[dependabot]

Bumps NhanAZ/DevTools from 1.0.15 to 1.0.18.

Release notes

Sourced from NhanAZ/DevTools's releases.

DevTools 1.0.18

DevTools loads folder plugins and shared development virions on Axolotl-PM and builds standalone plugin PHARs.

Changes

• Verify compatibility with Axolotl-PM 5.50.0 at commit fe5b3dee173b5e839783ab6fb7280005aa0a4d73, resolving [issue #6](NhanAZ/DevTools#6).
• Synchronize the development dependency, CI server source and compatibility monitor with that revision.
• Update the locked server dependencies to BedrockProtocol 63.0.1 and NetherNet 0.3.1.
• Keep runtime smoke servers on loopback RakNet and test that workflow pins match the lockfile.

Install

Download DevTools-1.0.18.phar and verify its SHA-256 with SHA256SUMS.txt. Stop the server, place the file at plugins/DevTools.phar, start the server, and run /devtools status.

The examples ZIP contains the HelloShared plugin and SharedGreeting library. Follow the example guide to load source and build a standalone PHAR.

Compatibility and verification

PHP 8.4 remains the source, CLI and build minimum. Installing the source checkout's development dependencies now requires ext-webrtc through NetherNet; use a current Axolotl-PM PHP binary.

The release candidate gate runs PHPStan max, syntax, style, unit tests, documentation checks and artifact validation. The full CI quality matrix runs on PHP 8.4 and PHP 8.5. The runtime validation guide covers folder plugins, shared virions and standalone PHARs on Axolotl-PM 5.50.0 with Windows x64 and PHP 8.4.24 ZTS. These tests use RakNet and do not test NetherNet client connections or gameplay.

DevTools 1.0.17 remains available for rollback. Runtime evidence is recorded separately from candidate metadata; CI on PHP 8.5 does not claim an Axolotl-PM server test on PHP 8.5.

Release assets

• DevTools-1.0.18.phar contains the installable plugin.
• DevTools-examples-1.0.18.zip contains examples, a build workflow and a coding agent template.
• RELEASE_NOTES.md describes this release.
• candidate.json identifies the source commit, build run and asset hashes.
• SHA256SUMS.txt lists checksums.

Documentation

• Installation
• CLI and JSON
• Dependency support
• GitHub workflows

DevTools 1.0.17

DevTools loads folder plugins and shared development virions on Axolotl-PM and builds standalone plugin PHARs.

Changes

• Reject linked source paths, including Windows directory junctions, and avoid following them during cleanup.
• Protect existing build outputs, detect collisions with bundled virion resources and metadata, and retain supported license and notice files.
• Fix namespace preparation for numeric-leading package names and source inspection of attributed anonymous classes.
• Close shading guard gaps involving imported aliases, named arguments and argument unpacking.

... (truncated)

Changelog

Sourced from NhanAZ/DevTools's changelog.

Changelog

1.0.18 - 2026-10-20

• Verify Axolotl-PM 5.50.0 and synchronize the development dependency, CI and compatibility monitor with source commit fe5b3dee173b5e839783ab6fb7280005aa0a4d73.
• Update the locked server dependencies to BedrockProtocol 63.0.1 and NetherNet 0.3.1. Development installations now require ext-webrtc.
• Keep runtime smoke servers on loopback RakNet and add regression coverage for workflow pins drifting from the lockfile.

1.0.17 - 2026-10-20

• Reject linked source paths, including Windows directory junctions, without traversing them during staging or cleanup.
• Preserve existing output directories and links on build failure, reject resource and metadata collisions with bundled virions, and retain supported license and notice files.
• Handle numeric-leading package names and attributed anonymous classes correctly when preparing namespaces and inspecting source.
• Close shading guard gaps involving imported aliases, named arguments and argument unpacking while preserving supported static references.
• Apply semantic version precedence consistently when selecting virions, including prereleases, build metadata and large version components.
• Reject empty plugin API lists, invalid source paths and malformed release tags with clear diagnostics; support qualified server command aliases.
• Remove duplicate validation and unused imports, align PHPStan with PHP 8.4, expand regression coverage and shorten documentation.

1.0.16 - 2026-10-20

• Raise DevTools' minimum PHP version to 8.4 and run the full CI quality gate on PHP 8.4 and 8.5.
• Use PHP 8.4 by default in the reusable build and publication workflows.
• Generate prepared Composer virion metadata with DevTools' PHP 8.4 baseline.

1.0.15 - 2026-10-14

• Require a packaging identity string compared with __CLASS__ to exactly match the original enclosing class name. This prevents an unrelated namespace prefix from bypassing the standalone namespace reference guard.
• Preserve exact identity sentinels through post-shading validation by resolving shaded namespaces back to their original names.
• Add regression coverage for unrelated namespace prefixes and case-mismatched identity strings.

1.0.14 - 2026-10-14

• Allow dynamic construction from a local static class map whose values are explicit ::class references immediately selected by the factory.
• Preserve exact __CLASS__ !== 'original\\Class' packaging sentinels used to detect namespace shading while continuing to reject unrelated identity strings.
• Keep mutable, runtime-supplied and otherwise unproven dynamic class maps rejected.

1.0.13 - 2026-10-14

• Allow object-class diagnostics inside the same short-circuit instanceof ... || throw guard when the inspected variable is the guarded operand.
• Keep dynamic class factories, static calls, computed targets and mismatched guarded variables rejected.

1.0.12 - 2026-10-13

• Allow only variable class operands of instanceof, which perform type checks without autoloading; computed targets remain rejected.
• Rewrite the exact Fiber::getCurrent(), non-null guard and suspend() pattern to \Fiber::suspend(); other dynamic static calls remain rejected.
• Rewrite ReflectionClass($className) only when the immediately preceding statement assigns that variable from get_called_class() inside a non-static closure with a bound object. Also allow ReflectionClass($this) where $this is available.
• Keep regression tests for each accepted pattern and for similar unproven patterns that must remain rejected.

1.0.11 - 2026-10-13

... (truncated)

Commits

• c735c40 Prepare DevTools 1.0.18 for Axolotl-PM 5.50.0
• 407ea8d Verify Axolotl-PM 5.50.0 compatibility
• 7662b05 Fix build and virion edge cases for 1.0.17
• 4b7a46c Update compatibility monitor to DevTools 1.0.16
• 3aa8cf4 Handle missing CLI arguments for PHP 8.5
• dc17311 Raise DevTools PHP baseline to 8.4
• 3452946 Fix artifact action metadata assertions
• 48136aa Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#3)
• e19e088 Bump phpstan/phpstan from 2.3.0 to 2.3.1 (#4)
• 1cc9966 Bump friendsofphp/php-cs-fixer from 3.95.17 to 3.95.27 (#5)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)