LoginSign Up
← Back to all sparks
C

CakePHP

DEVOPS
Velocity6.3

Rapid development PHP framework with convention over configuration

cakephp.org ↗

CakePHP 5.4 adds a DI container, distributed locks and DTO request mapping

dependency-injectiondistributed-locksdto-mappingsecurity-backportsbranch-eol
◆Current state
CakePHP is maintaining four branches at once and shipping coordinated security work across them — three security issues fixed in 5.3.7 and backported the same day to 5.2.15 and 5.1.10, followed by a RateLimitMiddleware fix in 5.4.1. Against that maintenance backdrop, 5.4.0 is a substantial feature release: a backwards-compatible dependency-injection container, a new Lock package for distributed locks, a #[RequestToDto] attribute, and new Collection methods for keys, values and conditional chaining.
◆Where it's heading
The framework is modernising its application-structure primitives without breaking anything — the container is explicitly backwards compatible, and DTO mapping arrives as an attribute rather than a required pattern. Taken together, container-based wiring plus typed request DTOs move CakePHP toward the same architecture its PHP peers settled on, while the Lock package acknowledges that applications now run as multiple processes by default.
◆Prediction
Expect 5.5 to continue the branch-retirement cadence, dropping 5.2 from security support, and for the DTO and container APIs to gain ergonomics as they are exercised in real applications.

◆Recent moves

  1. 5d ago

    Rate-limiter defaults to remote_addr after security report

    A maintenance release for the new 5.4 branch whose most consequential change is a security one: RateLimitMiddleware now keys on remote_addr instead of the spoofable x-forwarded-for header by default. Postgres subquery aliasing and schema deserialization fixes round it out.

    View source ↗
  2. 14d ago

    CakePHP 5.4 brings a DI container, Lock package and DTO attribute

    ⚡ SPARK

    The one feature release in this window, and the source of the trajectory the maintenance releases sit against. A container, distributed locks and attribute-driven DTO mapping arrive together, each additive rather than breaking, while 5.1 drops out of security support.

    View source ↗
  3. 18d ago

    5.2 branch picks up a backported fix

    A backport of the same fix released in 5.3.7, published within minutes of its siblings. The value is in the coordination, not the content — supported branches get security work on the same day.

    View source ↗
  4. 18d ago

    5.1 branch picks up a backported fix

    The 5.1 counterpart of the same backport, and one of the last releases that branch receives before 5.4.0 ends its security support a few days later.

    View source ↗
  5. 18d ago

    Patch repairs a syntax error shipped in 5.1.8

    A same-day corrective release fixing a syntax error that reached 5.1.8. Small, but a reminder that the multi-branch backport process carries its own risk of shipping breakage.

    View source ↗
  6. 18d ago

    Three security issues fixed and backported across branches

    The origin release for the day's coordinated backports, fixing three security issues with advisories held until vulnerability review completed. It also adds an allowedClasses config to RedisEngine, which is deserialization hardening rather than a feature.

    View source ↗