[dependabot]

Bumps the pm-toolchain group with 3 updates in the / directory: @unbrained/pm-cli, pm-changelog and pm-ops.

Updates @unbrained/pm-cli from 2026.10.17 to 2026.10.20

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.10.20

@​unbrained/pm-cli 2026.10.20

Source range: v2026.10.19...v2026.10.20

Changelog

Changed

• Refresh seven-day-eligible marked 18.1.1 Markdown tooling (pm-argzmt)

Fixed

• GH-1500: Preserve null, empty and reserved JSON row facts through host rendering (pm-4euctr)
• GH-1501: Compact default brief-list TOON envelopes without hiding source completeness (pm-6pycus)
• Align token-budget recovery declaration states with the public runtime guard (pm-8jzcwv)
• Preserve authoritative history after native SQLite transaction startup failures (pm-0orupq)
• Bound recovery probes by missing-reference rendering retries (pm-k6uglj)
• Probe canonical include-mode retries with their actual packing policy (pm-0bbc53)
• Enforce rendered relationship budgets with expected SDK usage recovery (pm-odw3j8)
• Preserve expected check publishers in PR readiness receipts (pm-5p48kf)
• Bound complete macOS nightly validation with two shards (pm-qrirz8)
• Run Git-heavy merge regression files after parallel contract workers (pm-89297t)
• Show failed required PR checks before waiting on pending optional reviewers (pm-jm7m3o)
• item mutate --dry-run does not surface per-row advisory duplicate-detection warnings (pm-ekf2gu)

Security

• GH-1504: Refresh eligible Actions and executed secret-scanner contracts (pm-396dil)

Other

• Assemble complete review receipts without mutating the base receipt (pm-gfksc7)
• Qualify Unicorn 78 after its exact release-age boundary (pm-afshwe)
• Refresh newly matured TypeScript-ESLint 8.71.2 quality tooling (pm-vcy3vq)
• Run the command-example corpus scan after parallel coverage workers (pm-a3c6g4)
• Transaction preview refusal should identify a safe relative offending path (pm-fa9olc)

PM Tracker Evidence

Closed pm items in release window: 17 By type: Task=11, Chore=5, Issue=1 By status: closed=17

Selected release-related tracker items:

• pm-afshwe [Chore/closed] Qualify Unicorn 78 after its exact release-age boundary

v2026.10.19

@​unbrained/pm-cli 2026.10.19

... (truncated)

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.10.20 - 2026-10-20

Changed

• Refresh seven-day-eligible marked 18.1.1 Markdown tooling (pm-argzmt)

Fixed

• GH-1500: Preserve null, empty and reserved JSON row facts through host rendering (pm-4euctr)
• GH-1501: Compact default brief-list TOON envelopes without hiding source completeness (pm-6pycus)
• Align token-budget recovery declaration states with the public runtime guard (pm-8jzcwv)
• Preserve authoritative history after native SQLite transaction startup failures (pm-0orupq)
• Bound recovery probes by missing-reference rendering retries (pm-k6uglj)
• Probe canonical include-mode retries with their actual packing policy (pm-0bbc53)
• Enforce rendered relationship budgets with expected SDK usage recovery (pm-odw3j8)
• Preserve expected check publishers in PR readiness receipts (pm-5p48kf)
• Bound complete macOS nightly validation with two shards (pm-qrirz8)
• Run Git-heavy merge regression files after parallel contract workers (pm-89297t)
• Show failed required PR checks before waiting on pending optional reviewers (pm-jm7m3o)
• item mutate --dry-run does not surface per-row advisory duplicate-detection warnings (pm-ekf2gu)

Security

• GH-1504: Refresh eligible Actions and executed secret-scanner contracts (pm-396dil)

Other

• Assemble complete review receipts without mutating the base receipt (pm-gfksc7)
• Qualify Unicorn 78 after its exact release-age boundary (pm-afshwe)
• Refresh newly matured TypeScript-ESLint 8.71.2 quality tooling (pm-vcy3vq)
• Run the command-example corpus scan after parallel coverage workers (pm-a3c6g4)
• Transaction preview refusal should identify a safe relative offending path (pm-fa9olc)

2026.10.19 - 2026-10-19

Fixed

• GH-1475: settle authenticated lossless merges within one reviewed delivery (pm-gh1475)
• GH-1491: Preserve both add/add snapshots on ambiguous creation ancestry (pm-gh1491)
• Recognize literal dynamic imports in module-usage evidence (pm-f38ovr)
• Keep recovery and help examples on canonical list commands (pm-mw5gip)
• Accept encoding format aliases on core item collections and mutations (pm-frbf0j)

2026.10.18 - 2026-10-18

Fixed

• Retain tested optional-peer closures in the published runtime bundle (pm-iceees)
• Fail the required coverage aggregate when any shard fails or is skipped (pm-0p4aal)
• Invalidate shared history projections when writers lack SQLite (pm-f7shxf)

... (truncated)

Commits

• a627deb chore(release): cut 2026.10.20
• 26fda75 Fix context recovery and review readiness; stabilize native validation (#1508)
• e321723 Align recovery declaration states with validated budget evidence
• 5f9cb46 refactor: assemble complete review receipts as fresh results
• fd5508f docs: record complete native acceptance for reviewed SDK fixes
• dd097e4 fix: bound reference recovery work and preserve history after SQLite startup ...
• e30d553 fix: verify context retry budgets with canonical include modes
• 6385def Complete context recovery, mature tooling and reviewed closeout
• 22edcd0 Honor explicit TOON policy in dependency budget accounting
• a235a7e Verify context-budget retries and preserve invocation scope
• Additional commits viewable in compare view

Updates pm-changelog from 2026.10.16 to 2026.10.20

Release notes

Sourced from pm-changelog's releases.

pm-changelog v2026.10.20

No release notes provided.

pm-changelog v2026.10.19

No release notes provided.

pm-changelog v2026.10.19-1

2026.10.19-1 - 2026-10-19

Fixed

• Publish same-day calendar suffixes with an explicit latest dist-tag (pmc-udb5)
• Request the full list projection explicitly for whole-tracker changelog reads (pmc-zfyb)

pm-changelog v2026.10.17

No release notes provided.

Changelog

Sourced from pm-changelog's changelog.

Changelog

Compatibility: explicit tag options (--all-release-tags, --since-previous-tag, --until-release-tag) now require an accessible Git repository and fail with MissingTagHistoryError in source archives and container contexts without Git history. Use tracker-only generation or --milestones there.

2026.10.23 - 2026-10-23

Changed

• Adopt pm-github 2026.10.16: default-branch-safe gated sync and daily gated closeout PRs (pmc-6edv)
• Enable the gated GitHub issue sync (pmc-ctr2)

Fixed

• Track merge receipts so pm 2026.10.19+ can settle lossless merges (pmc-pnaq)
• A release run bumped and committed a new version every night while publishing was impossible, and the changelog-date verifier was never invoked by a gate (pmc-3u78)
• Let an item supply a release note the changelog prefers over its defect-shaped title (pmc-fzs6)
• Harden the release merge wait against mergeStateStatus deadlock (pmc-blj6)
• A test asserts an error that only occurs when no package.json exists anywhere above the OS temp directory, so it fails on a host where one does (pmc-6eau)
• List closed issues under Fixed only when a repair is recorded (pmc-txk1)
• This package generates its own changelog without the flag that stops the heading date coming from the clock (pmc-q22j)
• Link custom-type items to their registered tracker folders (pmc-rspo)
• The release job authenticated with a stored npm token that expired, so publishing stopped while every other gate stayed green (pmc-4xu9)

Security

• Consume the canonical attestation gate instead of carrying a copy of it (pmc-wf7n)

Other

• Record pi-land-a merge-readiness verification pass for PR 215 (pmc-wgte)
• Certify pm-changelog on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates (pmc-38z4)

2026.10.19-1 - 2026-10-19

Fixed

• Publish same-day calendar suffixes with an explicit latest dist-tag (pmc-udb5)
• Request the full list projection explicitly for whole-tracker changelog reads (pmc-zfyb)

2026.10.14 - 2026-10-14

Fixed

• Preserve shipped entries when completed items are reopened and closed again (pmc-reopened-history)

2026.10.12 - 2026-10-12

Added

• Changelog entries can use resolution prose, and --check warns about defect-shaped titles (pmc-d3ds)

... (truncated)

Commits

• 55c4fac Release pm-changelog v2026.10.20
• 0362c96 chore(deps-dev): bump pm-ops (#260)
• d80fdea fix(release): select latest for numeric calendar suffixes
• 62831c1 Release pm-changelog v2026.10.19-1
• 38b0a89 fix(changelog): retain complete tracker fields in generation
• cd60a26 Release pm-changelog v2026.10.19
• 6273a9b chore(deps-dev): bump the pm-toolchain group with 2 updates (#255)
• 17f2f7a chore(deps-dev): bump the pm-toolchain group across 1 directory with 2 update...
• b9c91c5 Keep the release version regex readable by the workflow auditor (#254)
• 4711012 Release pm-changelog v2026.10.17
• Additional commits viewable in compare view

Updates pm-ops from 2026.10.17 to 2026.10.20

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.10.19

Changelog

2026.10.15 - 2026-10-15

Security

• Remove the unpatched braces chain with built-in fs.glob and jscpd 5 only (ops-braces-audit)

2026.10.14 - 2026-10-14

Fixed

• Reject unresolved alias and function publish indirection in canonical attestation auditor (ops-publish-indirection)
• Keep merge-driver prepare read-only during npm pack and publish (ops-pack-prepare)

2026.10.12 - 2026-10-12

Added

• Repair an incomplete release triple, instead of only reporting it every day (ops-3j1z)

Fixed

• Make historical Windows proof evidence available in fresh clones (ops-kw02)

Other

• Certify pm-ops on PM CLI/SDK 2026.10.10 with linear declaration scanner (ops-hiee)

2026.10.5 - 2026-10-05

Fixed

• Cover .tsx, .mts and .cts sources in the docstring and duplication gates, excluding ambient .d.mts/.d.cts declarations (ops-zq8c)

Other

• Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (ops-k1lf)

2026.9.29 - 2026-09-29

Fixed

• Release completeness audit fails a release it just created because the GitHub Release list lags creation (ops-eys5)

2026.9.28 - 2026-09-28

Fixed

... (truncated)

Commits

• ee02973 Release pm-ops v2026.10.20
• ace3231 chore(deps-dev): bump eslint (#185)
• f422ab4 chore(deps-dev): bump the pm-toolchain group with 2 updates (#184)
• c3af218 Release pm-ops v2026.10.19
• 61bda59 chore(deps-dev): bump the pm-toolchain group with 2 updates (#181)
• 298461d Release pm-ops v2026.10.18
• 5baf921 chore(deps): bump the codeql-actions group with 2 updates (#179)
• See full diff in compare view

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 19fcc975-0385-4592-ae83-e49b5fe7ea96

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[unbraind]

@dependabot recreate

[unbraind]

@dependabot recreate

[unbraind]

@dependabot recreate