[dependabot]

Bumps the pm-toolchain group with 2 updates in the / directory: pm-changelog and pm-ops.

Updates pm-changelog from 2026.10.19 to 2026.10.26

Release notes

Sourced from pm-changelog's releases.

pm-changelog v2026.10.26

2026.10.26 - 2026-10-26

Added

• Compile ordered consumer upgrade obligations across releases (pmc-consumer-upgrades)

pm-changelog v2026.10.25

2026.10.25 - 2026-10-25

Added

• Publish audience-specific change contracts with shared attribution (pmc-audience-contracts)
• Generate release notes from immutable tracker milestones (pmc-tracker-milestones)
• Audit every generated release claim against recorded evidence (pmc-claim-evidence)

Other

• Correct tracker reconciliation review evidence (pmc-review-266)
• Release readiness hardening for pm-changelog (pmc-14cx)
• Bump @​unbrained/pm-cli SDK to >=2026.5.24 (pmc-cfhf)

pm-changelog v2026.10.24

No release notes provided.

pm-changelog v2026.10.23

2026.10.23 - 2026-10-23

Changed

• Adopt pm-github 2026.10.16: default-branch-safe gated sync and daily gated closeout PRs (pmc-6edv)
• Enable the gated GitHub issue sync (pmc-ctr2)

Fixed

• Track merge receipts so pm 2026.10.19+ can settle lossless merges (pmc-pnaq)
• A release run bumped and committed a new version every night while publishing was impossible, and the changelog-date verifier was never invoked by a gate (pmc-3u78)
• Let an item supply a release note the changelog prefers over its defect-shaped title (pmc-fzs6)
• Harden the release merge wait against mergeStateStatus deadlock (pmc-blj6)
• A test asserts an error that only occurs when no package.json exists anywhere above the OS temp directory, so it fails on a host where one does (pmc-6eau)
• List closed issues under Fixed only when a repair is recorded (pmc-txk1)
• This package generates its own changelog without the flag that stops the heading date coming from the clock (pmc-q22j)
• Link custom-type items to their registered tracker folders (pmc-rspo)
• The release job authenticated with a stored npm token that expired, so publishing stopped while every other gate stayed green (pmc-4xu9)

Security

• Consume the canonical attestation gate instead of carrying a copy of it (pmc-wf7n)

Other

... (truncated)

Changelog

Sourced from pm-changelog's changelog.

2026.10.26 - 2026-10-26

Added

• Compile ordered consumer upgrade obligations across releases (pmc-consumer-upgrades)

2026.10.25 - 2026-10-25

Added

• Publish audience-specific change contracts with shared attribution (pmc-audience-contracts)
• Generate release notes from immutable tracker milestones (pmc-tracker-milestones)
• Audit every generated release claim against recorded evidence (pmc-claim-evidence)

Other

• Correct tracker reconciliation review evidence (pmc-review-266)
• Release readiness hardening for pm-changelog (pmc-14cx)
• Bump @​unbrained/pm-cli SDK to >=2026.5.24 (pmc-cfhf)

2026.10.23 - 2026-10-23

Changed

• Adopt pm-github 2026.10.16: default-branch-safe gated sync and daily gated closeout PRs (pmc-6edv)
• Enable the gated GitHub issue sync (pmc-ctr2)

Fixed

• Track merge receipts so pm 2026.10.19+ can settle lossless merges (pmc-pnaq)
• A release run bumped and committed a new version every night while publishing was impossible, and the changelog-date verifier was never invoked by a gate (pmc-3u78)
• Let an item supply a release note the changelog prefers over its defect-shaped title (pmc-fzs6)
• Harden the release merge wait against mergeStateStatus deadlock (pmc-blj6)
• A test asserts an error that only occurs when no package.json exists anywhere above the OS temp directory, so it fails on a host where one does (pmc-6eau)
• List closed issues under Fixed only when a repair is recorded (pmc-txk1)
• This package generates its own changelog without the flag that stops the heading date coming from the clock (pmc-q22j)
• Link custom-type items to their registered tracker folders (pmc-rspo)
• The release job authenticated with a stored npm token that expired, so publishing stopped while every other gate stayed green (pmc-4xu9)

Security

• Consume the canonical attestation gate instead of carrying a copy of it (pmc-wf7n)

Other

• Record pi-land-a merge-readiness verification pass for PR 215 (pmc-wgte)
• Certify pm-changelog on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates (pmc-38z4)

2026.10.19-1 - 2026-10-19

... (truncated)

Commits

• 62833a1 Release pm-changelog v2026.10.26
• 0b43eb3 Redact package-scan diagnostics and reject sensitive member names (#289)
• ce504e1 Point the npm homepage at the package catalog and link the author (#284)
• 954b2a1 Keep internal certification records and local paths out of the npm package (#...
• 206e576 Make every command's help match its accepted flags (#283)
• 81208e2 chore(deps-dev): bump the pm-toolchain group with 2 updates (#282)
• 17fc812 Use the pm SDK for complete changelog tracker reads (#280)
• fa8a8a1 Close the consumer upgrade obligations feature delivered by #278 (#279)
• 033afef Compile consumer upgrade actions once in prerequisite order (#278)
• e53da92 Release pm-changelog v2026.10.25
• Additional commits viewable in compare view

Updates pm-ops from 2026.10.19 to 2026.10.26

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.10.26

Changelog

2026.10.26 - 2026-10-26

Fixed

• Every published release needs exactly one changelog section, including releases with no tracked items (ops-changelog-sections)

pm-ops v2026.10.25

Changelog

2026.10.25 - 2026-10-25

Added

• Run reviewed read-only diagnostic plans within explicit budgets (ops-diagnostic-plans)
• Invalidate only operational claims whose evidence expires or whose scoped versions change (ops-evidence-expiry)
• Report verified backend SDK capabilities without tracker writes (ops-backend-capability)

Fixed

• Honor metrics JSON format and document verified registry activation (ops-install-routes-1022)
• Refuse unsafe diagnostic and artifact inputs before reading (ops-bounded-input)

2026.10.23 - 2026-10-23

Added

• Freeze the merge-driver launcher and accept every released launcher revision (ops-m82r)
• One reusable daily release workflow for fleet packages (ops-reusable-daily-release)

Changed

• Enable the gated pm-github issue sync and remove the braces chain (ops-gated-issue-sync)
• Adopt pm-github 2026.10.16: default-branch-safe gated sync and daily gated closeout PRs (ops-l7gb)

Fixed

• A release run bumped and committed a new version every night while publishing was impossible, because the only externally-failable step runs last (ops-e9g6)
• Fix release publish-before-protected-main-push ordering (ops-gitr)
• A parenthesised command inside a case arm is read as an arm label, refusing a publish the shell attests (ops-vkvy)
• Self-hosted pm-changelog is reported not ready because it does not depend on itself (ops-pksh)
• Adding a source file breaks the coverage gate in three places, and none of them says so (ops-cl0o)
• Recognize third-party publish wrappers (semantic-release, np, release-it, lerna publish, changeset publish) in the canonical attestation auditor (ops-third-party-publish-wrappers)
• A hardcoded fixture date aged out of the seven day window and broke the daily release (ops-i2iz)
• The release completeness audit reported a published version and its GitHub Release as missing, turning a successful release into a failed one (ops-fcow)
• Guarded merge-driver launcher: omit-dev clone installs complete instead of failing on the devDependency import (ops-mqdi)
• Duplication gate scans generated PM extension copies (ops-to4t)
• ops verify-release times out on real full package gate after five minutes (ops-3xyb)

... (truncated)

Changelog

Sourced from pm-ops's changelog.

2026.10.26 - 2026-10-26

Fixed

• Every published release needs exactly one changelog section, including releases with no tracked items (ops-changelog-sections)

2026.10.25 - 2026-10-25

Added

• Run reviewed read-only diagnostic plans within explicit budgets (ops-diagnostic-plans)
• Invalidate only operational claims whose evidence expires or whose scoped versions change (ops-evidence-expiry)
• Report verified backend SDK capabilities without tracker writes (ops-backend-capability)

Fixed

• Honor metrics JSON format and document verified registry activation (ops-install-routes-1022)
• Refuse unsafe diagnostic and artifact inputs before reading (ops-bounded-input)

2026.10.24 - 2026-10-24

No tracked changes.

2026.10.23 - 2026-10-23

Added

• Freeze the merge-driver launcher and accept every released launcher revision (ops-m82r)
• One reusable daily release workflow for fleet packages (ops-reusable-daily-release)

Changed

• Enable the gated pm-github issue sync and remove the braces chain (ops-gated-issue-sync)
• Adopt pm-github 2026.10.16: default-branch-safe gated sync and daily gated closeout PRs (ops-l7gb)

Fixed

• A release run bumped and committed a new version every night while publishing was impossible, because the only externally-failable step runs last (ops-e9g6)
• Self-hosted pm-changelog is reported not ready because it does not depend on itself (ops-pksh)
• Adding a source file breaks the coverage gate in three places, and none of them says so (ops-cl0o)
• Recognize third-party publish wrappers (semantic-release, np, release-it, lerna publish, changeset publish) in the canonical attestation auditor (ops-third-party-publish-wrappers)
• The release completeness audit reported a published version and its GitHub Release as missing, turning a successful release into a failed one (ops-fcow)
• Guarded merge-driver launcher: omit-dev clone installs complete instead of failing on the devDependency import (ops-mqdi)
• Duplication gate scans generated PM extension copies (ops-to4t)
• ops verify-release times out on real full package gate after five minutes (ops-3xyb)
• Preserve launcher resolution errors when presence probes fail (ops-85at)
• Keep multi-line quoted strings open in the publish-attestation scanner (ops-attestation-multiline-quotes)
• The release job authenticated with a stored npm token that expired, so publishing stopped while every other gate stayed green (ops-cenj)

Other

... (truncated)

Commits

• 32ecf1e Release pm-ops v2026.10.26
• c641cd2 Point the npm homepage at the package catalog and link the author (#214)
• ae658cf chore(deps-dev): bump jscpd (#213)
• 1ceb53b Reduce shared diagnostic failures to minimal evidence packets (#210)
• 11607ad Use SDK corpus reads for backend assurance and diagnostics (#208)
• 2f28e15 Close the changelog-section issue delivered by #205 (#207)
• 36478d7 Keep one changelog section per published release (#205)
• b2048f3 Release pm-ops v2026.10.25
• 7940aa5 chore(deps): bump taiki-e/install-action from 2.87.29 to 2.87.30 (#203)
• 8a7af48 chore(deps): bump unbraind/pm-github/.github/workflows/pm-github-closeout.yml...
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e84dcfb9-11c1-4867-9a21-edcb04848cc9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}