PHP just released versions fixing critical security vulnerabilties.

1. If you can upgrade fast, do it.
2. If you can't but can firewall your project from Internet access, do it.
3. If you can't, at least apply the following to php.ini to be safer (not fully safe still so aim for upgrade anyway):

memory_limit=-1
post_max_size = 8M ; or more if uploads are needed but upload_max_filesize < post_max_size
session.upload_progress.enabled=0
fatal_error_backtraces=0 ; for PHP 8.5+

Yii DB version 2.1.0 was released. In this version:

• Add UuidValue expression that represents a UUID value independently of DBMS
• Support UnitEnum enums as column values
• Add Identifier expression for strict identifier quoting
• Add IdentifierQuoterInterface and implement it in Quoter

Yii DB Migration version 2.2.0 was released. In this version:

• Add support for additional named databases with separate migration history and --db option to select database
• Add migrate:mark to move migration history to a version without executing migrations
• Add configurable transaction mode and --transactional / --no-transactional options for migration generation
• Show friendly error on run ./vendor/bin/yii-db-migration without configuration file

We are pleased to announce version 2.2.19 of the Auth Client extension.

• Added OpenID Connect RP-Initiated Logout URL generation.
• Fixed OAuth2 refresh token preservation.
• Fixed the PKCE token request origin header for compatibility with providers such as Keycloak.
• Removed xoauth_displayname from default OAuth2 authorization URLs.

We are very pleased to announce the release of Auth Client extension version 2.2.18.

• Update for VK client to use new domain.
• Minimal PHP version raised to 7.4.
• Compatibility with PHP up to 8.5.
• Bugfixes.

See the CHANGELOG for details.

Yii DataView version 1.3.0 was released. In this version:

• Add GridView::keepColumnAttributesInEmptyCell() to keep column body cell attributes on empty cells
• Add GridView::filterRowAttributes(), and filterAttributes and filterClass parameters to DataColumn to set HTML attributes and a CSS class for filter cells
• Add GridView methods sortableHeaderClass(), sortableHeaderAscClass(), sortableHeaderDescClass(), sortableLinkAscClass() and sortableLinkDescClass() to configure CSS classes for sortable column headers and links
• Add GridView::captionAttributes() method and $attributes parameter to GridView::caption() to set HTML attributes for the caption tag

Yii DataView version 1.2.0 was released. In this version:

• Add prepareDataReader() to reuse filtered data reader
• Add UseInlineJsInterface::useInlineJs() to DropdownFilter, SelectPageSize and InputPageSize, and BaseListView::useInlineJs() to override it for every rendered widget, so their onChange/onchange handler can be replaced with the shipped no-inline-js.js script
• Pass DataContext to callable buttons in ActionColumn

We are very pleased to announce the release of the ApiDoc extension version 4.0.1.

This release enhances the generation:

• Recoverable HTML parsing errors in API link titles are now suppressed.
• Removed the bold formatting from the method names for better readability.
• Added <wbr> to namespaces so line breaks are made on \ if possible.

See the CHANGELOG for a full list of changes.

Yii HTTP Middleware version 1.3.0 was released.

In this version:

• Add ETag value normalization in HttpCacheMiddleware via ETagValueNormalizerInterface with NoopETagValueNormalizer and SuffixETagValueNormalizer implementations
• Add $keepHeadersOnStatusCode and $removedHeaders constructor parameters to RemoveBodyMiddleware
• Add $removeOnStatusCode constructor parameter to ContentLengthMiddleware
• Remove Content-Length and Transfer-Encoding headers in RemoveBodyMiddleware when the body is removed

Yii Sentry version 3.0.0 was released. In this version:

• Chg #40, 41, #43: Change PHP version constraint to 8.1 - 8.5
• Bump sentry/sentry version to ^4.0
• Add support for Sentry cron monitoring via check-ins
• Add support for symfony/console version ^7.0

The Yii website has a fresh new look!

We’ve redesigned it for clearer navigation, better readability, improved mobile support, and consistent dark mode—all while keeping the familiar Yii spirit.

Take a look and let us know what you think!

Yii auth version 3.3.0 was released. In this version:

• Split AuthenticationMethodInterface into focused authentication and challenge interfaces
• Bump minimal PHP version to 8.1
• Explicitly mark readonly properties
• Explicitly import classes and functions in "use" section

Yii DB Migration version 2.1.0 was released. In this version:

• Add MigrationBuilder::insertBatch() method, deprecate batchInsert()
• Explicitly import classes, functions, and constants in "use" section
• Remove unnecessary files from Composer package
• Remove confirmation prompt from migrate:create command as creating a migration is non-destructive

Yii Bulma version 1.1.0 was released. In this version:

• Bump yiisoft/html version to ^4.2.0
• Adapt configuration to changes in yiisoft/form
• Change PHP constraint in composer.json to 8.1 - 8.5
• Adopt last change yiisoft/widget

Yii Bootstrap 5 version 1.2.0 was released.

In this version:

• Add tabIndex() method to Button widget
• Raise yiisoft/html version to ^3.13 || ^4.0
• Fix Collapse re-encoding content already managed by Toggler

We’ve added a new Yii3 demo application:

https://github.com/yiisoft/demo-summarizer

It started as a practical way to test yiisoft/queue together with AMQP and Redis/Valkey drivers in Yii3 application, but it turned into a useful demo on its own.

Yii HTML version 4.2.0 was released. In this version:

• Add beforeInput() and afterInput() methods to abstract BooleanInputTag, extended by Radio and Checkbox
• Add beforeCheckbox() and afterCheckbox() methods to CheckboxList, and beforeRadio() and afterRadio() methods to RadioList

Yii Runner RoadRunner version 3.2.0 was released. In this version:

• Add PHP 8.5 support
• Add spiral/roadrunner-http version ^v4.0.0 support

Yii Validator version 2.6.0 was released.

This release adds a new File validator, extends Image validator input support, and includes translation, documentation, and internal code quality improvements.

File validator ¶

We are very pleased to announce the release of the ApiDoc extension version 4.0.0.

This is a major release that modernizes ApiDoc for current PHP projects. The minimum PHP version is now 8.2, and dependency requirements were raised for nikic/php-parser, phpdocumentor/reflection, and phpdocumentor/type-resolver.

Version 4.0.0 adds support for intersection and nullable types, PHPStan/Psalm syntax, constants in interfaces and traits, inherited descriptions, improved method signatures, better inline @see and @link handling, and links to built-in PHP functions. It also includes a new template for custom projects.