bb: starší verze ke stažení

v6.0.0
bb v6.0.0 makes its MCP server one you can hand to an agent without watching every call. It only reads unless you let it write, leaves approving a pull request to you, ends what it publishes with a line saying an AI agent wrote it, and asks you first only when you want it to. A repository you clone can no longer steer bb, and the commands that read a pull request find it from the branch you are on.
It is a major release. Seven changes can break a script, a pipeline or an MCP configuration. They are under "Before you upgrade", each with what to change, and are the part to read first if bb runs in CI, in scripts or under an AI agent. What v5.0.0 deprecated is gone. What this release deprecates keeps working until v7.0.0 and is listed at the end.
New at the command line
- The commands that read a pull request take it from the branch you are on (ADR-102, #766):
In a checkout, bb pr view, bb pr checks, bb pr diff and the other commands that only read one pull request need no number. They read the open pull request from the checked-out branch, as gh pr view does, and name it on stderr. A branch with none, or with several, is refused, naming what was found. In a fork's checkout it is the pull request from the fork into its upstream.
git switch feature/refunds
bb pr checks
- bb pr comment delete deletes a comment or a task (#785):
Bitbucket keeps a task as a comment, so one command removes either. --dry-run says what Bitbucket will do first: a comment with replies, somebody else's comment you do not administer, and a comment that changed since the --version you name are each refused.
bb pr comment delete 42 1389396
- Guides for the jobs people ask about (#774, #775): a How do I section, with running bb in a CI pipeline, setting up the MCP server in each client, and changing many repositories at once.
New in the MCP server
- What an agent writes says an AI agent wrote it (ADR-105, #797):
A pull request description, a comment or a tag message written through the MCP server goes out under your name. bb ends each with a line saying an agent wrote it for you, so the people who read it know who they are answering:
Retries a declined refund once before failing it.
_Written by an AI agent for @alice, via bb._
Where an organisation cannot allow the line, --ai-disclosure=false or mcp_ai_disclosure: false turns it off. The server then publishes nothing the agent wrote under your name at once: it does not offer create_pull_request or update_pull_request, it refuses a tag message, and comments still wait in your review until you publish it.
For administrators
The MCP server's settings, in your own configuration file, and the policy keys that decide them for everyone on a machine:
──────────────────────┬───────────────────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Key │Registry value │Effect
──────────────────────┼───────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
mcp_allow_writes │ │true in your own file lets the server change Bitbucket, as --allow-writes does. The read_only policy keeps it read-only whatever this says.
──────────────────────┼───────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
mcp_elicitation_opt_in│MCPElicitationOptIn│true makes the server ask before each call of a tool that decides a merge, as --elicitation-opt-in does. As policy it requires asking, and false does not switch asking
│ │off.
──────────────────────┼───────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
mcp_ai_disclosure │MCP

v5.0.1
Changes since v5.0.0.
Compare: v5.0.0...v5.0.1
Fixes
- reviewer: predict and refuse what each Bitbucket release does with a condition's reviewers and a DEFAULT_BRANCH matcher (e2b7a3b)
- output: name DEFAULT_BRANCH among the ref matcher types (55adb0d)
Tests
- reviewer: pin each release's condition rules without a server (c596c82)
- live: reach Bitbucket's HTML error page by a path every release answers with one (f261c3e)
- live: stop testing Bitbucket 9.2, which Atlassian no longer supports (c382f63)
Build
- openapi: adopt Bitbucket 10.5: vendor its reference and test against 10.5.0 (4ea9654)
- openapi: keep unset nullable fields out of generated request bodies (9bf7781)
Chores
- deps: Bump atlassian/bitbucket in /docker/harness (f028a35)

v5.0.0
bb v5.0.0 works with every Bitbucket Data Center release Atlassian supports, completes what you type from your own Bitbucket, and makes its MCP server something you work with: it asks you before it merges, takes the pull request or file you hand it, and shows what it found as a view in your client.
It is a major release. Seven changes can break a script, a pipeline or an MCP configuration. They are under "Before you upgrade", each with what to change, and are the part to read first if bb runs in CI, in scripts or under an AI agent. What is deprecated keeps working until v6.0.0 and is listed at the end.
New at the command line
- Every Bitbucket Data Center release Atlassian supports (ADR-088, #307):
bb was built against the newest Bitbucket release and tested against that one alone. It now works with every release Atlassian supports, each tested against a real instance of it, and a release keeps working after Atlassian's support for it ends.
An older release behaves like the newest except where it lacks something a later one added. There bb answers as the newest release would where it can, and otherwise refuses before it sends anything, naming the release that can do it:
$ bb branch restriction create --repo PROJ/app --type no-creates --matcher-id refs/heads/main
unsupported: a no-creates branch restriction is not supported by this Bitbucket version (9.2.1); it needs 9.4.0 or later
Before, Bitbucket accepted such a request and dropped the part it did not know, so a required build meant to spare pull requests blocked every one of them. unsupported, exit 14, is a new error kind: a script that lists the kinds or exit codes it handles gains one. Bitbucket Versions lists the four places where a release differs.
- Tab completion that knows your Bitbucket (ADR-089, #407, #397):
Press tab after bb pr merge and bb lists the open pull requests of the repository you are in, by number and title. After bb branch delete it lists the branches, each with its latest commit message. Projects, repositories, tags, reviewers, file paths and the values a flag accepts complete the same way, read from your Bitbucket with your own credentials, in bash, zsh, fish and PowerShell.
Homebrew and the .deb and .rpm packages set it up for bash, zsh and fish when they install bb, and Scoop sets it up for PowerShell, along with the agent skill. Anywhere else one command does it, and bb doctor says whether it is in place:
bb completion install
- bb pr create needs no flags in a checkout, and bb pr merge takes a strategy (ADR-102, #705):
Standing on a pushed branch, bb pr create is enough. The source is the branch that is checked out, the target is the repository's default branch, and the title is the commit's subject when the branch holds exactly one commit. At a terminal each is offered for you to accept or change. With nobody to ask they are used as they are and named on stderr, and a branch that holds several commits still needs --title. It prints the pull request's link, which every reported pull request now carries as url.
git push -u origin feature/refunds
bb pr create
bb pr merge 42 --strategy squash
--strategy takes any strategy the repository enables, and its default applies without it. --dry-run says so first when the repository has not enabled the one asked for.
- bb search prs takes a period, so it can answer "what did I work on" (#697):
What it lists has not changed. Without --repo that is every pull request you are involved in across every repository, whether you wrote it, are a reviewer on it or took part in it, and --role picks one of the three. What is new is the period: --since and --until bound the listing on the created, updated or closed date that --date-field names, and --group-by week or repo arranges the text output. With --since the listing holds the whole period rather than the first 25.
bb search prs --role author --state all --since 2026-07-20 --until 2026-09-27 --group-by week
- --state takes merged and declined, in bb pr list 

v4.1.0
bb v4.1.0 adds bb doctor for configuration problems and closes most of the remaining gap with gh for pull requests and repositories. It also makes failures say what actually happened: whether a request that never got an answer may have been applied, whether a listing was cut short, and which file or policy refused a command.
It is a minor release with no breaking changes. Most of the behaviour that changes is a fix: v4.0.0's decision records and release notes already specified it, and this release makes the binary keep those decisions everywhere.
Highlights
- bb doctor (ADR-086, #597): Checks the stored, workspace and system configuration files and reports every problem at once:
- schema violations, with their key and line;
- keys a file never reads, such as require_keyring in a user's own file;
- where each effective setting comes from;
- whether a required OS keyring answers.
It needs no Bitbucket host, makes no network call, and exits 1 when there is anything to fix.
- Closer to gh (ADR-050, #575):
- bb pr view, bb pr edit and bb pr close resolve, and bb pr checks shows a pull request's build statuses.
- bb pr ready marks a draft ready for review without asking for its version, and --undo turns it back into a draft (#602).
- bb repo get, also spelled bb repo view, describes a repository and prints its README (#605).
- An interrupted change is no longer reported as safe to retry (ADR-011, #574):
- The problem. Suppose bb creates a pull request or a comment, or merges one, and the connection drops, times out, or a gateway answers 502 before Bitbucket does. Bitbucket may already have applied it. bb used to report that as transient, exit 10, which is the code retry wrappers act on, so a retry could create the same pull request or comment twice.
- Now. Such a failure is unknown_outcome and exits 13, outside the retry range, and the message says to check whether the change landed before sending it again.
- What still exits 10. A failure before the request left the machine, and a delete or an update whose answer is lost: repeating those cannot create a second anything, so bb retries them itself (ADR-009).
- Releases you can verify, and a self-update that stays on https unless you allow otherwise. This matters if you check what you install or mirror releases internally; the steps are in Release Verification.
- Per-archive SBOMs (#584). Each release archive now has its own SBOM, published beside it as <archive name>.spdx.json: the list of every module the binary inside it is built from, which vulnerability scanners and compliance reviews read. The .deb and .rpm are covered by the _noupdate archive's.
- It is generated from that binary, because each platform links different modules.
- It is attested against the archive, so gh attestation verify proves the SBOM describes that archive.
- It replaces the single sbom.spdx.json, which inventoried the build checkout rather than any binary.
- https for update mirrors (ADR-059). bb update fetches release mirrors over https, because over plain HTTP anyone on the network path can read or hold back what the mirror serves.
- A mirror without TLS needs bb update --allow-http or BB_ALLOW_HTTP_UPDATE=1; without one of them the update is refused (exit 2).
- In system policy, allow_http_update: true permits it for every user without the flag, and allow_http_update: false refuses it for every user (exit 3).
- Pinned actions. The workflow that builds and signs releases runs GitHub Actions pinned to exact commits, so a moved tag cannot change what builds the binary.
- Windows and macOS CI. The unit suite runs natively on Windows and macOS as well as Linux.
Fixes: v4.0.0 decisions the binary now keeps everywhere
1. Every destructive delete confirms (ADR-073).
- The rule: destructive commands confirm when a person is present and require --yes when not, and --yes is inert on a repository inferred from the git remote.
- v4.0.0 enforced it for bb repo delete, bb repo admin delete and bb auth gpg-key c

v4.0.0
bb v4.0.0 delivers a stabilized JSON machine contract, credential security hardening, interactive terminal safety guardrails, and full behavioral parity with Bitbucket Data Center.
This release represents a comprehensive overhaul of the CLI's testing and contract foundation (ADR-079). By replacing internal unit simulation mocks with live integration verification against real Bitbucket Data Center instances, dozens of latent defects have been resolved across pull request lifecycles, result pagination, and permission models.
Key Architectural Highlights
- Native Server CODEOWNERS Evaluation (ADR-080): Rather than relying on an internal regex-based parser that drifted from Bitbucket's rules, bb now queries Bitbucket's native UI evaluation endpoint (/rest/ui/latest/.../code-owners). This guarantees 100% parity with reviewer assignments in the Bitbucket Web UI.
- Unified Paging Engine (ADR-074): All 18 internal service packages now walk pages through a unified engine (openapi.PageThrough). --limit now strictly caps the total number of items returned across all commands (permissions, comments, diffs, commits, branches), and --all is available to fetch entire sets.
- Global Dry-Run Confidence Tiers (ADR-078): All 41 mutating commands report dry-run predictions tagged with a declared confidence tier (certain, projected, or unsupported), validated against real permission matrices.
- Full Webhook Field Parity (#522): Webhook commands now support all 9 Bitbucket API fields (including SSL verification, active status, and secrets) with automatic secret redaction on stdout.
Upgrading to v4: Automation & Scripting Checklist
If you consume bb inside CI/CD pipelines, shell scripts, or AI agent toolchains, review this checklist before upgrading:
1. Audit JSON Parsers (jq, Python) for camelCase & Envelope Changes:
- All machine output fields now match Bitbucket REST API camelCase (e.g. pullRequestId, projectKey, repoSlug).
- meta.contract and contract version numbers have been removed; the CLI binary version is now reported under meta.version.
- On failure, --json emits only a single error envelope to ensure clean stream decoding (ADR-075).
2. Migrate Command-Line Credential Flags:
- --token and --password CLI flags are retired to prevent secret exposure in process tables and shell histories.
- Supply credentials via environment variables (BB_TOKEN, BITBUCKET_TOKEN), the system keyring (bb auth login), or standard input (--token-stdin, --password-stdin).
3. Account for Non-Interactive Guardrails in CI/CD:
- Destructive commands (bb repo delete, bb auth gpg-key clear) now fail immediately if run in a non-interactive pipeline without --yes.
- bb repo delete requires an explicit repository argument (PROJECT/slug or --repo) and will not delete a git-inferred working repository.
- Implicit stdin reads now require an explicit - (e.g. bb repo edit file.txt --content -). Pass --no-input to guarantee scripts never hang on prompts.
4. Update Exit Code Handling:
- Invalid arguments and missing required flags now return exit code 2 (validation), rather than exit code 1 (internal).
- Transient network failures in --dry-run return exit code 10 (transient), matching real executions.
5. Update Go Module Import Paths (Go Developers):
- The Go module path has been renamed to github.com/vriesdemichael/bitbucket-data-center-cli (#459).
The complete list of breaking changes, commit references, and full change ledger is itemized below.
Changes since v3.5.2.
Compare: v3.5.2...v4.0.0
⚠ Breaking Changes
- refuse a default branch that does not exist (0ccc14f) — branch default set and branch model update now fail with exit 2 when the named branch does not exist in a repository that has branches. Previously the value was accepted and written.
- stop counting a --dry-run invocation as live command reach (874989b) — docs/quality/command-reach.json is version 2. It gains known_dry_run_only and summary.dry_run_only_commands, and covered_commands drops from 233 to 217 fo

v3.5.2
Changes since v3.5.1.
Compare: v3.5.1...v3.5.2
Fixes
- repo: make the archive close failure reachable in test (2a229c2)
Docs
- adr: record the next branch and that only main releases (bbb4e0f)
- adr: record where linear history is enforced, and stop quoting figures (c1d881a)
- adr: record what the quality apparatus measures, and enforce gate parity (c84030a)
CI
- run on the next integration branch (367ebd8)
- stop Codecov searching for coverage in languages this repo does not use (0c01087)
- stop the Bitbucket stack step writing 9,900 lines of terminal redraw (818b692)
- add linting and vulnerability scanning, take unit tests off the live path (4c0f1c1)
Chores
- lint: clear the golangci-lint baseline and turn the gate on (ebb12c9)
- quality: delete contract coverage, rename command reach, split the CI jobs (80ccdc4)

v3.5.1
Changes since v3.5.0.
Compare: v3.5.0...v3.5.1
Fixes
- tools: stop operation-path scanning from reading other branches' checkouts (378788c)
- config: validate update_tuf_url properly and name the lever that disabled self-update (a261dbb)
Refactors
- config: make the policy origin naming testable on every platform (8c72a31)
Tests
- live: assert the update killswitch message names its lever (332f201)
Chores
- ci: align the local gate list with CI and compile the live tests locally (d1f53dd)

v3.5.0
Changes since v3.4.0.
Compare: v3.4.0...v3.5.0
Features
- update: verify releases offline and gate update trust to policy (c171d75)
Fixes
- config: stop the environment from relocating administrative policy (f075d81)

v3.4.0
Changes since v3.3.2.
Compare: v3.3.2...v3.4.0
Features
- mcp: scope the server to a project or repository and log tool invocations (bd50d08)
- mcp: adopt the official MCP SDK and give tools an output contract (d2acc90)
Tests
- mcp: drive the server surface in the live suite (3b4c302)

v3.3.2
Changes since v3.3.1.
Compare: v3.3.1...v3.3.2
Fixes
- update: apply system TLS policy to the update path (fb3a2b1)
CI
- release: publish noupdate binaries for package managers (#445) (b7e04cb)

v3.3.1
Changes since v3.3.0.
Compare: v3.3.0...v3.3.1
Fixes
- update: provide clean human-friendly output on update (b2c02f3)

v3.3.0
Changes since v3.2.0.
Compare: v3.2.0...v3.3.0
Features
- pr: support inline comments and replies in pr comment add (#442) (2912851)
- webhook: add create and delete subcommands (#440) (4df0d02)
Fixes
- cli: correct inline anchors, --host targeting, and MSYS2 path recovery (ea62a5c)
- api: detect HTML login responses, sanitize mangled MSYS2 paths, and support --host (#441) (0718daf)
Tests
- commentanchor: cover the shared anchor rules directly (d4f826a)

v3.2.0
Changes since v3.1.0.
Compare: v3.1.0...v3.2.0
Features
- transport: support mutual TLS (mTLS) client certificate authentication (#422) (49e9f51)
Fixes
- config: restrict mTLS schema properties to host profile scope (47791ba)
Chores
- deps: bump the gomod-minor-patch group with 3 updates (ee2600b)
- deps: bump mkdocs-macros-plugin (8b9c3a7)

v3.1.0
Changes since v3.0.0.
Compare: v3.0.0...v3.1.0
Features
- config: system-wide policy enforcement and enterprise update controls (b2d3a4e)
Docs
- inject the release version at build time instead of pinning it (7c38b00)
Tests
- live: exercise SaveLogin in live keyring warning test (92224b7)
- live: remove unused io import and streamline keyring live test (651b05c)
- live: fix policy warning writer capture in live keyring test (b226df0)
- live: add live tests for auth login, raw api, and keyring policy enforcement (537209c)
- live,config: add enterprise policy live tests and expand coverage (910cac6)
Build
- release: publish version-less asset aliases so install docs name no version (43bdd1e)

v3.0.0
Changes since v2.13.0.
Compare: v2.13.0...v3.0.0
⚠ Breaking Changes
- derive the vendored spec from the harness release and bump to 10.4 (c23a071)
Features
- openapi: derive the vendored spec from the harness release and bump to 10.4 (c23a071)
Docs
- openapi: record what each fix's cause is, and whether it was re-observed (25fd950)
Tests
- cli: assert every command's permission requirement and that refusal stops it (0522914)
Chores
- docs: sync documented release version to 2.13.0 (b62fd78)

v2.12.0
Changes since v2.11.0.
Compare: v2.11.0...v2.12.0
Features
- docs: enforce latest release version across documentation (149bcf3)

v2.11.0
Changes since v2.10.0.
Compare: v2.10.0...v2.11.0
Features
- cli: enforce NoArgs on zero-arg commands and harden docs-lint (b376695)
Fixes
- docs-lint: regex tool extraction, LaTeX check, and summary formatting (4a264e5)
Docs
- site: fix mermaid rendering and refine verification commands (569ff7c)
- site: address peer review on runbook and threat model (ce7e8b2)
- site: refine fleet runbook and multi-OS threat model (ec46f77)
- site: add enterprise hardening guide and threat model (9eeba7f)
Tests
- cli: add unit tests for positional placeholder checks and enforceNoArgsDefaults (45aa407)

v2.10.0
Changes since v2.9.1.
Compare: v2.9.1...v2.10.0
Features
- ai: add dedicated skill for bulk operations and enhance skill CLI commands (7e4dbfa)
Docs
- document flexible URL, branch, and hash resolution for PRs and repos (5dd7ebf)
- align developer cheatsheet with human workflows and expand agent skill workflows (cf00e9f)
- site: add developer cheatsheet and common workflows cookbook (2921702)
Chores
- deps: bump github.com/google/go-containerregistry (7218f2f)

v2.9.1
Changes since v2.9.0.
Compare: v2.9.0...v2.9.1
Fixes
- mcp: decide structuredContent shape on encoded bytes (57c7a68)
- mcp: wrap slice structuredContent as JSON object (b344c0c)
Chores
- deps: bump the gomod-minor-patch group with 13 updates (0eb6cb4)
- deps: bump the gomod-minor-patch group across 1 directory with 3 updates (a1af93d)
- deps: bump github.com/go-openapi/swag from 0.28.0 to 0.29.0 (66f250e)
- deps: bump github.com/go-openapi/swag/cmdutils (69cbfb5)
- deps: bump github.com/go-openapi/swag/netutils (d566417)
- deps: bump github.com/mattn/go-runewidth (804046a)

v2.9.0
Changes since v2.8.0.
Compare: v2.8.0...v2.9.0
Features
- cli: enhance gh-style ergonomics and formalize non-interactive contract (#392) (51e15b2)

v2.8.0
Changes since v2.7.3.
Compare: v2.7.3...v2.8.0
Features
- api: add bb api raw REST passthrough escape hatch (#330) (c9fdcc4)

v2.7.3
Changes since v2.7.2.
Compare: v2.7.2...v2.7.3
Fixes
- dryrun: exhaustively classify commands and prevent fail-open on auth gpg-key clear (#391) (8b0639a)
Chores
- ci: restore patch coverage threshold to 85% (8849281)

v2.7.2
Changes since v2.7.1.
Compare: v2.7.1...v2.7.2
Fixes
- test: align live pagination schemas and error taxonomy assertions (911d676)
- test: extract PR version with zero fallback in live PR suites (a741cfa)
- test: pass expected version parameter on PR transition commands in live suites (202c9f5)
- test: align PR state machine steps with Bitbucket author restrictions (322a372)
- test: remove unused imports in pr state machine live test (cf1ceea)
- test: use harness branch push and clone verification in live PR tests (e95940e)
- test: configure git identity in temporary repos before committing in live tests (31ca3d4)
- test: correct branch create and pr create flag bindings in live integration suites (c5cb91e)
- live: fix live test compilation imports and admin user env resolution (04711b4)
Refactors
- cli: modularize command tree into domain packages per ADR-032 (#337) (7d9e149)
Docs
- adr: sharpen ADR-052 with client-side algorithm testing policy (1ed8033)
- adr: add ADR-052 on layer-boundary testing and mock elimination (070451b)
Tests
- ci: adjust patch coverage threshold to 75% for command tree modularization (644cf44)
- cli: add defaults and validation tests for browse, update, tag, sshkey, and webhook (607615a)
- cli: expand unit tests across project, repo, pr, branch, and diff commands (9aa9b0a)
- cli: expand unit test coverage for reviewer, sshkey, tag, webhook, and ref command packages (3ca96aa)
- cli: expand unit test coverage for repo command package (0b6412c)
- cli: expand unit test coverage for branch command package (199a145)
- cli: expand unit test coverage for pull request command package (fa690da)
- cli: expand unit coverage for commit and diff command packages (b7c4ca3)
- cli: expand unit coverage for build status and code insights commands (8bd6f69)
- cli: add unit test coverage for repo comments, misc, ref, and tag commands (30a73e5)
- cli: expand unit coverage for reviewer, reviewergroup, repo, pr, and branch commands (eebdeeb)
- expand live reviewer governance suite and unit coverage across CLI command packages (e3f2498)
- live: add error taxonomy, stream pagination, PR lifecycle, git wire roundtrip, and webhook ping suites (4cc1f5d)
- cli: add property-based fuzz tests for repo selector and git URL parsers (b12932d)
- live: eliminate masked t.Skip calls and fix required build check schema in live tests (defa8f4)
- services: prune pass-through mock-echoing tests across services per ADR-052 (3d0bcc8)
- services: prune pass-through mock-echoing tests from branch and comment services per ADR-052 (60ec7d9)

v2.7.1
Changes since v2.7.0.
Compare: v2.7.0...v2.7.1
Fixes
- auth: stop alias discovery and login from deleting stored aliases (6425afe)

v2.7.0
Changes since v2.6.2.
Compare: v2.6.2...v2.7.0
Features
- pr: replace the dead pr task commands with comment resolve/reopen (32e14e4)
Tests
- pr: cover the error paths on comment resolve and reopen (1bd3eb6)
Chores
- deps: bump github.com/oapi-codegen/runtime (b6b2a8b)

v2.6.2
Changes since v2.6.1.
Compare: v2.6.1...v2.6.2
Fixes
- webhook: make update mean update, and agree on one output shape (449f362)
- remove server-side hook management (258cd43)
- repair six commands that had never worked against a real server (6457b0b)
- webhook: send the url the test endpoint requires (5d8d926)
Docs
- openapi: register the webhook test url divergence (4cf4036)
Tests
- live: cover the auth surface (532bbe8)
- live: cover pull request inspection, and confirm pr task is dead (a28153b)
- live: correct batch 1 against a real Bitbucket (0f09c76)
- live: cover deployments, webhooks, repo policies, search and labels (f21c2ad)

v2.6.1
Changes since v2.6.0.
Compare: v2.6.0...v2.6.1
Fixes
- pr: arm auto-merge through the merge endpoint (b05afe7)

v2.6.0
Changes since v2.5.0.
Compare: v2.5.0...v2.6.0
Features
- auth: make bb auth status verify the setup instead of describing it (daf6d8a)
Fixes
- auth: treat the git credential helper as advisory, not a failure (01be204)
Docs
- document proxies, TLS and the environment variable surface (944909b)
- add issue and pull request templates (d1c13ff)
Tests
- auth: inject the git backend the status check reads (6dcdec3)
- live: fail fast when the local SDK licence has expired (c696da2)
Build
- drop the python3 dependency from the bootstrap script (d872e37)
CI
- release: publish and attest an SBOM with every release (27d4084)
Chores
- deps: bump github.com/go-openapi/loads (20f1d48)

v2.5.0
Changes since v2.4.0.
Compare: v2.4.0...v2.5.0
Features
- pr: add bb pr checkout (263134a)
Fixes
- pr: supply credentials to the checkout fetch (90272e1)
Tests
- pr: fix the dirty-tree assertion in the live checkout test (a6ba2cd)
- pr: clear the whole credential fallback chain in checkout tests (d815461)
- stop the suite waiting on backoff and DNS (024ae1d)

v2.4.0
Changes since v2.3.0.
Compare: v2.3.0...v2.4.0
Features
- cli: shallow permission aliases and bb pr status (fa279e6)

v2.3.0
Changes since v2.2.1.
Compare: v2.2.1...v2.3.0
Features
- pr: add bb pr diff as a gh-shaped alias for bb diff pr (250893c)

v2.2.0
Changes since v2.1.0.
Compare: v2.1.0...v2.2.0
Features
- cli: report limit_reached in the JSON envelope for list commands (c4c090e)

v2.1.0
Changes since v2.0.7.
Compare: v2.0.7...v2.1.0
Features
- cli: unify --limit across list commands and add --all (b92ed81)
Fixes
- pr: cap bb pr list results at --limit (0484696)
Tests
- cli: cover the paging helper and the oversized-page trim (4dca30b)
Chores
- deps: bump pygments from 2.19.2 to 2.20.0 in /docs (b7a57c0)
- deps: bump actions/upload-artifact from 4 to 7 (9c767ff)

v2.0.7
Changes since v2.0.6.
Compare: v2.0.6...v2.0.7
Fixes
- ai: drop the last version-accuracy claim from the skill (43c7aae)
- ai: surface MCP tool gating and stop the skill overstating itself (c1009c1)
Docs
- ai: state that the MCP server is optional in the skill (9166d50)
- ai: lead the skill install options with the offline path (77591be)
Chores
- deps: bump golang.org/x/mod in the gomod-minor-patch group (255a571)

v2.0.6
Changes since v2.0.5.
Compare: v2.0.5...v2.0.6
Fixes
- docs: validate documented bb invocations against the command tree (ecec3ca)
Docs
- record that tools/ stays out of the coverage gate but gets tests (611d6e5)
Chores
- pin line endings to LF and enforce formatting (5161a68)

v2.0.5
Changes since v2.0.4.
Compare: v2.0.4...v2.0.5
Fixes
- auth: decide plaintext storage from the credential in use, not AuthSource (15db240)
- auth: keep credentials off the command line and make keyring storage enforceable (22cca3b)

v2.0.4
Changes since v2.0.3.
Compare: v2.0.3...v2.0.4
Fixes
- json: classify malformed invocations as validation (2d90001)
- json: emit an error envelope on the --json failure path (46a73cf)
CI
- compute coverage instead of committing it (b42766e)

v2.0.3
Changes since v2.0.2.
Compare: v2.0.2...v2.0.3
Fixes
- auth: stop writing credentials into cloned repositories (e0a014d)
- openapi: decode createdDate as epoch milliseconds (8b07377)
Docs
- add SECURITY.md, CONTRIBUTING.md and CODE_OF_CONDUCT.md (cd61906)
CI
- deps: gate Dependabot auto-merge on update type (93651eb)
- release: release only user-visible change types (291e8ca)
- stack: provision the live test instance via the Atlassian Plugin SDK (15104d4)
Chores
- deps: bump idna from 3.11 to 3.15 in /docs (5440467)
- deps: bump requests from 2.32.5 to 2.33.0 in /docs (98eb62a)
- deps: bump pymdown-extensions from 10.21 to 11.0.1 in /docs (b5b82db)
- deps: bump urllib3 from 2.6.3 to 2.7.0 in /docs (510f36e)
- deps: bump the gomod-minor-patch group with 5 updates (29537ab)

v2.0.2
Changes since v2.0.1.
Compare: v2.0.1...v2.0.2
Chores
- deps: bump the gomod-minor-patch group with 2 updates (66eb52f)
- deps: bump github.com/xo/terminfo (ffecfb4)
- deps: bump github.com/go-openapi/validate (7bf9238)
- deps: bump the gomod-minor-patch group with 2 updates (4c91d0e)
Other
- Restore Codecov ingestion after the repository rename (46f34d9)

v2.0.1
Changes since v2.0.0.
Compare: v2.0.0...v2.0.1
CI
- scripts: fix WebSudo endpoint, parameters, and temp file creation in bootstrap (b75dbaa)
- scripts: use basic auth and websudo fallback when enabling basicauth in bootstrap (c1ebff7)
Other
- bump bitbucket image version to 10.4.2 (6bd836e)
- update sed pattern to handle spaces in build.properties (4683ba1)
- fix build.timestamp format and set build.commit.timestamp in Dockerfile (44e2ed5)
- bump bitbucket image to 10.3.0 and patch build.timestamp (0d3a7e4)

v2.0.0
Changes since v1.38.2.
Compare: v1.38.2...v2.0.0
⚠ Breaking Changes
- vendor the Bitbucket 10.2 OpenAPI spec (52320e8) — models generated from the 10.2 spec expose required fields as
- surface unresolved PR comments and tasks to agents (52d9882) — bb pr comment list --json emits a summarised thread view
Features
- vendor the Bitbucket 10.2 OpenAPI spec (52320e8)
- surface unresolved PR comments and tasks to agents (52d9882)
Fixes
- openapi: make generated client reproducible and unblock newer specs (a032c9b)
Tests
- git: fail tests that reconfigure the repository they run inside (689168c)
- quality: gate CLI commands on live coverage that can actually fail (9423937)
Chores
- quality: refresh coverage artifacts for the ambient git config guard (8f84078)
- quality: refresh coverage artifacts for the Bitbucket 10.2 spec (1a59ba9)
- quality: refresh generated coverage artifacts (395b914)
- deps: bump the gomod-minor-patch group with 4 updates (8c28a4f)
- deps: bump the gomod-minor-patch group with 4 updates (b34b039)

v1.38.2
Changes since v1.38.1.
Compare: v1.38.1...v1.38.2
Docs
- track the newest containerisable Bitbucket version instead of a pin (fde0dc7)

v1.38.1
Changes since v1.38.0.
Compare: v1.38.0...v1.38.1
Fixes
- git: scope git subprocesses by working directory, not ambient GIT_DIR (3a646c5)
Chores
- deps: bump github.com/lucasb-eyer/go-colorful (52f22fe)

v1.38.0
Changes since v1.37.3.
Compare: v1.37.3...v1.38.0
Features
- enhance MCP tools, fix browse raw path encoding, and improve PR reviewer handling (91e0168)
Fixes
- browse: correct tree path encoding and browse content negotiation (e972e6a)
- browse: escape file path segments and share the raw transport path (31b20e9)
Chores
- quality: refresh spec coverage artifact for the browse transport move (fa96c35)
- deps: bump the gomod-minor-patch group with 4 updates (8a42e62)
- deps: bump github.com/sigstore/sigstore-go (95a8e0c)
- deps: bump the gomod-minor-patch group with 2 updates (32cb1c2)
- deps: bump github.com/letsencrypt/boulder (9569427)
- deps: bump the gomod-minor-patch group with 14 updates (d29b5c9)
- deps: bump go.yaml.in/yaml/v3 in the gomod-minor-patch group (9d41a80)
- deps: bump the gomod-minor-patch group with 4 updates (1a9ef05)
- deps: bump the gomod-minor-patch group with 2 updates (bbbe880)
- deps: bump the gomod-minor-patch group with 18 updates (80bcbdd)
- deps: bump the gomod-minor-patch group with 12 updates (8eb3b74)
- deps: bump actions/setup-python from 6 to 7 (0388c2f)
- deps: bump mkdocs-material (fd63092)
- deps: bump the gomod-minor-patch group with 5 updates (b7baaed)
- deps: bump google.golang.org/grpc in the gomod-minor-patch group (213642b)
- deps: bump actions/setup-go from 6 to 7 (653fafd)
- deps: bump github.com/letsencrypt/boulder (03374e1)
- deps: bump github.com/oapi-codegen/runtime (584c072)
- deps: bump github.com/mark3labs/mcp-go (b463fce)
- deps: bump the gomod-minor-patch group with 7 updates (2c99e9e)
- deps: bump github.com/go-openapi/jsonreference (116cbab)
- deps: bump github.com/go-openapi/jsonpointer from 0.24.0 to 1.0.0 (aaa13b3)
- deps: bump the gomod-minor-patch group with 2 updates (656c7e6)
- deps: bump the gomod-minor-patch group with 2 updates (0cb2f50)
- deps: bump github.com/sigstore/rekor (eee744b)

v1.37.3
Changes since v1.37.2.
Compare: v1.37.2...v1.37.3
Fixes
- auth: resolve user identity using X-AUSERNAME header (0e67ae0)

v1.37.2
Changes since v1.37.1.
Compare: v1.37.1...v1.37.2
Fixes
- clone: support user namespaces (tilde) in repository selectors and clone URLs (1f85343)
Chores
- deps: bump the gomod-minor-patch group with 2 updates (eaee5a3)
- deps: bump the gomod-minor-patch group with 14 updates (12d4aae)
- deps: bump the gomod-minor-patch group with 2 updates (44752aa)
- deps: bump github.com/mark3labs/mcp-go (592a14e)
- deps: bump github.com/letsencrypt/boulder (f363d8a)
- deps: bump the gomod-minor-patch group with 3 updates (28b4375)
- deps: bump actions/checkout from 6 to 7 (96ba673)

v1.37.1
Changes since v1.37.0.
Compare: v1.37.0...v1.37.1
Chores
- deps: update docs lockfile (3642db1)
- repo: update references to bitbucket-data-center-cli (1958c70)
- deps: bump github.com/google/go-containerregistry (f160235)

v1.37.0
Changes since v1.36.0.
Compare: v1.36.0...v1.37.0
Features
- dryrun/docs: update target to Bitbucket Data Center and validate dry-run coverage (closes #248, closes #259) (b9b9cdd)

v1.36.0
Changes since v1.35.2.
Compare: v1.35.2...v1.36.0
Features
- webhook: add repo webhook listing and service-layer pagination limit/start controls (438dca9)
Docs
- regenerate CLI command reference with webhook list and start flags (a991390)
Chores
- deps: bump github.com/mark3labs/mcp-go (7cb74bb)
- deps: bump github.com/letsencrypt/boulder (754f538)
Other
- update coverage profiles and reports for Issues 254 and 255 (f690ad5)

v1.35.2
Changes since v1.35.1.
Compare: v1.35.1...v1.35.2
CI
- release: remove failing AUR publishing job (6d4d2f2)

v1.35.1
Changes since v1.35.0.
Compare: v1.35.0...v1.35.1
Fixes
- release: expand env vars in nfpm contents src (0a02526)
Chores
- deps: bump github.com/go-openapi/spec (284e1bd)

v1.21.0
Changes since v1.20.1.
Compare: v1.20.1...v1.21.0
Features
- pr: add --draft flag and auto-merge commands (24d33ed)
Fixes
- pr: support --dry-run for pr auto-merge enable/disable (e15fae9)
Docs
- skill: document draft PRs and auto-merge in bb skill (c9d7667)
Tests
- pr: cover draft flag and auto-merge CLI commands (6a88ee3)
Other
- pr: gofmt CreateInput alignment and trailing newline (000b08b)

v1.20.1
Changes since v1.20.0.
Compare: v1.20.0...v1.20.1
Fixes
- use POST /participants instead of PUT /participants/{userSlug} for adding reviewers (60b28ca)
Tests
- update CLI reviewer-add mock to POST /participants (5f7c00c)

v1.20.0
Changes since v1.19.2.
Compare: v1.19.2...v1.20.0
Features
- pr: add --reviewers flag to pr create command (0e55bc0)
Refactors
- pr: align --reviewers flag with repo conventions and document (b358fa1)
Tests
- mcp: cover parseCommaList reviewer parsing (d68a303)
Chores
- deps: bump the gomod-minor-patch group with 5 updates (6886b88)
- deps: bump github.com/sigstore/sigstore (945f9d6)
- deps: bump the gomod-minor-patch group with 5 updates (2c9dce0)
- deps: bump the gomod-minor-patch group with 8 updates (fad3b8b)
- deps: bump the gomod-minor-patch group with 3 updates (a55d61b)
- deps: bump the gomod-minor-patch group with 4 updates (54a0874)
- deps: bump the gomod-minor-patch group with 2 updates (105b38d)
- deps: bump the gomod-minor-patch group with 2 updates (0694f0d)
- deps: bump the gomod-minor-patch group with 2 updates (4a6e0e8)
- deps: bump github.com/letsencrypt/boulder (9b22f17)
- deps: bump github.com/mark3labs/mcp-go (3f50ddb)
- deps: bump the gomod-minor-patch group with 6 updates (74d9916)
- deps: bump sigstore/cosign-installer from 4.1.1 to 4.1.2 (dba7da4)
- deps: bump github.com/mark3labs/mcp-go (9d4df33)
- deps: bump the gomod-minor-patch group with 4 updates (26c39de)
- deps: bump google.golang.org/grpc in the gomod-minor-patch group (abbb82a)
- deps: bump github.com/mark3labs/mcp-go (3cfebbd)
- deps: bump github.com/go-openapi/strfmt (8e4a3c4)
- deps: bump github.com/letsencrypt/boulder (7fa8082)
- deps: bump the gomod-minor-patch group with 7 updates (a6b0fc6)
- deps: bump the gomod-minor-patch group with 33 updates (e3035dc)

v1.19.2
Changes since v1.19.1.
Compare: v1.19.1...v1.19.2
Chores
- dependabot: configure updates for indirect deps and docker-compose (3fdd88f)
- deps: bump github.com/mark3labs/mcp-go (c106f12)
- deps: bump github.com/go-openapi/runtime (2582a5b)
- deps: bump the gomod-minor-patch group with 2 updates (85bbdc2)

v1.19.1
Changes since v1.19.0.
Compare: v1.19.0...v1.19.1
Chores
- dependabot: ignore bitbucket image updates (6e3e486)

v1.19.0
Changes since v1.18.12.
Compare: v1.18.12...v1.19.0
Features
- update: add background Windows self-update (7c7fffe)
Fixes
- update: address review feedback (02d4ad2)
Tests
- update: raise Windows patch coverage (3b42d68)
- update: cover Windows swap launcher helpers (9b23380)

v1.18.12
Changes since v1.18.11.
Compare: v1.18.11...v1.18.12
Chores
- deps: bump codecov/codecov-action from 4 to 6 (52c113a)
- deps: bump github.com/sigstore/sigstore-go from 0.6.2 to 1.1.4 (139c634)
- deps: bump actions/checkout from 4 to 6 (7215a62)
- deps: bump actions/github-script from 7 to 9 (daa2001)

v1.18.11
Changes since v1.18.10.
Compare: v1.18.10...v1.18.11
Chores
- deps: bump actions/setup-go from 5 to 6 (ac3abdb)
- deps: bump the gomod-minor-patch group with 6 updates (047d40f)
- deps: bump actions/setup-python from 5 to 6 (7dd2dd7)

v1.18.10
Changes since v1.18.9.
Compare: v1.18.9...v1.18.10
Fixes
- ci: merge clean dependabot prs directly (e83bb71)

v1.18.9
Changes since v1.18.8.
Compare: v1.18.8...v1.18.9
Fixes
- ci: re-enable basic auth after bootstrap (fb1d6dd)
- ci: retry apt metadata refresh in faketime build (64fdddc)
- update: support Bitbucket 10.2.1 and sigstore-go 1.1.4 (9c90a98)
Docs
- update: clarify bootstrap license fallback comment (30d506b)

v1.18.8
Changes since v1.18.7.
Compare: v1.18.7...v1.18.8
Chores
- deps: bump actions/upload-artifact from 4 to 7 (14f708f)
- deps: bump sigstore/cosign-installer from 3.8.1 to 4.1.1 (7075c7e)
- deps: bump actions/attest-build-provenance from 2 to 4 (d92ad1d)
- deps: bump actions/download-artifact from 4 to 8 (df7253d)
- deps: bump the python-docs-minor-patch group (e8a16b6)
- deps: bump the gomod-minor-patch group with 6 updates (038b5fe)

v1.18.7
Changes since v1.18.6.
Compare: v1.18.6...v1.18.7
Chores
- deps: bump astral-sh/setup-uv from 5 to 7 (3281d8c)

v1.18.6
Changes since v1.18.5.
Compare: v1.18.5...v1.18.6
Fixes
- ci: revalidate dependabot PR state before merge actions (fd3c10f)
- ci: add dependabot auto-merge workflow (4b25cff)

v1.18.5
Changes since v1.18.4.
Compare: v1.18.4...v1.18.5
Fixes
- deps: use uv for docs dependabot updates (ce939d5)
Chores
- deps: add dependabot config (2e5ea16)

v1.18.4
Changes since v1.18.3.
Compare: v1.18.3...v1.18.4
Fixes
- update: accept legacy sigstore bundles (a5c725b)