chore(deps-dev): bump @unbrained/pm-cli from 2026.9.26 to 2026.10.1

[dependabot]

Bumps @unbrained/pm-cli from 2026.9.26 to 2026.10.1.

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.10.1

@​unbrained/pm-cli 2026.10.1

Source range: v2026.9.30...v2026.10.1

Changelog

Fixed

• Control native effort in the history/activity provenance fixture (pm-6jvz55)
• GH-1351: leaf get advertises empty children as omitted (pm-x8jdt8)
• GH-1349: Bun 1.3.5 merge installer accepts a transient launcher (pm-aaxq4n)

Security

• Scorecard alert 29: patch new brace-expansion recursion and rewrite denial-of-service advisories (pm-cbzvgn)

PM Tracker Evidence

Closed pm items in release window: 4 By type: Issue=4 By status: closed=4

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.

v2026.9.30

@​unbrained/pm-cli 2026.9.30

Source range: v2026.9.29...v2026.9.30

Changelog

Fixed

• Registry install acceptance loses subprocess timeout and signal evidence and labels every failure as registry availability (pm-q7c36n)
• Bun merge-driver installation disagrees with strict health (pm-vks66s)
• Expose host-bound audited workspace settings mutation to extension commands (pm-wtqltn)
• Full-item stdin JSON update silently ignores edited notes (pm-2589e6)

PM Tracker Evidence

Closed pm items in release window: 4 By type: Issue=4 By status: closed=4

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.

v2026.9.29

... (truncated)

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.10.1 - 2026-10-01

Fixed

• Control native effort in the history/activity provenance fixture (pm-6jvz55)
• GH-1351: leaf get advertises empty children as omitted (pm-x8jdt8)
• GH-1349: Bun 1.3.5 merge installer accepts a transient launcher (pm-aaxq4n)

Security

• Scorecard alert 29: patch new brace-expansion recursion and rewrite denial-of-service advisories (pm-cbzvgn)

2026.9.30 - 2026-09-30

Fixed

• Registry install acceptance loses subprocess timeout and signal evidence and labels every failure as registry availability (pm-q7c36n)
• Bun merge-driver installation disagrees with strict health (pm-vks66s)
• Expose host-bound audited workspace settings mutation to extension commands (pm-wtqltn)
• Full-item stdin JSON update silently ignores edited notes (pm-2589e6)

2026.9.29 - 2026-09-29

Fixed

• GH-1340: pm duplicates treats UTF-8 prose as a 0.99 issue-code match (pm-1ieq24)
• Persist revised linked evidence notes while preserving idempotent retries (pm-zqxlfs)
• Bound Plan mutation receipts while preserving full inspection (pm-hqy7lr)

Deprecated

• Alias-usage counters: measure deprecated-spelling hits so grammar-freeze removals are evidence-based (pm-0mox)
• Extension activation attributes canonical full-list projection to deprecated --full (pm-8uwigr)

Other

• Replay each history state once: reuse the previous entry's digest as the next before-hash, stop at the first matching hash epoch, and drop the second document clone (pm-hen0t6)

2026.9.28 - 2026-09-28

Fixed

• Allow self-isolating linked package tests without inherited PM_PATH (pm-t05d8d)
• Preserve every tracker merge fence during nested init and detect lost active mappings (pm-kynkl8)
• GH-1325: history diff cursor drops newest rows and strands the final page (pm-c3aiik)
• Windows nightly merge-receipt classification test exceeds 60-second budget (pm-v0600g)
• GH-1327: Windows nightly static inventory unreadable-source assertion fails (pm-ft90q2)
• GH-1326: Windows nightly bundled-package init test exceeds 30 seconds (pm-kvhnb5)
• MCP detached task completion coverage can miss cleanup under hosted shards (pm-tm6h9x)
• Full coverage refusal-closure retry test exceeds its four-minute budget under suite contention (pm-mrrci4)

... (truncated)

Commits

• 89b4aa8 chore(release): cut 2026.10.1
• 1e7ecc1 fix: stabilize Bun merge, context reads and dependency security (#1353)
• 344aa7b chore(release): cut 2026.9.30
• d56cae9 Merge pull request #1350 from unbraind/fix/release-origin-and-install-diagnos...
• d28153f fix(release): keep dispatcher timing separate from native cron
• dc9b60e fix(release): recognize Bun registry 404 diagnostics
• 1d2443f fix(release): preserve exact-tag recovery and complete redaction
• 1a4ab2f fix(release): preserve install failure evidence and attribute daily dispatches
• bbfa428 Audit extension settings and item JSON updates; repair Bun merge drivers (#1348)
• db52e3f chore(release): cut 2026.9.29
• Additional commits viewable in compare view

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 70eab7b3-fa73-4353-94a6-9d4b471fb8df

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[unbraind]

Superseded by #131, which carries this update together with the PM CLI 2026.10.4 certification.

[dependabot]

Looks like @unbrained/pm-cli is up-to-date now, so this is no longer needed.