Skip to content
Edit this page

Version 4.2.0

Release Date: June 3, 2022

4.2.0 release of CodeIgniter4

Highlights

  • Update minimum PHP requirement to 7.4.
  • To make the default configuration more secure, auto-routing has been changed to disabled by default.
  • OCI8 Driver for Oracle Database (contributed by ytetsuro). See Database.
  • Improved Auto Routing (opt-in) (contributed by kenjis). See New Improved Auto Routing.
  • Query Builder Subqueries and UNION support (contributed by Andrey Pyzhikov). See Database.

New Contributors

BREAKING

Method Signature Changes

  • The method signatures of CodeIgniter\Database\BaseBuilder::join() and CodeIgniter\Database\*\Builder::join() have been changed.
  • The method signature of Validation::setRule() has been changed. The string typehint on the $rules parameter was removed. Extending classes should likewise remove the typehint so as not to break LSP.
  • The method signature of CodeIgniter\CLI\CommandRunner::_remap() has been changed to fix a bug.
  • The default parameter values for Service::reset() and CIUnitTestCase::resetServices() have been changed from false to true. This is to eliminate unexpected problems during testing, such as lang() not getting translated messages.

Behavior Changes

  • The CodeIgniter\CodeIgniter class has a new property $context and it must have the correct context at runtime. So the following files have been changed:
    • public/index.php
    • spark
  • The system/bootstrap.php file has been modified to easily implement Preloading. Returning a CodeIgniter instance and loading the .env file have been moved to index.php and spark.
  • The behavior of CodeIgniter\Autoloader\Autoloader::initialize() has changed to fix a bug. It used to use the Composer classmap only when $modules->discoverInComposer is true. Now it always uses the Composer classmap if Composer is available.
  • The color code output by CLI::color() has been changed to fix a bug.
  • To prevent unexpected access from the web browser, if a controller is added to a cli route ($routes->cli()), all methods of that controller are no longer accessible via auto-routing.
  • There is a possible backward compatibility break for users extending the History Collector, and they should probably update the History::setFiles() method.
  • The unexpected behavior of dot_array_search() has been fixed. Now dot_array_search('foo.bar.baz', ['foo' => ['bar' => 23]]) returns null. Previous versions returned 23.
  • CodeIgniter::storePreviousURL() has been changed to store only the URLs whose Content-Type was text/html. It also affects the behavior of previous_url() and redirect()->back().

Enhancements

New Improved Auto Routing

Added a new, optional, more secure auto router. These are the changes from the legacy auto-routing:

  • A controller method needs an HTTP verb prefix like getIndex(), postCreate().
    • Developers always know the HTTP method, so requests by an unexpected HTTP method do not pass.
  • The Default Controller (Home by default) and the Default Method (index by default) must be omitted in the URI.
    • It enforces a one-to-one correspondence between controller methods and URIs.
    • E.g. by default, you can access /, but /home and /home/index will be 404.
  • It checks the method parameter count.
    • If there are more parameters in the URI than the method parameters, it results in a 404.
  • It does not support the _remap() method.
    • It enforces a one-to-one correspondence between controller methods and URIs.
  • It can't access controllers in Defined Routes.
    • It completely separates controllers accessible via Auto Routes from those accessible via Defined Routes.

See Auto Routing (Improved) for the details.

Database

  • Added a new OCI8 database driver.
    • It can access Oracle Database and supports SQL and PL/SQL statements.
  • QueryBuilder
    • Added Subqueries in the FROM section. See Subqueries.
    • Added Subqueries in the SELECT section. See Select.
    • The BaseBuilder::buildSubquery() method can take an optional third argument string $alias.
    • Union queries. See Union queries.
  • Raw SQL string support
  • SQLite3 has a new Config item foreignKeys that enables foreign key constraints.

Helpers and Functions

  • HTML helper script_tag() now uses null values to write boolean attributes in minimized form: <script src="..." defer />. See the sample code for script_tag().
  • Added a 4th parameter $includeDir to get_filenames(). See get_filenames().
  • Exception information logged through log_message() has been improved. It now includes the file and line where the exception originated. It also does not truncate the message anymore.
    • The log format has also changed. If users are depending on the log format in their apps, the new log format is "<1-based count> <cleaned filepath>(<line>): <class><function><args>"

Commands

  • Added spark db:table command. See Database Commands for the details.
    • You can now see the names of all the tables in the database you are currently connected to in the terminal.
      • spark db:table --show
    • Or you can see the field names and the records of a table.
      • spark db:table my_table
      • spark db:table my_table --limit-rows 50 --limit-field-value 20 --desc
    • Or you can see metadata like the column type and max length of a table.
      • spark db:table my_table --metadata
  • The spark routes command now shows closure routes, auto routes, and filters. See URI Routing.

Others

  • Added $this->validateData() in Controller. See $this->validateData().
  • Content Security Policy (CSP) enhancements
    • Added the configs $scriptNonceTag and $styleNonceTag in Config\ContentSecurityPolicy to customize the CSP placeholders ({csp-script-nonce} and {csp-style-nonce})
    • Added the config $autoNonce in Config\ContentSecurityPolicy to disable the CSP placeholder replacement
    • Added the functions csp_script_nonce() and csp_style_nonce() to get nonce attributes
    • See Content Security Policy for details.
  • New View Decorators allow modifying the generated HTML prior to caching.
  • Added Validation Strict Rules. See Traditional and Strict Rules.
  • Added support for webp files to app/Config/Mimes.php.
  • RouteCollection::addRedirect() can now use placeholders. See Redirecting Routes for details.
  • Debugbar enhancements
    • The Debug Toolbar now uses microtime() instead of time().
  • Added a sample file for Preloading. See preload.php.

Changes

  • Update minimum PHP requirement to 7.4.
  • To make the default configuration more secure, auto-routing has been changed to disabled by default.
  • Validation. Changed generation of errors when using fields with a wildcard (*). Now the error key contains the full path. See Getting All Errors.
  • Validation::getError() when using a wildcard will return all found errors matching the mask as a string.
  • The current version of Content Security Policy (CSP) outputs one nonce for script and one for style tags. The previous version outputted one nonce for each tag.
  • The process of sending cookies has been moved to the Response class. Now the Session class doesn't send cookies, but sets them on the Response.

Deprecations

  • CodeIgniter\Database\SQLSRV\Connection::getError() is deprecated. Use CodeIgniter\Database\SQLSRV\Connection::error() instead.
  • CodeIgniter\Debug\Exceptions::cleanPath() and CodeIgniter\Debug\Toolbar\Collectors\BaseCollector::cleanPath() are deprecated. Use the clean_path() function instead.
  • CodeIgniter\Log\Logger::cleanFilenames() and CodeIgniter\Test\TestLogger::cleanup() are both deprecated. Use the clean_path() function instead.
  • CodeIgniter\Router\Router::setDefaultController() is deprecated.
  • The constant SPARKED in spark is deprecated. Use the $context property in CodeIgniter\CodeIgniter instead.
  • CodeIgniter\Autoloader\Autoloader::discoverComposerNamespaces() is deprecated, and no longer used.
  • The constants EVENT_PRIORITY_LOW, EVENT_PRIORITY_NORMAL and EVENT_PRIORITY_HIGH are deprecated. Use the class constants CodeIgniter\Events\Events::PRIORITY_LOW, CodeIgniter\Events\Events::PRIORITY_NORMAL and CodeIgniter\Events\Events::PRIORITY_HIGH instead.

Bugs Fixed

  • Fixed a bug where the SQLSRV driver ignored the port value from the config.

See the repo's CHANGELOG_4.2.md for a complete list of bugs fixed.