chore(deps-dev): bump @unbrained/pm-cli from 2026.9.17 to 2026.9.19

[dependabot]

Bumps @unbrained/pm-cli from 2026.9.17 to 2026.9.19.

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.9.19

@​unbrained/pm-cli 2026.9.19

Source range: v2026.9.18...v2026.9.19

Changelog

Fixed

• Workspace singleton files (settings.json, schema, session-state, checkpoints) are lock-free read-modify-write — parallel pm config set demonstrably loses updates (pm-bgcu)
• The close-time blocker-clear warning names one deleted ordering edge out of N, so silent multi-blocker data loss is indistinguishable from single-blocker clearing (pm-scbr0s)
• Declare and enforce shared default bounds across graph queries (pm-mfy1ux)
• Isolate published MCP verification from the caller global skill catalog (pm-prmt1y)
• The --profile timer reports a fraction of real invocation latency and is documented nowhere, so every latency judgement built on it is calibrated against the wrong number (pm-ag9nka)
• Count successful provenance resolutions so historical health advisories can clear (pm-4f1l7f)
• Isolated release acceptance inherits npm allow-scripts through npm run (pm-64qsbl)
• macOS registry acceptance rejects empty optional flags under Bash nounset (pm-q4avk2)
• Windows transport-floor contract test batches 78 fixtures under one deadline (pm-lgyaw8)

Other

• Fail repository tests on undeclared MCP options including reporter overrides (pm-v0s2rm)
• Reconcile provenance delivery metadata with reviewed implementation (pm-senomv)
• Refresh Node declarations to 26.6.1 for SDK and process timing validation (pm-8p629e)

PM Tracker Evidence

No closed pm tracker items were updated in the selected release window.

v2026.9.18

@​unbrained/pm-cli 2026.9.18

Source range: v2026.9.17...v2026.9.18

Changelog

Fixed

• Allow canonical JSON/TOON encoding on mutations (pm-1rta7z)
• Omit redundant read receipts when canonical output flags do not compact results (pm-g8oh0f)
• Keep the largest list prefix that fits the output budget (pm-15yuly)
• Reject ambiguous event durations with explicit minute and month units (pm-jkjt)
• Packed telemetry acceptance must await completion across delivery batches (pm-07m41m)
• GH-1264: enforce next ready-queue token budgets and disclose omitted recommendations (pm-v53h9j)
• Reject malformed linked-test JSON paths instead of silently normalizing assertions (pm-czr31p)

Security

• Reject inherited array elements in linked-test assertions (pm-1skc)
• Read linked-test JSON assertions without invoking accessors (pm-xxrq)

... (truncated)

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.9.19 - 2026-09-19

Fixed

• Workspace singleton files (settings.json, schema, session-state, checkpoints) are lock-free read-modify-write — parallel pm config set demonstrably loses updates (pm-bgcu)
• The close-time blocker-clear warning names one deleted ordering edge out of N, so silent multi-blocker data loss is indistinguishable from single-blocker clearing (pm-scbr0s)
• Declare and enforce shared default bounds across graph queries (pm-mfy1ux)
• Isolate published MCP verification from the caller global skill catalog (pm-prmt1y)
• The --profile timer reports a fraction of real invocation latency and is documented nowhere, so every latency judgement built on it is calibrated against the wrong number (pm-ag9nka)
• Count successful provenance resolutions so historical health advisories can clear (pm-4f1l7f)
• Isolated release acceptance inherits npm allow-scripts through npm run (pm-64qsbl)
• macOS registry acceptance rejects empty optional flags under Bash nounset (pm-q4avk2)
• Windows transport-floor contract test batches 78 fixtures under one deadline (pm-lgyaw8)

Other

• Fail repository tests on undeclared MCP options including reporter overrides (pm-v0s2rm)
• Reconcile provenance delivery metadata with reviewed implementation (pm-senomv)
• Refresh Node declarations to 26.6.1 for SDK and process timing validation (pm-8p629e)

2026.9.18 - 2026-09-18

Fixed

• Allow canonical JSON/TOON encoding on mutations (pm-1rta7z)
• Omit redundant read receipts when canonical output flags do not compact results (pm-g8oh0f)
• Keep the largest list prefix that fits the output budget (pm-15yuly)
• Reject ambiguous event durations with explicit minute and month units (pm-jkjt)
• Packed telemetry acceptance must await completion across delivery batches (pm-07m41m)
• GH-1264: enforce next ready-queue token budgets and disclose omitted recommendations (pm-v53h9j)
• Reject malformed linked-test JSON paths instead of silently normalizing assertions (pm-czr31p)

Security

• Reject inherited array elements in linked-test assertions (pm-1skc)
• Read linked-test JSON assertions without invoking accessors (pm-xxrq)
• Prevent prototype traversal in nested settings reads and writes (pm-3kk6)
• Share secret and private-context detection between mutation preflight and repository scanning (pm-wwooxx)

Other

• Serialize the complete build pipeline so overlapping validation cannot consume partially rewritten dist artifacts (pm-cxc4jc)
• Released-artifact acceptance: the exact published tarball is installed clean and driven through a scripted agent session before the release is advertised (pm-ygli86)
• Verify explicit calendar duration in package-first dogfood (pm-d9bg0i)
• ADR: Require explicit minute and month units for event durations (pm-j1vw3a)
• Context judgment corpus: small, real-shaped, scale, and returning-agent continuity scenarios for pm context/next (pm-lixy)
• Refresh Sentry 10.75 and CLI 3.8 with Unicorn 75 compatibility proof (pm-1wypwu)

Commits

• cba038e chore(release): cut 2026.9.19
• 95034a6 fix(sdk): preserve concurrent workspace edits and lifecycle receipts (#1277)
• 64aec11 Enforce bounded graph output and MCP acceptance contracts (#1276)
• 14d9920 fix: measure provenance recovery and full CLI invocation latency (#1275)
• 055c081 fix: harden registry acceptance and platform regression gates (#1274)
• 9951344 chore(release): cut 2026.9.18
• b8a0641 fix(sdk): maximize bounded reads and share mutation encoding (#1273)
• 831e5c2 docs(pm): track provenance health success accounting report (#1270)
• e403932 Package calendar scheduling and require explicit duration units (#1268)
• b2755b1 Enforce next budgets and validate context and packed telemetry at scale (#1265)
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: c868f165-06bf-4602-8bcd-5484403cfae7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

PR author is in the excluded authors list.

[unbraind]

Superseded by #112, which moved pm-graph to pm CLI 2026.9.21, the fleet-certified pin.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.