We are very pleased to announce the release of Smarty extension version 2.0.7 that fixes widget registration and rendering code generation inside subtemplates and adds an ability to use SmartyBC class.

We are very pleased to announce the release of MongoDB extension version 2.1.7 that fixes Yii 2.0.14+ incompatibility and enhances Session component error reporting.

We are very pleased to announce the release of Shell extension version 2.0.1 which updates psy/psysh dependency to 0.8.x versions.

We are very happy to announce that the new yiiframework.com website is finally ready for deployment.

A huge thanks to Сергей Хильков (eshill) for his design work, to Jacob Moen and Nikola Trifunović for the countless hours spent on tweaking the frontend code and doing pages markup. Thanks to prodex, Robert Korulczyk and other contributors for fixes and additions.

There is a forum topic for discussion on this announcement.

Today we are releasing several versions for Yii 2.0.x and official extensions to fix a security issue.

The problem addressed in these patches exists in ActiveRecord shortcut methods findOne() and findAll(), which may allow SQL injection if input is not prepared properly. We consider this as a security issue in Yii because the documentation for these methods did not contain an explicit warning that there are cases when passing unfiltered user input might be dangerous. Thanks to analitic1983 for making us aware of the issue.

The nature of this issue does not solely exists in the Yii Framework but depends on how an application uses Yii. We have changed Yii to be more robust against the worst impact of the problem (SQL injection), but applications may still be vulnerable and changes to application code are necessary in some cases. As a safety measure, findOne() and findAll() are now limited to filter on columns that are AR properties only. In the following we will explain the problem in more detail and show which application code is affected and what needs to be adjusted on upgrade.

We are very pleased to announce the release of Imagine extension version 2.1.1 which both fixes bugs and makes small enhancements.

This release updates 'Imagine' dependency to include versions 0.7.x.

See CHANGELOG for details.

We are very pleased to announce the release of Faker extension version 2.0.4 which both fixes bugs and makes small enhancements.

See CHANGELOG for details.

We are very pleased to announce the release of Yii Framework version 2.0.14. Please refer to the instructions at http://www.yiiframework.com/download/ to install or upgrade to this version.

Version 2.0.14 is a minor release of Yii 2.0 which contains more than a hundred enhancements and bug fixes including security fixes. It is also the last version of Yii 2.0 that contains enhancements. This means that we will focus on including new features into the 2.1.x branch and 2.0.x will only receive bug fixes from now on. We will make an announcement on the time frames for supporting different branches with the release of version 2.1.

There are minor changes that may affect your existing applications, so make sure to check the UPGRADE.md file.

We are very pleased to announce the release of Bootstrap extension version 2.0.8 which both fixes bugs and makes small enhancements.

See CHANGELOG for details.

We are very pleased to announce the release of MongoDB extension version 2.1.6 which brings two bug fixes:

• Fixed yii\mongodb\Command::aggregate() without 'cursor' option produces error on MongoDB Server 3.6
• Fixed yii\mongodb\Collection::dropIndex() unable to drop index specified with sort via index plugin

See CHANGELOG for details.

We are very pleased to announce the release of Sphinx extension version 2.0.10 which brings 4 enhancements and bug fixes:

• Fixed yii\sphinx\Schema::findColumns() unable to merge field and attribute columns with same name
• Fixed yii\sphinx\QueryBuilder::buildInCondition() incompatibility with PHP 7.2
• yii\sphinx\QueryBuilder::callSnippets() now automatically casts snippet source to string
• yii\sphinx\QueryBuilder now supports Traversable objects for use in in conditions

See CHANGELOG for details.

We are very pleased to announce the release of HTTP client extension version 2.0.6 which brings an enhancement and a bug fix:

• Fixed Message::getHeaders() unable to parse HTTP status code in case reason phrase contains : character
• Request::createFullUrl() now prevents appearance of multiple slashes while combining Client::$baseUrl and Request::$url

See CHANGELOG for details.

We are very pleased to announce the release of Auth Client extension version 2.1.5 which brings 3 enhancements and bug fixes:

• Updated endpoint URLs for LinkedIn.
• AuthAction refactored to use yii\web\Application::$request for request data access.
• Added yii\authclient\AuthAction::$cancelCallback allowing custom handling for authentication cancellation.

See the CHANGELOG for details.

Jeff Reifman started Yii meetup in Portland, Oregon.

First one will take place Tuesday, January 16, 2018 6:30 PM to 8:30 PM at Palio 1996 SE Ladd Av.

If you're nearby, join it. Here's meetup page at meetup.com.

We have released version 2.0.2 of the Queue extension. This version is fixing bugs as well as adding some enhancements.

New AMQP Interop driver added. It allows you to seamlessly use many drivers queue interop project supports.

There are new events: cli\Queue::EVENT_WORKER_START and cli\Queue::EVENT_WORKER_STOP. These allow you to add handlers to worker start and stop.

We are very pleased to announce the release of Gii extension version 2.0.6. In this release there are many bug fixes and, of course, some enhancements:

Overall ¶

• PHP 7.1 compatibility.
• Aliases could now be used in generator's templates.
• Added filename filter to generated files list preview.
• Added meta tag to prevent indexing of debug by search engines in case it's exposed.

We have good news for you. We are going to work more on Yii 2.1. Yii 2.0.14 release, that should happen in first months of 2018, will be last release that adds features and enhancements to 2.0 branch.

After 2.0.14 release:

1. We are not accepting any features or enhancements in 2.0 branch.
2. We are merging 2.0 into 2.1 once and not merging it again.
3. Bug-fixes are accepted.

We are very pleased to announce the release of the redis extension version 2.0.7.

This release makes the extension compatible with PHP 7.2 by refering to BaseObject instead of the Object class in Yii.

It also adds simple ORDER BY support to the ActiveQuery so DataProvider functionaility is now fully supported.

We are very pleased to announce the release of Debug Toolbar extension version 2.0.13. In this release:

• PHP 7.2 compatibility.
• Bugfixes.
• HTTP headers are now sent regardless if page is served via AJAX so panel could be referenced from single page apps.
• DB panel got duplicated queries counts.

We've released version 2.0.7 of the jQueryUI extension. This version is fixing bugs and updates jQueryUI dependency so it works with latest Yii release.