[dependabot]

Bumps the pm-toolchain group with 3 updates in the / directory: @unbrained/pm-cli, pm-changelog and pm-ops.

Updates @unbrained/pm-cli from 2026.10.17 to 2026.10.19

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.10.19 - 2026-10-19

Fixed

• GH-1475: settle authenticated lossless merges within one reviewed delivery (pm-gh1475)
• GH-1491: Preserve both add/add snapshots on ambiguous creation ancestry (pm-gh1491)
• Recognize literal dynamic imports in module-usage evidence (pm-f38ovr)
• Keep recovery and help examples on canonical list commands (pm-mw5gip)
• Accept encoding format aliases on core item collections and mutations (pm-frbf0j)

2026.10.18 - 2026-10-18

Fixed

• Retain tested optional-peer closures in the published runtime bundle (pm-iceees)
• Fail the required coverage aggregate when any shard fails or is skipped (pm-0p4aal)
• Invalidate shared history projections when writers lack SQLite (pm-f7shxf)
• GH-1485: Bound history-index reader contention before authoritative appends (pm-gh1485)
• Keep mutation-event subscriptions available when optional index rebuilds race or contend (pm-xj80p9)
• GH-1487: Respect nested Git repository boundaries during tracker discovery (pm-gh1487)
• GH-1484: Infer native Node test telemetry and bound intentional test flush lifetime (pm-gh1484)
• GH-1486: Keep passing health diagnostics concise by default (pm-gh1486)
• GH-1489: Keep all-status list filters independent of field projection (pm-gh1489)
• GH-1482: Read legacy dependency timestamps safely and diagnose invalid values (pm-gh1482)
• GH-1481: Retain explicitly requested sort values in brief list projections (pm-gh1481)

Other

• Adopt immutable TruffleHog 3.98.0 after the release-age boundary (pm-38w3ii)
• Renew pinned pnpm Windows shell-launcher compatibility after dependency cooldown (pm-rnpmtp)
• Refresh compatible Sentry 10.76.2 observability patch (pm-wejmmy)
• Refresh seven-day-eligible Greptile 3.6.2 review tooling (pm-8jhc84)
• Qualify real-baseline checks and packed concurrent-create acceptance across runtimes (pm-58zon0)
• Refresh eligible October 17 dependencies with SDK codec compatibility proof (pm-ul0ow4)

Commits

• dbccf03 chore(release): cut 2026.10.19
• 5a62ab1 Merge pull request #1499 from unbraind/fix/sdk-merge-settlement-safety
• 3614687 fix(merge): authenticate unreplaced indexed receipt objects
• bfd3b2d fix(merge): batch indexed evidence and bind settlement to physical paths
• 91a3b80 fix(merge): authenticate indexed receipts before writing audit history
• 76b5462 fix(sdk): make lossless merge settlement portable and reviewable
• 96f3302 fix(cli): unify output aliases and canonical guidance (#1498)
• 2c6f791 chore(release): cut 2026.10.18
• d72bb86 fix(release): retain complete peer bundles and renew native tooling
• 75bd740 fix(history): preserve writer progress and complete SDK event snapshots (#1493)
• Additional commits viewable in compare view

Updates pm-changelog from 2026.10.16 to 2026.10.19

Release notes

Sourced from pm-changelog's releases.

pm-changelog v2026.10.19

No release notes provided.

pm-changelog v2026.10.19-1

2026.10.19-1 - 2026-10-19

Fixed

• Publish same-day calendar suffixes with an explicit latest dist-tag (pmc-udb5)
• Request the full list projection explicitly for whole-tracker changelog reads (pmc-zfyb)

pm-changelog v2026.10.17

No release notes provided.

Changelog

Sourced from pm-changelog's changelog.

Changelog

2026.10.19-1 - 2026-10-19

Fixed

• Publish same-day calendar suffixes with an explicit latest dist-tag (pmc-udb5)
• Request the full list projection explicitly for whole-tracker changelog reads (pmc-zfyb)

2026.10.14 - 2026-10-14

Fixed

• Preserve shipped entries when completed items are reopened and closed again (pmc-reopened-history)

2026.10.12 - 2026-10-12

Added

• Changelog entries can use resolution prose, and --check warns about defect-shaped titles (pmc-d3ds)

Fixed

• Refuse explicit partial-read envelopes supplied to changelog generation (pmc-n4qu)
• Make node-entrypoint fixture teardown reliable (pmc-node-teardown-226)

2026.10.5 - 2026-10-05

Fixed

• Keep installed usage documentation links portable and the dependency-updates table row valid (pmc-mwnu)

Other

• Auto-merge green Dependabot updates and group the pm toolchain into one daily PR (pmc-y0a5)

2026.9.25 - 2026-09-25

Added

• Add opt-in Dependabot dependency sections so item-less release windows still get notes (pmc-ny9i)

Fixed

• Include extension-registered item types in changelog generation and body previews (pmc-k1oq)
• A publish that npm accepts late is reported as failed and the GitHub Release is skipped on bun mirror lag (pmc-piam)

Other

• Certify pm CLI 2026.9.23 and adopt the guarded pm-ops merge-driver launcher (pmc-pcax)

... (truncated)

Commits

• cd60a26 Release pm-changelog v2026.10.19
• 6273a9b chore(deps-dev): bump the pm-toolchain group with 2 updates (#255)
• 17f2f7a chore(deps-dev): bump the pm-toolchain group across 1 directory with 2 update...
• b9c91c5 Keep the release version regex readable by the workflow auditor (#254)
• 4711012 Release pm-changelog v2026.10.17
• f190da3 chore(deps): bump the codeql-action group with 2 updates (#252)
• 584c621 Repin gated sync to pm-github 2026.10.16 and add the daily gated closeout cal...
• See full diff in compare view

Updates pm-ops from 2026.10.16 to 2026.10.19

Commits

• c3af218 Release pm-ops v2026.10.19
• 61bda59 chore(deps-dev): bump the pm-toolchain group with 2 updates (#181)
• 298461d Release pm-ops v2026.10.18
• 5baf921 chore(deps): bump the codeql-actions group with 2 updates (#179)
• 5194c35 Release pm-ops v2026.10.17
• 2ea3939 Freeze merge-driver bootstrap and accept released launcher copies (#177)
• 5cc0b8f Repin gated sync to pm-github 2026.10.16 and add the daily gated closeout cal...
• See full diff in compare view

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 4c88d439-6012-4933-a1d0-04f91f33259c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[unbraind]

Bounded hosted-CI diagnosis for exact PR head 14a84cc:

The current Node 22 job fails for two existing compatibility causes, not a newly established data-loss defect:

1. The merge-driver prepare launcher is still tested using byte equality against the newer pm-ops template. The existing backwards-compatible remedy is pm-ops #177, exporting assertCanonicalLauncher from pm-ops/launcher-check.
2. The changelog invocation fails closed with omission_receipt.has_omissions=true despite count=total of 1/1 or 2/2 and unbounded output budget/limit. This matches the already-closed pmc-zfyb canonical item, delivered by pm-changelog #256: pm-cli 2026.10.18 requires list-local --full for full item projection. An unbounded amount/cost budget does not request full projection. This dependency PR still pins pm-changelog 2026.10.17.

Acceptance: adopt the existing launcher validation and full-projection repairs; rerun both supported Node jobs; verify changelog execution succeeds with the complete fields and retains fail-closed behavior when fields really are omitted. Do not remove the completeness check or merely raise output limits.

Evidence limits: exact hosted logs and canonical source records, not an independent local end-to-end reproduction. No core/runtime mutation failure is inferred, and no additional upstream issue is needed for these existing causes.

[unbraind]

@dependabot recreate

[unbraind]

@dependabot recreate