[dependabot]

Bumps the pm-toolchain group with 3 updates: @unbrained/pm-cli, pm-changelog and pm-ops.

Updates @unbrained/pm-cli from 2026.10.13 to 2026.10.15

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.10.15

@​unbrained/pm-cli 2026.10.15

Source range: v2026.10.14...v2026.10.15

Changelog

Fixed

• GH-1467: Preserve optional extension value arity in machine contracts (pm-gh1467)
• GH-1466: Preserve explicitly false values for extension bool aliases (pm-gh1466)
• GH-1458: Preserve linked-test edit history across older published readers and writers (pm-gh1458)
• GH-1457: Recover output cursors passed to --after and expose budget continuation controls (pm-gh1457)

Security

• Redact sensitive values in Sentry command context and encoded diagnostic text (pm-geywoc)

Other

• Compact SDK declaration whitespace while preserving types and documentation (pm-chw71s)

PM Tracker Evidence

Closed pm items in release window: 8 By type: Task=3, Issue=5 By status: closed=8

Selected release-related tracker items:

• pm-gh1458 [Issue/closed] GH-1458: Preserve linked-test edit history across older published readers and writers

v2026.10.14

@​unbrained/pm-cli 2026.10.14

Source range: v2026.10.13...v2026.10.14

Changelog

Added

• GH-1462: Publish host-aligned TOON codecs for extension acceptance tests (pm-gh1462)
• Enable explicit successful-command Sentry tracing without eager startup (pm-58yzil)

Changed

• Give recurrence policy globs a deterministic matching bound (pm-0vqbl5)

Fixed

• GH-1461: Normalize supported inline flag placeholders across help and parsing (pm-gh1461)

... (truncated)

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.10.15 - 2026-10-15

Fixed

• GH-1467: Preserve optional extension value arity in machine contracts (pm-gh1467)
• GH-1466: Preserve explicitly false values for extension bool aliases (pm-gh1466)
• GH-1458: Preserve linked-test edit history across older published readers and writers (pm-gh1458)
• GH-1457: Recover output cursors passed to --after and expose budget continuation controls (pm-gh1457)

Security

• Redact sensitive values in Sentry command context and encoded diagnostic text (pm-geywoc)

Other

• Compact SDK declaration whitespace while preserving types and documentation (pm-chw71s)

2026.10.14 - 2026-10-14

Added

• GH-1462: Publish host-aligned TOON codecs for extension acceptance tests (pm-gh1462)
• Enable explicit successful-command Sentry tracing without eager startup (pm-58yzil)

Changed

• Give recurrence policy globs a deterministic matching bound (pm-0vqbl5)

Fixed

• Prevent Sentry command context from recording positional content and option values (pm-geywoc)
• GH-1461: Normalize supported inline flag placeholders across help and parsing (pm-gh1461)
• GH-1460: Merge extension assets as ordinary Git files while preserving tracker drivers (pm-gh1460)
• Resume due telemetry after a concurrent background upload (pm-j8spis)
• Embedded CLI commands fail when an eval host has no script argv entry (pm-mor9pl)

Commits

• 9de83bc chore(release): cut 2026.10.15
• b29ceb3 fix(sdk): preserve extension grammar and diagnostic privacy
• 0e94c3c feat(sdk): guard linked-test history and recover context continuation
• 2024387 chore(release): cut 2026.10.14
• c577ede feat(sdk): complete package authoring primitives and reliable telemetry delivery
• f01d624 feat: add consent-aware SDK tracing and bounded recurrence matching (#1455)
• See full diff in compare view

Updates pm-changelog from 2026.10.12 to 2026.10.16

Release notes

Sourced from pm-changelog's releases.

pm-changelog v2026.10.16

No release notes provided.

pm-changelog v2026.10.15

No release notes provided.

pm-changelog v2026.10.14

2026.10.14 - 2026-10-14

Fixed

• Preserve shipped entries when completed items are reopened and closed again (pmc-reopened-history)

pm-changelog v2026.10.13

No release notes provided.

Changelog

Sourced from pm-changelog's changelog.

Changelog

2026.10.19-1 - 2026-10-19

Fixed

• Publish same-day calendar suffixes with an explicit latest dist-tag (pmc-udb5)
• Request the full list projection explicitly for whole-tracker changelog reads (pmc-zfyb)

2026.10.14 - 2026-10-14

Fixed

• Preserve shipped entries when completed items are reopened and closed again (pmc-reopened-history)

Commits

• b7934ed Release pm-changelog v2026.10.16
• b013f5a chore(deps-dev): bump marked (#249)
• 4a2e633 Verify release backlog and stabilize Git fixture cleanup (#247)
• aafea5d Enable the gated pm-github issue sync (#240)
• 8e2050f Release pm-changelog v2026.10.15
• 517972d chore(deps-dev): bump @​unbrained/pm-cli (#245)
• 166c6de Release pm-changelog v2026.10.14
• 935c7d2 fix(changelog): preserve shipped entries across reopened completions (#243)
• 911f1fe Link custom-type items to their registered tracker folders (#241)
• 3e895e6 chore(deps-dev): bump @​unbrained/pm-cli (#242)
• Additional commits viewable in compare view

Updates pm-ops from 2026.10.12 to 2026.10.16

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.10.16

Changelog

2026.10.15 - 2026-10-15

Security

• Remove the unpatched braces chain with built-in fs.glob and jscpd 5 only (ops-braces-audit)

2026.10.14 - 2026-10-14

Fixed

• Reject unresolved alias and function publish indirection in canonical attestation auditor (ops-publish-indirection)
• Keep merge-driver prepare read-only during npm pack and publish (ops-pack-prepare)

2026.10.12 - 2026-10-12

Added

• Repair an incomplete release triple, instead of only reporting it every day (ops-3j1z)

Fixed

• Make historical Windows proof evidence available in fresh clones (ops-kw02)

Other

• Certify pm-ops on PM CLI/SDK 2026.10.10 with linear declaration scanner (ops-hiee)

2026.10.5 - 2026-10-05

Fixed

• Cover .tsx, .mts and .cts sources in the docstring and duplication gates, excluding ambient .d.mts/.d.cts declarations (ops-zq8c)

Other

• Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (ops-k1lf)

2026.9.29 - 2026-09-29

Fixed

• Release completeness audit fails a release it just created because the GitHub Release list lags creation (ops-eys5)

2026.9.28 - 2026-09-28

Fixed

... (truncated)

Changelog

Sourced from pm-ops's changelog.

Changelog

2026.10.15 - 2026-10-15

Security

• Remove the unpatched braces chain with built-in fs.glob and jscpd 5 only (ops-braces-audit)

2026.10.14 - 2026-10-14

Fixed

• Reject unresolved alias and function publish indirection in canonical attestation auditor (ops-publish-indirection)
• Keep merge-driver prepare read-only during npm pack and publish (ops-pack-prepare)

Commits

• 20cf00e Release pm-ops v2026.10.16
• d4e6757 chore(deps-dev): bump pm-changelog (#174)
• 53bb649 Read [[ =~ ]] regex operands and array assignments as words so version checks...
• 84221c8 Preserve multiline shell quotes and scan Compose executable fields (#171)
• 6ec0512 Enable the gated pm-github issue sync and remove the braces chain (#168)
• de9c474 Release pm-ops v2026.10.15
• 159802d Fail closed on third-party publish wrappers in the attestation auditor (#167)
• f126502 Close tracker items delivered by merged pull requests (#165)
• 44bcf51 chore(deps-dev): bump @​types/node (#166)
• 417369c Release pm-ops v2026.10.14
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Summary by cubic

Updates the pm-toolchain group to latest patch releases: @unbrained/pm-cli to 2026.10.15, pm-changelog to 2026.10.16, and pm-ops to 2026.10.16.

Dependencies

• pm-ops drops the optional fast-glob peer and raises the jscpd range to >=5.0.0 <6.0.0, removing the unpatched braces chain; it also gains a yaml runtime dependency.
• @unbrained/pm-cli adds semver as a bundled dependency.
• pm-changelog fixes shipped entries being dropped when completed items are reopened and closed again.

Refactors

• The merge-driver test no longer expects Git's built-in text, binary, and union drivers in the registered config, since pm-cli 2026.10.15 and later declare merge=text in .gitattributes.

^{Written for commit 728973d. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f48f963a-5cd6-4ae0-84cd-97294198e14b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}