chore(deps-dev): bump the pm-toolchain group across 1 directory with 3 updates

[dependabot]

Bumps the pm-toolchain group with 3 updates in the / directory: @unbrained/pm-cli, pm-changelog and pm-ops.

Updates @unbrained/pm-cli from 2026.10.3 to 2026.10.8

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.10.8

@​unbrained/pm-cli 2026.10.8

Source range: v2026.10.7...v2026.10.8

Changelog

Fixed

• Name the rejected custom field in extension-field recovery (pm-field-key-recovery)
• GH-1424: Wait safely for contended Git merge-driver configuration (pm-gh1424)
• GH-1390: Keep trusted merge-receipt attribution and committed reconciliation authoritative (pm-gh1390)
• GH-1405: Settle proven abandoned plain-merge receipts without losing provenance (pm-gh1405)
• Declare non-regular transaction preview paths as recoverable SDK refusals (pm-preview-path-refusal)

Other

• Prove native Git lock retry after observed contention in PR1425 (pm-native-git-retry-proof)
• Bound local temp footprint: prune Node compile cache and guarantee smoke/dogfood sandbox cleanup on failure (pm-p5u6)

PM Tracker Evidence

Closed pm items in release window: 7 By type: Issue=5, Chore=2 By status: closed=7

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.

v2026.10.7

@​unbrained/pm-cli 2026.10.7

Source range: v2026.10.6...v2026.10.7

Changelog

Fixed

• GH-1417: Bundle the tested CLI runtime closure for reproducible npm and Bun installs (pm-gh1417)
• GH-1418: Accept real Bun filtered-test execution receipts (pm-gh1418)
• Prose graph census misses valid item identifiers with multiple hyphens (pm-axotea)
• Include body-only references in strict workspace assurance context (pm-jprn58)
• GH-1413: Preserve lossless producer cursors under amount-only output caps (pm-gh1413)
• GH-1414/GH-1415: Restore portable schema and checksum nightly fixtures (pm-gh1414)
• Expose typed explicit-ID duplicate creation conflicts to SDK callers (pm-gh1400)

Security

• Remove vulnerable MCP Apps development client from the locked dependency tree (GHSA-6qxp-vccf-f47h) (pm-mcpoauth)

... (truncated)

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.10.8 - 2026-10-08

Fixed

• Name the rejected custom field in extension-field recovery (pm-field-key-recovery)
• GH-1424: Wait safely for contended Git merge-driver configuration (pm-gh1424)
• GH-1390: Keep trusted merge-receipt attribution and committed reconciliation authoritative (pm-gh1390)
• GH-1405: Settle proven abandoned plain-merge receipts without losing provenance (pm-gh1405)
• Declare non-regular transaction preview paths as recoverable SDK refusals (pm-preview-path-refusal)

Other

• Prove native Git lock retry after observed contention in PR1425 (pm-native-git-retry-proof)
• Bound local temp footprint: prune Node compile cache and guarantee smoke/dogfood sandbox cleanup on failure (pm-p5u6)

2026.10.7 - 2026-10-07

Fixed

• GH-1417: Bundle the tested CLI runtime closure for reproducible npm and Bun installs (pm-gh1417)
• GH-1418: Accept real Bun filtered-test execution receipts (pm-gh1418)
• Prose graph census misses valid item identifiers with multiple hyphens (pm-axotea)
• Include body-only references in strict workspace assurance context (pm-jprn58)
• GH-1413: Preserve lossless producer cursors under amount-only output caps (pm-gh1413)
• GH-1414/GH-1415: Restore portable schema and checksum nightly fixtures (pm-gh1414)
• Expose typed explicit-ID duplicate creation conflicts to SDK callers (pm-gh1400)

Security

• Remove vulnerable MCP Apps development client from the locked dependency tree (GHSA-6qxp-vccf-f47h) (pm-mcpoauth)

Other

• Deliver canonical strict-create, claim-start and scoped init recovery (pm-flfk2d)

2026.10.6 - 2026-10-06

Fixed

• GH-1394: Define audited owned-subtree replacement for complete-next settings mutations (pm-gh1394)
• GH-1393: Seed truthful schema-context settings history for linked tests (pm-gh1393)
• GH-1411: Compose amount and token ceilings without stale cursors or skipped rows (pm-gh1411)
• GH-1386: remove conflicting global output projection from get recovery retries (pm-gh1386)
• GH-1408: Reduce omission receipt overhead for explicit scalar field projections (pm-gh1408)
• GH-1409/GH-1410: Preserve declared blocker spelling when resolving imported source IDs (pm-gh1409)
• GH-1398: Preserve bare-help discovery before CLI mutations (pm-gh1398)
• GH-1392: Keep extension diagnostics read-only and resolve npm-managed freshness (pm-gh1392)
• PR watch reports success when a mandatory check never reports (pm-zpwfzy)
• Verify immutable Codecov assets and authenticated Cloud report uploads (pm-2x67z9)

... (truncated)

Commits

• 4f3682a chore(release): cut 2026.10.8
• 313fd9b fix(sdk): preserve storage lifetimes and serialize merge setup
• ea434db fix(sdk): restore audited merge recovery and typed preview refusals
• 0c094bc chore(release): cut 2026.10.7
• f81d9a5 Fix SDK graph census and Bun receipts; ship tested runtime bundles (#1421)
• 686e764 Fix lossless reads, typed conflicts, agent recovery and nightly portability
• 6436916 chore(release): cut 2026.10.6
• 7e667e5 fix: compose SDK read ceilings and secure projection recovery (#1412)
• a7c662b Add SDK settings ownership, safe discovery and portable blocker reads (#1402)
• 7077aca chore(release): cut 2026.10.5
• Additional commits viewable in compare view

Updates pm-changelog from 2026.9.25 to 2026.10.5

Release notes

Sourced from pm-changelog's releases.

pm-changelog v2026.10.5

2026.10.5 - 2026-10-05

Fixed

• Keep installed usage documentation links portable and the dependency-updates table row valid (pmc-mwnu)

Other

• Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (pmc-y0a5)

pm-changelog v2026.10.4

No release notes provided.

Changelog

Sourced from pm-changelog's changelog.

2026.10.5 - 2026-10-05

Fixed

• Keep installed usage documentation links portable and the dependency-updates table row valid (pmc-mwnu)

Other

• Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (pmc-y0a5)

Commits

• f241332 Release pm-changelog v2026.10.5
• 3e31f7b Keep installed usage documentation links portable and the dependency-updates ...
• 2c061fc Auto-merge green Dependabot updates and group the pm toolchain into one daily...
• 564cc39 Certify pm-changelog on PM CLI 2026.10.4 and consolidate pending dependency u...
• 5de5ffe Release pm-changelog v2026.10.4
• a102d18 Certify pm-changelog against PM CLI SDK 2026.9.26 (#215)
• See full diff in compare view

Updates pm-ops from 2026.9.29 to 2026.10.6

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.10.06

Changelog

2026.10.5 - 2026-10-05

Fixed

• Cover .tsx, .mts and .cts sources in the docstring and duplication gates, excluding ambient .d.mts/.d.cts declarations (ops-zq8c)

Other

• Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (ops-k1lf)

2026.9.29 - 2026-09-29

Fixed

• Release completeness audit fails a release it just created because the GitHub Release list lags creation (ops-eys5)

2026.9.28 - 2026-09-28

Fixed

• Hoisted broken pm-ops can bypass merge-driver install guard (ops-jzp5)

2026.9.26 - 2026-09-26

Fixed

• A publish that npm accepts late is reported as failed and the GitHub Release is skipped on bun mirror lag (ops-ssnr)
• The guarded launcher template reads a pm-ops directory without package.json as an omit-dev install and skips the merge drivers (ops-eyi8)

Other

• Certify pm CLI 2026.9.23 and adopt the guarded pm-ops merge-driver launcher (ops-me3v)

2026.9.18 - 2026-09-18

Added

• Ship canonical strict ESLint and duplication gates from pm-ops (ops-4phd)
• Ship the merge-driver install step as the canonical pm-ops/merge-driver export (ops-crgk)

Fixed

• pm CLI 2026.9.11 drops every pm-ops command, because its new core ops group collides at group level (ops-k9iv)

Other

• Certify pm CLI 2026.9.17 (ops-xz9q)

... (truncated)

Changelog

Sourced from pm-ops's changelog.

Changelog

2026.10.5 - 2026-10-05

Fixed

• Cover .tsx, .mts and .cts sources in the docstring and duplication gates, excluding ambient .d.mts/.d.cts declarations (ops-zq8c)

Other

• Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (ops-k1lf)

Commits

• fedeb7b Release pm-ops v2026.10.06
• cf17187 chore(deps-dev): bump eslint (#146)
• b097a3f Release pm-ops v2026.10.05
• 8485910 Cover .mts and .cts sources in the docstring and duplication gates (#144)
• 6cf6111 Auto-merge green Dependabot updates and group the pm toolchain into one daily...
• d79c9bd Certify pm-ops on PM CLI 2026.10.4 and consolidate pending dependency updates...
• 57bd2f2 Release pm-ops v2026.10.04
• 3844710 Fix coverage source inventories and preserve nested c8 counters (#134) (#140)
• b97fd99 fix: preserve launcher resolution errors on uncertain probes (#136)
• 437e424 Fix TSX omissions in pm-ops quality gates (#132)
• See full diff in compare view

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 1b237b1f-84e1-4eed-80ce-fe62d81d5eb4

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[unbraind]

@dependabot rebase