The CakePHP core team is happy to announce the immediate availability of CakePHP 5.4.1. This is a maintenance release for the 5.4 branch that fixes community reported issues, regressions and a security issue with RateLimitMiddleware. Thank you to yousukezan for reporting the security issue via our mailing list.

Bugfixes

You can expect the following changes in 5.4.1. See the changelog for every commit.

• Fixed incorrect alias generation with postgres driver and subqueries.
• Fixed errors related to newly added properties when Database\Schema\Column and Index are deserialized.
• Fixed Undefined array key "prefix" error when using Cache::add() with Cache\Engine\NullEngine.
• Changed default ipHeader in RateLimitMiddleware from x-forwarded-for to remote_addr.
• Improved API docs for FunctionsBuilder.

Contributors to 5.4.1

Thank you to all the contributors that submitted a pull request:

• Alejandro Ibarra
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• othercorey

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

The CakePHP core team is happy to announce the release of CakePHP 5.4.0. With the release of 5.4.0, the 5.1 will no longer receive security fixes. 5.2 will continue to receive security fixes until the release of 5.5.

What's new in 5.4.0

Some highlights of the 5.4.0 release include:

• A backwards compatible container implementation has been added to CakePHP.
• New methods on Collection for working with keys, values, conditional method chaining, and imploding to a string.
• New Lock package for working with distributed locks.
• Commands now have $this->io and $this->args as properties.
• ConsoleHelpHeaderProviderInterface lets commands customize help output header messages.
• The #[RequestToDto] attribute enables automatic mapping of request data to Data Transfer Objects.
• Added JsonStreamResponse for more memory efficient streaming of large JSON responses.
• Added several new expression builders for null-safe comparisons, and aggregations.
• Added Connection::afterCommit() to register callbacks that run after the outermost transaction commits.
• Additional postgres index metadata reflection and generation support was added.
• LoggedQuery::setRedactor() was added to scrub sensitive data from query logs.
• Added a PSR-13 Link header implementation.
• Number::toReadableSizes() now defaults binary units (KiB = 1024 bytes) with setUseIecUnits().
• I18n::setCacheConfig() lets you rename the _cake_translations_ cache profile.
• cake i18n extract now extracts labels added with the #[Label] attribute.
• The associated option in newEntity() and patchEntity() supports the nested array format used by contain().
• TestCase::mockModel() enables mocking of model classes with Mockery.
• Added new Utility\Fs classes for scanning and pattern based discovery of directory trees.
• Security::encrypt() now supports longer keys with separate encryption and authentication keys.
• Text::mask() and Text::maskValue() were added.
• FormHelper::enumOptions() was added to make generating form inputs from enums easier.
• The default eager loading strategy for HasMany and BelongsToMany associations was changed from select to subquery.
• Table methods for patching, saving, deleting and loading entities now check entity class types and reject mismatched entities.
• FormHelper now wraps hidden form blocks used for CSRF and tampering prevention with hidden attributes instead of inline styles.
• Application::events() and Plugin::events() are now called consistently in both web and CLI contexts, and can use DI container services.

The migration guide has a complete list of what's new in 5.4.0. We recommend you give that page a read when upgrading as it notes the behavior changes present in 5.4.0.

Contributors to 5.4.0

Thank you to all the contributors that have contributed to this release:

• Abdul Malik Ikhsan
• ADmad
• celsowm
• gillux
• Graham Watson
• Jamison Bryant
• Jasper Smet
• Joachim Rey
• Kevin Pfeifer
• Mallik Hassan
• Mark Scherer
• Mark Story
• Nicos Panayides
• othercorey

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

Contains another backported fix from 5.3.7

Contains another backported fix from 5.3.7

Fixes a syntax error that slipped into 5.1.8

The CakePHP core team is happy to announce the immediate availability of CakePHP 4.6.5. This is a maintenance release for the 4.6 branch that fixes community reported issues and two security issues. Advisories will be published for the issues over the next week as vulnerability reviews are completed. Thank you to @unknownhad and Rotem Reiss for reporting these issues via our security process. The security fixes have been backported and released as 4.5.12 as well.

Bugfixes

You can expect the following changes in 4.6.5. See the changelogj for every commit.

• Normalized handling of %2f in route paths to always be treated as an encoded value.
• Improved parameter handling and escaping in FunctionsBuilder.
• SmtpTransport now strips CRLF from email header values.

Contributors to 4.6.5

Thank you to all the contributors that submitted a pull request:

• Mark Story

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

This release contains backports of security fixes from 4.6.5

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.3.5. This is a maintenance release for the 5.3 branch that fixes community reported issues and three security issues. Advisories will be published for the issues over the next week as vulnerability reviews are completed. Thank you to @unknownhad, and Rotem Reiss for reporting these issues via our security process. The security fixes have been backported and released as 5.2.15, 5.1.10 as well.

Bugfixes

You can expect the following changes in 5.3.7. See the changelog for every commit.

• Clarify behavior of the local parameter to ServerRequest::referrer().
• MissingRouteException now includes the passed parameters for failed named route matches.
• Add allowedClasses config to RedisEngine to provide controls on what classes can be constructed from serialized data.
• Http\Client now uses curl.cainfo from PHP ini when defined.
• SmtpTransport now strips CRLF from email header values.
• Improved parameter handling and escaping in FunctionsBuilder.
• Fixed potential SQL injection in FunctionsBuilder::jsonValue() with postgres drivers.
• Added default values to Debugger::exportMask which sanitize common credential fields.
• Retain the ORDER BY clause when loading has many associations with a subquery loader strategy.
• Normalized handling of %2f in route paths to always be treated as an encoded value.

Contributors to 5.3.7

Thank you to all the contributors that submitted a pull request:

• ADmad
• Kevin Pfeifer
• Jorge M. González Martín
• Mark Scherer
• Mark Story
• othercorey
• XananasX

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

This release contains backports of security fixes from 5.3.7

This release contains backports of security fixes from 5.3.7