CakePHP 5.3

Apply the PHP 8.5 baseline first. These rules target CakePHP 5.3 on PHP 8.5; the line requires PHP 8.2 or newer and officially supports PHP 8.5. Apply plugin rules only when the corresponding compatible plugin is installed.

Version and dependency scope

• Verify the locked framework and plugin versions, including standalone cakephp/database when used. The full cakephp/cakephp package replaces its split packages at the framework version; installing both is not required.
• Run the newest 5.3 release and take each later 5.3 security release as it ships, because CakePHP delivers fixes for a supported minor only as new patch releases of that minor. Monitor official advisories; a supported branch does not make every patch safe. Plan migration from the security-only 5.3 branch before its support ends with the release of 5.6 or an earlier major-version cutoff.

Requests, proxies, and routing

• Put RoutingMiddleware before middleware that consumes route parameters, and run BodyParserMiddleware before body-based authentication and CSRF validation. Keep failures inside ErrorHandlerMiddleware; test route-scoped middleware as well as the application queue.
• Enforce request-size limits before BodyParserMiddleware reads the body. Reject unsupported content types and validate the decoded shape explicitly: unknown types pass through, and valid JSON scalars are cast to arrays. Keep its default xml => false unless XML is required and separately validated.
• Preserve webhook bytes before body parsing consumes the stream; verify the signature over those bytes, enforce