We are very pleased to announce the release of Shell extension version 2.0.1 which updates psy/psysh dependency to 0.8.x versions.

We are very happy to announce that the new yiiframework.com website is finally ready for deployment.

A huge thanks to Сергей Хильков (eshill) for his design work, to Jacob Moen and Nikola Trifunović for the countless hours spent on tweaking the frontend code and doing pages markup. Thanks to prodex, Robert Korulczyk and other contributors for fixes and additions.

There is a forum topic for discussion on this announcement.

Today we are releasing several versions for Yii 2.0.x and official extensions to fix a security issue.

The problem addressed in these patches exists in ActiveRecord shortcut methods findOne() and findAll(), which may allow SQL injection if input is not prepared properly. We consider this as a security issue in Yii because the documentation for these methods did not contain an explicit warning that there are cases when passing unfiltered user input might be dangerous. Thanks to analitic1983 for making us aware of the issue.

The nature of this issue does not solely exists in the Yii Framework but depends on how an application uses Yii. We have changed Yii to be more robust against the worst impact of the problem (SQL injection), but applications may still be vulnerable and changes to application code are necessary in some cases. As a safety measure, findOne() and findAll() are now limited to filter on columns that are AR properties only. In the following we will explain the problem in more detail and show which application code is affected and what needs to be adjusted on upgrade.

We are very pleased to announce the release of Imagine extension version 2.1.1 which both fixes bugs and makes small enhancements.

This release updates 'Imagine' dependency to include versions 0.7.x.

See CHANGELOG for details.

We are very pleased to announce the release of Faker extension version 2.0.4 which both fixes bugs and makes small enhancements.

See CHANGELOG for details.

We are very pleased to announce the release of Yii Framework version 2.0.14. Please refer to the instructions at http://www.yiiframework.com/download/ to install or upgrade to this version.

Version 2.0.14 is a minor release of Yii 2.0 which contains more than a hundred enhancements and bug fixes including security fixes. It is also the last version of Yii 2.0 that contains enhancements. This means that we will focus on including new features into the 2.1.x branch and 2.0.x will only receive bug fixes from now on. We will make an announcement on the time frames for supporting different branches with the release of version 2.1.

There are minor changes that may affect your existing applications, so make sure to check the UPGRADE.md file.

We are very pleased to announce the release of Bootstrap extension version 2.0.8 which both fixes bugs and makes small enhancements.

See CHANGELOG for details.

We are very pleased to announce the release of MongoDB extension version 2.1.6 which brings two bug fixes:

• Fixed yii\mongodb\Command::aggregate() without 'cursor' option produces error on MongoDB Server 3.6
• Fixed yii\mongodb\Collection::dropIndex() unable to drop index specified with sort via index plugin

See CHANGELOG for details.

We are very pleased to announce the release of Sphinx extension version 2.0.10 which brings 4 enhancements and bug fixes:

• Fixed yii\sphinx\Schema::findColumns() unable to merge field and attribute columns with same name
• Fixed yii\sphinx\QueryBuilder::buildInCondition() incompatibility with PHP 7.2
• yii\sphinx\QueryBuilder::callSnippets() now automatically casts snippet source to string
• yii\sphinx\QueryBuilder now supports Traversable objects for use in in conditions

See CHANGELOG for details.

We are very pleased to announce the release of HTTP client extension version 2.0.6 which brings an enhancement and a bug fix:

• Fixed Message::getHeaders() unable to parse HTTP status code in case reason phrase contains : character
• Request::createFullUrl() now prevents appearance of multiple slashes while combining Client::$baseUrl and Request::$url

See CHANGELOG for details.

We are very pleased to announce the release of Auth Client extension version 2.1.5 which brings 3 enhancements and bug fixes:

• Updated endpoint URLs for LinkedIn.
• AuthAction refactored to use yii\web\Application::$request for request data access.
• Added yii\authclient\AuthAction::$cancelCallback allowing custom handling for authentication cancellation.

See the CHANGELOG for details.

Jeff Reifman started Yii meetup in Portland, Oregon.

First one will take place Tuesday, January 16, 2018 6:30 PM to 8:30 PM at Palio 1996 SE Ladd Av.

If you're nearby, join it. Here's meetup page at meetup.com.