Version 4.7.5

Release Date: Unreleased

4.7.5 release of CodeIgniter4

BREAKING

Message Changes

  • Added the Cookie.invalidCookieValue language string.

  • Added the Cookie.invalidCookiePath language string.

  • Added the Cookie.invalidCookieDomain language string.

Changes

  • Response: setJSON() and setXML(), and the FormatterInterface::format() contract implemented by JSONFormatter and XMLFormatter, now type their body/data parameter as mixed instead of array|object|string, matching what they already accepted at runtime (e.g., scalars and bool).

Deprecations

  • Debug Toolbar: Deprecated the unused CodeIgniter\Debug\Toolbar\Collectors\Views::$views property.

Bugs Fixed

  • CLI: Fixed a bug where pressing backspace in a CLI::prompt() erased the prompt text when the readline extension is enabled. The prompt is now passed to readline() so line redraws repaint it. ANSI color codes in the prompt (e.g., option defaults) are wrapped in readline’s non-printing markers under GNU readline so cursor positioning stays accurate. On Windows, where the readline extension is built on WinEditLine, the prompt is written to STDOUT first because WinEditLine reports no library version and prints ANSI sequences literally.

  • CLIRequest: Fixed a bug where parseCommand() could throw a TypeError when argv is missing.

  • CodeIgniter: Fixed a bug where gatherOutput() could be called twice when startController() returned a ResponseInterface (e.g., from filter attributes or closure routes).

  • Content Security Policy: Fixed a bug where empty Content-Security-Policy, Content-Security-Policy-Report-Only, and Reporting-Endpoints response headers were generated when no corresponding values existed.

  • Cookie: Fixed a bug where Cookie instances created with raw: true allowed invalid characters in cookie values rejected by setrawcookie().

  • Cookie: Fixed a bug where Cookie instances allowed invalid characters in path, domain, and prefix attributes rejected by setcookie() and setrawcookie().

  • Database: Fixed a bug where rebuilding a SQLite3 table (e.g., Forge::dropColumn(), Forge::modifyColumn(), Forge::dropForeignKey() and Forge::dropPrimaryKey()) corrupted the table names referenced by its foreign keys when DBPrefix was set.

  • Files: Fixed a bug where File::move() and UploadedFile::move() set executable and overly permissive file permissions (0777 & ~umask() instead of 0666 & ~umask()), and UploadedFile::move() targeted the parent directory instead of the destination file for chmod().

  • Helpers: Fixed a bug where get_dir_file_info() returned incomplete entries for subdirectories and missing files instead of omitting them.

  • Honeypot: Fixed a bug where bot detection returned an HTTP 500 response instead of 403 (Forbidden).

  • I18n: Fixed a bug where Time::today(), Time::yesterday(), and Time::tomorrow() ignored the specified $timezone and setTestNow() when calculating the day.

  • Logger: Fixed a bug where interpolating a log message with array or non-stringable context values could raise PHP warnings or errors.

  • Cache: Fixed MemcachedHandler::decrement() initializing a non-existent counter to the positive offset. Missing counters are now initialized to 0, reflecting Memcached’s unsigned, saturating counter semantics.

See the repo’s CHANGELOG.md for a complete list of bugs fixed.