Yii2 extensions with pending releases were tagged:

• Composer 2.0.11
• Redis 2.0.19
• Shell 2.0.6
• apidoc 3.0.7

We are pleased to announce the release of ElasticSearch extension version 2.1.4. This release fixes PHP 8 compatibiltiy issues and adds curlOptions attribute for advanced configuration of curl session.

See the CHANGELOG for details.

We are very pleased to announce the release of ElasticSearch extension version 2.1.3. This release:

• Adds support for runtime mappings in Elasticsearch 7.11+.
• Updates API calls for compatibility with Elastcisearch 8+.
• Adds "match" and "match_phrase" queries to query builder.

See the CHANGELOG for details.

We are very pleased to announce the release of ElasticSearch extension version 2.1.2. This release is using proper CSRNG when choosing connection.

See the CHANGELOG for details.

We are very pleased to announce the release of ElasticSearch extension version 2.1.1. This is bugfix release solving a performance issue and an issue with counting collections with more than 10K elements.

See the CHANGELOG for details.

We are very pleased to announce the release of ElasticSearch extension version 2.1.0.

This is the first stable release with support for ElasticSearch from version 5 to current version 7.

We have switched to GitHub actions for testing it. Extension is tested on PHP 5.6 - PHP 7.4 and ElasticSearch 5.6.16, 6.8.9, and 7.7.0.

We are very pleased to announce the release of ElastiSearch extension version 2.0.7. This release fixes a couple of bugs and adds PHP forward compatibility to the legacy 2.0.x branch that is compatible with ElasticSeach from 1.6.0 to 1.7.6.

See the CHANGELOG for details.

We are very pleased to announce the release of ElastiSearch extension version 2.0.6. This release fixes a couple of bugs and adds forward compatibility to the legacy 2.0.x branch that is compatible with ElasticSeach from 1.6.0 to 1.7.6.

See the CHANGELOG for details.

Today we are releasing several versions for Yii 2.0.x and official extensions to fix a security issue.

The problem addressed in these patches exists in ActiveRecord shortcut methods findOne() and findAll(), which may allow SQL injection if input is not prepared properly. We consider this as a security issue in Yii because the documentation for these methods did not contain an explicit warning that there are cases when passing unfiltered user input might be dangerous. Thanks to analitic1983 for making us aware of the issue.

The nature of this issue does not solely exists in the Yii Framework but depends on how an application uses Yii. We have changed Yii to be more robust against the worst impact of the problem (SQL injection), but applications may still be vulnerable and changes to application code are necessary in some cases. As a safety measure, findOne() and findAll() are now limited to filter on columns that are AR properties only. In the following we will explain the problem in more detail and show which application code is affected and what needs to be adjusted on upgrade.