The CakePHP core team is happy to announce the release of CakePHP 5.3.0. With the release of 5.3.0, we're ending bugfix support for CakePHP 5.2. Both 5.1 and 5.2 continue to receive security updates until the release of 5.4.0 or 6.0.0. It is also the end of support for bugfixes for CakePHP 4.x. The core team will continue to provide security updates for CakePHP throughout 2026.

What's new in 5.3.0

Some highlights of the 5.3.0 release include:

• Added Redis Cluster support to RedisEngine. Configure the cluster option with an array of server addresses to enable cluster mode.
• Several events were added to the Cache package to allow monitoring the caching behavior.
• cake plugin assets symlink command now supports a --relative option to create relative path symlinks. This is useful when creating symlinks within containers that use volume mounts.
• cake server now supports a --frankenphp option that will start the development server with FrankenPHP.
• Added Console TreeHelper which outputs an array as a tree such as an array of filesystem directories as array keys and files as lists under each directory.
• Added the ability to group commands in console help output.
• New DI container support for the #[Configure] attribute have data injected from Configure, and the TableContainer delegate that lets you inject ORM Tables into your services.
• Added support for additional column types in MySQL, and Postgres bringing CakePHP's database type support close to parity with phinx. Queries can also define optimizer hints for engine specific optimizations.
• The new RateLimitMiddleware provides configurable rate limiting for your application to protect against abuse and ensure fair usage of resources. It supports multiple identification strategies (IP, user, route, API key), different rate limiting algorithms (sliding window, fixed window, token bucket), and advanced features like custom identifiers, request costs, and dynamic limits.
• Added DateTimePeriod which wraps a PHP DatePeriod and returns DateTime instances when iterating.
• Added SelectQuery::projectAs() for projecting query results into lightweight Data Transfer Objects (DTOs) for read-only data access.
• Added new fluent builders for defining the sortableFields data of your pagination operations. The new builders allow you to define complex sorting for both virtual and real fields, with multi-column and pinned sorting support.
• Additional assertions for redirect responses in integration tests.

The migration guide has a complete list of what's new in 5.3.0. We recommend you give that page a read when upgrading as it notes the behavior changes present in 5.3.0.

Contributors to 5.3.0

Thank you to all the contributors that have contributed to 5.3.0:

• ADmad
• Alberto G. Rodriguez
• Christian
• Corey Taylor
• Gerson Felipe Schwinn
• Jamison Bryant
• Jasper Smet
• Joris Vaesen
• Juhani Aronen
• Kevin Pfeifer
• Lauri Tunnela
• Marcelo Rocha
• Mark Scherer
• Mark Story
• Murl080
• Nicos Panayides
• othercorey
• scribblemaniac
• Steve
• Umer Salman
• Val Bancer

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.2.11. This is a maintenance release for the 5.2 branch that fixes several community reported issues and regressions.

Bugfixes

You can expect the following changes in 5.2.11. See the changelog for every commit.

• Fix completion command to exclude plugin-prefixed aliases. By default plugin prefixed commands are not included in the completion command output. Use -v to include all aliases.
• Fixed setTimezone() being called on Date instances in RelativeTimeFormatter.
• Improve return type annotation for Validator::validate().
• Improved API documentation.
• E_COMPILE_ERROR errors are not handled as fatal errors in ExceptionTrap::handleShutdown().
• Fix how plugin assets command handles invalid symlinks.

Contributors to 5.2.11

Thank you to all the contributors that submitted a pull request:

• ADmad
• Gerson Felipe Schwinn
• Joris Vaesen
• Mark Scherer
• othercorey

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

The CakePHP core team is happy to announce the second release candidate for CakePHP 5.3.0. Since the previous release candidate, the following changes have been made:

• Added ExistsInNullable rule class to make it easier to create exists in rules that allow nulls.
• Bugfixes and Improvements to the rate limiter middleware.
• Improved API documentation.
• SortField treats 'desc' as reverse of the default direction now.
• Fixed maxLimit restriction on PaginatorHelper::limitControl().
• Fixed missing type mappings in database schema.
• Missing abstract types no longer raise exceptions. Instead a String type is returned.
• Loading plugin classes with the class name of Plugin is now deprecated.
• Added additional data to cache engine events.
• Fixed deserialization error in TableSchema.
• Added verbose mode output for the version command.
• Improved error messages when a command is missing.
• Added Http\RedirectTrait to make it easier to build redirect responses in applications and plugins.
• Association::__isset() now only checks for associations, to be aligned with __get().
• Commands can now implement the CommandHiddenInterface marker interface to hide a command from command listings.

What's new in 5.3.0

The migration guide has a complete list of what's new in 5.3.0. We recommend you give that page a read when upgrading as it notes the behavior changes present in 5.3.0.

How you Can Help

You can help deliver 5.3.0 by contributing in one of many ways:

1. Check the documentation for mistakes, outdated, unclear or broken examples. We've been trying to update the documentation as we go, but there are likely examples or sections we've missed.
2. Try it out! Give CakePHP 5.3.0 a test drive. Let us know how upgrading went and if there were any rough spots.
3. File issues for regressions in existing features, or suggest new features. Even if those features don't make it into 5.3.0, we're early in the process of planning 5.3 and value community feedback.

Contributors to 5.3.0-RC2

Thank you to all the contributors that have contributed to this release:

• ADmad
• Corey Taylor
• Jasper Smet
• Kevin Pfeifer
• Marcelo Rocha
• Mark Scherer
• Mark Story

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.2.10. This is a maintenance release for the 5.2 branch that fixes several community reported issues and regressions.

Bugfixes

You can expect the following changes in 5.2.10. See the changelog for every commit.

• Fixed Form::getError() using dot notation
• Fixed testing FormProtector with IntegrationTestTrait in non-debug mode
• Fixed Query::bind() not setting the query dirty
• Fixed rendering 400 errors with base template from plugins
• Fixed ConsoleIntegrationTestTrait::exec() exception on multiple calls with input
• Initialized event manager earlier when running commands so all events are supported
• Cleaned up various documentation and annotations
• Fixed Chronos deprecations
• Fixed PHP 8.5 deprecations

Contributors to 5.2.10

Thank you to all the contributors that submitted a pull request:

• ADmad
• Alberto G. Rodriguez
• Corey Taylor
• Jasper Smet
• Mark Scherer
• Mark Story
• nook24

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

The CakePHP core team is happy to announce the immediate availability of CakePHP 4.6.3. This is a maintenance release for the 4.6 branch that fixes several community reported issues and regressions.

Bugfixes

You can expect the following changes in 4.6.3. See the changelog for every commit.

• Fixed PHP 8.4 and 8.5 deprecation warnings.
• Fixed queries that use subqueries that already been executed.
• Fixed Query::bind() not setting the dirty flag.
• Backported Cell action events
• Normalize URLs in IntegrationTestTrait::assertRedirect()

Contributors to 4.6.3

Thank you to all the contributors that submitted a pull request:

• bancer
• krugerman007
• markstory
• othercorey
• skie

The CakePHP core team is happy to announce the first release candidate for CakePHP 5.3.0. The 5.3 release includes several behavior changes to increase correctness and new features. The highlights of those include:

• Minium PHP version requirement is now PHP 8.2.0.
• The Redis cache engine now supports Redis clusters.
• cake plugin assets symlink command now supports a --relative option to create relative path symlinks.
• cake server now supports a --frankenphp option that will start the development server with FrankenPHP.
• Added Configure attribute to support injecting Configure values into constructor arguments.
• Added Query::optimizerHint() which accepts engine-specific optimizer hints.
• Added additional database types for year, inet, cidr, and macaddr.
• Added Date::getTimestamp(). This method returns an int of the date's timestamp.
• Table::patchEntity(), Table::newEntity(), Marshaller::one() and Marshaller::many() now accept a strictFields option that only applies validation to the fields listed in the fields option.
• Added TableContainer that you can register in your Application::services() to add dependency injection for your Tables.
• Added a new fluent interface and value objects for defining sortable fields. The sortableFields option now of Paginator now accepts a callable that receives a SortableFieldsBuilder instance, allowing you to map friendly sort keys to database fields with multi-column sorting and direction control.
• Added SortField class for defining sort field configurations with customizable default directions and locked directions, (e.g. SortField::desc('created', locked: true)).
• Added support for combined sorting keys in URLs (e.g., ?sort=title-asc)
• assertRedirectBack() and assertRedirectBackToReferer() were added to improve ergonomics of asserting redirects.
• HtmlHelper::scriptStart() and scriptEnd() now allow simple
  wrapping script tags (<script>...</script>) around inline JavaScript. This enables syntax highlighting in many editors.
• StringTemplate::addClassNames() was added to provide a more ergonomic way to generate class names.
• Cake\Http\Middleware\RateLimiterMiddleware was added to provide rate limiting functionality for applications.

What's new in 5.3.0

The migration guide has a complete list of what's new in 5.3.0. We recommend you give that page a read when upgrading as it notes the behavior changes present in 5.3.0.

How you Can Help

You can help deliver 5.3.0 by contributing in one of many ways:

1. Check the documentation for mistakes, outdated, unclear or broken examples. We've been trying to update the documentation as we go, but there are likely examples or sections we've missed.
2. Try it out! Give CakePHP 5.3.0 a test drive. Let us know how upgrading went and if there were any rough spots.
3. File issues for regressions in existing features, or suggest new features. Even if those features don't make it into 5.3.0, we're early in the process of planning 5.3 and value community feedback.

Contributors to 5.3.0-RC1

Thank you to all the contributors that have contributed to this release:

• ADmad
• Alberto G. Rodriguez
• Christian
• Corey Taylor
• Jamison Bryant
• Jasper Smet
• Juhani Aronen
• Kevin Pfeifer
• Lauri Tunnela
• Marcelo Rocha
• Mark Scherer
• Mark Story
• Murl080
• Nicos Panayides
• nook24
• Steve
• Umer Salman
• Val Bancer

As always, a huge thanks to all the community members that helped make this release happen by reporting issues and sending pull requests.

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.2.9. This is a maintenance release for the 5.2 branch that fixes several community reported issues and regressions.

Bugfixes

You can expect the following changes in 5.2.9. See the changelog for every commit.

• Improve PHPUnit usage in tests.
• Fixed DI integration for Components.
• Type annotations for LocatorAwareTrait::fetchTable() have been improved so that IDEs / static analyzer can now recognize the specific table type for the returned value, when the method is called with FQCN.
• Fixed default value reflection and for SQLite boolean columns.
• Fixed how Socket detects connection interruptions, by deprecating $connected property, and using is_resource() instead. This should improve behavior of SmtpTransport in long running processes.
• Improved typehints for SelectQuery.

Contributors to 5.2.9

Thank you to all the contributors that submitted a pull request:

• Adam Halfar
• ADmad
• Alberto Pagliarini
• kolorafa
• Mark Scherer
• Mark Story

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.2.8. This is a maintenance release for the 5.2 branch that fixes several ,community reported issues and regressions. 5.2.8 also contains a fix for a potential security issue in the query builder. When using already executed queries as subquery expressions, bound parameter values were overwritten which could lead to inccorrect query results. Other usage of subqueries are not impacted.

I'd like to welcome josbeir to the CakePHP team. They have been actively been developing a refesh of the documentation. You can see a development preview of the documentation at newbook.cakephp.org. If you have any feedback about the new documentation site, please open an issue in GitHub.

Bugfixes

You can expect the following changes in 5.2.8. See the changelog for every commit.

• Improved type checks and null coalescing operator usage.
• Fixed route generation when routes are defined with null prefix values.
• Improved type annotations in collection classes.
• Fixed more compatibility issues with PHP 8.5.
• Fixed loading nested associations with Table::loadInto().
• Fixed usage of lock option for PaginatorHelper::sort().
• Fixed an access before initialization in RedisEngine.

Contributors to 5.2.8

A special thanks to Kei Akiyama for reporting the vulnerability in the query builder. As always, thank you to everyone who submitted a pull request:

• ADmad
• Arshid
• Marcelo Rocha
• Mark Scherer
• Mark Story
• othercorey

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.2.7. This is a maintenance release for the 5.2 branch that fixes several community reported issues and regressions.

Bugfixes

You can expect the following changes in 5.2.7. See the changelog for every commit.

• Fixed regression where added rules were enabled for delete operations by
  default.
• Updated Validation::uuid() to accept V7 UUIDs.
• Fixed array value handling in getEnv().
• Fixed flaky tests for Arabic-Indic numeral output.
• Fixed hidden validation messages in nested entities from validation and domain rule failures. Now validation errors are available for nested entities in the _rule key.
• XML from Xml::fromArray() is now validated before being returned. This prevents invalid XML from being generated by invalid input. Now an XmlException will be thrown.
• Updated for PHP 8.5 deprecations.
• Cleaned up plugin configuration after test runs.
• Fixed column comment quoting in the MySQL schema dialect.
• Implemented missing support for QueryExpression as schema column defaults. This was a porting gap when moving code from migrations to cakephp/database.

Contributors to 5.2.7

Thank you to all the contributors that submitted a pull request:

• ADmad
• Arshid
• Mark Scherer
• Mark Story

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.2.6. This is a maintenance release for the 5.2 branch that fixes several community reported issues and regressions.

Bugfixes

You can expect the following changes in 5.2.6. See the changelog for every commit.

• Pagination now uses a cloned query to get a count instead of using the loaded records.
• Improved API docs.
• Fixed generation and reflection of unsigned integer column types in sqlite.
• Fixed deprecation errors in FormProtectionComponent.
• Fixed translate behavior with iI8n locale that has options defined.
• Improved exception messages in SelectQuery.
• Fixed error when xdebug is enabled and uninitialized properties are accessed.
• You can now join and contain the same table in an loadInto() operation.
• Datetime validation correctly handles booleans now.

Contributors to 5.2.6

• ADmad
• Corey Taylor
• Eriknag
• Felix Kempf
• freefri
• Juan Pablo Ramirez
• Kevin Pfeifer
• Mark Scherer
• Mark Story
• wowDAS Markus Ramšak

Thank you to all the contributors that submitted a pull request:

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.