build(deps-dev): bump @unbrained/pm-cli from 2026.9.29 to 2026.10.1

Closed
DE
14d ago
+5-5

Bumps @unbrained/pm-cli from 2026.9.29 to 2026.10.1.

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.10.1

@​unbrained/pm-cli 2026.10.1

Source range: v2026.9.30...v2026.10.1

Changelog

Fixed

  • Control native effort in the history/activity provenance fixture (pm-6jvz55)
  • GH-1351: leaf get advertises empty children as omitted (pm-x8jdt8)
  • GH-1349: Bun 1.3.5 merge installer accepts a transient launcher (pm-aaxq4n)

Security

  • Scorecard alert 29: patch new brace-expansion recursion and rewrite denial-of-service advisories (pm-cbzvgn)

PM Tracker Evidence

Closed pm items in release window: 4 By type: Issue=4 By status: closed=4

Selected release-related tracker items:

  • No release-tagged pm items found in the selected window.

v2026.9.30

@​unbrained/pm-cli 2026.9.30

Source range: v2026.9.29...v2026.9.30

Changelog

Fixed

  • Registry install acceptance loses subprocess timeout and signal evidence and labels every failure as registry availability (pm-q7c36n)
  • Bun merge-driver installation disagrees with strict health (pm-vks66s)
  • Expose host-bound audited workspace settings mutation to extension commands (pm-wtqltn)
  • Full-item stdin JSON update silently ignores edited notes (pm-2589e6)

PM Tracker Evidence

Closed pm items in release window: 4 By type: Issue=4 By status: closed=4

Selected release-related tracker items:

  • No release-tagged pm items found in the selected window.
Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.10.1 - 2026-10-01

Fixed

  • Control native effort in the history/activity provenance fixture (pm-6jvz55)
  • GH-1351: leaf get advertises empty children as omitted (pm-x8jdt8)
  • GH-1349: Bun 1.3.5 merge installer accepts a transient launcher (pm-aaxq4n)

Security

  • Scorecard alert 29: patch new brace-expansion recursion and rewrite denial-of-service advisories (pm-cbzvgn)

2026.9.30 - 2026-09-30

Fixed

  • Registry install acceptance loses subprocess timeout and signal evidence and labels every failure as registry availability (pm-q7c36n)
  • Bun merge-driver installation disagrees with strict health (pm-vks66s)
  • Expose host-bound audited workspace settings mutation to extension commands (pm-wtqltn)
  • Full-item stdin JSON update silently ignores edited notes (pm-2589e6)
Commits
  • 89b4aa8 chore(release): cut 2026.10.1
  • 1e7ecc1 fix: stabilize Bun merge, context reads and dependency security (#1353)
  • 344aa7b chore(release): cut 2026.9.30
  • d56cae9 Merge pull request #1350 from unbraind/fix/release-origin-and-install-diagnos...
  • d28153f fix(release): keep dispatcher timing separate from native cron
  • dc9b60e fix(release): recognize Bun registry 404 diagnostics
  • 1d2443f fix(release): preserve exact-tag recovery and complete redaction
  • 1a4ab2f fix(release): preserve install failure evidence and attribute daily dispatches
  • bbfa428 Audit extension settings and item JSON updates; repair Bun merge drivers (#1348)
  • See full diff in compare view