Sourced from @​unbrained/pm-cli's releases.

v2026.8.18

@​unbrained/pm-cli 2026.8.18

Source range: v2026.8.17...v2026.8.18

Changelog

Added

• Alias shim layer: config-aware hidden aliases with one-line migration hints (foundation for all consolidations) (pm-0z7n)

Fixed

• A commit pushed directly to the default branch can never be released: both analyzer-evidence fallbacks presuppose a pull request, and nothing declares that precondition (pm-u1baah)
• GH-1052: typed fail-closed whole-list SDK primitive (pm-y4aaol)
• Packed Bun SDK import fails on node:module stripTypeScriptTypes (pm-ikj8ve)
• GH-1051: package catalog rejects universal output-budget controls (pm-2firut)
• Bun event streaming falls back to authoritative history without node:sqlite (pm-b8hwfr)
• Surface replication gate scopes trigger activation to relevant diff content (pm-mrhwow)
• CodeQL: remove generated-code artifact path interpolation from exporter integration harness (pm-ozxkm2)
• Exporter artifact-channel contract: clean stdout, bounded receipts, and binary-safe streaming (pm-dilou2)
• GH-1048: Windows Node 24 numeric EDQUOT fixtures construct NaN on platforms that do not declare that errno (pm-y4kovm)
• Queued daily releases recognize an already-published same-day release before analyzer provenance (pm-dm2vfz)

Security

• Adopt Dependabot PR #1046 pinned CodeQL 4.37.7 and TruffleHog 3.97.0 refresh (pm-pp6al9)

Deprecated

• ADR: noun-verb CLI grammar — accepted consolidation principles and alias-preserving deprecation policy (pm-pbyu)

Other

• Command-grammar conformance gate: the noun-verb table and shared verb vocabulary become machine-checked contracts a non-conforming command cannot pass (pm-wt43zj)
• Consolidate the 8 list-* status variants into pm list --status (list-all/open/draft/in-progress/blocked/closed/canceled become hidden aliases) (pm-pfqi)
• Command-destination census: 14 of 76 canonical commands have no declared home in the target grammar, so the surface can be frozen with its shape still undecided (pm-yy8rmx)
• Half of the pm events payload is per-row resume cursors an agent never reads: 48 percent of stream bytes buy a capability consumed once per batch (pm-ez1dfg)

PM Tracker Evidence

No closed pm tracker items were updated in the selected release window.

Sourced from @​unbrained/pm-cli's changelog.

2026.8.18 - 2026-08-18

Added

• Alias shim layer: config-aware hidden aliases with one-line migration hints (foundation for all consolidations) (pm-0z7n)

Fixed

• A commit pushed directly to the default branch can never be released: both analyzer-evidence fallbacks presuppose a pull request, and nothing declares that precondition (pm-u1baah)
• GH-1052: typed fail-closed whole-list SDK primitive (pm-y4aaol)
• Packed Bun SDK import fails on node:module stripTypeScriptTypes (pm-ikj8ve)
• GH-1051: package catalog rejects universal output-budget controls (pm-2firut)
• Bun event streaming falls back to authoritative history without node:sqlite (pm-b8hwfr)
• Surface replication gate scopes trigger activation to relevant diff content (pm-mrhwow)
• CodeQL: remove generated-code artifact path interpolation from exporter integration harness (pm-ozxkm2)
• Exporter artifact-channel contract: clean stdout, bounded receipts, and binary-safe streaming (pm-dilou2)
• GH-1048: Windows Node 24 numeric EDQUOT fixtures construct NaN on platforms that do not declare that errno (pm-y4kovm)
• Queued daily releases recognize an already-published same-day release before analyzer provenance (pm-dm2vfz)

Security

• Adopt Dependabot PR #1046 pinned CodeQL 4.37.7 and TruffleHog 3.97.0 refresh (pm-pp6al9)

Deprecated

• ADR: noun-verb CLI grammar — accepted consolidation principles and alias-preserving deprecation policy (pm-pbyu)

Other

• Command-grammar conformance gate: the noun-verb table and shared verb vocabulary become machine-checked contracts a non-conforming command cannot pass (pm-wt43zj)
• Consolidate the 8 list-* status variants into pm list --status (list-all/open/draft/in-progress/blocked/closed/canceled become hidden aliases) (pm-pfqi)
• Command-destination census: 14 of 76 canonical commands have no declared home in the target grammar, so the surface can be frozen with its shape still undecided (pm-yy8rmx)
• Half of the pm events payload is per-row resume cursors an agent never reads: 48 percent of stream bytes buy a capability consumed once per batch (pm-ez1dfg)

• dd578f4 chore(release): cut 2026.8.18
• aedbba6 Publish canonical CLI grammar and typed alias contracts (#1058)
• 84d742c Resolve squash provenance and terminal cancellation telemetry (#1057)
• 41af793 Preserve reviewed provenance through PM delivery closeout (#1056)
• 2e5adcd chore(pm): record merged SDK delivery
• 52d2e95 Certify complete project reads across SDK, CLI, and package runtimes (#1054)
• 4c71075 Merge pull request #1053 from unbraind/codex/artifact-and-resumable-stream-co...
• a1e0d64 Record artifact stream review closeout
• 9cc7dfe fix: harden resumable stream review contracts
• 7f94e00 fix(tests): remove generated artifact path interpolation
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)