Dunebox v1.3.0

Dunebox v1.3.0

"PHP for developers": PHP settings per version without touching php.ini, Xdebug with one
switch, every log in one screen and dump()/dd() captured in the app. Drop-in update: replace
dunebox.exe and system/dunebox-cli.exe; config, hosts and data remain intact. From 1.2.0,
Dunebox installs this update by itself. It also includes the fixes prepared for 1.2.1, which
was never released on its own.

New

• PHP settings per version. Settings › PHP has a card for each installed PHP version with
  memory_limit, max upload size (post_max_size follows it), max execution time and
  display_errors. Each value shows what is in effect and where it comes from (set by
  Dunebox, php.ini or PHP default). Your php.ini is never modified: leave a field empty to use
  it, or use Restore php.ini values. Saving restarts only that PHP version, after asking.
  The values apply to sites, to php/artisan/composer in the terminal and to Cron Jobs.
  From the terminal: dunebox php get, dunebox php set <ver> <setting> <value>,
  dunebox php unset, dunebox php reset <ver>.
• Xdebug. One switch per PHP version (7.4, 8.2, 8.3, 8.4, 8.5): step debugging on request
  (browser extension or XDEBUG_TRIGGER, IDE on port 9003) and clearer error messages; for
  test code coverage set XDEBUG_MODE=coverage in the terminal. Off by default. Also
  dunebox php set <ver> xdebug on|off. PHP versions installed with an earlier Dunebox get a
  Download Xdebug button (or dunebox php xdebug-download <ver>).
• Dumps panel. Turn on Capture dumps and Laravel/Symfony dump() and dd() show up in
  the app instead of the page, in real time, grouped by request or command, with the site, the
  URL or command line and the calling file and line. Filter, pause, clear. dd() still stops
  the request. Works on every PHP version, also for artisan commands, queues and tests.
  With capture off, PHP behaves exactly as before. Also dunebox php dumps on|off.
  Dumps stay in a local file in the logs folder; very large dumps are shortened. A project
  that declares its own dump()/dd() functions needs capture off; an auto_prepend_file
  from your php.ini keeps working.
• Logs screen. Every log in one place: the output of each service (database errors
  included), PHP errors per version, web server error and access logs, database slow queries,
  Cron Jobs, developer
  tools, each site's logs and Laravel's storage/logs. Pick a service or a host, then which
  one (only the list scrolls, the log stays in view), follow
  new lines live (with pause), search, copy, open the file. Each service on the Dashboard has a
  Logs button that opens its logs here, an Info button with its ports and a Config
  menu with its configuration files.
• Search: the command palette is now called Search and has its own field at the top of
  the sidebar; open it with Ctrl+F (it was Ctrl+K). From it you can also open the PHP
  settings of a version, turn Xdebug or dump capture on and off, open Logs (Ctrl+7) and Dumps
  (Ctrl+8).
• Interface touches: instant tooltips on icon buttons, a Logs button and a play icon on
  each Cron Job, package cards in two columns, "Remove" used everywhere.
• Diagnostics checks that the PHP settings are applied to every version (also that a
  running PHP isn't still using older ones) and warns if Xdebug is on for a PHP package that
  doesn't include it.
• Claude integration: new tools to read and change PHP settings, list logs and read the
  latest dumps.

Updated components

All updates stay within the same series, so your databases keep working as they are (MySQL
upgrades its data files by itself on first start). After the update Dunebox downloads the new
components once.

• PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 — security release (critical remote code execution
  fixes published on 2026-10-21). With imagick 3.8.1 and the MongoDB driver 2.5.5.
• Apache 2.4.69 — 33 security fixes since 2.4.67, one specific to Windows.
• Mailpit 1.31.6, phpRedisAdmin 1.27.0 — security fixes. phpRedisAdmin now asks for a
  login unless the instance is marked as an isolated development instance: Dunebox does that,
  since it's reachable only from your PC.
• nginx 1.30.6, PostgreSQL 18.6 — security fixes.
• MySQL 8.0.46 (last 8.0 release), MariaDB 12.3.3, MongoDB 8.3.13 — maintenance
  releases of the same series.

Fixed (prepared for 1.2.1)

• Updates can no longer leave Dunebox without its app. The new version is copied next to
  the current one first and then swapped in; if the app is ever found missing or empty at
  startup, Dunebox puts the previous version back by itself.
• Back to the previous version if the new one doesn't start. The previous version is kept
  until the new one has started properly; dunebox update rollback does the same by hand.
• Closing during an update now waits for it: Dunebox restarts by itself when it's done.
• Esc in the host and Cron Job editors closes an open menu or list first.
• Fix all in Diagnostics applies the fixes in the right order and ignores informational
  rows; removing hosts without a folder works right after startup.
• Ctrl+Shift+S no longer fires while you're typing in a field.
• Microsoft Store edition: new versions are announced as arriving through the Store.
• The "changes to apply to Windows" notification appears exactly when the hosts file, the
  certificate or the local DNS rule really need updating.
• dunebox doctor exits with an error code when it finds errors.
• Third-party licenses are shipped in THIRD-PARTY-NOTICES.txt (About dialog); Report in
  Diagnostics no longer includes your Windows user name; updates only accept https downloads
  of a sensible size.
• Each Redis instance now writes its own log file (redis-5.0.log). The old redis.log
  stays in the logs folder with the earlier history; you can delete it.

Notes

• Xdebug comes with the PHP packages of this release for new installations. PHP versions
  you already have keep working as they are: click Download Xdebug on their card in
  Settings › PHP to add it.
• Portable, unsigned build: Windows SmartScreen may warn on first run
  ("More info" -> "Run anyway"). Authenticode code signing is on the roadmap.