chore(deps-dev): bump pm-changelog from 2026.7.25 to 2026.7.28

[dependabot]

Bumps pm-changelog from 2026.7.25 to 2026.7.28.

Release notes

Sourced from pm-changelog's releases.

pm-changelog v2026.7.28

2026.7.28 - 2026-07-28

Added

• Report the actual changelog drift as a diff when check fails (pmc-r0nj)

Other

• Adopt pm-cli 2026.7.28 and harmonize the production audit script (pmc-4w23)
• Adopt pm-cli 2026.7.27 dependency ranges (pmc-58zs)

pm-changelog v2026.7.27

2026.7.27 - 2026-07-27

Other

• Exclude generated dist output from DeepScan static analysis (pmc-mi7s)
• Replace hand-built api doubles in extension tests with the SDK activation harness (pmc-x0u4)

pm-changelog v2026.7.26

2026.7.26 - 2026-07-26

Other

• Enable governance duplicate-detection advisory mode and adopt pm-cli 2026.7.25 (pmc-zbj2)

Changelog

Sourced from pm-changelog's changelog.

2026.7.28 - 2026-07-28

Added

• Report the actual changelog drift as a diff when check fails (pmc-r0nj)

Other

• Adopt pm-cli 2026.7.28 and harmonize the production audit script (pmc-4w23)
• Adopt pm-cli 2026.7.27 dependency ranges (pmc-58zs)

2026.7.27 - 2026-07-27

Other

• Exclude generated dist output from DeepScan static analysis (pmc-mi7s)
• Replace hand-built api doubles in extension tests with the SDK activation harness (pmc-x0u4)

2026.7.26 - 2026-07-26

Other

• Enable governance duplicate-detection advisory mode and adopt pm-cli 2026.7.25 (pmc-zbj2)

Commits

• 9ef3162 Adopt pm-cli 2026.7.28 and harmonize the production audit script (#104)
• fdaaaa8 feat(check): report the actual changelog drift as a diff when check fails (#103)
• d9d2459 chore: adopt pm-cli 2026.7.27 dependency ranges (#102)
• 8ae46c2 Release pm-changelog v2026.7.27
• e1d507e chore(ci): exclude generated dist output from DeepScan analysis (#100)
• ecec8cf Verify the pm-changelog extension through pm's real activation harness instea...
• e126a8b Release pm-changelog v2026.7.26
• 33007d8 chore(governance): enable duplicate-detection advisory mode and adopt pm-cli ...
• 874fb0d chore(deps-dev): bump @​unbrained/pm-cli from 2026.7.24 to 2026.7.25 (#96)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bump dev tool pm-changelog to 2026.7.28. Failed changelog checks now show a diff to highlight drift.

• Dependencies

  • Update pm-changelog to 2026.7.28; upstream now peers on @unbrained/pm-cli >= 2026.7.28.

• Migration

  • If you run the pm CLI locally or in CI, ensure @unbrained/pm-cli is >= 2026.7.28.

^{Written for commit 5558e87. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[unbraind]

Dev-dependency bump, all checks green including the coverage gate at its full threshold and the changelog check. Merging.

Noted for the record because it is not obvious: a dependency bump can fail changelog:check in this fleet, and when it does the bump is not the cause. The check regenerates CHANGELOG.md from the tracker and compares, so if main's changelog has drifted — which happens when a branch created before a release bump is merged without rebasing onto it — then every pull request fails, dependabot's included. Two sibling packages were in exactly that state today. If a future bump here fails this check, regenerate on main first rather than looking at the dependency.