Why use a strong random number generator in one place, but not another? I know salts have no cryptographic security requirement, but collisions are less likely if you use one.

fixes yiisoft/yii#2844

which resulted in endless loop

http://www.yiiframework.com/forum/index.php/topic/50982-cfilehelper-bug-security-flaw/

- Gii diff markup is now copy paste friendly
- Removed StringHelper::diff()
- Moved phpspec/php-diff dependency from yiisoft/yii2 to yiisoft/yii2-gii

- DbMessageSource now performs UNION ALL.
- Fixed message merging for php and po.
- Updated tests.

in case no dir is present

- i18n now falls back to `en` from `en-US` if message translation isn't found
- View now falls back to `en` from `en-US` if file not found
- Default `sourceLanguage` and `language` are now `en`

issue #2043

A bit less stricter check as suggested by @qiang: https://github.com/yiisoft/yii2/commit/2aa8fc71714134feac3f0a09dd61837d920be534