We are very pleased to announce the release of HTTP client extension version 2.0.7. In this release, Response::detectFormatByContent was fixed to properly detect JSON Array. Additionally, Request::setFullUrl() method was added.
See the CHANGELOG for details.
We are very pleased to announce the release of Debug extension version 2.0.14. In this release, additionally to bugfixes, there's new "Events" panel.
See the CHANGELOG for details.
We are very pleased to announce the release of Auth Client extension version 2.1.7. It fixes OAuth2 client unsetting scope on defaultReturnUrl. Previously it was causing bad request from recent version of Google provider.
See the CHANGELOG for details.
We are very pleased to announce the release of Auth Client extension version 2.1.6. It upgrades VKontakte API used to version 5.0 and fixes a couple of bugs related to OpenID and canceling login in auth form.
See the CHANGELOG for details.
A few month ago we have replaced the old Yii Framework website with a rewritten version in Yii 2. While developing the new site, we also discussed the replacement of the old IPB forum software with a more modern solution, but replacing the forum together with the site would have been too much work to do at once.
From a long discussion, which started already a few years ago, we have now evaluated different forum software and decided to go with Discourse, which is an open source forum software made by the people who created also StackOverflow. We are going to replace the old forum with a Discourse instance starting tomorrow (September 4, 2018).
Here is a list of things that are going to change:
Andrii Vasyliev, @hiqsol joined Yii team. Andrii uses Yii daily for his team projects and is very interested in framework moving forward.
He's from Kiev, Ukraine and is part of HiQDev team same as another long term Yii team member, Dmytro Naumenko (@SilverFire).
His primary focus will be refreshing Yii architecture splitting it into more packages to achieve more frequent independent releases and making Yii core more robust.
We are very pleased to announce that Yii Framework version 1.1.20 is released. You can download it at yiiframework.com/download/.
This release is a release of Yii 1.1 that has reached maintenance mode and will, only receive necessary security fixes and fixes to adjust the code for compatibility with PHP 7 if they do not cause breaking changes. This allows you to keep your servers PHP version up to date in the environments where old Yii 1.1 applications are hosted and stay within the version ranges supported by the PHP team. Yii 1.1.20 is compatible with PHP 7.2 that, at the time of this writing, has an announced security support until November 30, 2020.
We recommend to use Yii 2.0 for new projects as well as introducing Yii 2.0 for developing new features in existing Yii 1.1 apps, as described in the Yii 2 guide. Upgrading a whole app to Yii 2.0 will, in most cases, result in a total rewrite so this option provides a way for upgrading step by step and allows you to keep old applications up to date even with low budget.
Since version 3.0.0 Yii adopts SemVer versioning to achieve better predictability and compatibility with Composer.
Same will happen with extensions. They will adopt SemVer starting from next major versions.
SemVer is simple. Given a version number MAJOR.MINOR.PATCH, increment the:
Yii 2.0.x versioning stays as is.
We are very pleased to announce the release of Queue extension version 2.1.0.
Additionally to fixing bugs, the version brings two major enhancements on board. First, there is now Amazon SQS queue support.
Second, cli\Queue:EVENT_WORKER_LOOP worker loop event was added. It is called on each iteration between requests to queue.
Other than that, there are slightly updated documentation and new Japanese translation.
Full changelog is available at GitHub.
We are very pleased to announce the release of Gii extension version 2.0.7. The release corrects Gii behavior adapting it to changes introduced in version 2.0.15 of the framework. Additionally there are fixes in model and CRUD generators.
We are very pleased to announce the release of Swiftmailer extension version 2.1.1 that fixes yii\swiftmailer\Mailer::setTransport had no effect after sending of first message.
We are very pleased to announce the release of Smarty extension version 2.0.7 that fixes widget registration and rendering code generation inside subtemplates and adds an ability to use SmartyBC class.
We are very pleased to announce the release of MongoDB extension version 2.1.7 that fixes Yii 2.0.14+ incompatibility and enhances Session component error reporting.
We are very pleased to announce the release of Shell extension version 2.0.1 which updates psy/psysh dependency to
0.8.x versions.
We are very happy to announce that the new yiiframework.com website is finally ready for deployment.
A huge thanks to Сергей Хильков (eshill) for his design work, to Jacob Moen and Nikola Trifunović for the countless hours spent on tweaking the frontend code and doing pages markup. Thanks to prodex, Robert Korulczyk and other contributors for fixes and additions.
There is a forum topic for discussion on this announcement.
Today we are releasing several versions for Yii 2.0.x and official extensions to fix a security issue.
The problem addressed in these patches exists in ActiveRecord shortcut methods findOne() and findAll(), which may
allow SQL injection if input is not prepared properly. We consider this as a security issue in Yii because the documentation for these methods did not contain an explicit warning that there are cases when passing unfiltered user input might be dangerous. Thanks to analitic1983 for making us aware of the issue.
The nature of this issue does not solely exists in the Yii Framework but depends on how an application uses Yii.
We have changed Yii to be more robust against the worst impact of the problem (SQL injection), but applications may still be vulnerable
and changes to application code are necessary in some cases. As a safety measure, findOne() and findAll() are now limited to filter on
columns that are AR properties only. In the following we will explain the problem in more detail
and show which application code is affected and what needs to be adjusted on upgrade.
We are very pleased to announce the release of Imagine extension version 2.1.1 which both fixes bugs and makes small enhancements.
This release updates 'Imagine' dependency to include versions 0.7.x.
See CHANGELOG for details.
We are very pleased to announce the release of Faker extension version 2.0.4 which both fixes bugs and makes small enhancements.
See CHANGELOG for details.
We are very pleased to announce the release of Yii Framework version 2.0.14. Please refer to the instructions at http://www.yiiframework.com/download/ to install or upgrade to this version.
Version 2.0.14 is a minor release of Yii 2.0 which contains more than a hundred enhancements and bug fixes including security fixes. It is also the last version of Yii 2.0 that contains enhancements. This means that we will focus on including new features into the 2.1.x branch and 2.0.x will only receive bug fixes from now on. We will make an announcement on the time frames for supporting different branches with the release of version 2.1.
There are minor changes that may affect your existing applications, so make sure to check the UPGRADE.md file.
We are very pleased to announce the release of Bootstrap extension version 2.0.8 which both fixes bugs and makes small enhancements.
See CHANGELOG for details.
