applied fixes in upstream: Fixing deprecation in PHP 8.5

[77web]

ported kamilwylegala#86

PDO::MYSQL_ATTR_* constants are deprecated in PHP 8.5 in favor of the Pdo\Mysql class (available since PHP 8.4). Use the new constants when available, falling back to the deprecated ones on older PHP.

The other two commits in PR kamilwylegala#86 were intentionally not applied:

• "Removed ancient code sniffer." drops cakephp/cakephp-codesniffer from composer.json, but this fork deliberately keeps it with documented advisory exceptions (CVE-2026-67434, PKSA-6vdd-n4sx-knhy).
• "Skip DNS resolution failure." patches a DNS-dependent HttpSocketTest that this fork already replaced with a local TLS fixture server (c9c3b9a, 8ebbcbd), so the fix no longer applies.

[basi]

Thanks for porting upstream kamilwylegala#86. As a straight port this looks good: no regression on PHP 8.0–8.4, and CI is green on 8.0/8.4.

The PHP 8.5 fix is incomplete, though, and the PHP version in the comment is wrong (both carried over from upstream). I'd recommend keeping this PR a 1:1 port of upstream kamilwylegala#86 and handling the following in a separate follow-up PR. That keeps the upstream sync traceable and makes the fork-specific divergence explicit.

Follow-up PR (suggested scope)

• Must: migrate the SSL constants (MYSQL_ATTR_SSL_KEY / SSL_CERT / SSL_CA, L185-189). PHP 8.5 deprecates them too (see inline).
• Must: fix the code comment. Pdo\Mysql is available since PHP 8.4, not 8.1 (see inline).
• Should: use PHP_VERSION_ID >= 80400 instead of class_exists('Pdo\Mysql') (see inline).
• Should: add a README Changelog entry covering this port and the follow-up, as was done for the previous upstream port (kamilwylegala#83), e.g.:
  - Fix PHP 8.5 deprecation: the MySQL datasource uses Pdo\Mysql::ATTR_* constants on PHP >= 8.4 (ported from kamilwylegala/cakephp2-php8#86). Apps passing PDO::MYSQL_ATTR_* in the datasource 'flags' option should migrate as well.
• Upstream master has the same gap, so the follow-up could be sent upstream too.

This PR

• Please correct "available since PHP 8.1" to 8.4 in the PR description.

Notes (non-blocking)

• CI only runs PHP 8.0/8.4, so the 8.5 deprecation itself is not verified. The CI DB config also sets neither encoding nor ssl_*, so the INIT_COMMAND and SSL paths never run. An 8.5 CI job would be best as its own PR.
• The commit subject is 113 characters and gets truncated on GitHub. Recent commits use Conventional Commits, e.g. fix: use Pdo\Mysql attribute constants to avoid PHP 8.5 deprecations.
• Leaving out the other two upstream commits looks right: the phpcs advisory exceptions are documented in composer.json, and testVerifyPeer already uses a local TLS fixture.

[basi]

(For the follow-up PR.) Pdo\Mysql was added in PHP 8.4.0, not 8.1 (https://www.php.net/manual/en/class.pdo-mysql.php).
PHP_VERSION_ID >= 80400 would also be preferable to class_exists('Pdo\Mysql'). On PHP < 8.4, class_exists() runs the autoloader chain on every connect(), and a userland Pdo\Mysql class would be misdetected. CakePHP 4.x/5.x use the same version check. A possible shape, which also defines the SSL variables used at L185-189:

		// PDO::MYSQL_ATTR_* constants are deprecated as of PHP 8.5 in favor of Pdo\Mysql::ATTR_* (available since PHP 8.4)
		if (PHP_VERSION_ID >= 80400) {
			$mysqlAttrUseBufferedQuery = Pdo\Mysql::ATTR_USE_BUFFERED_QUERY;
			$mysqlAttrInitCommand = Pdo\Mysql::ATTR_INIT_COMMAND;
			$mysqlAttrSslKey = Pdo\Mysql::ATTR_SSL_KEY;
			$mysqlAttrSslCert = Pdo\Mysql::ATTR_SSL_CERT;
			$mysqlAttrSslCa = Pdo\Mysql::ATTR_SSL_CA;
		} else {
			$mysqlAttrUseBufferedQuery = PDO::MYSQL_ATTR_USE_BUFFERED_QUERY;
			$mysqlAttrInitCommand = PDO::MYSQL_ATTR_INIT_COMMAND;
			$mysqlAttrSslKey = PDO::MYSQL_ATTR_SSL_KEY;
			$mysqlAttrSslCert = PDO::MYSQL_ATTR_SSL_CERT;
			$mysqlAttrSslCa = PDO::MYSQL_ATTR_SSL_CA;
		}

[basi]

(For the follow-up PR.) PDO::MYSQL_ATTR_SSL_KEY / SSL_CERT (here) and SSL_CA (L189) are deprecated in PHP 8.5 as well (php-src UPGRADING for 8.5: "Driver specific constants in the PDO class have been deprecated"). SSL-enabled connections (e.g. ssl_ca for RDS/Cloud SQL) will therefore still emit E_DEPRECATED on every connect. With the variables above:

		if (!empty($config['ssl_key']) && !empty($config['ssl_cert'])) {
			$flags[$mysqlAttrSslKey] = $config['ssl_key'];
			$flags[$mysqlAttrSslCert] = $config['ssl_cert'];
		}
		if (!empty($config['ssl_ca'])) {
			$flags[$mysqlAttrSslCa] = $config['ssl_ca'];
		}

CakePHP 4.x/5.x switch these three as well.

[77web]

@basi Thank you for the review. I updated the PHP version in this PR desc.

[basi]

Thanks for updating the description. Approving this as a 1:1 port of kamilwylegala#86.

As a follow-up, could you also add PHP 8.5 to the CI matrix in .github/workflows/tests.yml? CI currently runs only 8.0 and 8.4, so the 8.5 deprecation fixes (this PR and the SSL-constant follow-up) aren't verified. Adding an entry next to the 8.4 one under include: should be enough:

          - php-version: '8.5'
            db-type: mysql

Please also update the README line "Github actions are running tests on PHP 8.0, 8.4." to match. A separate PR is fine, especially if 8.5 surfaces unrelated failures.