[alenarmona]

Jira: PHP85-21

Summary

Creates the cakephp2-php85 branch our applications will consume on PHP 8.5 containers. The framework now runs with zero deprecation notices on PHP 8.1 through 8.5 while staying compatible with PHP 8.0+ (no 8.5-only syntax, composer still requires ^8.0).

Upstream sync

The 14 upstream commits from kamilwylegala/cakephp2-php8 not yet in our master, up to kamilwylegala#87. Includes the CSRF hardening (kamilwylegala#76) and upstream's PHP 8.4/8.5 fixes (kamilwylegala#75, kamilwylegala#83, kamilwylegala#86). Cherry-picked; the resulting tree is identical to upstream master.

CI and tooling

• Test matrix now runs PHP 8.0, 8.1, 8.4 and 8.5 (intl installed, mcrypt dropped).
• The test app's core.php reports E_ALL, so any deprecation fails the suite. Previously deprecations were masked, which is why CI looked green on 8.1.
• docker/web image moved to php:8.5-apache.
• README: Zumba branch section, composer update procedure, upstream sync procedure, changelog.

Framework changes

PHP 8.5

• Security::cipher(): reproduce the pre-8.5 float→int wrap-around of Security.cipherSeed without the deprecated cast. Verified identical output for the production-style seed, so existing cookies still decrypt.
• limit()/offset() in DboSource, Sqlite, Postgres, Sqlserver clamp out-of-range values instead of casting.
• ConsoleLog no longer calls posix_isatty(null).
• ReflectionProperty::setAccessible() only called on PHP < 8.1.
• Null array offsets replaced by explicit checks (I18n context key, Helper, CakeResponse, ConsoleOptionParser, RequestHandlerComponent, Set, Configure::consume, CakeSession::check).
• libxml_disable_entity_loader() calls removed; deprecated mhash() path removed.

PHP 8.4

• trigger_error(..., E_USER_ERROR) replaced by exceptions (ConfigureException, CakeException, RuntimeException in bootstrap scripts) or ErrorHandler::handleFatalError(). All were fatal paths.

PHP 8.2 (dynamic properties)

• Properties declared on Scaffold, ConsoleOptionParser, HelpFormatter, MemcachedEngine, CakeTestCase, CakeTestFixture, CakeFixtureManager, ControllerTestDispatcher, PDOExceptionWithQueryString and ~100 test classes.
• ConnectionManager instantiates DATABASE_CONFIG through CakeDatabaseConfig, a #[\AllowDynamicProperties] subclass, so ConnectionManager::create() stops emitting deprecations. instanceof DATABASE_CONFIG still holds.
• CakeRequest allows dynamic properties (tests and plugins decorate it).

PHP 8.1

• Remaining "passing null to non-nullable internal parameter" cases fixed across the framework with (string) casts or null checks.

Other

• Security::encrypt()/decrypt() fall back to OpenSSL when ext-mcrypt is missing.
• SessionHandlerAdapter methods marked #[\ReturnTypeWillChange].
• CakeRoute: no false-to-array conversion for named rules. CakeSchema: null name no longer passed to strtolower().
• MysqlTest and ApplicationControllerTest restore global state when skipped (they were leaking debug and Session config into later tests).

Container requirements

• ext-intl is required: upstream replaced strftime() with php81_bc/strftime, which hard-requires intl.
• ext-mcrypt is no longer needed.

Test evidence

Full suite (4073 tests) run locally with SQLite:

PHP	Result
8.5.8	Clean except 6 CakeTime tests (local build has no ext-intl) and 2 CakeSocket tests (DNS).
8.3.11	Clean.

CI covers the intl and locale cases (locale-gen es_ES), so watch the 8.5 jobs on the first run.

Follow-ups

• Reference dev-cakephp2-php85 as 2.10.24 from the admin and public repos (separate dependency-bump tickets).
• Offer the framework fixes upstream to reduce future sync work.

🤖 Generated with Claude Code