v2026.10.22

@unbrained/pm-cli 2026.10.22

Source range: v2026.10.21...v2026.10.22

Changelog

Fixed

• MCP create drops advertised metadata outside its small top-level allowlist (pm-ap7ilf)
• Validate declared MCP boolean options before mutation normalization (pm-7qg4jz)
• Reject mixed-type MCP mutation arrays before CSV normalization (pm-gllxud)
• GH-1539: enforce command builder keys and preserve literal types (pm-gh1539)
• GH-1538: refuse or honor supplied MCP update fields before reporting success (pm-gh1538)
• GH-1535: report context test health over the matching population (pm-gh1535)
• GH-1534: retain root relationship evidence before optional context detail (pm-gh1534)
• Render literal and root-layout tracker paths safely in SDK cache ignore rules (pm-47wuv8awpqvj)
• GH-1532: preserve every tracker cache exclusion when nested init shares a repository (pm-nl60tbxzkjwp)
• GH-1528: recover completeness and TOON mistakes on the attempted read command (pm-7gpx34)
• Model session-suppressed row references in public SDK result types (pm-t1p1jv)
• Preserve budget omission types across union SDK option shapes (pm-jqgkis)
• Align SDK producer-continuation result types with sparse reference envelopes (pm-oybmsd)

Security

• Retain dependency advisory failure evidence in CI (pm-ciadvisoryreceipt)
• Patch Vitest Windows backslash redirect traversal (pm-vitestredirect)
• Patch Vitest manual-mock registration code injection (pm-vitestmanual)
• GH-1530: dependency advisory CLI silently skips checks through filesystem aliases (pm-tl7vlu)

Other

• Keep omitted SDK read options as precise first-page results (pm-qal1uw)
• Schedule the context decision corpus keeper after parallel contract workers (pm-j2vwbh)

PM Tracker Evidence

Closed pm items in release window: 23
By type: Issue=19, Task=4
By status: closed=23

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.