chore(deps-dev): bump @unbrained/pm-cli from 2026.10.1 to 2026.10.3 in the pm-toolchain group

[dependabot]

Bumps the pm-toolchain group with 1 update: @unbrained/pm-cli.

Updates @unbrained/pm-cli from 2026.10.1 to 2026.10.3

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.10.3

@​unbrained/pm-cli 2026.10.3

Source range: v2026.10.2...v2026.10.3

Changelog

Fixed

• GH-1354: Linked-test snapshot mode drops nested package dependencies and breaks monorepo acceptance (pm-5iwfkj)

Security

• Scorecard alert 29: patch Axios in the CodSpeed development dependency graph (pm-r61juc)
• Remove unpatched braces recursion vulnerability from file matching (pm-fnx3np)

Other

• Refresh eligible MCP Apps 2.0.3 SDK type contracts (pm-iktual)

PM Tracker Evidence

Closed pm items in release window: 4 By type: Issue=3, Chore=1 By status: closed=4

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.

v2026.10.2

@​unbrained/pm-cli 2026.10.2

Source range: v2026.10.1...v2026.10.2

Changelog

Fixed

• GH-1370: validate transaction previews against staged lifecycle state (pm-gh1370)
• GH-1371: compose output budget and producer pagination (pm-gh1371)
• GH-1364: preserve tracker scope and valid projection in recovery (pm-gh1364)

PM Tracker Evidence

Closed pm items in release window: 3 By type: Issue=3 By status: closed=3

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.10.3 - 2026-10-03

Security

• Scorecard alert 29: patch Axios in the CodSpeed development dependency graph (pm-r61juc)
• Remove unpatched braces recursion vulnerability from file matching (pm-fnx3np)

Other

• Refresh eligible MCP Apps 2.0.3 SDK type contracts (pm-iktual)

2026.10.2 - 2026-10-02

Fixed

• GH-1370: validate transaction previews against staged lifecycle state (pm-gh1370)
• GH-1371: compose output budget and producer pagination (pm-gh1371)
• GH-1364: preserve tracker scope and valid projection in recovery (pm-gh1364)

Commits

• ca6e718 chore(release): cut 2026.10.3
• d729dd0 Preserve monorepo test dependencies and secure SDK file matching and CodSpeed
• b52bb3b chore(release): cut 2026.10.2
• 7f8ffdd Merge pull request #1372 from unbraind/fix/agent-recovery-pagination-preflight
• 295781a Handle settings open races and verify shipped preview transport
• 4a7274e Verify retained preview state and qualify portable filesystem guarantees
• fb7aa33 fix: preserve preview startup safety and complete recovery and pagination con...
• 16bb75f fix: preserve review receipts and use static preview test types
• 4814e52 chore: record verified recovery pagination and preview closeout
• 92cff9e test: discover packed artifacts across npm versions
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Summary by cubic

Bumps @unbrained/pm-cli from 2026.10.1 to 2026.10.3 in the pm-toolchain group.

The update fixes linked-test snapshot mode dropping nested package dependencies in monorepos, validates transaction previews against the staged lifecycle state, and fixes output budget and producer pagination. It also patches Axios in the CodSpeed development dependency graph and removes a braces recursion vulnerability by swapping fast-glob for tinyglobby in file matching.

^{Written for commit 0068a48. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 83d871ee-cabe-4d86-bbaa-f534f80af491

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

PR author is in the excluded authors list.