The CakePHP core team is happy to announce the immediate availability of CakePHP 5.3.5. This is a maintenance release for the 5.3 branch that fixes several community reported issues.

Bugfixes

You can expect the following changes in 5.3.5. See the changelog for every commit.

• Fixed a regression where the SameSite cookie attributes would only be applied to the php preset.
• ConsoleOutput::write() now guards against closed file handles.
• Console runner now shows help text instead of an error on invalid command names.

Contributors to 5.3.5

Thank you to all the contributors that submitted a pull request:

• ADmad
• Juan Pablo Ramirez
• Kevin Pfeifer
• Mark Scherer
• Mark Story

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

The CakePHP core team is happy to announce the first release candidate for CakePHP 5.4.0. The 5.4 release includes several behavior changes to increase correctness and new features. The highlights of those include:

What's new in 5.4.0

The migration guide has a complete list of what's new in 5.4.0. We recommend you give that page a read when upgrading as it notes the behavior changes present in 5.4.0.

• The default eager loading strategy for HasMany and BelongsToMany associations has changed from select to subquery. If you need the previous behavior, explicitly set 'strategy' => 'select' when defining associations.
• Model.afterSaveCommit and Model.afterDeleteCommit events are now fired when save() or delete() is called inside an outer transaction.
• Collection had keys(), values(), implode(), when() and unless() methods added.
• Commands now have $this->io and $this->args set by CakePHP. This will become the default in 6.0, and execute() will no longer receive io & args parameters.
• Database queries now support notBetween(), inOrNull(), notInOrNull(), isDistinctFrom(), isNotDistinctFrom(), except(), exceptAll(), and stringAgg() operators/functions added.
• Support for brin, hash, gin, and spgist indexes for postgres was added.
• TestCase::mockModel() has been added to enable mocking of table classes using Mockery.
• New filesystem utilities were added for fluent file discovery with pattern matching, and cross-platform path manipulation was added.
• Security::encrypt() can now be configured to use longer keys with separate encryption and authentication keys that are derived from the provided key.
• Added Text::mask() method which masks a portion of a string with a repeated character.

How you Can Help

You can help deliver 5.4.0 by contributing in one of many ways:

1. Check the documentation for mistakes, outdated, unclear or broken examples. We've been trying to update the documentation as we go, but there are likely examples or sections we've missed.
2. Try it out! Give CakePHP 5.4.0 a test drive. Let us know how upgrading went and if there were any rough spots.
3. File issues for regressions in existing features, or suggest new features. Even if those features don't make it into 5.4.0, we're early in the process of planning 5.5 and 6.0 and value community feedback.

Contributors to 5.4.0-RC1

Thank you to all the contributors that have contributed to this release:

• ADmad
• Application-drop-up
• celsowm
• Jamison Bryant
• Jasper Smet
• Joachim Rey
• Kevin Pfeifer
• Mallik Hassan
• Mark Scherer
• Mark Story
• Masatoshi Ogiwara
• othercorey

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.3.4. This is a maintenance release for the 5.3 branch that fixes several community reported issues.

Bugfixes

You can expect the following changes in 5.3.4. See the changelog for every commit.

• Added database connection context to errors logged for QueryException.
• Improved phpstan type inference, and table entity generics.
• Fixed pagination sort condition merging with alias prefixed fields. Fields are now normalized before resolving sort direction.

Contributors to 5.3.4

Thank you to all the contributors that submitted a pull request:

• ADmad
• Application-drop-up
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• Masatoshi Ogiwara

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.3.3. This is a maintenance release for the 5.3 branch that fixes several community reported issues.

Bugfixes

You can expect the following changes in 5.3.3. See the changelog for every commit.

• Improved type hints for database query results, and disableHydration().
• Query::setMatching() without a builder no longer clears the builder function. Instead an identity function is used to retain query composition.
• Improved typehinting on FactoryLocator.
• Updated dependencies and CI tooling.
• Enabled strict mode for more in_array() checks.

Contributors to 5.3.3

Thank you to all the contributors that submitted a pull request:

• ADmad
• Jasper Smet
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• Nicos Panayides

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.3.2. This is a maintenance release for the 5.3 branch that fixes several community reported issues.

Bugfixes

You can expect the following changes in 5.3.2. See the changelog for every commit.

• Improved API documentation.
• Fixed incorrect cache key usage within Inflector.
• Fixed isset bug in debug output formatters.
• Fixed loose equality comparisons.
• Made EventInterface template covariant, improving type inference.
• Improved performance of DTO projection. Benchmark results show ~70% reduction in DTO mapping overhead.
• Add BIT type support to MysqlSchemaDialect. This improves compatibility with existing migrations.
• Add support for a fixed option to the binary type in MySQL. This enabled migrations to preserve fixed/variable length binary column types.
• Add collation support for uuid columns in MySQL.
• Fixed reflection of ON UPDATE CURRENT_TIMESTAMP in MySQL.
• Command names are now coloured in help output.
• PaginatorHelper::limitControl() now preserves passed parameters in the form action.
• Updated anchor links in documentation to match new book.cakephp.org site.
• BelongsToMany::unlink() now returns false if deleting the association link fails.
• Improve generic type annotations in several places.
• QueryException now contains the connection that an error is from to improve debugging of multi-connection applications.
• Update to support PHPUnit 13, and continue to adopt Mockery for mocks.
• Application rules setError() now handles dotted field paths consistently with other ORM components.
• Fix sliding window rate limiter boundary conditions because of rounding down.
• Fix compatibility issues with PHP 8.4 and database reflection queries that trigger errors under PHP 8.4's more strict float-to-int coercion.
• FormHelper will no longer mark fields as required, when they have a callable condition in a allowEmpty*().

Contributors to 5.3.2

Thank you to all the contributors that submitted a pull request:

• ADmad
• Jasper Smet
• Kevin Pfeifer
• kuldeep22somaiya
• Marc Würth
• Mark Scherer
• Mark Story
• othercorey

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.2.12. This is a security fix release for the 5.2 branch that fixes a security issue with PaginatorHelper. This release is recommended for all applications using PaginatorHelper::limitControl() with CakePHP >= 5.2.10. Earlier releases are not impacted.

Bugfixes

You can expect the following changes in 5.2.11. See the changelog for every commit.

• Fixed outputting unescaped HTML generated from request query string data in PaginatorHelper::limitControl().

Contributors to 5.2.12

Thank you to all the contributors that submitted a pull request:

• Mark Story
• phpcss-ankue

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.3.1. This is a maintenance release for the 5.3 branch that fixes community reported issues, regressions and a security issue with PaginatorHelper.

Bugfixes

You can expect the following changes in 5.3.1. See the changelog for every commit.

• Fixed outputting unescaped HTML generated from request query string data in PaginatorHelper::limitControl().
• Fixed plugin template paths.

Contributors to 5.3.1

Thank you to all the contributors that submitted a pull request:

• Corey Taylor
• Mark Scherer
• Mark Story

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

The CakePHP core team is happy to announce the release of CakePHP 5.3.0. With the release of 5.3.0, we're ending bugfix support for CakePHP 5.2. Both 5.1 and 5.2 continue to receive security updates until the release of 5.4.0 or 6.0.0. It is also the end of support for bugfixes for CakePHP 4.x. The core team will continue to provide security updates for CakePHP throughout 2026.

What's new in 5.3.0

Some highlights of the 5.3.0 release include:

• Added Redis Cluster support to RedisEngine. Configure the cluster option with an array of server addresses to enable cluster mode.
• Several events were added to the Cache package to allow monitoring the caching behavior.
• cake plugin assets symlink command now supports a --relative option to create relative path symlinks. This is useful when creating symlinks within containers that use volume mounts.
• cake server now supports a --frankenphp option that will start the development server with FrankenPHP.
• Added Console TreeHelper which outputs an array as a tree such as an array of filesystem directories as array keys and files as lists under each directory.
• Added the ability to group commands in console help output.
• New DI container support for the #[Configure] attribute have data injected from Configure, and the TableContainer delegate that lets you inject ORM Tables into your services.
• Added support for additional column types in MySQL, and Postgres bringing CakePHP's database type support close to parity with phinx. Queries can also define optimizer hints for engine specific optimizations.
• The new RateLimitMiddleware provides configurable rate limiting for your application to protect against abuse and ensure fair usage of resources. It supports multiple identification strategies (IP, user, route, API key), different rate limiting algorithms (sliding window, fixed window, token bucket), and advanced features like custom identifiers, request costs, and dynamic limits.
• Added DateTimePeriod which wraps a PHP DatePeriod and returns DateTime instances when iterating.
• Added SelectQuery::projectAs() for projecting query results into lightweight Data Transfer Objects (DTOs) for read-only data access.
• Added new fluent builders for defining the sortableFields data of your pagination operations. The new builders allow you to define complex sorting for both virtual and real fields, with multi-column and pinned sorting support.
• Additional assertions for redirect responses in integration tests.

The migration guide has a complete list of what's new in 5.3.0. We recommend you give that page a read when upgrading as it notes the behavior changes present in 5.3.0.

Contributors to 5.3.0

Thank you to all the contributors that have contributed to 5.3.0:

• ADmad
• Alberto G. Rodriguez
• Christian
• Corey Taylor
• Gerson Felipe Schwinn
• Jamison Bryant
• Jasper Smet
• Joris Vaesen
• Juhani Aronen
• Kevin Pfeifer
• Lauri Tunnela
• Marcelo Rocha
• Mark Scherer
• Mark Story
• Murl080
• Nicos Panayides
• othercorey
• scribblemaniac
• Steve
• Umer Salman
• Val Bancer

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.2.11. This is a maintenance release for the 5.2 branch that fixes several community reported issues and regressions.

Bugfixes

You can expect the following changes in 5.2.11. See the changelog for every commit.

• Fix completion command to exclude plugin-prefixed aliases. By default plugin prefixed commands are not included in the completion command output. Use -v to include all aliases.
• Fixed setTimezone() being called on Date instances in RelativeTimeFormatter.
• Improve return type annotation for Validator::validate().
• Improved API documentation.
• E_COMPILE_ERROR errors are not handled as fatal errors in ExceptionTrap::handleShutdown().
• Fix how plugin assets command handles invalid symlinks.

Contributors to 5.2.11

Thank you to all the contributors that submitted a pull request:

• ADmad
• Gerson Felipe Schwinn
• Joris Vaesen
• Mark Scherer
• othercorey

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

The CakePHP core team is happy to announce the second release candidate for CakePHP 5.3.0. Since the previous release candidate, the following changes have been made:

• Added ExistsInNullable rule class to make it easier to create exists in rules that allow nulls.
• Bugfixes and Improvements to the rate limiter middleware.
• Improved API documentation.
• SortField treats 'desc' as reverse of the default direction now.
• Fixed maxLimit restriction on PaginatorHelper::limitControl().
• Fixed missing type mappings in database schema.
• Missing abstract types no longer raise exceptions. Instead a String type is returned.
• Loading plugin classes with the class name of Plugin is now deprecated.
• Added additional data to cache engine events.
• Fixed deserialization error in TableSchema.
• Added verbose mode output for the version command.
• Improved error messages when a command is missing.
• Added Http\RedirectTrait to make it easier to build redirect responses in applications and plugins.
• Association::__isset() now only checks for associations, to be aligned with __get().
• Commands can now implement the CommandHiddenInterface marker interface to hide a command from command listings.

What's new in 5.3.0

The migration guide has a complete list of what's new in 5.3.0. We recommend you give that page a read when upgrading as it notes the behavior changes present in 5.3.0.

How you Can Help

You can help deliver 5.3.0 by contributing in one of many ways:

1. Check the documentation for mistakes, outdated, unclear or broken examples. We've been trying to update the documentation as we go, but there are likely examples or sections we've missed.
2. Try it out! Give CakePHP 5.3.0 a test drive. Let us know how upgrading went and if there were any rough spots.
3. File issues for regressions in existing features, or suggest new features. Even if those features don't make it into 5.3.0, we're early in the process of planning 5.3 and value community feedback.

Contributors to 5.3.0-RC2

Thank you to all the contributors that have contributed to this release:

• ADmad
• Corey Taylor
• Jasper Smet
• Kevin Pfeifer
• Marcelo Rocha
• Mark Scherer
• Mark Story

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.