Sourced from @​unbrained/pm-cli's releases.

v2026.10.17

@​unbrained/pm-cli 2026.10.17

Source range: v2026.10.15...v2026.10.17

Changelog

Added

• GH-1456: Discoverable SDK-backed bulk creation with JSONL and keyed upsert (pm-gh1456)
• Validate contributed scalar flag values before extension handler dispatch (pm-extension-scalar-validation)
• GH-1465: Represent implementer-to-verifier handoff as project context (pm-gh1465)

Fixed

• Preserve surrogate pairs in bounded JSON and TOON output (pm-gh1478)
• Refuse item text with an unpaired surrogate as a typed field error before TOON encoding (pm-jsm9im)
• Return typed refusals for malformed raw duration options (pm-bulk-option-validation)
• Align claim guidance with atomic ownership refusal (pm-5f7ayv)
• GH-1464: Distinguish successful close follow-up from failure recovery (pm-gh1464)

Other

• As an MCP host or coding agent, I can discover pm capabilities and complete long-running context workflows through one current stateless protocol (pm-x705zo)

PM Tracker Evidence

Closed pm items in release window: 9 By type: Issue=5, Story=1, Feature=3 By status: closed=9

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.

v2026.10.15

@​unbrained/pm-cli 2026.10.15

Source range: v2026.10.14...v2026.10.15

Changelog

Fixed

• GH-1467: Preserve optional extension value arity in machine contracts (pm-gh1467)
• GH-1466: Preserve explicitly false values for extension bool aliases (pm-gh1466)
• GH-1458: Preserve linked-test edit history across older published readers and writers (pm-gh1458)
• GH-1457: Recover output cursors passed to --after and expose budget continuation controls (pm-gh1457)

Security

... (truncated)

Sourced from @​unbrained/pm-cli's changelog.

2026.10.17 - 2026-10-17

Added

• GH-1456: Discoverable SDK-backed bulk creation with JSONL and keyed upsert (pm-gh1456)
• Validate contributed scalar flag values before extension handler dispatch (pm-extension-scalar-validation)
• GH-1465: Represent implementer-to-verifier handoff as project context (pm-gh1465)

Fixed

• Preserve surrogate pairs in bounded JSON and TOON output (pm-gh1478)
• Refuse item text with an unpaired surrogate as a typed field error before TOON encoding (pm-jsm9im)
• Return typed refusals for malformed raw duration options (pm-bulk-option-validation)
• Align claim guidance with atomic ownership refusal (pm-5f7ayv)
• GH-1464: Distinguish successful close follow-up from failure recovery (pm-gh1464)

Other

• As an MCP host or coding agent, I can discover pm capabilities and complete long-running context workflows through one current stateless protocol (pm-x705zo)

2026.10.15 - 2026-10-15

Fixed

• GH-1467: Preserve optional extension value arity in machine contracts (pm-gh1467)
• GH-1466: Preserve explicitly false values for extension bool aliases (pm-gh1466)
• GH-1458: Preserve linked-test edit history across older published readers and writers (pm-gh1458)
• GH-1457: Recover output cursors passed to --after and expose budget continuation controls (pm-gh1457)

Security

• Redact sensitive values in Sentry command context and encoded diagnostic text (pm-geywoc)

Other

• Compact SDK declaration whitespace while preserving types and documentation (pm-chw71s)

• b062b79 chore(release): cut 2026.10.17
• 94757af Add SDK-first bulk creation, scalar validation and Unicode-safe output
• 8aeb18c Add verification handoffs, close follow-ups, and bounded Windows CI (#1476)
• 9de83bc chore(release): cut 2026.10.15
• b29ceb3 fix(sdk): preserve extension grammar and diagnostic privacy
• 0e94c3c feat(sdk): guard linked-test history and recover context continuation
• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)