Yii Framework 2.0.55 has been released.

This release includes an important security fix for CVE-2026-39850, plus continued work on static analysis, PHPDoc annotations, and compatibility with newer PHP versions.

Highlights:

- Security fix for CVE-2026-39850.

Internal variables in `View::renderPhpFile()` and `ErrorHandler::renderFile()` are now isolated to prevent parameter collisions from overriding included file paths.

- Continued PHPStan/Psalm and PHPDoc annotation improvements.

This includes more generics, conditional types, and more accurate return and parameter types.

- `yii\grid\GridView` improvements.

The default `filterSelector` can now be overridden and may use Closures.

- Better compatibility with newer PHP versions.

This includes PHP 8.6-related test adjustments.

- Removed obsolete code paths for PHP versions older than the current Yii 2 minimum.

- Bug fixes.

The Yii 2 basic and advanced application templates also received refreshed CI, Docker, static analysis, documentation, and…