* upstream: (21 commits)
Fixes#1643: Added default value for `Captcha::options`
Fixes#1654: Fixed the issue that a new message source object is generated for every new message being translated
Allow dash char in ActionColumn’s button names.
Added SecurityTest.
fixed functional test when enablePrettyUrl is false.
fixed composer.json
minor doc fix.
Fixes#1634: Use masked CSRF tokens to prevent BREACH exploits
Use better random CSRF token.
GII unique indexes avoid autoIncrement columns
updated debug retry params.
Added sleep().
Added unit test for ActiveRecord::updateAttributes().
Fixes#1641: Added `BaseActiveRecord::updateAttributes()`
Fixed#1504: Debug toolbar isn't loaded successfully in some environments when xdebug is enabled
Mongo README.md updated.
Fixes#1611: Added `BaseActiveRecord::markAttributeDirty()`
Number validator was missing
Fixes#1638: prevent table names from being enclosed within curly brackets twice.
Unique indexes rules for single columns into array
...
* master: (59 commits)
updated ext composer.json for issue labels
moved redis to extensions
fixed whitespaces
update composer to include sphinx
Added initial steps about configuring DB-based RBAC
Fixes#1297: CSRF not generated on error pages
fixes#1158 mentioned @web alias in docs
Merged RBAC draft into authorization
"yii\sphinx\ActiveQuery" updated to throw exception on conflict between "asArray" and "snippetByModel" options.
Code style and docs at "yii\sphinx\*" fixed.
Docs for Sphinx extension updated.
Redundant typecast removed from yii\sphinx\ActiveRecord::create()
yii\sphinx\Command reworked to extend yii\db\Command. yii\sphinx\DataReader removed.
Sphinx Active Record updated to be compatible with ActiveDataProvider.
Sphinx documentation updated.
Sphinx documentation updated.
Sphinx has many relation test prepared.
Sphinx Query refactored.
Create relation methods added to Sphinx Active Record.
Sphinx Query Builder updated to respect column types for where statements
...
* master:
Fixes#1253Fixes#1310: ActiveRelation does not preserve order of items on find via() and viaTable()
fixed limit/offset for sqlite,mysql and cubrid
fixed test break.
Fixed test break.
Fixes#1301: fixed scenario generation when there are "except" scenarios.
support for batch insert in sqlite older than 3.7.11
Fixes#1298: supporting route with trailing slash.
Fixes#1296: stricter check of dashes in route.
Fixes#1307: move batchInsert() to base class.
Update apps-advanced.md
