build(deps-dev): bump the pm-toolchain group with 3 updates

[dependabot]

Bumps the pm-toolchain group with 3 updates: @unbrained/pm-cli, pm-changelog and pm-ops.

Updates @unbrained/pm-cli from 2026.10.5 to 2026.10.6

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.10.6

@​unbrained/pm-cli 2026.10.6

Source range: v2026.10.5...v2026.10.6

Changelog

Fixed

• GH-1394: Define audited owned-subtree replacement for complete-next settings mutations (pm-gh1394)
• GH-1393: Seed truthful schema-context settings history for linked tests (pm-gh1393)
• GH-1411: Compose amount and token ceilings without stale cursors or skipped rows (pm-gh1411)
• GH-1386: remove conflicting global output projection from get recovery retries (pm-gh1386)
• GH-1408: Reduce omission receipt overhead for explicit scalar field projections (pm-gh1408)
• GH-1409/GH-1410: Preserve declared blocker spelling when resolving imported source IDs (pm-gh1409)
• GH-1398: Preserve bare-help discovery before CLI mutations (pm-gh1398)
• GH-1392: Keep extension diagnostics read-only and resolve npm-managed freshness (pm-gh1392)
• PR watch reports success when a mandatory check never reports (pm-zpwfzy)
• Verify immutable Codecov assets and authenticated Cloud report uploads (pm-2x67z9)

Security

• CodeQL 43: keep worker-bridge debug diagnostics free of raw arguments and stderr (pm-cql43)
• Dependabot 47 and Scorecard 29: patch indexed source-map offset denial of service (pm-dba47)
• Adopt CodeQL 4.38.2 and TruffleHog 3.97.9 immutable scanner updates (pm-gh1404)

Other

• Refresh aged SonarJS 4.2.2 and TypeScript-ESLint 8.71 quality tooling (pm-l8dzdv)

PM Tracker Evidence

Closed pm items in release window: 13 By type: Issue=10, Task=1, Chore=2 By status: closed=13

Selected release-related tracker items:

• pm-gh1409 [Issue/closed] GH-1409/GH-1410: Preserve declared blocker spelling when resolving imported source IDs

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.10.6 - 2026-10-06

Fixed

• GH-1394: Define audited owned-subtree replacement for complete-next settings mutations (pm-gh1394)
• GH-1393: Seed truthful schema-context settings history for linked tests (pm-gh1393)
• GH-1411: Compose amount and token ceilings without stale cursors or skipped rows (pm-gh1411)
• GH-1386: remove conflicting global output projection from get recovery retries (pm-gh1386)
• GH-1408: Reduce omission receipt overhead for explicit scalar field projections (pm-gh1408)
• GH-1409/GH-1410: Preserve declared blocker spelling when resolving imported source IDs (pm-gh1409)
• GH-1398: Preserve bare-help discovery before CLI mutations (pm-gh1398)
• GH-1392: Keep extension diagnostics read-only and resolve npm-managed freshness (pm-gh1392)
• PR watch reports success when a mandatory check never reports (pm-zpwfzy)
• Verify immutable Codecov assets and authenticated Cloud report uploads (pm-2x67z9)

Security

• CodeQL 43: keep worker-bridge debug diagnostics free of raw arguments and stderr (pm-cql43)
• Dependabot 47 and Scorecard 29: patch indexed source-map offset denial of service (pm-dba47)
• Adopt CodeQL 4.38.2 and TruffleHog 3.97.9 immutable scanner updates (pm-gh1404)

Other

• Refresh aged SonarJS 4.2.2 and TypeScript-ESLint 8.71 quality tooling (pm-l8dzdv)

Commits

• 6436916 chore(release): cut 2026.10.6
• 7e667e5 fix: compose SDK read ceilings and secure projection recovery (#1412)
• a7c662b Add SDK settings ownership, safe discovery and portable blocker reads (#1402)
• See full diff in compare view

Updates pm-changelog from 2026.10.4 to 2026.10.5

Release notes

Sourced from pm-changelog's releases.

pm-changelog v2026.10.5

2026.10.5 - 2026-10-05

Fixed

• Keep installed usage documentation links portable and the dependency-updates table row valid (pmc-mwnu)

Other

• Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (pmc-y0a5)

Changelog

Sourced from pm-changelog's changelog.

2026.10.5 - 2026-10-05

Fixed

• Keep installed usage documentation links portable and the dependency-updates table row valid (pmc-mwnu)

Other

• Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (pmc-y0a5)

2026.9.25 - 2026-09-25

Added

• Add opt-in Dependabot dependency sections so item-less release windows still get notes (pmc-ny9i)

Fixed

• Include extension-registered item types in changelog generation and body previews (pmc-k1oq)
• A publish that npm accepts late is reported as failed and the GitHub Release is skipped on bun mirror lag (pmc-piam)

Other

• Certify pm CLI 2026.9.23 and adopt the guarded pm-ops merge-driver launcher (pmc-pcax)

2026.9.23 - 2026-09-23

Other

• Certify pm CLI 2026.9.21 and install merge drivers through the canonical pm-ops launcher (pmc-psin)

2026.9.18 - 2026-09-18

Other

• Certify pm CLI 2026.9.17 (pmc-r1qu)

2026.9.15 - 2026-09-15

Fixed

• Include configured custom item types in changelog generation and export (pmc-vnke)

2026.9.13 - 2026-09-13

Other

• Group the codeql-action init and analyze updates so Dependabot stops splitting a pair that must match (pmc-fi6u)
• Certify pm CLI 2026.9.12 and the pm-ops 2026.9.11 auditor (pmc-s7bi)

... (truncated)

Commits

• f241332 Release pm-changelog v2026.10.5
• 3e31f7b Keep installed usage documentation links portable and the dependency-updates ...
• 2c061fc Auto-merge green Dependabot updates and group the pm toolchain into one daily...
• 564cc39 Certify pm-changelog on PM CLI 2026.10.4 and consolidate pending dependency u...
• See full diff in compare view

Updates pm-ops from 2026.10.5 to 2026.10.6

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.10.06

Changelog

2026.10.5 - 2026-10-05

Fixed

• Cover .tsx, .mts and .cts sources in the docstring and duplication gates, excluding ambient .d.mts/.d.cts declarations (ops-zq8c)

Other

• Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (ops-k1lf)

2026.9.29 - 2026-09-29

Fixed

• Release completeness audit fails a release it just created because the GitHub Release list lags creation (ops-eys5)

2026.9.28 - 2026-09-28

Fixed

• Hoisted broken pm-ops can bypass merge-driver install guard (ops-jzp5)

2026.9.26 - 2026-09-26

Fixed

• A publish that npm accepts late is reported as failed and the GitHub Release is skipped on bun mirror lag (ops-ssnr)
• The guarded launcher template reads a pm-ops directory without package.json as an omit-dev install and skips the merge drivers (ops-eyi8)

Other

• Certify pm CLI 2026.9.23 and adopt the guarded pm-ops merge-driver launcher (ops-me3v)

2026.9.18 - 2026-09-18

Added

• Ship canonical strict ESLint and duplication gates from pm-ops (ops-4phd)
• Ship the merge-driver install step as the canonical pm-ops/merge-driver export (ops-crgk)

Fixed

• pm CLI 2026.9.11 drops every pm-ops command, because its new core ops group collides at group level (ops-k9iv)

Other

• Certify pm CLI 2026.9.17 (ops-xz9q)

... (truncated)

Changelog

Sourced from pm-ops's changelog.

Changelog

Commits

• fedeb7b Release pm-ops v2026.10.06
• cf17187 chore(deps-dev): bump eslint (#146)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Summary by cubic

Bumps the pm-toolchain dev dependency group: @unbrained/pm-cli to 2026.10.6, pm-changelog to 2026.10.5, and pm-ops to 2026.10.6. The @unbrained/pm-cli update includes several bug fixes and security patches; the other two are minor fixes with no breaking changes to the toolchain.

^{Written for commit 4baa934. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 6406c887-4d53-40a0-b14d-800e4438be57

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}