v0.8.0

Requires PHP 8.3 or newer, as announced in 0.7.5. pb-php 2.2.0 raised its own minimum to PHP 8.3 in a minor release with no API changes, and this release requires it. Composer's platform check keeps PHP 8.1 / 8.2 installs on 0.7.5. No commands, options, or runtime behaviour change.

Removed (breaking)

• PHP 8.1 and 8.2 are no longer supported. The required PHP version is now ^8.3 (was ^8.1). PHP 8.1 reached end of life on 31 December 2025 and does not receive PHP security fixes, including CVE-2026-109618 and CVE-2026-109619 (fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12). PHP 8.2 reaches end of life on 31 December 2026.

Changed

• Requires spontena/pb-php ^2.2 (was ^2.1.4). pb-php 2.2.0 has no src/ changes from 2.1.4; it only raises the PHP requirement.
• CI matrix now covers PHP 8.3 / 8.4 / 8.5.
• README / README.ja: Requirements say PHP 8.3+ and that PHP 8.1 / 8.2 stay on 0.7.5; the logging note no longer carries the PHP 8.1 caveat.

Upgrading

• On PHP 8.3 or newer, composer global update knlab/pb-migrate (or composer update knlab/pb-migrate in a project) picks up 0.8.0. Keep PHP on the latest patch release of a supported branch.
• On PHP 8.1 / 8.2, Composer stays on 0.7.5. Upgrade PHP to move to 0.8.

Full changelog: v0.7.5...v0.8.0

v0.7.5

Documentation release ahead of the critical PHP security release of October 2026 (scheduled 2026-10-21 14:00 UTC, two vulnerabilities rated CVSS v4.0 9.2). PHP 8.1 reached end of life on 31 December 2025 and does not receive these fixes, but pb-migrate still installs on it. This release documents the risk and deprecates PHP 8.1 / 8.2; the "php": "^8.1" constraint stays for 0.7.x.

Security

• PHP 8.1 is end of life and unpatched. It is not covered by the critical PHP security release of October 2026 or any later PHP security release. PHP 8.3 or newer is recommended; PHP 8.2 reaches end of life on 31 December 2026. Updating pb-migrate does not patch the PHP runtime — upgrade PHP itself to the latest patch release of a supported branch. See https://www.php.net/supported-versions.php.

Deprecated

• Support for PHP 8.1 and 8.2. The next minor release, 0.8, will require PHP ^8.3. No commands, options, or runtime behaviour change in this release.

Changed

• CI also runs the unit suite on PHP 8.5.
• README / README.ja: Requirements recommend PHP 8.3+ and carry the end-of-life notice above.

Full changelog: v0.7.4...v0.7.5

v0.7.4

Three gaps in the sync layer that the v0.7.3 dogfooding did not reach: --only could not address the two bare-name kinds at all, pull ignored the subdirectory a local file lives in and so manufactured the very name collision FileScanner now rejects, and status reported "in sync" after a local file had been deleted. This release also carries the README.ja sync that landed after v0.7.3 was tagged.

Fixed

• --only properties / --only pdefaults now work on push, pull, diff and report. The two kinds have no name of their own, so neither the name nor the kind/name form could match them and the option silently selected nothing. A bare kind value only acts this way for kinds without a filename in their URL; --only file is still a non-match, not a wildcard.
• pull keeps subdirectory paths. When a file with the same kind and name already lives in a subdirectory (ja/greet.aiml), pull writes into that path. It used to write a second copy at the bot directory root, which push then refused as a remote-name collision, and the local-edit protection added in v0.7.3 never saw the nested file. Files with no local counterpart still land at the root as before. The ↓ kind/name → path line shows the path actually written.
• status counts local deletions. Cache entries with no matching local file are reported as (-) N delete, and ✓ in sync is no longer shown for a tree where a file was removed after the last push / pull. This matches what report --since=cache already showed and what the next push would remove from the remote.

Changed

• README: --only accepted forms, pull's subdirectory behaviour, and the status summary now mention deletes.
• README.ja mirrors the v0.7.3 README additions (pull --force, Pull semantics, Error handling) and the changes above.

Full changelog: v0.7.3...v0.7.4

v0.7.3

pb-php shipped a security release (2.1.4) that pins patched Guzzle versions and strips response bodies and credential-bearing query strings from its exception messages. This release adopts it and re-attaches the server's own error explanation on the pb-migrate side, so API failures stay readable. It also lands two sync-safety changes: pull no longer overwrites files edited since the last sync, and push refuses local trees whose files would collide under Pandorabots' flat remote namespace.

Security

• Require spontena/pb-php ^2.1.4, which in turn requires guzzlehttp/guzzle ^7.15.2 and guzzlehttp/psr7 ^2.12.3. composer audit on the previous lock reported 13 advisories against Guzzle (one high); the updated lock reports none.
• Action required for existing installs: run composer update — a lock file is not updated by this change alone.

Added

• pull protects un-pushed local edits. Before writing a file it compares the local SHA-256 with the hash recorded in the cache at the last sync. A mismatch skips the file with a warning and a per-bot summary count. No cache entry (first pull, manually dropped-in file) falls through and writes, preserving first-pull behaviour. pull --force restores the old unconditional overwrite.
• FileScanner refuses colliding remote names. Local trees where two files map to the same remote name (e.g. ja/greet.aiml and en/greet.aiml both upload as file/greet) now raise a ConfigException listing every colliding path. Same basename across different kinds (foo.set / foo.map) is still fine.
• Server error detail is shown everywhere an ApiException surfaces. The message field of the API's JSON error body is appended in the REPL error line, batch failure line, test FAIL line, the error block of a direct CLI run (as a trailing Server message: line), and the pull / push skip lines for HTTP 4xx / 412 on system-managed files. Bodies without a usable message render exactly as before.
• README (English and Japanese): new "Error handling" and "Pull semantics" sections.

Changed

• composer analyse runs PHPStan with --memory-limit=1G.
• .gitignore excludes local AI-agent instruction files (CLAUDE.md, AGENTS.md, .claude/, .codex/).

Full changelog: v0.7.2...v0.7.3