CakePHP 5.0.0 was released on September 10th. The current version as of today is 5.0.3 (released Nov 28th and compatible with PHP 8.3 https://github.com/cakephp/cakephp/releases/tag/5.0.3).
You might be asking yourself some questions related to the upgrade… here's what we've been recommending to our clients to do since version 5 was released.
Leaving aside the obvious reasons for an upgrade, today we're going to categorize the decision from 2 different points of view: Your current CakePHP version, and your role in the project.
When should you upgrade?
We are going to use current CakePHP version as the main criteria:
* If you are in CakePHP <= 2
* We strongly recommend an upgrade as soon as possible. If you are unable to upgrade, try to keep your PHP version and all the underlying dependencies as fresh as you can and isolate the application as much as possible. If your application is internal, consider using a VPN blocking all outside traffic. If your site is open to the public, consider using an isolated environment, hardened. Adding a web application firewall and a strict set of rules could also help to mitigate potential security issues. Even if CakePHP is very secure, the older versions of CakePHP, like 1 and 2 have a very old code base , and other vendors/ libraries could be a serious security risk for your project at this point.
* If you are in CakePHP 3.x
* The effort to upgrade at least to CakePHP 4.x should not be a blocker. We would recommend upgrading at least to the latest CakePHP 4.5.x. You can actually "ignore" the deprecations for now, you don't need to plan for upgrading your authentication/authorization layers just yet, focus on getting your project stable and up to CakePHP 4.5.x in the first round.
* If you are in CakePHP 4.x
* Upgrading to CakePHP 5.x is not an immediate priority for you.
* I would say, 2024 is a good time to start planning for an upgrade. Feature and bugfix releases for 4.x will continue until September 2025. Security fixes will continue for 4.x until September 2026. You have plenty of time to consider an upgrade, and take advantage of newer (and faster!) PHP versions.
Why should you upgrade?
We are going to use your role in the project to provide some good reasons:
* If you are a developer
* More strict types, meaning better IDE support and more errors catched at development time.
* New features in CakePHP 5.x will make your code more readable, like Typed finder parameters https://book.cakephp.org/5/en/appendices/5-0-migration-guide.html#typed-finder-parameters
* Quality of life features, reducing development time like https://book.cakephp.org/5/en/appendices/5-0-migration-guide.html#plugin-installer
* Compatibility with PHP 8.3 for extra performance & support
* If you are a manager
* Ensure your development team is forced to drop old auth code and embrace the new authentication/authorization layer https://book.cakephp.org/5/en/appendices/5-0-migration-guide.html#auth
* The new authentication layer will allow you to easily integrate features like single sign on, two factor authentication or hardware keys (like Yubikeys), as there are plugins available handling all these features.
* Get an extended support window. CakePHP is one of the longest maintained frameworks out there, upgrading to CakePHP 5 will keep your core maintained past 2026.
* Upgrade to PHP 8.3 and force legacy vendors to be up to date with the new version, this will also push your team to get familiar with the new PHP core features.
* If you are an investor, not directly related with the project day-to-day operations
* Secure your inversion for a longer period.
* Reduce your exposure to security issues.
* Send a strong message to your partners, keeping your product updated with the latest technology trends.
* Send a strong message to your team, investing in the upgrade of your application will let them know the project is aiming for a long term future.
In conclusion, upgrading to CakePHP 5 is a good move for 2024 whether you're a developer, manager, or investor. The version 5 is stable and ready to go.
Staying current becomes not just a best practice but a strategic advantage.
If you are in doubt, feel free to contact us. We'll review your case (for free) and provide an actionable recommendation based on your current situation in the next business day.