1.5.0-alpha.1

1.5.0

• Total issues resolved: 16
• Total pull requests resolved: 30
• Total contributors: 11

enhancement

• 670: 631: remove abandoned packages from bySearching/byProvider thanks to @asgrim
• 669: 643: RPM package manager updates thanks to @asgrim and @remicollet
• 668: 585: improve messaging when no auth available during verify thanks to @asgrim
• 666: 561: pie upgrade feature thanks to @asgrim
• 652: 587: add pie install --from-lock thanks to @asgrim
• 651: refactor: enhance UX for missing build tools prompt thanks to @yilanboy
• 642: 466: allow multiple exts install at once thanks to @asgrim and @1ma
• 639: more rpm providers (for dnf tips) thanks to @remicollet
• 634: 615 add zizmor thanks to @asgrim
• 633: 624: select packages for php project install thanks to @asgrim
• 623: 622: use providers API to find matching exts in pie install for PHP projects thanks to @asgrim
• 621: 586: make re-installing a verified extension a no-op thanks to @asgrim and @shivammathur
• 620: Fix: Skip semver tag patterns for pre-releases thanks to @glensc and @jnoordsij
• 619: Add unzip to required build tools thanks to @iliaal
• 617: Various Hardening Updates thanks to @iliaal
• 614: Add granular publish tags for "-bin" docker image thanks to @glensc
• 584: 532: enable Safe functions and phpstan rule thanks to @asgrim
• 580: 541: replace some common placeholders before build thanks to @asgrim and @remicollet

bug

• 664: 1.4.8 merge up to 1.5.x - output newline, and Windows exe build fixes thanks to @asgrim
• 645: 640: merge up fix to 1.5.x thanks to @asgrim
• 638: 579: merge up brew self update thanks to @asgrim
• 594: Merge up binary pkg configure options fix thanks to @asgrim

documentation

• 659: (maitainer) Add https://php.github.io/pie as repository website thanks to @homersimpsons
• 656: Docs update for 1.5.x so far thanks to @asgrim
• 648: Update README.md thanks to @kramred
• 641: Support operator thanks to @jb-lopez
• 616: Add security policy thanks to @asgrim

dependencies,github_actions,php

• 657: Deps update 1.5.x thanks to @asgrim

• 613: [1.5.x] Update Composer to 2.9.8 thanks to @asgrim

• 610: Merge up fixes for #596 and #597 to 1.5.x thanks to @asgrim

enhancement,maintainer investigating

• 588: Improve PIE install & update process thanks to @asgrim
• 563: Improve functionality to enable mlocati/docker-php-extension-installer to use PIE thanks to @asgrim

dependencies,php

• 583: [1.5.x] Update Composer to 2.9.7 thanks to @asgrim

1.4.8

1.4.8

• Total issues resolved: 0
• Total pull requests resolved: 3
• Total contributors: 1

dependencies,php

• 663: Dependency bump for 1.4.x series thanks to @asgrim

bug

• 662: 646: remove additional newline from subprocess callback thanks to @asgrim
• 661: 609: Re-enable windows pie.exe builds with VS22 thanks to @asgrim

1.4.7

1.4.7

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

bug

• 644: 640: fixing build tools installer on EL10 thanks to @asgrim

1.4.6

1.4.6

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

bug

• 637: 579: fix self update issues thanks to @asgrim

1.4.5

This release contains vulnerability fixes for the following security advisories:

• GHSA-h842-vjwg-pxxx - Sudo-elevated arbitrary file deletion via extra.pie-installed-binary metadata in UninstallUsingUnlink
• GHSA-pm6p-666q-hvj5 - Sudo-elevated root code execution via TOCTOU between self-update verify and write
• GHSA-f67f-c344-cqqr - PIE self-update accepts any historically-attested pie.phar (rollback gap)
• GHSA-vcv4-gmjc-mxvq - php-ext.build-path traversal escapes PIE's vendor extract directory
• GHSA-8xmh-xrvp-hwrf - WindowsInstall::copyExtraFile lacks destination containment check (Windows-only path traversal)
• GHSA-p4j8-36rr-gjfq - Self-update attestation verification is scoped to --owner=php, not --repo=php/pie

1.3.13

This release contains vulnerability fixes for the following security advisories:

• GHSA-h842-vjwg-pxxx - Sudo-elevated arbitrary file deletion via extra.pie-installed-binary metadata in UninstallUsingUnlink
• GHSA-pm6p-666q-hvj5 - Sudo-elevated root code execution via TOCTOU between self-update verify and write
• GHSA-f67f-c344-cqqr - PIE self-update accepts any historically-attested pie.phar (rollback gap)
• GHSA-vcv4-gmjc-mxvq - php-ext.build-path traversal escapes PIE's vendor extract directory
• GHSA-8xmh-xrvp-hwrf - WindowsInstall::copyExtraFile lacks destination containment check (Windows-only path traversal)
• GHSA-p4j8-36rr-gjfq - Self-update attestation verification is scoped to --owner=php, not --repo=php/pie

1.4.4

1.4.4

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

dependencies

• 612: [1.4.x] Update Composer to 2.9.8 thanks to @asgrim

1.3.12

1.3.12

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

dependencies

• 611: Update Composer to 2.9.8 thanks to @asgrim

1.4.3

1.4.3

• Total issues resolved: 2
• Total pull requests resolved: 3
• Total contributors: 2

bug

• 608: 597: add output check for dnf permission denied thanks to @asgrim and @hackel
• 607: 597: don't auto install re2c and bison thanks to @asgrim and @hackel
• 606: 596: fix two packages found for same ext in pie show etc thanks to @asgrim and @hackel

1.4.2

1.4.2

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

bug

• 593: 590: prevent pre-packaged-binary from being used when configure options are passed thanks to @asgrim