dereuromark · Oct 11, 2026 · Jun 19, 2026 · Oct 11, 2026 · Oct 11, 2026 · Oct 11, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -11,11 +11,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-version: ['8.2', '8.5']
+        php-version: ['8.5']
         db-type: [sqlite, mysql, pgsql]
         prefer-lowest: ['']
         include:
-          - php-version: '8.2'
+          - php-version: '8.5'
             db-type: 'sqlite'
             prefer-lowest: 'prefer-lowest'
 
@@ -67,7 +67,7 @@ jobs:
           if [[ ${{ matrix.db-type }} == 'sqlite' ]]; then export DB_URL='sqlite:///:memory:'; fi
           if [[ ${{ matrix.db-type }} == 'mysql' ]]; then export DB_URL='mysql://root:root@127.0.0.1/cakephp'; fi
           if [[ ${{ matrix.db-type }} == 'pgsql' ]]; then export DB_URL='postgres://postgres:postgres@127.0.0.1/postgres'; fi
-          if [[ ${{ matrix.php-version }} == '8.2' ]]; then
+          if [[ ${{ matrix.php-version }} == '8.5' ]]; then
             vendor/bin/phpunit --coverage-clover=coverage.xml
           else
             vendor/bin/phpunit
@@ -77,7 +77,7 @@ jobs:
         run: vendor/bin/validate-prefer-lowest -m
 
       - name: Upload coverage reports to Codecov
-        if: success() && matrix.php-version == '8.2'
+        if: success() && matrix.php-version == '8.5'
         uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -92,7 +92,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.2'
+          php-version: '8.5'
           extensions: mbstring, intl
           coverage: none
 

diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
@@ -47,6 +47,7 @@ jobs:
           path: docs/.vitepress/dist
 
   deploy:
+    if: github.ref == 'refs/heads/master'
     permissions:
       contents: read
       pages: write

diff --git a/README.md b/README.md
@@ -1,10 +1,14 @@
 # CakePHP TinyAuth Plugin
 
-[![CI](https://github.com/dereuromark/cakephp-tinyauth/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/dereuromark/cakephp-tinyauth/actions/workflows/ci.yml?query=branch%3Amaster)
+This branch targets CakePHP 6 and PHP 8.5 or later. Use the `cake6` branches of companion CakePHP plugins during development.
+
+Composer applications consuming this development branch must set `minimum-stability` to `dev` and `prefer-stable` to `true`, then require this plugin as `dev-cake6`. Companion plugins also use their `cake6` branches. The published documentation website covers stable CakePHP 5 releases; use this branch's `docs/` directory for the upgrade documentation.
+
+[![CI](https://github.com/dereuromark/cakephp-tinyauth/actions/workflows/ci.yml/badge.svg?branch=cake6)](https://github.com/dereuromark/cakephp-tinyauth/actions/workflows/ci.yml?query=branch%3Acake6)
 [![Latest Stable Version](https://poser.pugx.org/dereuromark/cakephp-tinyauth/v/stable.svg)](https://packagist.org/packages/dereuromark/cakephp-tinyauth)
 [![Coverage Status](https://img.shields.io/codecov/c/github/dereuromark/cakephp-tinyauth/master.svg)](https://codecov.io/github/dereuromark/cakephp-tinyauth/branch/master)
 [![PHPStan](https://img.shields.io/badge/PHPStan-level%208-brightgreen.svg?style=flat)](https://phpstan.org/)
-[![Minimum PHP Version](https://img.shields.io/badge/php-%3E%3D%208.2-8892BF.svg)](https://php.net/)
+[![Minimum PHP Version](https://img.shields.io/badge/php-%3E%3D%208.5-8892BF.svg)](https://php.net/)
 [![License](https://poser.pugx.org/dereuromark/cakephp-tinyauth/license.svg)](LICENSE)
 [![Total Downloads](https://poser.pugx.org/dereuromark/cakephp-tinyauth/d/total.svg)](https://packagist.org/packages/dereuromark/cakephp-tinyauth)
 [![Coding Standards](https://img.shields.io/badge/cs-PSR--2--R-purple.svg?style=flat-square)](https://github.com/php-fig-rectified/fig-rectified-standards)

diff --git a/composer.json b/composer.json
@@ -27,19 +27,19 @@
 		"docs": "https://dereuromark.github.io/cakephp-tinyauth/"
 	},
 	"require": {
-		"php": ">=8.2",
-		"cakephp/cakephp": "^5.1.1"
+		"php": ">=8.5",
+		"cakephp/cakephp": "^6.0@dev"
 	},
 	"require-dev": {
-		"cakephp/authentication": "^3.0.1 || ^4.0",
-		"cakephp/authorization": "^3.0.1",
-		"cakephp/debug_kit": "^5.0.1",
+		"cakephp/authentication": "^5.0@dev",
+		"cakephp/authorization": "^4.0@dev",
+		"cakephp/debug_kit": "^6.0@dev",
 		"composer/semver": "^3.0",
-		"dereuromark/cakephp-i18n-lint": "^0.1.1",
+		"dereuromark/cakephp-i18n-lint": "dev-cake6",
 		"fig-r/psr2r-sniffer": "dev-master",
-		"phpunit/phpunit": "^11.5 || ^12.1 || ^13.0"
+		"phpunit/phpunit": "^13.0"
 	},
-	"minimum-stability": "stable",
+	"minimum-stability": "dev",
 	"prefer-stable": true,
 	"autoload": {
 		"psr-4": {

diff --git a/docs/.vitepress/config.ts b/docs/.vitepress/config.ts
@@ -90,7 +90,7 @@ export default defineConfig({
       provider: 'local',
     },
     editLink: {
-      pattern: 'https://github.com/dereuromark/cakephp-tinyauth/edit/master/docs/:path',
+      pattern: 'https://github.com/dereuromark/cakephp-tinyauth/edit/cake6/docs/:path',
       text: 'Edit this page on GitHub',
     },
     footer: {

diff --git a/docs/authentication/impersonation.md b/docs/authentication/impersonation.md
@@ -4,7 +4,7 @@ TinyAuth ships a `PrimaryKeySessionAuthenticator` that enables the classic "admi
 
 ## Setup
 
-With Authentication 4, replace the default Session authenticator in `getAuthenticationService()` with the following configuration. This example assumes a `Users` table with an `id` primary key:
+With Authentication 5, replace the default Session authenticator in `getAuthenticationService()` with the following configuration. This example assumes a `Users` table with an `id` primary key:
 
 ```php
 $service->loadAuthenticator('TinyAuth.PrimaryKeySession', [
@@ -22,7 +22,7 @@ $service->loadAuthenticator('TinyAuth.PrimaryKeySession', [
 ]);
 ```
 
-The authenticator stores only the user’s primary key in the session. With caching disabled, it reloads the identity through the configured identifier on each request. For Authentication 3, configure the Token identifier using its [versioned setup guide](https://book.cakephp.org/authentication/3/en/quick-start.html).
+The authenticator stores only the user’s primary key in the session. With caching disabled, it reloads the identity through the configured identifier on each request. Configure the Token identifier using its [versioned setup guide](https://book.cakephp.org/authentication/5/#quick-start).
 
 ### Config keys
 

diff --git a/docs/authentication/index.md b/docs/authentication/index.md
@@ -6,7 +6,7 @@ Complete [Installation](/guide/install) first. For a small working rule set, fol
 
 ## Official plugin setup
 
-Set up the [CakePHP Authentication plugin](https://github.com/cakephp/authentication) before loading TinyAuth’s component. Use the documentation matching your installed version: [Authentication 4](https://book.cakephp.org/authentication/4/en/quick-start.html) or [Authentication 3](https://book.cakephp.org/authentication/3/en/quick-start.html).
+Set up the [CakePHP Authentication plugin](https://github.com/cakephp/authentication) before loading TinyAuth’s component. Use the documentation matching your installed version: [Authentication 5](https://book.cakephp.org/authentication/5/#quick-start).
 
 ## Implement Authentication Interface
 
@@ -24,7 +24,7 @@ class Application extends BaseApplication implements AuthenticationServiceProvid
 }
 ```
 
-📖 See: [Application Setup](https://book.cakephp.org/authentication/4/en/quick-start.html#application-setup) in official docs
+📖 See: [Application Setup](https://book.cakephp.org/authentication/5/#getting-started) in official docs
 
 ## Configure Middleware
 
@@ -46,11 +46,11 @@ public function middleware(MiddlewareQueue $middlewareQueue): MiddlewareQueue
 }
 ```
 
-📖 See: [Middleware Setup](https://book.cakephp.org/authentication/4/en/middleware.html) in official docs
+📖 See: [Middleware Setup](https://book.cakephp.org/authentication/5/middleware.html) in official docs
 
 ## Configure Authentication Service
 
-The example below uses Authentication 4. For Authentication 3, follow its versioned guide to configure identifiers, then load the same TinyAuth component. Implement `getAuthenticationService()` in your `Application` class:
+The example below uses Authentication 5 with CakePHP 6. Implement `getAuthenticationService()` in your `Application` class:
 
 ```php
 // src/Application.php
@@ -123,7 +123,7 @@ public function getAuthenticationService(ServerRequestInterface $request): Authe
 
 Note: Each authenticator has its own `identifier` configuration. The Session authenticator doesn't need one as it uses the stored identity.
 
-📖 See: [Authentication Service](https://book.cakephp.org/authentication/4/en/authentication-service.html) in official docs
+📖 See: [Authentication Service](https://book.cakephp.org/authentication/5/#getting-started) in official docs
 
 ---
 
@@ -402,7 +402,7 @@ $service->loadAuthenticator('TinyAuth.PrimaryKeySession', [
 ]);
 ```
 
-📖 See: [Session Authenticator](https://book.cakephp.org/authentication/4/en/authenticators.html#session) in official docs for base functionality
+📖 See: [Session Authenticator](https://book.cakephp.org/authentication/5/authenticators.html#session) in official docs for base functionality
 
 ### Session Caching with PrimaryKeySession
 
@@ -485,7 +485,7 @@ $service->loadAuthenticator('Tools.LoginLink', [
 
 Note: Requires `composer require dereuromark/cakephp-tools`
 
-📖 See: [Tools Plugin LoginLink](https://github.com/dereuromark/cakephp-tools/blob/master/docs/Authentication/LoginLink.md)
+📖 See: [Tools Plugin LoginLink](https://github.com/dereuromark/cakephp-tools/blob/cake6/docs/Authentication/LoginLink.md)
 
 ## Accessing User Identity
 
@@ -504,6 +504,6 @@ $user = $this->AuthUser->identity();
 
 # Additional Resources
 
-- 📖 Official Authentication Docs: [book.cakephp.org/authentication/3](https://book.cakephp.org/authentication/3/en/index.html)
+- 📖 Official Authentication Docs: [book.cakephp.org/authentication/5](https://book.cakephp.org/authentication/5/)
 - 🔐 Authorization: Add role-based access control - See [Authorization](/authorization/)
 - ❓ Troubleshooting: See [Troubleshooting](/guide/troubleshooting)
diff --git a/docs/authorization/index.md b/docs/authorization/index.md
@@ -6,7 +6,7 @@ Complete [Installation](/guide/install) first. [Getting started](/guide/quick-st
 
 ## Official plugin setup
 
-Set up the [CakePHP Authorization plugin](https://github.com/cakephp/authorization) with its [Getting started guide](https://book.cakephp.org/authorization/3/en/getting-started.html). Authentication middleware must run before Authorization middleware so the latter can decorate the authenticated identity.
+Set up the [CakePHP Authorization plugin](https://github.com/cakephp/authorization) with its [Getting started guide](https://book.cakephp.org/authorization/4/#getting-started). Authentication middleware must run before Authorization middleware so the latter can decorate the authenticated identity.
 
 ## Implement Authorization Interface
 
@@ -34,7 +34,7 @@ class Application extends BaseApplication
 }
 ```
 
-📖 See: [Getting Started](https://book.cakephp.org/authorization/3/en/getting-started.html) in official docs
+📖 See: [Getting Started](https://book.cakephp.org/authorization/4/#getting-started) in official docs
 
 ## Configure Middleware
 
@@ -73,7 +73,7 @@ public function getAuthorizationService(ServerRequestInterface $request): Author
 
 This configures the request policy that reads your `auth_acl.ini` file for role-based permissions.
 
-📖 See: [Authorization Service](https://book.cakephp.org/authorization/3/en/getting-started.html#authorization-service) in official docs
+📖 See: [Authorization Service](https://book.cakephp.org/authorization/4/#getting-started) in official docs
 
 ---
 
@@ -578,6 +578,6 @@ By default INI files and the IniAdapter will be used. See [AuthorizationAdapter]
 
 # Additional Resources
 
-- 📖 Official Authorization Docs: [book.cakephp.org/authorization/3](https://book.cakephp.org/authorization/3/en/index.html)
+- 📖 Official Authorization Docs: [book.cakephp.org/authorization/4](https://book.cakephp.org/authorization/4/)
 - 🔐 Authentication: Set up authentication first - See [Authentication](/authentication/)
 - ❓ Troubleshooting: See [Troubleshooting](/guide/troubleshooting)
diff --git a/docs/guide/custom-adapters.md b/docs/guide/custom-adapters.md
@@ -20,7 +20,7 @@ interface AllowAdapterInterface {
 }
 ```
 
-`getAllow()` returns the public-action whitelist, keyed by section. The reference implementation is [`IniAllowAdapter`](https://github.com/dereuromark/cakephp-tinyauth/blob/master/src/Auth/AllowAdapter/IniAllowAdapter.php).
+`getAllow()` returns the public-action whitelist, keyed by section. The reference implementation is [`IniAllowAdapter`](https://github.com/dereuromark/cakephp-tinyauth/blob/cake6/src/Auth/AllowAdapter/IniAllowAdapter.php).
 
 Each entry should look like:
 
@@ -57,7 +57,7 @@ interface AclAdapterInterface {
 }
 ```
 
-`getAcl()` returns the role-permission map, keyed by section. The reference implementation is [`IniAclAdapter`](https://github.com/dereuromark/cakephp-tinyauth/blob/master/src/Auth/AclAdapter/IniAclAdapter.php).
+`getAcl()` returns the role-permission map, keyed by section. The reference implementation is [`IniAclAdapter`](https://github.com/dereuromark/cakephp-tinyauth/blob/cake6/src/Auth/AclAdapter/IniAclAdapter.php).
 
 `$availableRoles` is `['admin' => 1, 'user' => 2, ...]` so you can look up role IDs by name.
 

diff --git a/docs/guide/install.md b/docs/guide/install.md
@@ -1,28 +1,33 @@
 # Installation
 
+The `cake6` branch requires CakePHP 6 and PHP 8.5. Development dependencies require the application to allow development stability, even when TinyAuth declares its own `@dev` constraints. Keep `prefer-stable` enabled for other packages.
+
 ## Required dependencies
 
 TinyAuth wraps CakePHP's official Authentication and Authorization plugins. Before using TinyAuth features, you must install and configure the official plugins:
 
 | Feature | Required Plugin | Setup Guide |
 | --- | --- | --- |
-| Authentication (login/logout) | [cakephp/authentication](https://github.com/cakephp/authentication) | [/authentication/](/authentication/) + [Authentication 4](https://book.cakephp.org/authentication/4/en/index.html) / [Authentication 3](https://book.cakephp.org/authentication/3/en/index.html) |
-| Authorization (roles / ACL) | [cakephp/authorization](https://github.com/cakephp/authorization) | [/authorization/](/authorization/) + [Official Docs](https://book.cakephp.org/authorization/3/en/index.html) |
+| Authentication (login/logout) | [cakephp/authentication](https://github.com/cakephp/authentication) | [/authentication/](/authentication/) + [Authentication 5](https://book.cakephp.org/authentication/5/) |
+| Authorization (roles / ACL) | [cakephp/authorization](https://github.com/cakephp/authorization) | [/authorization/](/authorization/) + [Official Docs](https://book.cakephp.org/authorization/4/) |
 
 ```bash
+composer config minimum-stability dev
+composer config prefer-stable true
+
 # For authentication features
-composer require cakephp/authentication
+composer require 'cakephp/authentication:^5.0@dev'
 
 # For authorization features
-composer require cakephp/authorization
+composer require 'cakephp/authorization:^4.0@dev'
 ```
 
 > Standalone exception: the [AuthUser component and helper](/auth-user) work without the official plugins: they integrate with any authentication solution that sets an identity in the request.
 
 ## Install TinyAuth
 
 ```bash
-composer require dereuromark/cakephp-tinyauth
+composer require dereuromark/cakephp-tinyauth:dev-cake6
 bin/cake plugin load TinyAuth
 ```
 

diff --git a/docs/guide/upgrade.md b/docs/guide/upgrade.md
@@ -1,5 +1,13 @@
 # Upgrade Guide
 
+## CakePHP 6 development branch
+
+The `cake6` branch requires PHP 8.5 and CakePHP 6. Authentication features use Authentication 5; authorization features use Authorization 4. Follow the [installation guide](/guide/install) to select the development branches and configure Composer stability.
+
+Custom components and helpers must follow the CakePHP 6 configuration and view property names. Custom commands implement `execute(): int` and access the inherited argument and console properties. Review overrides against the native parameter and return types in this branch. INI allow-file configuration still accepts one directory or an array of directories.
+
+The test suite uses PHPUnit 13. The published documentation website describes the stable CakePHP 5 branch; use the `docs/` files in this branch for CakePHP 6.
+
 ## Upgrading from TinyAuth 3.x (CakePHP 4.x)
 
 **Breaking changes:** TinyAuth has fundamentally changed from a standalone auth solution to a wrapper around the official CakePHP plugins.