chore(deps-dev): bump the pm-toolchain group across 1 directory with 3 updates

[dependabot]

Bumps the pm-toolchain group with 3 updates in the / directory: @unbrained/pm-cli, pm-changelog and pm-ops.

Updates @unbrained/pm-cli from 2026.10.5 to 2026.10.9

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.10.9

@​unbrained/pm-cli 2026.10.9

Source range: v2026.10.8...v2026.10.9

Changelog

Added

• Fact-preserving SDK table encoding, measured TOON defaults, and complete context budgets (pm-kvxqp1)

Fixed

• GH-1391: Express faithful self-isolating source package gates without tracker redirects (pm-gh1391)
• Native SQLite warnings corrupt strict machine-channel acceptance on Node 24.12 (pm-aiqmgj)
• Reject external test scratch roots beneath an initialized ancestor tracker (pm-runner-ancestor-tracker)
• Scratch lifecycle 15-second wall-clock assertion flakes under default full coverage concurrency (pm-dqej6b)

Other

• Refresh cooldown-eligible jscpd 5.4 duplicate-detection tooling (pm-jscpd-54)

PM Tracker Evidence

Closed pm items in release window: 6 By type: Feature=1, Issue=4, Chore=1 By status: closed=6

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.

v2026.10.8

@​unbrained/pm-cli 2026.10.8

Source range: v2026.10.7...v2026.10.8

Changelog

Fixed

• Name the rejected custom field in extension-field recovery (pm-field-key-recovery)
• GH-1424: Wait safely for contended Git merge-driver configuration (pm-gh1424)
• GH-1390: Keep trusted merge-receipt attribution and committed reconciliation authoritative (pm-gh1390)
• GH-1405: Settle proven abandoned plain-merge receipts without losing provenance (pm-gh1405)
• Declare non-regular transaction preview paths as recoverable SDK refusals (pm-preview-path-refusal)

Other

• Prove native Git lock retry after observed contention in PR1425 (pm-native-git-retry-proof)
• Bound local temp footprint: prune Node compile cache and guarantee smoke/dogfood sandbox cleanup on failure (pm-p5u6)

... (truncated)

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.10.9 - 2026-10-09

Added

• Fact-preserving SDK table encoding, measured TOON defaults, and complete context budgets (pm-kvxqp1)

Fixed

• GH-1391: Express faithful self-isolating source package gates without tracker redirects (pm-gh1391)
• Native SQLite warnings corrupt strict machine-channel acceptance on Node 24.12 (pm-aiqmgj)
• Reject external test scratch roots beneath an initialized ancestor tracker (pm-runner-ancestor-tracker)
• Scratch lifecycle 15-second wall-clock assertion flakes under default full coverage concurrency (pm-dqej6b)

Other

• Refresh cooldown-eligible jscpd 5.4 duplicate-detection tooling (pm-jscpd-54)

2026.10.8 - 2026-10-08

Fixed

• Name the rejected custom field in extension-field recovery (pm-field-key-recovery)
• GH-1424: Wait safely for contended Git merge-driver configuration (pm-gh1424)
• GH-1390: Keep trusted merge-receipt attribution and committed reconciliation authoritative (pm-gh1390)
• GH-1405: Settle proven abandoned plain-merge receipts without losing provenance (pm-gh1405)
• Declare non-regular transaction preview paths as recoverable SDK refusals (pm-preview-path-refusal)

Other

• Prove native Git lock retry after observed contention in PR1425 (pm-native-git-retry-proof)
• Bound local temp footprint: prune Node compile cache and guarantee smoke/dogfood sandbox cleanup on failure (pm-p5u6)

2026.10.7 - 2026-10-07

Fixed

• GH-1417: Bundle the tested CLI runtime closure for reproducible npm and Bun installs (pm-gh1417)
• GH-1418: Accept real Bun filtered-test execution receipts (pm-gh1418)
• Prose graph census misses valid item identifiers with multiple hyphens (pm-axotea)
• Include body-only references in strict workspace assurance context (pm-jprn58)
• GH-1413: Preserve lossless producer cursors under amount-only output caps (pm-gh1413)
• GH-1414/GH-1415: Restore portable schema and checksum nightly fixtures (pm-gh1414)
• Expose typed explicit-ID duplicate creation conflicts to SDK callers (pm-gh1400)

Security

• Remove vulnerable MCP Apps development client from the locked dependency tree (GHSA-6qxp-vccf-f47h) (pm-mcpoauth)

Other

... (truncated)

Commits

• e936784 chore(release): cut 2026.10.9
• 87d9b02 Merge pull request #1427: lossless TOON tables and complete context budgets
• d291905 fix(output): bound sparse table candidate construction
• 4f4450b fix(output): simplify compaction and preserve heterogeneous row rendering
• 20bc06c fix(output): retain lean JSON aliases and document budget rendering contracts
• 0f58324 feat(sdk): preserve nested table facts and bound complete context output
• 5f8ae4d Merge pull request #1426 from unbraind/fix/faithful-package-gates-and-machine...
• ee46fdb fix(sdk): isolate snapshot acceptance from ambient Git settings
• 7a513ec fix(sdk): preserve isolated package gates and clean machine channels
• 4f3682a chore(release): cut 2026.10.8
• Additional commits viewable in compare view

Updates pm-changelog from 2026.10.4 to 2026.10.5

Release notes

Sourced from pm-changelog's releases.

pm-changelog v2026.10.5

2026.10.5 - 2026-10-05

Fixed

• Keep installed usage documentation links portable and the dependency-updates table row valid (pmc-mwnu)

Other

• Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (pmc-y0a5)

Changelog

Sourced from pm-changelog's changelog.

2026.10.5 - 2026-10-05

Fixed

• Keep installed usage documentation links portable and the dependency-updates table row valid (pmc-mwnu)

Other

• Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (pmc-y0a5)

2026.9.25 - 2026-09-25

Added

• Add opt-in Dependabot dependency sections so item-less release windows still get notes (pmc-ny9i)

Fixed

• Include extension-registered item types in changelog generation and body previews (pmc-k1oq)
• A publish that npm accepts late is reported as failed and the GitHub Release is skipped on bun mirror lag (pmc-piam)

Other

• Certify pm CLI 2026.9.23 and adopt the guarded pm-ops merge-driver launcher (pmc-pcax)

2026.9.23 - 2026-09-23

Other

• Certify pm CLI 2026.9.21 and install merge drivers through the canonical pm-ops launcher (pmc-psin)

2026.9.18 - 2026-09-18

Other

• Certify pm CLI 2026.9.17 (pmc-r1qu)

2026.9.15 - 2026-09-15

Fixed

• Include configured custom item types in changelog generation and export (pmc-vnke)

2026.9.13 - 2026-09-13

Other

• Group the codeql-action init and analyze updates so Dependabot stops splitting a pair that must match (pmc-fi6u)
• Certify pm CLI 2026.9.12 and the pm-ops 2026.9.11 auditor (pmc-s7bi)

... (truncated)

Commits

• f241332 Release pm-changelog v2026.10.5
• 3e31f7b Keep installed usage documentation links portable and the dependency-updates ...
• 2c061fc Auto-merge green Dependabot updates and group the pm toolchain into one daily...
• 564cc39 Certify pm-changelog on PM CLI 2026.10.4 and consolidate pending dependency u...
• See full diff in compare view

Updates pm-ops from 2026.10.5 to 2026.10.6

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.10.06

Changelog

2026.10.5 - 2026-10-05

Fixed

• Cover .tsx, .mts and .cts sources in the docstring and duplication gates, excluding ambient .d.mts/.d.cts declarations (ops-zq8c)

Other

• Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (ops-k1lf)

2026.9.29 - 2026-09-29

Fixed

• Release completeness audit fails a release it just created because the GitHub Release list lags creation (ops-eys5)

2026.9.28 - 2026-09-28

Fixed

• Hoisted broken pm-ops can bypass merge-driver install guard (ops-jzp5)

2026.9.26 - 2026-09-26

Fixed

• A publish that npm accepts late is reported as failed and the GitHub Release is skipped on bun mirror lag (ops-ssnr)
• The guarded launcher template reads a pm-ops directory without package.json as an omit-dev install and skips the merge drivers (ops-eyi8)

Other

• Certify pm CLI 2026.9.23 and adopt the guarded pm-ops merge-driver launcher (ops-me3v)

2026.9.18 - 2026-09-18

Added

• Ship canonical strict ESLint and duplication gates from pm-ops (ops-4phd)
• Ship the merge-driver install step as the canonical pm-ops/merge-driver export (ops-crgk)

Fixed

• pm CLI 2026.9.11 drops every pm-ops command, because its new core ops group collides at group level (ops-k9iv)

Other

• Certify pm CLI 2026.9.17 (ops-xz9q)

... (truncated)

Changelog

Sourced from pm-ops's changelog.

Changelog

2026.10.12 - 2026-10-12

Added

• Repair an incomplete release triple, instead of only reporting it every day (ops-3j1z)

Fixed

• Make historical Windows proof evidence available in fresh clones (ops-kw02)

Other

• Certify pm-ops on PM CLI/SDK 2026.10.10 with linear declaration scanner (ops-hiee)

Commits

• fedeb7b Release pm-ops v2026.10.06
• cf17187 chore(deps-dev): bump eslint (#146)
• See full diff in compare view

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 3f3dbd25-9cbf-42c8-9640-743005c725bb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}