CakePHP 4.6

Apply the PHP 8.3 baseline first. These rules target the CakePHP 4.6 line, which requires PHP 7.4 or later, but the official compatibility map confirms 4.x only through PHP 8.3; Composer's >=7.4.0,<9 constraint does not establish tested PHP 8.4/8.5 compatibility.

Version and support posture

• Run the newest 4.6 release and take each later 4.6 security release as it ships, because CakePHP delivers fixes for this line only as new 4.6 patch releases.
• Lock the framework and any independently installed split core components to compatible patched versions. Resolve Authentication, Authorization, Chronos, and other plugins against their own version constraints; their release numbers do not track CakePHP core.
• Plan migration to a supported newer major. Treat 4.6 as a security-maintained legacy line with security fixes scheduled until CakePHP 6.0, and verify continued support before deployment.

Routing, middleware, and request parsing

• Define explicit routes, method constraints, and parameter patterns in config/routes.php; remove unnecessary fallbacks() and wildcard action routes. Enforce policy on the resolved controller/action and resource, including plugin and prefix routes.
• Use $request->allowMethod() for mutations, including logout. Account for _method and X-HTTP-Method-Override, which ServerRequestFactory processes before middleware; inspect ORIGINAL_REQUEST_METHOD when restricting overrides and never mutate through an effective GET/HEAD action.
• Preserve the patched routing behavior and avoid extra URL decoding before security decisions. Test