Merge branch 'master' into 20087-add-csp-nonce-attribute-to-script-tags

.github/workflows/build.yml

@@ -65,8 +65,13 @@ jobs:
         uses: niden/actions-memcached@v7
 
       - name: Install dependencies.
+        if: matrix.php != '8.4'
         run: composer update $DEFAULT_COMPOSER_FLAGS
 
+      - name: Install dependencies with PHP 8.4.
+        if: matrix.php == '8.4'
+        run: composer update $DEFAULT_COMPOSER_FLAGS --ignore-platform-reqs
+
       - name: Run tests with PHPUnit and generate coverage.
         if: matrix.php == '7.4'
         run: vendor/bin/phpunit --verbose --exclude-group $PHPUNIT_EXCLUDE_GROUP --coverage-clover=coverage.xml --colors=always

.github/workflows/ci-mssql.yml

@@ -66,8 +66,13 @@ jobs:
         run: composer self-update
 
       - name: Install dependencies with composer
+        if: matrix.php != '8.4'
         run: composer update --prefer-dist --no-interaction --no-progress --optimize-autoloader --ansi
 
+      - name: Install dependencies with PHP 8.4.
+        if: matrix.php == '8.4'
+        run: composer update --prefer-dist --no-interaction --no-progress --optimize-autoloader --ignore-platform-reqs --ansi
+
       - name: Run MSSQL tests with PHPUnit and generate coverage.
         run: vendor/bin/phpunit --group mssql --coverage-clover=coverage.xml --colors=always
 

.github/workflows/ci-mysql.yml

@@ -47,9 +47,14 @@ jobs:
           php-version: ${{ matrix.php }}
           tools: composer:v2, pecl
 
-      - name: Install dependencies with composer.
+      - name: Install dependencies with composer
+        if: matrix.php != '8.4'
         run: composer update --prefer-dist --no-interaction --no-progress --optimize-autoloader --ansi
 
+      - name: Install dependencies with PHP 8.4.
+        if: matrix.php == '8.4'
+        run: composer update --prefer-dist --no-interaction --no-progress --optimize-autoloader --ignore-platform-reqs --ansi
+
       - name: Run MySQL tests with PHPUnit and generate coverage.
         run: vendor/bin/phpunit --group mysql --coverage-clover=coverage.xml --colors=always
 

.github/workflows/ci-pgsql.yml

@@ -51,9 +51,14 @@ jobs:
       - name: Update composer.
         run: composer self-update
 
-      - name: Install dependencies with composer.
+      - name: Install dependencies with composer
+        if: matrix.php != '8.4'
         run: composer update --prefer-dist --no-interaction --no-progress --optimize-autoloader --ansi
 
+      - name: Install dependencies with PHP 8.4.
+        if: matrix.php == '8.4'
+        run: composer update --prefer-dist --no-interaction --no-progress --optimize-autoloader --ignore-platform-reqs --ansi
+
       - name: Run Pgsql tests with PHPUnit and generate coverage.
         run: vendor/bin/phpunit --group pgsql --coverage-clover=coverage.xml --colors=always
 

.github/workflows/ci-sqlite.yml

@@ -40,9 +40,14 @@ jobs:
       - name: Update composer.
         run: composer self-update
 
-      - name: Install dependencies with composer.
+      - name: Install dependencies with composer
+        if: matrix.php != '8.4'
         run: composer update --prefer-dist --no-interaction --no-progress --optimize-autoloader --ansi
 
+      - name: Install dependencies with PHP 8.4.
+        if: matrix.php == '8.4'
+        run: composer update --prefer-dist --no-interaction --no-progress --optimize-autoloader --ignore-platform-reqs --ansi
+
       - name: Run SQLite tests with PHPUnit and generate coverage.
         run: vendor/bin/phpunit --group sqlite --coverage-clover=coverage.xml --colors=always
 

README.md

@@ -34,6 +34,20 @@ and a [Definitive Guide Mirror](http://stuff.cebe.cc/yii2docs/) which is updated
 - For Yii 1.1 users, there is [Upgrading from Yii 1.1](https://www.yiiframework.com/doc/guide/2.0/en/intro-upgrade-from-v1)
 to get an idea of what has changed in 2.0.
 
+Versions & PHP compatibility
+----------------------------
+
+| Yii2 Version | PHP version    | Development status                | EOL ¹                                                          |
+|--------------|----------------|-----------------------------------|----------------------------------------------------------------|
+| <= 2.0.49.*  | >= 5.4, <= 8.3 | security fixes only               | 23 Nov 2026 ³                                                  |
+| >= 2.0.50    | >= 7.3, <= 8.4 | bug fixes and security fixes only | bugfixes till 23 Nov 2026 ³, security fixes till 21 Nov 2027 ⁴ |
+| >= 2.2.0 ²   | >= 8.1         | active development                |                                                                |
+
+¹ All mentioned dates may be subject to change and no rights can be derived from them.  
+² Note: Yii 2.1 was [skipped](https://github.com/yiisoft/yii2/discussions/19831#discussioncomment-5858046), [Yii 2.2](https://github.com/yiisoft/yii2/tree/2.2) has not yet been released.  
+³ [PHP 8.3 EOL date](https://www.php.net/supported-versions.php).  
+⁴ [Expected PHP 8.4 EOL date](https://wiki.php.net/todo/php84).  
+
 Community
 ---------
 

composer.json

@@ -73,7 +73,7 @@
         "ext-ctype": "*",
         "lib-pcre": "*",
         "yiisoft/yii2-composer": "~2.0.4",
-        "ezyang/htmlpurifier": "^4.6",
+        "ezyang/htmlpurifier": "^4.17",
         "cebe/markdown": "~1.0.0 | ~1.1.0 | ~1.2.0",
         "bower-asset/jquery": "3.7.*@stable | 3.6.*@stable | 3.5.*@stable | 3.4.*@stable | 3.3.*@stable | 3.2.*@stable | 3.1.*@stable | 2.2.*@stable | 2.1.*@stable | 1.11.*@stable | 1.12.*@stable",
         "bower-asset/inputmask": "^5.0.8 ",

docs/internals/git-workflow.md

@@ -111,7 +111,7 @@ review your suggestion, and provide appropriate feedback along the way.
 ### 2. Pull the latest code from the main Yii branch
 
 ```
-git pull upstream
+git pull upstream master
 ```
 
 You should start at this point for every new contribution to make sure you are working on the latest code.

framework/CHANGELOG.md

@@ -20,10 +20,11 @@ Yii Framework 2 Change Log
 - Enh #20042: Add empty array check to `ActiveQueryTrait::findWith()` (renkas)
 - Enh #20032: Added `yii\helpers\BaseStringHelper::mask()` method for string masking with multibyte support (salehhashemi1992)
 - Enh #20034: Added `yii\helpers\BaseStringHelper::findBetween()` to retrieve a substring that lies between two strings (salehhashemi1992)
+- Bug #20083: Fix deprecated warning implicit conversion from float (skepticspriggan)
 - Enh #20087: Add custom attributes to script tags (skepticspriggan)
 - Enh #20121: Added `yiisoft/yii2-coding-standards` to composer `require-dev` and lint code to comply with PSR12 (razvanphp)
 - Enh #20134: Raise minimum `PHP` version to `7.3` (@terabytesoftw)
-
+- Bug #20141: Update `ezyang/htmlpurifier` dependency to version `4.17` (@terabytesoftw)
 
 2.0.49.2 October 12, 2023
 -------------------------

framework/base/Component.php

@@ -605,7 +605,7 @@ public function off($name, $handler = null)
      * @param string $name the event name
      * @param Event|null $event the event instance. If not set, a default [[Event]] object will be created.
      */
-    public function trigger($name, Event $event = null)
+    public function trigger($name, ?Event $event = null)
     {
         $this->ensureBehaviors();
 

framework/composer.json

@@ -68,7 +68,7 @@
         "ext-ctype": "*",
         "lib-pcre": "*",
         "yiisoft/yii2-composer": "~2.0.4",
-        "ezyang/htmlpurifier": "^4.6",
+        "ezyang/htmlpurifier": "^4.17",
         "cebe/markdown": "~1.0.0 | ~1.1.0 | ~1.2.0",
         "bower-asset/jquery": "3.7.*@stable | 3.6.*@stable | 3.5.*@stable | 3.4.*@stable | 3.3.*@stable | 3.2.*@stable | 3.1.*@stable | 2.2.*@stable | 2.1.*@stable | 1.11.*@stable | 1.12.*@stable",
         "bower-asset/inputmask": "^5.0.8 ",

framework/db/ActiveQuery.php

@@ -785,7 +785,7 @@ public function orOnCondition($condition, $params = [])
      * @throws InvalidConfigException when query is not initialized properly
      * @see via()
      */
-    public function viaTable($tableName, $link, callable $callable = null)
+    public function viaTable($tableName, $link, ?callable $callable = null)
     {
         $modelClass = $this->primaryModel ? get_class($this->primaryModel) : $this->modelClass;
         $relation = new self($modelClass, [

framework/db/ActiveQueryInterface.php

@@ -97,7 +97,7 @@ public function with();
      * Its signature should be `function($query)`, where `$query` is the query to be customized.
      * @return $this the relation object itself.
      */
-    public function via($relationName, callable $callable = null);
+    public function via($relationName, ?callable $callable = null);
 
     /**
      * Finds the related records for the specified primary record.

framework/db/ActiveRelationTrait.php

@@ -104,7 +104,7 @@ public function __clone()
      * Its signature should be `function($query)`, where `$query` is the query to be customized.
      * @return $this the relation object itself.
      */
-    public function via($relationName, callable $callable = null)
+    public function via($relationName, ?callable $callable = null)
     {
         $relation = $this->primaryModel->getRelation($relationName);
         $callableUsed = $callable !== null;

framework/i18n/Formatter.php

@@ -1059,7 +1059,7 @@ public function asDuration($value, $implodeString = ', ', $negativeSign = '-')
         } elseif (is_numeric($value)) {
             $isNegative = $value < 0;
             $zeroDateTime = (new DateTime())->setTimestamp(0);
-            $valueDateTime = (new DateTime())->setTimestamp(abs($value));
+            $valueDateTime = (new DateTime())->setTimestamp(abs((int) $value));
             $interval = $valueDateTime->diff($zeroDateTime);
         } elseif (strncmp($value, 'P-', 2) === 0) {
             $interval = new DateInterval('P' . substr($value, 2));

framework/mail/BaseMessage.php

@@ -39,7 +39,7 @@ abstract class BaseMessage extends BaseObject implements MessageInterface
      * the "mailer" application component will be used instead.
      * @return bool whether this message is sent successfully.
      */
-    public function send(MailerInterface $mailer = null)
+    public function send(?MailerInterface $mailer = null)
     {
         if ($mailer === null && $this->mailer === null) {
             $mailer = Yii::$app->getMailer();

framework/mail/MessageInterface.php

@@ -209,7 +209,7 @@ public function embedContent($content, array $options = []);
      * If null, the "mailer" application component will be used instead.
      * @return bool whether this message is sent successfully.
      */
-    public function send(MailerInterface $mailer = null);
+    public function send(?MailerInterface $mailer = null);
 
     /**
      * Returns string representation of this message.

tests/framework/console/FakePhp71Controller.php

@@ -14,9 +14,14 @@
 
 class FakePhp71Controller extends Controller
 {
-    public function actionInjection($before, Request $request, $between, DummyService $dummyService, Post $post = null, $after)
-    {
-
+    public function actionInjection(
+        $before,
+        Request $request,
+        $between,
+        DummyService $dummyService,
+        ?Post $post,
+        $after
+    ) {
     }
 
     public function actionNullableInjection(?Request $request, ?Post $post)

tests/framework/di/ContainerTest.php

@@ -252,7 +252,7 @@ public function testOptionalDependencies()
     {
         $container = new Container();
         // Test optional unresolvable dependency.
-        $closure = function (QuxInterface $test = null) {
+        $closure = function (?QuxInterface $test = null) {
             return $test;
         };
         $this->assertNull($container->invoke($closure));

tests/framework/di/stubs/Alpha.php

@@ -12,10 +12,10 @@ class Alpha extends BaseObject
     public $color = true;
 
     public function __construct(
-        Beta $beta = null,
-        QuxInterface $omega = null,
-        Unknown $unknown = null,
-        AbstractColor $color = null
+        ?Beta $beta = null,
+        ?QuxInterface $omega = null,
+        ?Unknown $unknown = null,
+        ?AbstractColor $color = null
     ) {
         $this->beta = $beta;
         $this->omega = $omega;

tests/framework/i18n/FormatterDateTest.php

@@ -536,6 +536,7 @@ public function testAsDuration()
         // other options
         $this->assertSame('minus 244 seconds', $this->formatter->asDuration($interval_244_seconds, ' and ', 'minus '));
         $this->assertSame('minus 4 minutes and 4 seconds', $this->formatter->asDuration(-244, ' and ', 'minus '));
+        $this->assertSame('1 second', $this->formatter->asDuration(1.5));
 
         // Pass a inverted DateInterval string
         $this->assertSame('-1 year, 2 months, 10 days, 2 hours, 30 minutes', $this->formatter->asDuration('2008-05-11T15:30:00Z/2007-03-01T13:00:00Z'));

tests/framework/web/FakePhp71Controller.php

@@ -21,9 +21,14 @@ class FakePhp71Controller extends Controller
 {
     public $enableCsrfValidation = false;
 
-    public function actionInjection($before, Request $request, $between, VendorImage $vendorImage, Post $post = null, $after)
-    {
-
+    public function actionInjection(
+        $before,
+        Request $request,
+        $between,
+        VendorImage $vendorImage,
+        ?Post $post,
+        $after
+    ) {
     }
 
     public function actionNullableInjection(?Request $request, ?Post $post)

tests/framework/web/FakePhp7Controller.php

@@ -17,11 +17,11 @@ class FakePhp7Controller extends Controller
 {
     public $enableCsrfValidation = false;
 
-    public function actionAksi1(int $foo, float $bar = null, bool $true, bool $false)
+    public function actionAksi1(int $foo, ?float $bar, bool $true, bool $false)
     {
     }
 
-    public function actionStringy(string $foo = null)
+    public function actionStringy(?string $foo = null)
     {
     }
 }