chore(deps-dev): bump @unbrained/pm-cli from 2026.7.22 to 2026.7.24

[dependabot]

Bumps @unbrained/pm-cli from 2026.7.22 to 2026.7.24.

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.7.23

@​unbrained/pm-cli 2026.7.23

Source range: v2026.7.22...v2026.7.23

Changelog

Added

• SDK relationship registry and graph-query primitives: custom typed edges, adjacency, paths, closures, impact, and bounded subgraphs (pm-ju83)
• Context relevance signal feature store: derived recency, graph, claim, risk, deadline, knowledge-density, and semantic-match signals (pm-3hps)

Fixed

• GH-646: classify merge reconciliation discards by net outcome (pm-mmm9o5)
• GH-649: reject self-referential ordering relationships at the SDK mutation boundary (pm-k9t17l)
• GH-645: standard-depth get/show JSON omits notes without notes_count (pm-3esl28)
• GH-638: delete JSON envelope reports the removed item as open (pm-tz2ikr)
• GH-635: plan create cannot forward strict Plan-required metadata (pm-qd3woa)
• GH-642: linked-test runner enters interactive init wizard before repository commands (pm-lcnk2n)
• GH-641: plan link promotion rejects registered implements relationship kind (pm-ypuc39)

Other

• Capstone: zero the SDK import-boundary baseline — flip remaining CLI/MCP private-core imports to SDK primitives and harden the ratchet into a hard boundary gate (pm-9x6e)

PM Tracker Evidence

Closed pm items in release window: 15 By type: Issue=8, Feature=3, Plan=2, Task=2 By status: closed=15

Selected release-related tracker items:

• pm-cvwi [Feature/closed] Comments shorthand compatibility and docs parity

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.7.24 - 2026-07-24

Added

• pm validate needs a counts-only projection so agents can read drift numbers without row-array payloads (pm-a9mc)
• GH-445: suppress/factor repeated inherited tags in pm context rows (--no-tags + tag folding) (pm-ishm)
• NDJSON output mode: --format ndjson on list/search/context emits one JSON object per line for grep/jq/xargs pipelines (pm-646c)
• Workspace-scoped audit history stream: schema/config/profile/init mutations recorded as append-only hash-chained JSONL (pm-klo8)
• Schema evolution migrations: lossless, history-recorded bulk migration of existing items when custom types, fields, or statuses are renamed or retired (pm-dijg)
• Beyond-PM SDK exemplar phase 2: temporal digital-twin graph with entity relationships, event replay, point-in-time state, and invariants (pm-kr3t)
• Bounded SQLite metadata list reads and compact get child continuations (pm-px153l)
• Workspace memory tiers: derived rollup summaries of closed-item epochs keep decades-old work queryable in bounded tokens (pm-5qmm)

Fixed

• pm deps tree must remain bounded on cyclic deep relationship graphs (pm-gygna8)
• GH-449: contracts policy_modes advertises 'enforce' but governance config accepts 'strict' (contract drift) (pm-kjbh)
• Scoped renderer ownership: safe package renderers should not keep isolated package doctor in warning state (pm-nf7q)
• Extension flag value-arity decided by three divergent predicates in cli/extension-command-help.ts - help, parse, and summary surfaces can disagree (pm-853a)
• Post-install activation verification can load stale overwritten extension modules (pm-4v4c)
• Relationship timestamp snapshots must honor event time for late and offline arrivals (pm-j3swnb)

Security

• Extension install: untrusted manifest dependency specs reach npm install unvalidated (arg injection all-OS; shell command injection on Windows) (pm-g072)
• CodeQL alert 30: polynomial ReDoS in shared path normalization primitive (pm-v3zd3o)

Other

• SDK reference documentation for promoted primitives + migration notes for the CLI-on-SDK layering (pm-ds3b)
• SDK authoring DX polish: manifest-drift guard in scaffold tests, expectation key naming, repeated --capability, define* index signatures (pm-llrp)
• Extension install should scaffold newly required item-type folders (pm health ok:false after installing pm-kanban until pm init) (pm-l98s)
• Cursor fingerprints: replace per-command presentation-flag deny-lists with contract-declared semantic classification in sdk/pagination (pm-fgih)

2026.7.23 - 2026-07-23

Added

• SDK relationship registry and graph-query primitives: custom typed edges, adjacency, paths, closures, impact, and bounded subgraphs (pm-ju83)
• Context relevance signal feature store: derived recency, graph, claim, risk, deadline, knowledge-density, and semantic-match signals (pm-3hps)

Fixed

• GH-646: classify merge reconciliation discards by net outcome (pm-mmm9o5)
• GH-649: reject self-referential ordering relationships at the SDK mutation boundary (pm-k9t17l)
• GH-645: standard-depth get/show JSON omits notes without notes_count (pm-3esl28)
• GH-638: delete JSON envelope reports the removed item as open (pm-tz2ikr)
• GH-635: plan create cannot forward strict Plan-required metadata (pm-qd3woa)
• GH-642: linked-test runner enters interactive init wizard before repository commands (pm-lcnk2n)
• GH-641: plan link promotion rejects registered implements relationship kind (pm-ypuc39)

... (truncated)

Commits

• db1b711 chore(release): cut 2026.7.24
• ca35233 feat(sdk): bounded streaming context and graph projections (#662)
• 26946b5 docs(pm): record PR 660 merged-head proof
• a894a8b Merge pull request #660 from unbraind/feat/sdk-schema-evolution-contracts
• a759268 fix(sdk): serialize workspace audit transactions
• 15c7444 feat(sdk): add resumable schema evolution and workspace audit history
• 9b079a5 SDK extension authoring, trust boundaries, and scoped rendering (#657)
• 4544cb7 feat(sdk): temporal digital-twin context engine (#656)
• f70526f feat(sdk): indexed reads, workspace memory, and cursor contracts (#655)
• 221980a docs(pm): record v2026.7.23 release proof (#654)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Upgrade @unbrained/pm-cli to 2026.7.24 to pick up security fixes and new CLI features for data export and workspace auditing. This affects dev tooling only.

• Dependencies
  • Bumps @unbrained/pm-cli 2026.7.22 → 2026.7.24.
  • Includes security fixes (extension install arg injection; path normalization ReDoS) and multiple bug fixes.
  • Adds NDJSON output, workspace audit history, and schema evolution migrations; lockfile pulls in npm-package-arg and related deps.

^{Written for commit e653a0a. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.