Certify pm-jira on PM CLI 2026.10.4 and consolidate pending dependency updates

Merged
UN
14d ago
+225-272

Pins PM CLI/SDK, pm-ops, pm-changelog and managed pm-github to 2026.10.4, with exact development dependency versions and the unchanged SDK floor. Consolidates Dependabot #118, #121, #122 and #123, including the exact CodeQL SHA/comment bump. Copies the published merge-driver launcher unchanged and adds a real malformed-lookup regression.

Packed real-tracker acceptance exposed unregistered native Jira importer/exporter flags. A new activation-contract test failed before the repair; existing pull/export definitions are now registered through the supported SDK, so documented CLI options reach their handlers without a parser bypass or new floor.

Validation (heavy commands serialized with the shared flock):

  • npm run release:check through linked pm test pm-jira-gdlw --run --progress, using env -u PM_PATH for the CI child: 195/195 pass, zero skips.
  • Coverage: 100% lines / branches / functions across two application TS files. Existing operational-script exclusion remains visible; statements unmeasured. No thresholds or ignores changed.
  • Launcher: 8/8 pass. New importer/exporter flag contract: 1/1 pass after a demonstrated failure.
  • npm audit and npm audit --omit=dev: zero vulnerabilities; no open Dependabot security alerts.
  • npx pm health --strict-exit --require-merge-drivers: exit 0, one advisory stale-item finding.
  • bun install --no-save: exit 0; no existing Bun lockfile is changed.
  • npm pack installed into the copied real project tracker. npm/npx and native Bun (bunx --bun @unbrained/pm-cli@2026.10.4): pass for validate, sync/import dry runs, ordinary export and rich/update-existing export. All nine real items exported, independently confirmed against a complete unbounded list, with the owner present and complete JSON parity; scratch deleted. Live Jira authentication/network calls are outside this acceptance.
  • Managed pm-github read-only dry-run: zero linked provenance cases, synced/skipped/planned all 0. No issue writes or scheduling changes.
  • Changelog regenerated after PM mutations; check passes.

Exact commands and scope. PM owner pm-jira-gdlw stays open for orchestrator verification, merge and closure.

Summary by cubic

Certifies pm-jira on PM CLI/SDK 2026.10.4, consolidates the pending Dependabot updates into one branch, and records verified CI and reviewer evidence at the final head. This also fixes a regression where native Jira import/export flags were rejected by CLI 2026.10.4 because the package never registered them.

Bug Fixes

  • Registers the existing PULL_FLAGS and EXPORT_FLAGS through the SDK schema API, so pm jira import and pm jira export advertise their documented flags without a parser bypass or floor increase.
  • Replaces the merge-driver launcher with the published canonical version and adds a regression for non-directory node_modules lookup paths.

Dependencies

  • Pins @unbrained/pm-cli, pm-ops, and pm-changelog to 2026.10.4, @types/node to 26.6.4, and TypeScript to 7.0.2 without changing the existing CLI peer floor.
  • Updates the managed pm-github extension and CI restore pin to 2026.10.4, and adopts the exact CodeQL SHA from Dependabot; scheduled sync stays disabled.

No migration steps are required. Full validation passes 195/195 tests with zero skips and unchanged 100% coverage thresholds. CI and reviewer evidence was verified at the exact head, with the certification item left open for orchestrator verification.

Summary by Sourcery

Certify pm-jira on PM CLI/SDK 2026.10.4 while consolidating dependency updates and repairing native Jira flag registration.

Bug Fixes:

  • Register the documented Jira import and export flags so native CLI commands can reach their existing handlers.
  • Preserve the original module-resolution error when merge-driver discovery encounters malformed lookup paths.

Enhancements:

  • Certify pm-jira against PM CLI and SDK 2026.10.4, including packed npm and native Bun real-tracker acceptance.
  • Consolidate and pin the pending development and managed-extension dependency updates without changing the existing CLI compatibility floor.

CI:

  • Update the managed pm-github CI restoration version and pin CodeQL actions to the Dependabot-provided revision.

Documentation:

  • Add certification documentation covering validation scope, packed acceptance, and observed results.

Tests:

  • Add regression coverage for malformed node_modules lookup paths and the native Jira importer/exporter flag activation contract.