Pop PHP
Introduction

Changelog

The release history of the framework as a whole, newest first. Each entry covers the framework release rather than any one component — component version numbers move independently, and the mapping from a framework version to its component versions is in the tables on What's New in v7 and Upgrading from v6.

For v7 specifically, this page is the summary. The feature-by-feature detail is NEW-FEATURES.md and the break-by-break detail is BC-BREAKS.md.

7.0.0#

Released 17 August 2026.

Framework-wide#

  • Many new features and upgrades.
  • Updated for PHP 8.4 and newer.
  • Added declare(strict_types=1); throughout all components.
  • Added PHPStan coverage throughout all components.
  • Improved test code coverage throughout all components.

New packages#

  • framework — the popphp/framework repository becomes the official installer repository, providing the correct abstracted layer over the underlying popphp-framework installation. A project's composer.json now carries a single popphp/framework requirement instead of the long list of individual component requirements that came from the original popphp-framework repository.
  • pop-parser — a package that parses name and address strings into individual data points.

Upgrades and improvements#

popphp

  • Added Dispatch functionality, allowing things other than controllers to be dispatched by the application object.
  • Tighter integration of CallableObject: a controller can be a callable string supported by CallableObject, or a CallableObject instance. This is normalized in one place across every route-registration path, and a malformed callable string throws at route-registration time instead of registering a route that can never dispatch.
  • Added PSR-14 interoperability to the event functionality.
  • Added PSR-15 interoperability to the middleware functionality.
  • Added PSR-11 interoperability to the service functionality.
  • Changed the error thrown by Pop\Application::run() from Pop\Exception to Throwable.
  • Patched a number of bugs and general issues throughout.
  • Moved AbstractModel to pop-utils.
  • Moved AbstractDataModel to pop-db.

pop-acl

  • Added role and resource removal for better management.
  • Added introspection to get current permissions.
  • Added wildcard permissions.

pop-auth

  • Security-hardening pass on all adapters, including a new needsRehash() contract, and adapters throwing Pop\Auth\Exception on infrastructure failures instead of silently returning 0.
  • Removed the LDAP adapter.
  • Removed the database table adapter; database-backed authentication moved to pop-db, and pop-auth no longer depends on pop-db.
  • Removed the HTTP adapter; use pop-http's Client and Auth classes directly for delegated or remote authentication, and pop-auth no longer depends on pop-http.
  • Added a Jwt adapter that verifies a token's signature, through a new pop-crypt signature-verification primitive, and its claims — exp and nbf always, aud and iss opt-in.
  • Widened AuthInterface::authenticate() to authenticate(string $credential, ?string $secondary = null): int to accommodate Jwt's single-token credential.

pop-cache

  • Added PSR interoperability: PSR-6 and PSR-16 caching interfaces.
  • Improvements to cache retrieval.
  • Addition of modern caching features, such as remember().
  • Injectable clock.

pop-code

  • General improvements and additions to catch up to PHP 8.4.
  • Improvements and additions for modifiers.
  • Added support for enums.
  • Added support for attributes.

pop-color

  • Added support for new color formats: HSB, HSV, HWB, Lab, Lch, Oklab and Oklch.

pop-config

  • Added dot.notation support.
  • Switched to symfony/yaml for YAML support.
  • Improved exception handling.
  • Improved collision behavior.

pop-console

  • Expanded the Command class to use the dispatchable functionality, now used to add executable application commands directly to pop-kettle without needing a controller.
  • Added table rendering.
  • Added progress bar functionality.
  • Added a multi-select prompt.
  • Added the ability to display help for sub-commands, filtering a help screen down to a smaller set of commands.
  • Refactored the Console class, breaking the prompt, header, alert and help rendering out into separate, stand-alone Prompt, Header, Alert and Help classes. The public API is unchanged.

pop-crypt

  • Added Sodium and XChaCha20 support.
  • Improved security fixes.
  • Added Signature\Verifier for HMAC, RSA and EC signature verification, consumed by pop-auth's new Jwt adapter.

pop-css

  • Improved color support through the upgraded pop-color component.
  • Improved CSS support.

pop-csv

  • Added support for escaped formulas.
  • Improved file streaming.

pop-db

  • Improved and upgraded shorthand syntax across the board.
  • Improved and upgraded relationships.
  • Before and after hook support for save, update and delete.
  • JSON support.
  • Subquery support.
  • EXISTS support.
  • Moved AbstractDataModel to pop-db, from popphp.
  • Moved and refactored the Auth\Table functionality from pop-auth into pop-db. It now supports authentication, attempts and MFA natively.
  • Fillable and guarded support.
  • Removed the circular dependency on pop-debug.
  • Added reset() to the Record class to reset a column value.
  • Added needsRehash() and rehash() to Record\Encoded to transparently upgrade outdated password hashes on a successful verify().

pop-debug

  • Refactored for new pop-log compatibility.
  • Support for NDJSON.
  • Removed the circular dependency on pop-db.

pop-form

  • Improved CSRF.
  • Removed the Captcha field, outdated and ineffective in today's modern web landscape.
  • Improved file uploads.
  • Added ARIA support.

pop-http

  • Added PSR interoperability: PSR-7 HTTP message interfaces, PSR-17 HTTP factories, PSR-18 HTTP client, and PSR-3 logging middleware.
  • Core internals refactor: dropped use of the pop-mime body for multipart handling in favor of a newly built native Body class; improved data handling and parsing; improvements to the curl and stream handler classes; improvements to the client functionality; improvements to the server functionality; and added support for content negotiation through the Accept request header.
  • Improvements to the curl command functionality.
  • Added a mock transport handler.

pop-image

  • Removed the Captcha class, outdated and ineffective in today's modern web landscape.

pop-kettle

  • Added the ability to install a front-end system from a selection of popular JS frameworks plus TailwindCSS, through Vite: AlpineJS, Vue.js and React.
  • Added the web:watch and web:build commands to rebuild front-end assets from the kettle helper script.
  • Moved the serve command into the new web: command group as web:serve.
  • Added the ability to add executable commands directly to the kettle helper script, rather than having to build a separate application script and console controllers.
  • Added support to manage queues directly from the kettle helper script.
  • Added autoloading of commands in the application namespace.
  • Added new pop-console functionality to display help for sub-commands.
  • Moved the kettle app:* commands to kettle pop:*, freeing the app (App) namespace for the installed application.
  • Simplified the kettle pop:init command options and converted them into prompts within the command; the namespace is normalized into a valid PHP namespace, a script slug and a display name.
  • Consolidated the separate web and API scaffolding into a single set of Http controllers that negotiate an HTML or JSON response off the request's Accept header, reducing the six install flavors down to a full application or a CLI-only one.
  • Added the --set flag to the pop:env command to change the application environment.
  • Removed the kettle.inc.php file; pop:init now registers the application namespace in composer.json and runs composer dump-autoload instead.
  • Renamed the orig.env template file to .env.example.
  • Added a Composer-based install hook to run the pop:init command post-install.

pop-log

  • Added PSR interoperability: the PSR-3 logger interface.
  • Improved RFC-3164 support and compatibility.
  • Added processors.
  • Added formatters.
  • Added streams.

pop-mail

  • Removed native message and part functionality, replaced with refactored functionality in pop-mime.
  • Message::parse() now throws Pop\Mail\Exception on content with no header/body delimiter instead of surfacing a TypeError from pop-mime.

pop-mime

  • Built out native message and part functionality, to be consumed by pop-mail.
  • Patched Message::parseMessage() throwing a TypeError on content with no \r\n\r\n header/body delimiter; such content is now parsed as a header-less, body-only message.

pop-pdf

  • Patched a known error bug that displayed in strict readers such as Adobe Acrobat.
  • Added native text extraction.
  • Added native PDF merging.
  • Finished HTML-to-PDF functionality, including HTML tables.
  • CID font support for Cyrillic, Greek, Arabic and other scripts.

pop-queue

  • Full refactor: new adapter contracts; improved dead-letter storage; a new memory adapter; delay, backoff and timeout added to jobs; improvements to concurrent workers; a worker registry and observability; improved schedule fairness; improved worker orchestration; and improved security.

pop-session

  • Improved session clean up.
  • Improved session security.

pop-storage

  • Support for presigned and temporary URLs.
  • Improved recursive listing.
  • Improved streaming.

pop-utils

  • Added debug interfaces, to break the circular dependency between pop-db and pop-debug.
  • Moved AbstractModel to pop-utils, from popphp.
  • Fixed CallableObject dropping its parameters for the 'new Class' form, which returned null and constructed nothing. It now matches the bare 'Class' form. An already-instantiated object passed with parameters returns the object instead of null.

pop-view

  • Major refactor and upgrade to the stream template.

Deprecated and removed#

  • popcorn — no longer supported. The functionality has been baked directly into the Pop\Application class.
  • pop-ftp — no longer supported.
  • pop-auth — the LDAP adapter was removed and is no longer supported.
  • pop-auth — the database table adapter was removed; it moved to pop-db.
  • pop-auth — the HTTP adapter was removed; use pop-http directly.
  • popphp-skeleton — no longer supported. Replaced by pop-kettle as the de facto application scaffolding.
  • popphp-tutorial — no longer supported. See the documentation for code examples.

6.0.0#

Released 3 November 2025.

  • Updated for PHP 8.3 and newer.
  • Updated tests for PHPUnit 12.0 and newer.
  • New and refactored package: pop-crypt, an older package that was sunset a few years ago, refactored with modern support for one-way hashing and two-way encryption.
  • popphp — added support for middleware.
  • pop-db — refactored the Pop\Db\Record\Encoded class to work with the newly refactored pop-crypt component.
  • pop-debug — refactored and streamlined the component.
  • pop-utils — added the Pop\Utils\Num helper class.

5.5.0#

Released 12 February 2025.

  • Updated for PHP 8.2 and newer.
  • Updated tests for PHPUnit 11.5 and newer.
  • pop-db — added support for latest() and oldest() with hasMany relationships, and support for UPDATE SQL in the Sql\Data class.
  • pop-csv — added support to map array and multi-dimensional array values to a single cell value.
  • pop-mail — bug fixes.
  • pop-debug — added support for adding loggers to the debugger.
  • pop-form — improved i18n support for the required message.
  • pop-http — improved support for custom content-type headers.
  • pop-kettle — added bash and zsh completion.
  • pop-log — added serialization support for context.
  • pop-storage — improved the Azure adapter.
  • pop-validator — added an optional results property.

5.4.0#

Released 10 September 2024.

  • popphp — bug fix.
  • pop-dom — bug fix.
  • pop-form — bug fix.
  • pop-http — bug fix.
  • pop-pdf — added support for text extraction.
  • pop-utils — added DateTimeTrait.
  • pop-validator — added DateTime validators.

5.3.1#

Released 28 May 2024.

  • Small improvements to popphp, pop-db, pop-form, pop-http, pop-mail and pop-utils.

5.3.0#

Released 1 April 2024.

  • pop-utils — added a helper class and functions, added autoloading of helper functions to the main application object, added an array helper class, and refactored the existing array classes for better interoperability.

5.2.0#

Released 4 March 2024.

  • Added bash completion to pop-kettle.
  • Added a style object and functionality to pop-pdf.
  • popcorn — added support for custom methods in the config, and improved route prefixes.
  • pop-form — improved error message grouping and display, and improved append and prepend functionality with form field elements.
  • Improved ACL policy support in pop-nav.
  • Upgraded the options parameter in pop-csv — renamed omit to exclude and added include.
  • Added the outputToRawString() method in pop-image.

5.1.0#

Released 18 December 2023.

  • Improved transaction support in pop-db.
  • Added individual query methods to the database adapters in pop-db.
  • Added the Pop\App helper class in popphp.
  • Added the Pop\Model\AbstractDataModel class in popphp.
  • Incorporated vlucas/phpdotenv in popphp to track application-specific variables.
  • Improved application handling and support with pop-kettle.
  • Improved color and styling support in pop-console.

5.0.0#

Released 8 November 2023.

  • Upgraded to PHP 8.1 and newer.
  • pop-http — better separation of client and server functionality, with a standalone Client class, client handlers supporting curl, streams and curl multi, and a standalone Server class. Improved response content negotiation and handling. Added promises. Added curl CLI conversion functionality. Added the ability to create raw strings of a client request. Added factories to the client Stream and Curl classes, and to the request, response and upload classes. Improved the Auth header object, adding support for digest auth.
  • pop-mail — expanded the available mail transports to include Mailgun, SendGrid, Office 365, AWS SES and Google, and expanded the available mail clients to include Office 365 and Google.
  • pop-storage — added an Azure adapter, refactored the S3 and local adapters, and added a top-level normalized Storage class.
  • pop-queue — created a task object that extends the job object and has scheduling functionality; deprecated the scheduler object and refactored the worker object, reworking the job/task, queue and worker hierarchy; added a cron object to manage scheduling and greatly improved scheduling; added sub-minute scheduling; added max attempts; improved the run-until functionality; and added an AWS SQS adapter.
  • popphp — improved CLI route syntax and handling.
  • pop-auth — refactored for pop-http v5.0.0.
  • pop-db — added a Seeder class with create() and run() methods, added the ability to store database migrations in a database table, and improved the debugger functionality with the profiler.
  • pop-code — added support for return types and better support for type hints.
  • pop-cache — renamed the Db adapter to Database to limit possible namespace conflicts.
  • pop-color — new component for color value management, parsing and conversion.
  • pop-config — added support for YAML.
  • pop-console — added support for a fourth console color, to visually separate parameters and options.
  • pop-css — added a writeToFile($to) method, improved comment functionality, and improved the CSS object constructor.
  • pop-debug — improved retrieval of stored debug content, renamed the Db storage adapter to Database to limit possible namespace conflicts, added a timestamp column to the database storage adapter, and deprecated and removed the Redis adapter.
  • pop-image — deprecated and removed setAdjust(), setDraw(), setEffect(), setFilter(), setLayer() and setType(). The existing adjust(), draw(), effect(), filter(), layer() and type() methods now serve as the constructor factories for their respective objects.
  • pop-kettle — added the ability to store and manage migrations from a database table, moved seed functionality over to the new Pop\Db\Sql\Seeder class, and added the ability to export and import raw SQL files, MySQL only.
  • pop-log — renamed the Db writer to Database to limit possible namespace conflicts.
  • pop-utils — added a File helper class, and deprecated and removed the abstract error class and error interface.
  • Deprecated: PHP 7.4 is no longer supported, the pop-loader component is no longer available, and the abstract error class and error interface were removed from pop-utils.

4.8.0#

Released 3 September 2023.

  • Added API-based adapters for Mailgun and SendGrid in the pop-mail component.
  • Added a new Auth header class to the pop-http component, providing easier access to auth header information for outbound client requests and inbound server requests.
  • Added the ability to track full state in the pop-audit component.

4.7.0#

Released 16 November 2022.

  • Added support for PHP 8.0 and newer, backwards compatible to PHP 7.4.
  • Added the new pop-storage component, providing interchangeable adapters to switch between storage resources such as local disk and AWS S3.

4.6.0#

Released 12 February 2021.

  • Migrated unit tests from Travis CI to GitHub Actions.
  • Changed the minimum supported PHP version to 7.3.
  • Changed the minimum supported PHPUnit version to 9.0.
  • pop-image updated to v3.6.0 — full removal of the Gmagick adapter.
  • pop-queue updated to v1.2.0 — migrated from the SuperClosure library to the OPI Closure library.

4.5.0#

Released 28 May 2020.

  • pop-db updated to v5.0.5 — refactored the predicate set parser and generator classes; refactored the helper parser classes for expressions, tables and so on; improved the SQL builder and schema builder classes; improved connect and disconnect functionality on the adapter classes; improved support for standard SQL functions; removed references to ArrayObjects; and improved unit tests and coverage.
  • pop-pdf updated to v4.0.0 — fixed field issues, improved text support, improved HTML support, and a code review and clean up.
  • pop-acl updated to v3.3.0 — added policy functionality.
  • pop-audit updated to v1.2.0 — refactored the Http adapter to work with the newly refactored pop-http component, refactored the Table adapter to include check and create table schema, and general code review and clean up.
  • pop-auth updated to v3.2.0 — refactored the Http class to use the pop-http component.
  • pop-cache updated to v3.3.0 — refactored the SQLite adapter class into a full Db adapter, deprecated and removed the Memcache adapter in favor of the Memcached adapter, refactored the Apc adapter to use only the APCu extension, and refactored and improved unit tests.
  • pop-code updated to v4.0.0 — support for traits, support for constants, better support for namespaces, and improved reflection and parsing support.
  • pop-debug updated to v1.2.0 — refactored the SQLite storage class into a full Db storage class, and refactored the request handler to use the newly refactored pop-http component.
  • pop-mail updated to v3.5.0 — incorporated the new pop-mime component for better and more consistent parsing of mail messages, and refactored the attachment class.
  • pop-form updated to v3.5.0 — added an AclForm class to enforce ACL-based roles and permissions for which form fields are accessible by which users; removed the native filter classes in favor of the newly refactored pop-filter component; added a FormValidator class to perform field value validations without the weight of a full form object; added a FormConfig class for more robust support of form configuration; and better support for conditional validation.
  • pop-http updated to v4.0.0 — refactored code base with better class structure; better support for the HTTP client classes, including form data; moved the server request, response and upload classes into a new Pop\Http\Server\ namespace; incorporated the new pop-mime component for better multipart form data generation; incorporated the newly refactored pop-filter component for input data filtering; and better support for storing large raw data streams to file instead of in memory.
  • pop-filter reinstated and re-purposed in v3.0.0 — refactored the previously deprecated component to handle filtering of data and values for the multiple components that need it.
  • pop-kettle updated to v1.5.0 — updated to work with the newly refactored components of Pop PHP v4.5, added the db:create-seed command, added better support for Windows, added support for MVC commands, and added support for an include helper file to hook other apps into Kettle.
  • pop-log updated to v3.2.0 — added log limits.
  • pop-mime new release v1.0.0 — a new component to handle generating and parsing MIME content.
  • pop-queue new release v1.0.0 — a new component to manage job queues.
  • pop-utils new release v1.1.0 — a new component providing common utilities, classes and interfaces.
  • pop-view updated to v3.2.0 — added the pop-filter component for filtering functionality.
  • pop-session updated to v3.2.0 — refactored code base with better class structure, and added unit tests.
  • pop-cookie updated to v3.2.0 — added ArrayAccess, Countable and Iterator, and added unit tests.
  • pop-dir updated to v3.1.0 — added support for unlinking and unsetting files from a directory object, where writable and accessible.
  • pop-i18n updated to v3.1.0 — added support for output variations under one source.
  • pop-image updated to v3.4.0 — added support for animated GIFs under the Imagick adapter, and deprecated the Gmagick adapter.
  • popphp updated to v3.6.0 — better support for dynamic array params in the HTTP and CLI route objects, refactored to use the new pop-utils component including its array and callable features, added support for multi-byte routes, and added support for named routes and URL generation.
  • popcorn updated to v3.3.0 — added support for custom HTTP methods, added an any() method, and better exception error messaging.

4.1.0#

Released 17 October 2019.

  • Updated to pop-csv v3.1.4 — better appending, newline, escape and limit support.
  • Updated to pop-db v4.5.5 — support for export and for creating large SQL queries from data sets.
  • Updated to pop-form v3.4.0 — ACL form objects, and a light-weight form validator class for validation of form values without the weight of a full HTML form object.
  • Updated to pop-mail v3.2.2 — better support for file attachments under both the IMAP client and the Mailer classes, support for auto-detection of content type for attachments, and better handling of newlines in message parts.
  • Updated to popphp v3.3.1 — added a force route parameter to the run() method.

4.0.3#

Released 9 April 2019.

  • Updated to pop-csv v3.1.0, which includes static helper methods.

4.0.2#

Released 12 March 2019.

  • Updated to pop-db v4.5.0, which includes support for the encoded record class.

4.0.1#

Released 9 February 2019.

  • Added the pop-kettle component for CLI-based helper functionality.

4.0.0#

Released 5 February 2019.

  • Support for PHP 7.1 and newer only.
  • PHPUnit tests refactored for PHPUnit 7.0 and newer.
  • Refactored pop-auth.
  • Refactored pop-console, adding better support for help command display.
  • Refactored pop-db, improving relationship functionality.
  • Updated pop-debug, improving ExceptionHandler and QueryHandler.
  • Refactored pop-form — added ACL-enabled form capabilities, and moved filter functionality into a separate set of classes.
  • Refactored pop-http, adding a separate HTTP response parser class.
  • Refactored pop-log, adding an HTTP log writer.
  • Refactored pop-nav, adding a NavBuilder class.
  • Refactored pop-pdf, improving text wrap and alignment functionality.
  • Refactored pop-view, adding a separate stream parser class.
  • Refactored popphp, improving the Application and Module class relationships.
  • Removed the bootstrap feature from the main framework repository.

3.8.0#

  • Added pop-audit.
  • Added the ability to track dirty attributes in pop-db.
  • Added bootstrap functionality to provide basic application scaffolding.

3.6.5#

  • Updated pop-pdf.

3.6.4#

  • Updated license and copyright.
  • Updated composer.json.

3.6.3#

  • Updated pop-dom.

3.6.2#

  • Added pop-css.

3.6.1#

  • Reinstated pop-i18n.

3.6.0#

  • Updated pop-db.
  • Updated pop-cache.
  • Added pop-debug.

3.5.2#

  • Updated pop-config, pop-image, pop-pdf, pop-session, popphp and popcorn.

3.5.1#

  • Updated pop-auth, popcorn, pop-http and pop-db.

3.5.0#

New or changed features:

  • The database component was significantly refactored for v4.
  • The data component was deprecated and its CSV functionality moved into its own component, pop-csv.
  • The file component was deprecated: the upload functionality moved to the HTTP component and the directory functionality moved into its own component, pop-dir.

Removed: the pop-archive, pop-crypt, pop-data, pop-feed, pop-file, pop-filter, pop-geo, pop-i18n, pop-payment, pop-shipping, pop-version and pop-web components.

3.0.1#

  • The mail component was updated to version 3.0.0.

3.0#

New features:

  • The cache component now supports Redis and session adapters.
  • The Session and Cookie classes of the deprecated pop-web component were broken out into their own individual components, pop-session and pop-cookie.
  • The pop-version component can now pull its source from the Pop website or from GitHub.

Changed features:

  • The Record sub-component of the database component was refactored. Functionality should remain largely the same, but there may be some backward-compatibility breaks in older code.

Deprecated features:

  • Due to the unavailability or instability of the apc, apcu and apc_bc extensions, the APC adapter in the pop-cache component may not function properly in PHP 7.
  • Due to the unavailability or instability of the memcache and memcached extensions, the Memcache and Memcached adapters in the pop-cache component may not function properly in PHP 7.

Removed features:

  • The pop-web component was removed; its cookie and session sub-components were ported into their own individual components.
  • The pop-filter component was removed.
  • The pop-geo component was removed.
  • The Rar adapter in the pop-archive component was removed.

See also#