[dependabot]

Bumps NhanAZ/DevTools from 1.0.3 to 1.0.15.

Release notes

Sourced from NhanAZ/DevTools's releases.

DevTools 1.0.15

DevTools loads folder plugins and shared development virions on Axolotl-PM and builds standalone plugin PHARs.

Changes

• Require packaging identity strings compared with __CLASS__ to exactly match the original enclosing class. Unrelated namespace prefixes, suffixes and case mismatches remain rejected.
• Resolve shaded namespaces back to their original names during final source validation so exact packaging sentinels survive reparsing without bypassing stale-reference checks.
• Add regression coverage for unrelated namespace prefixes and case-mismatched identity strings.
• Allow dynamic construction from a local static class map whose values are explicit ::class references immediately selected by the factory.
• Preserve exact __CLASS__ !== 'original\\Class' packaging sentinels used to detect namespace shading while continuing to reject unrelated identity strings.
• Keep mutable, runtime-supplied and otherwise unproven dynamic class maps rejected.

Previous changes

• Permit a variable operand in instanceof, whose runtime type check does not autoload a class; computed dynamic targets remain rejected.
• Rewrite only the exact Fiber::getCurrent(), non-null guard and suspend() pattern to the native \Fiber::suspend() call.
• Rewrite ReflectionClass($className) to reflect the bound object only when the same non-static closure immediately assigned the variable from get_called_class(). Permit ReflectionClass($this) when a non-static method or closure has a bound object.
• Preserve fail-closed checks for other dynamic static calls, arbitrary reflection class strings and computed instanceof targets.

These earlier narrow rules clear the relevant VAPM Fiber, reflection and instanceof patterns in libBedrock's prepared dependency sources. Its build still stops at a VAPM autoloader path stored as a string that no longer matches after namespace shading. No complete libBedrock PHAR or release eligibility is claimed.

Install

Download DevTools-1.0.15.phar and verify its SHA-256 with SHA256SUMS.txt. Stop the server, place the file at plugins/DevTools.phar, start the server, and run /devtools status.

The examples ZIP contains the HelloShared plugin and SharedGreeting library. Follow the example guide to load source and build a standalone PHAR.

Compatibility and verification

PHP 8.1 is the source and build baseline. The release candidate gate runs PHPStan max, syntax, style, unit tests, documentation checks and artifact validation on the selected commit. The runtime validation guide describes the pinned Axolotl-PM test and its limits.

DevTools 1.0.14 remains available for rollback. A successful dependency preparation or build does not prove a server boot or gameplay behavior. Runtime evidence for this release is recorded separately from candidate metadata.

Release assets

• DevTools-1.0.15.phar contains the installable plugin.
• DevTools-examples-1.0.15.zip contains examples, a build workflow and a coding agent template.
• RELEASE_NOTES.md describes this release.
• candidate.json identifies the source commit, build run and asset hashes.
• SHA256SUMS.txt lists checksums.

Documentation

• Installation
• CLI and JSON
• Dependency support
• GitHub workflows

DevTools 1.0.14

... (truncated)

Changelog

Sourced from NhanAZ/DevTools's changelog.

Changelog

1.0.15 - 2026-10-14

• Require a packaging identity string compared with __CLASS__ to exactly match the original enclosing class name. This prevents an unrelated namespace prefix from bypassing the standalone namespace reference guard.
• Preserve exact identity sentinels through post-shading validation by resolving shaded namespaces back to their original names.
• Add regression coverage for unrelated namespace prefixes and case-mismatched identity strings.

1.0.14 - 2026-10-14

• Allow dynamic construction from a local static class map whose values are explicit ::class references immediately selected by the factory.
• Preserve exact __CLASS__ !== 'original\\Class' packaging sentinels used to detect namespace shading while continuing to reject unrelated identity strings.
• Keep mutable, runtime-supplied and otherwise unproven dynamic class maps rejected.

1.0.13 - 2026-10-14

• Allow object-class diagnostics inside the same short-circuit instanceof ... || throw guard when the inspected variable is the guarded operand.
• Keep dynamic class factories, static calls, computed targets and mismatched guarded variables rejected.

1.0.12 - 2026-10-13

• Allow only variable class operands of instanceof, which perform type checks without autoloading; computed targets remain rejected.
• Rewrite the exact Fiber::getCurrent(), non-null guard and suspend() pattern to \Fiber::suspend(); other dynamic static calls remain rejected.
• Rewrite ReflectionClass($className) only when the immediately preceding statement assigns that variable from get_called_class() inside a non-static closure with a bound object. Also allow ReflectionClass($this) where $this is available.
• Keep regression tests for each accepted pattern and for similar unproven patterns that must remain rejected.

1.0.11 - 2026-10-13

• Allow dynamic is_a() target types when allow_string is omitted and the target is a variable. PHP compares that target without autoloading it; calls with an explicit third argument remain subject to the dynamic-reference guard.
• Add regression tests for the allowed comparison and the rejected autoload-enabled form.

1.0.10 - 2026-10-11

• Prepare locked Composer virions when a PHP file declares its matching class and additional classes in the same namespace and directory. Generate a small autoload shim for each additional class and record the mapping in provenance.
• Keep standalone classes with incorrect paths rejected, detect duplicate class declarations regardless of letter case, and retain the existing dynamic class shading guard.

1.0.9 - 2026-10-11

• Require annotated runtime class factories to have two unconditional throwing guards immediately before a direct return of the new object.
• Reject unreachable checks and a class name reassigned after validation. The previous scan could mistake either case for a safe shaded factory.
• Keep the existing explicitly guarded factory pattern and reject unproven dynamic class operations.

1.0.8 - 2026-10-11

• Prepare Composer virions from dev- branches only when composer.lock pins a full Git commit and source and distribution references agree. Give each prepared revision a distinct internal version and keep the original Composer version in provenance.
• Match internal commit versions by exact revision because PHP version comparison can consider different hexadecimal suffixes equal.
• Add import-poggit-libraries: false for projects that keep legacy Poggit declarations but use their reviewed Composer lock as the DevTools dependency source. The default still imports Poggit libraries.
• Keep dynamic class shading guards in place. Preparation alone does not certify a standalone PHAR.

1.0.7 - 2026-10-11

... (truncated)

Commits

• 8d13a75 Align release metadata regression tests with 1.0.15
• f0383e3 Fix shaded class identity validation and release 1.0.15
• 2650969 chore: pin compatibility monitor to DevTools 1.0.14
• 628368d feat: support safe static class map shading
• c0eae64 Pin compatibility workflow to DevTools 1.0.13
• c5bd6d8 Allow guarded object class diagnostics
• f10550e ci: verify DevTools 1.0.12 compatibility baseline
• 6180fb4 feat: safely shade proven dynamic class patterns
• 06c52ee ci: pin compatibility check to DevTools 1.0.11
• 56f8b99 Allow comparison-only dynamic is_a targets
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)