chore(deps-dev): bump the pm-toolchain group across 1 directory with 3 updates

[dependabot]

Bumps the pm-toolchain group with 3 updates in the / directory: @unbrained/pm-cli, pm-changelog and pm-ops.

Updates @unbrained/pm-cli from 2026.10.11 to 2026.10.13

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.10.13

@​unbrained/pm-cli 2026.10.13

Source range: v2026.10.12...v2026.10.13

Changelog

Added

• Let SDK extension read commands opt into universal context output controls (pm-extension-read-output-controls)

Fixed

• Avoid mutation-output flags when recovering an unsupported read projection (pm-o0tkr6)
• Preserve MCP warning enforcement when late console logs lack module attribution (pm-bbyopg)
• Expose safe reviewed migration for historical merge receipts (pm-tknnzp)
• Accept actively registered relationship kinds in SDK and CLI dependency mutations (pm-7dsolo)
• Protect distribution inventory and staging from concurrent dist rebuilds (pm-distribution-consumer-lease)
• Preserve documented SDK schema field types through typed helpers (pm-ty5i58)
• Core external-reference refusal recommends a flag absent from the CLI lexicon (pm-by83yj)
• GH-1443: align item and history union ordering and provenance during lossless merges (pm-pftgcz)
• Make assurance risk help include the required recurrence policy (pm-assurance-risk-help-policy)

Other

• Refresh eligible Markdown and lint tooling and record pending dependency migrations (pm-0uxmwf)
• Deduplicate hosted Commander recovery-context projection (pm-nrj9sy)
• Refresh eligible SDK and CI dependencies (pm-98f0ec)
• Accept universal SDK read receipts in the public context evaluation reader (pm-i4kxx1)
• Expose active planning recovery when a canonical item is reopened (pm-reopen-planning-recovery)
• Compact declaration indentation while preserving SDK types and documentation (pm-chw71s)

PM Tracker Evidence

Closed pm items in release window: 17 By type: Issue=10, Task=3, Feature=1, Chore=3 By status: closed=17

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.

v2026.10.12

@​unbrained/pm-cli 2026.10.12

Source range: v2026.10.11...v2026.10.12

Changelog

Fixed

... (truncated)

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.10.13 - 2026-10-13

Added

• Let SDK extension read commands opt into universal context output controls (pm-extension-read-output-controls)

Fixed

• Avoid mutation-output flags when recovering an unsupported read projection (pm-o0tkr6)
• Preserve MCP warning enforcement when late console logs lack module attribution (pm-bbyopg)
• Expose safe reviewed migration for historical merge receipts (pm-tknnzp)
• Accept actively registered relationship kinds in SDK and CLI dependency mutations (pm-7dsolo)
• Protect distribution inventory and staging from concurrent dist rebuilds (pm-distribution-consumer-lease)
• Preserve documented SDK schema field types through typed helpers (pm-ty5i58)
• Core external-reference refusal recommends a flag absent from the CLI lexicon (pm-by83yj)
• GH-1443: align item and history union ordering and provenance during lossless merges (pm-pftgcz)
• Make assurance risk help include the required recurrence policy (pm-assurance-risk-help-policy)

Other

• Compact declaration indentation while preserving SDK types and documentation (pm-chw71s)
• Refresh eligible Markdown and lint tooling and record pending dependency migrations (pm-0uxmwf)
• Deduplicate hosted Commander recovery-context projection (pm-nrj9sy)
• Refresh eligible SDK and CI dependencies (pm-98f0ec)
• Accept universal SDK read receipts in the public context evaluation reader (pm-i4kxx1)
• Expose active planning recovery when a canonical item is reopened (pm-reopen-planning-recovery)

2026.10.12 - 2026-10-12

Fixed

• GH-1440: validate linked-test context at write time and distinguish execution refusals (pm-gh1440)
• Declare calendar package positional signatures in the SDK grammar census (pm-kki6bf)
• Reject sparse artifact ledger inputs through both public SDK exports (pm-ledger-sparse-delivery)
• Prevent exact-tag recovery from republishing an accepted npm version while public metadata is unavailable (pm-publication-acceptance-fence)
• Expose the test measurement run prerequisite in help and recovery (pm-test-measure-prerequisite)

Other

• Edit linked-test metadata in place with preserved provenance and atomic history (pm-9djr6d)
• Keep linked-test SDK delivery within publication budgets using authoritative API references (pm-4g4qv0)
• Preserve fail-closed startup benchmark runner qualification and complete diagnostics (pm-runner-qualification-delivery)
• Include declared morning automation in daily release blocker alerts and successful recovery (pm-automatic-release-alerts)
• Deliver unambiguous registry-derived namespace recovery across installed Node and Bun consumers (pm-namespace-recovery-delivery)

Commits

• 828edf4 chore(release): cut 2026.10.13
• f5f1bc5 feat(sdk): share universal context output controls with package readers (#1454)
• d0786dc Merge pull request #1453 from unbraind/fix/sdk-relationship-receipt-compatibi...
• 6e365a4 Record scoped telemetry pairing and historical audit limitations
• 1d86880 Require sealed receipt audits and complete reviewed delivery evidence
• 8eb1e56 Fix registered relationship writes and legacy merge settlement compatibility
• a91fed3 Merge pull request #1451 from unbraind/fix/sdk-consumer-contracts-oct12
• 8473d10 fix(release): acquire independent leases for unavailable owner paths
• 2c8795b chore(pm): record late registered-relationship mutation report
• c22cc8b docs(pm): close verified SDK delivery and generate release notes
• Additional commits viewable in compare view

Updates pm-changelog from 2026.10.5 to 2026.10.12

Release notes

Sourced from pm-changelog's releases.

pm-changelog v2026.10.12

2026.10.12 - 2026-10-12

Added

• Changelog entries can use resolution prose, and --check warns about defect-shaped titles (pmc-d3ds)

Fixed

• Refuse explicit partial-read envelopes supplied to changelog generation (pmc-n4qu)
• Make node-entrypoint fixture teardown reliable (pmc-node-teardown-226)

Changelog

Sourced from pm-changelog's changelog.

2026.10.12 - 2026-10-12

Added

• Changelog entries can use resolution prose, and --check warns about defect-shaped titles (pmc-d3ds)

Fixed

• Refuse explicit partial-read envelopes supplied to changelog generation (pmc-n4qu)
• Make node-entrypoint fixture teardown reliable (pmc-node-teardown-226)

Commits

• e1cb885 Release pm-changelog v2026.10.12
• b57d639 docs: reconcile delivered changelog feature evidence
• d29b589 Prefer resolution prose for changelog entries and warn on defect titles (#231)
• 5af8dd7 chore(deps-dev): bump marked (#234)
• a9477d4 chore(deps-dev): bump pm-ops (#233)
• 2443794 chore(deps-dev): bump @​unbrained/pm-cli (#232)
• 998688d Close pmc-n4qu after #229 merged (#230)
• 878bf76 Refuse explicit partial-read receipts and unproven certificates in caller JSO...
• f5ed3ab Close pmc-node-teardown-226 after #227 merged (#228)
• 1d4f493 Keep fixture telemetry workers out of the node-entrypoint teardown (#227)
• See full diff in compare view

Updates pm-ops from 2026.10.6 to 2026.10.12

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.10.12

Changelog

2026.10.12 - 2026-10-12

Added

• Repair an incomplete release triple, instead of only reporting it every day (ops-3j1z)

Fixed

• Make historical Windows proof evidence available in fresh clones (ops-kw02)

Other

• Certify pm-ops on PM CLI/SDK 2026.10.10 with linear declaration scanner (ops-hiee)

2026.10.5 - 2026-10-05

Fixed

• Cover .tsx, .mts and .cts sources in the docstring and duplication gates, excluding ambient .d.mts/.d.cts declarations (ops-zq8c)

Other

• Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (ops-k1lf)

2026.9.29 - 2026-09-29

Fixed

• Release completeness audit fails a release it just created because the GitHub Release list lags creation (ops-eys5)

2026.9.28 - 2026-09-28

Fixed

• Hoisted broken pm-ops can bypass merge-driver install guard (ops-jzp5)

2026.9.26 - 2026-09-26

Fixed

• A publish that npm accepts late is reported as failed and the GitHub Release is skipped on bun mirror lag (ops-ssnr)
• The guarded launcher template reads a pm-ops directory without package.json as an omit-dev install and skips the merge drivers (ops-eyi8)

Other

• Certify pm CLI 2026.9.23 and adopt the guarded pm-ops merge-driver launcher (ops-me3v)

... (truncated)

Changelog

Sourced from pm-ops's changelog.

2026.10.12 - 2026-10-12

Added

• Repair an incomplete release triple, instead of only reporting it every day (ops-3j1z)

Fixed

• Make historical Windows proof evidence available in fresh clones (ops-kw02)

Other

• Certify pm-ops on PM CLI/SDK 2026.10.10 with linear declaration scanner (ops-hiee)

2026.10.5 - 2026-10-05

Fixed

• Cover .tsx, .mts and .cts sources in the docstring and duplication gates, excluding ambient .d.mts/.d.cts declarations (ops-zq8c)

Other

• Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (ops-k1lf)

2026.9.29 - 2026-09-29

Fixed

• Release completeness audit fails a release it just created because the GitHub Release list lags creation (ops-eys5)

2026.9.28 - 2026-09-28

Fixed

• Hoisted broken pm-ops can bypass merge-driver install guard (ops-jzp5)

2026.9.26 - 2026-09-26

Fixed

• A publish that npm accepts late is reported as failed and the GitHub Release is skipped on bun mirror lag (ops-ssnr)
• The guarded launcher template reads a pm-ops directory without package.json as an omit-dev install and skips the merge drivers (ops-eyi8)

Other

• Certify pm CLI 2026.9.23 and adopt the guarded pm-ops merge-driver launcher (ops-me3v)

2026.9.18 - 2026-09-18

Added

... (truncated)

Commits

• ca604a7 Release pm-ops v2026.10.12
• ece5761 Close tracker items delivered by merged pull requests (#157)
• 126c7bc Make dependency acceptance self-syncing across SDK bumps (#155)
• 33824d6 chore(deps): bump the codeql-actions group across 1 directory with 2 updates ...
• a456302 feat: repair incomplete release triples from verified npm evidence (#150)
• 69700b0 chore(deps-dev): bump pm-changelog (#153)
• 223621f Fix Windows proof fixtures after squash merges (#156)
• 3fca1f2 Audit nested publishers with linear parsing and preserve consumer Git config ...
• See full diff in compare view

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: fa9fef44-0168-40d5-95ab-353ada06fa9b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}