chore(deps-dev): bump @unbrained/pm-cli from 2026.10.1 to 2026.10.3 in the pm-toolchain group

Merged
DE
10d ago
+47-242

Bumps the pm-toolchain group with 1 update: @unbrained/pm-cli.

Updates @unbrained/pm-cli from 2026.10.1 to 2026.10.3

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.10.3

@​unbrained/pm-cli 2026.10.3

Source range: v2026.10.2...v2026.10.3

Changelog

Fixed

  • GH-1354: Linked-test snapshot mode drops nested package dependencies and breaks monorepo acceptance (pm-5iwfkj)

Security

  • Scorecard alert 29: patch Axios in the CodSpeed development dependency graph (pm-r61juc)
  • Remove unpatched braces recursion vulnerability from file matching (pm-fnx3np)

Other

  • Refresh eligible MCP Apps 2.0.3 SDK type contracts (pm-iktual)

PM Tracker Evidence

Closed pm items in release window: 4 By type: Issue=3, Chore=1 By status: closed=4

Selected release-related tracker items:

  • No release-tagged pm items found in the selected window.

v2026.10.2

@​unbrained/pm-cli 2026.10.2

Source range: v2026.10.1...v2026.10.2

Changelog

Fixed

PM Tracker Evidence

Closed pm items in release window: 3 By type: Issue=3 By status: closed=3

Selected release-related tracker items:

  • No release-tagged pm items found in the selected window.
Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.10.3 - 2026-10-03

Security

  • Scorecard alert 29: patch Axios in the CodSpeed development dependency graph (pm-r61juc)
  • Remove unpatched braces recursion vulnerability from file matching (pm-fnx3np)

Other

  • Refresh eligible MCP Apps 2.0.3 SDK type contracts (pm-iktual)

2026.10.2 - 2026-10-02

Fixed

Commits
  • ca6e718 chore(release): cut 2026.10.3
  • d729dd0 Preserve monorepo test dependencies and secure SDK file matching and CodSpeed
  • b52bb3b chore(release): cut 2026.10.2
  • 7f8ffdd Merge pull request #1372 from unbraind/fix/agent-recovery-pagination-preflight
  • 295781a Handle settings open races and verify shipped preview transport
  • 4a7274e Verify retained preview state and qualify portable filesystem guarantees
  • fb7aa33 fix: preserve preview startup safety and complete recovery and pagination con...
  • 16bb75f fix: preserve review receipts and use static preview test types
  • 4814e52 chore: record verified recovery pagination and preview closeout
  • 92cff9e test: discover packed artifacts across npm versions
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by cubic

Bumps @unbrained/pm-cli from 2026.10.1 to 2026.10.3 in the pm-toolchain group.

The update fixes linked-test snapshot mode dropping nested package dependencies in monorepos, validates transaction previews against the staged lifecycle state, and fixes output budget and producer pagination. It also patches Axios in the CodSpeed development dependency graph and removes a braces recursion vulnerability by swapping fast-glob for tinyglobby in file matching.