chore(deps-dev): bump @unbrained/pm-cli from 2026.9.26 to 2026.10.1

Closed
DE
18d ago
+5-5

Bumps @unbrained/pm-cli from 2026.9.26 to 2026.10.1.

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.10.1

@​unbrained/pm-cli 2026.10.1

Source range: v2026.9.30...v2026.10.1

Changelog

Fixed

  • Control native effort in the history/activity provenance fixture (pm-6jvz55)
  • GH-1351: leaf get advertises empty children as omitted (pm-x8jdt8)
  • GH-1349: Bun 1.3.5 merge installer accepts a transient launcher (pm-aaxq4n)

Security

  • Scorecard alert 29: patch new brace-expansion recursion and rewrite denial-of-service advisories (pm-cbzvgn)

PM Tracker Evidence

Closed pm items in release window: 4 By type: Issue=4 By status: closed=4

Selected release-related tracker items:

  • No release-tagged pm items found in the selected window.

v2026.9.30

@​unbrained/pm-cli 2026.9.30

Source range: v2026.9.29...v2026.9.30

Changelog

Fixed

  • Registry install acceptance loses subprocess timeout and signal evidence and labels every failure as registry availability (pm-q7c36n)
  • Bun merge-driver installation disagrees with strict health (pm-vks66s)
  • Expose host-bound audited workspace settings mutation to extension commands (pm-wtqltn)
  • Full-item stdin JSON update silently ignores edited notes (pm-2589e6)

PM Tracker Evidence

Closed pm items in release window: 4 By type: Issue=4 By status: closed=4

Selected release-related tracker items:

  • No release-tagged pm items found in the selected window.

v2026.9.29

... (truncated)

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.10.1 - 2026-10-01

Fixed

  • Control native effort in the history/activity provenance fixture (pm-6jvz55)
  • GH-1351: leaf get advertises empty children as omitted (pm-x8jdt8)
  • GH-1349: Bun 1.3.5 merge installer accepts a transient launcher (pm-aaxq4n)

Security

  • Scorecard alert 29: patch new brace-expansion recursion and rewrite denial-of-service advisories (pm-cbzvgn)

2026.9.30 - 2026-09-30

Fixed

  • Registry install acceptance loses subprocess timeout and signal evidence and labels every failure as registry availability (pm-q7c36n)
  • Bun merge-driver installation disagrees with strict health (pm-vks66s)
  • Expose host-bound audited workspace settings mutation to extension commands (pm-wtqltn)
  • Full-item stdin JSON update silently ignores edited notes (pm-2589e6)

2026.9.29 - 2026-09-29

Fixed

  • GH-1340: pm duplicates treats UTF-8 prose as a 0.99 issue-code match (pm-1ieq24)
  • Persist revised linked evidence notes while preserving idempotent retries (pm-zqxlfs)
  • Bound Plan mutation receipts while preserving full inspection (pm-hqy7lr)

Deprecated

  • Alias-usage counters: measure deprecated-spelling hits so grammar-freeze removals are evidence-based (pm-0mox)
  • Extension activation attributes canonical full-list projection to deprecated --full (pm-8uwigr)

Other

  • Replay each history state once: reuse the previous entry's digest as the next before-hash, stop at the first matching hash epoch, and drop the second document clone (pm-hen0t6)

2026.9.28 - 2026-09-28

Fixed

  • Allow self-isolating linked package tests without inherited PM_PATH (pm-t05d8d)
  • Preserve every tracker merge fence during nested init and detect lost active mappings (pm-kynkl8)
  • GH-1325: history diff cursor drops newest rows and strands the final page (pm-c3aiik)
  • Windows nightly merge-receipt classification test exceeds 60-second budget (pm-v0600g)
  • GH-1327: Windows nightly static inventory unreadable-source assertion fails (pm-ft90q2)
  • GH-1326: Windows nightly bundled-package init test exceeds 30 seconds (pm-kvhnb5)
  • MCP detached task completion coverage can miss cleanup under hosted shards (pm-tm6h9x)
  • Full coverage refusal-closure retry test exceeds its four-minute budget under suite contention (pm-mrrci4)

... (truncated)

Commits
  • 89b4aa8 chore(release): cut 2026.10.1
  • 1e7ecc1 fix: stabilize Bun merge, context reads and dependency security (#1353)
  • 344aa7b chore(release): cut 2026.9.30
  • d56cae9 Merge pull request #1350 from unbraind/fix/release-origin-and-install-diagnos...
  • d28153f fix(release): keep dispatcher timing separate from native cron
  • dc9b60e fix(release): recognize Bun registry 404 diagnostics
  • 1d2443f fix(release): preserve exact-tag recovery and complete redaction
  • 1a4ab2f fix(release): preserve install failure evidence and attribute daily dispatches
  • bbfa428 Audit extension settings and item JSON updates; repair Bun merge drivers (#1348)
  • db52e3f chore(release): cut 2026.9.29
  • Additional commits viewable in compare view