• Fixed types not being used when marshalling _ids and composite keys.
• Added missing encoding to OAuth1 client when the consumer_key is a base64 encoded string.

Contributors to 3.9.10

Thank you to all the contributors that helped make this release happen:

• othercorey
• Mark Story
• ndm2

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.2.6. See the changelog for every commit.

• Updated API documentation for FrozenDate.
• Improved Security.salt warning message.
• Improved exception message in Collection::groupBy() when no key is used.
• cake plugin assets can now handle symlinks on windows.
• Fixed variadic string argument resolution in ControllerFactory.
• Fixed ‘text file busy’ errors that can occur when deleting files on virtual machines.
• Fixed assertMailSentToAt(0) not working correctly.

Contributors to 4.2.6

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Karma Dice
• Mark Scherer
• Mark Story
• gregs
• ndm2

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.9.9. See the changelog for every commit.

• The assertMailSentFrom() method can now compare array emails.
• Improved API documentation.
• Fix BufferedIterator not yielding full results when partially iterated.
• Fix RouteBuilder::plugin() not forwarding the namePrefix option.

Contributors to 3.9.9

Thank you to all the contributors that helped make this release happen:

• Corey Taylor
• Jorge
• Marc Würth
• Mark Story
• TerryKern
• Tobse
• ndm2

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.2.5. See the changelog for every commit.

• Improved time format in response headers. Previously leading 0s were missing.
• Improved API documentation.
• Fixed RouteBuilder::plugin() not forwarding the _namePrefix option.
• Improved accuracy of database query log timers.
• Fixed BufferedIterator not returning all results after being partially iterated and then iterated a second time.
• The standalone database package no longer emits a type error when App.namespace is undefined and the connection does not exist.

Contributors to 4.2.5

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Mark Scherer
• Mark Story
• othercorey
• Saleh Souzanchi
• Tobse

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Extending the 3.x Timeline

Previously 3.9 was the last planned feature release for 3.x and bug fix releases were planned to stop after June 15 2021. Because of continued interest and usage of 3.x we’ve decided to extend the 3.x maintenance timeline and release 3.10. The new timelines are:

• 3.10 will continue to receive bug fixes until December 15 2021.
• 3.10 will continue to receive security fixes until December 15 of 2022.

Updating to the RC

You can use composer to upgrade to the beta version of CakePHP 3.10.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:3.10.0-RC1"

We would greatly appreciate it if you temporarily upgraded your application, and ran your tests. By opening issues for any regressions in the release candidate, we can help ensure a smoother release of 3.10.0 before the stable release.

What’s new in 3.10.0?

The shortlist of features included in 3.10 is as follows:

• Improved API documentation.
• Backported improvements to Validation::time() from 4.x.
• EmailTrait::assertMailSentFrom() now accepts an array with an address & alias.

Contributors to 3.10.0-RC1

Thank you to all the contributors that helped make this release happen:

• Corey Taylor
• David Yell
• Marc Würth
• Mark Story
• tanden
• TerryKern
• Val Bancer

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Bugfixes

You can expect the following changes in 3.9.8. See the changelog for every commit.

• The changes made to TableLocator::get() in 3.9.7 were reverted as issues were opened as plugins rely on shallow initialization loops.

Contributors to 3.9.8

Thank you to all the contributors that helped make this release happen:

• ADmad
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.9.7. See the changelog for every commit.

• bin/cake routes check no longer fails when redirect routes are used.
• Improved API documentation and method annotations.
• The variable replacement behavior was aligned between the sprintf and icu message formatters. This change was a backport from 4.x.
• Aligned Entity::isEmpty() and Entity::hasValue() to treat '0' as a non-empty value. This aligns the behavior with documentation and original intent.
• Fixed path handling in FileCache to prevent deleting an empty paths.
• TableLocator::get() now raises an error when a table’s initialize() method would create an infinite loop.
• Email::setReplyTo() now takes multiple addresses.

Contributors to 3.9.7

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Marc Würth
• Mark Story
• mtak3
• ndm2
• othercorey
• Waldemar Bartikowski

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.2.4. See the changelog for every commit.

• Fix bin/cake routes check not handling redirect routes correctly.
• Removed a connection flag from the SQLServer driver that is incompatible with pdo_sqlsrv 5.9+.
• Improved API documentation.
• Console TableHelper now accepts integers and floats as cell values.
• Updated documentation for ServerRequest::is() to allow mixed.
• Improved PHP8 compatibility for silenced errors.
• Aligned Entity::isEmpty() and Entity::hasValue() to treat '0' as a non-empty value. This aligns the behavior with documentation and original intent.
• DatabaseSession now uses the session table’s entity when creating/deleting records.
• Fixed path handling in FileCache to prevent deleting an empty paths.

Contributors to 4.2.4

Thank you to all the contributors that helped make this release happen:

• ADmad
• AdmDevelopment
• Alexander Volle
• Mark Story
• mirko-pagliai
• mtak3
• ndm2
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.2.3. See the changelog for every commit.

• Improve saving of translations when using the shadow table strategy.
• Improved flash message retention. Messages are now merged with the existing messages making it compatible with multiple requests in the same test method.
• Fix Session::read() to return the default value when a session cannot be started.
• Improved API documentation.
• Validation::custom() now accepts integer values.
• The sprintf() translation formatter now works consistently with the intl based implementation when translating plural values. The count parameter is no longer the first placeholder value.
• Mailer\Message now includes the textMessage and htmlMessage in serialized data.
• Arguments for stacktraces are now included by default for development error pages.

Contributors to 4.2.3

Thank you to all the contributors that helped make this release happen:

• ADmad
• Cauan Cabral
• Corey Taylor
• Hache_raw
• Joseph Shanak
• Mark Scherer
• Mark Story
• o0h
• othercorey
• Thx3r
• Waldemar Bartikowski

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.9.6. See the changelog for every commit.

• Enabled exception argument collection in ErrorHandlerMiddleware for PHP>7.4

Contributors to 3.9.6

Thank you to all the contributors that helped make this release happen:

• Erwane Breton
• Mark Story

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.2.2. See the changelog for every commit.

• Integration tests now persist flash message more reliably when custom view classes are used, and when redirects are performed.
• Changes made to FixtureManager were reverted fixing problems with fixture schema management and partial data loading.
• API documentation was improved.
• CSRF tokens created by CsrfProtectionMiddleware are now salted to mitigate BREACH vulnerabilities. The tokens are now longer, and are encoded with base64 instead of hexadecimal encoded.

Contributors to 4.2.2

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Mark Scherer
• Mark Story

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.9.5. See the changelog for every commit.

• Fixed missing parenthesis on subqueries in SQLServer.
• Fixed incorrect bindings when ordering queries by expressions in SQLServer.
• Fix Hash::mergeDiff() not handling scalar values during merging well.

Contributors to 3.9.5

Thank you to all the contributors that helped make this release happen:

• Mark Story
• ndm2
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.2.1. See the changelog for every commit.

• Fix fixture file casing.
• Improved API documentation for TimeHelper.
• Added additional setup warnings for short Security.salt values. Ideally salt values are 32 bytes or longer.
• Fix null values being passed to controller actions when resolving dependencies.
• Fix BREACH weakness in SessionCsrfProtectionMiddleware.

Contributors to 4.2.1

Thank you to all the contributors that helped make this release happen:

• ADmad
• Mark Scherer
• Mark Story
• Remi Collet

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Upgrading to 4.2.0

You can use composer to upgrade to CakePHP 4.2.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:4.2.*"

Deprecation Warnings

4.2 introduces a few deprecations. All of these features will continue for the duration of 4.x but will be removed in 5.0. See the migration guide.

What’s new in 4.2.0?

The migration guide has a complete list of what’s new in 4.2.0. We recommend you give that page a read when upgrading. A few highlights from 4.2.0 are:

• Full support for PHP8.
• Experimental support for a dependency injection container was added. The DI container enables you to have application dependencies injected into controller constructors, controller actions and command constructors.
• SQLServer driver now uses client-side buffers for results. This improves performance greatly.
• Cake\Http\Middleware\SessionCsrfProtectionMiddleware was added. Instead of storing CSRF tokens in a cookie, this middleware stores tokens in the session. This makes CSRF tokens user scoped and time based with the session, offering enhanced security over cookie based CSRF tokens.
• A new utility class Cake\Http\FlashMessage was added whose instance is available through ServerRequest::getFlash(). The class similar to the FlashComponent allows you to set flash messages from anywhere you have a request, making it useful in middleware.
• Table::subquery() and Query::subquery() were added. These methods lets you create query objects that don’t have automatic aliasing.
• Collations are now supported for string literals and IdentifierExpression.

Contributors to 4.2.0

Thank you to all tbe contributors that helped make 4.2 happen:

• ADmad
• Blaz
• chris cnizzardini
• Edgaras Janušauskas
• Eugene Ritter
• imo-tikuwa
• Juan Basso
• Mario Rothauer
• Mark Scherer
• Mark Story
• ndm2
• othercorey
• Ricardo Turella
• tanden
• tikuwa

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests. 4.2.0 is a large release and would not have been possible without the community support and feedback.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 2.10.24. See the changelog for every commit.

• Fixed incorrect URL parsing when REQUEST_URI contains a string that is the same length as the App.fullBaseUrl.

Contributors to 2.10.24

Thank you to all the contributors that helped make this release happen:

• Mark Story

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.1.7. See the changelog for every commit.

• Improved API documentation
• Added additional tests for flash message retention in tests.
• Fixed SQL Server missing parenthesis on pagination subquery order clause.
• Fixed SQL Server binding conflicts when ordering by expression objects.
• Improved error messages when database queries are missing operators.
• Fixed Hash::mergeDiff() not handling scalar values well.

Contributors to 4.1.7

Thank you to all the contributors that helped make this release happen:

• ADmad
• Ikko Ashimine
• Mark Scherer
• Mark Story
• Markus Ramšak
• ndm2
• othercorey
• saeideng

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.0.10. See the changelog for every commit.

• Fixed validation of HTTP methods defined in _method parameters.

Contributors to 4.0.9

Thank you to all the contributors that helped make this release happen:

• Mark Story
• Xhelal Likaj

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

New Features

The migration guide has a complete list of what’s new in 4.2.0. We recommend you give that page a read when upgrading as it outlines the deprecations present in 4.2.

Changes Since 4.2.0-beta1

• Http\Client::createFromUrl() was added.
• Improved errors when INSERT queries cannot be compiled.
• TableHelper::output() now has a text-right tag to right align cell content.
• TestFixture::isManaged() was added to make whether a fixture manages schema more explicit.
• UrlHelper now supports the assetUrlClassName option, which allows you to replace the class used to generate static asset URLs.
• TableLocator::allowFallbackClass() was added. This method lets you disable automatic fallback table class in a locator.
• Http\FlashMessage was added. This utility class enables flash messages to be manipulated from within middleware.
• Http\ServerRequest::getFlash() was added to expose the new flash utility.
• Fixing binding conflicts in SQLServer queries.
• Added Application.buildContainer event. This event is triggered when the application container is built.
• Integration test traits had the mockService() method added to enable straightforward mocking of services in tests.

How you Can Help

You can help by trying out the RC in your application. Please open issues for any new test failures or regressions the new version creates in your application.

Contributors to 4.2.0-RC1

Thank you to all the contributors that have helped with 4.2.0:

• ADmad
• Corey Taylor
• Edgaras Janušauskas
• Eugene Ritter
• Ikko Ashimine
• imo-tikuwa
• Juan Basso
• Mark Scherer
• Mark Story
• ndm2
• othercorey
• saeideng
• tikuwa

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.9.4. See the changelog for every commit.

• The pj() function now supports UTF-8 data better.
• Fixed warning about SameSite index when upgrading from earlier versions of 3.x.
• Improved API documentation.
• Added upper PHP version constraint of <8.0. Because 3.x has several dependencies that are not compatible with PHP8, we also cannot easily support PHP8 without breaking compatibility.

Contributors to 3.9.4

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Mark Story
• Saleh Souzanchi
• Tadahisa Motooka
• terry.kern

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.1.6. See the changelog for every commit.

• The Validator::setStopOnFailure() method was added. This method helps improve ease of upgrading from 3.x. It allows the require* methods to stop field validation.
• Mailer::setReplyTo() now accepts multiple email addresses. This change aligns Reply-To with other email fields that accept multiple recipients.
• Warnings emitted by AuthComponent when using strict mode and a mocked request were fixed.
• Fixed incorrect error messages for named routes that failed to match.
• Fixed string condition parsing in having and where conditions when the string condition contains functions and spaces.
• Improved API documentation.
• OAuth 1.0 signatures no longer include request bodies if the request is not urlencoded data.
• Support for UTF8 encodings was added to pj().
• Entity marshalling now loosely compares objects. Previously strict comparisons were used causing all object attributes to considered dirty and updated.
• Improved error messages when INSERT queries were missing a table name.
• BodyParserMiddleware now correctly handles scalar value request bodies for JSON requests.
• ServerCommand now honours the PHP environment variable when starting the HTTP server.

Contributors to 4.1.6

Thank you to all the contributors that helped make this release happen:

• ADmad
• chris cnizzardini
• Corey Taylor
• Daniel Opitz
• Juan Basso
• Marc Würth
• Mark Scherer
• Mark Story
• Matthias Wirtz
• othercorey
• Ricardo Turella
• Richard.Strittmatter

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

New Features

The migration guide has a complete list of what’s new in 4.2.0. We recommend you give that page a read when upgrading as it outlines the deprecations present in 4.2.

How you Can Help

You can help by trying out the beta in your application. Please open issues for any new test failures or regressions the new version creates in your application.

Contributors to 4.2.0-beta1

Thank you to all the contributors that have helped with 4.1.0:

• ADmad
• Blaz
• chris cnizzardini
• Corey Taylor
• Mario Rothauer
• Mark Scherer
• Mark Story
• ndm2
• othercorey
• Ricardo Turella
• tanden

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.9.3. See the changelog for every commit.

• Reduce the usage of deprecated features in Http package.
• Fixed HasMany associations not applying conditions defined within a closure during an unlink operation.
• Cookies can have their SameSite attribute defined in PHP 7.3+.
• Improved API documentation.

Contributors to 3.9.3

Thank you to all the contributors that helped make this release happen:

• ADmad
• itosho
• Mark Story
• Mischa ter Smitten

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.1.5. See the changelog for every commit.

• cake plugin load will now display an error when an invalid plugin name is used.
• Improved compatibility with PHP8.
• Test fixtures now truncate tables that have externally defined schema. Previously they would not be truncated or dropped and subsequent tests would fail.
• MemcachedEngine will now raise an exception when persistent connections are used with different server lists.
• AuthComponent no longer raises an error when the request has no action defined.
• Improved cross browser compatibility of ‘Copy’ button in debug output.
• Updated parameter names inside Collection in preparation foro PHP8.

Contributors to 4.1.5

Thank you to all the contributors that helped make this release happen:

• ADmad
• bancer
• Corey Taylor
• itosho
• Jonathan McAndrew
• Mark Scherer
• Mark Story
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.1.4. See the changelog for every commit.

• Route now normalizes HTTP method names. This prevents hard to diagnose route matching failures when a method was miscased.
• The output of debug() now includes whitespace in the generated HTML. This improves the text output when contents are copy and pasted.
• The HTML output of debug() now includes a ‘copy’ button to make copying the contents easier.
• Parameter name mismatches between interfaces, and implementations were fixed in preparation for PHP8’s named parameters.
• Invalid UUID values now emit warnings less often during marshalling.
• TableRegistry::get() now generates aliases correctly when tables are fetched with their full qualified namespace name.

Contributors to 4.1.4

Thank you to all the contributors that helped make this release happen:

• ADmad
• Mark Scherer
• Mark Story
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.9.2. See the changelog for every commit.

• The Http\Client curl adapter now uses CURLOPT_NOBODY when making HEAD requests.
• Fix output buffers not being closed when view templates or blocks are being rendered. This fixes tests being marked as risky in PHPUnit.
• PaginatorHelper::first() and last() now correctly handle url options.

Contributors to 3.9.2

Thank you to all the contributors that helped make this release happen:

• Marc Würth
• Mark Story
• ndm2
• Nicky Gerritsen

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.1.3. See the changelog for every commit.

• The changes made to not reload plugin configuration was reverted as it caused regressions in community plugins.
• XML entity loading code was de-duplicated and made compatible with PHP8.
• The SqlServer driver now raises an exception when more than 2100 parameters are provided as that is the maximum that SQLServer supports.
• The SqlServer driver will now retry connection creation up to 4 times on certain errors such as database paused. This increases compatibility with cloud hosted SQLServer instances.
• View now closes all open output buffers when an element or view fails during rendering. This resolves open buffer warnings in test cases.
• DateType now ensures that time components are wiped for PHP provided classes as well.

Contributors to 4.1.3

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Mark Scherer
• Mark Story
• ndm2

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.1.2. See the changelog for every commit.

• Fixed usage of deprecated classes internally.
• Fixed TypeError in PHP8.
• Improved type checking in Validation::custom() and localizedTime().
• Fixed potential collision with placeholders in Text::insert().
• Enabled autoloading of models when modelClass is defined with a fully qualified namespace name.
• Enable log formats to log milliseconds.
• Fixed incorrect behavior when sending a HEAD request and the response contains a Content-Length header.
• Whitespace inside strings output via debug() is now retained in the HTML output format.
• Improve database logging to handle SELECT queries that return no rows.
• Update external entity loading options to work with newer versions of libxml.
• Table::getAlias() now handles abstract base classes better.

Contributors to 4.1.2

Thank you to all the contributors that helped make this release happen:

• ADmad
• Benjamin Gehrels
• Corey Taylor
• Edgaras Janušauskas
• Marc Würth
• Mark Scherer
• Mark Story
• mcsknp
• Nicky Gerritsen
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.9.1. See the changelog for every commit.

• Connection::transactional() will now rollback the transaction on a Throwable instance.
• Fixed encoding issue in MO file parser.
• Improved API documentation.
• Added ssl_local_pk option to HttpClient.
• Collection::shuffle() now includes elements with duplicate keys in the collection.
• Added deprecation tag to NumberHelper::defaultCurrency(). Use getDefaultCurrency() and setDefaultCurrency() instead.

Contributors to 3.9.1

Thank you to all the contributors that helped make this release happen:

• Corey Taylor
• Edgaras Janušauskas
• Mark Scherer
• Mark Story
• othercorey
• Philo Hamel
• Val Bancer
• Vincent PLANCHER

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.1.1. See the changelog for every commit.

• FlashComponent::set() now handles Throwable in addition to Exception.
• debug() now can output objects like SplFixedArray that have integer property names.
• Validation::date() no longer accepts values that have , after the month value.
• Assets in vendor prefixed plugins now are correctly timestampped by HtmlHelper.
• Routing error pages no longer double encode HTML for route elements and options.
• Fix incorrect aliasing for Cake\Database\Expression\ComparisonExpression that was causing a regression in application/plugin code.
• Improved compatibility in getMockForModel().
• The parsed results of DSN strings now cast timeout to an integer.
• CsrfProtectionMiddleware not raises an exception when the request already contains a csrfToken attributes as this implies that CSRF has already been applied to the request and applying it twice is a configuration error.

Contributors to 4.1.1

Thank you to all the contributors that helped make this release happen:

• ADmad
• Cauan Cabral
• Corey Taylor
• Gerd Katzenbeisser
• Mark Scherer
• Mark Story
• mitzzzjp
• Peter Härder

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Upgrading to 4.1.0

You can use composer to upgrade to CakePHP 4.1.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:4.1.*"

Deprecation Warnings

4.1 introduces a few deprecations. All of these features will continue for the duration of 4.x but will be removed in 5.0. See the migration guide.

What’s new in 4.1.0?

The migration guide has a complete list of what’s new in 4.1.0. We recommend you give that page a read when upgrading. A few highlights from 4.1.0 are:

• Support for Common Table Expressions (CTE) in the ORM.
• Support for window functions in the ORM.
• Query::orderAsc() and Query::orderDesc() now accept Closure’s as their field enabling you to use build complex order expressions with the provided QueryExpression object.
• debug() and Debugger::printVar() now emit HTML in web contexts, and ANSI styled output in CLI contexts. Output of cyclic structures and repeated objects is much simpler. Cyclic objects are only dumped once and use reference ids to point back to the full value.
• CsrfProtectionMiddleware can now create cookies with the samesite attribute set.
• Log messages can now contain {foo} style placeholders. These placeholders will be replaced by values from the $context parameter if available.

Contributors to 4.1.0

Thank you to all the contributors that helped make 4.1 happen:

• ADmad
• andrii-pukhalevych
• Cauan Cabral
• chinpei215
• Corey Taylor
• Diego Sardina
• diegosardina
• Edgaras Janušauskas
• Frank de Graaf
• Jad Bitar
• John Zwarthoed
• Marc Würth
• Mario Rothauer
• Mark Scherer
• Mark Story
• Matthias Wirtz
• McsKienNP
• mcsknp
• mtak3
• ndm2
• nojimag
• Oliver Nowak
• othercorey
• saeideng
• victoreassi
• Vincent PLANCHER
• Walther Lalk

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests. 4.1.0 is a large release and would not have been possible without the community support and feedback.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.0.9. See the changelog for every commit.

• Added support for AUTH PLAIN to SmtpTransport.
• Improved API docblocks and type annotations.
• Removed usage of ReflectionParameter::getClass() as it is deprecated in PHP 8.
• Improved performance of ServerRequest::is() and isAll().
• Fixed warnings in SecurityComponent, FormProtector and CsrfProtectionMiddleware when handling invalid non-scalar data.
• Fixed incorrect paths in missing layout error pages.

Contributors to 4.0.9

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Edgaras Janušauskas
• Mark Scherer
• Mark Story
• andrii-pukhalevych

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

New Features

The migration guide has a complete list of what’s new in 4.1.0. We recommend you give that page a read when upgrading as it outlines the deprecations present in 4.1.

Changes Since 4.1.0-RC1

• Table::saveMany() now triggers the Model.afterSaveCommit event.
• Improved deprecation links.
• Fix a regression in RC1 where associations with dependent but not associated records would cause deletions to fail.
• Fixed inflection of CamelCase words.
• Deprecated TableRegistry::get(). Use the TableLocatorAwareTrait instead.
• Fix query LoggingStatement prematurely fetching records.
• The whitelist and sortWhitelist options for PaginatorComponent have been deprecated. Use allowedParameters and sortableFields instead.
• Fixed incorrect paths in missing layout exception pages.
• CsrfProtectionMiddleware::whitelistCallback() has been deprecated. Use skipCheckCallback() instead.
• Add support for console colors in Windows 10 and bash emulation.

How you Can Help

You can help by trying out the RC in your application. Please open issues for any new test failures or regressions the new version creates in your application.

Contributors to 4.1.0-RC2

Thank you to all the contributors that have helped with 4.1.0:

• ADmad
• Corey Taylor
• Mark Scherer
• Mark Story
• Walther Lalk
• ndm2

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Upgrading to 3.9.0

You can use composer to upgrade to CakePHP 3.9.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:3.9.*"

Deprecation Warnings

• ConsoleIo::info(), success(), warning() and error() will no longer accept null values in the message parameter in 4.0.
• Using a comma separated string for $fixtures in test cases is deprecated. Instead use an array, or implement the new getFixtures() method on your test case classes.
• Validator::errors() was renamed to Validator::validate().
• FormHelper::create() now emits deprecation warnings when the $context parameter is a boolean or string. These values trigger fatal errors in 4.0 and will need to be updated before upgrading.
• The magic method signature for FunctionBuilder::cast([...]) is deprecated. Use FunctionBuilder::cast('field', 'type') instead.
• Abandoned zendframework package has been replaced with laminas which provides backwards-compatible classes.

What’s new in 3.9.0?

The migration guide has a complete list of what’s new in 3.9.0. We recommend you give that page a read when upgrading. A few highlights from 3.9.0 are:

• Command classes can implement the defaultName() method to overwrite the conventions based CLI name.
• Query::orderAsc() and Query::orderDesc() now accept Closure’s as their field enabling you to use build complex order expressions with the provided QueryExpression object.
• Cake\Datasource\SimplePaginator was added. This class makes paginating very large results more efficient. It skips running the potentially expensive count() query. If you only use ‘next’ and ‘previous’ navigation in your pagination controls this class can be a good solution.
• Cake\Http\Client\Response::isSuccess() was backported from 4.0
• Cake\Http\Middleware\CspMiddleware was backported from 4.0
• BaseApplication::addOptionalPlugin() was added. This method handles loading plugins, and handling errors for plugins that may not exist because they are dev dependencies.
• The i18n global functions now only return strings. The changes made to 4.0 to remove the null return value when no translation string is provide have been backported to 3.9.
• Lenient parsing can be disabled for parseDateTime() and parseDate() using disableLenientParsing(). The default is enabled - the same as IntlDateFormatter.
• Table::saveManyOrFail() method has been added that will throw PersistenceFailedException with the specific entity that failed in case of an error. The entities are saved within a transaction.
• Table::deleteMany() and Table::deleteManyOrFail() methods have been added for removing many entities at once including callbacks. The entities are removed within a transaction.
• Text::uuid() now uses random_int() with PHP 5.6 insted of mt_rand(). This adds a dependency on paragonie/random_compat which implements it for PHP 5.6.

Contributors to 3.9.0

Thank you to all the contributors that helped make 3.9 happen:

• ADmad
• Cauan Cabral
• Corey Taylor
• Edgaras Janušauskas
• Erwane Breton
• Florian Krämer
• Frank de Graaf (Phally)
• Jorge González
• Mark Scherer
• Mark Story
• Robert Pustułka
• Tibor
• Val Bancer
• Victor Eduardo de Assis
• Zuluru
• andrii-pukhalevych
• bancer
• gregs
• mcsknp
• ndm2
• nojimage

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests. 3.9.0 is a large release and would not have been possible without the community support and feedback.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.8.13. See the changelog for every commit.

• Improve API documentation annotations.
• Add AUTH PLAIN support to the SmtpTransport.
• Fix warnings emitted by SecurityComponent and CsrfProtectionMiddleware when array data was provided in specific inputs.

Contributors to 3.8.13

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Mark Story

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 2.10.22. See the changelog for every commit.

• Improve API documentation.
• Fix UUID generation to not include host or IP based information. This aligns the implementation with the documented behavior of being a v4 UUID.
• Improved performance of Request::is() and Request::isAll()

Contributors to 2.10.22

Thank you to all the contributors that helped make this release happen:

• Mark Sch
• Mark Story
• Richard van den
• Val Bancer
• andrii-pukhalevych
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

New Features

The migration guide has a complete list of what’s new in 4.1.0. We recommend you give that page a read when upgrading as it outlines the deprecations present in 4.1.

Changes Since 4.1.0-beta1

• Form\Form::set() was added to help incrementally update the data in a Form object.
• The interface for CommonTableExpressions and windowing functions were improved.
• TranslateBehavior now supports a locale option when finding records. This option lets you set the locale for a single find call.
• Query::clearResult() was added to clear the internal result and count value.
• Deprecation annotations now contain IDE clickable links.
• Added missing annotations in the Validation package.
• Datetime inputs created through FormHelper can have the step option unset.
• Cache adapters that require extensions now raise clearer exceptions when the required extensions are missing.
• Datasource\LocatorInterface was added to help easy other locator implementations.
• SmtpAdapter now supports AUTH PLAIN.
• PHP8 nightly builds were added to the CakePHP test matrix.
• Delete operations with cascading callbacks now abort when an associated record fails to delete because of application rule failures.
• Query::orderAsc() and Query::orderDesc() now support closures to build the order clause.
• Session::read() now has a default parameter.
• Session::readOrFail() was added.

How you Can Help

You can help by trying out the RC in your application. Please open issues for any new test failures or regressions the new version creates in your application.

Contributors to 4.1.0-RC1

Thank you to all the contributors that have helped with 4.1.0:

• ADmad
• Corey Taylor
• Edgaras Janušauskas
• Frank de Graaf
• Mark Scherer
• Mark Story
• Matthias Wirtz
• andrii-pukhalevych
• ndm2
• othercorey

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Updating to the RC

You can use composer to upgrade to the beta version of CakePHP 3.9.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:3.9.0-RC2"

We would greatly appreciate it if you temporarily upgraded your application, and ran your tests. By opening issues for any regressions in the release candidate, we can help ensure a smoother release of 3.9.0 before the stable release.

What’s new in 3.9.0?

The migration guide has a complete list of what’s new in 3.9.0, and what has been deprecated. We recommend you give that page a read when upgrading.

Changes Since 3.9.0-RC1

• Added Cake\Orm\Query::clearResult(). This method makes it easier to re-use a query object to fetch results multiple times.
• The __() family of functions no longer have null in their return type. Instead they always return a string. This behavior was backported from 4.0
• Improved API documentation.

Contributors to 3.9.0-RC2

Thank you to all the contributors that helped make this release happen:

• Corey Taylor
• Frank de Graaf
• Mark Story
• Val Bancer
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Bugfixes

You can expect the following changes in 4.0.8. See the changelog for every commit.

• Update API documentation and method typing.
• Fixed marshalling datetime values of HH:mm.
• Removed @throws annotations from IntegrationTestTrait methods.
• Fixed handling of false values in FormHelper. Instead of '', 0 is used now.
• Improved CSRF validation error messages.
• Fixed application/www-form-urlencoded payloads in integration tests showing up as empty arrays.
• XmlView no longer tries to get keys of non-array values.

Contributors to 4.0.8

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Frank de Graaf
• Mark Scherer
• Mark Story
• diegosardina

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 2.10.21. See the changelog for every commit.

• Improve compatibility with PHP7.4 by removing usage of deprecated string offset syntax.
• Added support for TLS 1.3 to CakeSocket.
• Fixed argument order for implode() call that would fail in PHP8.

Contributors to 2.10.21

Thank you to all the contributors that helped make this release happen:

• ADmad
• Jakub Onderka
• Mark Sch
• Mark Story
• Markus Podar
• Val Bancer
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

New Features

The migration guide has a complete list of what’s new in 4.1.0. We recommend you give that page a read when upgrading as it outlines the deprecations present in 4.1.

How you Can Help

You can help by trying out the beta in your application. Please open issues for any new test failures or regressions the new version creates in your application.

Contributors to 4.1.0-beta1

Thank you to all the contributors that have helped with 4.1.0:

• ADmad
• Corey Taylor
• Diego Sardina
• Edgaras Janušauskas
• Jad Bitar
• John Zwarthoed
• Marc Würth
• Mario Rothauer
• Mark Scherer
• Mark Story
• McsKienNP
• Oliver Nowak
• andrii-pukhalevych
• chinpei215
• mcsknp
• mtak3
• ndm2
• nojimage
• saeideng

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Updating to the RC

You can use composer to upgrade to the beta version of CakePHP 3.9.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:3.9.0-RC1"

We would greatly appreciate it if you temporarily upgraded your application, and ran your tests. By opening issues for any regressions in the release candidate, we can help ensure a smoother release of 3.9.0 before the stable release.

What’s new in 3.9.0?

The migration guide has a complete list of what’s new in 3.9.0, and what has been deprecated. We recommend you give that page a read when upgrading.

Contributors to 3.9.0-RC1

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Edgaras Janušauskas
• Erwane Breton
• Florian Krämer
• Jorge González
• Mark Scherer
• Mark Story
• Robert Pustułka
• Tibor
• Val Bancer
• Victor Eduardo de Assis
• Zuluru
• gregs
• mcsknp
• ndm2
• nojimage

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Bugfixes

You can expect the following changes in 3.8.12. See the changelog for every commit.

• Fixed casing of stored procedures used to reflect schema in SQLServer to work on case sensitive databases.
• Improved compatibility aliases for PHPUnit.
• Improved API docstrings.
• Fixed error when Email messagaes were force wrapped and were exactly the maximum line length.

Contributors to 3.8.12

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Edgaras Janušauskas
• Erwane Breton
• Mark Scherer
• Mark Story
• Nicolas

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.0.7. See the changelog for every commit.

• Improved CSRF generation to fix upgrade errors introduced in 4.0.6
• MailSentWith assertions now include the contents of the messages that did not pass the assertion.
• Fixed Debugger::exportVar() now handles uninitialized typed properties from PHP 7.4
• Improved API docstring types.
• Improved rendering of multiline exception messages and messages with inline code formatting.
• Improved defining ISO8601 validation rules.

Contributors to 4.0.7

Thank you to all the contributors that helped make this release happen:

• ADmad
• Edgaras Janušauskas
• Erwane Breton
• Johan Meiring
• Mark Scherer
• Mark Story
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.0.6. See the changelog for every commit.

• Nirmal Kirubakaran contacted us via the security mailing list and disclosed a vulnerability in our CSRF token generation. If an attacker were to use an XSS vulnerabiity or physical access to fixate a CSRF token they could then exploit additional CSRF attacks. In this release generated tokens contain an HMAC signed with Security.salt. This ensures the tokens were generated by the same application that receives them. CSRF tokens generated in previous versions will now be rejected by 4.0.6 as they do not contain the HMAC.
• Improved session access in IntegrationTestTrait through the new getTestSession() method.
• Fixed generation of pagination links on / URLs.
• cake plugin unload and cake plugin load now handle vendor namespaced plugins.
• Validation::inList() no longer emits a warning on a non-scalar values.
• Schema reflection stored procedures in SQLServer now work in case sensitive configurations.
• Email message wrapping no longer emits errors when lines are the same length as the wrap length.
• App::path() now resolves locale files for plugins.

Contributors to 4.0.6

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Mark Scherer
• Mark Story
• Nicolas

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.8.11. See the changelog for every commit.

• Added deprecation notice about ResponseEmitter to Response::send().
• Fixed a division by 0 warning when file cache gc probability is set to 0.
• Updated deprecation warning supression for test suites in PHP 7.4.
• Allow usage of unassigned HTTP status codes between 100 and 599.

Contributors to 3.8.11

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Edgaras Janušauskas
• Mark Story
• Rachman Chavik

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.0.5. See the changelog for every commit.

• SMTP delivery failure exceptions now include the error text received from the destination server.
• Improved API documentation.
• Table::saveMany() now correctly rollbacks a transaction when an entity other than the first fails to save because of application rules or database failure.
• ConsoleIntegrationTestTrait now uses mocked _out and _err objects if they have been set.
• ConsoleInput::read() now handles false values from fgets() and readline.
• CounterCacheBehavior now handles null association values better when custom finders are used.
• Http\Response now allows usage of unassigned HTTP status codes between 100 and 599.
• Binary data in SQL query logs is now encoded as hexadecimal to improve readability of query logs.

Contributors to 4.0.5

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Edgaras Janušauskas
• Jad Bitar
• Mark Scherer
• Mark Story
• Victor Eduardo de Assis
• nook24

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.0.4. See the changelog for every commit.

• Http\Response::$_contentType was removed as it was often wrong and out of sync with the getHeader('Content-Type') value.
• NumberHelper::precision() had the $options parameter added so it can better wrap Number::precision().
• Add timestamptimezone mapping to FormHelper and DateTimeWidget.
• IntegrationTestCaseTrait once again raises exceptions when disableErrorHandlerMiddleware() is used.
• datetime-local values are rendered with milliseconds by DateTimeWidget only when step size is less than 1.
• Improved API documentation.
• Improved missing template exception messages. They now list out the full path of every attempted file.
• CounterCacheBehavior no longer attempts to update values when the foreign key is null.
• Loading optional associations with leftJoinWith() and contain() no longer raises an exception about missing association data.
• TextHelper::autoParagraph() now accepts null.
• HtmlHelper::para() now accepts null.
• Validation::decimal() now handles Polish formatted numbers correctly.
• HasMany associations now set invalid messages and errors on the parent entity when non-atomic saves fail.
• Improved missing database exception message.
• Logged fatal errors now include the file and line position.

Contributors to 4.0.4

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Justin Slamka
• Mark Scherer
• Mark Story
• Michal
• Rachman Chavik
• Remi Collet
• Victor Eduardo de Assis

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.8.10. See the changelog for every commit.

• TestCase\EmailTrait::assertMailSentWith() now knows how to assert view builder properties.
• NumberHelper::precision() had the $options parameter added so it can better wrap Number::precision().
• Http\Response::withStatus() no longer overwrites the content-type header with the contents of the _contentType property.
• Http\Response::$_contenType was removed as it was often wrong and out of sync with the getHeader('Content-Type') value.
• Updated API documentation and type annotations.
• Validation::decimal() now handles Polish formatted numbers correctly.
• Logged fatal errors now include the file and line position.

Contributors to 3.8.10

Thank you to all the contributors that helped make this release happen:

• Johan Meiring
• Mark Story
• Michal
• Rachman Chavik
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.0.3. See the changelog for every commit.

• Fixed password hashing being skipped when password field was null. This prevents a potential timing sidechannel should an application store users with null passwords.
• i18n extract now skips writing files if no strings have changed.
• If identifier quoting is disabled, queries will no longer have column aliases quoted. This helps improve performance of the ORM. Postgres still quotes aliases to prevent alias casing issues.
• FormProtectionComponent no longer fails validation when PSR7 file upload objects are used.
• Year widgets created with FormHelper now accept DateTime instances as their value.
• Improved error message copying from exception pages.

Contributors to 4.0.3

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Edgaras Janušauskas
• Ian den Hartog
• José Lorenzo Rodríguez
• Marc Würth
• Mark Scherer
• Mark Story
• Michael Hoffmann

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.8.9. See the changelog for every commit.

• Error/Notice messages now have the correct context and code snippets when DebugKit is enabled.
• When a joined association uses formatResults the parent entity is no longer marked dirty if the result formatter modifieds the association entity.
• Fixed contain() on BelongsToMany association restricting fields with fields option.
• Fix element cache key generation when elements were in subdirectories.
• Improved API documentation.
• i18n extract now skips writing files if no strings have changed.
• Fixed password hashing being skipped when password field was null. This prevents a potential timing sidechannel should an application store users with null passwords.
• Fixed a notice error UrlHelper::assetUrl() when $path is null.

Contributors to 3.8.9

Thank you to all the contributors that helped make this release happen:

• Edgaras Janušauskas
• Marc Würth
• Mark Scherer
• Mark Story
• gregs
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 2.10.20. See the changelog for every commit.

• The creation of ControllerTestDispatcher objects has been moved into a separate method allowing it to be overriden in application code.
• Requests with empty JSON objects no longer result in request->data being null.
• ShellHelpers located in plugins can now be loaded from outside the plugin by using plugin dot notation.
• Headers already sent warnings related to sessions when tests are run by phpunit.phar have been fixed.
• session_set_save_handler() is no longer called when there is an active session.
• CakeTestSuiteCommand::run() exit logic now matches phpunit’s behavior, and calls doRun() with false.

Contributors to 2.10.20

Thank you to all the contributors that helped make this release happen:

• Corey Taylor
• Edgaras Janušauskas
• Gareth Ellis
• Gerson Felipe Schwinn
• Mark Sch
• Mark Story
• Mark van Driel
• Milan van As
• Pascal Woerde
• Val Bancer

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.0.2. See the changelog for every commit.

• An exception is now raised in development mode if the generated alias name for a table + column would exceed the maximum identifier length for your database platform.
• FormProtectionComponent now checks unlockedFields correctly.
• The deprecation warning in RequestHandlerComponent for parsing request bodies was removed. Conditionally triggering it had too many edge cases and was confusing users.
• Improved formatting of API documentation examples.
• The ORM more efficiently traverses and transforms query objects improving performance for all ORM operations.
• Associations that use formatResults and change the associated entities no longer result in records being marked as dirty when records are read.
• Cache and Log now handle numeric engine names correctly.
• Errors and warnings emitted while DebugKit is active now reference the correct file and line.
• Dependencies on abandoned zendframework packages are now referencing the Laminas project.
• Using contain() with a field list on a BelongsToMany association now works correctly.
• Session cookies now have SameSite=Lax instead of strict to better emulate how session cookies worked in the past.
• View element caching now works when elements are in subdirectories.
• PaginatorHelper::first() and last() now apply the url option when the title parameter is a string.

Contributors to 4.0.2

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Edgaras Janušauskas
• Mark Scherer
• Mark Story
• gregs
• o0h
• othercorey
• saeideng

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 4.0.1. See the changelog for every commit.

• The upgrade tool has a smaller install footprint and should have fewer conflicts with application code now.
• Removed the typehint on Event data payload, as it can be any type.
• Removed the empty string default value for console options. This fixes Argument::hasOption() always returning true for optional options.
• CSRF tokens are now set on redirect and basic diactoros response objects.
• URL generation no longer emits a type warning when route elements have a regex pattern and parameters are integers.
• Loading joinable associations with contain() now emit errors when foreign keys are not selected. This may cause existing queries to start emitting errors, but those queries were previously silently failing to load associated data as requested.
• SQLServer fixtures now handle the restrict foreign key action now.
• The datetime abstract type once again uses the DATETIME column type in SQLServer. Using DATETIME2 created microsecond overflow issues for some users.
• TestCase::loadRoutes() was added to ease writing unit tests for classes like mailers which often need routes loaded.
• ConsoleIo::createFile() no longer returns false when the created file has 0 bytes.
• When generating URLs, routes with controller and action placeholders no longer strip these these keys when they are undefined. Instead routes missing the controller and action keys will fail to match.
• Optional routing placeholders now work consistently for both braced placeholders and colon placeholders.
• FunctionsBuilder once again allows mixed types for the $expression parameter as many expressions accept objects that implement __toString().
• ErrorLogger no longer fails to log messages for errors which no file or line.
• Improved API doc blocks.

Contributors to 4.0.1

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Edgaras Janušauskas
• Kaliel
• Mark Scherer
• Mark Story
• Matthias Wirtz

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.8.8. See the changelog for every commit.

• Improved API documentation.
• Text::slug() can now preserve spaces.
• FunctionsBuilder::datePart() now passes on its type parameters.
• A potential session fixation issue was fixed. To be vulnerable your application must also have a cross-site-scripting vulnerability or have strict sessions disabled.
• SQLServerSchema dialect now handles the restrict mode of foreign keys correctly.
• Matching routes with integer values is now more typesound.
• Shims were added to TestCase to enable getMock() and getMockBuilder() to not emit deprecations in PHP7.4
• A regression in how FormHelper::dateTime() handles empty values was fixed.
• When generating URLs, routes with controller and action placeholders no longer strip these these keys when they are undefined. Instead routes missing the controller and action keys will fail to match.
• Optional routing placeholders now work consistently for both braced placeholders and colon placeholders.

Contributors to 3.8.8

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Edgaras Janušauskas
• Jeremy Harris
• Marc Würth
• Mark Scherer
• Mark Story
• o0h

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Key Features

• PHP 7.2 required.
• Streamlined APIs with all deprecated methods and behavior removed.
• Additional typehints across the framework giving you errors faster.
• Improved error messages across the framework.
• A refreshed application skeleton design.
• New database types for fixed length strings (CHAR), datetime with microseconds, and datetime with timezone types.
• Table now features OrFail methods that raise exceptions on failure making error handling more explicit and straightforward.
• Middleware for CSP headers, Form tampering prevention, and HTTPS enforcement.
• Cake\Routing\Asset to make generating asset URLs simple from anywhere in your application code.
• FormHelper now generates HTML5 validation errors.
• FormHelper now generates HTML5 datetime input elements.

Upgrading to 4.0

While 4.0 contains a number of breaking changes we have prepared an exhaustive migration guide covering all the deprecated, removed, and new features.

Additionally, we have put together an upgrade guide which gives a step-by-step guide and CLI tool to help you upgrade your application. These documents and companion tool will only improve as we collect more feedback from people upgrading.

Contributors to 4.0.0

CakePHP 4.0 would not have been possible without the hard work and contributions from the following folks:

• ADmad
• Albert Cansado Solà
• Chetan Varshney
• Corey Taylor
• Edgaras Janušauskas
• Erwane Breton
• Florian Krämer
• Ian den Hartog
• Iandenh
• Ilie Pandia
• Jason Horvath
• Jeremy Harris
• Jorge González
• José Lorenzo Rodríguez
• Ján Súkeník
• Karma Dice
• Marc Würth
• Marcelo Rocha
• Mark Scherer
• Mark Story
• Matthew Brown
• Michael Hoffmann
• Robert Pustułka
• Tomas Saghy
• Val Bancer
• Yevgeny Tomenko
• Zuluru
• andrii-pukhalevych
• bancer
• dan
• gregs
• kawaguchi masaki
• mirko-pagliai
• ndm2
• nojimage
• o0h
• othercorey
• saeideng
• sohelrana820
• val

Thank you for all you’ve done to make CakePHP 4 a reality.

Bugfixes

You can expect the following changes in 3.8.7. See the changelog for every commit.

• Generated route names are now correct for routes using braced placeholders.
• Email::getHeaderCharset() now uses the email charset as a fallback if the header charset is undefined.
• IntegrationTestTrait::assertRedirectEquals() was added to make it simpler to assert redirect values without additional Router transformations.
• Improved documenation blocks and type annotations.
• Email attachments now encode the filenames in Content-Disposition headers if the filenames contain non-ascii values.
• Http\Client now accepts a protocolVersion option in its constructor. This option lets you control the HTTP version used. This change makes it simpler to make HTTP2 requests.
• Improved error message when ConsoleIntegrationTestTrait runs out of replies to interactive questions.
• Http\Client can now send request bodies in GET requests.
• Added PHP7.4 to our test matrix.

Contributors to 3.8.7

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Edgaras Janušauskas
• Mark Scherer
• Mark Story
• Martin Matthaei
• gregs
• othercorey

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Updating to the RC

You can use composer to upgrade to the beta version of CakePHP 4.0.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:4.0.0-RC2"

We would greatly appreciate it if you temporarily upgraded your application, and ran your tests. By opening issues for any regressions in the release candidate, we can help ensure a smoother release of 4.0.0 before the stable release.

What’s new in 4.0.0?

The migration guide has a complete list of what’s new in 4.0.0, and what has been deprecated. We recommend you give that page a read when upgrading.

Changes since 4.0.0-RC1

• Validation::compareFields() now works with null values.
• Email attachments now URL encode filenames with non-ascii characters.
• Added assertRedirectEquals() to allow assertions without the base path being added.
• Removed Http\Server::setRunner(), as the runner can be provided as a constructor argument now.
• Improved error messages from QueryExpressions when null is used with an incompatible operator.
• Added deprecation warnings for Validator::allowEmpty() and Validator::notEmpty().
• The safe option was removed from HtmlHelper::script() and scriptBlock(). This option is not needed in an HTML5 context.
• HtmlHelper::docType() is now deprecated.
• The console package was more thoroughly tested in isolation and several problems were fixed.
• FormProtectionComponent now works with applications in sub-directories.
• Validator::errors() was deprecated and is replaced by validate().

Contributors to 4.0.0-RC2

Thank you to all the contributors that helped make this release happen:

• ADmad
• Chetan Varshney
• Corey Taylor
• Edgaras Janušauskas
• Mark Scherer
• Mark Story
• Martin Matthaei
• gregs
• othercorey
• saeideng

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Updating to the RC

You can use composer to upgrade to the beta version of CakePHP 4.0.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:4.0.0-RC1"

We would greatly appreciate it if you temporarily upgraded your application, and ran your tests. By opening issues for any regressions in the release candidate, we can help ensure a smoother release of 4.0.0 before the stable release.

What’s new in 4.0.0?

The migration guide has a complete list of what’s new in 4.0.0, and what has been deprecated. We recommend you give that page a read when upgrading.

Changes since 4.0.0-beta4

• A new compact route _path format has been added to Router::url(). This new format accepts the same Controller::action format that route definition can use.
• The http and console libraries have had standalone packages created.
• Development error pages now preserve inline code highlighting and newlines in exception messages.
• SecurityComponent is now deprecated, and replaced by the FormProtectionComponent.
• The ConsoleErrorHandler was moved to the Error package.
• Validation::time() now accepts microseconds.
• SameSite cookie support was added for PHP>7.3.0
• New database types for char, datetimefractional and timestampfractional were added. The new datetime types allow representation of time values including microseconds.
• InstanceConfigTrait::getConfigOrFail() was added.
• New isLinkedTo and isNotLinkedTo rules were added to ORM\RulesChecker.
• Date and FrozenDate objects now use the default timezone instead of UTC. This fixes problems where ‘today’ would not always be today depending on your distance from UTC.
• Controller action dispatching was refactored to make adding a DI container in the future easier.
• Routing prefixes are now PascalCased instead of under_scored. This removes some inflection and normalizes the representation of prefixes.

Contributors to 4.0.0-RC1

We’d like to welcome othercorey to the core team. They have been contributed a number of documentation improvements and driven multiple improvements around how CakePHP handles microseconds across both CakePHP and Chronos.

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Edgaras Janušauskas
• Jorge González
• Karma Dice
• Mark Scherer
• Mark Story
• dan
• itosho
• ndm2
• othercorey
• saeideng

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Bugfixes

You can expect the following changes in 3.8.6. See the changelog for every commit.

• Microseconds are no longer dropped when creating Time and FrozenTime instances from other datetime objects.
• Improved API documentation and deprecated tags.
• Time::__debugInfo() has been aligned with the implementation in chronos.
• Http\Client now reads cookies from the correct subdomain when handling cross subdomain redirects.
• Dates before 1600 are now accepted by Validation::dateTime().
• FormHelper::dateTime() now correctly handles empty options that are incompletely defined arrays.
• Validation::compareFields() now works with null.

Contributors to 3.8.6

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Edgaras Janušauskas
• Iftekhar Ahmed Eather
• Mark Scherer
• Mark Story
• detinkin
• itosho

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

New Features

The migration guide has a complete list of what’s new in 4.0.0. We recommend you give that page a read when upgrading as it notes the various breaking changes present in 4.0.

How you Can Help

You can help deliver 4.0 by contributing in one of many ways:

1. Check the documentation for mistakes, outdated, unclear or broken examples. We’ve been trying to update everything but may have not caught everything.
2. Try it out! Give CakePHP 4.0 a test drive in a non-production application. We’d love to hear how converting a small application went and what was harder than it should have been.
3. File issues for regressions in existing features, or suggest new features. While we’re not likely to greatly expand the scope of 4.0, we would like input on what should be a part of 4.1 and 4.2.
4. Let us know about unclear error messages or silent failures in CakePHP.

Contributors to 4.0.0-beta4

Thank you to all the contributors that have helped since the beta2 release:

• ADmad
• Corey Taylor
• Edgaras Janušauskas
• Erwane Breton
• Iftekhar Ahmed Eather
• Jason Horvath
• Littley Lv
• Mark Scherer
• Mark Story
• Rachman Chavik
• Val Bancer
• andrii-pukhalevych
• bancer
• detinkin
• kawaguchi masaki
• mirko-pagliai
• saeideng

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.8.5. See the changelog for every commit.

• Router::reverse() now removes the CSRF token and isAjax from generated URLs.
• Improved failure messages for header and cookie assertion methods.
• Removed an additional \r\n from multipart HTTP client request bodies which caused them to be rejected by some servers.
• Removed quotes around multipart message boundary markers. These quotes are not necessary and could cause servers with non-compliant HTTP parsers to reject the request.
• Number::toPercentage() now uses the locale data when placing the % marker.
• MysqlSchema now generates schema correctly for decimal and float columns that have a length but no precision.
• Fixed schema reflection for double unsigned type in MySQL.
• Fixed schema reflection for varbinary(max) type in SqlServer.
• File and line information is now included in log messages from ErrorHandlerMiddleware.

Contributors to 3.8.5

Thank you to all the contributors that helped make this release happen:

• ADmad
• Edgaras Janušauskas
• Littley Lv
• Mark Scherer
• Mark Story
• Rachman Chavik
• bancer

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.8.4. See the changelog for every commit.

• RedisEngine now uses the nx parameter to atomically set keys and expiration times.
• Dependent association deletions now correctly remove alias prefixes from unary and identifier expressions used in the conditions.
• Improved API documentation.
• SQLite schema reflection now preserves decimal column precision and length.
• CakePHP is now using github-actions to manage stale issues.

Contributors to 3.8.4

Thank you to all the contributors that helped make this release happen:

• ADmad
• Alex
• Ethan Pooley
• Mark Scherer
• Mark Story
• ndm2

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

New Features

The migration guide has a complete list of what’s new in 4.0.0. We recommend you give that page a read when upgrading as it notes the various breaking changes present in 4.0.

How you Can Help

You can help deliver 4.0 by contributing in one of many ways:

1. Check the documentation for mistakes, outdated, unclear or broken examples. We’ve been trying to update everything but may have not caught everything.
2. Try it out! Give CakePHP 4.0 a test drive in a non-production application. We’d love to hear how converting a small application went and what was harder than it should have been.
3. File issues for regressions in existing features, or suggest new features. While we’re not likely to greatly expand the scope of 4.0, we would like input on what should be a part of 4.1 and 4.2.
4. Let us know about unclear error messages or silent failures in CakePHP.

Contributors to 4.0.0-beta3

Thank you to all the contributors that have helped since the beta2 release:

• ADmad
• Alex
• Edgaras Janušauskas
• Ethan Pooley
• Jorge González
• Mark Scherer
• Mark Story
• Val Bancer
• ndm2

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.8.3. See the changelog for every commit.

• Added IntegrationTestTrait::setUnlockedFields() to make working with SecurityComponent in tests simpler.
• Improved forwards compatible annotation for EntityInterface::setDirty().
• Made return value of TestEmailTransport::send() match the real implementations.
• Fixed double escaping in pagination meta tags.
• Improved API documentation.
• Subqueries passed to FunctionExpression objects are now wrapped in parentheses.
• Cake\Network\Socket can now connect to unix sockets.
• Console error codes are now constrained to be between 1 and 244.

Contributors to 3.8.3

Thank you to all the contributors that helped make this release happen:

• ADmad
• Edgaras Janušauskas
• Jorge González
• Mark Scherer
• Mark Story
• Mauri Kujala
• Robert Pustułka
• ndm2

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

New Features

The migration guide has a complete list of what’s new in 4.0.0. We recommend you give that page a read when upgrading as it notes the various breaking changes present in 4.0.

How you Can Help

You can help deliver 4.0 by contributing in one of many ways:

1. Check the documentation for mistakes, outdated, unclear or broken examples. We’ve been trying to update everything but may have not caught everything.
2. Try it out! Give CakePHP 4.0 a test drive in a non-production application. We’d love to hear how converting a small application went and what was harder than it should have been.
3. File issues for regressions in existing features, or suggest new features. While we’re not likely to greatly expand the scope of 4.0, we would like input on what should be a part of 4.1 and 4.2.
4. Let us know about unclear error messages or silent failures in CakePHP.

Contributors to 4.0.0-beta2

Thank you to all the contributors that have helped since the beta1 release:

• ADmad
• Albert Cansado Solà
• Anne van de Venis
• Bogdan SOOS
• Brandon Kelly
• Edgaras Janušauskas
• Hideki Kinjyo
• Mark Scherer
• Mark Story
• Mauri Kujala
• Robert Pustułka
• Walther Lalk
• andrii-pukhalevych
• bancer
• gregs
• mirko-pagliai
• ndm2
• saeideng

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.8.2. See the changelog for every commit.

• Added simplexml to requirements of cakephp/utility.
• i18n extract now supports the -p option like other core shells.
• Improved API documentation.
• Fixed incorrect association and _locale property assignment when using matching() with TranslateBehavior.
• The default value for the $when parameter of Validation::notEmptyDateTime() was corrected.
• RedisEngine now calls expire() instead of setTimeout().
• FormHelper now correctly generates Javascript snippets to clear custom HTML validation messages.
• Fixed an overflow error if RequestHandlerComponent was loaded multiple times with different configuration.

Contributors to 3.8.2

Thank you to all the contributors that helped make this release happen:

• ADmad
• Bogdan SOOS
• Brandon Kelly
• Edgaras Janušauskas
• Hideki Kinjyo
• Mark Scherer
• Mark Story
• andrii-pukhalevych
• ndm2

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 2.10.19. See the changelog for every commit.

• Added missing App::uses() call to CakeEventManager.
• CakeTestRunner now passes the $exit parameter to doRun(). This improves compatibility with PHPUnit 5.2.x

Contributors to 2.10.19

Thank you to all the contributors that helped make this release happen:

• Koji Tanaka
• Mark Story

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.8.1. See the changelog for every commit.

• Improved error messages when ConsoleIntegrationTestTrait is missing replies for interactive questions.
• Fixed how Http\Client\Adapter\CurlAdapter selects HTTP protocol versions.
• Added getVisible() to the annotations in EntityInterface.
• Fixed Table::loadInto() not loading translations.
• Switched to using SCAN instead of KEYS to clear redis caches.

Contributors to 3.8.1

Thank you to all the contributors that helped make this release happen:

• ADmad
• Anne
• Anne van de Venis
• Marc Würth
• Mark Story
• Robert Pustułka
• Walther Lalk
• gregs

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

New Features

The migration guide has a complete list of what’s new in 4.0.0. We recommend you give that page a read when upgrading as it notes the various breaking changes present in 4.0.

How you Can Help

You can help deliver 4.0 by contributing in one of many ways:

1. Check the documentation for mistakes, outdated, unclear or broken examples. We’ve been trying to update everything but may have not caught everything.
2. Try it out! Give CakePHP 4.0 a test drive in a non-production application. We’d love to hear how converting a small application went and what was harder than it should have been.
3. File issues for regressions in existing features, or suggest new features. While we’re not likely to greatly expand the scope of 4.0, we would like input on what should be a part of 4.1 and 4.2.
4. Let us know about unclear error messages or silent failures in CakePHP.

Contributors to 4.0.0-beta1

Thank you to all the contributors that have helped since the alpha1 release:

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Upgrading to 3.8.0

You can use composer to upgrade to CakePHP 3.8.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:3.8.*"

Deprecation Warnings

3.8.0 adds two new runtime deprecations. The most noticible deprecation will be in Validator. The parameter order for the new allowEmpty* methods added in 3.7 has been normalized to match the order used in the notEmpty* methods. While annoying we thought it was best to add warnings now and have consistent methods for 4.0 rather than have to carry deprecation warnings through several 4.x releases.

Because fixing eprecation warnings in a large application can be a non-trivial task you will likely want to disable deprecation warnings allowing you to make incremental progress in fixing them. To disable deprecation warnings set Error.errorLevel to E_ALL ^ E_USER_DEPRECATED in config/app.php.

The migration guide has more details on the deprecation in 3.8 and their replacements. Deprecated features will continue to exist and behave as they always have until 4.0.0

What’s new in 3.8.0?

The migration guide has a complete list of what’s new in 3.8.0. We recommend you give that page a read when upgrading. A few highlights from 3.8.0 are:

• CollectionTrait now uses the newCollection method to create clones. This allows sub-classes to have collection methods create instances of themselves instead of using Collection.
• Command::executeCommand() was added. This method makes it simple to call another command from the current one.
• Validator::notEmptyString(), notEmptyArray(), notEmptyFile(), notEmptyDate(), notEmptyTime(), and notEmptyDateTime() were added. They act as compliments to the allowEmpty* methods added in 3.7.
• Validation::mimeType() now compares checks mime-types in a case insensitive manner.
• Validation::dateTime() now supports the iso8601 format.
• Radio buttons can now customize the generated label by using the label key inside a complex option definition. This key will be used instead of the label key defined at the top level options.

Contributors to 3.8.0

Thank you to all the contributors that helped make 3.8 happen:

• ADmad
• Andrej Griniuk
• Cedric Alfonsi
• Edgaras Janušauskas
• Jeremy Harris
• Jorge González
• Lars Ebert
• Marc Würth
• Mark Scherer
• Mark Story
• Nicolas
• Robert Pustułka
• Simone Alers
• andrii-pukhalevych
• chinpei215
• madbbb

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests. 3.8.0 is a large release and would not have been possible without the community support and feedback.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.7.9. See the changelog for every commit.

• Fixed Type::buildAll() not returning custom type objects added with Type::set().
• Improved API documentation examples.
• Validation::isInteger() no longer accepts boolean values as 1/0.
• Validation methods that operate on strings (minLength, maxLength, minLengthBytes, maxLengthBytes) now reject non-scalar values.
• requestAction() now looks for 'return' in a type-safe way.

Contributors to 3.7.9

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• George Constantinou
• Mark Story
• othercorey
• saeideng

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Updating to the RC

You can use composer to upgrade to the beta version of CakePHP 3.8.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:3.8.0-RC3"

We would greatly appreciate it if you temporarily upgraded your application, and ran your tests. By opening issues for any regressions in the release candidate, we can help ensure a smoother release of 3.8.0 before the stable release.

What’s new in 3.8.0?

The migration guide has a complete list of what’s new in 3.8.0, and what has been deprecated. We recommend you give that page a read when upgrading.

Changes since 3.8.0-RC2

• FormContext::error() now returns array keys for errors.
• Improved API documentation.
• Improved error messages when associations are missing and association properties are accessed.
• Iterating PluginCollection during application hook methods no longer skips hooks anymore.
• Cleaned up ConsoleOutput constructor.
• EntityContext can now read validation errors from nested validators.
• Mimetype validation now compares values in a case-insensitive way.
• EntityTrait::getVisibleProperties() is now deprecated. Use getVisible() instead.

Contributors to 3.8.0-RC3

Thank you to all the contributors that helped make this release happen:

• ADmad
• Andrej Griniuk
• Corey Taylor
• Mark Scherer
• Mark Story
• Robert Pustułka
• othercorey
• saeideng

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

New Features

The migration guide has a complete list of what’s new in 4.0.0. We recommend you give that page a read when upgrading as it notes the various breaking changes present in 4.0.

How you Can Help

You can help deliver 4.0 by contributing in one of many ways:

1. Check the documentation for mistakes, outdated, unclear or broken examples. We’ve been trying to update everything but may have not caught everything.
2. Try it out! Give CakePHP 4.0 a test drive in a non-production application. We’d love to hear how converting a small application went and what was harder than it should have been.
3. File issues for regressions in existing features, or suggest new features. While we’re not likely to greatly expand the scope of 4.0, we would like input on what should be a part of 4.1 and 4.2.
4. Let us know about unclear error messages or silent failures in CakePHP.

Contributors to 4.0.0-alpha2

Thank you to all the contributors that have helped since the alpha1 release:

• ADmad
• Corey Taylor
• Edgaras Janušauskas
• Ian den Hartog
• Jeremy Harris
• José Lorenzo Rodríguez
• Marc Wilhelm
• Marc Würth
• Mark Scherer
• Mark Story
• Michael Hoffmann
• Robert Pustułka
• TekkCraft
• andrii-pukhalevych
• mirko-pagliai
• saeideng
• stickler-ci
• 時流

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Download a packaged release on github.

Bugfixes

You can expect the following changes in 3.7.8. See the changelog for every commit.

• The application/json content type no longer has a charset parameter. It is not valid and newer versions of Chrome emit warnings when it is present.
• Improved API documentation.
• char(36) columns are now generated correctly in postgres.
• Fixed plural form rules for Turkish.
• Cache key generation for translators now works when changing locales mid-process.
• IntegrationTestCase now handles absolute URLs correctly.
• FormContext::error() now returns keys on error messages.
• Controller::afterFilter() now has access to response objects returned by controller actions. Previously it would see an older version of the response.
• Improved error messages when associations are missing.
• Iterating PluginCollection in nested loops no longer stops iterating early.

Contributors to 3.7.8

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Jeremy Harris
• José Lorenzo Rodríguez
• Marc Wilhelm
• Marc Würth
• Mark Scherer
• Mark Story
• Robert Pustułka
• TekkCraft
• 時流

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Updating to the RC

You can use composer to upgrade to the beta version of CakePHP 3.8.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:3.8.0-RC2"

We would greatly appreciate it if you temporarily upgraded your application, and ran your tests. By opening issues for any regressions in the release candidate, we can help ensure a smoother release of 3.8.0 before the stable release.

What’s new in 3.8.0?

The migration guide has a complete list of what’s new in 3.8.0, and what has been deprecated. We recommend you give that page a read when upgrading.

Changes since 3.8.0-RC1

• Plural rules for Turkish were corrected.
• Changing the locale partway during a process no longer results in incorrect values being generated.
• Improved deprecation warnings.
• Improved API documentation.
• CsrfMiddleware now supports disabling CSRF checks on a per-request basis by setting a whitelistCallback.
• Fixed absolute URL handling in IntegrationTestCase.
• Controller afterFilter callbacks now has access to the response returned by the controller action.
• assertExitSuccess() and assertExitError() were added to ConsoleIntegrationTestTrait.

Contributors to 3.8.0-RC2

Thank you to all the contributors that helped make this release happen:

• ADmad
• Corey Taylor
• Mark Scherer
• Mark Story
• andrii-pukhalevych
• 時流

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Bugfixes

You can expect the following changes in 2.10.18. See the changelog for every commit.

• Fixed shutdown errors in PHP 7.2 during tests when file caching is used.
• Skipped tests in PHP 7.3 that were previously skipped.
• Improved API documentation.

Contributors to 2.10.18

Thank you to all the contributors that helped make this release happen:

• Koji Tanaka
• Mark Sch
• Mark Story
• bancer

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

Download a packaged release on github.

Updating to the RC

You can use composer to upgrade to the beta version of CakePHP 3.8.0:

php composer.phar require --update-with-dependencies "cakephp/cakephp:3.8.0-RC1"

We would greatly appreciate it if you temporarily upgraded your application, and ran your tests. By opening issues for any regressions in the release candidate, we can help ensure a smoother release of 3.8.0 before the stable release.

What’s new in 3.8.0?

The migration guide has a complete list of what’s new in 3.8.0, and what has been deprecated. We recommend you give that page a read when upgrading.

Changes since 3.8.0-beta1

• CollectionTrait now uses the newCollection() method to create new instances. This allows implementing classes to ensure that instances of the current class are created when new collections are required.
• ModelAwareTrait::loadModel() now allows fully qualified namespaces as a parameter.
• The console table helper now correctly calculates the width of formatted cells.
• Improved API doc blocks.
• Commands will now auto-load the model named in their modelClass property.
• Bundled CA certs were updated to 2019-01-23 release from curl.
• Add getName() to View. This method was suggested in a deprecation warning but did not exist.
• Cake\Http\Response::withModified() is now compatible with DateTimeImmutable objects.
• Improved API documentation.
• Fixed accidental return type change in Cache::deleteMany().
• FileEngine no longer emits warnings when cache files are written to during shutdown when the previous write is for the same key.
• CommandRunner now gracefully handles StopException now.
• Fixed side-effect in SmtpTransport destructor.
• Requirements for the cache package were fixed.
• Don’t emit a charset parameter on the json content type. Chrome has started emitting warnings when this parameter is present as it isn’t compliant with the spec.
• Add Command::executeCommand() This method enables commands to dispatch each other without needing to use the CommandRunner.
• Add Response::withCookieCollection().
• Generate column SQL for CHAR(36) in postgres schema correctly.

Contributors to 3.8.0-RC1

Thank you to all the contributors that helped make this release happen:

• ADmad
• Edgaras Janušauskas
• Jeremy Harris
• José Lorenzo Rodríguez
• Kyle Burton
• Marc Wilhelm
• Marc Würth
• Mark Scherer
• Mark Story
• Simone Alers
• TekkCraft
• saeideng

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.