Yii 2.0.16

The PHP framework team Yii has released version 2.0.16, containing more than a hundred fixes and some improvements . Fixed several security issues.

The branch Yii 2.0 reached a freeze more than a year ago , which means that it mainly accepts corrections. This was done to allow the Yii team to focus on Yii 3. At the very end of this post there is a little more information about Yii 3.

This release includes several changes that may affect existing applications. Be sure to read UPGRADE.md .

Many thanks to the members of the Yii community who are participating in the development. Without you, such a large-scale project would be impossible. Special thanks to translators who keep the documentation up to date.

Below are the most interesting improvements that still managed to leak into the release. The full list, as usual, can be found in CHANGELOG .

Active record

Salem Ouerdani, @tunecino added behavior for optimistic locking.

Optimistic locking allows multiple users to simultaneously edit a record and avoid potential server side conflicts. In the case when a user tries to save edits based on obsolete data (because another user has already been saved), a StaleObjectException , and no update or deletion is made.

The mechanism of such a lock was implemented in the first versions of Yii, but it was not so easy to use it correctly. Now just.

Documentation can be found in the official manual.
and the OptimisticLockBehavior API .

Migrations

The console migration generator now uses table prefixes by default. If you want to change this, you can set yii\console\controllers\MigrateController::useTablePrefix to false in the config of console commands.

Database

• The MySQL driver now supports fractional second accuracy for temporary types (MySQL is required> = 5.6.4).
• The Oracle driver now supports sequence dumping.

Helpers

• yii\helpers\Inflector learned to work correctly with UTF-8.
• Added flag yii\mutex\FileMutex::$isWindows for Windows Ball on Unix guest machines.
• The yii\helpers\UnsetArrayValue , yii\helpers\ReplaceArrayValue can now be restored after serialization with var_export() .

Gridview

The $filterOnFocusOut option is $filterOnFocusOut , which determines whether filtering should be performed when the focus is lost.

jQuery

Now you can install jQuery 3.3.

Mutex

• The frequency of attempts to acquire a yii\mutex\FileMutex::acquireLock() increased if $timeout provided.
• Added support for $timeout in yii\mutex\PgsqlMutex::acquire() .

Security patches

Two security issues have been fixed:

• CVE-2018-14578: bypassing the CSRF token check in \yii\web\Request::getMethod()
• CVE-2018-19454: unnecessary logging of confidential information in \yii\log\Target

Application Templates

• Codeception configs have been cleaned in both the basic and advanced templates.
• A simple Docker config has been added to the Advanced template.
• The Advanced template now requires a newer version of Codeception, which only works since PHP 7.0. Older applications will work as before.

Little about Yii 3.0

The next major version of Yii will be 3.0. A detailed announcement will be later, but for now briefly:

Updated architecture : the framework is divided into separate packages .
This will allow you to collect from them what you need.

JavaScript-independent : along with the reorganization of the source code, Yii is decoupled from the JavaScript framework in the kernel.
Yii key packages do not require jQuery.

Compatible with PSR : Yii 3 will follow the recommendations of PHP-FIG. Many PSRs have already been implemented: logging, cache, DI, and others.

Yii 3.0 is under active development. A detailed announcement will be made to achieve the alpha version.