# Release History

# 4.1.1 (2024-10-29)
* composer.json: Add changelog command (Reedy)
* composer.json: Bump guzzle/guzzlehttp to 7.9.2 (Reedy)
* Use explicit nullable type on parameter arguments (Reedy)

## 4.1.0 (2024-10-17)
* Add remote download/upload support for large file performance (T292322). The
  feature is off by default. Once the server is updated and has allowUrlFiles
  enabled, the client can enable allowUrlFiles to fully enable the feature for
  callers.
* Fix bug in BoxedCommand::inputFileFromStream.
* Require wikimedia/wikipeg 4.0.0.

## 4.0.2 (2024-03-05)
* blubber: create videoscaler variant
* dev: Replace blubberoid with blubber buildkit
* Allow the use of wikimedia/wikipeg 4.0.0

## 4.0.1 (2023-02-20)
* In the Firejail wrapper, fix handling of empty environment variables.
* Fix compatibility with Firejail 0.9.72 and fix a possible sandbox escape by
  passing the whole command string to a shell that runs under Firejail.

## 4.0.0 (2022-11-10)
* Require PHP >=7.4.3, up from 7.2.9.
* Fix OOM in MultipartAction when handling a large request body.
* Compatibility with php8.1: Use ENT_COMPAT on htmlspecialchars.
* Allow the use of wikimedia/wikipeg 3.0.0.

## 3.0.0 (2021-11-04)
* Add RpcClient interface for remote code execution and a LocalRpcClient
  implementation to be used as fallback when Shellbox server is not
  available.
* PSR-18 ClientInterface is now used instead of Shellbox own HttpClientInterface

## 2.1.1 (2022-07-27)
* Loosen guzzlehttp/guzzle requirement.

## 2.1.0 (2021-09-24)
* Roll our own *nix shell escaping function, improving PHP 8 support
  while still protecting against attacks using GBK locales by filtering
  them out of the environment.

## 2.0.0 (2021-08-20)

* Require PHP >=7.2.9, up from 7.2.0.
* Add a "spec" action, which exposes a swagger spec for service-checker.
* Remove non-functional allowlist code (T277981).
* Documentation has been added to <https://www.mediawiki.org/wiki/Shellbox>.

## 1.0.4 (2021-02-26)

* Raise priority of limit.sh if it uses a cgroup (T274942).

## 1.0.3 (2021-02-10)

* Only allow path to limit.sh when command has other allowed paths (T274474).
* build: Exclude config folder from Composer package.

## 1.0.2 (2021-02-07)

* Don't pass through the fake CGI environment to subprocesses.

## 1.0.1 (2021-02-03)

* build: Exclude public_html folder from Composer package.

## 1.0.0 (2021-02-02)

* Initial release.
