v2026.10.7

@unbrained/pm-cli 2026.10.7

Source range: v2026.10.6...v2026.10.7

Changelog

Fixed

• GH-1417: Bundle the tested CLI runtime closure for reproducible npm and Bun installs (pm-gh1417)
• GH-1418: Accept real Bun filtered-test execution receipts (pm-gh1418)
• Prose graph census misses valid item identifiers with multiple hyphens (pm-axotea)
• Include body-only references in strict workspace assurance context (pm-jprn58)
• GH-1413: Preserve lossless producer cursors under amount-only output caps (pm-gh1413)
• GH-1414/GH-1415: Restore portable schema and checksum nightly fixtures (pm-gh1414)
• Expose typed explicit-ID duplicate creation conflicts to SDK callers (pm-gh1400)

Security

• Remove vulnerable MCP Apps development client from the locked dependency tree (GHSA-6qxp-vccf-f47h) (pm-mcpoauth)

Other

• Deliver canonical strict-create, claim-start and scoped init recovery (pm-flfk2d)

PM Tracker Evidence

Closed pm items in release window: 9
By type: Issue=8, Task=1
By status: closed=9

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.