build(deps-dev): bump @unbrained/pm-cli from 2026.9.23 to 2026.9.30

[dependabot]

Bumps @unbrained/pm-cli from 2026.9.23 to 2026.9.30.

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.9.30

@​unbrained/pm-cli 2026.9.30

Source range: v2026.9.29...v2026.9.30

Changelog

Fixed

• Registry install acceptance loses subprocess timeout and signal evidence and labels every failure as registry availability (pm-q7c36n)
• Bun merge-driver installation disagrees with strict health (pm-vks66s)
• Expose host-bound audited workspace settings mutation to extension commands (pm-wtqltn)
• Full-item stdin JSON update silently ignores edited notes (pm-2589e6)

PM Tracker Evidence

Closed pm items in release window: 4 By type: Issue=4 By status: closed=4

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.

v2026.9.29

@​unbrained/pm-cli 2026.9.29

Source range: v2026.9.28...v2026.9.29

Changelog

Fixed

• GH-1340: pm duplicates treats UTF-8 prose as a 0.99 issue-code match (pm-1ieq24)
• Persist revised linked evidence notes while preserving idempotent retries (pm-zqxlfs)
• Bound Plan mutation receipts while preserving full inspection (pm-hqy7lr)

Deprecated

• Alias-usage counters: measure deprecated-spelling hits so grammar-freeze removals are evidence-based (pm-0mox)
• Extension activation attributes canonical full-list projection to deprecated --full (pm-8uwigr)

Other

• Replay each history state once: reuse the previous entry's digest as the next before-hash, stop at the first matching hash epoch, and drop the second document clone (pm-hen0t6)

PM Tracker Evidence

Closed pm items in release window: 6 By type: Issue=4, Task=2 By status: closed=6

... (truncated)

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.9.30 - 2026-09-30

Fixed

• Registry install acceptance loses subprocess timeout and signal evidence and labels every failure as registry availability (pm-q7c36n)
• Bun merge-driver installation disagrees with strict health (pm-vks66s)
• Expose host-bound audited workspace settings mutation to extension commands (pm-wtqltn)
• Full-item stdin JSON update silently ignores edited notes (pm-2589e6)

2026.9.29 - 2026-09-29

Fixed

• GH-1340: pm duplicates treats UTF-8 prose as a 0.99 issue-code match (pm-1ieq24)
• Persist revised linked evidence notes while preserving idempotent retries (pm-zqxlfs)
• Bound Plan mutation receipts while preserving full inspection (pm-hqy7lr)

Deprecated

• Alias-usage counters: measure deprecated-spelling hits so grammar-freeze removals are evidence-based (pm-0mox)
• Extension activation attributes canonical full-list projection to deprecated --full (pm-8uwigr)

Other

• Replay each history state once: reuse the previous entry's digest as the next before-hash, stop at the first matching hash epoch, and drop the second document clone (pm-hen0t6)

2026.9.28 - 2026-09-28

Fixed

• Allow self-isolating linked package tests without inherited PM_PATH (pm-t05d8d)
• Preserve every tracker merge fence during nested init and detect lost active mappings (pm-kynkl8)
• GH-1325: history diff cursor drops newest rows and strands the final page (pm-c3aiik)
• Windows nightly merge-receipt classification test exceeds 60-second budget (pm-v0600g)
• GH-1327: Windows nightly static inventory unreadable-source assertion fails (pm-ft90q2)
• GH-1326: Windows nightly bundled-package init test exceeds 30 seconds (pm-kvhnb5)
• MCP detached task completion coverage can miss cleanup under hosted shards (pm-tm6h9x)
• Full coverage refusal-closure retry test exceeds its four-minute budget under suite contention (pm-mrrci4)
• GH-1328: linked-test execution does not disclose item evidence recording (pm-aao1hy)
• GH-1330: per-command JSON help inherits the root intent and init example (pm-s8ztcl)
• Refuse malformed settings writes with typed recovery (pm-z329kd)
• Refuse local package installation when source scan stops at entry limit (pm-erogk1)

Security

• Exclude Git metadata from local package directory installs (pm-k7nxaz)

Other

• Refresh September 27 compatible development dependency releases (pm-u9qqip)

... (truncated)

Commits

• 344aa7b chore(release): cut 2026.9.30
• d56cae9 Merge pull request #1350 from unbraind/fix/release-origin-and-install-diagnos...
• d28153f fix(release): keep dispatcher timing separate from native cron
• dc9b60e fix(release): recognize Bun registry 404 diagnostics
• 1d2443f fix(release): preserve exact-tag recovery and complete redaction
• 1a4ab2f fix(release): preserve install failure evidence and attribute daily dispatches
• bbfa428 Audit extension settings and item JSON updates; repair Bun merge drivers (#1348)
• db52e3f chore(release): cut 2026.9.29
• 12e92af Track stdin note updates, extension settings audit, and Bun merge drift (#1347)
• dfc6d9d Merge pull request #1344 from unbraind/feat/alias-provenance-and-usage-metrics
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps the @unbrained/pm-cli dev dependency from 2026.9.23 to 2026.9.30, covering several bug fixes in the release notes. The transitive @sentry/* packages also move from 10.75.0 to 10.75.1 as part of this update.

^{Written for commit 981bcc3. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d55352c2-11ec-4116-9f61-ec4a16a4ac8c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[unbraind]

Superseded by #132, which carries this update together with the PM CLI 2026.10.4 certification.

[dependabot]

Looks like @unbrained/pm-cli is up-to-date now, so this is no longer needed.