chore(deps-dev): bump the pm-toolchain group with 3 updates
Bumps the pm-toolchain group with 3 updates: @unbrained/pm-cli, pm-changelog and pm-ops.
Updates @unbrained/pm-cli from 2026.10.5 to 2026.10.9
Release notes
Sourced from @unbrained/pm-cli's releases.
v2026.10.9
@unbrained/pm-cli2026.10.9Source range: v2026.10.8...v2026.10.9
Changelog
Added
- Fact-preserving SDK table encoding, measured TOON defaults, and complete context budgets (pm-kvxqp1)
Fixed
- GH-1391: Express faithful self-isolating source package gates without tracker redirects (pm-gh1391)
- Native SQLite warnings corrupt strict machine-channel acceptance on Node 24.12 (pm-aiqmgj)
- Reject external test scratch roots beneath an initialized ancestor tracker (pm-runner-ancestor-tracker)
- Scratch lifecycle 15-second wall-clock assertion flakes under default full coverage concurrency (pm-dqej6b)
Other
- Refresh cooldown-eligible jscpd 5.4 duplicate-detection tooling (pm-jscpd-54)
PM Tracker Evidence
Closed pm items in release window: 6 By type: Feature=1, Issue=4, Chore=1 By status: closed=6
Selected release-related tracker items:
- No release-tagged pm items found in the selected window.
v2026.10.8
@unbrained/pm-cli2026.10.8Source range: v2026.10.7...v2026.10.8
Changelog
Fixed
- Name the rejected custom field in extension-field recovery (pm-field-key-recovery)
- GH-1424: Wait safely for contended Git merge-driver configuration (pm-gh1424)
- GH-1390: Keep trusted merge-receipt attribution and committed reconciliation authoritative (pm-gh1390)
- GH-1405: Settle proven abandoned plain-merge receipts without losing provenance (pm-gh1405)
- Declare non-regular transaction preview paths as recoverable SDK refusals (pm-preview-path-refusal)
Other
- Prove native Git lock retry after observed contention in PR1425 (pm-native-git-retry-proof)
- Bound local temp footprint: prune Node compile cache and guarantee smoke/dogfood sandbox cleanup on failure (pm-p5u6)
... (truncated)
Changelog
Sourced from @unbrained/pm-cli's changelog.
2026.10.9 - 2026-10-09
Added
- Fact-preserving SDK table encoding, measured TOON defaults, and complete context budgets (pm-kvxqp1)
Fixed
- GH-1391: Express faithful self-isolating source package gates without tracker redirects (pm-gh1391)
- Native SQLite warnings corrupt strict machine-channel acceptance on Node 24.12 (pm-aiqmgj)
- Reject external test scratch roots beneath an initialized ancestor tracker (pm-runner-ancestor-tracker)
- Scratch lifecycle 15-second wall-clock assertion flakes under default full coverage concurrency (pm-dqej6b)
Other
- Refresh cooldown-eligible jscpd 5.4 duplicate-detection tooling (pm-jscpd-54)
2026.10.8 - 2026-10-08
Fixed
- Name the rejected custom field in extension-field recovery (pm-field-key-recovery)
- GH-1424: Wait safely for contended Git merge-driver configuration (pm-gh1424)
- GH-1390: Keep trusted merge-receipt attribution and committed reconciliation authoritative (pm-gh1390)
- GH-1405: Settle proven abandoned plain-merge receipts without losing provenance (pm-gh1405)
- Declare non-regular transaction preview paths as recoverable SDK refusals (pm-preview-path-refusal)
Other
- Prove native Git lock retry after observed contention in PR1425 (pm-native-git-retry-proof)
- Bound local temp footprint: prune Node compile cache and guarantee smoke/dogfood sandbox cleanup on failure (pm-p5u6)
2026.10.7 - 2026-10-07
Fixed
- GH-1417: Bundle the tested CLI runtime closure for reproducible npm and Bun installs (pm-gh1417)
- GH-1418: Accept real Bun filtered-test execution receipts (pm-gh1418)
- Prose graph census misses valid item identifiers with multiple hyphens (pm-axotea)
- Include body-only references in strict workspace assurance context (pm-jprn58)
- GH-1413: Preserve lossless producer cursors under amount-only output caps (pm-gh1413)
- GH-1414/GH-1415: Restore portable schema and checksum nightly fixtures (pm-gh1414)
- Expose typed explicit-ID duplicate creation conflicts to SDK callers (pm-gh1400)
Security
- Remove vulnerable MCP Apps development client from the locked dependency tree (GHSA-6qxp-vccf-f47h) (pm-mcpoauth)
Other
... (truncated)
Commits
e936784chore(release): cut 2026.10.987d9b02Merge pull request #1427: lossless TOON tables and complete context budgetsd291905fix(output): bound sparse table candidate construction4f4450bfix(output): simplify compaction and preserve heterogeneous row rendering20bc06cfix(output): retain lean JSON aliases and document budget rendering contracts0f58324feat(sdk): preserve nested table facts and bound complete context output5f8ae4dMerge pull request #1426 from unbraind/fix/faithful-package-gates-and-machine...ee46fdbfix(sdk): isolate snapshot acceptance from ambient Git settings7a513ecfix(sdk): preserve isolated package gates and clean machine channels4f3682achore(release): cut 2026.10.8- Additional commits viewable in compare view
Updates pm-changelog from 2026.10.4 to 2026.10.5
Release notes
Sourced from pm-changelog's releases.
pm-changelog v2026.10.5
2026.10.5 - 2026-10-05
Fixed
- Keep installed usage documentation links portable and the dependency-updates table row valid (pmc-mwnu)
Other
- Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (pmc-y0a5)
Changelog
Sourced from pm-changelog's changelog.
2026.10.5 - 2026-10-05
Fixed
- Keep installed usage documentation links portable and the dependency-updates table row valid (pmc-mwnu)
Other
- Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (pmc-y0a5)
2026.9.25 - 2026-09-25
Added
- Add opt-in Dependabot dependency sections so item-less release windows still get notes (pmc-ny9i)
Fixed
- Include extension-registered item types in changelog generation and body previews (pmc-k1oq)
- A publish that npm accepts late is reported as failed and the GitHub Release is skipped on bun mirror lag (pmc-piam)
Other
- Certify pm CLI 2026.9.23 and adopt the guarded pm-ops merge-driver launcher (pmc-pcax)
2026.9.23 - 2026-09-23
Other
- Certify pm CLI 2026.9.21 and install merge drivers through the canonical pm-ops launcher (pmc-psin)
2026.9.18 - 2026-09-18
Other
- Certify pm CLI 2026.9.17 (pmc-r1qu)
2026.9.15 - 2026-09-15
Fixed
- Include configured custom item types in changelog generation and export (pmc-vnke)
2026.9.13 - 2026-09-13
Other
... (truncated)
Commits
f241332Release pm-changelog v2026.10.53e31f7bKeep installed usage documentation links portable and the dependency-updates ...2c061fcAuto-merge green Dependabot updates and group the pm toolchain into one daily...564cc39Certify pm-changelog on PM CLI 2026.10.4 and consolidate pending dependency u...- See full diff in compare view
Updates pm-ops from 2026.10.5 to 2026.10.6
Release notes
Sourced from pm-ops's releases.
pm-ops v2026.10.06
Changelog
2026.10.5 - 2026-10-05
Fixed
- Cover .tsx, .mts and .cts sources in the docstring and duplication gates, excluding ambient .d.mts/.d.cts declarations (ops-zq8c)
Other
- Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (ops-k1lf)
2026.9.29 - 2026-09-29
Fixed
- Release completeness audit fails a release it just created because the GitHub Release list lags creation (ops-eys5)
2026.9.28 - 2026-09-28
Fixed
- Hoisted broken pm-ops can bypass merge-driver install guard (ops-jzp5)
2026.9.26 - 2026-09-26
Fixed
- A publish that npm accepts late is reported as failed and the GitHub Release is skipped on bun mirror lag (ops-ssnr)
- The guarded launcher template reads a pm-ops directory without package.json as an omit-dev install and skips the merge drivers (ops-eyi8)
Other
- Certify pm CLI 2026.9.23 and adopt the guarded pm-ops merge-driver launcher (ops-me3v)
2026.9.18 - 2026-09-18
Added
- Ship canonical strict ESLint and duplication gates from pm-ops (ops-4phd)
- Ship the merge-driver install step as the canonical pm-ops/merge-driver export (ops-crgk)
Fixed
- pm CLI 2026.9.11 drops every pm-ops command, because its new core ops group collides at group level (ops-k9iv)
Other
- Certify pm CLI 2026.9.17 (ops-xz9q)
... (truncated)
Changelog
Sourced from pm-ops's changelog.
Changelog
Unreleased
Added
- Repair an incomplete release triple, instead of only reporting it every day (ops-3j1z)
Fixed
- Make historical Windows proof evidence available in fresh clones (ops-kw02)
Other
- Certify pm-ops on PM CLI/SDK 2026.10.10 with linear declaration scanner (ops-hiee)
Commits
fedeb7bRelease pm-ops v2026.10.06cf17187chore(deps-dev): bump eslint (#146)- See full diff in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions
Summary by cubic
Bumps the pm-toolchain dev dependencies: @unbrained/pm-cli to 2026.10.9, pm-changelog to 2026.10.5, and pm-ops to 2026.10.6.
The @unbrained/pm-cli bump also adds re-review events to three pm history streams, because 2026.10.9 re-gates on merge receipts that were previously reviewed on 2026-08-22.
Migration
@unbrained/pm-clinow bundles its runtime dependencies and declares@types/nodeas an optional peer dependency, so the top-level lockfile tree is restructured.