Bump cakephp/cakephp from 4.4.18 to 4.5.11

[dependabot]

Bumps cakephp/cakephp from 4.4.18 to 4.5.11.

Release notes

Sourced from cakephp/cakephp's releases.

CakePHP 4.5.10 released

The CakePHP core team is happy to announce the immediate availability of CakePHP 4.5.10. This is a maintenance release for the 4.5 branch that fixes a few community reported issues. This will be the final routine release for 4.5, as 4.6.0 will be released later this week.

Bugfixes

You can expect the following changes in 4.5.10. See the changelog for every commit.

• Fix Route::parseRequest() not being able to emit query parameters

Contributors to 4.5.10

Thank you to all the contributors that helped make this release happen:

• Mark Story

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

CakePHP 4.5.9 released

The CakePHP core team is happy to announce the immediate availability of CakePHP 4.5.9. This is a maintenance release for the 4.4 branch that fixes a few community reported issues and a security fix.

Bugfixes

You can expect the following changes in 4.5.9. See the changelog for every commit.

• Requests now read the uri from REQUEST_URI instead of PATH_INFO. PATH_INFO has urlescaping applied which enables requests with %2f to be routed when they should not. This could create a security risk for applications that use CDN or loadbalancer rules with paths to be bypassed.
• Fix ORM queries not being able to set read role.

Contributors to 4.5.9

Thank you to all the contributors that helped make this release happen:

• Jeppe Bonde Weikop for reporting the PATH_INFO issue.
• Kevin Pfeifer
• Mark Story

As always, we would like to thank all the contributors that opened issues, created pull requests or updated the documentation.

CakePHP 4.5.8 released

The CakePHP core team is happy to announce the immediate availability of CakePHP 4.5.8. This is a maintenance release for the 4.4 branch that fixes a few community reported issues.

Bugfixes

You can expect the following changes in 4.5.8. See the changelog for every commit.

• Backport gettext compatible paths to the list of translation folders.

... (truncated)

Commits

• 005df99 Update version number to 4.5.11
• 2af17bd Fix a potential file handling weakness in element()
• 789c840 Update version number to 4.5.10
• acef0d2 Fix Route::parseRequest() not being able to emit query parameters (#18246)
• d0a413d Update version number to 4.5.9
• 0300452 Merge pull request #18093 from cakephp/4.x-fix-orm-read-role
• 13ce1ce fix ORM querys not being able to set read role
• 87b9d1a Merge pull request #18059 from cakephp/4x-request-uri
• 84d37ad Apply suggestions from code review
• c081243 Use REQUEST_URI instead of PATH_INFO (#18050)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.