Update sandermuller/package-boost requirement from ^0.15.0 to ^0.15.0 || ^1.0.0

[dependabot]

Updates the requirements on sandermuller/package-boost to permit the latest version.

Release notes

Sourced from sandermuller/package-boost's releases.

v1.0.0

package-boost-php is now SemVer-stable. The public surface declared in PUBLIC_API.md is locked for the 1.x line:

• the AutoSync composer-hook façade (run / runWithSummary),
• the bin/package-boost-php CLI contract (the gitattributes / lean command names, their options, and exit codes),
• the # >>> package-boost (managed) >>> managed-block marker format.

Everything marked @internal remains free to change.

Breaking

• sandermuller/boost-core constraint narrowed to ^1.0 (from ^0.20 || ^0.21 || ^0.22 || ^0.23), dropping the boost-core 0.x line. boost-core 1.0.0 is a drop-in over 0.23.3 (no API break), so the bump is mechanical — composer require sandermuller/boost-core:^1.0. The surfaces this package consumes (the BoostAutoSync hooks, the BoostBaseCommand @api helpers, the boost.php authoring API) are frozen and unchanged. See UPGRADING.md.

No source/behavior changes — the package's runtime behavior is identical to 0.20.x. This release formalizes the API surface and aligns the dependency floor with boost-core's own 1.0 freeze.

Full Changelog: SanderMuller/package-boost-php@0.20.0...1.0.0

Changelog

Sourced from sandermuller/package-boost's changelog.

1.0.0 - 2026-06-05

package-boost-php is now SemVer-stable. The public surface declared in PUBLIC_API.md is locked for the 1.x line:

• the AutoSync composer-hook façade (run / runWithSummary),
• the bin/package-boost-php CLI contract (the gitattributes / lean command names, their options, and exit codes),
• the # >>> package-boost (managed) >>> managed-block marker format.

Everything marked @internal remains free to change.

Breaking

• sandermuller/boost-core constraint narrowed to ^1.0 (from ^0.20 || ^0.21 || ^0.22 || ^0.23), dropping the boost-core 0.x line. boost-core 1.0.0 is a drop-in over 0.23.3 (no API break), so the bump is mechanical — composer require sandermuller/boost-core:^1.0. The surfaces this package consumes (the BoostAutoSync hooks, the BoostBaseCommand @api helpers, the boost.php authoring API) are frozen and unchanged. See UPGRADING.md.

No source/behavior changes — the package's runtime behavior is identical to 0.20.x. This release formalizes the API surface and aligns the dependency floor with boost-core's own 1.0 freeze.

Full Changelog: SanderMuller/package-boost-php@0.20.0...1.0.0

0.20.0 - 2026-06-04

Changed

• Skill sources moved to directory form (<name>/SKILL.md) — the shape boost-core emits and the reference catalogs all use. The three shipped skills (lean-dist, skill-authoring, writing-file-emitter) are now authored as directories; guidelines stay flat. No consumer impact — boost-core discovers skills by name and the emitted SKILL.md content is unchanged; this is authoring uniformity, and boost-core accepts both forms.
• skill-authoring skill now documents the directory-form rule, and its frontmatter name guidance is corrected for directory-form skills (the name matches the skill's directory, not the literal SKILL filename).

Non-breaking — skill-source layout + authoring guidance. The set of shipped skills, their names, and their emitted output are unchanged.

... (truncated)

Commits

• 848e99a feat!: require boost-core ^1.0 (first stable release)
• 84177a1 Update CHANGELOG
• b15d7eb feat(skills): adopt directory-form skill sources + document the rule
• 75288aa Update CHANGELOG
• 4b89d90 chore(deps): widen boost-core to allow ^0.23
• 80de749 Update CHANGELOG
• cfd1896 feat: declare public API surface (PUBLIC_API.md + @api/@​internal markers)
• 2dcda3a Update CHANGELOG
• 8c81c32 chore(deps): widen boost-core to allow ^0.21 and ^0.22
• 705a1f9 Update CHANGELOG
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)