It’s going to be a painful process. I’ve been going through it for 6 months as I can. No method has went untouched, so depending on how big your app is, that might put some scale on it for you. Things like authentication and authorization are completely different, setup and configured completely different as well. So for me I found myself trashing everything I had in version 2 and completely redoing it all in version 4. I never could get authorization tools to do what I needed and ended up not using them at all in version 4 and writing my own authorization wrapper in about day after spending 5 days trying to get Cake4’s authorization tools to work. Everything around the ORM will change, but to be honest, for me that’s been less painful than everything else that’s changed.