What Is New in CakePHP 2.10
CakePHP 2.10 is the final release in the 2.x branch, focusing on maintenance, security updates, and compatibility improvements to provide a stable foundation for applications not yet moving to newer versions.
| Category | Key Changes |
|---|---|
| Security | Updates to the Security component and CSRF handling. |
| Improvements | PHP 7.3 compatibility, updated dependencies (CakeResque, ElasticSearch), and shell argument fixes. |
| Bug Fixes | Corrections for XML views, session handling, and database query behavior. |
| Deprecated | Final deprecation notices for features removed in CakePHP 3.x. |
How does CakePHP 2.10 handle security updates?
The primary security enhancement addresses a CSRF (Cross-Site Request Forgery) bypass vector. The Security component's validatePost method was updated to more rigorously validate the order of form elements, specifically the _Token fields.
In practice, this fix prevents a potential exploit where an attacker could manipulate the request structure. If you use the built-in CSRF protection, your forms automatically benefit from this stronger validation without code changes.
What compatibility improvements were made for newer PHP versions?
This release ensures stable operation under PHP 7.3. Changes include fixes for shell argument parsing where the number of arguments exceeded the system limit, preventing fatal errors in console commands.
Core dependencies were also bumped: the bundled CakeResque plugin was updated to version 4.1.0, and the ElasticSearch datasource was updated to use a newer, compatible client library. This keeps your background jobs and search integrations running smoothly.
Were there any important bug fixes for core components?
Several bugs were squashed. A notable fix corrects an issue where XmlView would not properly reset between requests, potentially causing incorrect XML output in subsequent responses.
Another fix resolves a problem where the Session object could incorrectly report it was started, and a database-related fix ensures that ORDER BY clauses with FIELD() functions work correctly in subqueries. These are the kinds of deep, subtle issues that matter in long-running applications.
FAQ
Is CakePHP 2.10 safe to use with PHP 7.3 and 7.4?
Yes, that was a key goal. The core team made specific changes to ensure compatibility with PHP 7.3. While not officially tested against every 7.4 point release, it generally runs without issues in many production environments.
Does this release add any new features?
No. As the final release of a legacy branch, 2.10 does not introduce new features. Its purpose is stabilization, security, and compatibility for existing applications. All new feature development is in CakePHP 3.x and 4.x.
I see deprecation notices. Should I be worried?
These notices highlight code that was already deprecated and has been removed in CakePHP 3.x. They are a final reminder if you plan to eventually migrate. For a pure 2.10 application, they don't indicate a problem, but you should configure your logs to ignore the E_USER_DEPRECATED level if they become noisy.
What happens if I find a bug now?
The 2.x branch has reached end-of-life (EOL). This means no further releases, including security patches, will be issued by the core team. The community may provide unofficial support, but the official path is to plan an upgrade to a supported version.
My console shell crashes with an argument error. Does 2.10 fix this?
Yes, one of the specific fixes addresses a case where shell commands would fail if the number of arguments exceeded the system's MAX_ARG limit. The fix properly handles these long argument lists, which is common in batch processing tasks.