"ezyang/htmlpurifier" package has been made optional

composer.json

@@ -76,7 +76,6 @@
         "yiisoft/yii2-composer": "~2.0.4",
         "psr/simple-cache": "~1.0.0",
         "psr/http-message": "~1.0.0",
-        "ezyang/htmlpurifier": "~4.6",
         "cebe/markdown": "~1.0.0 | ~1.1.0",
         "bower-asset/jquery": "3.2.*@stable | 3.1.*@stable | 2.2.*@stable | 2.1.*@stable | 1.11.*@stable | 1.12.*@stable",
         "bower-asset/inputmask": "~3.2.2 | ~3.3.5",
@@ -84,6 +83,7 @@
         "bower-asset/yii2-pjax": "~2.0.1"
     },
     "require-dev": {
+        "ezyang/htmlpurifier": "~4.6",
         "phpunit/phpunit": "~6.2.3",
         "cebe/indent": "~1.0.2",
         "friendsofphp/php-cs-fixer": "~2.2.3"
@@ -95,6 +95,7 @@
         }
     ],
     "suggest": {
+        "ezyang/htmlpurifier": "required at `yii\\helpers\\HtmlPurifier` for 'html' data format support (e.g. `yii\\i18n\\Formatter:asHtml()`)",
         "yiisoft/yii2-coding-standards": "you can use this package to check for code style issues when contributing to yii"
     },
     "autoload": {

framework/CHANGELOG.md

@@ -39,6 +39,7 @@ Yii Framework 2 Change Log
 - Chg #14178: Removed HHVM-specific code (samdark)
 - Enh #14671: use `random_int()` instead of `mt_rand()` to generate cryptographically secure pseudo-random integers (yyxx9988)
 - Chg #14761: Removed Yii autoloader in favor of Composer's PSR-4 implementation (samdark)
+- Chg: Package "ezyang/htmlpurifier" has been made optional and does installed via Composer by default (klimov-paul)
 
 2.0.14 under development
 ------------------------

framework/UPGRADE.md

@@ -154,6 +154,9 @@ Upgrade from Yii 2.0.x
   `yii\validators\FileValidator::buildMimeTypeRegexp()` have been made `public`. Make sure you use correct
   access level specification in case you override these methods.
 * Default script position for the `yii\web\View::registerJs()` changed to `View::POS_END`.
+* Package "ezyang/htmlpurifier" has been made optional and does installed via Composer by default. If you need
+  `yii\helpers\HtmlPurifier` or `yii\i18n\Formatter::asHtml()` (e.g. 'html' data format) you'll have to install
+  this package manually fro your project.
 
 
 Upgrade from Yii 2.0.13

framework/composer.json

@@ -71,12 +71,14 @@
         "yiisoft/yii2-composer": "~2.0.4",
         "psr/simple-cache": "~1.0.0",
         "psr/http-message": "~1.0.0",
-        "ezyang/htmlpurifier": "~4.6",
         "cebe/markdown": "~1.0.0 | ~1.1.0",
         "bower-asset/jquery": "3.2.*@stable | 3.1.*@stable | 2.2.*@stable | 2.1.*@stable | 1.11.*@stable | 1.12.*@stable",
         "bower-asset/punycode": "1.3.*",
         "bower-asset/yii2-pjax": "~2.0.1"
     },
+    "suggest": {
+        "ezyang/htmlpurifier": "required at `yii\\helpers\\HtmlPurifier` for 'html' data format support (e.g. `yii\\i18n\\Formatter:asHtml()`)"
+    },
     "autoload": {
         "psr-4": {"yii\\": ""},
         "classmap": [

framework/helpers/BaseHtmlPurifier.php

@@ -7,11 +7,21 @@
 
 namespace yii\helpers;
 
+use yii\base\InvalidConfigException;
+
 /**
  * BaseHtmlPurifier provides concrete implementation for [[HtmlPurifier]].
  *
  * Do not use BaseHtmlPurifier. Use [[HtmlPurifier]] instead.
  *
+ * This helper requires `ezyang/htmlpurifier` library to be installed. This can be done via composer:
+ *
+ * ```
+ * composer require --prefer-dist "ezyang/htmlpurifier:~4.6"
+ * ```
+ *
+ * @see http://htmlpurifier.org/
+ *
  * @author Alexander Makarov <sam@rmcreative.ru>
  * @since 2.0
  */
@@ -44,6 +54,10 @@ class BaseHtmlPurifier
      */
     public static function process($content, $config = null)
     {
+        if (!class_exists(\HTMLPurifier::class)) {
+            throw new InvalidConfigException('Unable to load "' . \HTMLPurifier::class . '" class. Make sure you have installed "ezyang/htmlpurifier:~4.6" composer package.');
+        }
+
         $configInstance = \HTMLPurifier_Config::create($config instanceof \Closure ? null : $config);
         $configInstance->autoFinalize = false;
         $purifier = \HTMLPurifier::instance($configInstance);