CakePHP 4.4.18

Last reviewed Sep 24, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. PHP 8.2118 lines · 5.8K tokens
  2. CakePHP 4.4.18101 lines · 4.5K tokens
Total219 lines · 10.4K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 93
  • 95
  • 98
  • 113
  • 117
  • 187
  • 201
  • 203
  • 208
  • 209
  • 214
  • 250
  • 252
  • 256
  • 295
  • 306
  • 307
  • 319
  • 323
  • 327
  • 328
  • 338
  • 340
  • 352
  • 354
  • 362
  • 367
  • 377
  • 384
  • 390
  • 409
  • 434
  • 470
  • 502
  • 522
  • 524
  • 532
  • 552
  • 601
  • 611
  • 613
  • 614
  • 627
  • 639
  • 647
  • 674
  • 698
  • 732
  • 759
  • 760
  • 770
  • 776
  • 778
  • 798
  • 807
  • 829
  • 862
  • 915
  • 916
  • 918
  • 940
  • 942
  • 1004
  • 1021
  • 1275
  • 1287
  • 1333
  • 1395

Prompt Preview

Apply the PHP 8.2 baseline first. These rules cover the exact CakePHP 4.4.18 tag, whose Composer requirement is PHP >=7.4.0; use supported PHP 8.2 security patches for this legacy scope. PHP 8.3 compatibility belongs to CakePHP 4.5+, so do not infer it for 4.4.18 from the aggregate 4.x compatibility table. Treat this framework patch as migration-only.

Mandatory upgrade boundary

  • Do not approve a new production deployment on 4.4.18, the last 4.4 release; later CakePHP advisories that affect it ship no 4.4 fix. Move to the newest release of the extended-support 4.6 branch or of a 5.x minor that CakePHP's support table still lists, after checking its runtime and dependency requirements, because CakePHP delivers security fixes only as new patch releases of the minors in that table.
  • Treat the published September 2026 security-support deadline for 4.4 as elapsed. Do not apply the 4.6 support extension to 4.4, or treat 4.5.12 as a durable supported destination merely because it contains later fixes.
  • Use the following controls only to contain an existing application during migration. Review composer.lock for consistent framework and split-package versions; do not force independently versioned CakePHP plugins or Chronos to the framework's version number.

Known exact-version hazards

  • Keep the SQL type in FunctionsBuilder::cast(), date part in extract() and datePart(), and interval unit in dateAdd() in fixed server-owned maps. This tag inserts them as SQL literals and lacks the later validation fix.
  • Choose View::element() names from fixed server maps.