chore(deps-dev): bump @unbrained/pm-cli from 2026.9.29 to 2026.10.1

[dependabot]

Bumps @unbrained/pm-cli from 2026.9.29 to 2026.10.1.

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.10.1

@​unbrained/pm-cli 2026.10.1

Source range: v2026.9.30...v2026.10.1

Changelog

Fixed

• Control native effort in the history/activity provenance fixture (pm-6jvz55)
• GH-1351: leaf get advertises empty children as omitted (pm-x8jdt8)
• GH-1349: Bun 1.3.5 merge installer accepts a transient launcher (pm-aaxq4n)

Security

• Scorecard alert 29: patch new brace-expansion recursion and rewrite denial-of-service advisories (pm-cbzvgn)

PM Tracker Evidence

Closed pm items in release window: 4 By type: Issue=4 By status: closed=4

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.

v2026.9.30

@​unbrained/pm-cli 2026.9.30

Source range: v2026.9.29...v2026.9.30

Changelog

Fixed

• Registry install acceptance loses subprocess timeout and signal evidence and labels every failure as registry availability (pm-q7c36n)
• Bun merge-driver installation disagrees with strict health (pm-vks66s)
• Expose host-bound audited workspace settings mutation to extension commands (pm-wtqltn)
• Full-item stdin JSON update silently ignores edited notes (pm-2589e6)

PM Tracker Evidence

Closed pm items in release window: 4 By type: Issue=4 By status: closed=4

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.10.1 - 2026-10-01

Fixed

• Control native effort in the history/activity provenance fixture (pm-6jvz55)
• GH-1351: leaf get advertises empty children as omitted (pm-x8jdt8)
• GH-1349: Bun 1.3.5 merge installer accepts a transient launcher (pm-aaxq4n)

Security

• Scorecard alert 29: patch new brace-expansion recursion and rewrite denial-of-service advisories (pm-cbzvgn)

2026.9.30 - 2026-09-30

Fixed

• Registry install acceptance loses subprocess timeout and signal evidence and labels every failure as registry availability (pm-q7c36n)
• Bun merge-driver installation disagrees with strict health (pm-vks66s)
• Expose host-bound audited workspace settings mutation to extension commands (pm-wtqltn)
• Full-item stdin JSON update silently ignores edited notes (pm-2589e6)

Commits

• 89b4aa8 chore(release): cut 2026.10.1
• 1e7ecc1 fix: stabilize Bun merge, context reads and dependency security (#1353)
• 344aa7b chore(release): cut 2026.9.30
• d56cae9 Merge pull request #1350 from unbraind/fix/release-origin-and-install-diagnos...
• d28153f fix(release): keep dispatcher timing separate from native cron
• dc9b60e fix(release): recognize Bun registry 404 diagnostics
• 1d2443f fix(release): preserve exact-tag recovery and complete redaction
• 1a4ab2f fix(release): preserve install failure evidence and attribute daily dispatches
• bbfa428 Audit extension settings and item JSON updates; repair Bun merge drivers (#1348)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps @unbrained/pm-cli from 2026.9.29 to 2026.10.1 in dev dependencies.

• 2026.10.1 fixes leaf get advertising empty children as omitted and the Bun 1.3.5 merge installer accepting a transient launcher.
• 2026.9.30 fixes registry install acceptance losing subprocess timeout evidence and full-item stdin JSON updates silently ignoring edited notes.
• Patches a brace-expansion recursion and denial-of-service advisory (Scorecard alert 29).

^{Written for commit ce5802f. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 643e41fe-dd92-4d68-b6de-65c511e98335

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[unbraind]

Superseded by #119, which carries this update together with the PM CLI 2026.10.4 certification.

[dependabot]

Looks like @unbrained/pm-cli is up-to-date now, so this is no longer needed.