# Changes for PHP Mode by Version

All notable changes of the PHP Mode 1.19.1 release series are documented in this file using the [Keep a CHANGELOG](https://keepachangelog.com/) principles.

## Unreleased

### Added

 * `php-project-get-root-dir` falls back to `project-current` when no PHP-specific marker is found, so `project.el` backends (Projectile 3, `project-vc-extra-root-markers`, etc.) can contribute project detection
 * Add `php-ide-set-feature` command to interactively enable a PHP-IDE feature for the current buffer
   * Only offers features whose backing package is actually available
 * Add `php-ide-status` command to report the current PHP-IDE state for the current buffer
   * Shows whether it is on, what is configured, and what is available
 * Add `php-ide-eglot-activate`, which registers `php-ide-eglot-executable` into `eglot-server-programs`
   * Buffer-local, so only buffers that set the variable are affected; previously the variable had no effect on Eglot at all
 * Add `php-cc-mode` as a forward-compatible alias for the CC Mode based `php-mode`
   * Lets configuration and third-party code refer to the CC Mode implementation by the name it will keep once `php-mode` becomes cc-mode independent; loading it has no effect on `php-mode` itself
   * `php-cc-mode-hook`, `php-cc-mode-lineup-cascaded-calls` and `php-cc-mode-enable-backup-style-variables` are provided as aliases of their current `php-mode-*` counterparts

### Changed

 * Add `readonly` class modifier to [Imenu] ([#802])
 * Add `enum` support to `php-current-class` ([#802])
 * Remove hardcoding of implicit paths in `php` that are not guaranteed to exist ([#803])
 * `php-ide-turn-on` no longer errors when `php-ide-features` is unset
   * It is now a silent no-op, matching the README's `hack-local-variables-hook` recipe, which previously errored on every PHP file until a feature was configured
 * `php-ide-features` now also accepts a bare feature symbol, not just a list
   * This was already shown (but not actually supported) in `php-ide.el`'s own Commentary
 * Restrict `:safe` on `php-ide-features`/`php-ide-eglot-executable`, and drop `:safe` from `php-ide-mode-functions` entirely
   * Previously these let a `.dir-locals.el` silently run an attacker-chosen command or Lisp function without Emacs's usual confirmation; now only PHP-IDE's own known feature symbols and bundled executable presets are accepted
   * **If you now get prompted** by a `.dir-locals.el` you wrote and trust yourself (e.g. `php-ide-eglot-executable` set to a raw path/command, or any use of `php-ide-mode-functions`), this is expected — PHP-IDE can no longer vouch for that value as safe.  Answer `!` at the prompt to permanently remember that exact value (all supported Emacs versions), or `+` to trust the whole directory from then on (Emacs 30.1+); see `(info "(emacs) Directory Variables")`.  You can also pre-approve values ahead of time in your own init file via `safe-local-variable-values` / `safe-local-variable-directories`, so you are never prompted even on first visit.
   * `php-ide-mode-functions` was always meant to be configured globally with `add-hook` in your init file (see the Commentary in `php-ide.el`), not set per-project via `.dir-locals.el`.  For per-project behavior, branch on the `FEATURE` argument inside your hook function instead of varying the variable's value by directory.
 * Mark `php-ide-feature-alist` and `php-ide-lsp-command-alist` as risky local variables
   * They decide which command PHP-IDE executes and which functions it calls, and adding an entry to `php-ide-lsp-command-alist` also makes that entry pass the `:safe` check of `php-ide-eglot-executable` — so a project could otherwise have supplied both the command and its own approval.  Risky variables are always confirmed and never remembered as safe
 * `php-ide-mode` now warns when `php-ide-features` enables more than one LSP client at once
   * Activation still proceeds; Phpactor's bridge is not an LSP client and pairs with one without a warning
...
...
