diff --git a/framework/base/Behavior.php b/framework/base/Behavior.php
index df7e2443da..47d70589bb 100644
--- a/framework/base/Behavior.php
+++ b/framework/base/Behavior.php
@@ -23,7 +23,7 @@ namespace yii\base;
 class Behavior extends Object
 {
     /**
-     * @var Component the owner of this behavior
+     * @var Component|null the owner of this behavior
      */
     public $owner;
 
diff --git a/framework/base/Component.php b/framework/base/Component.php
index 21880846fc..ee17b7e4c1 100644
--- a/framework/base/Component.php
+++ b/framework/base/Component.php
@@ -566,7 +566,7 @@ class Component extends Object
 
     /**
      * Returns all behaviors attached to this component.
-     * @return Behavior[] list of behaviors attached to this component
+     * @return Behavior[]|null list of behaviors attached to this component
      */
     public function getBehaviors()
     {
diff --git a/framework/base/Controller.php b/framework/base/Controller.php
index 1a8ebd8ab1..84b51419f6 100644
--- a/framework/base/Controller.php
+++ b/framework/base/Controller.php
@@ -212,7 +212,7 @@ class Controller extends Component implements ViewContextInterface
      * where `Xyz` stands for the action ID. If found, an [[InlineAction]] representing that
      * method will be created and returned.
      * @param string $id the action ID.
-     * @return Action the newly created action instance. Null if the ID doesn't resolve into any action.
+     * @return Action|null the newly created action instance. Null if the ID doesn't resolve into any action.
      */
     public function createAction($id)
     {
diff --git a/framework/base/ErrorHandler.php b/framework/base/ErrorHandler.php
index 1176343d6e..69e196a43f 100644
--- a/framework/base/ErrorHandler.php
+++ b/framework/base/ErrorHandler.php
@@ -38,7 +38,7 @@ abstract class ErrorHandler extends Component
      */
     public $memoryReserveSize = 262144;
     /**
-     * @var \Exception the exception that is being handled currently.
+     * @var \Exception|null the exception that is being handled currently.
      */
     public $exception;
 
diff --git a/framework/base/Model.php b/framework/base/Model.php
index 79078d26c3..621fddcd79 100644
--- a/framework/base/Model.php
+++ b/framework/base/Model.php
@@ -849,7 +849,7 @@ class Model extends Component implements IteratorAggregate, ArrayAccess, Arrayab
     public static function loadMultiple($models, $data, $formName = null)
     {
         if ($formName === null) {
-            /* @var $first Model */
+            /* @var $first Model|false */
             $first = reset($models);
             if ($first === false) {
                 return false;
diff --git a/framework/base/Module.php b/framework/base/Module.php
index 5c863745bf..e310eec14a 100644
--- a/framework/base/Module.php
+++ b/framework/base/Module.php
@@ -305,7 +305,7 @@ class Module extends ServiceLocator
     /**
      * Returns current module version.
      * If version is not explicitly set, [[defaultVersion()]] method will be used to determine its value.
-     * @return string the version of this module.
+     * @return string|callable the version of this module.
      * @since 2.0.11
      */
     public function getVersion()
@@ -342,7 +342,7 @@ class Module extends ServiceLocator
     /**
      * Returns default module version.
      * Child class may override this method to provide more specific version detection.
-     * @return string the version of this module.
+     * @return string|callable the version of this module.
      * @since 2.0.11
      */
     protected function defaultVersion()
@@ -606,7 +606,7 @@ class Module extends ServiceLocator
      * Note that this method does not check [[modules]] or [[controllerMap]].
      *
      * @param string $id the controller ID.
-     * @return Controller the newly created controller instance, or `null` if the controller ID is invalid.
+     * @return Controller|null the newly created controller instance, or `null` if the controller ID is invalid.
      * @throws InvalidConfigException if the controller class and its file name do not match.
      * This exception is only thrown when in debug mode.
      */
diff --git a/framework/base/Security.php b/framework/base/Security.php
index a76103b4ab..6f0568107c 100644
--- a/framework/base/Security.php
+++ b/framework/base/Security.php
@@ -163,7 +163,7 @@ class Security extends Component
      * @param string $data data to be encrypted
      * @param bool $passwordBased set true to use password-based key derivation
      * @param string $secret the encryption password or key
-     * @param string $info context/application specific information, e.g. a user ID
+     * @param string|null $info context/application specific information, e.g. a user ID
      * See [RFC 5869 Section 3.2](https://tools.ietf.org/html/rfc5869#section-3.2) for more details.
      *
      * @return string the encrypted data
@@ -214,7 +214,7 @@ class Security extends Component
      * @param string $data encrypted data to be decrypted.
      * @param bool $passwordBased set true to use password-based key derivation
      * @param string $secret the decryption password or key
-     * @param string $info context/application specific information, @see encrypt()
+     * @param string|null $info context/application specific information, @see encrypt()
      *
      * @return bool|string the decrypted data or false on authentication failure
      * @throws InvalidConfigException on OpenSSL not loaded
@@ -280,7 +280,7 @@ class Security extends Component
             }
             return $outputKey;
         }
-        
+
         $test = @hash_hmac($algo, '', '', true);
         if (!$test) {
             throw new InvalidParamException('Failed to generate HMAC with hash algorithm: ' . $algo);
@@ -409,7 +409,7 @@ class Security extends Component
      * It indicates whether the hash value in the data is in binary format. If false, it means the hash value consists
      * of lowercase hex digits only.
      * hex digits will be generated.
-     * @return string the real data with the hash stripped off. False if the data is tampered.
+     * @return string|false the real data with the hash stripped off. False if the data is tampered.
      * @throws InvalidConfigException when HMAC generation fails.
      * @see hashData()
      */