Release notes from cakephp

CakePHP 5.3.2 released

2026-02-25T04:29:45Z

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.3.2. This is a maintenance release for the 5.3 branch that fixes several community reported issues.

Bugfixes

You can expect the following changes in 5.3.2. See the changelog for every commit.

Improved API documentation.
Fixed incorrect cache key usage within Inflector.
Fixed isset bug in debug output formatters.
Fixed loose equality comparisons.
Made EventInterface template covariant, improving type inference.
Improved performance of DTO projection. Benchmark results show ~70% reduction in DTO mapping overhead.
Add BIT type support to MysqlSchemaDialect. This improves compatibility with existing migrations.
Add support for a fixed option to the binary type in MySQL. This enabled migrations to preserve fixed/variable length binary column types.
Add collation support for uuid columns in MySQL.
Fixed reflection of ON UPDATE CURRENT_TIMESTAMP in MySQL.
Command names are now coloured in help output.
PaginatorHelper::limitControl() now preserves passed parameters in the form action.
Updated anchor links in documentation to match new book.cakephp.org site.
BelongsToMany::unlink() now returns false if deleting the association link fails.
Improve generic type annotations in several places.
QueryException now contains the connection that an error is from to improve debugging of multi-connection applications.
Update to support PHPUnit 13, and continue to adopt Mockery for mocks.
Application rules setError() now handles dotted field paths consistently with other ORM components.
Fix sliding window rate limiter boundary conditions because of rounding down.
Fix compatibility issues with PHP 8.4 and database reflection queries that trigger errors under PHP 8.4's more strict float-to-int coercion.
FormHelper will no longer mark fields as required, when they have a callable condition in a allowEmpty*().

Contributors to 5.3.2

Thank you to all the contributors that submitted a pull request:

ADmad
Jasper Smet
Kevin Pfeifer
kuldeep22somaiya
Marc Würth
Mark Scherer
Mark Story
othercorey

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

CakePHP 5.2.12 released

2026-01-15T03:49:52Z

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.2.12. This is a security fix release for the 5.2 branch that fixes a security issue with PaginatorHelper. This release is recommended for all applications using PaginatorHelper::limitControl() with CakePHP >= 5.2.10. Earlier releases are not impacted.

Bugfixes

You can expect the following changes in 5.2.11. See the changelog for every commit.

Fixed outputting unescaped HTML generated from request query string data in PaginatorHelper::limitControl().

Contributors to 5.2.12

Thank you to all the contributors that submitted a pull request:

Mark Story
phpcss-ankue

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

CakePHP 5.3.1 released

2026-01-15T02:47:46Z

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.3.1. This is a maintenance release for the 5.3 branch that fixes community reported issues, regressions and a security issue with PaginatorHelper.

Bugfixes

You can expect the following changes in 5.3.1. See the changelog for every commit.

Fixed outputting unescaped HTML generated from request query string data in PaginatorHelper::limitControl().
Fixed plugin template paths.

Contributors to 5.3.1

Thank you to all the contributors that submitted a pull request:

Corey Taylor
Mark Scherer
Mark Story

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

CakePHP 5.3.0 released

2026-01-10T05:29:03Z

The CakePHP core team is happy to announce the release of CakePHP 5.3.0. With the release of 5.3.0, we're ending bugfix support for CakePHP 5.2. Both 5.1 and 5.2 continue to receive security updates until the release of 5.4.0 or 6.0.0. It is also the end of support for bugfixes for CakePHP 4.x. The core team will continue to provide security updates for CakePHP throughout 2026.

What's new in 5.3.0

Some highlights of the 5.3.0 release include:

Added Redis Cluster support to RedisEngine. Configure the cluster option with an array of server addresses to enable cluster mode.
Several events were added to the Cache package to allow monitoring the caching behavior.
cake plugin assets symlink command now supports a --relative option to create relative path symlinks. This is useful when creating symlinks within containers that use volume mounts.
cake server now supports a --frankenphp option that will start the development server with FrankenPHP.
Added Console TreeHelper which outputs an array as a tree such as an array of filesystem directories as array keys and files as lists under each directory.
Added the ability to group commands in console help output.
New DI container support for the #[Configure] attribute have data injected from Configure, and the TableContainer delegate that lets you inject ORM Tables into your services.
Added support for additional column types in MySQL, and Postgres bringing CakePHP's database type support close to parity with phinx. Queries can also define optimizer hints for engine specific optimizations.
The new RateLimitMiddleware provides configurable rate limiting for your application to protect against abuse and ensure fair usage of resources. It supports multiple identification strategies (IP, user, route, API key), different rate limiting algorithms (sliding window, fixed window, token bucket), and advanced features like custom identifiers, request costs, and dynamic limits.
Added DateTimePeriod which wraps a PHP DatePeriod and returns DateTime instances when iterating.
Added SelectQuery::projectAs() for projecting query results into lightweight Data Transfer Objects (DTOs) for read-only data access.
Added new fluent builders for defining the sortableFields data of your pagination operations. The new builders allow you to define complex sorting for both virtual and real fields, with multi-column and pinned sorting support.
Additional assertions for redirect responses in integration tests.

The migration guide has a complete list of what's new in 5.3.0. We recommend you give that page a read when upgrading as it notes the behavior changes present in 5.3.0.

Contributors to 5.3.0

Thank you to all the contributors that have contributed to 5.3.0:

ADmad
Alberto G. Rodriguez
Christian
Corey Taylor
Gerson Felipe Schwinn
Jamison Bryant
Jasper Smet
Joris Vaesen
Juhani Aronen
Kevin Pfeifer
Lauri Tunnela
Marcelo Rocha
Mark Scherer
Mark Story
Murl080
Nicos Panayides
othercorey
scribblemaniac
Steve
Umer Salman
Val Bancer

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

CakePHP 5.2.11 released

2026-01-09T04:38:56Z

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.2.11. This is a maintenance release for the 5.2 branch that fixes several community reported issues and regressions.

Bugfixes

You can expect the following changes in 5.2.11. See the changelog for every commit.

Fix completion command to exclude plugin-prefixed aliases. By default plugin prefixed commands are not included in the completion command output. Use -v to include all aliases.
Fixed setTimezone() being called on Date instances in RelativeTimeFormatter.
Improve return type annotation for Validator::validate().
Improved API documentation.
E_COMPILE_ERROR errors are not handled as fatal errors in ExceptionTrap::handleShutdown().
Fix how plugin assets command handles invalid symlinks.

Contributors to 5.2.11

Thank you to all the contributors that submitted a pull request:

ADmad
Gerson Felipe Schwinn
Joris Vaesen
Mark Scherer
othercorey

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

CakePHP 5.3.0-RC2 released

2025-12-14T05:27:40Z

The CakePHP core team is happy to announce the second release candidate for CakePHP 5.3.0. Since the previous release candidate, the following changes have been made:

Added ExistsInNullable rule class to make it easier to create exists in rules that allow nulls.
Bugfixes and Improvements to the rate limiter middleware.
Improved API documentation.
SortField treats 'desc' as reverse of the default direction now.
Fixed maxLimit restriction on PaginatorHelper::limitControl().
Fixed missing type mappings in database schema.
Missing abstract types no longer raise exceptions. Instead a String type is returned.
Loading plugin classes with the class name of Plugin is now deprecated.
Added additional data to cache engine events.
Fixed deserialization error in TableSchema.
Added verbose mode output for the version command.
Improved error messages when a command is missing.
Added Http\RedirectTrait to make it easier to build redirect responses in applications and plugins.
Association::__isset() now only checks for associations, to be aligned with __get().
Commands can now implement the CommandHiddenInterface marker interface to hide a command from command listings.

What's new in 5.3.0

The migration guide has a complete list of what's new in 5.3.0. We recommend you give that page a read when upgrading as it notes the behavior changes present in 5.3.0.

How you Can Help

You can help deliver 5.3.0 by contributing in one of many ways:

Check the documentation for mistakes, outdated, unclear or broken examples. We've been trying to update the documentation as we go, but there are likely examples or sections we've missed.
Try it out! Give CakePHP 5.3.0 a test drive. Let us know how upgrading went and if there were any rough spots.
File issues for regressions in existing features, or suggest new features. Even if those features don't make it into 5.3.0, we're early in the process of planning 5.3 and value community feedback.

Contributors to 5.3.0-RC2

Thank you to all the contributors that have contributed to this release:

ADmad
Corey Taylor
Jasper Smet
Kevin Pfeifer
Marcelo Rocha
Mark Scherer
Mark Story

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

CakePHP 5.2.10 released

2025-12-05T22:42:45Z

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.2.10. This is a maintenance release for the 5.2 branch that fixes several community reported issues and regressions.

Bugfixes

You can expect the following changes in 5.2.10. See the changelog for every commit.

Fixed Form::getError() using dot notation
Fixed testing FormProtector with IntegrationTestTrait in non-debug mode
Fixed Query::bind() not setting the query dirty
Fixed rendering 400 errors with base template from plugins
Fixed ConsoleIntegrationTestTrait::exec() exception on multiple calls with input
Initialized event manager earlier when running commands so all events are supported
Cleaned up various documentation and annotations
Fixed Chronos deprecations
Fixed PHP 8.5 deprecations

Contributors to 5.2.10

Thank you to all the contributors that submitted a pull request:

ADmad
Alberto G. Rodriguez
Corey Taylor
Jasper Smet
Mark Scherer
Mark Story
nook24

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

CakePHP 4.6.3 released

2025-12-15T13:00:22Z

The CakePHP core team is happy to announce the immediate availability of CakePHP 4.6.3. This is a maintenance release for the 4.6 branch that fixes several community reported issues and regressions.

Bugfixes

You can expect the following changes in 4.6.3. See the changelog for every commit.

Fixed PHP 8.4 and 8.5 deprecation warnings.
Fixed queries that use subqueries that already been executed.
Fixed Query::bind() not setting the dirty flag.
Backported Cell action events
Normalize URLs in IntegrationTestTrait::assertRedirect()

Contributors to 4.6.3

Thank you to all the contributors that submitted a pull request:

bancer
krugerman007
markstory
othercorey
skie

CakePHP 5.3.0-RC1 released

2025-11-10T07:43:05Z

The CakePHP core team is happy to announce the first release candidate for CakePHP 5.3.0. The 5.3 release includes several behavior changes to increase correctness and new features. The highlights of those include:

Minium PHP version requirement is now PHP 8.2.0.
The Redis cache engine now supports Redis clusters.
cake plugin assets symlink command now supports a --relative option to create relative path symlinks.
cake server now supports a --frankenphp option that will start the development server with FrankenPHP.
Added Configure attribute to support injecting Configure values into constructor arguments.
Added Query::optimizerHint() which accepts engine-specific optimizer hints.
Added additional database types for year, inet, cidr, and macaddr.
Added Date::getTimestamp(). This method returns an int of the date's timestamp.
Table::patchEntity(), Table::newEntity(), Marshaller::one() and Marshaller::many() now accept a strictFields option that only applies validation to the fields listed in the fields option.
Added TableContainer that you can register in your Application::services() to add dependency injection for your Tables.
Added a new fluent interface and value objects for defining sortable fields. The sortableFields option now of Paginator now accepts a callable that receives a SortableFieldsBuilder instance, allowing you to map friendly sort keys to database fields with multi-column sorting and direction control.
Added SortField class for defining sort field configurations with customizable default directions and locked directions, (e.g. SortField::desc('created', locked: true)).
Added support for combined sorting keys in URLs (e.g., ?sort=title-asc)
assertRedirectBack() and assertRedirectBackToReferer() were added to improve ergonomics of asserting redirects.
HtmlHelper::scriptStart() and scriptEnd() now allow simple
wrapping script tags (<script>...</script>) around inline JavaScript. This enables syntax highlighting in many editors.
StringTemplate::addClassNames() was added to provide a more ergonomic way to generate class names.
Cake\Http\Middleware\RateLimiterMiddleware was added to provide rate limiting functionality for applications.

What's new in 5.3.0

The migration guide has a complete list of what's new in 5.3.0. We recommend you give that page a read when upgrading as it notes the behavior changes present in 5.3.0.

How you Can Help

You can help deliver 5.3.0 by contributing in one of many ways:

Check the documentation for mistakes, outdated, unclear or broken examples. We've been trying to update the documentation as we go, but there are likely examples or sections we've missed.
Try it out! Give CakePHP 5.3.0 a test drive. Let us know how upgrading went and if there were any rough spots.
File issues for regressions in existing features, or suggest new features. Even if those features don't make it into 5.3.0, we're early in the process of planning 5.3 and value community feedback.

Contributors to 5.3.0-RC1

Thank you to all the contributors that have contributed to this release:

ADmad
Alberto G. Rodriguez
Christian
Corey Taylor
Jamison Bryant
Jasper Smet
Juhani Aronen
Kevin Pfeifer
Lauri Tunnela
Marcelo Rocha
Mark Scherer
Mark Story
Murl080
Nicos Panayides
nook24
Steve
Umer Salman
Val Bancer

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

CakePHP 5.2.9 released

2025-12-05T22:27:25Z

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.2.9. This is a maintenance release for the 5.2 branch that fixes several community reported issues and regressions.

Bugfixes

You can expect the following changes in 5.2.9. See the changelog for every commit.

Improve PHPUnit usage in tests.
Fixed DI integration for Components.
Type annotations for LocatorAwareTrait::fetchTable() have been improved so that IDEs / static analyzer can now recognize the specific table type for the returned value, when the method is called with FQCN.
Fixed default value reflection and for SQLite boolean columns.
Fixed how Socket detects connection interruptions, by deprecating $connected property, and using is_resource() instead. This should improve behavior of SmtpTransport in long running processes.
Improved typehints for SelectQuery.

Contributors to 5.2.9

Thank you to all the contributors that submitted a pull request:

Adam Halfar
ADmad
Alberto Pagliarini
kolorafa
Mark Scherer
Mark Story

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.