v2026.10.21

@unbrained/pm-cli 2026.10.21

Source range: v2026.10.20...v2026.10.21

Changelog

Fixed

• Return a typed assurance refusal for unknown declaration reads instead of high-priority Sentry faults (pm-eg5u1n)
• Patch MCP client redirect disclosure and Vite Windows editor injection advisories (pm-5sgx37)
• Bound Windows script regression admission with complete deterministic shards (pm-vqwery)
• Scorecard alert 29: patch newly disclosed follow-redirects credential-header vulnerabilities (pm-px2raj)
• GH-1518: recover provably dead same-host item-lock owners before TTL expiry (pm-02z97f)
• Replace unsafe live-lock force advice with invocation-preserving contention recovery (pm-htiwmd)
• GH-1520: reject unknown SDK mutation option keys before any write (pm-fl3phm)
• GH-1519: preflight test run options before persisting linked-test edits (pm-hdvxqg)
• GH-1507: Explain effective default list ordering in brief rows and metadata (pm-zd46m7)
• GH-1514: injected extension SDK client loses invocation author precedence (pm-65srr0)
• GH-1511: keep blocked work prioritization inside context cursor page boundaries (pm-0luwp4)
• GH-1510: make relationship packet cursor recovery command-aware (pm-ohgg1b)
• GH-1512: define count-based context completion rounding at half-percent boundaries (pm-r2xv95)
• GH-1509: preserve legacy relationship blocker details in deep context (pm-h5ko1l)

Other

• Complete bounded discovery and read-only recovery proof for missing assurance declarations (pm-l6bpb8)
• Expose freshness and completeness of independent dependency advisory feeds before merge (pm-eqxjzl)
• Schedule corpus and policy fixture keepers after parallel contract workers (pm-ckb8w5)

PM Tracker Evidence

Closed pm items in release window: 17
By type: Issue=14, Task=3
By status: closed=17

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.