All notable changes to this project are documented here. Versions follow Semantic Versioning. Starting with 1.2.1, release tags have no v prefix.

• block-insecure-code also blocks shell execution functions by default: exec, shell_exec, system, passthru, popen, proc_open, pcntl_exec and create_function in PHP, and new Function(...) in JavaScript/TypeScript. Use --exclude-functions to allow some.
• block-insecure-code only matches global function calls. Method and static calls ($pdo->exec(), obj.eval()) and function definitions are no longer matched, except window.eval(), globalThis.eval() and self.eval().

• forbid-env-files, forbid-dump-files, forbid-log-files and forbid-cache-files: code-free hooks (language: fail) customized with pre-commit's standard files and exclude options. Without customization, they forbid exactly the same files as the block-*-files hooks.
• README: migration guide, and recommended companion hooks (gitleaks for secrets, check-added-large-files, detect-private-key).

• block-env-files, block-dump-files, block-log-files and block-cache-files will be removed in 3.0.0. Their name shows their replacement on every run, and their failure output includes a deprecation note.

• The Python package is renamed ctrlweb_pre_commit_hooks (distribution ctrlweb-pre-commit-hooks), so it no longer shares its name with the official pre-commit/pre-commit-hooks. Hook ids and arguments are unchanged.

• block-debug-statements and block-insecure-code now ignore comments and strings properly instead of cutting each line at the first // or #:
  • Calls after a URL or a # color on the same line are now found ($url = "https://…"; var_dump($x);).
  • Calls inside docblocks, /* */ comments, strings, heredocs and template literals are no longer flagged (echo "use var_dump()";).
  • PHP 8 attributes (#[...]) are not treated as comments.
  • Inline HTML outside <?php ?> and Blade templates are still checked ({{ dd($x) }}, @dd($x)).
  • In diff mode, a line added inside an existing /* */ comment is not flagged.
• block-debug-statements and block-insecure-code can run in parallel on large file sets (require_serial removed).
• All hooks declare minimum_pre_commit_version: 3.2.0, required by stages: [pre-commit].
• Python 3.9 or later is required.

• MIT license.
• CI on Ubuntu and Windows, linting with ruff.

• block-env-files and block-log-files now match file names in any directory (e.g. config/.env, logs/error_log), not only at the repository root.
• --extra-* and --exclude-* values are case-insensitive, and a file matching any --exclude-* value is never blocked (--exclude-prefixes previously had no effect).
• dd no longer matches add( (e.g. $collection->add(...)), and eval no longer matches literal_eval( or $eval(. Pattern names are matched literally.
• block-insecure-code no longer crashes on binary files, and both content hooks no longer crash on files that aren't valid UTF-8 or when printing non-ASCII lines on Windows.
• diff mode works with color.ui=always, reports correct line numbers after a "No newline at end of file" marker, and uses --from-ref/--to-ref in CI.

• block-env-files allows .env.example, .env.sample, .env.dist, .env.template and env.d.ts by default.
• block-dump-files also blocks .sqlite3 files.
• block-debug-statements also checks .mjs, .cjs and .tsx files.
• block-insecure-code only checks PHP and JavaScript/TypeScript files, as documented.

• block-insecure-code hook, blocking eval() calls.

• --check-mode=diff for block-debug-statements, to check only the modified lines.

• --exclude-patterns of block-debug-statements had no effect.

• block-debug-statements hook, blocking var_dump(), print_r(), dd() and console.log() in PHP and JavaScript files.

• block-env-files, block-dump-files, block-log-files and block-cache-files hooks, with --extra-* and --exclude-* arguments.